From 14d6e216f69b6b2a78db6bdc6fa0f7c93a3e6bed Mon Sep 17 00:00:00 2001
From: nginx-seanmoloney <133861979+nginx-seanmoloney@users.noreply.github.com>
Date: Fri, 6 Jun 2025 10:57:03 +0100
Subject: [PATCH 001/117] Update instructions for upgrading NGINX Agent (#648)

* Update instructions for upgrading NGINX Agent

* PR feedback

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* PR feedback

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* PR feedback

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

---------

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
---
 content/agent/installation-upgrade/upgrade.md | 57 ++++++++++---------
 1 file changed, 30 insertions(+), 27 deletions(-)

diff --git a/content/agent/installation-upgrade/upgrade.md b/content/agent/installation-upgrade/upgrade.md
index 50477e94b..cd11db359 100644
--- a/content/agent/installation-upgrade/upgrade.md
+++ b/content/agent/installation-upgrade/upgrade.md
@@ -12,9 +12,7 @@ type:
 
 Learn how to upgrade NGINX Agent.
 
-## Upgrade NGINX Agent from version v2.31.0 or greater
-
-{{< note >}} Starting from version v2.31.0, NGINX Agent will automatically restart itself during an upgrade. {{< /note >}}
+## Upgrade NGINX Agent
 
 To upgrade NGINX Agent, follow these steps:
 
@@ -41,43 +39,48 @@ To upgrade NGINX Agent, follow these steps:
         sudo apt-get install -y --only-upgrade nginx-agent -o Dpkg::Options::="--force-confold"
         ```
 
+## Upgrade NGINX Agent to a Specific Version 
 
+To upgrade NGINX Agent to a specific **v2.x version**, follow these steps: 
 
-## Upgrade NGINX Agent from a version less than v2.31.0
-
-To upgrade NGINX Agent, take the following steps:
+#### Steps to Upgrade: 
 
-1. Open an SSH connection to the server where you’ve installed NGINX Agent and log in.
+1. Open an SSH connection to the server running  NGINX Agent and log in.
 
-1. Make a backup copy of the following locations to ensure that you can successfully recover if the upgrade has issues:
+1. Back up the following files and directories to ensure you can restore the environment in case of issues during the upgrade: 
 
     - `/etc/nginx-agent`
-    - `config_dirs` values for any configuration specified in `/etc/nginx-agent/nginx-agent.conf`
-
-1. Stop NGINX Agent:
+    - Any `config_dirs` directory specified in `/etc/nginx-agent/nginx-agent.conf`.
 
-    ```shell
-    sudo systemctl stop nginx-agent
-    ```
-
-1. Install the updated version of NGINX Agent:
-
-    - CentOS, RHEL, RPM-Based
+1. Perform the version-controlled upgrade. 
 
+   - Debian, Ubuntu, Deb-Based
+        
         ```shell
-        sudo yum -y makecache
-        sudo yum update -y nginx-agent
+        sudo apt-get update
+        sudo apt-get install -y nginx-agent=<specific-version> -o Dpkg::Options::="--force-confold"
         ```
-
-    - Debian, Ubuntu, Deb-Based
-
+        
+        Example (to upgrade to version 2.41.1~noble): 
+        
         ```shell
-        sudo apt-get update
-        sudo apt-get install -y --only-upgrade nginx-agent -o Dpkg::Options::="--force-confold"
+        sudo apt-get install -y nginx-agent=2.41.1~noble -o Dpkg::Options::="--force-confold"
         ```
 
-1. Start NGINX Agent:
+    - CentOS, RHEL, RPM-Based        
+       
+        ```shell
+        sudo yum install -y nginx-agent-<specific-version>
+        ```
+        
+        Example (to upgrade to version `2.41.1`): 
+    
+        ```shell
+        sudo yum install -y nginx-agent-2.41.1
+        ```
 
+1. Verify the installed version:    
+    
     ```shell
-    sudo systemctl start nginx-agent
+    sudo nginx-agent --version
     ```

From 39aed75510db87ea491b4bf18e98d599b4de2288 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Fri, 6 Jun 2025 11:19:41 -0700
Subject: [PATCH 002/117] Add custom landing page to N1 via index.md (#636)

* feat: Add custom landing page to N1 via index.md

* Removed list-main

* Finish adding all the custom content for N1 landing page

* Added changelog shortcode to Changelog card
---
 content/nginx-one/_index.md     |  65 +++++++++++++++++
 layouts/partials/list-main.html | 119 --------------------------------
 2 files changed, 65 insertions(+), 119 deletions(-)
 delete mode 100644 layouts/partials/list-main.html

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index 21284cbf0..27bf8dbfe 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -2,7 +2,72 @@
 title: F5 NGINX One Console
 description: The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
 url: /nginx-one/
+hasCustomContent: true
 cascade:
   logo: "NGINX-One-product-icon.svg"
 ---
+{{< card-layout >}}
+  {{< card-section >}}
+    {{< card title="Manage your NGINX fleet" >}}
+      Simplify, scale, secure, and collaborate with your NGINX fleet 
+    {{</ card >}}
+    {{< card title="Get started" >}}
+      See benefits from the NGINX One Console
+    {{</ card >}}
+    {{< card title="Connect your instances" >}}
+      Work with data plane keys, containers, and proxy servers
+    {{</ card >}}
+    {{< card title="Manage your NGINX instances" >}}
+      Monitor and maintain your deployments
+    {{</ card >}}
+    {{< card title="Draft new configurations" >}}
+      Work with Staged Configurations
+    {{</ card >}}
+    {{< card title="Set up metrics" >}}
+      Review your deployments in a dashboard 
+    {{</ card >}}
+    {{< card title="Organize users with RBAC" >}}
+      Assign responsibilities with role-based access control 
+    {{</ card >}}
+    {{< card title="Automate with the NGINX One API" >}}
+      Manage your NGINX fleet over REST 
+    {{</ card >}}
+    {{< card title="Glossary" >}}
+      Learn terms unique to NGINX One Console 
+    {{</ card >}}
+    {{< card title="Changelog" >}}
+      {{< changelog-dates >}}
+    {{</ card >}}
+  {{</ card-section >}}
 
+  # Other Products 
+  {{< card-section title="Kubernetes Solutions">}}
+    {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" icon="NGINX-Ingress-Controller-product-icon">}}
+      Kubernetes traffic management with API gateway, identity, and observability features. 
+    {{</ card >}}
+    {{< card title="NGINX Gateway Fabric" titleUrl="/nginx-gateway-fabric" icon="NGINX-product-icon">}}
+      Next generation Kubernetes connectivity using the Gateway API. 
+    {{</ card >}}
+  {{</ card-section >}}
+  {{< card-section title="Local Console Option">}}
+    {{< card title="NGINX Instance Manager" titleUrl="/nginx-instance-manager" icon="NGINX-Instance-Manager-product-icon">}}
+      Track and control NGINX Open Source and NGINX Plus instances. 
+    {{</ card >}}
+  {{</ card-section >}}
+  {{< card-section title="Modern App Delivery">}}
+    {{< card title="NGINX Plus" titleUrl="/nginx" icon="NGINX-Plus-product-icon-RGB">}}
+      The all-in-one load balancer, reverse proxy, web server, content cache, and API gateway. 
+    {{</ card >}}
+    {{< card title="NGINX Open Source" titleUrl="nginx.org" icon="NGINX-product-icon">}}
+      The open source all-in-one load balancer, content cache, and web server 
+    {{</ card >}}
+  {{</ card-section >}}
+  {{< card-section title="Security">}}
+    {{< card title="NGINX App Protect WAF" titleUrl="/nginx-app-protect-waf" icon="NGINX-App-Protect-WAF-product-icon">}}
+      Lightweight, high-performance, advanced protection against Layer 7 attacks on your apps and APIs. 
+    {{</ card >}}
+    {{< card title="NGINX App Protect DoS" titleUrl="/nginx-app-protect-dos" icon="NGINX-App-Protect-DoS-product-icon">}}
+      Defend, adapt, and mitigate against Layer 7 denial-of-service attacks on your apps and APIs. 
+    {{</ card >}}
+  {{</ card-section >}}
+{{</ card-layout >}}
\ No newline at end of file
diff --git a/layouts/partials/list-main.html b/layouts/partials/list-main.html
deleted file mode 100644
index be455babf..000000000
--- a/layouts/partials/list-main.html
+++ /dev/null
@@ -1,119 +0,0 @@
-{{/*  TODO: Delete this page, and use the one from nginx-hugo-them  */}}
-<div class="list-page">
-    {{ $PageTitle := .Title }}
-    <div class="col-md-12 col-xl-12 py-md-3" style="margin-left: -1.75em;">
-        <div class="page-header list">
-            <h1 class="bd-title">
-                {{ .Title }}
-            </h1>
-            {{ if .Description }}
-                <p>
-                    {{ .Description | markdownify }}
-                </p>
-            {{ end}}
-            {{ if .Content }}
-                <p>
-                    {{ .Content | markdownify }}
-                </p>
-            {{ end }}
-        </div>
-    </div>
-
-    {{ if or (lt .WordCount 1) (eq $PageTitle "F5 NGINX One Console") (eq $PageTitle "F5 NGINX App Protect DoS") (eq $PageTitle "F5 NGINX Plus")  }}
-    <section>
-        <div class="row">
-            <div class="card-deck">
-                {{ range .Pages.GroupBy "Section" }}
-                    {{ range .Pages.ByWeight }}
-                    <div class="col-md-5 card">
-                        <div class="card-body">
-                            <h3 class="card-title" style="display: flex; align-items: center; gap: 5px;">
-                                <i class="fas fa-{{if eq .Kind "page"}}file-alt{{else}}book{{end}} fa-lg card-img-top"></i>
-                                <a href="{{ if .Params.url}}{{ .Params.url}}{{else}}{{ .Permalink }}{{end}}">{{ .Title }}</a>
-                            </h3>
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Manage your NGINX fleet")}}
-                                <p style="padding-bottom: 10px;">Simplify, scale, secure, and collaborate with your NGINX fleet </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Get started")}}
-                                <p style="padding-bottom: 10px;">See benefits from the NGINX One Console </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Draft new configurations")}}
-                                <p style="padding-bottom: 10px;">Work with Staged Configurations</p> 
-                            {{ end }}
-<!--                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Secure your fleet")}}
-                                <p style="padding-bottom: 10px;">Configure alerts that match your security policies </p> 
-                            {{ end }} -->
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Manage your NGINX instances")}}
-                                <p style="padding-bottom: 10px;">Monitor and maintain your deployments </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Organize users with RBAC")}}
-                                <p style="padding-bottom: 10px;">Assign responsibilities with role-based access control </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Automate with the NGINX One API")}}
-                                <p style="padding-bottom: 10px;">Manage your NGINX fleet over REST </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Glossary")}}
-                                <p style="padding-bottom: 10px;">Learn terms unique to NGINX One Console </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Connect your instances") }}
-                                <p style="padding-bottom: 10px;">Work with data plane keys, containers, and proxy servers </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Set up metrics") }}
-                                <p style="padding-bottom: 10px;">Review your deployments in a dashboard </p> 
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "API")}}
-                                <p style="padding-bottom: 10px;">These are API docs</p> <!-- Added text here -->
-                                <ul style="padding-top: 10px;">
-                                    {{ range .Pages }}
-                                        <li><a href="{{ .Permalink }}"> {{ .Title }}</a></li>
-                                    {{ end }}
-                                </ul>
-                            {{ end }}
-                            {{ if and (eq $PageTitle "F5 NGINX One Console") (eq .Title "Changelog") }}
-                                {{ partial "changelog-date.html" . }}
-                            {{ end }}
-                        </div>
-                    </div>
-                    {{ end }}
-                {{ end }}
-            </div>
-            {{ if eq $PageTitle "F5 NGINX One Console" }}
-                <h1 class="bd-title" style="margin-top: 15px;">Other Products</h1>
-                {{ $nginxProducts := slice 
-                    (dict "title" "NGINX Instance Manager" "url" "/nginx-instance-manager" "imgSrc" "NGINX-Instance-Manager-product-icon" "type" "local-console-option" "description" "Track and control NGINX Open Source and NGINX Plus instances.")
-                    (dict "title" "NGINX Ingress Controller" "url" "/nginx-ingress-controller" "imgSrc" "NGINX-Ingress-Controller-product-icon" "type" "kubernetes-solutions" "description" "Kubernetes traffic management with API gateway, identity, and observability features.")
-                    (dict "title" "NGINX Gateway Fabric" "url" "/nginx-gateway-fabric" "imgSrc" "NGINX-product-icon" "type" "kubernetes-solutions" "description" "Next generation Kubernetes connectivity using the Gateway API.")
-                    (dict "title" "NGINX App Protect WAF" "url" "/nginx-app-protect-waf" "imgSrc" "NGINX-App-Protect-WAF-product-icon" "type" "security" "description" "Lightweight, high-performance, advanced protection against Layer 7 attacks on your apps and APIs.")
-                    (dict "title" "NGINX App Protect DoS" "url" "/nginx-app-protect-dos" "imgSrc" "NGINX-App-Protect-DoS-product-icon" "type" "security" "description" "Defend, adapt, and mitigate against Layer 7 denial-of-service attacks on your apps and APIs.")
-                    (dict "title" "NGINX Plus" "url" "/nginx" "imgSrc" "NGINX-Plus-product-icon-RGB" "type" "modern-app-delivery"  "description" "The all-in-one load balancer, reverse proxy, web server, content cache, and API gateway.")
-                    (dict "title" "NGINX Open Source" "url" "https://nginx.org/en/docs/" "imgSrc" "NGINX-product-icon" "type" "modern-app-delivery" "description" "The open source all-in-one load balancer, content cache, and web server")
-                }}
-                {{ $groupedProducts := dict 
-                    "local-console-option" (where $nginxProducts "type" "local-console-option")
-                    "kubernetes-solutions" (where $nginxProducts "type" "kubernetes-solutions")
-                    "security" (where $nginxProducts "type" "security")
-                    "modern-app-delivery" (where $nginxProducts "type" "modern-app-delivery")
-                }}
-                {{ range $type, $products := $groupedProducts }}
-                <div class="card-deck">
-                    <p style="margin-left: 15px; width: 100%; font-weight: bold;">{{ $type | humanize | title }}</p>
-                    {{ range $products }}
-                        <div class="card" style="margin-top: 0px; {{ if eq (len $products) 1 }}max-width: calc(50% - 30px);{{ else }}min-width: 40%;{{ end }}">
-                            <div class="card-body">
-                                <h3 class="card-title" style="display: flex; align-items: center;">
-                                    <img class="card-img-top" src="{{ .Site.BaseURL }}/images/icons/{{ .imgSrc }}.png"/>
-                                <a href="{{ if eq .title "NGINX Open Source" }}{{ .url }}{{ else }}{{ .Site.BaseURL }}{{ .url }}{{ end }}">{{ .title }}</a>
-                                </h3>
-                                <p >
-                                    {{ if .description }}{{ .description | markdownify }}{{ end }}    
-                                </p>
-                            </div>
-                        </div>
-                    {{ end }}
-                </div>            
-                {{ end }}
-            {{ end }} 
-        </div>  
-    </section>
-    {{end}}
-</div>

From 2f385fa478951a6658c98613737640340aea0352 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Jun 2025 09:13:57 +0100
Subject: [PATCH 003/117] build(deps): bump github/codeql-action from 3.28.16
 to 3.28.19 (#653)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.16 to 3.28.19.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/28deaeda66b76a05916b6923827895f2b14ab387...fca7ace96b7d713c7035871441bd52efbe39e27e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.28.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ossf_scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml
index 86cd9f9bc..a3837c42f 100644
--- a/.github/workflows/ossf_scorecard.yml
+++ b/.github/workflows/ossf_scorecard.yml
@@ -56,6 +56,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload SARIF results to code scanning
-        uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
         with:
           sarif_file: results.sarif

From dcf33483345bd629b6b2185e05593781cc640712 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Mon, 9 Jun 2025 03:32:47 -0700
Subject: [PATCH 004/117] Resolved dot org link in N1 landing page (#654)

---
 content/nginx-one/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index 27bf8dbfe..12ff811af 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -58,7 +58,7 @@ cascade:
     {{< card title="NGINX Plus" titleUrl="/nginx" icon="NGINX-Plus-product-icon-RGB">}}
       The all-in-one load balancer, reverse proxy, web server, content cache, and API gateway. 
     {{</ card >}}
-    {{< card title="NGINX Open Source" titleUrl="nginx.org" icon="NGINX-product-icon">}}
+    {{< card title="NGINX Open Source" titleUrl="https://nginx.org" icon="NGINX-product-icon">}}
       The open source all-in-one load balancer, content cache, and web server 
     {{</ card >}}
   {{</ card-section >}}

From 90cf13c4df3a7a529b7fc225cebcb16694baa025 Mon Sep 17 00:00:00 2001
From: Jack Hickey <133868041+nginx-jack@users.noreply.github.com>
Date: Mon, 9 Jun 2025 12:00:45 +0100
Subject: [PATCH 005/117] Bump go.mod to v0.42.37 (#656)

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index fd5114fe6..eab95ad43 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/nginxinc/docs
 
 go 1.19
 
-require github.com/nginxinc/nginx-hugo-theme v0.42.36 // indirect    
+require github.com/nginxinc/nginx-hugo-theme v0.42.37 // indirect
diff --git a/go.sum b/go.sum
index d4f5dc928..2f4bc5017 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,2 @@
-github.com/nginxinc/nginx-hugo-theme v0.42.36 h1:vFBavxB+tw2fs0rLTpA3kYPMdBK15LtZkfkX21kzrDo=
-github.com/nginxinc/nginx-hugo-theme v0.42.36/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
+github.com/nginxinc/nginx-hugo-theme v0.42.37 h1:KtESjG1VG6ioSQBWfwgIiDVEmq9mylpunV2NENM8XvI=
+github.com/nginxinc/nginx-hugo-theme v0.42.37/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=

From a615caece8feeaf8ce41c6ee0507178162fb849b Mon Sep 17 00:00:00 2001
From: "Jacob (Jake) Newfield" <104527109+jnewfield@users.noreply.github.com>
Date: Tue, 10 Jun 2025 03:06:50 -0700
Subject: [PATCH 006/117] Add http_auth_jwt module to cryptographic boundary
 definition within 'NGINX Plus FIPS Compliance' document (#658)

Changes have been made
---
 content/nginx/fips-compliance-nginx-plus.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/nginx/fips-compliance-nginx-plus.md b/content/nginx/fips-compliance-nginx-plus.md
index ecd72095d..7be51a7be 100644
--- a/content/nginx/fips-compliance-nginx-plus.md
+++ b/content/nginx/fips-compliance-nginx-plus.md
@@ -31,7 +31,7 @@ This statement uses the following terms:
 
 - **Cryptographic module**: The OpenSSL software, comprised of libraries of FIPS‑validated algorithms that can be used by other applications.
 
-- **Cryptographic boundary**: The operational functions that use FIPS‑validated algorithms. For NGINX Plus, the cryptographic boundary includes all functionality that is implemented by the [http_ssl](http://nginx.org/en/docs/http/ngx_http_ssl_module.html), [http_v2](http://nginx.org/en/docs/http/ngx_http_v2_module.html), [stream_ssl](http://nginx.org/en/docs/stream/ngx_stream_ssl_module.html), and [mail_ssl](http://nginx.org/en/docs/mail/ngx_mail_ssl_module.html) modules. These modules implement SSL and TLS operations for inbound and outbound connections which use HTTP, HTTP/2, TCP, and mail protocols.
+- **Cryptographic boundary**: The operational functions that use FIPS‑validated algorithms. For NGINX Plus, the cryptographic boundary includes all functionality that is implemented by the [http_ssl](http://nginx.org/en/docs/http/ngx_http_ssl_module.html), [http_v2](http://nginx.org/en/docs/http/ngx_http_v2_module.html), [stream_ssl](http://nginx.org/en/docs/stream/ngx_stream_ssl_module.html), [mail_ssl](http://nginx.org/en/docs/mail/ngx_mail_ssl_module.html), and [http_auth_jwt](http://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html) modules. These modules implement SSL and TLS operations for inbound and outbound connections which use HTTP, HTTP/2, TCP, and mail protocols.
 
 - **NGINX Plus**: The NGINX Plus software application developed by NGINX, Inc. and delivered in binary format from NGINX servers.
 

From 77420464da7dc2d1083e5abdfdf74818bba5c70a Mon Sep 17 00:00:00 2001
From: nginx-seanmoloney <133861979+nginx-seanmoloney@users.noreply.github.com>
Date: Tue, 10 Jun 2025 15:24:17 +0100
Subject: [PATCH 007/117] Agent info banner (#661)

* Add an info banner, apply banner to all sections.
Add a compatibility matrix to tech specs

* add v3 banner

* PR feedback

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* PR feedback

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update _banners/agent-v3-release.md

* Update Agent version column to contain versions.

* Minor change to remove v from versions

* Update _banners/agent-v3-release.md

---------

Co-authored-by: Jon Cahill-Torre <j.cahilltorre@f5.com>
Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
---
 _banners/agent-v3-release.md              |  9 +++++++++
 content/agent/_index.md                   |  8 ++++++--
 content/agent/technical-specifications.md | 11 +++++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 _banners/agent-v3-release.md

diff --git a/_banners/agent-v3-release.md b/_banners/agent-v3-release.md
new file mode 100644
index 000000000..c82d87a10
--- /dev/null
+++ b/_banners/agent-v3-release.md
@@ -0,0 +1,9 @@
+{{< banner "notice" "NGINX Agent 3.0 is now available" >}}
+
+
+F5 NGINX One Console does not currently support Agent 3.x. If you are using NGINX One Console in your environment, upgrade to the latest Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
+
+Please see the [Technical specifications](/nginx-agent/technical-specifications/) for product compatibility.
+
+
+{{< /banner >}}
\ No newline at end of file
diff --git a/content/agent/_index.md b/content/agent/_index.md
index 330490eb8..fcb621c38 100644
--- a/content/agent/_index.md
+++ b/content/agent/_index.md
@@ -1,8 +1,12 @@
 ---
 title: NGINX Agent
-description: NGINX Agent is a companion daemon for your NGINX Open Source or NGINX
-  Plus instance.
 url: /nginx-agent/
 cascade:
   logo: NGINX-product-icon.png
+  banner:
+    enabled: true
+    type: deprecation
+    start-date: 2025-05-29
+    end-date: 2025-09-09
+    md: /_banners/agent-v3-release.md
 ---
diff --git a/content/agent/technical-specifications.md b/content/agent/technical-specifications.md
index 7ecd18398..149b08df9 100644
--- a/content/agent/technical-specifications.md
+++ b/content/agent/technical-specifications.md
@@ -12,6 +12,17 @@ type:
 
 This document provides technical specifications for NGINX Agent. It includes information on supported distributions, deployment environments, NGINX versions, sizing recommendations, and logging.
 
+## NGINX Agent v3.0 Compatibility 
+{{< bootstrap-table "table table-striped table-bordered" >}}
+| NGINX Product                | Agent Version  |
+|------------------------------|----------------|
+| **NGINX One Console**        | 2.x            |
+| **NGINX Gateway Fabric**     | 3.x            | 
+| **NGINX Plus**               | 2.x, 3.x       |
+| **NGINX Ingress Controller** | 2.x            |
+| **NGINX Instance Manager**   | 2.x            |
+{{< /bootstrap-table >}}
+
 ## Supported Distributions
 
 NGINX Agent can run in most environments. We support the following distributions:

From de52c056afac71025d8ab4b867041c066cf42fba Mon Sep 17 00:00:00 2001
From: Arpith Varghese <127259427+arpith-f5@users.noreply.github.com>
Date: Tue, 10 Jun 2025 08:06:41 -0700
Subject: [PATCH 008/117] NGINXaaS Platform metric migration (#647)

---
 .../monitoring/enable-monitoring.md           |  4 +--
 .../monitoring/migrate-to-platform-metrics.md | 34 +++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)
 create mode 100644 content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md

diff --git a/content/nginxaas-azure/monitoring/enable-monitoring.md b/content/nginxaas-azure/monitoring/enable-monitoring.md
index c4bc181d2..7185e3320 100644
--- a/content/nginxaas-azure/monitoring/enable-monitoring.md
+++ b/content/nginxaas-azure/monitoring/enable-monitoring.md
@@ -12,7 +12,7 @@ Monitoring your application's performance is crucial for maintaining its reliabi
 
 Refer to the [Azure monitor overview](https://docs.microsoft.com/en-us/azure/azure-monitor/overview) documentation from Microsoft to learn more about Azure Monitor.
 
-### Prerequisites
+## Prerequisites
 
 - A system assigned managed identity with `Monitoring Metrics Publisher` role.
 
@@ -25,7 +25,7 @@ Azure Monitor will collects metrics from the NGINXaaS deployment automatically i
 ## Exporting
 You can export Azure Monitor metrics to other destinations like Log Analytics workspace, Azure Storage Account, Azure Event Hubs or Azure Monitor partner solutions using Diagnostic Setting. For more information, see the [Metrics diagnostic setting](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings).
 
-To configure diagnostic settings for a service, see [Create diagnostic settings in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/create-diagnostic-settings).
+To configure diagnostic settings for a service, see [Create diagnostic settings in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/create-diagnostic-settings). You can export metrics by selecting the `AllMetrics` category in diagnostic settings.
 
 {{<note>}} Not all metrics are exportable via diagnostic settings, for a list of exportable metrics, see [NGINXaaS exportable metrics](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-metrics/nginx-nginxplus-nginxdeployments-metrics).{{</note>}}
 
diff --git a/content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md b/content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md
new file mode 100644
index 000000000..44c14df37
--- /dev/null
+++ b/content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md
@@ -0,0 +1,34 @@
+---
+title: Migrate from Custom Metrics to Platform Metrics
+weight: 1000
+toc: true
+url: /nginxaas/azure/getting-started/migrate-to-platform-metrics/
+type:
+- how-to
+---
+
+## Overview
+NGINXaaS previously supported monitoring using [Custom Metrics](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-custom-overview). Custom metrics is a preview feature in Azure and support for it will be dropped in the future. We have added support for Platform metrics which is the Azure recommended way for monitoring resources, we strongly recommend you to migrate your deployments monitoring to use Platform metrics to take advantage of reduced latency and higher reliability.
+
+## Migration Steps
+This section contains instructions on how to migrate your deployment monitoring from Custom Metrics to Platform Metrics.
+
+1. Verify that your NGINXaaS deployment meets the [pre-requisites]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md#prerequisites">}}) for Platform metrics to work.
+2. If the per-requisites are met, Platform metrics are enabled by default on all NGINXaaS deployment. Verify that you are able to see the new metrics in Azure Monitor under the `Standard Metrics` namespace.
+3. Turn off legacy monitoring.
+
+   - **Using Portal**  
+     1. Go to the **NGINX monitoring** page of the NGINXaaS deployment in the Azure portal.  
+     2. Toggle Off the `Send metrics to Azure Monitor` switch.  
+     3. Click Save.  
+
+   - **Using Terraform**  
+     1. Set `diagnose_support_enabled` to false in the `azurerm_nginx_deployment` resource.  
+     2. Run `terraform plan` followed by `terraform apply` to upgrade the deployment.  
+
+   - **Using Azure CLI**  
+     Run the command below:  
+     ```bash
+     az nginx deployment update --name myDeployment --resource-group \
+     myResourceGroup --enable-diagnostics="false"
+     ```
\ No newline at end of file

From 0f04b44c3259067c99049b7a0c28889415e10cec Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Tue, 10 Jun 2025 16:58:23 +0100
Subject: [PATCH 009/117] style guide corrections to migrate metrics doc (#664)

* style guide corrections to migrate metrics doc

* Apply suggestions from code review

Co-authored-by: Ryan Davis <ryepup@gmail.com>
Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

---------

Co-authored-by: Ryan Davis <ryepup@gmail.com>
Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>
---
 .../monitoring/migrate-to-platform-metrics.md | 38 ++++++++++---------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md b/content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md
index 44c14df37..c33b781c7 100644
--- a/content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md
+++ b/content/nginxaas-azure/monitoring/migrate-to-platform-metrics.md
@@ -1,5 +1,5 @@
 ---
-title: Migrate from Custom Metrics to Platform Metrics
+title: Migrate from Custom metrics to Platform metrics
 weight: 1000
 toc: true
 url: /nginxaas/azure/getting-started/migrate-to-platform-metrics/
@@ -8,27 +8,29 @@ type:
 ---
 
 ## Overview
-NGINXaaS previously supported monitoring using [Custom Metrics](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-custom-overview). Custom metrics is a preview feature in Azure and support for it will be dropped in the future. We have added support for Platform metrics which is the Azure recommended way for monitoring resources, we strongly recommend you to migrate your deployments monitoring to use Platform metrics to take advantage of reduced latency and higher reliability.
 
-## Migration Steps
-This section contains instructions on how to migrate your deployment monitoring from Custom Metrics to Platform Metrics.
+F5 NGINXaaS for Azure previously supported monitoring through [Custom Metrics](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-custom-overview), which is a preview feature in Azure. As a preview feature, support for Custom Metrics will be removed in the future. We've added support for Platform Metrics, which is the recommended way to monitor resources in Azure. We strongly recommend switching your deployment's monitoring to Platform Metrics to take advantage of lower latency and better reliability.
 
-1. Verify that your NGINXaaS deployment meets the [pre-requisites]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md#prerequisites">}}) for Platform metrics to work.
-2. If the per-requisites are met, Platform metrics are enabled by default on all NGINXaaS deployment. Verify that you are able to see the new metrics in Azure Monitor under the `Standard Metrics` namespace.
-3. Turn off legacy monitoring.
+## Migration steps
 
-   - **Using Portal**  
-     1. Go to the **NGINX monitoring** page of the NGINXaaS deployment in the Azure portal.  
-     2. Toggle Off the `Send metrics to Azure Monitor` switch.  
-     3. Click Save.  
+Follow the steps in this section to migrate your deployment monitoring from Custom metrics to Platform metrics.
 
-   - **Using Terraform**  
-     1. Set `diagnose_support_enabled` to false in the `azurerm_nginx_deployment` resource.  
-     2. Run `terraform plan` followed by `terraform apply` to upgrade the deployment.  
+1. Verify that your NGINXaaS deployment meets the [pre-requisites]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md#prerequisites">}}) for Platform metrics to work.
+2. If the pre-requisites are met, Platform metrics are enabled by default on all NGINXaaS deployment. Verify that you are able to see the new metrics in Azure Monitor under the `Standard Metrics` namespace.
+3. Turn off legacy monitoring:
 
-   - **Using Azure CLI**  
-     Run the command below:  
-     ```bash
+   - Using the Azure portal
+     1. In the Azure portal, go to the **NGINX monitoring** page for your NGINXaaS deployment.
+     2. Turn off the **Send metrics to Azure Monitor** setting.
+     3. Select **Save**.
+
+   - Using Terraform
+     1. Set `diagnose_support_enabled` to false in the `azurerm_nginx_deployment` resource.
+     2. Run `terraform plan` followed by `terraform apply` to upgrade the deployment.
+
+   - Using the Azure CLI
+     Run the following command:
+     ```shell
      az nginx deployment update --name myDeployment --resource-group \
      myResourceGroup --enable-diagnostics="false"
-     ```
\ No newline at end of file
+     ```

From d99cf086deae9024fba74eb80dd17e0c22143e28 Mon Sep 17 00:00:00 2001
From: Alex Russell <91080557+arussellf5@users.noreply.github.com>
Date: Wed, 11 Jun 2025 02:50:19 -0600
Subject: [PATCH 010/117] NGINXaaS for Azure: update helm chart version used
 for load balancer for kubernetes (#665)

This will ensure users get latest bug fixes and functionality.
---
 content/nginxaas-azure/loadbalancer-kubernetes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/nginxaas-azure/loadbalancer-kubernetes.md b/content/nginxaas-azure/loadbalancer-kubernetes.md
index 51fd5e740..bd845dac1 100644
--- a/content/nginxaas-azure/loadbalancer-kubernetes.md
+++ b/content/nginxaas-azure/loadbalancer-kubernetes.md
@@ -148,7 +148,7 @@ The NLK controller can be installed in your Kubernetes cluster using either Helm
 Install the NLK controller using `helm install`. Be sure your kubectl context is pointed at the desired cluster.
 
 ```bash
-helm install nlk oci://registry-1.docker.io/nginxcharts/nginxaas-loadbalancer-kubernetes --version 1.0.0 \
+helm install nlk oci://registry-1.docker.io/nginxcharts/nginxaas-loadbalancer-kubernetes --version 1.1.1 \
   --set "nlk.dataplaneApiKey=${keyValue}" \
   --set "nlk.config.nginxHosts=${dataplaneAPIEndpoint}nplus"
 ```

From 2f2be347be8bde4f8c97e1d3feeb6cd0bc99f919 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 11 Jun 2025 03:18:27 -0700
Subject: [PATCH 011/117] Renamed from products to components for N1 (#667)

---
 content/nginx-one/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index 12ff811af..d5f57a9a6 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -40,7 +40,7 @@ cascade:
     {{</ card >}}
   {{</ card-section >}}
 
-  # Other Products 
+  # Other Components 
   {{< card-section title="Kubernetes Solutions">}}
     {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" icon="NGINX-Ingress-Controller-product-icon">}}
       Kubernetes traffic management with API gateway, identity, and observability features. 

From d7f351785767aa402eb5c5351c124f8c33cba9a7 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 11 Jun 2025 09:22:39 -0700
Subject: [PATCH 012/117] Fix changelog partial (#670)

fix changelog partial
---
 layouts/partials/changelog-date.html | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/layouts/partials/changelog-date.html b/layouts/partials/changelog-date.html
index 2c1547392..efe487b51 100644
--- a/layouts/partials/changelog-date.html
+++ b/layouts/partials/changelog-date.html
@@ -1,11 +1,10 @@
 {{ $changelogContent := readFile "content/nginx-one/changelog.md" }}
 {{ $maxNumLogs := 3 }}
 {{ $headings := first $maxNumLogs (findRE `(?m)^##\s(.+)$` $changelogContent) }}
-
 <ul style="padding-top: 10px;">
-    {{ range $headings }}
-      {{$title := replaceRE "^##\\s" "" .}}
-      <li><a href="{{ absURL "nginx-one/changelog/" }}#{{urlize $title}}">{{ $title }}</a></li>
-    {{ end }}  
-    <li><a href="{{ absURL "nginx-one/changelog/" }}">Older...</a></li>
+  {{ range $headings }}
+  {{ $title := replaceRE "^##\\s" "" . }}
+  <li><a href="{{ absURL "nginx-one/changelog/" }}#{{urlize $title}}">{{ $title }}</a></li>
+  {{ end }}  
+  <li><a href="{{ absURL "nginx-one/changelog/" }}">Older...</a></li>
 </ul>
\ No newline at end of file

From 1f9fdcc2424e725b04cdf824cb30dc240ddf7b58 Mon Sep 17 00:00:00 2001
From: yar <y82@users.noreply.github.com>
Date: Thu, 12 Jun 2025 10:49:42 +0100
Subject: [PATCH 013/117] feat: Update the value of ssl_protocols. (#672)

---
 .../load-balancer/http-load-balancer.md       |   2 +-
 .../admin-guide/mail-proxy/mail-proxy.md      |   4 +-
 .../securing-http-traffic-upstream.md         |   4 +-
 .../securing-tcp-traffic-upstream.md          |   4 +-
 .../security-controls/terminating-ssl-http.md |   8 +-
 .../security-controls/terminating-ssl-tcp.md  |   4 +-
 .../microsoft-exchange.md                     | 150 +++++++++---------
 .../f5-big-ip-configuration.md                |   4 +-
 content/nginx/fips-compliance-nginx-plus.md   |   2 +-
 9 files changed, 90 insertions(+), 92 deletions(-)

diff --git a/content/nginx/admin-guide/load-balancer/http-load-balancer.md b/content/nginx/admin-guide/load-balancer/http-load-balancer.md
index a01b69aed..cfce044ca 100644
--- a/content/nginx/admin-guide/load-balancer/http-load-balancer.md
+++ b/content/nginx/admin-guide/load-balancer/http-load-balancer.md
@@ -427,7 +427,7 @@ http {
         listen              443 ssl;
         ssl_certificate     /etc/nginx/ssl/company.com.crt;
         ssl_certificate_key /etc/nginx/ssl/company.com.key;
-        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+        ssl_protocols       TLSv1.2 TLSv1.3;
 
         location / {
             proxy_pass         https://exchange;
diff --git a/content/nginx/admin-guide/mail-proxy/mail-proxy.md b/content/nginx/admin-guide/mail-proxy/mail-proxy.md
index ab47d4813..a2f29c46d 100644
--- a/content/nginx/admin-guide/mail-proxy/mail-proxy.md
+++ b/content/nginx/admin-guide/mail-proxy/mail-proxy.md
@@ -166,7 +166,7 @@ To enable SSL/TLS for the mail proxy:
     ```nginx
     mail {
         #...
-        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+        ssl_protocols TLSv1.2 TLSv1.3;
         ssl_ciphers   HIGH:!aNULL:!MD5;
     }
     ```
@@ -223,7 +223,7 @@ mail {
     ssl                 on;
     ssl_certificate     /etc/ssl/certs/server.crt;
     ssl_certificate_key /etc/ssl/certs/server.key;
-    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+    ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         HIGH:!aNULL:!MD5;
     ssl_session_cache   shared:SSL:10m;
     ssl_session_timeout 10m;
diff --git a/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md b/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md
index d2e353616..978bab7c5 100644
--- a/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md
+++ b/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md
@@ -77,7 +77,7 @@ Optionally, you can specify which SSL protocols and ciphers are used:
 ```nginx
 location /upstream {
         #...
-        proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+        proxy_ssl_protocols TLSv1.2 TLSv1.3;
         proxy_ssl_ciphers   HIGH:!aNULL:!MD5;
 }
 ```
@@ -133,7 +133,7 @@ http {
             proxy_pass                    https://backend.example.com;
             proxy_ssl_certificate         /etc/nginx/client.pem;
             proxy_ssl_certificate_key     /etc/nginx/client.key;
-            proxy_ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
+            proxy_ssl_protocols           TLSv1.2 TLSv1.3;
             proxy_ssl_ciphers             HIGH:!aNULL:!MD5;
             proxy_ssl_trusted_certificate /etc/nginx/trusted_ca_cert.crt;
 
diff --git a/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md b/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md
index 13ec0bc3f..d40ccac1b 100644
--- a/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md
+++ b/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md
@@ -58,7 +58,7 @@ Optionally, specify which SSL protocols and ciphers to use:
 ```nginx
 server {
         ...
-        proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+        proxy_ssl_protocols TLSv1.2 TLSv1.3;
         proxy_ssl_ciphers   HIGH:!aNULL:!MD5;
 }
 ```
@@ -98,7 +98,7 @@ stream {
 
         proxy_ssl_certificate         /etc/ssl/certs/backend.crt;
         proxy_ssl_certificate_key     /etc/ssl/certs/backend.key;
-        proxy_ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
+        proxy_ssl_protocols           TLSv1.2 TLSv1.3;
         proxy_ssl_ciphers             HIGH:!aNULL:!MD5;
         proxy_ssl_trusted_certificate /etc/ssl/certs/trusted_ca_cert.crt;
 
diff --git a/content/nginx/admin-guide/security-controls/terminating-ssl-http.md b/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
index 792b7ce00..66656532d 100644
--- a/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
+++ b/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
@@ -22,7 +22,7 @@ server {
     server_name         www.example.com;
     ssl_certificate     www.example.com.crt;
     ssl_certificate_key www.example.com.key;
-    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+    ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         HIGH:!aNULL:!MD5;
     #...
 }
@@ -39,10 +39,10 @@ In this case it is important to restrict access to the file. Note that although
 
 The [ssl_protocols](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) and [ssl_ciphers](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers ) directives can be used to require that clients use only the strong versions and ciphers of SSL/TLS when establishing connections.
 
-Since version 1.9.1, NGINX uses these defaults:
+Since version 1.23.4, NGINX uses these defaults:
 
 ```nginx
-ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers HIGH:!aNULL:!MD5;
 ```
 
@@ -118,7 +118,7 @@ http {
 
         ssl_certificate     www.example.com.crt;
         ssl_certificate_key www.example.com.key;
-        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+        ssl_protocols       TLSv1.2 TLSv1.3;
         ssl_ciphers         HIGH:!aNULL:!MD5;
         #...
     }
diff --git a/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md b/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md
index bf7ab028f..af416b053 100644
--- a/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md
+++ b/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md
@@ -62,7 +62,7 @@ Additionally, the [ssl_protocols](https://nginx.org/en/docs/stream/ngx_stream_ss
 ```nginx
 server {
     #...
-    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
+    ssl_protocols  TLSv1.2 TLSv1.3;
     ssl_ciphers    HIGH:!aNULL:!MD5;
 }
 ```
@@ -152,7 +152,7 @@ stream {
 
         ssl_certificate       /etc/ssl/certs/server.crt;
         ssl_certificate_key   /etc/ssl/certs/server.key;
-        ssl_protocols         SSLv3 TLSv1 TLSv1.1 TLSv1.2;
+        ssl_protocols         TLSv1.2 TLSv1.3;
         ssl_ciphers           HIGH:!aNULL:!MD5;
         ssl_session_cache     shared:SSL:20m;
         ssl_session_timeout   4h;
diff --git a/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md b/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md
index bfaabc179..1c1a48769 100644
--- a/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md
+++ b/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md
@@ -475,7 +475,7 @@ The directives in the top‑level `stream` configuration block configure TCP loa
     server {
         listen 993;
         status_zone exchange-imaps;
-        proxy_pass exchange-imaps;
+        proxy_pass  exchange-imaps;
     }
     ```
 
@@ -488,7 +488,7 @@ The directives in the top‑level `stream` configuration block configure TCP loa
     server {
         listen 25; # SMTP port can be changed here (to 587, for example)
         status_zone exchange-smtp;
-        proxy_pass exchange-smtp;
+        proxy_pass  exchange-smtp;
     }
     ```
 
@@ -517,7 +517,7 @@ These directives in the top‑level `http` configuration block configure global
 
     ```nginx
     # In the 'http' block
-    keepalive_timeout 3h;
+    keepalive_timeout  3h;
     proxy_read_timeout 3h;
     ```
 
@@ -542,7 +542,7 @@ These directives define virtual servers for HTTP and HTTPS traffic in the top‑
    ```nginx
    # In the 'http' block
    server {
-       listen 443 ssl;
+       listen      443 ssl;
        status_zone exchange-combined;
    }
    ```
@@ -564,9 +564,9 @@ These directives define virtual servers for HTTP and HTTPS traffic in the top‑
 
    ```nginx
    # In the 'server' block for HTTPS traffic
-   ssl_certificate /etc/nginx/ssl/company.com.crt;
+   ssl_certificate     /etc/nginx/ssl/company.com.crt;
    ssl_certificate_key /etc/nginx/ssl/company.com.key;
-   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+   ssl_protocols       TLSv1.2 TLSv1.3;
    ```
 
    Directive documentation: [ssl_certificate](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate), [ssl_certificate_key](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate_key), [ssl_protocols](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)
@@ -668,11 +668,11 @@ These directives complete the configuration for basic load balancing of Exchange
     ```nginx
     # In the 'server' block for HTTPS traffic
     location / {
-        proxy_pass https://exchange;
-        proxy_buffering off;
-        proxy_http_version 1.1;
+        proxy_pass              https://exchange;
+        proxy_buffering         off;
+        proxy_http_version      1.1;
         proxy_request_buffering off;
-        proxy_set_header Connection "Keep-Alive";
+        proxy_set_header        Connection "Keep-Alive";
     }
     ```
 
@@ -730,10 +730,10 @@ http {
         listen 443 ssl;
         http2  on;
         client_max_body_size 2G;
-        ssl_certificate /etc/nginx/ssl/company.com.crt;
-        ssl_certificate_key /etc/nginx/ssl/company.com.key;
-        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-        status_zone exchange-combined;
+        ssl_certificate      /etc/nginx/ssl/company.com.crt;
+        ssl_certificate_key  /etc/nginx/ssl/company.com.key;
+        ssl_protocols        TLSv1.2 TLSv1.3;
+        status_zone          exchange-combined;
 
         location = / {
             return 301 "/owa/";
@@ -745,11 +745,11 @@ http {
         }
 
         location / {
-            proxy_pass https://exchange;
-            proxy_buffering off;
-            proxy_http_version 1.1;
+            proxy_pass              https://exchange;
+            proxy_buffering         off;
+            proxy_http_version      1.1;
             proxy_request_buffering off;
-            proxy_set_header Connection "Keep-Alive";
+            proxy_set_header        Connection "Keep-Alive";
         }
     }
 }
@@ -780,13 +780,13 @@ stream {
     server {
         listen 993;
         status_zone exchange-imaps;
-        proxy_pass exchange-imaps;
+        proxy_pass  exchange-imaps;
     }
 
     server {
         listen 25; # SMTP port can be changed here (to 587, for example)
         status_zone exchange-smtp;
-        proxy_pass exchange-smtp;
+        proxy_pass  exchange-smtp;
     }
 }
 ```
@@ -820,9 +820,6 @@ Exchange CASs interact with various applications used by clients on different ty
 {{</bootstrap-table>}}
 
 
-
-
-
 <span id="url-control"></span>
 ##### Configuring Granular URL Location Control
 
@@ -892,9 +889,9 @@ Exchange CASs interact with various applications used by clients on different ty
        ```nginx
        # In the 'server' block for HTTPS traffic
        location / {
-           proxy_pass https://exchange;
+           proxy_pass         https://exchange;
            proxy_http_version 1.1;
-           proxy_set_header Connection "";
+           proxy_set_header   Connection "";
        }
        ```
 
@@ -907,9 +904,9 @@ Exchange CASs interact with various applications used by clients on different ty
        location /ecp {
            #allow 172.16.0.0/16; # Replace with your admin network
            #deny all;
-           proxy_pass https://exchange-ecp;
+           proxy_pass         https://exchange-ecp;
            proxy_http_version 1.1;
-           proxy_set_header Connection "";
+           proxy_set_header   Connection "";
        }
        ```
 
@@ -920,9 +917,9 @@ Exchange CASs interact with various applications used by clients on different ty
       ```nginx
       # In the 'server' block for HTTPS traffic
       location /mapi {
-          proxy_pass https://exchange-mapi;
+          proxy_pass         https://exchange-mapi;
           proxy_http_version 1.1;
-          proxy_set_header Connection "";
+          proxy_set_header   Connection "";
       }
       ```
 
@@ -931,9 +928,9 @@ Exchange CASs interact with various applications used by clients on different ty
       ```nginx
       # In the 'server' block for HTTPS traffic
       location /Microsoft-Server-ActiveSync {
-          proxy_pass https://exchange-activesync;
+          proxy_pass         https://exchange-activesync;
           proxy_http_version 1.1;
-          proxy_set_header Connection "";
+          proxy_set_header   Connection "";
       }
       ```
 
@@ -942,9 +939,9 @@ Exchange CASs interact with various applications used by clients on different ty
       ```nginx
       # In the 'server' block for HTTPS traffic
       location /owa {
-          proxy_pass https://exchange-owa;
+          proxy_pass         https://exchange-owa;
           proxy_http_version 1.1;
-          proxy_set_header Connection "";
+          proxy_set_header   Connection "";
       }
       ```
 
@@ -953,11 +950,11 @@ Exchange CASs interact with various applications used by clients on different ty
       ```nginx
       # In the 'server' block for HTTPS traffic
       location /rpc/rpcproxy.dll {
-          proxy_pass https://exchange-rpc;
-          proxy_buffering off;
-          proxy_http_version 1.1;
+          proxy_pass              https://exchange-rpc;
+          proxy_buffering         off;
+          proxy_http_version      1.1;
           proxy_request_buffering off;
-          proxy_set_header Connection "Keep-Alive";
+          proxy_set_header        Connection "Keep-Alive";
       }
       ```
 
@@ -1018,27 +1015,27 @@ These directives configure NGINX Plus health checks.
    location /ecp {
        #allow 172.16.0.0/16; # Replace with your admin network
        #deny all;
-       proxy_pass https://exchange-ecp;
+       proxy_pass         https://exchange-ecp;
        proxy_http_version 1.1;
-       proxy_set_header Connection "";
-       health_check uri=/ecp/healthcheck.htm interval=3s
-                    match=exchange-health;
+       proxy_set_header   Connection "";
+       health_check       uri=/ecp/healthcheck.htm interval=3s
+                          match=exchange-health;
    }
 
    location /mapi {
-       proxy_pass https://exchange-mapi;
+       proxy_pass         https://exchange-mapi;
        proxy_http_version 1.1;
-       proxy_set_header Connection "";
-       health_check uri=/mapi/healthcheck.htm interval=3s
-                    match=exchange-health;
+       proxy_set_header   Connection "";
+       health_check       uri=/mapi/healthcheck.htm interval=3s
+                          match=exchange-health;
    }
 
    location /owa {
-       proxy_pass https://exchange-owa;
+       proxy_pass         https://exchange-owa;
        proxy_http_version 1.1;
-       proxy_set_header Connection "";
-       health_check uri=/owa/healthcheck.htm interval=3s
-                    match=exchange-health;
+       proxy_set_header   Connection "";
+       health_check       uri=/owa/healthcheck.htm interval=3s
+                          match=exchange-health;
    }
    ```
 
@@ -1234,10 +1231,10 @@ http {
         http2  on;
 
         client_max_body_size 2G;
-        ssl_certificate /etc/nginx/ssl/company.com.crt;
+        ssl_certificate     /etc/nginx/ssl/company.com.crt;
         ssl_certificate_key /etc/nginx/ssl/company.com.key;
-        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-        status_zone exchange-combined;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        status_zone         exchange-combined;
 
         location = / {
             return 301 "/owa/";
@@ -1249,9 +1246,9 @@ http {
         }
 
         location / {
-            proxy_pass https://exchange;
+            proxy_pass         https://exchange;
             proxy_http_version 1.1;
-            proxy_set_header Connection "";
+            proxy_set_header   Connection "";
         }
 
         location /ecp {
@@ -1263,43 +1260,43 @@ http {
             #allow 172.16.0.0/16; # Replace with your admin network
             #deny all;
 
-            proxy_pass https://exchange-ecp;
+            proxy_pass         https://exchange-ecp;
             proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            health_check uri=/ecp/healthcheck.htm interval=3s
-                         match=exchange-health;
+            proxy_set_header   Connection "";
+            health_check       uri=/ecp/healthcheck.htm interval=3s
+                               match=exchange-health;
         }
 
         location /mapi {
-            proxy_pass https://exchange-mapi;
+            proxy_pass         https://exchange-mapi;
             proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            health_check uri=/mapi/healthcheck.htm interval=3s
-                         match=exchange-health;
+            proxy_set_header   Connection "";
+            health_check       uri=/mapi/healthcheck.htm interval=3s
+                               match=exchange-health;
         }
 
         location /Microsoft-Server-ActiveSync {
-            proxy_pass https://exchange-active-sync;
+            proxy_pass         https://exchange-active-sync;
             proxy_http_version 1.1;
-            proxy_set_header Connection "";
+            proxy_set_header   Connection "";
         }
 
         location /owa {
-            proxy_pass https://exchange-owa;
+            proxy_pass         https://exchange-owa;
             proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            health_check uri=/owa/healthcheck.htm interval=3s
-                         match=exchange-health;
+            proxy_set_header   Connection "";
+            health_check       uri=/owa/healthcheck.htm interval=3s
+                               match=exchange-health;
         }
 
         location /rpc/rpcproxy.dll {
-            proxy_pass https://exchange-rpc;
-            proxy_buffering off;
-            proxy_http_version 1.1;
-            proxy_request_buffering off;
+            proxy_pass                  https://exchange-rpc;
+            proxy_buffering             off;
+            proxy_http_version          1.1;
+            proxy_request_buffering     off;
             proxy_set_header Connection "Keep-Alive";
-            health_check uri=/rpc/rpcproxy.dll interval=3s
-                         match=exchange-auth;
+            health_check                uri=/rpc/rpcproxy.dll interval=3s
+                                        match=exchange-auth;
         }
     }
 }
@@ -1330,13 +1327,13 @@ stream {
     server {
         listen 993;
         status_zone exchange-imaps;
-        proxy_pass exchange-imaps;
+        proxy_pass  exchange-imaps;
     }
 
     server {
         listen 25; # SMTP port can be changed here (to 587, for example)
         status_zone exchange-smtp;
-        proxy_pass exchange-smtp;
+        proxy_pass  exchange-smtp;
     }
 }
 ```
@@ -1344,6 +1341,7 @@ stream {
 <span id="revision"></span>
 ### Revision History
 
+- Version 7 (June 2025) – Update for the `ssl_protocols` directive
 - Version 6 (May 2024) – Update about HTTP/2 support (the [http2](https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2) directive)
 - Version 5 (April 2018) – Update for NGINX Plus API (<span style="white-space: nowrap;">NGINX Plus R14</span>)
 - Version 4 (May 2017) – Update about HTTP/2 support (<span style="white-space: nowrap;">NGINX Plus Release 11</span> and later)
diff --git a/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md b/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md
index 1cc9c9455..f5e2a4dec 100644
--- a/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md
+++ b/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md
@@ -1,4 +1,4 @@
----
+    ---
 description: Migrate load-balancing configuration from F5 BIG-IP LTM to NGINX Plus,
   using our syntax conversion examples.
 docs: DOCS-460
@@ -240,7 +240,7 @@ There are two methods for handling SSL/TLS traffic on a load balancer instance,
             proxy_pass https://ssl_test_pool;
             proxy_ssl_certificate /etc/nginx/ssl/client.pem;
             proxy_ssl_certificate_key /etc/nginx/ssl/client.key;
-            proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+            proxy_ssl_protocols TLSv1.2 TLSv1.3;
             proxy_ssl_ciphers HIGH:!aNULL:!MD5;
             proxy_ssl_trusted_certificate /etc/nginx/ssl/trusted_ca_cert.crt;
             proxy_ssl_verify on;
diff --git a/content/nginx/fips-compliance-nginx-plus.md b/content/nginx/fips-compliance-nginx-plus.md
index 7be51a7be..52a378a44 100644
--- a/content/nginx/fips-compliance-nginx-plus.md
+++ b/content/nginx/fips-compliance-nginx-plus.md
@@ -110,7 +110,7 @@ server {
     ssl_certificate     /etc/nginx/ssl/test.crt;
     ssl_certificate_key /etc/nginx/ssl/test.key;
 
-    ssl_protocols   	TLSv1 TLSv1.1 TLSv1.2;
+    ssl_protocols   	TLSv1.2 TLSv1.3;
 
     location / {
         root   /usr/share/nginx/html;

From d91f4e05259e2860fea509eac0145b9af618ec0f Mon Sep 17 00:00:00 2001
From: salonichf5 <146118978+salonichf5@users.noreply.github.com>
Date: Thu, 12 Jun 2025 19:25:13 +0530
Subject: [PATCH 014/117] NGF: Update release version to v2.0.1 (#671)

Update doc version for NGF release 2.0.1
---
 layouts/shortcodes/version-ngf.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layouts/shortcodes/version-ngf.html b/layouts/shortcodes/version-ngf.html
index 359a5b952..10bf840ed 100644
--- a/layouts/shortcodes/version-ngf.html
+++ b/layouts/shortcodes/version-ngf.html
@@ -1 +1 @@
-2.0.0
\ No newline at end of file
+2.0.1
\ No newline at end of file

From c4e6d911e957489e7685f931cd361b710ef6a9fd Mon Sep 17 00:00:00 2001
From: Saylor Berman <s.berman@f5.com>
Date: Thu, 12 Jun 2025 09:34:43 -0600
Subject: [PATCH 015/117] NGF: replace static-mode with controller (#669)

Problem: The static-mode command has been renamed.

Solution: Update to `controller`.
---
 .../includes/ngf/installation/expose-nginx-gateway-fabric.md  | 2 +-
 content/ngf/overview/gateway-api-compatibility.md             | 4 ++--
 content/ngf/traffic-management/basic-routing.md               | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/content/includes/ngf/installation/expose-nginx-gateway-fabric.md b/content/includes/ngf/installation/expose-nginx-gateway-fabric.md
index 85d2f4f4c..9ae213ed8 100644
--- a/content/includes/ngf/installation/expose-nginx-gateway-fabric.md
+++ b/content/includes/ngf/installation/expose-nginx-gateway-fabric.md
@@ -50,4 +50,4 @@ There are two options for accessing NGINX Gateway Fabric depending on the type o
 
 NGINX Gateway Fabric uses the created service to update the **Addresses** field in the **Gateway Status** resource. Using a **LoadBalancer** service sets this field to the IP address and/or hostname of that service. Without a service, the pod IP address is used.
 
-This gateway is associated with the NGINX Gateway Fabric through the **gatewayClassName** field. The default installation of NGINX Gateway Fabric creates a **GatewayClass** with the name **nginx**. NGINX Gateway Fabric will only configure gateways with a **gatewayClassName** of **nginx** unless you change the name via the `--gatewayclass` [command-line flag]({{< ref "/ngf/reference/cli-help.md#static-mode">}}).
+This gateway is associated with the NGINX Gateway Fabric through the **gatewayClassName** field. The default installation of NGINX Gateway Fabric creates a **GatewayClass** with the name **nginx**. NGINX Gateway Fabric will only configure gateways with a **gatewayClassName** of **nginx** unless you change the name via the `--gatewayclass` [command-line flag]({{< ref "/ngf/reference/cli-help.md#controller">}}).
diff --git a/content/ngf/overview/gateway-api-compatibility.md b/content/ngf/overview/gateway-api-compatibility.md
index fc04731cc..207d9f94c 100644
--- a/content/ngf/overview/gateway-api-compatibility.md
+++ b/content/ngf/overview/gateway-api-compatibility.md
@@ -57,7 +57,7 @@ For a description of each field, visit the [Gateway API documentation](https://g
 
 {{< /bootstrap-table >}}
 
-NGINX Gateway Fabric supports a single GatewayClass resource configured with the `--gatewayclass` flag of the [static-mode]({{< ref "/ngf/reference/cli-help.md#static-mode">}}) command.
+NGINX Gateway Fabric supports a single GatewayClass resource configured with the `--gatewayclass` flag of the [controller]({{< ref "/ngf/reference/cli-help.md#controller>}}) command.
 
 **Fields**:
 
@@ -87,7 +87,7 @@ NGINX Gateway Fabric supports a single GatewayClass resource configured with the
 
 NGINX Gateway Fabric supports multiple Gateway resources. The Gateway resources must reference NGINX Gateway Fabric's corresponding GatewayClass.
 
-See the [static-mode]({{< ref "/ngf/reference/cli-help.md#static-mode">}}) command for more information.
+See the [controller]({{< ref "/ngf/reference/cli-help.md#controller">}}) command for more information.
 
 **Fields**:
 
diff --git a/content/ngf/traffic-management/basic-routing.md b/content/ngf/traffic-management/basic-routing.md
index 41a81cc81..78b02c338 100644
--- a/content/ngf/traffic-management/basic-routing.md
+++ b/content/ngf/traffic-management/basic-routing.md
@@ -148,7 +148,7 @@ In a production environment, you should have a DNS record for the external IP ad
 
 {{< /note >}}
 
-This Gateway is associated with NGINX Gateway Fabric through the **gatewayClassName** field. The default installation of NGINX Gateway Fabric creates a GatewayClass with the name **nginx**. NGINX Gateway Fabric will only configure Gateways with a **gatewayClassName** of **nginx** unless you change the name via the `--gatewayclass` [command-line flag]({{< ref "/ngf/reference/cli-help.md#static-mode" >}}).
+This Gateway is associated with NGINX Gateway Fabric through the **gatewayClassName** field. The default installation of NGINX Gateway Fabric creates a GatewayClass with the name **nginx**. NGINX Gateway Fabric will only configure Gateways with a **gatewayClassName** of **nginx** unless you change the name via the `--gatewayclass` [command-line flag]({{< ref "/ngf/reference/cli-help.md#controller" >}}).
 
 We specify a [listener](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.Listener) on the Gateway to open an entry point on the cluster. In this case, since the coffee application accepts HTTP requests, we create an HTTP listener, named **http**, that listens on port 80.
 

From 40af4bd29cdc39f54634f43858be07351dfc32ea Mon Sep 17 00:00:00 2001
From: Saylor Berman <s.berman@f5.com>
Date: Fri, 13 Jun 2025 01:58:34 -0600
Subject: [PATCH 016/117] Fix missing quote (#676)

A quotation was missing that was not caught by the original PR pipeline.
---
 content/ngf/overview/gateway-api-compatibility.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/ngf/overview/gateway-api-compatibility.md b/content/ngf/overview/gateway-api-compatibility.md
index 207d9f94c..5638ed596 100644
--- a/content/ngf/overview/gateway-api-compatibility.md
+++ b/content/ngf/overview/gateway-api-compatibility.md
@@ -57,7 +57,7 @@ For a description of each field, visit the [Gateway API documentation](https://g
 
 {{< /bootstrap-table >}}
 
-NGINX Gateway Fabric supports a single GatewayClass resource configured with the `--gatewayclass` flag of the [controller]({{< ref "/ngf/reference/cli-help.md#controller>}}) command.
+NGINX Gateway Fabric supports a single GatewayClass resource configured with the `--gatewayclass` flag of the [controller]({{< ref "/ngf/reference/cli-help.md#controller">}}) command.
 
 **Fields**:
 

From 85237e07f9835ff510e2fe2ab573a7e4d4bce958 Mon Sep 17 00:00:00 2001
From: bjee19 <139261241+bjee19@users.noreply.github.com>
Date: Fri, 13 Jun 2025 06:31:04 -0700
Subject: [PATCH 017/117] feat: Fix NGINX Plus subsection link (#677)

Fix small link to subsection
---
 .../ngf/installation/nginx-plus/docker-registry-secret.md       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md b/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md
index c6d666b6d..0bfceec95 100644
--- a/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md
+++ b/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md
@@ -2,7 +2,7 @@
 docs: "DOCS-000"
 ---
 
-{{< note >}} If you would rather pull the NGINX Plus image and push to a private registry, you can skip this specific step and instead follow [this step]({{< ref "/ngf/install/nginx-plus.md#pulling-an-image-for-local-use" >}}). {{< /note >}}
+{{< note >}} If you would rather pull the NGINX Plus image and push to a private registry, you can skip this specific step and instead follow [this step]({{< ref "/ngf/install/nginx-plus.md#pull-an-image-for-local-use" >}}). {{< /note >}}
 
 If the `nginx-gateway` namespace does not yet exist, create it:
 

From cbf35df3b705d13c0e509da19c9238723daf106d Mon Sep 17 00:00:00 2001
From: yar <y82@users.noreply.github.com>
Date: Fri, 13 Jun 2025 15:42:13 +0100
Subject: [PATCH 018/117] Actualizing SSL Termination for NGINX Plus  (#666)

* Removed HTML.
* Directive formatting added.
* Updated values in ssl_protocols.
* Updated Compatibility Notes.
* Updated info about browser SNI support.
---
 .../security-controls/terminating-ssl-http.md | 81 ++++++++++---------
 1 file changed, 43 insertions(+), 38 deletions(-)

diff --git a/content/nginx/admin-guide/security-controls/terminating-ssl-http.md b/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
index 66656532d..455e36ea6 100644
--- a/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
+++ b/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
@@ -11,10 +11,9 @@ type:
 
 This section describes how to configure an HTTPS server on NGINX and F5 NGINX Plus.
 
-<span id="setup"></span>
-## Setting up an HTTPS Server
+## Setting up an HTTPS Server {#setup}
 
-To set up an HTTPS server, in your **nginx.conf** file include the `ssl` parameter to the [listen](https://nginx.org/en/docs/http/ngx_http_core_module.html#listen) directive in the [server](https://nginx.org/en/docs/http/ngx_http_core_module.html#server) block, then specify the locations of the server certificate and private key files:
+To set up an HTTPS server, in your **nginx.conf** file include the `ssl` parameter to the [`listen`](https://nginx.org/en/docs/http/ngx_http_core_module.html#listen) directive in the [`server`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server) block, then specify the locations of the server certificate and private key files:
 
 ```nginx
 server {
@@ -28,7 +27,7 @@ server {
 }
 ```
 
-The server certificate is a public entity. It is sent to every client that connects to the NGINX or NGINX Plus server. The private key is a secure entity and should be stored in a file with restricted access. However, the NGINX master process must be able to read this file. Alternatively, the private key can be stored in the same file as the certificate:
+The server certificate is a public entity. It is sent to every client that connects to the NGINX or NGINX Plus server. The private key is a secure entity and should be stored in a file with restricted access. However, the NGINX master process must be able to read this file. Alternatively, the private key can be stored in the same file as the certificate:
 
 ```nginx
 ssl_certificate     www.example.com.cert;
@@ -37,20 +36,19 @@ ssl_certificate_key www.example.com.cert;
 
 In this case it is important to restrict access to the file. Note that although the certificate and the key are stored in one file in this case, only the certificate is sent to clients.
 
-The [ssl_protocols](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) and [ssl_ciphers](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers ) directives can be used to require that clients use only the strong versions and ciphers of SSL/TLS when establishing connections.
+The [`ssl_protocols`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) and [`ssl_ciphers`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers ) directives can be used to require that clients use only the strong versions and ciphers of SSL/TLS when establishing connections.
 
 Since version 1.23.4, NGINX uses these defaults:
 
 ```nginx
 ssl_protocols TLSv1.2 TLSv1.3;
-ssl_ciphers HIGH:!aNULL:!MD5;
+ssl_ciphers   HIGH:!aNULL:!MD5;
 ```
 
 Vulnerabilities are sometimes found in the design of older ciphers, and we recommend disabling them in a modern NGINX configuration (unfortunately, the default configuration cannot easily be changed because of backward compatibility for existing NGINX deployments). Please note that CBC-mode ciphers might be vulnerable to a number of attacks (the BEAST attack in particular as described in  [CVE-2011-3389](https://nvd.nist.gov/vuln/detail/CVE-2011-3389)), and we recommend not using SSLv3 due to the [POODLE](https://nvd.nist.gov/vuln/detail/CVE-2014-3566) attack, unless you need to support legacy clients.
 
 
-<span id="setup_ocsp"></span>
-### OCSP Validation of Client Certificates
+### OCSP Validation of Client Certificates {#setup_ocsp}
 
 NGINX can be configured to use Online Certificate Status Protocol (OCSP) to check the validity of X.509 client certificates as they are presented. An OCSP request for the client certificate status is sent to an OCSP responder which checks the certificate validity and returns the response with the certificate status:
 
@@ -58,7 +56,7 @@ NGINX can be configured to use Online Certificate Status Protocol (OCSP) to chec
 - `Revoked` - the certificate is revoked
 - `Unknown` - no information is available about the client certificate
 
-To enable OCSP validation of SSL client certificates, specify the [ssl_ocsp](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ocsp) directive along with the [ssl_verify_client](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_verify_client) directive, which enables certificate verification:
+To enable OCSP validation of SSL client certificates, specify the [`ssl_ocsp`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ocsp) directive along with the [`ssl_verify_client`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_verify_client) directive, which enables certificate verification:
 
 ```nginx
 server {
@@ -75,7 +73,7 @@ server {
 }
 ```
 
-NGINX sends the OCSP request to the OCSP URI embedded in the client certificate unless a different URI is defined with the [ssl_ocsp_responder](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ocsp_responder) directive. `Only http://` OCSP responders are supported:
+NGINX sends the OCSP request to the OCSP URI embedded in the client certificate unless a different URI is defined with the [`ssl_ocsp_responder`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ocsp_responder) directive. Only `http://` OCSP responders are supported:
 
 ```nginx
 #...
@@ -83,7 +81,7 @@ ssl_ocsp_responder http://ocsp.example.com/;
 #...
 ```
 
-To cache OCSP responses in a single memory zone shared by all worker processes, specify the [ssl_ocsp_cache](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ocsp_cache) directive to define the name and size of the zone. Responses are cached for `1` hour unless the `nextUpdate`value in the OCSP response specifies a different value:
+To cache OCSP responses in a single memory zone shared by all worker processes, specify the [`ssl_ocsp_cache`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ocsp_cache) directive to define the name and size of the zone. Responses are cached for `1` hour unless the `nextUpdate`value in the OCSP response specifies a different value:
 
 ```nginx
 #...
@@ -94,15 +92,14 @@ ssl_ocsp_cache shared:one:10m;
 The result of the client certificate validation is available in the [`$ssl_client_verify`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#var_ssl_client_verify) variable, including the reason for OCSP failure.
 
 
-<span id="optimize"></span>
-## HTTPS Server Optimization
+## HTTPS Server Optimization {#optimize}
 
 SSL operations consume extra CPU resources. The most CPU-intensive operation is the SSL handshake. There are two ways to minimize the number of these operations per client:
 
 - Enabling keepalive connections to send several requests via one connection
 - Reusing SSL session parameters to avoid SSL handshakes for parallel and subsequent connections
 
-Sessions are stored in the SSL session cache shared between worker processes and configured by the [ssl_session_cache](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache) directive. One megabyte of cache contains about 4000 sessions. The default cache timeout is 5 minutes. This timeout can be increased using the [ssl_session_timeout](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout) directive. Below is a sample configuration optimized for a multi-core system with 10 megabyte shared session cache:
+Sessions are stored in the SSL session cache shared between worker processes and configured by the [`ssl_session_cache`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache) directive. One megabyte of cache contains about 4000 sessions. The default cache timeout is `5` minutes. This timeout can be increased using the [`ssl_session_timeout`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout) directive. Below is a sample configuration optimized for a multi-core system with 10 megabyte shared session cache:
 
 ```nginx
 worker_processes auto;
@@ -125,8 +122,7 @@ http {
 }
 ```
 
-<span id="cert_chains"></span>
-## SSL Certificate Chains
+## SSL Certificate Chains {#cert_chains}
 
 Some browsers may complain about a certificate signed by a well-known certificate authority, while other browsers may accept the certificate without issues. This occurs because the issuing authority has signed the server certificate using an intermediate certificate that is not present in the base of well-known trusted certificate authorities which is distributed in a particular browser. In this case the authority provides a bundle of chained certificates that should be concatenated to the signed server certificate. The server certificate must appear before the chained certificates in the combined file:
 
@@ -134,7 +130,7 @@ Some browsers may complain about a certificate signed by a well-known certificat
 cat www.example.com.crt bundle.crt > www.example.com.chained.crt
 ```
 
-The resulting file should be used in the [ssl_certificate](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate) directive:
+The resulting file should be used in the [`ssl_certificate`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate) directive:
 
 ```nginx
 server {
@@ -184,12 +180,11 @@ Certificate chain
 ...
 ```
 
-In this example the subject (“`s`”) of the `www.GoDaddy.com` server certificate `#0` is signed by an issuer (`“i”`) which itself is the subject of certificate #1. Certificate #1 is signed by an issuer which itself is the subject of certificate #2. This certificate, however, is signed by the well‑known issuer `ValiCert, Inc.` whose certificate is stored in the browsers themselves.
+In this example the subject (“`s`”) of the `www.GoDaddy.com` server certificate `#0` is signed by an issuer (`“i”`) which itself is the subject of certificate #1. Certificate #1 is signed by an issuer which itself is the subject of certificate #2. This certificate, however, is signed by the well‑known issuer `ValiCert, Inc.` whose certificate is stored in the browsers themselves.
 
-If a certificate bundle has not been added, only the server certificate (#0) is shown.
+If a certificate bundle has not been added, only the server certificate (#0) is shown.
 
-<span id="single"></span>
-## A Single HTTP/HTTPS Server
+## A Single HTTP/HTTPS Server {#single}
 
 It is possible to configure a single server that handles both HTTP and HTTPS requests by placing one `listen` directive with the `ssl` parameter and one without in the same virtual server:
 
@@ -204,10 +199,10 @@ server {
 }
 ```
 
-In NGINX version 0.7.13 and earlier, SSL cannot be enabled selectively for individual listening sockets, as shown above. SSL can only be enabled for the entire server using the [ssl](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl) directive, making it impossible to set up a single HTTP/HTTPS server. The `ssl` parameter to the [listen](https://nginx.org/en/docs/http/ngx_http_core_module.html#listen) directive was added to solve this issue. The [ssl](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl) directive therefore is deprecated in version 0.7.14 and later.
+In NGINX version 0.7.13 and earlier, SSL cannot be enabled selectively for individual listening sockets, as shown above. SSL can only be enabled for the entire server using the [ssl](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl) directive, making it impossible to set up a single HTTP/HTTPS server. The `ssl` parameter to the [listen](https://nginx.org/en/docs/http/ngx_http_core_module.html#listen) directive was added to solve this issue. The [ssl](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl) directive therefore is deprecated in version 0.7.14 and later.
 
-<span id="name"></span>
-## Name-Based HTTPS Servers
+
+## Name-Based HTTPS Servers {#name}
 
 A common issue arises when two or more HTTPS servers are configured to listen on a single IP address:
 
@@ -247,7 +242,7 @@ server {
 }
 ```
 
-Note that there are also some specific proxy settings for HTTPS upstreams ([proxy_ssl_ciphers](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_ciphers), [proxy_ssl_protocols](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols), and [proxy_ssl_session_reuse](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_session_reuse)) which can be used for fine‑tuning SSL between NGINX and upstream servers. You can read more about these in the [HTTP proxy module documentation](https://nginx.org/en/docs/http/ngx_http_proxy_module.html).
+Note that there are also some specific proxy settings for HTTPS upstreams ([`proxy_ssl_ciphers`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_ciphers), [`proxy_ssl_protocols`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols), and [`proxy_ssl_session_reuse`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_session_reuse)) which can be used for fine‑tuning SSL between NGINX and upstream servers. You can read more about these in the [HTTP proxy module documentation](https://nginx.org/en/docs/http/ngx_http_proxy_module.html).
 
 ### An SSL Certificate With Several Names
 
@@ -276,17 +271,17 @@ server {
 
 ### Server Name Indication
 
-A more generic solution for running several HTTPS servers on a single IP address is the [TLS Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication) (SNI) extension ([RFC 6066](https://tools.ietf.org/html/rfc6066)), which allows a browser to pass a requested server name during the SSL handshake. With this solution, the server will know which certificate it should use for the connection. However, SNI has limited browser support. Currently it is supported starting with the following browser versions:
+A more generic solution for running several HTTPS servers on a single IP address is the [TLS Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication) (SNI) extension ([RFC 6066](https://tools.ietf.org/html/rfc6066)), which allows a browser to pass a requested server name during the SSL handshake. With this solution, the server will know which certificate it should use for the connection. Although SNI is widely supported by modern browsers, some old browsers may still not include support for it. Major browsers support SNI starting with the following versions:
 
-- Opera 8.0
-- MSIE 7.0 (but only on Windows Vista or higher)
+- Chrome 105 (Windows version supports SNI on Vista or higher, too)
 - Firefox 2.0 and other browsers using Mozilla Platform rv:1.8.1
+- Microsoft Internet Explorer 7.0 (but only on Windows Vista or higher)
+- Opera 8.0
 - Safari 3.2.1 (Windows version supports SNI on Vista or higher)
-- Chrome (Windows version supports SNI on Vista or higher, too)
 
 Only domain names can be passed in SNI. However, some browsers will pass the IP address of the server as its name if a request includes a literal IP address. It is best not to rely on this.
 
-In order to use SNI in NGINX, it must be supported in both the OpenSSL library with which the NGINX binary has been built, as well as the library with which it is being dynamically linked at runtime. OpenSSL supports SNI since the version 0.9.8f if it was built with configuration `option --enable-tlsext`. Since OpenSSL version 0.9.8j, this option is enabled by default. If NGINX was built with SNI support, NGINX shows the following when run with the <span style="white-space: nowrap;">`-V`</span> switch:
+In order to use SNI in NGINX, it must be supported in both the OpenSSL library with which the NGINX binary has been built, as well as the library with which it is being dynamically linked at runtime. OpenSSL supports SNI since the version 0.9.8f if it was built with configuration `option --enable-tlsext`. Since OpenSSL version 0.9.8j, this option is enabled by default. If NGINX was built with SNI support, NGINX shows the following when run with the `-V` switch:
 
 ```shell
 nginx -V
@@ -305,21 +300,31 @@ therefore SNI is not available
 
 ## Compatibility Notes
 
-- The SNI support status has been shown by the <span style="white-space: nowrap;">`-V`</span> switch since versions 0.8.21 and 0.7.62.
+- The SNI support status has been shown by the `-V` switch since versions 0.8.21 and 0.7.62.
+
+- The `ssl` parameter of the [`listen`](https://nginx.org/en/docs/http/ngx_http_core_module.html#listen) directive has been supported since version 0.7.14. Prior to version 0.8.21 it could only be specified along with the `default` parameter.
+
+- SNI has been supported since version 0.5.23.
 
-- The `ssl` parameter to the [listen](https://nginx.org/en/docs/http/ngx_http_core_module.html#listen) directive has been supported since version 0.7.14. Prior to version 0.8.21 it could only be specified along with the `default` parameter.
+- The shared SSL session cache has been supported since version 0.5.6.
 
-- SNI has been supported since version 0.5.23.
-- The shared SSL session cache has been supported since version 0.5.6.
+### SSL protocols
+
+ - Version 1.27.3 and later: the default SSL protocols are `TLSv1.2` and `TLSv1.3` (if supported by the OpenSSL library). Otherwise, when OpenSSL 1.0.0 or older is used, the default SSL protocols are `TLSv1` and `TLSv1.1`.
+
+- Version 1.23.4 and later: the default SSL protocols are `TLSv1`, `TLSv1.1`, `TLSv1.2`, and `TLSv1.3` (if supported by the OpenSSL library).
 
 - Version 1.9.1 and later: the default SSL protocols are `TLSv1`, `TLSv1.1`, and `TLSv1.2` (if supported by the OpenSSL library).
-- From versions 0.7.65 and 0.8.19 and later, the default SSL protocols are `SSLv3`, `TLSv1`, `TLSv1.1`, and `TLSv1.2` (if supported by the OpenSSL library).
 
-- In versions 0.7.64 and 0.8.18 and earlier, the default SSL protocols are `SSLv2`, `SSLv3`, and `TLSv1`.
+- From versions 0.7.65 and 0.8.19 and later, the default SSL protocols are `SSLv3`, `TLSv1`, `TLSv1.1`, and `TLSv1.2` (if supported by the OpenSSL library).
+
+- In versions 0.7.64 and 0.8.18 and earlier, the default SSL protocols are `SSLv2`, `SSLv3`, and `TLSv1`.
+
+### SSL ciphers
 
-- In version 1.0.5 and later, the default SSL ciphers are `HIGH:!aNULL:!MD5`.
+- In version 1.0.5 and later, the default SSL ciphers are `HIGH:!aNULL:!MD5`.
 
-- In versions 0.7.65 and 0.8.20 and later, the default SSL ciphers are `HIGH:!ADH:!MD5`.
+- In versions 0.7.65 and 0.8.20 and later, the default SSL ciphers are `HIGH:!ADH:!MD5`.
 
 - From version 0.8.19 the default SSL ciphers are `ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM`.
 

From 24cfa28bd357c9072cb9aa4fb67d6d841bcd37a1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Jun 2025 09:42:01 +0100
Subject: [PATCH 019/117] build(deps): bump github/codeql-action from 3.28.19
 to 3.29.0 (#678)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.19 to 3.29.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/fca7ace96b7d713c7035871441bd52efbe39e27e...ce28f5bb42b7a9f2c824e633a3f6ee835bab6858)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ossf_scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml
index a3837c42f..63944f691 100644
--- a/.github/workflows/ossf_scorecard.yml
+++ b/.github/workflows/ossf_scorecard.yml
@@ -56,6 +56,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload SARIF results to code scanning
-        uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
+        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
         with:
           sarif_file: results.sarif

From d6f0e0adec91ff7fef0b6ad8e8bd0d52091a0efb Mon Sep 17 00:00:00 2001
From: Travis Martin <33876974+travisamartin@users.noreply.github.com>
Date: Mon, 16 Jun 2025 08:51:22 -0700
Subject: [PATCH 020/117] NIM release 2.20.0 (#684)

* docs: add support for lightweight mode and clarify ClickHouse configuration

* build(deps): bump github/codeql-action from 3.28.15 to 3.28.16 (#459)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.15 to 3.28.16.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/45775bd8235c68ba998cffa5171334d58593da47...28deaeda66b76a05916b6923827895f2b14ab387)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.28.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alan Dooley <a.dooley@f5.com>
Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>

* fix: Address typo, update metadata for Add a Staged Configuration topic (#549)

This commit fixes a typo in the main body text of the documentation, and
also updates the Hugo frontmatter to new parameter names and values.

* Updated example description for uwsgi and Django. (#552)

Co-authored-by: Alan Dooley <a.dooley@f5.com>

* Fixed URL to dynamic modules for Wildfly deployment guide. (#548)

* Fixed URL to dynamic modules for Wildfly deployment guide.

* Apply suggestions from code review

Co-authored-by: Alan Dooley <github@adubhlaoi.ch>

---------

Co-authored-by: Alan Dooley <github@adubhlaoi.ch>
Co-authored-by: Alan Dooley <a.dooley@f5.com>

* Removed random symbols introduced in #512 (#546)

* Add a new trigger to build push workflow (#554)

feat: Add a new trigger to build push workflow

* added flag to use to skip installing clickhouse

* updated install guides with latest script changes

* edits to system config titles

* added NGINX Agent version requirement for lightweight NIM

* added step for adding NGINX signing key for manual install

* updated clickhouse version variable

* added variable for lightweight NIM NGINX Agent requirement

* reworded lightweight option to lightweight mode

* added steps for adding instances

* added steps for setting up metrics reporting

* edits

* added lightweight mode content to docker compose doc

* Apply suggestions from code review

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* edits to helm deploy for lightweight mode

* Update license_usage_offline.sh

* feat: Updated nim install-script (#202)

* Update install-nim-bundle.sh

* fix: Update install-nim-bundle.sh

* removed cruft from docker-compose-lightweight.yaml

* edits to docker compose comments

* Update license_usage_offline.sh

* feat: Updated nim install-script (#202)

* Update install-nim-bundle.sh

* fix: Update install-nim-bundle.sh

* feat: Update the value of ssl_protocols. (#672)

* NGF: Update release version to v2.0.1 (#671)

Update doc version for NGF release 2.0.1

* NGF: replace static-mode with controller (#669)

Problem: The static-mode command has been renamed.

Solution: Update to `controller`.

* Fix missing quote (#676)

A quotation was missing that was not caught by the original PR pipeline.

* updates to helm config settings with new chart name

* docs: add 2.20 RNs

* Update install-nim-manual.md

* Update install.md

* docs: add 2.20 KIs

* incremented helm chart version table

* nim 2.20 ki update steps

* Update install-nim-bundle.sh (#208)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alan Dooley <a.dooley@f5.com>
Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
Co-authored-by: yar <y82@users.noreply.github.com>
Co-authored-by: Alan Dooley <github@adubhlaoi.ch>
Co-authored-by: Lam <150060045+lamATnginx@users.noreply.github.com>
Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Co-authored-by: Chetan Jain <46200286+Chetan-99@users.noreply.github.com>
Co-authored-by: salonichf5 <146118978+salonichf5@users.noreply.github.com>
Co-authored-by: Saylor Berman <s.berman@f5.com>
Co-authored-by: Jon Cahill-Torre <j.cahilltorre@f5.com>
Co-authored-by: Micheal Kingston <44472403+mkingst@users.noreply.github.com>
---
 cleanup_log.txt                               |  929 +++++++++++++
 content/includes/installation/add-nms-repo.md |   38 +-
 .../installation/clickhouse-defaults.md       |   21 -
 .../nginx-plus/usage-tracking/overview.md     |    2 +-
 .../license/connected-install-license-note.md |    2 +-
 .../nim/clickhouse/cli-skip-clickhouse.md     |   10 +
 .../nim/clickhouse/clickhouse-defaults.md     |   23 +
 .../nim/clickhouse/clickhouse-install.md      |   70 +
 .../nim/docker/docker-compose-env-vars.md     |    8 +-
 .../installation/install-script-flags/cert.md |    8 +
 .../clickhouse-version.md                     |    8 +
 .../install-script-flags/distribution.md      |   14 +
 .../installation/install-script-flags/key.md  |    8 +
 .../install-script-flags/skip-clickhouse.md   |   10 +
 .../optional-steps/configure-clickhouse.md    |   23 +
 .../optional-steps/configure-selinux.md       |   12 +
 .../disable-metrics-collection.md             |   11 +
 .../optional-steps/install-configure-vault.md |   16 +
 .../nms-chart-supported-module-versions.md    |    1 +
 .../nim/tech-specs/supported-distros.md       |    2 +
 .../tech-specs/supported-nginx-versions.md    |    4 +-
 content/nim/admin-guide/_index.md             |    2 +-
 .../admin-guide/{license => }/add-license.md  |    6 +-
 content/nim/admin-guide/license/_index.md     |    7 -
 content/nim/admin-guide/rbac/overview-rbac.md |    2 +-
 .../report-usage-connected-deployment.md      |   10 +-
 content/nim/deploy/_index.md                  |    2 +-
 ...y-nginx-instance-manager-docker-compose.md |  271 +++-
 .../deploy/kubernetes/deploy-using-helm.md    |  438 +++---
 .../deploy/kubernetes/helm-config-settings.md |  157 +--
 .../vm-bare-metal/install-nim-deprecated.md   |  315 -----
 .../vm-bare-metal/install-nim-manual.md       |  233 ++++
 content/nim/deploy/vm-bare-metal/install.md   |  170 ++-
 content/nim/disconnected/_index.md            |    2 +-
 .../add-license-disconnected-deployment.md    |    4 +-
 ...ted.md => offline-install-guide-manual.md} |   49 +-
 .../nim/disconnected/offline-install-guide.md |  107 +-
 .../report-usage-disconnected-deployment.md   |    2 +-
 .../set-up-app-protect-instances.md           |    2 +-
 content/nim/nginx-instances/add-instance.md   |   49 +
 content/nim/releases/known-issues.md          |  164 ++-
 content/nim/releases/release-notes.md         |   93 +-
 .../configure-clickhouse.md                   |   90 +-
 .../configure-forward-proxy.md                |    2 +-
 .../configure-high-availability.md            |    2 +-
 .../configure-telemetry.md                    |    4 +-
 .../system-configuration/configure-vault.md   |    2 +-
 .../configure-with-config.md                  |    2 +-
 .../system-configuration/secure-traffic.md    |    4 +-
 .../how-to/deploy-api-connectivity-manager.md |    2 +-
 content/nms/acm/how-to/install-acm.md         |    2 +-
 content/nms/acm/tutorials/advanced-routing.md |    2 +-
 .../solutions/about-subscription-licenses.md  |    4 +-
 layouts/shortcodes/clickhouse-version.html    |    1 +
 .../lightweight-nim-nginx-agent-version.html  |    1 +
 .../docker-compose-lightweight.yaml           |   93 ++
 static/scripts/install-nim-bundle.sh          | 1220 +++++++----------
 static/scripts/license_usage_offline.sh       |  743 +++++-----
 58 files changed, 3413 insertions(+), 2066 deletions(-)
 create mode 100644 cleanup_log.txt
 delete mode 100644 content/includes/installation/clickhouse-defaults.md
 create mode 100644 content/includes/nim/clickhouse/cli-skip-clickhouse.md
 create mode 100644 content/includes/nim/clickhouse/clickhouse-defaults.md
 create mode 100644 content/includes/nim/clickhouse/clickhouse-install.md
 create mode 100644 content/includes/nim/installation/install-script-flags/cert.md
 create mode 100644 content/includes/nim/installation/install-script-flags/clickhouse-version.md
 create mode 100644 content/includes/nim/installation/install-script-flags/distribution.md
 create mode 100644 content/includes/nim/installation/install-script-flags/key.md
 create mode 100644 content/includes/nim/installation/install-script-flags/skip-clickhouse.md
 create mode 100644 content/includes/nim/installation/optional-steps/configure-clickhouse.md
 create mode 100644 content/includes/nim/installation/optional-steps/configure-selinux.md
 create mode 100644 content/includes/nim/installation/optional-steps/disable-metrics-collection.md
 create mode 100644 content/includes/nim/installation/optional-steps/install-configure-vault.md
 rename content/nim/admin-guide/{license => }/add-license.md (88%)
 delete mode 100644 content/nim/admin-guide/license/_index.md
 rename content/nim/admin-guide/{license => }/report-usage-connected-deployment.md (85%)
 delete mode 100644 content/nim/deploy/vm-bare-metal/install-nim-deprecated.md
 create mode 100644 content/nim/deploy/vm-bare-metal/install-nim-manual.md
 rename content/nim/disconnected/{offline-install-guide-deprecated.md => offline-install-guide-manual.md} (81%)
 create mode 100644 content/nim/nginx-instances/add-instance.md
 create mode 100644 layouts/shortcodes/clickhouse-version.html
 create mode 100644 layouts/shortcodes/lightweight-nim-nginx-agent-version.html
 create mode 100644 static/scripts/docker-compose/docker-compose-lightweight.yaml

diff --git a/cleanup_log.txt b/cleanup_log.txt
new file mode 100644
index 000000000..e4a129c9c
--- /dev/null
+++ b/cleanup_log.txt
@@ -0,0 +1,929 @@
+2025-05-21 06:21:52,139: File read successfully.
+2025-05-21 06:21:52,140: Initial shape (rows x columns): (743, 39)
+2025-05-21 06:21:52,140: Subheading row detected and removed.
+2025-05-21 06:21:52,143: Dataframe shape after header adjustments: (741, 39)
+2025-05-21 06:21:52,143: Columns found: ['StartDate', 'EndDate', 'Status', 'IPAddress', 'Progress', 'Duration (in seconds)', 'Finished', 'RecordedDate', 'ResponseId', 'RecipientLastName', 'RecipientFirstName', 'RecipientEmail', 'ExternalReference', 'LocationLatitude', 'LocationLongitude', 'DistributionChannel', 'UserLanguage', 'Q1', 'Q2', 'Q3', 'Q4', 'current_url', 'QID2_OriginalResponse', 'QID2_AICategory', 'QID2_FollowUpPrompt', 'Link URL', 'Q2 - Actionability', 'Q2 - Effort', 'Q2 - Effort Numeric', 'Q2 - Emotion Intensity', 'Q2 - Emotion', 'Q2 - Parent Topics', 'Q2 - Sentiment Polarity', 'Q2 - Sentiment Score', 'Q2 - Sentiment', 'Q2 - Topic Sentiment Label', 'Q2 - Topic Sentiment Score', 'Q2 - Topics', 'Q2 - Topic Hierarchy Level 1']
+2025-05-21 06:21:52,157: Row 0 deleted because Link URL is missing.
+2025-05-21 06:21:52,157: Row 1 deleted because Link URL is missing.
+2025-05-21 06:21:52,157: Row 2 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 3 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 4 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 5 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 6 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 7 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 8 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 9 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 10 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 11 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 12 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 13 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 14 deleted because Link URL is missing.
+2025-05-21 06:21:52,158: Row 15 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 16 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 17 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 18 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 19 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 20 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 21 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 22 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 23 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 24 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 25 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 26 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 27 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 28 deleted because Link URL is missing.
+2025-05-21 06:21:52,159: Row 29 deleted because Link URL is missing.
+2025-05-21 06:21:52,160: Row 30 deleted because Link URL is missing.
+2025-05-21 06:21:52,160: Row 31 deleted because Link URL is missing.
+2025-05-21 06:21:52,160: Row 32 deleted because Link URL is missing.
+2025-05-21 06:21:52,160: Row 33 deleted because Link URL is missing.
+2025-05-21 06:21:52,160: Row 34 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 35 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 36 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 37 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 38 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 39 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 40 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 41 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 42 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 43 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 44 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 45 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 46 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 47 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 48 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 49 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 50 deleted because Link URL is missing.
+2025-05-21 06:21:52,161: Row 213 deleted because Link URL is missing.
+2025-05-21 06:21:52,162: Rows before removing missing Link URL: 741, after: 689
+2025-05-21 06:21:52,163: Row 51 deleted because Q2 contains 'testing'.
+2025-05-21 06:21:52,163: Row 77 deleted because Q2 contains 'testing'.
+2025-05-21 06:21:52,163: Row 78 deleted because Q2 contains 'testing'.
+2025-05-21 06:21:52,163: Row 169 deleted because Q2 contains 'testing'.
+2025-05-21 06:21:52,163: Rows before removing Q2='testing': 689, after: 685
+2025-05-21 06:21:52,165: Row 58: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
+2025-05-21 06:21:52,165: Row 59: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/upgrade-to-v4/#update-custom-resource-apiversion to https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/upgrade-to-v4/
+2025-05-21 06:21:52,165: Row 71: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/custom-templates to https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/custom-templates/
+2025-05-21 06:21:52,165: Row 88: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/overview/design/#nginx-ingress-controller-process-components to https://docs.nginx.com/nginx-ingress-controller/overview/design/
+2025-05-21 06:21:52,165: Row 115: Link URL updated from https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#weights to https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/
+2025-05-21 06:21:52,165: Row 120: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
+2025-05-21 06:21:52,165: Row 152: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/glossary/#ingress-controller-ingress-controller to https://docs.nginx.com/nginx-ingress-controller/glossary/
+2025-05-21 06:21:52,165: Row 297: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
+2025-05-21 06:21:52,165: Row 308: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
+2025-05-21 06:21:52,166: Row 324: Link URL updated from https://docs.nginx.com/nginxaas-azure/known-issues/ to https://docs.nginx.com/nginxaas/azure/known-issues/ (URL replacement)
+2025-05-21 06:21:52,166: Row 324: Link URL updated from https://docs.nginx.com/nginxaas-azure/known-issues/ to https://docs.nginx.com/nginxaas/azure/known-issues/
+2025-05-21 06:21:52,166: Row 367: Link URL updated from https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/#prebuilt to https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/
+2025-05-21 06:21:52,166: Row 395: Link URL updated from https://docs.nginx.com/nginx/admin-guide/web-server/web-server/#locations to https://docs.nginx.com/nginx/admin-guide/web-server/web-server/
+2025-05-21 06:21:52,166: Row 396: Link URL updated from https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#method to https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/
+2025-05-21 06:21:52,166: Row 417: Link URL updated from https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/#virtual-servers to https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/
+2025-05-21 06:21:52,166: Row 418: Link URL updated from https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/#upgrading-nginx-plus to https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/
+2025-05-21 06:21:52,166: Row 477: Link URL updated from https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/#master-and-worker-processes to https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/
+2025-05-21 06:21:52,166: Row 501: Link URL updated from https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source to https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/
+2025-05-21 06:21:52,167: Row 587: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
+2025-05-21 06:21:52,167: Row 590: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
+2025-05-21 06:21:52,167: Row 592: Link URL updated from https://docs.nginx.com/nginx-one/getting-started/#enable-nginx-plus-api to https://docs.nginx.com/nginx-one/getting-started/
+2025-05-21 06:21:52,167: Row 617: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource to https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/
+2025-05-21 06:21:52,167: Row 636: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
+2025-05-21 06:21:52,167: Row 692: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
+2025-05-21 06:21:52,167: Row 695: Link URL updated from https://docs.nginx.com/nginx-management-suite/acm/how-to/infrastructure/manage-api-infrastructure/#add-environment to https://docs.nginx.com/nginx-management-suite/acm/how-to/infrastructure/manage-api-infrastructure/
+2025-05-21 06:21:52,167: Row 729: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments to https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/
+2025-05-21 06:21:52,168: Total Link URLs updated: 26
+2025-05-21 06:21:52,170: Exclude file loaded. Excluding 111 ResponseIDs.
+2025-05-21 06:21:52,172: Excluded bogus responses: removed 104 rows based on ResponseId.
+2025-05-21 06:21:52,172: Removed ResponseIDs: ['R_2BFXRROEE9C3BRP', 'R_2D8NGQPK1IWGIHY', 'R_2FP9OE7JF5GLHOP', 'R_2J2ML9WMO3BCXZ0', 'R_2LGQFCKEOOAPFCT', 'R_2RPFQ7PIR4C48DT', 'R_3J7OQ6V3GPEPYSJ', 'R_3JG7M3IHPME7LRX', 'R_401DHNTF0HMOWBL', 'R_40YHV7FFGANJU6F', 'R_424K44PYVRK8Y1G', 'R_429OWKCURJNOCTK', 'R_42NYN092DSVZXN7', 'R_45R6NUBXVOIPVEN', 'R_47VDGIRXA5NNCGO', 'R_4AK2INIGD1FFTDO', 'R_4BKCWEQU5MOZHA9', 'R_4DLQ3LQ6NHSZHBJ', 'R_4EFZQCTIWFGSTS9', 'R_4EXDDJGUFFTHDCC', 'R_4FO80F1TI4XXMDF', 'R_4GOFQWU2CBJQ9I8', 'R_4HOXH1YLAOVUM8Q', 'R_4JPODUU6FT5EJTD', 'R_4KHCYH2G4RX8GU6', 'R_4LGNMF3ZOJTCHSX', 'R_4MQKUOCWNMU1SPL', 'R_4N9TKVM3T4LLYKG', 'R_4NASUNJJHBDUNYB', 'R_4O67VYRCF2LMJJH', 'R_4OAKKCL6GPFZ6HE', 'R_4P2A79ACQ2DAXVN', 'R_4P9VTDYBBAGHH50', 'R_4QAAZ7C7ZBWLAZP', 'R_4QEFBD2SFDQ0REO', 'R_4QSJZTOLA1EOPTV', 'R_4QVW5AOMQL8JKAH', 'R_4QZ4BOZX5ZAWT8O', 'R_4SBC6FAX8YM8UGW', 'R_4SFJ4F2DSWFAHQZ', 'R_4ST9JXVOCQPNZWV', 'R_4U6KCOFBA0VPNFR', 'R_4VOH9KW1KCSSUJF', 'R_4WMMZUSHCE79AJG', 'R_4YE1NR6MWNJKK3P', 'R_51KKOSYZR16XRWF', 'R_5JBAKUSVN2PQSYJ', 'R_5MMU8NUYQQORLYE', 'R_6F3YPGOQKQMDPMC', 'R_6JLNAULKUPECILR', 'R_6PPUIKFYISENOOK', 'R_6VCPCX5BLHAFBKC', 'R_84BS33CREBBE09U', 'R_85HYVNJRFKFIUZ7', 'R_8C1JLR1AQTTTNE4', 'R_8NMFUZTTQCCOCN1', 'R_8OYXTWQHPPI60A9', 'R_8RTA9M4IQEQQDTR', 'R_8SBR3CGJS6QKOUL', 'R_8TTJC5OTE89JFJJ', 'R_8V8S2WSR76BZVDZ', 'R_8VPTIBSYWQJNJ42', 'R_8WBVOCJ7VLNATZF', 'R_906TQMCOD2GZKZH', 'R_93CMAHY49QS6HFS', 'R_93LGPITFTUNJBD4', 'R_96FPCSSZZ6OQGA5', 'R_97G6U0YYUPWZKAJ', 'R_9889CFZHAMBBJKL', 'R_9949KYHTOMG0ZXU', 'R_99ANGFU2UYWLPTX', 'R_9AGAOUORA4CPHTJ', 'R_9BAI4SFWRIEMME6', 'R_9BSJVEIWI90STOT', 'R_9C5BLPTCDY9OWIP', 'R_9CIYQQ0HJBEUA0O', 'R_9CPNDHPV7ZKBRFP', 'R_9DIMXPUAFKMVKJW', 'R_9DPMP66UHSZNLMP', 'R_9DUZARWZWO1OTNU', 'R_9EIFBZMGJ2RIMFJ', 'R_9EY7BUWKXFBNJWK', 'R_9FWXWDHSKHI0KCC', 'R_9HRYIJ0WJQNXLBV', 'R_9HVUPXH88UF2ALP', 'R_9J6C8A0F54FGTOE', 'R_9J9IEQJV2QIJNOO', 'R_9K6G6NUBNDQSLZC', 'R_9KOOA1DO1YZQCNN', 'R_9LIA90ICK0Z49X1', 'R_9MGHZSS6CHGXIGY', 'R_9MWUMGQY6B6KBSX', 'R_9OHCDWPHUIEEKKU', 'R_9OLOUQJMICBQCSJ', 'R_9PC2GVYGYM5RML5', 'R_9POGVOMHFMYBFJ2', 'R_9PPYOF1BOHS61LV', 'R_9QKQ89HE4TJYTIY', 'R_9ROSQUGFBCRUCUU', 'R_9RPKMREBNL1WAIO', 'R_9SUDDZVEJT2JFAS', 'R_9UASQESCV6I1RJD', 'R_9VIEDXC63JY6EL7', 'R_9ZAMFS0DAF1Z2ZT']
+2025-05-21 06:21:52,175: Row 712: Found and removed 1 email(s) from Q2.
+2025-05-21 06:21:52,175: Row 728: Found and removed 1 email(s) from Q2.
+2025-05-21 06:21:52,739: Row 52: Reverse geocoded lat=-29.9228, lon=-51.1744 -> country=Brazil, city=Canoas, state=Rio Grande do Sul
+2025-05-21 06:21:53,745: Row 53: Reverse geocoded lat=26.8756, lon=80.9115 -> country=India, city=Lucknow, state=Uttar Pradesh
+2025-05-21 06:21:54,735: Row 54: Reverse geocoded lat=13.6671, lon=100.5775 -> country=Thailand, city=Pu Chao Saming Phrai Town Municipality, state=None
+2025-05-21 06:21:55,697: Row 55: Reverse geocoded lat=36.6229, lon=114.4698 -> country=China, city=Handan, state=Hebei
+2025-05-21 06:21:56,656: Row 56: Reverse geocoded lat=-16.561, lon=-49.2063 -> country=Brazil, city=Goiânia, state=Goiás
+2025-05-21 06:21:57,664: Row 57: Reverse geocoded lat=-16.561, lon=-49.2063 -> country=Brazil, city=Goiânia, state=Goiás
+2025-05-21 06:21:58,695: Row 58: Reverse geocoded lat=53.481, lon=-2.2367 -> country=United Kingdom, city=Manchester, state=England
+2025-05-21 06:21:59,700: Row 60: Reverse geocoded lat=50.1187, lon=8.6842 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:22:00,919: Row 61: Reverse geocoded lat=17.9641, lon=102.5987 -> country=Laos, city=Vientiane Capital, state=Vientiane Prefecture
+2025-05-21 06:22:01,696: Row 62: Reverse geocoded lat=25.5908, lon=85.1348 -> country=India, city=Patna, state=Bihar
+2025-05-21 06:22:02,796: Row 63: Reverse geocoded lat=13.7159, lon=100.417 -> country=Thailand, city=Bangkok, state=None
+2025-05-21 06:22:04,250: Row 64: Reverse geocoded lat=48.157, lon=17.0915 -> country=Slovakia, city=Bratislava, state=Region of Bratislava
+2025-05-21 06:22:04,695: Row 65: Reverse geocoded lat=20.6381, lon=-103.348 -> country=Mexico, city=Guadalajara, state=Jalisco
+2025-05-21 06:22:05,783: Row 66: Reverse geocoded lat=22.155, lon=-101.9465 -> country=Mexico, city=Villa García, state=Zacatecas
+2025-05-21 06:22:07,105: Row 68: Reverse geocoded lat=49.1231, lon=8.6011 -> country=Germany, city=Bruchsal, state=Baden-Württemberg
+2025-05-21 06:22:07,783: Row 69: Reverse geocoded lat=49.1231, lon=8.6011 -> country=Germany, city=Bruchsal, state=Baden-Württemberg
+2025-05-21 06:22:08,729: Row 70: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
+2025-05-21 06:22:09,796: Row 71: Reverse geocoded lat=39.8655, lon=-86.122 -> country=United States, city=Indianapolis, state=Indiana
+2025-05-21 06:22:10,932: Row 72: Reverse geocoded lat=38.7584, lon=-9.2495 -> country=Portugal, city=Sintra, state=None
+2025-05-21 06:22:11,896: Row 73: Reverse geocoded lat=52.9044, lon=-1.2326 -> country=United Kingdom, city=Nottingham, state=England
+2025-05-21 06:22:12,850: Row 74: Reverse geocoded lat=50.1155, lon=14.4124 -> country=Czechia, city=Capital City of Prague, state=Prague
+2025-05-21 06:22:14,282: Row 75: Reverse geocoded lat=51.3593, lon=7.4763 -> country=Germany, city=Hagen, state=North Rhine-Westphalia
+2025-05-21 06:22:14,794: Row 76: Reverse geocoded lat=-1.2841, lon=36.8155 -> country=Kenya, city=Nairobi, state=Nairobi County
+2025-05-21 06:22:15,810: Row 79: Reverse geocoded lat=46.0653, lon=23.5917 -> country=Romania, city=Alba Iulia, state=None
+2025-05-21 06:22:16,899: Row 80: Reverse geocoded lat=46.7657, lon=23.5943 -> country=Romania, city=Cluj-Napoca, state=None
+2025-05-21 06:22:17,742: Row 81: Reverse geocoded lat=51.4964, lon=-0.1224 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:22:19,063: Row 82: Reverse geocoded lat=34.6946, lon=135.5021 -> country=Japan, city=Osaka, state=None
+2025-05-21 06:22:19,876: Row 83: Reverse geocoded lat=37.5079, lon=127.1177 -> country=South Korea, city=Seoul, state=None
+2025-05-21 06:22:20,974: Row 84: Reverse geocoded lat=46.4752, lon=30.7338 -> country=Ukraine, city=Odesa, state=Odesa Oblast
+2025-05-21 06:22:21,672: Row 85: Reverse geocoded lat=46.4752, lon=30.7338 -> country=Ukraine, city=Odesa, state=Odesa Oblast
+2025-05-21 06:22:22,667: Row 86: Reverse geocoded lat=-23.1798, lon=-46.8816 -> country=Brazil, city=Jundiaí, state=São Paulo
+2025-05-21 06:22:23,748: Row 87: Reverse geocoded lat=37.5537, lon=-77.4602 -> country=United States, city=Richmond, state=Virginia
+2025-05-21 06:22:24,717: Row 88: Reverse geocoded lat=22.2578, lon=114.1657 -> country=China, city=Hong Kong Island, state=Hong Kong
+2025-05-21 06:22:25,754: Row 89: Reverse geocoded lat=36.7637, lon=-119.7602 -> country=United States, city=Fresno, state=California
+2025-05-21 06:22:26,727: Row 90: Reverse geocoded lat=28.6542, lon=77.2373 -> country=India, city=Delhi, state=Delhi
+2025-05-21 06:22:27,804: Row 91: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
+2025-05-21 06:22:29,090: Row 92: Reverse geocoded lat=3.1685, lon=101.7034 -> country=Malaysia, city=Kuala Lumpur, state=Kuala Lumpur
+2025-05-21 06:22:29,779: Row 93: Reverse geocoded lat=36.7943, lon=-119.8856 -> country=United States, city=Fresno, state=California
+2025-05-21 06:22:30,928: Row 94: Reverse geocoded lat=47.1085, lon=15.7054 -> country=Austria, city=Gleisdorf, state=Styria
+2025-05-21 06:22:31,774: Row 95: Reverse geocoded lat=14.5971, lon=120.9798 -> country=Philippines, city=Manila, state=None
+2025-05-21 06:22:32,873: Row 96: Reverse geocoded lat=30.5851, lon=114.2662 -> country=China, city=Jianghan District, state=Hubei
+2025-05-21 06:22:33,711: Row 97: Reverse geocoded lat=32.4643, lon=14.5726 -> country=Libya, city=Zliten, state=Bani Walid
+2025-05-21 06:22:34,796: Row 98: Reverse geocoded lat=59.3591, lon=17.9951 -> country=Sweden, city=Solna, state=None
+2025-05-21 06:22:35,676: Row 99: Reverse geocoded lat=38.8897, lon=-121.2873 -> country=United States, city=Lincoln, state=California
+2025-05-21 06:22:36,708: Row 100: Reverse geocoded lat=-22.9616, lon=-49.8632 -> country=Brazil, city=Ourinhos, state=São Paulo
+2025-05-21 06:22:37,835: Row 101: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:22:38,698: Row 102: Reverse geocoded lat=39.018, lon=-77.539 -> country=United States, city=None, state=Virginia
+2025-05-21 06:22:39,654: Row 103: Reverse geocoded lat=40.1086, lon=-75.2835 -> country=United States, city=Plymouth Township, state=Pennsylvania
+2025-05-21 06:22:40,744: Row 104: Reverse geocoded lat=46.0653, lon=23.5917 -> country=Romania, city=Alba Iulia, state=None
+2025-05-21 06:22:41,718: Row 105: Reverse geocoded lat=-6.175, lon=106.8286 -> country=Indonesia, city=Special capital Region of Jakarta, state=None
+2025-05-21 06:22:42,737: Row 106: Reverse geocoded lat=37.1554, lon=9.7861 -> country=Tunisia, city=None, state=Bizerte
+2025-05-21 06:22:43,679: Row 107: Reverse geocoded lat=51.2437, lon=-2.2746 -> country=United Kingdom, city=None, state=England
+2025-05-21 06:22:44,800: Row 108: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
+2025-05-21 06:22:45,823: Row 109: Reverse geocoded lat=32.4633, lon=44.4179 -> country=Iraq, city=Al Hillah, state=Babil Governorate
+2025-05-21 06:22:46,743: Row 110: Reverse geocoded lat=-33.8715, lon=151.2006 -> country=Australia, city=Sydney, state=New South Wales
+2025-05-21 06:22:47,768: Row 111: Reverse geocoded lat=14.3269, lon=120.9336 -> country=Philippines, city=Dasmariñas, state=Cavite
+2025-05-21 06:22:48,782: Row 112: Reverse geocoded lat=36.3188, lon=139.579 -> country=Japan, city=Sano, state=None
+2025-05-21 06:22:49,815: Row 114: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
+2025-05-21 06:22:50,739: Row 115: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
+2025-05-21 06:22:51,687: Row 116: Reverse geocoded lat=39.018, lon=-77.539 -> country=United States, city=None, state=Virginia
+2025-05-21 06:22:52,702: Row 117: Reverse geocoded lat=42.6826, lon=23.3223 -> country=Bulgaria, city=Sofia, state=Sofia-City
+2025-05-21 06:22:53,690: Row 119: Reverse geocoded lat=38.7219, lon=-9.1398 -> country=Portugal, city=Lisbon, state=None
+2025-05-21 06:22:54,806: Row 120: Reverse geocoded lat=35.5641, lon=139.5295 -> country=Japan, city=Yokohama, state=None
+2025-05-21 06:22:55,755: Row 121: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
+2025-05-21 06:22:56,698: Row 122: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
+2025-05-21 06:22:57,803: Row 123: Reverse geocoded lat=11.3085, lon=106.0948 -> country=Vietnam, city=Tây Ninh, state=Tây Ninh Province
+2025-05-21 06:22:58,705: Row 124: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:22:59,737: Row 125: Reverse geocoded lat=14.3614, lon=121.4875 -> country=Philippines, city=Paete, state=Laguna
+2025-05-21 06:23:00,876: Row 126: Reverse geocoded lat=29.3959, lon=-98.4761 -> country=United States, city=San Antonio, state=Texas
+2025-05-21 06:23:01,698: Row 127: Reverse geocoded lat=26.1885, lon=91.7392 -> country=India, city=None, state=Assam
+2025-05-21 06:23:02,688: Row 128: Reverse geocoded lat=-18.913, lon=47.5296 -> country=Madagascar, city=Antananarivo, state=Analamanga
+2025-05-21 06:23:03,716: Row 129: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:23:05,028: Row 131: Reverse geocoded lat=52.1928, lon=5.4199 -> country=Netherlands, city=Amersfoort, state=Utrecht
+2025-05-21 06:23:06,180: Row 132: Reverse geocoded lat=51.9277, lon=4.5844 -> country=Netherlands, city=Capelle aan den IJssel, state=South Holland
+2025-05-21 06:23:06,676: Row 133: Reverse geocoded lat=40.5828, lon=-73.9532 -> country=United States, city=New York, state=New York
+2025-05-21 06:23:07,719: Row 134: Reverse geocoded lat=36.5312, lon=3.0698 -> country=Algeria, city=Bougara, state=Blida
+2025-05-21 06:23:09,028: Row 135: Reverse geocoded lat=49.2625, lon=8.6235 -> country=Germany, city=None, state=Baden-Württemberg
+2025-05-21 06:23:09,811: Row 137: Reverse geocoded lat=36.061, lon=120.3814 -> country=China, city=Shinan District, state=Shandong
+2025-05-21 06:23:11,054: Row 138: Reverse geocoded lat=20.0024, lon=73.7945 -> country=India, city=Nashik, state=Maharashtra
+2025-05-21 06:23:11,728: Row 139: Reverse geocoded lat=-25.0907, lon=-50.1653 -> country=Brazil, city=Ponta Grossa, state=Paraná
+2025-05-21 06:23:12,696: Row 140: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
+2025-05-21 06:23:14,214: Row 141: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
+2025-05-21 06:23:15,323: Row 142: Reverse geocoded lat=36.1898, lon=44.0157 -> country=Iraq, city=Erbil, state=Erbil Governorate
+2025-05-21 06:23:16,104: Row 143: Reverse geocoded lat=53.3382, lon=-6.2591 -> country=Ireland, city=Dublin, state=None
+2025-05-21 06:23:16,986: Row 144: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
+2025-05-21 06:23:18,038: Row 145: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:23:19,029: Row 146: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:23:20,112: Row 147: Reverse geocoded lat=40.7547, lon=-73.9614 -> country=United States, city=New York, state=New York
+2025-05-21 06:23:21,068: Row 148: Reverse geocoded lat=31.33, lon=75.5844 -> country=India, city=Jalandhar, state=Punjab
+2025-05-21 06:23:22,064: Row 149: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
+2025-05-21 06:23:23,110: Row 150: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:23:24,010: Row 151: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
+2025-05-21 06:23:24,998: Row 152: Reverse geocoded lat=36.61, lon=114.4876 -> country=China, city=Handan, state=Hebei
+2025-05-21 06:23:26,476: Row 154: Reverse geocoded lat=44.776, lon=17.1995 -> country=Bosnia and Herzegovina, city=Banja Luka, state=Republika Srpska
+2025-05-21 06:23:26,997: Row 155: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:23:28,037: Row 156: Reverse geocoded lat=51.4964, lon=-0.1224 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:23:29,244: Row 157: Reverse geocoded lat=35.5641, lon=45.4326 -> country=Iraq, city=Sulaymaniyah, state=Sulaymaniyah Governorate
+2025-05-21 06:23:29,989: Row 158: Reverse geocoded lat=35.5641, lon=45.4326 -> country=Iraq, city=Sulaymaniyah, state=Sulaymaniyah Governorate
+2025-05-21 06:23:31,087: Row 159: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:23:32,044: Row 160: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:23:33,016: Row 161: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:23:34,029: Row 162: Reverse geocoded lat=-22.8951, lon=-47.0439 -> country=Brazil, city=Campinas, state=São Paulo
+2025-05-21 06:23:35,059: Row 163: Reverse geocoded lat=4.0505, lon=9.7023 -> country=Cameroon, city=Douala I, state=Littoral
+2025-05-21 06:23:36,094: Row 164: Reverse geocoded lat=19.4371, lon=-99.0111 -> country=Mexico, city=Texcoco de Mora, state=State of Mexico
+2025-05-21 06:23:37,037: Row 165: Reverse geocoded lat=60.1719, lon=24.9347 -> country=Finland, city=Helsinki, state=Uusimaa
+2025-05-21 06:23:38,004: Row 166: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:23:39,241: Row 167: Reverse geocoded lat=49.5546, lon=25.5842 -> country=Ukraine, city=Ternopil, state=Ternopil Oblast
+2025-05-21 06:23:40,016: Row 168: Reverse geocoded lat=40.4327, lon=-3.621 -> country=Spain, city=Madrid, state=Community of Madrid
+2025-05-21 06:23:41,041: Row 170: Reverse geocoded lat=-24.0589, lon=-46.8456 -> country=Brazil, city=Itanhaem, state=São Paulo
+2025-05-21 06:23:42,079: Row 171: Reverse geocoded lat=33.3967, lon=-111.6545 -> country=United States, city=Mesa, state=Arizona
+2025-05-21 06:23:43,013: Row 172: Reverse geocoded lat=33.3967, lon=-111.6545 -> country=United States, city=Mesa, state=Arizona
+2025-05-21 06:23:44,056: Row 173: Reverse geocoded lat=21.9974, lon=79.0011 -> country=India, city=Malhanwara, state=Madhya Pradesh
+2025-05-21 06:23:45,153: Row 174: Reverse geocoded lat=51.7655, lon=-0.4482 -> country=United Kingdom, city=Dacorum, state=England
+2025-05-21 06:23:46,204: Row 175: Reverse geocoded lat=26.58, lon=106.7223 -> country=China, city=Yunyan, state=Guizhou
+2025-05-21 06:23:47,032: Row 176: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
+2025-05-21 06:23:48,146: Row 177: Reverse geocoded lat=30.6667, lon=104.0667 -> country=China, city=Chengdu, state=Sichuan
+2025-05-21 06:23:48,996: Row 178: Reverse geocoded lat=48, lon=68 -> country=Kazakhstan, city=Jezqazğan, state=Ulytau Region
+2025-05-21 06:23:50,382: Row 179: Reverse geocoded lat=41.0145, lon=28.9533 -> country=Turkey, city=Istanbul, state=Istanbul
+2025-05-21 06:23:51,037: Row 180: Reverse geocoded lat=60.1719, lon=24.9347 -> country=Finland, city=Helsinki, state=Uusimaa
+2025-05-21 06:23:52,005: Row 181: Reverse geocoded lat=37.1038, lon=-113.5764 -> country=United States, city=Saint George, state=Utah
+2025-05-21 06:23:53,205: Row 182: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:23:54,144: Row 183: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:23:55,048: Row 184: Reverse geocoded lat=22.6276, lon=110.1507 -> country=China, city=Yulin, state=Guangxi
+2025-05-21 06:23:55,996: Row 185: Reverse geocoded lat=-26.9873, lon=-48.6276 -> country=Brazil, city=Balneário Camboriú, state=Santa Catarina
+2025-05-21 06:23:57,100: Row 186: Reverse geocoded lat=-27.6157, lon=-48.6235 -> country=Brazil, city=São José, state=Santa Catarina
+2025-05-21 06:23:58,085: Row 187: Reverse geocoded lat=23.1181, lon=113.2539 -> country=China, city=Yuexiu District, state=Guangdong Province
+2025-05-21 06:23:59,137: Row 188: Reverse geocoded lat=58.0701, lon=11.8131 -> country=Sweden, city=Stenungsön, state=None
+2025-05-21 06:24:00,071: Row 189: Reverse geocoded lat=50.6223, lon=26.2396 -> country=Ukraine, city=Rivne, state=Rivne Oblast
+2025-05-21 06:24:01,008: Row 190: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
+2025-05-21 06:24:02,316: Row 191: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
+2025-05-21 06:24:03,051: Row 192: Reverse geocoded lat=11.5583, lon=104.9121 -> country=Cambodia, city=Khan Prampi Makara, state=Phnom Penh
+2025-05-21 06:24:04,186: Row 193: Reverse geocoded lat=29.3885, lon=76.9669 -> country=India, city=Panipat, state=Haryana
+2025-05-21 06:24:05,218: Row 194: Reverse geocoded lat=44.447, lon=26.0185 -> country=Romania, city=Roșu, state=None
+2025-05-21 06:24:06,146: Row 195: Reverse geocoded lat=-6.2114, lon=106.8446 -> country=Indonesia, city=Special capital Region of Jakarta, state=None
+2025-05-21 06:24:07,006: Row 196: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
+2025-05-21 06:24:08,129: Row 197: Reverse geocoded lat=33.8651, lon=-118.0673 -> country=United States, city=Cerritos, state=California
+2025-05-21 06:24:09,049: Row 198: Reverse geocoded lat=25.2925, lon=51.5321 -> country=Qatar, city=Doha, state=None
+2025-05-21 06:24:10,356: Row 199: Reverse geocoded lat=-6.2876, lon=106.722 -> country=Indonesia, city=South Tangerang, state=Banten
+2025-05-21 06:24:11,120: Row 200: Reverse geocoded lat=47.1449, lon=8.1551 -> country=Switzerland, city=Eich, state=Lucerne
+2025-05-21 06:24:12,261: Row 201: Reverse geocoded lat=41.6959, lon=44.832 -> country=Georgia, city=Tbilisi, state=None
+2025-05-21 06:24:13,784: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.0389&lon=102.7183&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:14,128: Row 202: Reverse geocoded lat=25.0389, lon=102.7183 -> country=China, city=Guandu, state=Yunnan
+2025-05-21 06:24:15,125: Row 203: Reverse geocoded lat=-23.4553, lon=-46.3348 -> country=Brazil, city=Itaquaquecetuba, state=São Paulo
+2025-05-21 06:24:16,063: Row 204: Reverse geocoded lat=19.3808, lon=-99.1982 -> country=Mexico, city=Mexico City, state=Mexico City
+2025-05-21 06:24:17,072: Row 206: Reverse geocoded lat=-23.5246, lon=-46.1835 -> country=Brazil, city=Mogi das Cruzes, state=São Paulo
+2025-05-21 06:24:18,143: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.7531&lon=10.1419&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:19,111: Row 207: Reverse geocoded lat=59.7531, lon=10.1419 -> country=Norway, city=Drammen, state=None
+2025-05-21 06:24:20,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.2253&lon=6.1516&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:21,105: Row 208: Reverse geocoded lat=46.2253, lon=6.1516 -> country=Switzerland, city=Geneva, state=Geneva
+2025-05-21 06:24:22,110: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5042&lon=-0.2199000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:23,207: Row 209: Reverse geocoded lat=51.5042, lon=-0.2199 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:24:24,090: Row 210: Reverse geocoded lat=51.5042, lon=-0.2199 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:24:25,124: Row 211: Reverse geocoded lat=51.5042, lon=-0.2199 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:24:26,220: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.7018&lon=90.3742&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:27,085: Row 212: Reverse geocoded lat=23.7018, lon=90.3742 -> country=Bangladesh, city=Keraniganj, state=Dhaka Division
+2025-05-21 06:24:28,068: Row 214: Reverse geocoded lat=34.7732, lon=113.722 -> country=China, city=Jinshui District, state=Henan
+2025-05-21 06:24:29,093: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.3917&lon=-0.5099000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:30,169: Row 215: Reverse geocoded lat=51.3917, lon=-0.5099 -> country=United Kingdom, city=Borough of Runnymede, state=England
+2025-05-21 06:24:31,174: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.3382&lon=-6.2591&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:32,217: Row 216: Reverse geocoded lat=53.3382, lon=-6.2591 -> country=Ireland, city=Dublin, state=None
+2025-05-21 06:24:33,108: Row 217: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
+2025-05-21 06:24:34,051: Row 218: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
+2025-05-21 06:24:35,082: Row 219: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:24:36,211: Row 220: Reverse geocoded lat=51.5088, lon=-0.093 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:24:37,231: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-30.3299&lon=-54.3251&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:38,102: Row 221: Reverse geocoded lat=-30.3299, lon=-54.3251 -> country=Brazil, city=São Gabriel, state=Rio Grande do Sul
+2025-05-21 06:24:39,107: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=36.7906&lon=118.0633&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:40,047: Row 222: Reverse geocoded lat=36.7906, lon=118.0633 -> country=China, city=Zhangdian District, state=Shandong
+2025-05-21 06:24:41,051: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.0&lon=70.0&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:42,032: Row 223: Reverse geocoded lat=30, lon=70 -> country=Pakistan, city=Fort Monroe, state=Punjab
+2025-05-21 06:24:43,041: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3388&lon=-121.8916&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:44,063: Row 224: Reverse geocoded lat=37.3388, lon=-121.8916 -> country=United States, city=San Jose, state=California
+2025-05-21 06:24:45,039: Row 225: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
+2025-05-21 06:24:46,071: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.6808&lon=112.4531&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:47,050: Row 226: Reverse geocoded lat=34.6808, lon=112.4531 -> country=China, city=Luoyang, state=Henan
+2025-05-21 06:24:48,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=31.9555&lon=35.9435&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:49,125: Row 228: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
+2025-05-21 06:24:50,043: Row 229: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
+2025-05-21 06:24:51,032: Row 230: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
+2025-05-21 06:24:52,058: Row 231: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
+2025-05-21 06:24:53,109: Row 232: Reverse geocoded lat=30.7488, lon=120.7486 -> country=China, city=Nanhu District, state=Zhejiang
+2025-05-21 06:24:54,077: Row 233: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
+2025-05-21 06:24:55,148: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=13.0895&lon=80.2739&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:56,076: Row 234: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:24:57,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-34.9087&lon=-56.1539&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:24:58,126: Row 235: Reverse geocoded lat=-34.9087, lon=-56.1539 -> country=Uruguay, city=Montevideo, state=Montevideo
+2025-05-21 06:24:59,082: Row 236: Reverse geocoded lat=38.3169, lon=116.8478 -> country=China, city=Yunhe District, state=Hebei
+2025-05-21 06:25:00,075: Row 240: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
+2025-05-21 06:25:01,094: Row 241: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
+2025-05-21 06:25:02,097: Row 243: Reverse geocoded lat=39.911, lon=116.395 -> country=China, city=Dongcheng District, state=Beijing
+2025-05-21 06:25:03,109: Row 244: Reverse geocoded lat=34.1794, lon=117.1612 -> country=China, city=Tongshan District, state=Jiangsu
+2025-05-21 06:25:04,149: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.4146&lon=-2.2274&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:05,127: Row 245: Reverse geocoded lat=53.4146, lon=-2.2274 -> country=United Kingdom, city=Manchester, state=England
+2025-05-21 06:25:06,129: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.9158&lon=-1.3601&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:07,140: Row 246: Reverse geocoded lat=50.9158, lon=-1.3601 -> country=United Kingdom, city=Southampton, state=England
+2025-05-21 06:25:08,145: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.1169&lon=8.6837&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:09,175: Row 247: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:25:10,113: Row 248: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
+2025-05-21 06:25:11,098: Row 250: Reverse geocoded lat=26.9136, lon=75.7858 -> country=India, city=Jaipur, state=Rajasthan
+2025-05-21 06:25:12,068: Row 251: Reverse geocoded lat=-34.1801, lon=-58.9181 -> country=Argentina, city=None, state=Buenos Aires
+2025-05-21 06:25:13,178: Row 252: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:25:14,161: Row 253: Reverse geocoded lat=31.8696, lon=117.293 -> country=China, city=Luyang District, state=Anhui
+2025-05-21 06:25:15,093: Row 254: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:25:16,115: Row 255: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
+2025-05-21 06:25:17,128: Row 257: Reverse geocoded lat=39.0469, lon=-77.4903 -> country=United States, city=Ashburn, state=Virginia
+2025-05-21 06:25:18,210: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=24.8591&lon=66.9983&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:19,043: Row 260: Reverse geocoded lat=24.8591, lon=66.9983 -> country=Pakistan, city=Karachi Division, state=None
+2025-05-21 06:25:20,047: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=24.8591&lon=66.9983&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:21,030: Row 261: Reverse geocoded lat=24.8591, lon=66.9983 -> country=Pakistan, city=Karachi Division, state=None
+2025-05-21 06:25:22,032: Row 264: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
+2025-05-21 06:25:23,036: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.5549&lon=13.4645&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:24,105: Row 265: Reverse geocoded lat=52.5549, lon=13.4645 -> country=Germany, city=Berlin, state=None
+2025-05-21 06:25:25,060: Row 266: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:25:26,113: Row 267: Reverse geocoded lat=51.5081, lon=-0.1278 -> country=United Kingdom, city=City of Westminster, state=England
+2025-05-21 06:25:27,068: Row 268: Reverse geocoded lat=39.911, lon=116.395 -> country=China, city=Dongcheng District, state=Beijing
+2025-05-21 06:25:28,127: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=21.1463&lon=79.0849&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:29,083: Row 269: Reverse geocoded lat=21.1463, lon=79.0849 -> country=India, city=Nagpur, state=Maharashtra
+2025-05-21 06:25:30,079: Row 270: Reverse geocoded lat=43.0147, lon=-81.3049 -> country=Canada, city=London, state=Ontario
+2025-05-21 06:25:31,088: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-33.914&lon=18.4129&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:32,098: Row 271: Reverse geocoded lat=-33.914, lon=18.4129 -> country=South Africa, city=Cape Town, state=Western Cape
+2025-05-21 06:25:33,102: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.5053&lon=-81.5566&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:25:34,193: Row 272: Reverse geocoded lat=41.5053, lon=-81.5566 -> country=United States, city=Cleveland Heights, state=Ohio
+2025-05-21 06:25:35,011: Row 273: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
+2025-05-21 06:25:36,116: Row 274: Reverse geocoded lat=-27.6157, lon=-48.6235 -> country=Brazil, city=São José, state=Santa Catarina
+2025-05-21 06:25:37,119: Row 275: Reverse geocoded lat=40.4422, lon=-79.9927 -> country=United States, city=Pittsburgh, state=Pennsylvania
+2025-05-21 06:25:38,061: Row 276: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
+2025-05-21 06:25:39,210: Row 277: Reverse geocoded lat=-36.8322, lon=174.7898 -> country=New Zealand, city=Devonport-Takapuna, state=Auckland
+2025-05-21 06:25:40,165: Row 278: Reverse geocoded lat=35.7204, lon=-0.6659 -> country=Algeria, city=Oran, state=Oran
+2025-05-21 06:25:41,206: Row 279: Reverse geocoded lat=41.4765, lon=1.9278 -> country=Spain, city=Martorell, state=Catalonia
+2025-05-21 06:25:42,175: Row 281: Reverse geocoded lat=21, lon=96 -> country=Myanmar, city=Wet Toe, state=Mandalay
+2025-05-21 06:25:43,213: Row 282: Reverse geocoded lat=14.6475, lon=121.0494 -> country=Philippines, city=Quezon City, state=None
+2025-05-21 06:25:44,084: Row 283: Reverse geocoded lat=14.6475, lon=121.0494 -> country=Philippines, city=Quezon City, state=None
+2025-05-21 06:25:45,232: Row 284: Reverse geocoded lat=59.4786, lon=18.2931 -> country=Sweden, city=Åkersberga, state=None
+2025-05-21 06:25:46,462: Row 285: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:25:47,405: Row 287: Reverse geocoded lat=35.4711, lon=44.3925 -> country=Iraq, city=Kirkuk, state=Kirkuk Governorate
+2025-05-21 06:25:48,051: Row 288: Reverse geocoded lat=33.8333, lon=35.8333 -> country=Lebanon, city=Jdita, state=Beqaa Governorate
+2025-05-21 06:25:49,219: Row 289: Reverse geocoded lat=48.0295, lon=7.573 -> country=France, city=Biesheim, state=Grand Est
+2025-05-21 06:25:50,104: Row 290: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
+2025-05-21 06:25:51,173: Row 291: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
+2025-05-21 06:25:52,465: Row 292: Reverse geocoded lat=51.2192, lon=4.3917 -> country=Belgium, city=Antwerp, state=Antwerp
+2025-05-21 06:25:53,220: Row 294: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:25:54,345: Row 295: Reverse geocoded lat=50.8397, lon=12.9358 -> country=Germany, city=Chemnitz, state=Saxony
+2025-05-21 06:25:55,064: Row 296: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
+2025-05-21 06:25:56,189: Row 297: Reverse geocoded lat=47.4121, lon=8.0864 -> country=Switzerland, city=Biberstein, state=Aargau
+2025-05-21 06:25:57,113: Row 299: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
+2025-05-21 06:25:58,134: Row 300: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:25:59,281: Row 301: Reverse geocoded lat=30.7096, lon=31.2554 -> country=Egypt, city=Mit Ghamr City, state=Ad Dakahliya
+2025-05-21 06:26:00,079: Row 302: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
+2025-05-21 06:26:01,121: Row 303: Reverse geocoded lat=-22.9035, lon=-47.0565 -> country=Brazil, city=Campinas, state=São Paulo
+2025-05-21 06:26:02,232: Row 304: Reverse geocoded lat=44.1145, lon=24.3402 -> country=Romania, city=Caracal, state=None
+2025-05-21 06:26:03,072: Row 305: Reverse geocoded lat=41.8835, lon=-87.6305 -> country=United States, city=Chicago, state=Illinois
+2025-05-21 06:26:04,061: Row 306: Reverse geocoded lat=49.2635, lon=-122.9331 -> country=Canada, city=Burnaby, state=British Columbia
+2025-05-21 06:26:05,101: Row 307: Reverse geocoded lat=36.5312, lon=3.0698 -> country=Algeria, city=Bougara, state=Blida
+2025-05-21 06:26:06,600: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.6113&lon=6.1294&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:07,249: Row 309: Reverse geocoded lat=49.6113, lon=6.1294 -> country=Luxembourg, city=Luxembourg, state=None
+2025-05-21 06:26:08,163: Row 310: Reverse geocoded lat=0.321, lon=32.5714 -> country=Uganda, city=Kampala, state=Central Region
+2025-05-21 06:26:09,135: Row 311: Reverse geocoded lat=-29.9434, lon=-50.9934 -> country=Brazil, city=Gravataí, state=Rio Grande do Sul
+2025-05-21 06:26:10,215: Row 312: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
+2025-05-21 06:26:11,056: Row 313: Reverse geocoded lat=-7.2333, lon=-62.9 -> country=Brazil, city=Humaitá, state=Amazonas
+2025-05-21 06:26:12,118: Row 314: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:26:13,119: Row 315: Reverse geocoded lat=-16.7267, lon=-49.1091 -> country=Brazil, city=Senador Canedo, state=Goiás
+2025-05-21 06:26:14,275: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4466&lon=5.4736&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:15,135: Row 316: Reverse geocoded lat=51.4466, lon=5.4736 -> country=Netherlands, city=Eindhoven, state=North Brabant
+2025-05-21 06:26:16,140: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.8661&lon=11.5154&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:17,081: Row 317: Reverse geocoded lat=3.8661, lon=11.5154 -> country=Cameroon, city=Yaoundé, state=Centre
+2025-05-21 06:26:18,086: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.8661&lon=11.5154&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:19,033: Row 318: Reverse geocoded lat=3.8661, lon=11.5154 -> country=Cameroon, city=Yaoundé, state=Centre
+2025-05-21 06:26:20,038: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=31.7126&lon=76.9328&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:21,081: Row 319: Reverse geocoded lat=31.7126, lon=76.9328 -> country=India, city=Mandi, state=Himachal Pradesh
+2025-05-21 06:26:22,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.5534&lon=7.9519&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:23,182: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.5534&lon=7.9519&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:24,156: Row 320: Reverse geocoded lat=47.5534, lon=7.9519 -> country=Germany, city=Säckingen, state=Baden-Württemberg
+2025-05-21 06:26:25,165: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:26,089: Row 321: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
+2025-05-21 06:26:27,095: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.0848&lon=14.4112&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:28,135: Row 322: Reverse geocoded lat=50.0848, lon=14.4112 -> country=Czechia, city=Capital City of Prague, state=Prague
+2025-05-21 06:26:29,141: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.1477&lon=-3.5655&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:30,020: Row 323: Reverse geocoded lat=37.1477, lon=-3.5655 -> country=Spain, city=Huétor Vega, state=Andalusia
+2025-05-21 06:26:31,024: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.0025&lon=8.9533&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:32,099: Row 325: Reverse geocoded lat=46.0025, lon=8.9533 -> country=Switzerland, city=Lugano, state=Ticino
+2025-05-21 06:26:33,104: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=12.3729&lon=-1.5264&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:34,075: Row 326: Reverse geocoded lat=12.3729, lon=-1.5264 -> country=Burkina Faso, city=Ouagadougou, state=None
+2025-05-21 06:26:35,078: Row 327: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
+2025-05-21 06:26:36,079: Row 328: Reverse geocoded lat=37.9842, lon=23.7353 -> country=Greece, city=Athens, state=Attica
+2025-05-21 06:26:37,067: Row 329: Reverse geocoded lat=54.8636, lon=-7.7557 -> country=Ireland, city=None, state=None
+2025-05-21 06:26:38,083: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.8305&lon=-87.656&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:39,123: Row 330: Reverse geocoded lat=34.8305, lon=-87.656 -> country=United States, city=Florence, state=Alabama
+2025-05-21 06:26:40,128: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.8978&lon=-77.2885&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:41,231: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.8978&lon=-77.2885&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:42,087: Row 331: Reverse geocoded lat=38.8978, lon=-77.2885 -> country=United States, city=Reston, state=Virginia
+2025-05-21 06:26:43,091: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.5&lon=19.0412&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:44,067: Row 332: Reverse geocoded lat=47.5, lon=19.0412 -> country=Hungary, city=Budapest, state=None
+2025-05-21 06:26:45,072: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=21.4668&lon=83.9764&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:46,159: Row 333: Reverse geocoded lat=21.4668, lon=83.9764 -> country=India, city=Sambalpur, state=Odisha
+2025-05-21 06:26:47,170: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.808&lon=-2.1118&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:48,040: Row 334: Reverse geocoded lat=52.808, lon=-2.1118 -> country=United Kingdom, city=Stafford, state=England
+2025-05-21 06:26:49,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-22.2635&lon=-49.1364&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:50,033: Row 335: Reverse geocoded lat=-22.2635, lon=-49.1364 -> country=Brazil, city=Bauru, state=São Paulo
+2025-05-21 06:26:51,039: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.8449&lon=14.2716&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:52,041: Row 336: Reverse geocoded lat=40.8449, lon=14.2716 -> country=Italy, city=Naples, state=Campania
+2025-05-21 06:26:53,045: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=13.6687&lon=100.579&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:54,087: Row 337: Reverse geocoded lat=13.6687, lon=100.579 -> country=Thailand, city=Pu Chao Saming Phrai Town Municipality, state=None
+2025-05-21 06:26:55,092: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.5211&lon=73.8502&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:56,061: Row 338: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:26:57,070: Row 339: Reverse geocoded lat=23.7018, lon=90.3742 -> country=Bangladesh, city=Keraniganj, state=Dhaka Division
+2025-05-21 06:26:58,077: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5112&lon=0.0300000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:26:59,110: Row 340: Reverse geocoded lat=51.5112, lon=0.03 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:27:00,093: Row 341: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:27:01,039: Row 342: Reverse geocoded lat=-7.2333, lon=-62.9 -> country=Brazil, city=Humaitá, state=Amazonas
+2025-05-21 06:27:02,085: Row 343: Reverse geocoded lat=40.7547, lon=-73.9614 -> country=United States, city=New York, state=New York
+2025-05-21 06:27:03,124: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.458&lon=30.5303&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:04,124: Row 344: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
+2025-05-21 06:27:05,122: Row 347: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:27:06,130: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=11.0027&lon=124.6083&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:07,107: Row 348: Reverse geocoded lat=11.0027, lon=124.6083 -> country=Philippines, city=Ormoc, state=Leyte
+2025-05-21 06:27:08,086: Row 349: Reverse geocoded lat=22.717, lon=75.8337 -> country=India, city=Indore, state=Madhya Pradesh
+2025-05-21 06:27:09,050: Row 350: Reverse geocoded lat=22.717, lon=75.8337 -> country=India, city=Indore, state=Madhya Pradesh
+2025-05-21 06:27:10,056: Row 351: Reverse geocoded lat=7.0712, lon=125.6089 -> country=Philippines, city=Davao City, state=None
+2025-05-21 06:27:11,126: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-4.7776&lon=11.8659&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:12,027: Row 352: Reverse geocoded lat=-4.7776, lon=11.8659 -> country=Congo-Brazzaville, city=None, state=Pointe-Noire (département)
+2025-05-21 06:27:13,038: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=19.0748&lon=72.8856&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:14,086: Row 353: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
+2025-05-21 06:27:15,092: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.6874&lon=33.0366&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:16,128: Row 354: Reverse geocoded lat=34.6874, lon=33.0366 -> country=Cyprus, city=Limassol, state=Cyprus
+2025-05-21 06:27:17,066: Row 355: Reverse geocoded lat=34.6874, lon=33.0366 -> country=Cyprus, city=Limassol, state=Cyprus
+2025-05-21 06:27:18,138: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.1953&lon=6.1385&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:19,053: Row 356: Reverse geocoded lat=46.1953, lon=6.1385 -> country=Switzerland, city=Geneva, state=Geneva
+2025-05-21 06:27:20,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.8951&lon=-1.1585&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:21,045: Row 357: Reverse geocoded lat=51.8951, lon=-1.1585 -> country=United Kingdom, city=Cherwell District, state=England
+2025-05-21 06:27:22,055: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.8951&lon=-1.1585&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:23,039: Row 358: Reverse geocoded lat=51.8951, lon=-1.1585 -> country=United Kingdom, city=Cherwell District, state=England
+2025-05-21 06:27:24,046: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.3706&lon=47.9697&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:25,074: Row 359: Reverse geocoded lat=29.3706, lon=47.9697 -> country=Kuwait, city=Kuwait City, state=Capital Governorate
+2025-05-21 06:27:26,078: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3177&lon=-122.0438&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:27,058: Row 360: Reverse geocoded lat=37.3177, lon=-122.0438 -> country=United States, city=Cupertino, state=California
+2025-05-21 06:27:28,064: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.9609&lon=-77.3429&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:29,066: Row 361: Reverse geocoded lat=38.9609, lon=-77.3429 -> country=United States, city=Reston, state=Virginia
+2025-05-21 06:27:30,072: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.1613&lon=-113.9518&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:31,126: Row 363: Reverse geocoded lat=51.1613, lon=-113.9518 -> country=Canada, city=Calgary, state=Alberta
+2025-05-21 06:27:32,130: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.036&lon=114.4654&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:33,052: Row 364: Reverse geocoded lat=38.036, lon=114.4654 -> country=China, city=Shijiazhuang, state=Hebei
+2025-05-21 06:27:34,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.0&lon=105.0&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:35,079: Row 365: Reverse geocoded lat=18, lon=105 -> country=Laos, city=Phonkeo, state=Bolikhamsai
+2025-05-21 06:27:36,084: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=36.096&lon=114.3828&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:37,120: Row 366: Reverse geocoded lat=36.096, lon=114.3828 -> country=China, city=开发区银杏大街街道, state=Henan
+2025-05-21 06:27:38,126: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.6933&lon=-104.7865&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:39,074: Row 367: Reverse geocoded lat=39.6933, lon=-104.7865 -> country=United States, city=Aurora, state=Colorado
+2025-05-21 06:27:40,083: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.7219&lon=-9.1398&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:41,149: Row 368: Reverse geocoded lat=38.7219, lon=-9.1398 -> country=Portugal, city=Lisbon, state=None
+2025-05-21 06:27:42,154: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=17.3843&lon=78.4583&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:43,053: Row 369: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
+2025-05-21 06:27:44,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.8273&lon=-83.2813&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:45,126: Row 370: Reverse geocoded lat=40.8273, lon=-83.2813 -> country=United States, city=Upper Sandusky, state=Ohio
+2025-05-21 06:27:46,132: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=31.2222&lon=121.4581&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:47,091: Row 371: Reverse geocoded lat=31.2222, lon=121.4581 -> country=China, city=Shanghai, state=Shanghai
+2025-05-21 06:27:48,104: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6542&lon=77.2373&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:49,036: Row 372: Reverse geocoded lat=28.6542, lon=77.2373 -> country=India, city=Delhi, state=Delhi
+2025-05-21 06:27:50,026: Row 373: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:27:51,048: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=13.0895&lon=80.2739&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:52,072: Row 374: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:27:53,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.5&lon=-10.0&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:54,053: Row 375: Reverse geocoded lat=28.5, lon=-10 -> country=Morocco, city=Aouint Lahna عوينة لهنا, state=None
+2025-05-21 06:27:55,059: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.0729&lon=7.689&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:56,182: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.0729&lon=7.689&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:27:57,227: Row 377: Reverse geocoded lat=45.0729, lon=7.689 -> country=Italy, city=Turin, state=Piedmont
+2025-05-21 06:27:58,146: Row 378: Reverse geocoded lat=21.4668, lon=83.9764 -> country=India, city=Sambalpur, state=Odisha
+2025-05-21 06:27:59,096: Row 379: Reverse geocoded lat=33.1976, lon=-96.6178 -> country=United States, city=McKinney, state=Texas
+2025-05-21 06:28:00,242: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.7126&lon=-74.0066&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:01,224: Row 380: Reverse geocoded lat=40.7126, lon=-74.0066 -> country=United States, city=New York, state=New York
+2025-05-21 06:28:02,142: Row 381: Reverse geocoded lat=33.4306, lon=-111.9256 -> country=United States, city=Tempe, state=Arizona
+2025-05-21 06:28:03,102: Row 382: Reverse geocoded lat=38.7883, lon=-121.2366 -> country=United States, city=Rocklin, state=California
+2025-05-21 06:28:04,072: Row 383: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
+2025-05-21 06:28:05,222: Row 384: Reverse geocoded lat=51.1876, lon=71.4491 -> country=Kazakhstan, city=Astana, state=Astana
+2025-05-21 06:28:06,135: Row 385: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
+2025-05-21 06:28:07,247: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:08,080: Row 387: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
+2025-05-21 06:28:09,087: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:10,055: Row 388: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
+2025-05-21 06:28:11,060: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:12,078: Row 389: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
+2025-05-21 06:28:13,083: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:14,083: Row 390: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
+2025-05-21 06:28:15,090: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.1023&lon=101.6265&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:16,171: Row 391: Reverse geocoded lat=3.1023, lon=101.6265 -> country=Malaysia, city=Petaling Jaya, state=Selangor
+2025-05-21 06:28:17,178: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3392&lon=-77.4175&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:18,063: Row 392: Reverse geocoded lat=37.3392, lon=-77.4175 -> country=United States, city=None, state=Virginia
+2025-05-21 06:28:19,067: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=21.2339&lon=110.3875&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:20,071: Row 394: Reverse geocoded lat=21.2339, lon=110.3875 -> country=China, city=Chikan District, state=Guangdong Province
+2025-05-21 06:28:21,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=43.3699&lon=-8.4096&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:22,211: Row 395: Reverse geocoded lat=43.3699, lon=-8.4096 -> country=Spain, city=A Coruña, state=Galicia
+2025-05-21 06:28:23,221: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=43.3699&lon=-8.4096&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:24,158: Row 396: Reverse geocoded lat=43.3699, lon=-8.4096 -> country=Spain, city=A Coruña, state=Galicia
+2025-05-21 06:28:25,078: Row 398: Reverse geocoded lat=42.2645, lon=-88.0034 -> country=United States, city=Mundelein, state=Illinois
+2025-05-21 06:28:26,034: Row 399: Reverse geocoded lat=-1.4428, lon=-79.4627 -> country=Ecuador, city=Ventanas, state=Los Ríos
+2025-05-21 06:28:27,126: Row 400: Reverse geocoded lat=-1.4428, lon=-79.4627 -> country=Ecuador, city=Ventanas, state=Los Ríos
+2025-05-21 06:28:28,174: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.0507&lon=31.2489&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:29,174: Row 401: Reverse geocoded lat=30.0507, lon=31.2489 -> country=Egypt, city=Cairo, state=Cairo
+2025-05-21 06:28:30,179: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-33.914&lon=18.4129&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:31,130: Row 403: Reverse geocoded lat=-33.914, lon=18.4129 -> country=South Africa, city=Cape Town, state=Western Cape
+2025-05-21 06:28:32,139: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.4597&lon=77.0282&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:33,081: Row 406: Reverse geocoded lat=28.4597, lon=77.0282 -> country=India, city=Gurgaon, state=Haryana
+2025-05-21 06:28:34,082: Row 407: Reverse geocoded lat=37.3388, lon=-121.8916 -> country=United States, city=San Jose, state=California
+2025-05-21 06:28:35,092: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.1181&lon=113.2539&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:36,089: Row 408: Reverse geocoded lat=23.1181, lon=113.2539 -> country=China, city=Yuexiu District, state=Guangdong Province
+2025-05-21 06:28:37,093: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.3518&lon=0.8088000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:38,131: Row 409: Reverse geocoded lat=49.3518, lon=0.8088 -> country=France, city=Bourg-Achard, state=Normandy
+2025-05-21 06:28:39,141: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.315&lon=83.0058&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:40,072: Row 410: Reverse geocoded lat=25.315, lon=83.0058 -> country=India, city=Varanasi, state=Uttar Pradesh
+2025-05-21 06:28:41,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.3275&lon=78.0325&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:42,079: Row 411: Reverse geocoded lat=30.3275, lon=78.0325 -> country=India, city=Dehradun, state=Uttarakhand
+2025-05-21 06:28:43,089: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=11.9924&lon=8.5173&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:44,125: Row 412: Reverse geocoded lat=11.9924, lon=8.5173 -> country=Nigeria, city=Tudun Wazurchi, state=Kano State
+2025-05-21 06:28:45,133: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.0734&lon=55.2979&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:46,101: Row 413: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
+2025-05-21 06:28:47,057: Row 414: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
+2025-05-21 06:28:48,050: Row 415: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
+2025-05-21 06:28:49,113: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6542&lon=77.2373&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:50,092: Row 416: Reverse geocoded lat=28.6542, lon=77.2373 -> country=India, city=Delhi, state=Delhi
+2025-05-21 06:28:51,096: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.8835&lon=-87.6305&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:52,049: Row 417: Reverse geocoded lat=41.8835, lon=-87.6305 -> country=United States, city=Chicago, state=Illinois
+2025-05-21 06:28:53,056: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.8707&lon=120.0898&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:54,132: Row 418: Reverse geocoded lat=30.8707, lon=120.0898 -> country=China, city=Wuxing District, state=Zhejiang
+2025-05-21 06:28:55,135: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.1302&lon=13.329&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:56,025: Row 419: Reverse geocoded lat=38.1302, lon=13.329 -> country=Italy, city=Palermo, state=Sicily
+2025-05-21 06:28:57,030: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.5852&lon=-0.2360000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:28:58,078: Row 420: Reverse geocoded lat=52.5852, lon=-0.236 -> country=United Kingdom, city=Peterborough, state=England
+2025-05-21 06:28:59,082: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.4073&lon=-121.939&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:00,103: Row 421: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
+2025-05-21 06:29:01,100: Row 422: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
+2025-05-21 06:29:02,114: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6922&lon=12.5478&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:03,221: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6922&lon=12.5478&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:04,095: Row 423: Reverse geocoded lat=55.6922, lon=12.5478 -> country=Denmark, city=Copenhagen, state=Capital Region of Denmark
+2025-05-21 06:29:05,099: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.5943&lon=85.1352&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:06,049: Row 425: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
+2025-05-21 06:29:07,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5064&lon=-0.0200000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:08,080: Row 427: Reverse geocoded lat=51.5064, lon=-0.02 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:29:09,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=56.1567&lon=10.2153&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:10,051: Row 428: Reverse geocoded lat=56.1567, lon=10.2153 -> country=Denmark, city=Aarhus, state=Central Denmark Region
+2025-05-21 06:29:11,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.5547&lon=5.9801&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:12,079: Row 429: Reverse geocoded lat=45.5547, lon=5.9801 -> country=France, city=Challes-les-Eaux, state=Auvergne-Rhône-Alpes
+2025-05-21 06:29:13,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-19.9218&lon=-43.9359&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:14,028: Row 432: Reverse geocoded lat=-19.9218, lon=-43.9359 -> country=Brazil, city=Belo Horizonte, state=Minas Gerais
+2025-05-21 06:29:15,033: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.615&lon=-122.1619&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:16,027: Row 433: Reverse geocoded lat=47.615, lon=-122.1619 -> country=United States, city=Bellevue, state=Washington
+2025-05-21 06:29:17,033: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.8707&lon=120.0898&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:18,075: Row 436: Reverse geocoded lat=30.8707, lon=120.0898 -> country=China, city=Wuxing District, state=Zhejiang
+2025-05-21 06:29:19,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.4381&lon=24.7369&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:20,133: Row 437: Reverse geocoded lat=59.4381, lon=24.7369 -> country=Estonia, city=Tallinn, state=None
+2025-05-21 06:29:21,144: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.8373&lon=80.9165&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:22,051: Row 438: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
+2025-05-21 06:29:23,055: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.8373&lon=80.9165&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:24,064: Row 439: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
+2025-05-21 06:29:25,068: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.5211&lon=73.8502&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:26,114: Row 440: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:29:27,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.9439&lon=5.8939&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:28,100: Row 441: Reverse geocoded lat=51.9439, lon=5.8939 -> country=Netherlands, city=Arnhem, state=Gelderland
+2025-05-21 06:29:29,105: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.7857&lon=98.9736&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:30,104: Row 442: Reverse geocoded lat=18.7857, lon=98.9736 -> country=Thailand, city=Chiang Mai City Municipality, state=None
+2025-05-21 06:29:31,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.4636&lon=85.8783&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:32,202: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.4636&lon=85.8783&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:33,025: Row 443: Reverse geocoded lat=20.4636, lon=85.8783 -> country=India, city=Cuttack, state=Odisha
+2025-05-21 06:29:34,029: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.2253&lon=6.1516&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:35,072: Row 444: Reverse geocoded lat=46.2253, lon=6.1516 -> country=Switzerland, city=Geneva, state=Geneva
+2025-05-21 06:29:36,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.6667&lon=104.0667&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:37,169: Row 446: Reverse geocoded lat=30.6667, lon=104.0667 -> country=China, city=Chengdu, state=Sichuan
+2025-05-21 06:29:38,174: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.1169&lon=8.6837&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:39,115: Row 447: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:29:40,041: Row 448: Reverse geocoded lat=26.3304, lon=-81.5871 -> country=United States, city=None, state=Florida
+2025-05-21 06:29:41,056: Row 449: Reverse geocoded lat=-3.717, lon=-38.5287 -> country=Brazil, city=Fortaleza, state=Ceará
+2025-05-21 06:29:42,047: Row 450: Reverse geocoded lat=55.7481, lon=12.5347 -> country=Denmark, city=Jægersborg, state=Capital Region of Denmark
+2025-05-21 06:29:43,132: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.5625&lon=-122.0004&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:44,023: Row 451: Reverse geocoded lat=37.5625, lon=-122.0004 -> country=United States, city=Fremont, state=California
+2025-05-21 06:29:45,027: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-12.0432&lon=-77.0282&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:46,105: Row 452: Reverse geocoded lat=-12.0432, lon=-77.0282 -> country=Peru, city=Lima, state=Lima
+2025-05-21 06:29:47,111: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.3287&lon=18.0717&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:48,064: Row 453: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
+2025-05-21 06:29:49,045: Row 454: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
+2025-05-21 06:29:50,074: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.1922&lon=20.8846&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:51,089: Row 456: Reverse geocoded lat=52.1922, lon=20.8846 -> country=Poland, city=Warsaw, state=Masovian Voivodeship
+2025-05-21 06:29:52,059: Row 457: Reverse geocoded lat=40.4153, lon=-3.694 -> country=Spain, city=Madrid, state=Community of Madrid
+2025-05-21 06:29:53,098: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.4153&lon=-3.694&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:54,167: Row 458: Reverse geocoded lat=40.4153, lon=-3.694 -> country=Spain, city=Madrid, state=Community of Madrid
+2025-05-21 06:29:55,171: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.3247&lon=18.056&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:56,113: Row 459: Reverse geocoded lat=59.3247, lon=18.056 -> country=Sweden, city=Stockholm, state=None
+2025-05-21 06:29:57,067: Row 460: Reverse geocoded lat=59.3247, lon=18.056 -> country=Sweden, city=Stockholm, state=None
+2025-05-21 06:29:58,118: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.0596&lon=19.9338&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:29:59,092: Row 461: Reverse geocoded lat=50.0596, lon=19.9338 -> country=Poland, city=Krakow, state=Lesser Poland Voivodeship
+2025-05-21 06:30:00,095: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3924&lon=16.9019&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:01,130: Row 462: Reverse geocoded lat=52.3924, lon=16.9019 -> country=Poland, city=Poznan, state=Greater Poland Voivodeship
+2025-05-21 06:30:02,136: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.3287&lon=18.0717&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:03,111: Row 463: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
+2025-05-21 06:30:04,114: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.7599&lon=6.0953&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:05,112: Row 465: Reverse geocoded lat=50.7599, lon=6.0953 -> country=Germany, city=Aachen, state=North Rhine-Westphalia
+2025-05-21 06:30:06,118: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=60.3951&lon=5.3237&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:07,090: Row 466: Reverse geocoded lat=60.3951, lon=5.3237 -> country=Norway, city=Bergen, state=None
+2025-05-21 06:30:08,096: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=60.3951&lon=5.3237&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:09,200: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=60.3951&lon=5.3237&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:10,061: Row 467: Reverse geocoded lat=60.3951, lon=5.3237 -> country=Norway, city=Bergen, state=None
+2025-05-21 06:30:11,055: Row 468: Reverse geocoded lat=60.3951, lon=5.3237 -> country=Norway, city=Bergen, state=None
+2025-05-21 06:30:12,068: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3759&lon=4.8975&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:13,176: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3759&lon=4.8975&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:14,156: Row 469: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
+2025-05-21 06:30:15,095: Row 470: Reverse geocoded lat=-25.5283, lon=-49.2161 -> country=Brazil, city=São José dos Pinhais, state=Paraná
+2025-05-21 06:30:16,166: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.0042&lon=28.8574&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:17,106: Row 471: Reverse geocoded lat=47.0042, lon=28.8574 -> country=Moldova, city=Chișinău, state=None
+2025-05-21 06:30:18,110: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-3.1032&lon=-60.0288&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:19,094: Row 473: Reverse geocoded lat=-3.1032, lon=-60.0288 -> country=Brazil, city=Manaus, state=Amazonas
+2025-05-21 06:30:20,098: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=12.9753&lon=77.591&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:21,083: Row 474: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
+2025-05-21 06:30:22,086: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=54.5455&lon=18.4494&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:23,100: Row 476: Reverse geocoded lat=54.5455, lon=18.4494 -> country=Poland, city=Gdynia, state=Pomeranian Voivodeship
+2025-05-21 06:30:24,104: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.7219&lon=-9.1398&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:25,105: Row 477: Reverse geocoded lat=38.7219, lon=-9.1398 -> country=Portugal, city=Lisbon, state=None
+2025-05-21 06:30:26,109: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.3946&lon=2.1406&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:27,155: Row 478: Reverse geocoded lat=41.3946, lon=2.1406 -> country=Spain, city=Barcelona, state=Catalonia
+2025-05-21 06:30:28,105: Row 479: Reverse geocoded lat=-27.4683, lon=153.0322 -> country=Australia, city=None, state=Queensland
+2025-05-21 06:30:29,165: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.7537&lon=21.2257&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:30,276: Row 480: Reverse geocoded lat=45.7537, lon=21.2257 -> country=Romania, city=Timișoara, state=None
+2025-05-21 06:30:31,158: Row 481: Reverse geocoded lat=53.7606, lon=-0.3734 -> country=United Kingdom, city=Hull, state=England
+2025-05-21 06:30:32,164: Row 482: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
+2025-05-21 06:30:33,286: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3759&lon=4.8975&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:34,191: Row 483: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
+2025-05-21 06:30:35,102: Row 484: Reverse geocoded lat=31.3709, lon=73.0336 -> country=Pakistan, city=Faisalabad City Tehsil, state=Punjab
+2025-05-21 06:30:36,097: Row 485: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
+2025-05-21 06:30:37,127: Row 486: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:30:38,115: Row 487: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
+2025-05-21 06:30:39,209: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.1836&lon=11.5754&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:40,049: Row 488: Reverse geocoded lat=48.1836, lon=11.5754 -> country=Germany, city=Munich, state=Bavaria
+2025-05-21 06:30:41,054: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=54.1085&lon=12.0645&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:42,050: Row 489: Reverse geocoded lat=54.1085, lon=12.0645 -> country=Germany, city=Rostock, state=Mecklenburg-Vorpommern
+2025-05-21 06:30:43,056: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.8327&lon=-9.166&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:44,122: Row 490: Reverse geocoded lat=38.8327, lon=-9.166 -> country=Portugal, city=Loures, state=None
+2025-05-21 06:30:45,127: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=56.9473&lon=24.0979&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:46,055: Row 491: Reverse geocoded lat=56.9473, lon=24.0979 -> country=Latvia, city=Riga, state=None
+2025-05-21 06:30:47,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.9192&lon=73.8741&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:48,167: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.9192&lon=73.8741&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:49,080: Row 494: Reverse geocoded lat=29.9192, lon=73.8741 -> country=India, city=Ganganagar, state=Rajasthan
+2025-05-21 06:30:50,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.1169&lon=8.6837&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:51,090: Row 495: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
+2025-05-21 06:30:52,043: Row 496: Reverse geocoded lat=-29.8553, lon=31.0428 -> country=South Africa, city=Durban, state=KwaZulu-Natal
+2025-05-21 06:30:53,095: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.5689&lon=106.5577&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:54,073: Row 498: Reverse geocoded lat=29.5689, lon=106.5577 -> country=China, city=Yuzhong District, state=Chongqing
+2025-05-21 06:30:55,048: Row 500: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
+2025-05-21 06:30:56,082: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.0582&lon=8.7868&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:57,050: Row 501: Reverse geocoded lat=53.0582, lon=8.7868 -> country=Germany, city=Bremen, state=Bremen
+2025-05-21 06:30:58,053: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=19.0748&lon=72.8856&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:30:59,082: Row 502: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
+2025-05-21 06:31:00,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.0&lon=105.0&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:01,139: Row 503: Reverse geocoded lat=35, lon=105 -> country=China, city=Bangluo, state=Gansu
+2025-05-21 06:31:02,145: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4537&lon=-0.2320000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:03,054: Row 505: Reverse geocoded lat=51.4537, lon=-0.232 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:31:04,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=33.8333&lon=35.8333&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:05,056: Row 507: Reverse geocoded lat=33.8333, lon=35.8333 -> country=Lebanon, city=Jdita, state=Beqaa Governorate
+2025-05-21 06:31:06,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.5971&lon=120.9798&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:07,077: Row 509: Reverse geocoded lat=14.5971, lon=120.9798 -> country=Philippines, city=Manila, state=None
+2025-05-21 06:31:08,081: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.0729&lon=4.5475&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:09,043: Row 510: Reverse geocoded lat=52.0729, lon=4.5475 -> country=Netherlands, city=Benthuizen, state=South Holland
+2025-05-21 06:31:10,049: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.0729&lon=4.5475&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:11,067: Row 511: Reverse geocoded lat=52.0729, lon=4.5475 -> country=Netherlands, city=Benthuizen, state=South Holland
+2025-05-21 06:31:12,073: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:13,109: Row 512: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
+2025-05-21 06:31:14,113: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.9757&lon=-77.6414&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:15,077: Row 513: Reverse geocoded lat=38.9757, lon=-77.6414 -> country=United States, city=Aldie, state=Virginia
+2025-05-21 06:31:16,081: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=10.4873&lon=-66.8738&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:17,046: Row 514: Reverse geocoded lat=10.4873, lon=-66.8738 -> country=Venezuela, city=Caracas, state=Miranda State
+2025-05-21 06:31:18,053: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-23.6301&lon=-46.6378&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:19,058: Row 515: Reverse geocoded lat=-23.6301, lon=-46.6378 -> country=Brazil, city=São Paulo, state=São Paulo
+2025-05-21 06:31:20,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.6475&lon=121.0494&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:21,038: Row 516: Reverse geocoded lat=14.6475, lon=121.0494 -> country=Philippines, city=Quezon City, state=None
+2025-05-21 06:31:22,043: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.9136&lon=75.7858&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:23,079: Row 519: Reverse geocoded lat=26.9136, lon=75.7858 -> country=India, city=Jaipur, state=Rajasthan
+2025-05-21 06:31:24,087: Row 520: Reverse geocoded lat=40.7592, lon=-111.8875 -> country=United States, city=Salt Lake City, state=Utah
+2025-05-21 06:31:25,091: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.2706&lon=85.8334&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:26,124: Row 523: Reverse geocoded lat=20.2706, lon=85.8334 -> country=India, city=Bhubaneswar Municipal Corporation, state=Odisha
+2025-05-21 06:31:27,131: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=17.3843&lon=78.4583&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:28,041: Row 525: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
+2025-05-21 06:31:29,047: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6327&lon=77.2198&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:30,139: Row 528: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:31:31,141: Row 529: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:31:32,145: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.5943&lon=85.1352&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:33,015: Row 530: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
+2025-05-21 06:31:34,021: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=24.6869&lon=46.7224&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:35,025: Row 531: Reverse geocoded lat=24.6869, lon=46.7224 -> country=Saudi Arabia, city=Riyadh, state=Riyadh Region
+2025-05-21 06:31:36,032: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.7556&lon=21.2526&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:37,089: Row 532: Reverse geocoded lat=48.7556, lon=21.2526 -> country=Slovakia, city=Košice, state=Region of Košice
+2025-05-21 06:31:38,094: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3028&lon=-121.9982&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:39,114: Row 533: Reverse geocoded lat=37.3028, lon=-121.9982 -> country=United States, city=San Jose, state=California
+2025-05-21 06:31:40,108: Row 536: Reverse geocoded lat=35.7449, lon=0.5663 -> country=Algeria, city=Relizane, state=Relizane
+2025-05-21 06:31:41,081: Row 538: Reverse geocoded lat=23.1181, lon=113.2539 -> country=China, city=Yuexiu District, state=Guangdong Province
+2025-05-21 06:31:42,124: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.9707&lon=32.7316&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:43,051: Row 540: Reverse geocoded lat=39.9707, lon=32.7316 -> country=Turkey, city=Yenimahalle, state=Ankara
+2025-05-21 06:31:44,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.6533&lon=90.4923&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:45,101: Row 541: Reverse geocoded lat=23.6533, lon=90.4923 -> country=Bangladesh, city=Narayanganj, state=Dhaka Division
+2025-05-21 06:31:46,060: Row 542: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
+2025-05-21 06:31:47,109: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.0822&lon=-81.5498&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:48,085: Row 545: Reverse geocoded lat=30.0822, lon=-81.5498 -> country=United States, city=None, state=Florida
+2025-05-21 06:31:49,090: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.5847&lon=98.6629&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:50,083: Row 546: Reverse geocoded lat=3.5847, lon=98.6629 -> country=Indonesia, city=City of Medan, state=North Sumatra
+2025-05-21 06:31:51,089: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.8964&lon=76.5909&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:52,053: Row 547: Reverse geocoded lat=28.8964, lon=76.5909 -> country=India, city=Rohtak, state=Haryana
+2025-05-21 06:31:53,057: Row 548: Reverse geocoded lat=30.5394, lon=-91.0522 -> country=United States, city=Central, state=Louisiana
+2025-05-21 06:31:54,062: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4562&lon=6.0573&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:55,152: Row 550: Reverse geocoded lat=51.4562, lon=6.0573 -> country=Netherlands, city=Horst, state=Limburg
+2025-05-21 06:31:56,160: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.4073&lon=-121.939&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:57,154: Row 551: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
+2025-05-21 06:31:58,160: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:31:59,167: Row 552: Reverse geocoded lat=48.8558, lon=2.3494 -> country=France, city=Paris, state=Ile-de-France
+2025-05-21 06:32:00,017: Row 553: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
+2025-05-21 06:32:01,177: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-37.867&lon=144.9973&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:02,067: Row 554: Reverse geocoded lat=-37.867, lon=144.9973 -> country=Australia, city=Melbourne, state=Victoria
+2025-05-21 06:32:03,073: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.5956&lon=10.0044&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:04,071: Row 555: Reverse geocoded lat=53.5956, lon=10.0044 -> country=Germany, city=Hamburg, state=None
+2025-05-21 06:32:05,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.144&lon=17.1332&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:06,024: Row 556: Reverse geocoded lat=51.144, lon=17.1332 -> country=Poland, city=Wrocław, state=Lower Silesian Voivodeship
+2025-05-21 06:32:07,029: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:08,151: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:09,192: Row 557: Reverse geocoded lat=48.8558, lon=2.3494 -> country=France, city=Paris, state=Ile-de-France
+2025-05-21 06:32:10,198: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=43.2951&lon=5.3861&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:11,103: Row 558: Reverse geocoded lat=43.2951, lon=5.3861 -> country=France, city=Marseille, state=Provence-Alpes-Côte d'Azur
+2025-05-21 06:32:12,084: Row 559: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
+2025-05-21 06:32:13,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.3275&lon=78.0325&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:14,090: Row 561: Reverse geocoded lat=30.3275, lon=78.0325 -> country=India, city=Dehradun, state=Uttarakhand
+2025-05-21 06:32:15,094: Row 562: Reverse geocoded lat=21.4913, lon=39.1841 -> country=Saudi Arabia, city=Jeddah, state=Makkah Region
+2025-05-21 06:32:16,099: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=1.3153&lon=103.9143&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:17,104: Row 563: Reverse geocoded lat=1.3153, lon=103.9143 -> country=Singapore, city=Singapore, state=None
+2025-05-21 06:32:18,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.9414&lon=40.1933&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:19,057: Row 565: Reverse geocoded lat=37.9414, lon=40.1933 -> country=Turkey, city=Kayapınar, state=None
+2025-05-21 06:32:20,062: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.767&lon=9.1827&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:21,042: Row 566: Reverse geocoded lat=48.767, lon=9.1827 -> country=Germany, city=Stuttgart, state=Baden-Württemberg
+2025-05-21 06:32:22,033: Row 568: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
+2025-05-21 06:32:23,047: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.3741&lon=9.5417&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:24,097: Row 569: Reverse geocoded lat=47.3741, lon=9.5417 -> country=Switzerland, city=Altstätten, state=St. Gallen
+2025-05-21 06:32:25,101: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.1454&lon=77.3281&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:26,203: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.1454&lon=77.3281&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:27,049: Row 573: Reverse geocoded lat=28.1454, lon=77.3281 -> country=India, city=Palwal, state=Haryana
+2025-05-21 06:32:28,056: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.4982&lon=13.4755&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:29,047: Row 575: Reverse geocoded lat=52.4982, lon=13.4755 -> country=Germany, city=Berlin, state=None
+2025-05-21 06:32:30,052: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.4982&lon=13.4755&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:31,102: Row 576: Reverse geocoded lat=52.4982, lon=13.4755 -> country=Germany, city=Berlin, state=None
+2025-05-21 06:32:32,107: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.6438&lon=120.9632&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:33,102: Row 578: Reverse geocoded lat=14.6438, lon=120.9632 -> country=Philippines, city=Caloocan, state=None
+2025-05-21 06:32:34,105: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.0396&lon=-111.9361&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:35,184: Row 579: Reverse geocoded lat=41.0396, lon=-111.9361 -> country=United States, city=Kaysville, state=Utah
+2025-05-21 06:32:36,189: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.8713&lon=4.3758&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:37,105: Row 580: Reverse geocoded lat=50.8713, lon=4.3758 -> country=Belgium, city=Schaerbeek - Schaarbeek, state=None
+2025-05-21 06:32:38,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.867&lon=-4.2621&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:39,115: Row 581: Reverse geocoded lat=55.867, lon=-4.2621 -> country=United Kingdom, city=Glasgow, state=Scotland
+2025-05-21 06:32:40,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.0&lon=105.0&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:41,107: Row 583: Reverse geocoded lat=18, lon=105 -> country=Laos, city=Phonkeo, state=Bolikhamsai
+2025-05-21 06:32:42,028: Row 584: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:32:43,031: Row 586: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
+2025-05-21 06:32:44,118: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.911&lon=116.395&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:45,043: Row 587: Reverse geocoded lat=39.911, lon=116.395 -> country=China, city=Dongcheng District, state=Beijing
+2025-05-21 06:32:46,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5081&lon=-0.1278000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:47,144: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5081&lon=-0.1278000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:32:48,220: Row 591: Reverse geocoded lat=51.5081, lon=-0.1278 -> country=United Kingdom, city=City of Westminster, state=England
+2025-05-21 06:32:49,171: Row 592: Reverse geocoded lat=32.3039, lon=-110.8368 -> country=United States, city=None, state=Arizona
+2025-05-21 06:32:50,093: Row 594: Reverse geocoded lat=37.5453, lon=-77.9187 -> country=United States, city=Powhatan, state=Virginia
+2025-05-21 06:32:51,168: Row 595: Reverse geocoded lat=30.6798, lon=-88.2914 -> country=United States, city=None, state=Alabama
+2025-05-21 06:32:52,188: Row 596: Reverse geocoded lat=36.8178, lon=10.1656 -> country=Tunisia, city=Tunis, state=Tunis
+2025-05-21 06:32:53,174: Row 597: Reverse geocoded lat=34.2635, lon=108.9246 -> country=China, city=Lianhu District, state=Shaanxi
+2025-05-21 06:32:54,166: Row 598: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
+2025-05-21 06:32:55,079: Row 599: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
+2025-05-21 06:32:56,073: Row 600: Reverse geocoded lat=21.9974, lon=79.0011 -> country=India, city=Malhanwara, state=Madhya Pradesh
+2025-05-21 06:32:57,009: Row 602: Reverse geocoded lat=-29.8553, lon=31.0428 -> country=South Africa, city=Durban, state=KwaZulu-Natal
+2025-05-21 06:32:58,142: Row 603: Reverse geocoded lat=1.2872, lon=103.8507 -> country=Singapore, city=Singapore, state=None
+2025-05-21 06:32:59,091: Row 604: Reverse geocoded lat=23.7207, lon=90.5635 -> country=Bangladesh, city=None, state=Dhaka Division
+2025-05-21 06:33:00,155: Row 606: Reverse geocoded lat=51.5164, lon=-0.093 -> country=United Kingdom, city=City of London, state=England
+2025-05-21 06:33:01,195: Row 607: Reverse geocoded lat=29.572, lon=-95.54 -> country=United States, city=Missouri City, state=Texas
+2025-05-21 06:33:02,031: Row 609: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
+2025-05-21 06:33:03,096: Row 610: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:33:04,228: Row 611: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
+2025-05-21 06:33:05,147: Row 612: Reverse geocoded lat=40.2584, lon=-111.6591 -> country=United States, city=Provo, state=Utah
+2025-05-21 06:33:06,139: Row 613: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
+2025-05-21 06:33:07,134: Row 614: Reverse geocoded lat=22.2904, lon=70.7915 -> country=India, city=Rajkot, state=Gujarat
+2025-05-21 06:33:08,126: Row 615: Reverse geocoded lat=37.9448, lon=-122.0279 -> country=United States, city=Concord, state=California
+2025-05-21 06:33:09,246: Row 617: Reverse geocoded lat=34.2619, lon=-6.5821 -> country=Morocco, city=Kenitra, state=None
+2025-05-21 06:33:10,158: Row 619: Reverse geocoded lat=45.3696, lon=-73.5654 -> country=Canada, city=Saint-Constant, state=Quebec
+2025-05-21 06:33:11,127: Row 620: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
+2025-05-21 06:33:12,055: Row 621: Reverse geocoded lat=-23.5475, lon=-46.6361 -> country=Brazil, city=São Paulo, state=São Paulo
+2025-05-21 06:33:13,134: Row 622: Reverse geocoded lat=55.6523, lon=12.0805 -> country=Denmark, city=Roskilde, state=Region Zealand
+2025-05-21 06:33:14,059: Row 623: Reverse geocoded lat=-33.914, lon=18.4129 -> country=South Africa, city=Cape Town, state=Western Cape
+2025-05-21 06:33:15,314: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.6113&lon=6.1294&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:16,173: Row 625: Reverse geocoded lat=49.6113, lon=6.1294 -> country=Luxembourg, city=Luxembourg, state=None
+2025-05-21 06:33:17,144: Row 626: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
+2025-05-21 06:33:18,159: Row 627: Reverse geocoded lat=30.7339, lon=76.7889 -> country=India, city=Chandigarh, state=Chandigarh
+2025-05-21 06:33:19,101: Row 628: Reverse geocoded lat=40.7547, lon=-73.9614 -> country=United States, city=New York, state=New York
+2025-05-21 06:33:20,165: Row 629: Reverse geocoded lat=51.5081, lon=-0.1278 -> country=United Kingdom, city=City of Westminster, state=England
+2025-05-21 06:33:21,085: Row 630: Reverse geocoded lat=31.2222, lon=121.4581 -> country=China, city=Shanghai, state=Shanghai
+2025-05-21 06:33:22,096: Row 631: Reverse geocoded lat=31.2222, lon=121.4581 -> country=China, city=Shanghai, state=Shanghai
+2025-05-21 06:33:23,172: Row 633: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
+2025-05-21 06:33:24,049: Row 634: Reverse geocoded lat=1, lon=38 -> country=Kenya, city=Waso ward, state=Samburu
+2025-05-21 06:33:25,067: Row 635: Reverse geocoded lat=-22.1231, lon=-51.3881 -> country=Brazil, city=Presidente Prudente, state=São Paulo
+2025-05-21 06:33:26,108: Row 636: Reverse geocoded lat=40.6036, lon=-3.7041 -> country=Spain, city=Tres Cantos, state=Community of Madrid
+2025-05-21 06:33:27,099: Row 637: Reverse geocoded lat=33.1371, lon=-96.7488 -> country=United States, city=Frisco, state=Texas
+2025-05-21 06:33:28,178: Row 638: Reverse geocoded lat=39.7593, lon=-104.9651 -> country=United States, city=Denver, state=Colorado
+2025-05-21 06:33:29,096: Row 639: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:33:30,217: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=36.1898&lon=44.0157&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:31,034: Row 640: Reverse geocoded lat=36.1898, lon=44.0157 -> country=Iraq, city=Erbil, state=Erbil Governorate
+2025-05-21 06:33:32,040: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.2845&lon=-107.8646&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:33,127: Row 641: Reverse geocoded lat=37.2845, lon=-107.8646 -> country=United States, city=Durango, state=Colorado
+2025-05-21 06:33:34,126: Row 642: Reverse geocoded lat=35.9825, lon=-78.5376 -> country=United States, city=Wake Forest, state=North Carolina
+2025-05-21 06:33:35,098: Row 643: Reverse geocoded lat=-14.785, lon=-39.2785 -> country=Brazil, city=Itabuna, state=Bahia
+2025-05-21 06:33:36,135: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-14.785&lon=-39.2785&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:37,095: Row 644: Reverse geocoded lat=-14.785, lon=-39.2785 -> country=Brazil, city=Itabuna, state=Bahia
+2025-05-21 06:33:38,100: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.3904&lon=-0.0992000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:39,138: Row 648: Reverse geocoded lat=51.3904, lon=-0.0992 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:33:40,142: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=11.0102&lon=76.9701&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:41,193: Row 649: Reverse geocoded lat=11.0102, lon=76.9701 -> country=India, city=Coimbatore, state=Tamil Nadu
+2025-05-21 06:33:42,021: Row 650: Reverse geocoded lat=-22.4851, lon=-47.1733 -> country=Brazil, city=Engenheiro Coelho, state=São Paulo
+2025-05-21 06:33:43,203: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.9171&lon=24.7158&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:44,162: Row 652: Reverse geocoded lat=48.9171, lon=24.7158 -> country=Ukraine, city=Ivano-Frankivsk, state=Ivano-Frankivsk Oblast
+2025-05-21 06:33:45,168: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:46,178: Row 653: Reverse geocoded lat=48.8558, lon=2.3494 -> country=France, city=Paris, state=Ile-de-France
+2025-05-21 06:33:47,182: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-6.3088&lon=107.316&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:48,153: Row 654: Reverse geocoded lat=-6.3088, lon=107.316 -> country=Indonesia, city=Karawang, state=West Java
+2025-05-21 06:33:49,151: Row 655: Reverse geocoded lat=43.6547, lon=-79.3623 -> country=Canada, city=Toronto, state=Ontario
+2025-05-21 06:33:50,154: Row 657: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:33:51,149: Row 658: Reverse geocoded lat=39.338, lon=-82.986 -> country=United States, city=Chillicothe, state=Ohio
+2025-05-21 06:33:52,164: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=22.2842&lon=114.1759&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:53,119: Row 659: Reverse geocoded lat=22.2842, lon=114.1759 -> country=China, city=Hong Kong Island, state=Hong Kong
+2025-05-21 06:33:54,091: Row 660: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
+2025-05-21 06:33:55,060: Row 661: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
+2025-05-21 06:33:56,075: Row 662: Reverse geocoded lat=7.3782, lon=3.9062 -> country=Nigeria, city=None, state=Oyo State
+2025-05-21 06:33:57,072: Row 663: Reverse geocoded lat=-31.8544, lon=115.8433 -> country=Australia, city=None, state=Western Australia
+2025-05-21 06:33:58,136: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6078&lon=12.9982&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:33:59,022: Row 664: Reverse geocoded lat=55.6078, lon=12.9982 -> country=Sweden, city=Malmö, state=None
+2025-05-21 06:34:00,027: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6078&lon=12.9982&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:01,017: Row 665: Reverse geocoded lat=55.6078, lon=12.9982 -> country=Sweden, city=Malmö, state=None
+2025-05-21 06:34:02,020: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.2049&lon=16.3662&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:03,130: Row 667: Reverse geocoded lat=48.2049, lon=16.3662 -> country=Austria, city=Vienna, state=None
+2025-05-21 06:34:04,134: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.5466&lon=10.021&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:05,028: Row 668: Reverse geocoded lat=53.5466, lon=10.021 -> country=Germany, city=Hamburg, state=None
+2025-05-21 06:34:06,033: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.5247&lon=-7.3385&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:07,036: Row 669: Reverse geocoded lat=53.5247, lon=-7.3385 -> country=Ireland, city=Mullingar, state=None
+2025-05-21 06:34:08,040: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.5329&lon=69.1682&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:09,149: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.5329&lon=69.1682&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:10,180: Row 670: Reverse geocoded lat=34.5329, lon=69.1682 -> country=Afghanistan, city=Kabul, state=Kabul Province
+2025-05-21 06:34:11,115: Row 671: Reverse geocoded lat=59.3326, lon=18.0651 -> country=Sweden, city=Stockholm, state=None
+2025-05-21 06:34:12,117: Row 672: Reverse geocoded lat=-31.8544, lon=115.8433 -> country=Australia, city=None, state=Western Australia
+2025-05-21 06:34:13,143: Row 673: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
+2025-05-21 06:34:14,190: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.7169&lon=-1.9716&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:15,189: Row 674: Reverse geocoded lat=51.7169, lon=-1.9716 -> country=United Kingdom, city=Cotswold District, state=England
+2025-05-21 06:34:16,111: Row 675: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
+2025-05-21 06:34:17,199: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-6.2056&lon=106.8376&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:18,107: Row 676: Reverse geocoded lat=-6.2056, lon=106.8376 -> country=Indonesia, city=Special capital Region of Jakarta, state=None
+2025-05-21 06:34:19,111: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.409&lon=9.3361&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:20,173: Row 677: Reverse geocoded lat=47.409, lon=9.3361 -> country=Switzerland, city=St. Gallen, state=St. Gallen
+2025-05-21 06:34:21,081: Row 678: Reverse geocoded lat=38.3802, lon=-75.6347 -> country=United States, city=None, state=Maryland
+2025-05-21 06:34:22,046: Row 679: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
+2025-05-21 06:34:23,126: Row 681: Reverse geocoded lat=34.197, lon=-118.8199 -> country=United States, city=Thousand Oaks, state=California
+2025-05-21 06:34:24,189: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.9136&lon=75.7858&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:25,044: Row 682: Reverse geocoded lat=26.9136, lon=75.7858 -> country=India, city=Jaipur, state=Rajasthan
+2025-05-21 06:34:26,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-6.9172&lon=107.6296&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:27,069: Row 683: Reverse geocoded lat=-6.9172, lon=107.6296 -> country=Indonesia, city=Bandung City, state=West Java
+2025-05-21 06:34:28,072: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.7681&lon=139.6258&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:29,116: Row 685: Reverse geocoded lat=35.7681, lon=139.6258 -> country=Japan, city=Nerima, state=None
+2025-05-21 06:34:30,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=22.9505&lon=91.4608&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:31,051: Row 686: Reverse geocoded lat=22.9505, lon=91.4608 -> country=Bangladesh, city=Feni, state=Chittagong Division
+2025-05-21 06:34:32,055: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.1211&lon=-117.4362&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:33,140: Row 687: Reverse geocoded lat=34.1211, lon=-117.4362 -> country=United States, city=Fontana, state=California
+2025-05-21 06:34:34,135: Row 689: Reverse geocoded lat=-22.3135, lon=-42.8741 -> country=Brazil, city=Teresópolis, state=Rio de Janeiro
+2025-05-21 06:34:35,144: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=32.8908&lon=13.1796&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:36,120: Row 690: Reverse geocoded lat=32.8908, lon=13.1796 -> country=Libya, city=Tripoli, state=Tripoli
+2025-05-21 06:34:37,026: Row 691: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
+2025-05-21 06:34:38,118: Row 692: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
+2025-05-21 06:34:39,129: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=16.2689&lon=-61.5073&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:40,073: Row 693: Reverse geocoded lat=16.2689, lon=-61.5073 -> country=France, city=Les Abymes, state=Guadeloupe
+2025-05-21 06:34:41,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.6343&lon=-90.5155&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:42,143: Row 694: Reverse geocoded lat=14.6343, lon=-90.5155 -> country=Guatemala, city=Guatemala City, state=Guatemala Department
+2025-05-21 06:34:43,097: Row 695: Reverse geocoded lat=-25.757, lon=28.1443 -> country=South Africa, city=Pretoria, state=Gauteng
+2025-05-21 06:34:44,152: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.8713&lon=4.3758&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:45,112: Row 696: Reverse geocoded lat=50.8713, lon=4.3758 -> country=Belgium, city=Schaerbeek - Schaarbeek, state=None
+2025-05-21 06:34:46,102: Row 698: Reverse geocoded lat=6.4474, lon=3.3903 -> country=Nigeria, city=Lagos, state=Lagos State
+2025-05-21 06:34:47,119: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=33.6099&lon=73.0301&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:48,060: Row 699: Reverse geocoded lat=33.6099, lon=73.0301 -> country=Pakistan, city=Rawalpindi Cantonment, state=Punjab
+2025-05-21 06:34:49,064: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4964&lon=-0.1224000&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:50,061: Row 700: Reverse geocoded lat=51.4964, lon=-0.1224 -> country=United Kingdom, city=London, state=England
+2025-05-21 06:34:51,046: Row 701: Reverse geocoded lat=33.6128, lon=-117.6622 -> country=United States, city=Mission Viejo, state=California
+2025-05-21 06:34:52,037: Row 702: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:34:53,071: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-1.944&lon=30.062&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:54,102: Row 703: Reverse geocoded lat=-1.944, lon=30.062 -> country=Rwanda, city=Kigali, state=Kigali City
+2025-05-21 06:34:55,071: Row 704: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
+2025-05-21 06:34:56,111: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.2615&lon=69.2177&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:57,076: Row 705: Reverse geocoded lat=41.2615, lon=69.2177 -> country=Uzbekistan, city=Tashkent, state=None
+2025-05-21 06:34:58,087: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-22.9072&lon=-43.1883&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:34:59,053: Row 706: Reverse geocoded lat=-22.9072, lon=-43.1883 -> country=Brazil, city=Rio de Janeiro, state=Rio de Janeiro
+2025-05-21 06:35:00,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:01,043: Row 707: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
+2025-05-21 06:35:02,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.9977&lon=29.7432&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:03,118: Row 708: Reverse geocoded lat=30.9977, lon=29.7432 -> country=Egypt, city=Al Wadi, state=Alexandria
+2025-05-21 06:35:04,124: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.0024&lon=73.7945&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:05,042: Row 709: Reverse geocoded lat=20.0024, lon=73.7945 -> country=India, city=Nashik, state=Maharashtra
+2025-05-21 06:35:06,046: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6327&lon=77.2198&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:07,076: Row 712: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
+2025-05-21 06:35:08,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.1667&lon=-77.25&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:09,053: Row 714: Reverse geocoded lat=18.1667, lon=-77.25 -> country=Jamaica, city=None, state=None
+2025-05-21 06:35:10,045: Row 715: Reverse geocoded lat=18.1667, lon=-77.25 -> country=Jamaica, city=None, state=None
+2025-05-21 06:35:11,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.2635&lon=108.9246&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:12,107: Row 716: Reverse geocoded lat=34.2635, lon=108.9246 -> country=China, city=Lianhu District, state=Shaanxi
+2025-05-21 06:35:13,112: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=9.0245&lon=38.7485&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:14,090: Row 717: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
+2025-05-21 06:35:15,094: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8582&lon=2.3387&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:16,219: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8582&lon=2.3387&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:17,242: Row 718: Reverse geocoded lat=48.8582, lon=2.3387 -> country=France, city=Paris, state=None
+2025-05-21 06:35:18,209: Row 719: Reverse geocoded lat=48.8582, lon=2.3387 -> country=France, city=Paris, state=None
+2025-05-21 06:35:19,250: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8582&lon=2.3387&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:20,228: Row 720: Reverse geocoded lat=48.8582, lon=2.3387 -> country=France, city=Paris, state=None
+2025-05-21 06:35:21,081: Row 721: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
+2025-05-21 06:35:22,084: Row 722: Reverse geocoded lat=51.5164, lon=-0.093 -> country=United Kingdom, city=City of London, state=England
+2025-05-21 06:35:23,117: Row 723: Reverse geocoded lat=51.5164, lon=-0.093 -> country=United Kingdom, city=City of London, state=England
+2025-05-21 06:35:24,076: Row 724: Reverse geocoded lat=24.1844, lon=88.2673 -> country=India, city=Murshidabad, state=West Bengal
+2025-05-21 06:35:25,245: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.0719&lon=17.4638&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:26,063: Row 725: Reverse geocoded lat=49.0719, lon=17.4638 -> country=Czechia, city=Uherské Hradiště, state=Central Moravia
+2025-05-21 06:35:27,066: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.1994&lon=-84.526&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:28,048: Row 726: Reverse geocoded lat=39.1994, lon=-84.526 -> country=United States, city=Cincinnati, state=Ohio
+2025-05-21 06:35:29,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:30,181: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:31,148: Row 727: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
+2025-05-21 06:35:32,083: Row 728: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
+2025-05-21 06:35:33,115: Row 729: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
+2025-05-21 06:35:34,141: Row 731: Reverse geocoded lat=34.7599, lon=113.6459 -> country=China, city=Zhengzhou, state=Henan
+2025-05-21 06:35:35,069: Row 732: Reverse geocoded lat=19.4324, lon=-99.1229 -> country=Mexico, city=Mexico City, state=Mexico City
+2025-05-21 06:35:36,162: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.4722&lon=9.1922&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:37,171: Row 733: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:35:38,131: Row 734: Reverse geocoded lat=29.1383, lon=-80.9956 -> country=United States, city=Port Orange, state=Florida
+2025-05-21 06:35:39,127: Row 735: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
+2025-05-21 06:35:40,054: Row 736: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
+2025-05-21 06:35:41,169: Row 737: Reverse geocoded lat=38.8574, lon=-77.1 -> country=United States, city=Arlington, state=Virginia
+2025-05-21 06:35:42,189: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.7891&lon=90.4126&format=json&accept-language=en-US&addressdetails=1
+2025-05-21 06:35:43,127: Row 739: Reverse geocoded lat=23.7891, lon=90.4126 -> country=Bangladesh, city=Dhaka, state=Dhaka Division
+2025-05-21 06:35:43,159: Created columns 'Country', 'City', and 'State' with reverse geocoded data.
+2025-05-21 06:35:43,429: Cleaned data written to /Users/T.Martin/Projects/reporting_doc_feedback/data_exports/cleaned_data.xlsx
+2025-05-21 06:35:43,429: Script completed successfully.
diff --git a/content/includes/installation/add-nms-repo.md b/content/includes/installation/add-nms-repo.md
index fec0ae06f..eac86faa7 100644
--- a/content/includes/installation/add-nms-repo.md
+++ b/content/includes/installation/add-nms-repo.md
@@ -36,23 +36,39 @@ Add the NGINX Instance Manager repository:
 
 {{%tab name="Debian, Ubuntu, Deb-Based"%}}
 
-Add the NGINX Instance Manager repository:
-
-- **Debian**
+1. Add the NGINX signing key:
 
   ```shell
-  printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/nms/debian `lsb_release -cs` nginx-plus\n" | sudo tee /etc/apt/sources.list.d/nms.list
-  sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx
+  wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \
+      | gpg --dearmor \
+      | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null 
   ```
 
-  <br>
+2. Add the NGINX Instance Manager repository:
 
-- **Ubuntu**
+   - **Debian**
 
-  ```shell
-  printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/nms/ubuntu `lsb_release -cs` nginx-plus\n" | sudo tee /etc/apt/sources.list.d/nms.list
-  sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx
-  ```
+    ```shell
+    printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
+    https://pkgs.nginx.com/nms/debian $(lsb_release -cs) nginx-plus\n" | \
+    sudo tee /etc/apt/sources.list.d/nms.list
+
+    sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx \
+    https://cs.nginx.com/static/files/90pkgs-nginx
+    ```
+
+     <br>
+
+   - **Ubuntu**
+
+    ```shell
+    printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
+    https://pkgs.nginx.com/nms/ubuntu $(lsb_release -cs) nginx-plus\n" | \
+    sudo tee /etc/apt/sources.list.d/nms.list
+
+    sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx \
+    https://cs.nginx.com/static/files/90pkgs-nginx
+    ```
 
 {{%/tab%}}
 {{</tabs>}}
diff --git a/content/includes/installation/clickhouse-defaults.md b/content/includes/installation/clickhouse-defaults.md
deleted file mode 100644
index 0921b6ebb..000000000
--- a/content/includes/installation/clickhouse-defaults.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-docs: DOCS-1238
----
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-
-| Configuration            | Default                            | Notes |
-|--------------------------|------------------------------------|-------|
-| clickhouse.address       | tcp://localhost:9000               |       |
-| clickhouse.username      |                                    |       |
-| clickhouse.password      |                                    |       |
-| clickhouse.tls_mode      | false                              |       |
-| clickhouse.tls.address   | tcp://localhost:9440               |       |
-| clickhouse.tls.skip_verify   | false                              |`clickhouse.tls.skip_verify` should be used only for self-signed certificates and is never recommended for production use. When set to `true`, certificates are not verified, which exposes the connection to man-in-the-middle attacks. |
-| clickhouse.tls.key_path  |                                    |       |
-| clickhouse.tls.cert_path |                                    |       |
-| clickhouse.tls.ca_path   | /etc/ssl/certs/ca-certificates.crt |The default value for `clickhouse.tls.ca_path` works out-of-the-box for Ubuntu and Debian. You'll need to [configure a different Certificate Authority](#tls) for other distributions. Refer to your distribution's documentation for additional information.|
-
-{{</bootstrap-table>}}
-
-<br>
diff --git a/content/includes/nginx-plus/usage-tracking/overview.md b/content/includes/nginx-plus/usage-tracking/overview.md
index 3a048abf9..85af6fb49 100644
--- a/content/includes/nginx-plus/usage-tracking/overview.md
+++ b/content/includes/nginx-plus/usage-tracking/overview.md
@@ -6,5 +6,5 @@ Start by installing NGINX Instance Manager on a dedicated host. Then, configure
 
 
 {{<call-out tip "Tip for Automated Reporting">}}
-To set up automatic reporting, [add your JWT-based license to NGINX Instance Manager]({{< ref "/nim/admin-guide/license/add-license.md#apply-jwt-license" >}}). This license can be downloaded from [MyF5](https://account.f5.com/myf5) if needed.
+To set up automatic reporting, [add your JWT-based license to NGINX Instance Manager]({{< ref "/nim/admin-guide/add-license.md#apply-jwt-license" >}}). This license can be downloaded from [MyF5](https://account.f5.com/myf5) if needed.
 {{</call-out>}}
diff --git a/content/includes/nim/admin-guide/license/connected-install-license-note.md b/content/includes/nim/admin-guide/license/connected-install-license-note.md
index 251043df4..9490e3fe3 100644
--- a/content/includes/nim/admin-guide/license/connected-install-license-note.md
+++ b/content/includes/nim/admin-guide/license/connected-install-license-note.md
@@ -4,4 +4,4 @@ docs:
 
 A valid license is required to make full use of all the features in NGINX Instance Manager.
 
-Refer to the [Add a License]({{< ref "nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license.
\ No newline at end of file
+Refer to the [Add a License]({{< ref "nim/admin-guide/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license.
\ No newline at end of file
diff --git a/content/includes/nim/clickhouse/cli-skip-clickhouse.md b/content/includes/nim/clickhouse/cli-skip-clickhouse.md
new file mode 100644
index 000000000..f4228b125
--- /dev/null
+++ b/content/includes/nim/clickhouse/cli-skip-clickhouse.md
@@ -0,0 +1,10 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+If you skip installing ClickHouse, you need NGINX Agent {{< lightweight-nim-nginx-agent-version >}}.
+
+After installation, make sure to [disable metrics collection]({{< ref "nim/system-configuration/configure-clickhouse.md#disable-metrics-collection" >}}) in the `/etc/nms/nms.conf` file.
diff --git a/content/includes/nim/clickhouse/clickhouse-defaults.md b/content/includes/nim/clickhouse/clickhouse-defaults.md
new file mode 100644
index 000000000..1848b75f7
--- /dev/null
+++ b/content/includes/nim/clickhouse/clickhouse-defaults.md
@@ -0,0 +1,23 @@
+---
+docs: DOCS-1238
+files:
+- content/nim/system-configuration/configure-clickhouse.md
+- content/nim/deploy/vm-bare-metal/install-nim-manual.md
+---
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+
+| Configuration                 | Default                            | Notes |
+|------------------------------|------------------------------------|-------|
+| clickhouse.enable            | true                               | Set to `false` to disable metrics collection and run NGINX Instance Manager in lightweight mode. Requires a service restart. |
+| clickhouse.address           | tcp://localhost:9000               | The address of the ClickHouse database. |
+| clickhouse.username          |                                    | The username NGINX Instance Manager uses to connect to ClickHouse, if authentication is enabled. |
+| clickhouse.password          |                                    | The password for the specified ClickHouse user. |
+| clickhouse.tls_mode          | false                              | Set to `true` to enable TLS for the ClickHouse connection. This setting will be deprecated in a future release. Use the `clickhouse.tls` section instead. |
+| clickhouse.tls.address       | tcp://localhost:9440               | The address NGINX Instance Manager uses to connect to ClickHouse over TLS. Format: `<ip-address>:<port>`. |
+| clickhouse.tls.skip_verify   | false                              | Set to `true` to skip TLS certificate verification. Use only for self-signed certificates in non-production environments. |
+| clickhouse.tls.key_path      |                                    | Path to the client TLS key file in PEM format. Required for client authentication. |
+| clickhouse.tls.cert_path     |                                    | Path to the client TLS certificate file in PEM format. Required for client authentication. |
+| clickhouse.tls.ca_path       | /etc/ssl/certs/ca-certificates.crt | Path to the system Certificate Authority used to verify the server certificate. The default path works for Ubuntu and Debian. Use a CA bundle appropriate to your system. See [TLS configuration](#tls) for details. |
+
+{{</bootstrap-table>}}
diff --git a/content/includes/nim/clickhouse/clickhouse-install.md b/content/includes/nim/clickhouse/clickhouse-install.md
new file mode 100644
index 000000000..961aed96b
--- /dev/null
+++ b/content/includes/nim/clickhouse/clickhouse-install.md
@@ -0,0 +1,70 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install-nim-manual.md
+---
+
+NGINX Instance Manager uses [ClickHouse](https://clickhouse.com) to store metrics, events, alerts, and configuration settings.
+
+If you install ClickHouse and choose to set a password (the default is an empty string), you must add it to the `clickhouse.password` setting in the `/etc/nms/nms.conf` file. If the password is missing or incorrect, NGINX Instance Manager **will not start**.
+
+For instructions and additional configuration options, including TLS settings, see [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}).
+
+NGINX Instance Manager requires ClickHouse version {{< clickhouse-version >}} or later.
+
+
+Follow these steps to install and enable ClickHouse on supported Linux distributions.
+
+1. First, set up the repository.
+
+   - For RPM-based systems (CentOS, RHEL):
+
+      ```shell
+      sudo yum install -y yum-utils
+      sudo yum-config-manager --add-repo https://packages.clickhouse.com/rpm/clickhouse.repo
+      ```
+
+   - For Debian-based systems (Debian, Ubuntu):
+
+      ```shell
+      sudo apt-get install -y apt-transport-https ca-certificates dirmngr
+      GNUPGHOME=$(mktemp -d)
+      sudo GNUPGHOME="$GNUPGHOME" gpg --no-default-keyring --keyring /usr/share/keyrings/clickhouse-keyring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 8919F6BD2B48D754
+      sudo rm -r "$GNUPGHOME"
+      sudo chmod +r /usr/share/keyrings/clickhouse-keyring.gpg
+
+      echo "deb [signed-by=/usr/share/keyrings/clickhouse-keyring.gpg] https://packages.clickhouse.com/deb lts main" | sudo tee /etc/apt/sources.list.d/clickhouse.list
+      sudo apt-get update
+      ```
+
+2. Next, install the ClickHouse server and client:
+
+   - For RPM-based systems (CentOS, RHEL):
+
+      ```shell
+      sudo yum install -y clickhouse-server clickhouse-client
+      ```
+
+   - For Debian-based systems (Debian, Ubuntu):
+
+      ```shell
+      sudo apt-get install -y clickhouse-server clickhouse-client
+      ```
+
+3. Then, enable the ClickHouse service so it starts automatically on reboot:
+
+   ```shell
+   sudo systemctl enable clickhouse-server
+   ```
+
+4. Start the ClickHouse service:
+
+   ```shell
+   sudo systemctl start clickhouse-server
+   ```
+
+5. Finally, confirm the service is running:
+
+   ```shell
+   sudo systemctl status clickhouse-server
+   ```
diff --git a/content/includes/nim/docker/docker-compose-env-vars.md b/content/includes/nim/docker/docker-compose-env-vars.md
index c34e6e767..5fb837435 100644
--- a/content/includes/nim/docker/docker-compose-env-vars.md
+++ b/content/includes/nim/docker/docker-compose-env-vars.md
@@ -4,14 +4,15 @@ docs:
 
 {{<bootstrap-table "table table-striped table-bordered">}}
 | Variable | Category | Description |
-|----------|----------|------------|
+|----------|----------|-------------|
+| **ENABLE_METRICS** | General | Enables or disables metrics collection and storage. Set to `false` to run in lightweight mode without ClickHouse. Defaults to `true`. |
+| **NIM_MAINTENANCE** | General | Enables maintenance mode for backup, restore, and troubleshooting (`true` or `false`). |
+| **NIM_LICENSE_MODE_OF_OPERATION** | General | Sets the license mode to either `connected` (default) or `disconnected`. |
 | **NIM_LOG_LEVEL** | General | Sets the logging level for NGINX Instance Manager. |
 | **NIM_METRICS_TTL** | General | Specifies the number of days to retain metrics. |
 | **NIM_EVENTS_TTL** | General | Specifies the number of days to retain event logs. |
 | **NIM_SECURITY_TTL** | General | Specifies the number of days to retain security violation logs. |
-| **NIM_MAINTENANCE** | General | Enables maintenance mode for backup, restore, and troubleshooting (`true` or `false`). |
 | **NIM_WATCHDOG_TIMEOUT** | General | Sets the timeout (in seconds) for the Data Plane Monitoring (DPM) watchdog. |
-| **NIM_LICENSE_MODE_OF_OPERATION** | General | Sets the license mode to either `connected` (default) or `disconnected`. |
 | **PROXY_ENABLE** | Forward Proxy | Enables or disables the use of a forward proxy (`true` or `false`). |
 | **PROXY_HOST** | Forward Proxy | The IP address or hostname of the proxy server. |
 | **PROXY_PORT** | Forward Proxy | The port number of the proxy server. |
@@ -20,7 +21,6 @@ docs:
 | **PROXY_USERNAME** | Forward Proxy | (Required if `PROXY_AUTH_REQUIRED=true`) The username for proxy authentication. |
 | **PROXY_PASSWORD** | Forward Proxy | (Required if `PROXY_AUTH_REQUIRED=true`) The password for proxy authentication. |
 | **PROXY_SSL_VERIFY** | Forward Proxy | Enables or disables SSL verification when `PROXY_PROTOCOL=https`. Default is `true`, meaning the proxy must have a valid certificate issued by a trusted Certificate Authority (CA). Set to `false` to allow self-signed or untrusted certificates (not recommended). |
-
 {{</bootstrap-table>}}
 
 
diff --git a/content/includes/nim/installation/install-script-flags/cert.md b/content/includes/nim/installation/install-script-flags/cert.md
new file mode 100644
index 000000000..578f9ff2c
--- /dev/null
+++ b/content/includes/nim/installation/install-script-flags/cert.md
@@ -0,0 +1,8 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+`-c <path/to/nginx-repo.crt>`: Path to the SSL certificate file. (default: `/etc/ssl/nginx`)
\ No newline at end of file
diff --git a/content/includes/nim/installation/install-script-flags/clickhouse-version.md b/content/includes/nim/installation/install-script-flags/clickhouse-version.md
new file mode 100644
index 000000000..aaf5e1849
--- /dev/null
+++ b/content/includes/nim/installation/install-script-flags/clickhouse-version.md
@@ -0,0 +1,8 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+`-v <clickhouse-version>`: Install a specific version of ClickHouse. If not set, version `{{< clickhouse-version >}}` is installed by default.
diff --git a/content/includes/nim/installation/install-script-flags/distribution.md b/content/includes/nim/installation/install-script-flags/distribution.md
new file mode 100644
index 000000000..2d6c65cd3
--- /dev/null
+++ b/content/includes/nim/installation/install-script-flags/distribution.md
@@ -0,0 +1,14 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+`-d <distribution>`: Target Linux distribution (for example, `ubuntu22.04`, `rhel8`)
+
+To see the list of supported distributions, run:
+
+```shell
+grep '\-d distribution' install-nim-bundle.sh
+```
\ No newline at end of file
diff --git a/content/includes/nim/installation/install-script-flags/key.md b/content/includes/nim/installation/install-script-flags/key.md
new file mode 100644
index 000000000..366786c45
--- /dev/null
+++ b/content/includes/nim/installation/install-script-flags/key.md
@@ -0,0 +1,8 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+`-k <path/to/nginx-repo.key>`: Path to the private key file. (default: `/etc/ssl/nginx`)
diff --git a/content/includes/nim/installation/install-script-flags/skip-clickhouse.md b/content/includes/nim/installation/install-script-flags/skip-clickhouse.md
new file mode 100644
index 000000000..93a61aeb7
--- /dev/null
+++ b/content/includes/nim/installation/install-script-flags/skip-clickhouse.md
@@ -0,0 +1,10 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+`-s`: Skip installing ClickHouse. This lightweight mode reduces system requirements and simplifies installation for users who do not need metrics.
+  
+{{< include "nim/clickhouse/cli-skip-clickhouse.md" >}}
\ No newline at end of file
diff --git a/content/includes/nim/installation/optional-steps/configure-clickhouse.md b/content/includes/nim/installation/optional-steps/configure-clickhouse.md
new file mode 100644
index 000000000..c2a086cd5
--- /dev/null
+++ b/content/includes/nim/installation/optional-steps/configure-clickhouse.md
@@ -0,0 +1,23 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/deploy/vm-bare-metal/install-nim-manual.md
+- content/nim/disconnected/offline-install-guide.md
+- content/nim/disconnected/offline-install-guide-manual.md
+---
+
+If you installed ClickHouse and set a password (the default is an empty string), you must add it to the `clickhouse.password` setting in the `/etc/nms/nms.conf` file after installing NGINX Instance Manager. If the password is missing or incorrect, NGINX Instance Manager will not start.
+
+You can also configure additional ClickHouse settings in the same section:
+
+- `clickhouse.username` – the username used to connect to ClickHouse
+- `clickhouse.address` – the address of the ClickHouse server (default is `tcp://localhost:9000`)
+- `clickhouse.tls_mode` – set to `true` to enable TLS
+- TLS certificate settings, such as:
+  - `clickhouse.tls.cert_path`
+  - `clickhouse.tls.key_path`
+  - `clickhouse.tls.ca_path`
+  - `clickhouse.tls.skip_verify`
+
+For more details, see [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}).
\ No newline at end of file
diff --git a/content/includes/nim/installation/optional-steps/configure-selinux.md b/content/includes/nim/installation/optional-steps/configure-selinux.md
new file mode 100644
index 000000000..730c97811
--- /dev/null
+++ b/content/includes/nim/installation/optional-steps/configure-selinux.md
@@ -0,0 +1,12 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install-nim-manual.md
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide-manual.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+SELinux helps secure your deployment by enforcing mandatory access control policies.
+
+If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Instance Manager.
diff --git a/content/includes/nim/installation/optional-steps/disable-metrics-collection.md b/content/includes/nim/installation/optional-steps/disable-metrics-collection.md
new file mode 100644
index 000000000..9ccd93654
--- /dev/null
+++ b/content/includes/nim/installation/optional-steps/disable-metrics-collection.md
@@ -0,0 +1,11 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide-manual.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+If you’re not collecting metrics—because you didn’t install ClickHouse or don’t plan to use it—you must disable metrics collection in the `/etc/nms/nms.conf` file. This setup requires NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}.
+
+For instructions, see [Disable metrics collection]({{< ref "nim/system-configuration/configure-clickhouse.md#disable-metrics-collection" >}}).
\ No newline at end of file
diff --git a/content/includes/nim/installation/optional-steps/install-configure-vault.md b/content/includes/nim/installation/optional-steps/install-configure-vault.md
new file mode 100644
index 000000000..6d39a002a
--- /dev/null
+++ b/content/includes/nim/installation/optional-steps/install-configure-vault.md
@@ -0,0 +1,16 @@
+---
+docs:
+files:
+- content/nim/deploy/vm-bare-metal/install-nim-manual.md
+- content/nim/deploy/vm-bare-metal/install.md
+- content/nim/disconnected/offline-install-guide-manual.md
+- content/nim/disconnected/offline-install-guide.md
+---
+
+NGINX Instance Manager can use [Vault](https://www.vaultproject.io/) as a datastore for secrets.
+
+To install and enable Vault, follow these steps:
+
+- Follow Vault's instructions to [install Vault 1.8.8 or later](https://www.vaultproject.io/docs/install) for your distribution.
+- Ensure you're running Vault in a [production-hardened environment](https://learn.hashicorp.com/tutorials/vault/production-hardening).
+- After installing NGINX Instance Manager, follow the steps to [configure Vault for storing secrets]({{< ref "/nim/system-configuration/configure-vault.md" >}}).
diff --git a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
index f55e661b5..21811f7d4 100644
--- a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
+++ b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
@@ -6,6 +6,7 @@ docs: DOCS-1324
 
 | NGINX Instance Manager chart | Instance Manager |
 |------------------------------|------------------|
+| 2.0.0                        | 2.20.0           |
 | 1.15.0                       | 2.18.0           |
 | 1.14.4                       | 2.17.4           |
 | 1.14.0                       | 2.17.0           |
diff --git a/content/includes/nim/tech-specs/supported-distros.md b/content/includes/nim/tech-specs/supported-distros.md
index 35e62cdc2..632059861 100644
--- a/content/includes/nim/tech-specs/supported-distros.md
+++ b/content/includes/nim/tech-specs/supported-distros.md
@@ -1,5 +1,7 @@
 ---
 docs: DOCS-1071
+files:
+- content/nim/fundamentals/tech-specs.md
 ---
 
 The following table lists the Linux distributions supported by NGINX Instance Manager and NGINX App Protect:
diff --git a/content/includes/nim/tech-specs/supported-nginx-versions.md b/content/includes/nim/tech-specs/supported-nginx-versions.md
index cc6d9d4f9..ddabfd9b2 100644
--- a/content/includes/nim/tech-specs/supported-nginx-versions.md
+++ b/content/includes/nim/tech-specs/supported-nginx-versions.md
@@ -1,5 +1,7 @@
 ---
 docs: DOCS-1075
+files:
+- content/nim/fundamentals/tech-specs.md
 ---
 
 NGINX Instance Manager supports the following NGINX Open Source and NGINX Plus versions:
@@ -8,7 +10,7 @@ NGINX Instance Manager supports the following NGINX Open Source and NGINX Plus v
 
 | NGINX Instance Manager | NGINX OSS   | NGINX Plus |
 | ---------------------- | ----------- | ---------- |
-| 2.18.0 and later       | 1.18–1.25.1 | R31–R33    |
+| 2.18.0 and later       | 1.18–1.28.0 | R31–R34    |
 | 2.16.0–2.17.x          | 1.18–1.25.1 | R31–R32    |
 | 2.7.0–2.15.x           | 1.18–1.25.1 | R21–R30    |
 | 2.0.0–2.6.0            | 1.18–1.21.6 | R21–R27    |
diff --git a/content/nim/admin-guide/_index.md b/content/nim/admin-guide/_index.md
index 5dafe4707..431e4278e 100644
--- a/content/nim/admin-guide/_index.md
+++ b/content/nim/admin-guide/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Platform administration
+title: Administer your platform
 weight: 40
 url: /nginx-instance-manager/admin-guide/
 ---
\ No newline at end of file
diff --git a/content/nim/admin-guide/license/add-license.md b/content/nim/admin-guide/add-license.md
similarity index 88%
rename from content/nim/admin-guide/license/add-license.md
rename to content/nim/admin-guide/add-license.md
index 09373655f..7d9aa0f2a 100644
--- a/content/nim/admin-guide/license/add-license.md
+++ b/content/nim/admin-guide/add-license.md
@@ -1,12 +1,14 @@
 ---
 docs: DOCS-789
-title: Add license
+title: Add a license (connected)
 toc: true
-weight: 1
+weight: 10
 type:
 - how-to
 ---
 
+{{< note >}}For disconnected environments, see [Add a license (disconnected)]({{< ref "nim/disconnected/add-license-disconnected-deployment.md" >}}).{{< /note >}}
+
 ## Overview
 
 To unlock all of the features in NGINX Instance Manager, you’ll need to add a JSON Web Token (JWT) license from MyF5. This guide shows you how to set up your network for reporting, download the license file, and apply it to NGINX Instance Manager. If needed, you can also cancel the license at any time.
diff --git a/content/nim/admin-guide/license/_index.md b/content/nim/admin-guide/license/_index.md
deleted file mode 100644
index bdaf856b0..000000000
--- a/content/nim/admin-guide/license/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: License and usage reporting
-weight: 1
-url: /nginx-instance-manager/admin-guide/license/
-cascade:
-   type: "nim-r33"
----
\ No newline at end of file
diff --git a/content/nim/admin-guide/rbac/overview-rbac.md b/content/nim/admin-guide/rbac/overview-rbac.md
index c49e14463..be72b3013 100644
--- a/content/nim/admin-guide/rbac/overview-rbac.md
+++ b/content/nim/admin-guide/rbac/overview-rbac.md
@@ -24,7 +24,7 @@ The following are essential concepts related to RBAC:
 
 ## Features {#features}
 
-NGINX Instance Manager provides a range of capabilities called features, which system administrators can manage using role-based access control (RBAC). The availability of some features depends on your license. For more information on licensing, see the [Add a license]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic.
+NGINX Instance Manager provides a range of capabilities called features, which system administrators can manage using role-based access control (RBAC). The availability of some features depends on your license. For more information on licensing, see the [Add a license]({{< ref "/nim/admin-guide/add-license.md" >}}) topic.
 
 ### NGINX Instance Manager features
 
diff --git a/content/nim/admin-guide/license/report-usage-connected-deployment.md b/content/nim/admin-guide/report-usage-connected-deployment.md
similarity index 85%
rename from content/nim/admin-guide/license/report-usage-connected-deployment.md
rename to content/nim/admin-guide/report-usage-connected-deployment.md
index d57939516..6ce813807 100644
--- a/content/nim/admin-guide/license/report-usage-connected-deployment.md
+++ b/content/nim/admin-guide/report-usage-connected-deployment.md
@@ -1,8 +1,8 @@
 ---
-title: Report usage data to F5
+title: Report usage data to F5 (connected)
 draft: false
 description: ''
-weight: 10
+weight: 20
 toc: true
 docs: DOCS-1650
 personas:
@@ -14,6 +14,8 @@ type:
 - how-to
 ---
 
+{{< note >}}For disconnected environments, see [Report usage data to F5 (disconnected)]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}).{{< /note >}}
+
 ## Overview
 
 In environments where NGINX Instance Manager has internet access but NGINX Plus doesn’t, NGINX Plus sends usage data to NGINX Instance Manager. NGINX Instance Manager will automatically send the usage reports to F5 for verification, or you can choose to send them manually.
@@ -22,8 +24,6 @@ In environments where NGINX Instance Manager has internet access but NGINX Plus
 
 See the steps below to configure NGINX Plus to report usage data to NGINX Instance Manager and how to submit the report to F5 for verification.
 
-{{<call-out "tip" "For network-restricted environments:" "" >}}If your deployment of NGINX Instance Manager doesn’t allow internet access, follow the steps in [Report usage data in network-restricted environments]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}) to report usage data to F5.{{</call-out>}}
-
 ---
 
 ## Before you begin
@@ -49,7 +49,7 @@ To configure NGINX Plus (R33 and later) to report usage data to NGINX Instance M
 
 ### Automatic reporting
 
-When you [add your JSON Web Token (JWT)]({{< ref "nim/admin-guide/license/add-license.md" >}}) to NGINX Instance Manager, usage reporting is enabled by default.
+When you [add your JSON Web Token (JWT)]({{< ref "nim/admin-guide/add-license.md" >}}) to NGINX Instance Manager, usage reporting is enabled by default.
 
 NGINX Instance Manager will automatically report subscription entitlement and usage data to F5 if internet access is available.
 
diff --git a/content/nim/deploy/_index.md b/content/nim/deploy/_index.md
index 0cd726566..37404e495 100644
--- a/content/nim/deploy/_index.md
+++ b/content/nim/deploy/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Deploy
+title: Deploy in a connected environment
 description:
 weight: 20
 url: /nginx-instance-manager/deploy/
diff --git a/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md b/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md
index aba19ad72..8e8a3fe99 100644
--- a/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md
+++ b/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md
@@ -10,48 +10,67 @@ type:
 
 ## Overview
 
-This guide will show you how to deploy and use F5 NGINX Instance Manager in Docker using [Docker Compose](https://docs.docker.com/compose/).
+This guide shows you how to run NGINX Instance Manager using [Docker Compose](https://docs.docker.com/compose/).
 
-This NGINX Instance Manager docker compose deployment is a single Docker image containing NGINX Instance Manager, Security Monitoring, and the latest App Protect compilers, which is orchestrated using a Docker Compose docker-compose.yaml definition.
+You can deploy it in two ways:
 
-The ClickHouse database is deployed in a separate container to improve resilience and make this a fault tolerant solution. You can also configure persistent storage
+- **Standard mode** includes full metrics and dashboards. This setup runs ClickHouse in a separate container.
+- **Lightweight mode** (new in 2.20.0) skips ClickHouse entirely. It’s ideal if you don’t need monitoring data or want a simpler setup. This reduces system requirements and avoids the work of managing a metrics database. You can add ClickHouse later if your needs change.
+
+Both modes use a pre-built Docker image that includes NGINX Instance Manager, Security Monitoring, and the latest NGINX App Protect compilers.
+
+If you use the standard setup, ClickHouse runs in its own container. This helps with fault tolerance and keeps data separate. You can also use persistent storage.
 
 ---
 
 ## What you need
 
-- A working version of [Docker](https://docs.docker.com/get-docker/)
-- Your NGINX Instance Manager subscription's JSON Web Token from [MyF5](https://my.f5.com/manage/s/subscriptions) You can use the same JSON Web Token as NGINX Plus in your MyF5 portal.
-- This pre-configured `docker-compose.yaml` file:
-  - {{<fa "download">}} {{<link "/scripts/docker-compose/docker-compose.yaml" "Download docker-compose.yaml file">}}.
+Before you begin, make sure you have the following:
+
+- [Docker](https://docs.docker.com/get-docker/) installed on your system.
+- A JSON Web Token (JWT) from your [MyF5 subscriptions page](https://my.f5.com/manage/s/subscriptions). This is the same token used for NGINX Plus.
+- The right `docker-compose.yaml` file for your setup:
+  - For **standard mode** (with metrics and dashboards):  
+    {{<fa "download">}} {{<link "/scripts/docker-compose/docker-compose.yaml" "Download the standard docker-compose.yaml file">}}
+  - For **lightweight mode** (no ClickHouse, no metrics):  
+    {{<fa "download">}} {{<link "/scripts/docker-compose/docker-compose-lightweight.yaml" "Download the lightweight docker-compose.yaml file">}}
+
+{{< note >}} If you're not sure which one to use, start with lightweight mode. You can always switch later by changing the Compose file and setting `ENABLE_METRICS: "true"`.{{< /note >}}
 
 ---
 
 ## Minimum requirements
 
-Deploying NGINX Instance Manager with docker requires a minimum of 4 CPU cores and 4 GB of memory for basic use cases. However, every environment is unique, primarily due to variations in the NGINX configurations being managed. For instance, managing NGINX instances with hundreds of configuration files or those with WAF (NGINX App Protect) enabled can significantly increase resource demands.
+Your system needs enough resources to run NGINX Instance Manager based on the mode you choose:
+
+| Deployment mode | CPU cores | Memory | ClickHouse required |
+|-----------------|-----------|--------|---------------------|
+| Standard        | 4         | 4 GB   | Yes                 |
+| Lightweight     | (Lower)   | (Lower)| No                  |
 
-If your use case is limited to usage tracking without active management or agent communication, the minimum requirements should suffice. For more complex deployments, we recommend reviewing the technical specifications guide to ensure the resources allocated are sufficient to handle an increased workload, particularly for the ClickHouse database, which may need to manage a higher volume of reads and writes.
+Standard mode requires a minimum of 4 CPU cores and 4 GB of memory. This setup includes ClickHouse, which handles metrics and dashboards. Depending on your NGINX footprint, you may need more resources, especially for environments with many configuration files or NGINX App Protect enabled.
+
+Lightweight mode removes ClickHouse, which lowers memory and CPU usage. While there’s no official minimum, users with basic instance management needs may see success with fewer resources. Test in your environment before committing to a smaller footprint.
+
+{{< note >}} If you're not sure which mode to use, start with lightweight mode. It's easier to set up, and you can switch to standard mode later by reintroducing ClickHouse. {{< /note >}}
 
 ## Before you start
 
 {{< include "/nim/decoupling/note-legacy-nms-references.md" >}}
 
-### Set up Docker for NGINX container registry
+### Log in to the NGINX container registry
 
-To set up Docker to communicate with the NGINX container registry located at `private-registry.nginx.com`, follow these steps:
+Both standard and lightweight deployments use a private image hosted at `private-registry.nginx.com`. You need to log in before running Docker Compose.
 
-{{< include "/nim/docker/docker-registry-login.md" >}}
+To set up Docker to communicate with the NGINX container registry:
 
-### Compose deployment
-
-{{<call-out "note" "Configuring a forward proxy:" "" >}}
+{{< include "/nim/docker/docker-registry-login.md" >}}
 
-If you are configuring a **forward proxy**, follow the steps in the [Forward Proxy Configuration Guide]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}) to modify `docker-compose.yaml` with the correct proxy settings **before** deploying NGINX Instance Manager.
+### Deploy NGINX Instance Manager
 
-{{</call-out>}}
+If you're using a forward proxy, update the Compose file **before** deploying. Follow the steps in the [Forward Proxy Configuration Guide]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}).
 
-Go to the directory where you downloaded `docker-compose.yaml`. Use the following commands to log in to `private-registry.nginx.com` and deploy NGINX Instance Manager.
+Go to the directory where you downloaded your `docker-compose.yaml` file, and run the following commands:
 
 ```shell
 docker login private-registry.nginx.com --username=<JWT_CONTENTS> --password=none
@@ -59,52 +78,84 @@ echo "admin" > admin_password.txt
 docker compose up -d
 ```
 
-If the deployment succeeds, you’ll see output similar to this:
+The deployment output will vary depending on the mode:
+
+#### Standard mode (with metrics)
 
 ```text
 [+] Running 6/6
- ✔ Network nim_clickhouse        Created   0.1s
- ✔ Network nim_external_network  Created   0.2s
- ✔ Network nim_default           Created   0.2s
- ✔ Container nim-precheck-1      Started   0.8s
- ✔ Container nim-clickhouse-1    Healthy   6.7s
- ✔ Container nim-nim-1           Started   7.4s
+ ✔ Network nim_clickhouse        Created
+ ✔ Network nim_external_network  Created
+ ✔ Network nim_default           Created
+ ✔ Container nim-precheck-1      Started
+ ✔ Container nim-clickhouse-1    Healthy
+ ✔ Container nim-nim-1           Started
  ```
 
+#### Lightweight mode (no ClickHouse)
+
+```text
+[+] Running 3/3
+ ✔ Network nim_default           Created
+ ✔ Network nim_external_network  Created
+ ✔ Container nim-nim-1           Started
+```
+
+In lightweight mode, only the NGINX Instance Manager service runs. ClickHouse and related containers are removed by design.
+
 ### Supported environment variables
 
+You can control Instance Manager behavior by setting environment variables in the `docker-compose.yaml` file. Here’s a summary of commonly used variables:
+
 {{< include "nim/docker/docker-compose-env-vars.md" >}}
 
-<br>
+### Stop or remove services
 
-{{<call-out "tip" "See also:" "" >}}
-For details on configuring a forward proxy, see the [Forward Proxy Configuration Guide]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}).
-{{</call-out>}}
+To stop NGINX Instance Manager, go to the directory where you downloaded your `docker-compose.yaml` file.
 
-### Compose stop or tear down
+If you used `docker compose up -d` to start services:
 
-Navigate to the directory where you downloaded `docker-compose.yaml`. If you started NIM with `docker compose up -d`, stop NIM services once you've finished with them by running `docker compose stop`. You can bring everything down, removing the containers entirely, with the `docker compose down` command.
+- Run `docker compose stop` to pause the containers
+- Run `docker compose down` to remove them completely
 
 ```shell
 docker compose down
 ```
-```
+
+The shutdown output will vary depending on the mode:
+
+#### Standard mode (with metrics)
+
+```text
 [+] Running 6/6
- ✔ Container nim-nim-1           Removed   30.6s
- ✔ Container nim-clickhouse-1    Removed    1.4s
- ✔ Container nim-precheck-1      Removed    0.0s
- ✔ Network nim_default           Removed    0.9s
- ✔ Network nim_external_network  Removed    0.4s
- ✔ Network nim_clickhouse        Removed    0.6s
+ ✔ Container nim-nim-1           Removed
+ ✔ Container nim-clickhouse-1    Removed
+ ✔ Container nim-precheck-1      Removed
+ ✔ Network nim_default           Removed
+ ✔ Network nim_external_network  Removed
+ ✔ Network nim_clickhouse        Removed
+```
+
+#### Lightweight mode (no ClickHouse)
+
+```text
+[+] Running 3/3
+ ✔ Container nim-nim-1           Removed
+ ✔ Network nim_default           Removed
+ ✔ Network nim_external_network  Removed
 ```
 
+In lightweight mode, only the core service and networks are removed. ClickHouse and precheck containers aren’t present.
+
 ---
 
 ## Secrets
 
-In the same `docker-compose.yaml` file, you can modify the following credentials:
+You can define secrets in the `docker-compose.yaml` file to set the admin password, optional access credentials, and TLS certificates.
+
+### Required
 
-Set the admin password (required)
+Set the admin password:
 
 ```yaml
 secrets:
@@ -112,14 +163,17 @@ secrets:
     file: admin_password.txt
 ```
 
-Pass a custom `.htpasswd` file (Optional)
+### Optional
+
+Use a custom `.htpasswd` file to control access to the user interface:
 
 ```yaml
+secrets:
   nim_credential_file:
     file: nim_creds.txt
 ```
 
-Optionally, you can also set the external SSL certificate, key, and CA files, in PEM format for the NGINX Instance Manager Ingress proxy.
+Use your own TLS certificate, key, and CA file for the ingress proxy:
 
 ```yaml
 secrets:
@@ -135,64 +189,122 @@ secrets:
 
 ## Backup
 
-Once you've set up your Docker containers, use the following command to back them up:
+You can create a backup of NGINX Instance Manager at any time using the built-in `nim-backup` command. This works for both standard and lightweight deployments.
+
+Run the following command from your Docker host:
 
 ```shell
-~$ docker exec nim-nim-1 nim-backup
-...
-Backup has been successfully created: /data/backup/nim-backup-<date>.tgz
+docker exec nim-nim-1 nim-backup
 ```
 
-If your system uses named volumes, inspect the `Mountpoint`. Alternatively, if you're using a shared NFS volume, then collect the data directly from the mount point.
+If successful, you’ll see a message like:
 
-```shell
-~/compose$ docker inspect volume nim_nim-data | jq '.[0].Mountpoint'
-"/var/lib/docker/volumes/nim_nim-data/_data"
-ubuntu@ip-<address>:~/compose$ sudo ls -l /var/lib/docker/volumes/nim_nim-data/_data/backup
--rw-r--r-- 1 root root 5786953 Sep 27 02:03 nim-backup-<date>.tgz
+```text
+Backup has been successfully created: /data/backup/nim-backup-<date>.tgz
 ```
 
+To locate the backup file:
+
+- **If using named volumes**
+
+  Inspect the volume to find its mount point:
+
+  ```shell
+  docker inspect volume nim_nim-data | jq '.[0].Mountpoint'
+  ```
+
+  Then list the backup directory:
+
+  ```shell
+  sudo ls -l /var/lib/docker/volumes/nim_nim-data/_data/backup
+  ```
+
+  Example output:
+
+  ```text
+  -rw-r--r-- 1 root root 5786953 Sep 27 02:03 nim-backup-2024-06-11.tgz
+  ```
+
+- **If using NFS**
+
+  Check the mount path directly, such as:
+
+  ```shell
+  ls -l /mnt/nfs_share/data/backup
+  ```
+
+
 ---
 
 ## Restore
 
-Before you can restore a backup, set your containers to maintenance mode in the same `docker-compose.yaml` file:
+To restore a backup, follow these steps:
 
-```yaml
+1. Enable maintenance mode:
+
+    In your `docker-compose.yaml` file, set the following:
+
+    ```yaml
     environment:
       NIM_MAINTENANCE: "true"
-```
+    ```
 
-```shell
-~$ docker exec nim-nim-1 nim-restore /data/backup/nim-backup-<date>.tgz
-...
-NGINX Instance Manager has been restored.
-```
+2. Run the restore command:
+
+    ```shell
+    docker exec nim-nim-1 nim-restore /data/backup/nim-backup-<date>.tgz
+    ```
+
+3. After the restore process finishes, disable maintenance mode.
+
+    In `docker-compose.yaml`, change the value back:
+
+    ```yaml
+    environment:
+      NIM_MAINTENANCE: "false"
+    ```
+
+4. Restart the container:
 
-Once the process is complete set `NIM_MAINTENANCE` to `false` and then run `docker-compose up -d`.
+    ```shell
+    docker compose up -d
+    ```
 
 ---
 
 ## Storage
 
-By default, the storage uses named volumes. Alternatively, you can use optional `driver_opts` settings to support other storage formats such as NFS.
-For all storage volumes, make sure to mount them, before running `docker compose up -d`. For a mounted NFS volume, you might use the following commands:
+NGINX Instance Manager uses named Docker volumes by default to persist data. You can also configure NFS or other storage backends using `driver_opts`.
+
+### Default volumes
+
+The standard `docker-compose.yaml` file defines these named volumes:
+
+- `nim-data`: stores configuration and state for Instance Manager
+- `clickhouse-data`: used only in standard mode to persist metrics
+
+In lightweight mode, `clickhouse-data` is not needed and should be removed from the Compose file.
+
+### Example: use NFS for storage
+
+Before you run `docker compose up -d`, make sure your NFS volumes are mounted:
 
 ```shell
-~$ sudo mount -t nfs <<nfs-ip>>:/mnt/nfs_share/clickhouse /mnt/nfs_share/clickhouse
-~$ sudo mount -t nfs <<nfs-ip>>:/mnt/nfs_share/data /mnt/nfs_share/data
+sudo mount -t nfs <<nfs-ip>>:/mnt/nfs_share/data /mnt/nfs_share/data
+sudo mount -t nfs <<nfs-ip>>:/mnt/nfs_share/clickhouse /mnt/nfs_share/clickhouse
 ```
 
+Update the volumes section in your Compose file:
+
 ```yaml
 volumes:
-  # By default docker compose will create a named volume
-  # Refer to https://docs.docker.com/reference/compose-file/volumes/ for additional storage options such as NFS
   nim-data:
     driver: local
     driver_opts:
       type: "nfs"
       o: "addr=<<nfs-ip>>,rw"
       device: ":/mnt/nfs_share/data"
+
   clickhouse-data:
     driver: local
     driver_opts:
@@ -201,11 +313,28 @@ volumes:
       device: ":/mnt/nfs_share/clickhouse"
 ```
 
+If you’re using lightweight mode, omit the `clickhouse-data` section entirely.
+
 ---
 
-## Support Data
+## Gather support data
+
+If you [contact support]({{< ref "nim/support/contact-support.md" >}}), it's helpful to include logs and a current backup. These commands capture useful diagnostic data.
 
-In case of problems, it's a good practice to:
+### Get recent logs
+
+Save logs from the past 24 hours:
+
+```shell
+docker compose logs --since 24h > my-logs-$(date +%Y-%m-%d).txt
+```
+
+### Create a fresh backup
+
+Run the backup command to capture the current state:
+
+```shell
+docker exec nim-nim-1 nim-backup
+```
 
-- Collect logs `docker-compose logs --since 24h > my-logs-$(date +%Y-%m-%d).txt`
-- Collect backup information `docker exec nim-nim-1 nim-backup`
+This creates a `.tgz` file inside the container under `/data/backup/`, which you can extract as described in the [Backup](#backup) section.
\ No newline at end of file
diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md
index 8d39db8eb..3b36c5a0e 100644
--- a/content/nim/deploy/kubernetes/deploy-using-helm.md
+++ b/content/nim/deploy/kubernetes/deploy-using-helm.md
@@ -9,230 +9,236 @@ type:
 
 ## Overview
 
-{{< include "/nim/decoupling/note-legacy-nms-references.md" >}}
+You can deploy F5 NGINX Instance Manager on Kubernetes using Helm. This method is quick, scalable, and supports both standard and lightweight modes.
 
-This guide explains how to deploy F5 NGINX Instance Manager on a Kubernetes or OpenShift cluster using Helm. You’ll learn how to download and use Docker images and customize your deployment.
+### New in 2.20.0
 
-{{< note >}} Starting in NGINX Instance Manager 2.19, you can deploy NGINX Instance Manager on an OpenShift cluster using Helm. {{< /note >}}
+Starting with version 2.20.0, NGINX Instance Manager supports **lightweight mode**, which skips ClickHouse and disables metrics collection, ideal for simpler setups or resource-limited environments.
 
-### About Helm
+- Lightweight mode requires NGINX Agent v2.41.1 or later.
 
-Helm charts are pre-configured packages of Kubernetes resources deployed with a single command. They let you define, install, and upgrade Kubernetes applications easily.
+{{< call-out "note" "Chart renamed in NIM 2.20.0" >}}
+The Helm chart has been renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`.  
+Make sure to update your chart references if you’re using version 2.20.0 or later.
+{{< /call-out >}}
 
-Helm charts consist of files that describe a group of related Kubernetes resources, like deployments, services, and ingress. They also allow you to manage dependencies between applications, making it easier to deploy multi-tier or complex applications.
 
 ---
 
-## Before you begin
+## Requirements
 
 To deploy NGINX Instance Manager using a Helm chart, you need:
 
-{{< bootstrap-table "table table-striped table-bordered" >}}
-| Requirements | Notes                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Docker 20.10 or later (linux/amd64)                                                 | [Docker documentation](https://docs.docker.com/get-docker)                                                                                                                                                                                                                                                                                                                                                                                     |
-| <span style=" white-space: nowrap;">Kubernetes 1.21.3 or later (linux/amd64)</span> | Ensure your client can [access the Kubernetes API server](https://kubernetes.io/docs/concepts/security/controlling-access/). The Helm chart will enable persistent storage using the default storage class in your Kubernetes cluster. More info is available in [Dynamic Volume Provisioning](https://kubernetes.io/docs/concepts/storage/dynamic-provisioning/). |
-| kubectl 1.21.3 or later                                                             | [kubectl documentation](https://kubernetes.io/docs/tasks/tools/#kubectl)                                                                                                                                                                                                                                                                                                                                                                         |
-| Helm 3.10.0 or later                                                                | [Helm installation guide](https://helm.sh/docs/intro/install/)                                                                                                                                                                                                                                                                                                                                                                                     |
-| OpenSSL 1.1.1 or later                                                              | [OpenSSL source](https://www.openssl.org/source/)                                                                                                                                                                                                                                                                                                                                                                                         |
-| `tar` 1.20 or later                                                                 | The `tar` tool is usually installed by default. Check your version with `tar --version`. If `tar` is missing or outdated, install it from your distribution’s package manager (like YUM for CentOS/RHEL or APT for Debian/Ubuntu).                                                                                                                                                             |
-
-{{< /bootstrap-table >}}
+## Requirements
 
----
+To deploy NGINX Instance Manager using a Helm chart, you need:
 
-## Get the NGINX Instance Manager images
+{{< bootstrap-table "table table-striped table-bordered" >}}
+| Requirements                                 | Notes                                                                                                                                                                                                                  |
+|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Docker 20.10 or later (linux/amd64)          | [Docker documentation](https://docs.docker.com/get-docker/)                                                                                                                                                            |
+| Kubernetes 1.21.3 or later (linux/amd64)     | Ensure your client can [access the Kubernetes API server](https://kubernetes.io/docs/concepts/overview/components/#kube-apiserver). Helm uses the default storage class for persistent volume provisioning.            |
+| `kubectl` 1.21.3 or later                    | [kubectl documentation](https://kubernetes.io/docs/reference/kubectl/)                                                                                                                                                 |
+| Helm 3.10.0 or later                         | [Helm installation guide](https://helm.sh/docs/intro/install/)                                                                                                                                                         |
+| OpenSSL 1.1.1 or later                       | [OpenSSL source](https://www.openssl.org/source/)                                                                                                                                                                      |
+| `tar` 1.20 or later                          | The `tar` tool is usually installed by default. Check with `tar --version`.                                                                                                                                            |
+| `values.yaml` file with `nmsClickhouse.mode` | Optional. Defaults to `internal`. Set to `external` or `disabled` to use an external ClickHouse instance or enable lightweight mode. In `external` mode, set `nim.externalClickhouse.address` to your ClickHouse host. |
+| NGINX subscription JWT                       | Required to authenticate with `private-registry.nginx.com` to pull the image. Download your JWT from [MyF5](https://my.f5.com/manage/s/) under **My Products & Plans > Subscriptions**.                                |
+{{</ bootstrap-table >}}
 
-### Using Docker
+---
 
-### Using Helm with a JWT token
+## Set up image registry access for NGINX Instance Manager
 
 You can use your NGINX JWT as a Docker configuration secret with Helm charts.
 
 Create a Docker registry secret on the cluster, using the JWT token as the username and `none` as the password. The Docker server is `private-registry.nginx.com`.
 
-{{< note >}} Make sure there are no extra characters or spaces when copying the JWT token. They can invalidate the token and cause 401 errors during authentication. {{< /note >}}
+{{< call-out "note" "Note" >}}
+Make sure there are no extra characters or spaces when copying the JWT token. They can invalidate the token and cause 401 errors during authentication.
+{{< /call-out >}}
 
-- **Kubernetes**:
+### Kubernetes
 
-  ```shell
-  kubectl create namespace nms
-  ```
-
-  ```shell
-  kubectl create secret docker-registry regcred \
+```shell
+kubectl create namespace nms
+kubectl create secret docker-registry regcred \
   --docker-server=private-registry.nginx.com \
-  --docker-username=<JWT Token> \
+  --docker-username=<NGINX JWT Token> \
   --docker-password=none \
   -n nms
-  ```
-
-- **OpenShift**:
+```
 
-  ```shell
-  oc new-project nms
-  ```
+### OpenShift
 
-  ```shell
-  oc create secret docker-registry regcred \
+```shell
+oc new-project nms
+oc create secret docker-registry regcred \
   --docker-server=private-registry.nginx.com \
-  --docker-username=<JWT Token> \
+  --docker-username=<NGINX JWT Token> \
   --docker-password=none \
   -n nms
-  ```
-
-{{< warning >}}
-
-You might see a warning about `--password` being insecure.
-
-This can be ignored (since no password is used), but if others have access to this system, delete the JWT token and clear your shell history after deployment.
+```
 
-{{< /warning >}}
+{{< call-out "note" "Note" >}}
+You might see a warning that `--password` is insecure. In this case, it’s safe to ignore—none is used as a placeholder.
 
-To confirm the secret is created:
+As a best practice, you can delete the JWT token and clear your shell history after deployment if others have access to the system.
+{{< /call-out >}}
 
-- **Kubernetes**:
+### Confirm the secret
 
-  ```shell
-  kubectl get secret regcred --output=yaml -n nms
-  ```
+- Kubernetes
 
-- **OpenShift**:
+    ```shell
+    kubectl get secret regcred --output=yaml -n nms
+    ```
 
-  ```shell
-  oc get secret regcred --output=yaml -n nms
-  ```
+- OpenShift
 
+    ```shell
+    oc get secret regcred --output=yaml -n nms
+    ```
 
-You can now use this secret for Helm deployments and point the charts to the public registry.
+You can now use this secret for Helm deployments and point the chart to the private registry.
 
 ---
 
-## Add the Helm repository
-
-{{< note >}} You need Helm 3.10.0 or later for these steps. {{< /note >}}
+## Add the repository {#add-repository}
 
-Run these commands to install the NGINX Instance Manager chart from the Helm repository:
+Run the following commands to add the official NGINX Helm repository and update your local chart list.
 
 ```shell
 helm repo add nginx-stable https://helm.nginx.com/stable
 helm repo update
 ```
 
-The first command adds the `nginx-stable` repository to your local Helm repo list. The second updates the list to ensure you have the latest versions of the charts.
-
 ---
 
-## Create a Helm deployment values.yaml file
+## Create a values.yaml file {#configure-values-yaml}
 
-The `values.yaml` file customizes the Helm chart installation without modifying the chart itself. You can use it to specify image repositories, environment variables, resource requests, and other settings.
+Create a file named `values.yaml` using the following example. This file customizes your NGINX Instance Manager deployment with Helm.
 
-1. Create a `values.yaml` file similar to this example:
+The values file lets you:
 
-    - In the `imagePullSecrets` section, add the credentials for your private Docker registry.
-    - Change the version tag to the version of NGINX Instance Manager you would like to install. See "Install the chart" below for versions.
-    - If deploying on OpenShift, add the `openshift.enabled: true` setting.
-
-    {{< see-also >}} For details on creating a secret, see Kubernetes [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). {{</ see-also >}}
-
-    ```yaml
-    imagePullSecrets:
-        - name: regcred
-    apigw:
-        image:
-            repository: private-registry.nginx.com/nms/apigw
-            tag: <version>
-    core:
-        image:
-            repository: private-registry.nginx.com/nms/core
-            tag: <version>
-    dpm:
-        image:
-            repository: private-registry.nginx.com/nms/dpm
-            tag: <version>
-    ingestion:
-        image:
-            repository: private-registry.nginx.com/nms/ingestion
-            tag: <version>
-    integrations:
-        image:
-            repository: private-registry.nginx.com/nms/integrations
-            tag: <version>
-    secmon:
-        image:
-            repository: private-registry.nginx.com/nms/secmon
-            tag: <version>
-    utility:
-        image:
-            repository: private-registry.nginx.com/nms/utility
-            tag: <version>
-    ```
-
-    {{< note >}} Starting in NGINX Instance Manager 2.19, the `secmon` pod is included in the NGINX Instance Manager deployment. {{< /note >}}
-
-2. Save and close the `values.yaml` file.
+- Set the deployment mode
+- Provide registry credentials
+- Specify image sources for each NIM service
 
----
+Set `nmsClickhouse.mode` to control ClickHouse deployment:
 
-## Enabling OpenShift
+| Mode       | Description                                                                                |
+|------------|--------------------------------------------------------------------------------------------|
+| `internal` | Deploys ClickHouse in the cluster (default).                                               |
+| `external` | Connects to an external ClickHouse instance and requires `nim.externalClickhouse.address`. |
+| `disabled` | Disables ClickHouse and enables lightweight mode (no metrics).                             |
 
-If deploying on OpenShift, include this setting in the `values.yaml` file:
+{{< call-out "note" "See also" >}}
+See the [Helm chart configuration settings](
+https://docs.nginx.com/nginx-instance-manager/deploy/kubernetes/helm-config-settings/
+) guide for a complete list of chart parameters.
+{{< /call-out >}}
 
 ```yaml
-openshift:
-  enabled: true
+nmsClickhouse:
+  mode: internal # options: internal, external, disabled
+
+# when mode is external, uncomment and set this:
+# externalClickhouse:
+#   address: <clickhouse-host>:<port>
+
+imagePullSecrets:
+  - name: regcred
+
+apigw:
+  image:
+    repository: private-registry.nginx.com/nms/apigw
+    tag: 2.20.0
+
+core:
+  image:
+    repository: private-registry.nginx.com/nms/core
+    tag: 2.20.0
+
+dpm:
+  image:
+    repository: private-registry.nginx.com/nms/dpm
+    tag: 2.20.0
+
+ingestion:
+  image:
+    repository: private-registry.nginx.com/nms/ingestion
+    tag: 2.20.0
+
+integrations:
+  image:
+    repository: private-registry.nginx.com/nms/integrations
+    tag: 2.20.0
+
+secmon:
+  image:
+    repository: private-registry.nginx.com/nms/secmon
+    tag: 2.20.0
+
+utility:
+  image:
+    repository: private-registry.nginx.com/nms/utility
+    tag: 2.20.0
 ```
 
-{{< note >}} The NIM deployment on OpenShift has been tested with OpenShift v4.13.0 Server. {{< /note >}}
+These values are required when pulling images from the NGINX private registry. The chart does not auto-resolve image tags. Update the tag: fields to match the NGINX Instance Manager version you want to install.
 
-### How OpenShift handles security constraints
+Use the file with the `-f values.yaml` flag when installing the chart.
 
-When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a **custom [Security Context Constraints](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) (SCCs)** and links it to the Service Account used by all pods.
+{{< call-out "note" "OpenShift support" >}}
+OpenShift support was added in NGINX Instance Manager 2.19. To enable it, add the setting `openshift.enabled: true` to your `values.yaml` file.  
+For more details, see [Appendix: OpenShift security constraints](#appendix-openshift-security-constraints).
+{{< /call-out >}}
 
-By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The NGINX Instance Manager deployment needs specific user IDs (UIDs) for certain services, such as **1000** for `nms` and **101** for `nginx` and `clickhouse`. Since the default SCCs do not allow these UIDs, a **custom SCC** is created. This ensures that the deployment can run with the necessary permissions while maintaining OpenShift’s security standards. The custom SCC allows these UIDs by setting the `runAsUser` field, which controls which users can run containers.
+---
 
-{{< note >}} If you’re encountering errors with the custom SCC, you may not have permissions to access the Security Context Constraints resource. Please contact a Cluster Administrator to request access, either through a cluster role binding or by adjusting your user role. {{< /note >}}
+## Install the chart
 
-To verify that the custom SCC has been created, after installing the helm chart, run:
+Install NGINX Instance Manager using Helm. The `adminPasswordHash` sets the default admin password.
 
 ```shell
-oc get scc nms-restricted-v2-scc --output=yaml
+helm install nim nginx-stable/nim \
+  -n nim \
+  --create-namespace \
+  --set adminPasswordHash=$(openssl passwd -6 '<your-password>') \
+  -f <your-values.yaml> \
+  --version <chart-version> \
+  --wait
 ```
 
----
-
-## Install the chart
+- Replace `<your-password>` with your preferred admin password.
+- Replace `<your-values.yaml>` with the path to your customized values.yaml file.
+- Replace `<chart-version>` with the version you want to install (for example, `2.20.0`).
 
-Run the `helm install` command to deploy NGINX Instance Manager:
+**Note:** You can set the ClickHouse mode at install time instead of editing `values.yaml`:
 
-1. Replace `<path-to-your-values.yaml>` with the path to your `values.yaml` file.
-1. Replace `YourPassword123#` with a secure password (containing a mix of uppercase, lowercase letters, numbers, and special characters).
+For lightweight mode (no ClickHouse):
 
-   {{< important >}} Remember to save the password for future use. Only the encrypted password is stored, and there's no way to recover or reset it if lost. {{< /important >}}
+```shell
+--set nmsClickhouse.mode=disabled
+```
 
-(Optional) Replace `<chart-version>` with the desired chart version. If omitted, the latest version will be installed. Currently only version 2.19.0 is supported.
+For external ClickHouse:
 
 ```shell
-helm install -n nms \
---set adminPasswordHash=$(openssl passwd -6 'YourPassword123#') \
-nms nginx-stable/nms-hybrid \
---create-namespace \
--f <path-to-your-values.yaml> \
-[--version <chart-version>] \
---wait
+--set nmsClickhouse.mode=external \
+--set nim.externalClickhouse.address=<clickhouse-host>:<port>
 ```
 
----
-
-## Validate the deployment
+**Validate the deployment**
 
-Check the status of the deployment:
+After installation, run the following command to confirm the deployment was successful:
 
 ```shell
-helm -n nms status nms
+helm status nim -n nim
 ```
 
-The status should show `STATUS: deployed` if successful.
+You should see `STATUS: deployed` in the output.
 
 ---
 
@@ -246,88 +252,100 @@ The status should show `STATUS: deployed` if successful.
 
 A valid license is required to use all NGINX Instance Manager features.
 
-For instructions on downloading and applying a license, see [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}).
+For instructions on downloading and applying a license, see [Add a License]({{< ref "/nim/admin-guide/add-license.md" >}}).
 
 ---
 
-## Upgrade NGINX Instance Manager
+### Upgrade NGINX Instance Manager
 
-To upgrade:
+To upgrade your deployment:
 
-1. [Update the Helm repository list](#add-helm-repository).
-1. [Adjust your `values.yaml` file](#create-a-helm-deployment-values.yaml-file) if needed.
-1. To upgrade the NGINX Instance Manager deployment, run the following command. This command updates the `nms` deployment with a new version from the `nginx-stable/nms-hybrid` repository. It also hashes the provided password and uses the `values.yaml` file at the path you specify.
+1. [Update the Helm repository list](#add-repository).
+2. [Review and adjust your `values.yaml` file](#configure-values-yaml) as needed.
+3. Run the following command to upgrade the deployment. This command uses the current chart version from the `nginx-stable/nim` repository and applies the configuration from your `values.yaml` file.
 
-(Optional) Replace `<chart-version>` with the desired chart version. If omitted, the latest version will be installed. Currently only version 2.19.0 is supported.
+```shell
+helm upgrade nim nginx-stable/nim \
+  -n nim \
+  --set adminPasswordHash=$(openssl passwd -6 '<your-password>') \
+  -f <path-to-your-values.yaml> \
+  --version <nim-version> \
+  --wait
+```
 
-   ```bash
-    helm upgrade -n nms \
-    --set adminPasswordHash=$(openssl passwd -6 'YourPassword123#') \
-    nms nginx-stable/nms-hybrid \
-    -f <path-to-your-values.yaml> \
-    [--version <chart-version>] \
-    --wait
-   ```
+- Replace `<your-password>` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
+- Replace `<path-to-your-values.yaml>` with the full path to your configuration file.
+- Replace `<nim-version>` with the version of NGINX Instance Manager you want to upgrade to.
 
-   - Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}).
-   - Replace `YourPassword123#` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
 
-      {{<call-out "important" "Save the password!" "" >}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
-   - (Optional) Replace <nms-chart-version> with the desired version number. If you don’t specify a version, the latest version will be installed.
+{{< call-out "important" "Save the password!" >}}
+Only the encrypted version of the admin password is stored in Kubernetes. If you lose it, it can’t be recovered or reset.
+Make sure to save the password in a secure place.
+{{< /call-out >}}
 
+{{< call-out "note" "Upgrading from earlier versions" >}}
+If you’re upgrading from a deployment that used the legacy `nms` chart or release name, you’ll need to update the chart reference and adjust the release name as needed.
+The latest chart is now called `nginx-stable/nim`, and `nim` is the recommended release name.
+{{< /call-out >}}
 
 ---
 
 ## Uninstall NGINX Instance Manager {#helm-uninstall-nim}
 
-To uninstall:
+To uninstall NGINX Instance Manager, run:
 
-```bash
-helm uninstall --namespace nms nms
+```shell
+helm uninstall <release-name> -n <namespace>
 ```
 
-This deletes the `nms` application and all associated Kubernetes resources.
+This command removes the deployment and all Kubernetes resources managed by the Helm chart.
+
+For example, if you used the default release and namespace names:
+
+```shell
+helm uninstall nim -n nim
+```
 
 ---
 
 ## Manage network policies
 
-To apply network policies for NGINX Instance Manager, ensure Kubernetes has a [network plugin](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) installed before the Helm chart installation.
+If you plan to use network policies, make sure your Kubernetes cluster has a supported [network plugin](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) installed **before** you install the Helm chart.
 
-By default, the following network policies will be created in the release namespace:
+By default, the Helm chart creates a set of network policies for NGINX Instance Manager in the deployment namespace.
+
+To view them:
 
 - **Kubernetes**:
 
-  ```shell
-  kubectl get netpol -n nms
-  ```
+    ```shell
+    kubectl get netpol -n <namespace>
+    ```
 
 - **OpenShift**:
 
-  ```shell
-  oc get netpol -n nms
-  ```
-  **Output**:
-
-  ```text
-  NAME           POD-SELECTOR                          AGE
-  apigw          app.kubernetes.io/name=apigw          4m47s
-  clickhouse     app.kubernetes.io/name=clickhouse     4m47s
-  core           app.kubernetes.io/name=core           4m47s
-  dpm            app.kubernetes.io/name=dpm            4m47s
-  ingestion      app.kubernetes.io/name=ingestion      4m47s
-  integrations   app.kubernetes.io/name=integrations   4m47s
-  secmon         app.kubernetes.io/name=secmon         4m47s
-  utility        app.kubernetes.io/name=integrations   4m47s
-  ```
-
-To disable network policies, update the `values.yaml` file:
+    ```shell
+    oc get netpol -n <namespace>
+    ```
+
+The number and names of network policies vary depending on the deployment mode (standard vs. lightweight). For example, in standard mode, you might see output like this:
+
+```text
+NAME         POD-SELECTOR                     AGE
+apigw        app.kubernetes.io/name=apigw     2m
+core         app.kubernetes.io/name=core      2m
+dpm          app.kubernetes.io/name=dpm       2m
+ingestion    app.kubernetes.io/name=ingestion 2m
+secmon       app.kubernetes.io/name=secmon    2m
+```
+
+If you’re using lightweight mode, your output may include fewer entries.
+
+To disable network policies, add the following to your `values.yaml` file:
 
 ```yaml
-nms-hybrid:
-   networkPolicies:
-      # Set this to true to enable network policies for NGINX Instance Manager.
-      enabled: false
+networkPolicies:
+  enabled: false
 ```
 
 ---
@@ -388,7 +406,7 @@ Run the `helm install` command to deploy NGINX Instance Manager:
 
    {{< important >}} Remember to save the password for future use. Only the encrypted password is stored, and there's no way to recover or reset it if lost. {{< /important >}}
 
-3. Replace `<chart-version>` with the desired chart version 1.15.0 or lower. If omitted, it will lead to an unsuccessful deployment as it will try to install the latest vesrion 1.16.0 or later.
+3. (Optional) Replace `<chart-version>` with the desired chart version. If omitted, the latest version will be installed.
 
 ```shell
 helm install -n nms \
@@ -410,12 +428,12 @@ To help you choose the right NGINX Instance Manager chart version, see the table
 
 To upgrade:
 
-1. [Update the Helm repository list](#add-helm-repository).
+1. [Update the Helm repository list](#add-repository).
 2. [Adjust your `values.yaml` file](#create-a-helm-deployment-values.yaml-file) if needed.
 3. To upgrade the NGINX Instance Manager deployment, run the following command. This command updates the `nms` deployment with a new version from the `nginx-stable/nms` repository. It also hashes the provided password and uses the `values.yaml` file at the path you specify.
 4. Replace `<chart-version>` with the desired chart version 1.15.0 or lower. If omitted, it will lead to an unsuccessful deployment as it will try to upgrade to the latest vesrion 1.16.0 or later.
 
-   ```bash
+   ```shell
     helm upgrade -n nms \
     --set nms-hybrid.adminPasswordHash=$(openssl passwd -6 'YourPassword123#') \
     nms nginx-stable/nms \
@@ -433,5 +451,33 @@ To upgrade:
 
 ## Troubleshooting
 
-For instructions on creating a support package to share with NGINX Customer Support, see [Create a Support Package from a Helm Installation]({{< ref "/nms/support/k8s-support-package.md" >}}).
+For instructions on creating a support package to share with NGINX Customer Support, see [Create a Support Package from a Helm Installation]({{< ref "nim/support/k8s-support-package.md" >}}).
+
+---
+
+## Appendix: OpenShift security constraints {#appendix-openshift-security-constraints}
+
+OpenShift restricts containers from running as root by default. To support NGINX Instance Manager, the Helm chart creates a custom Security Context Constraint (SCC) when you set:
+
+```yaml
+openshift:
+  enabled: true
+```
+
+This ensures pods can run with the user IDs required by NGINX Instance Manager services.
+
+{{< call-out "note" "Note" >}}
+If you see permission errors during deployment, your user account might not have access to manage SCCs. Contact a cluster administrator to request access.
+{{< /call-out >}}
+
+To verify that the SCC was created after installing the Helm chart, run:
+
+```shell
+oc get scc nms-restricted-v2-scc --output=yaml
+```
+
+---
+
+## Next steps
 
+- [Add NGINX Open Source and NGINX Plus instances to NGINX Instance Manager]({{< ref "nim/nginx-instances/add-instance.md" >}})
diff --git a/content/nim/deploy/kubernetes/helm-config-settings.md b/content/nim/deploy/kubernetes/helm-config-settings.md
index 83ce7682c..dd6a66d7e 100644
--- a/content/nim/deploy/kubernetes/helm-config-settings.md
+++ b/content/nim/deploy/kubernetes/helm-config-settings.md
@@ -1,95 +1,96 @@
 ---
 docs: DOCS-1112
-title: Configurable Helm settings
+title: Configurable helm settings
 toc: true
 weight: 300
-type:
+nd-content-type:
 - reference
+nd-product: NIM
 ---
 
-{{< include "/nim/decoupling/note-legacy-nms-references.md" >}}
-
 This reference guide lists the configurable Helm chart parameters and default settings for NGINX Instance Manager.
 
 ## NGINX Instance Manager Helm chart settings {#helm-settings}
 
-The following table lists the configurable parameters and default values for NGINX Instance Manager when installing from a Helm chart.
-
-To modify a configuration for an existing release, run the `helm upgrade` command and use `-f <my-values-file>`, where `<my-values-file>` is the path to a values file with your desired configuration.
-
-{{<bootstrap-table "table table-bordered table-striped table-responsive table-sm">}}
-
-| Parameter | Description | Default |
-|:-----------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------|
-| `nms-hybrid.adminPasswordHash`                        | The hashed value of the password for the admin user.<br>To generate the hash using `openssl`, run a command like: `openssl passwd -1 "YourPassword123#"` | N/A |
-| `nms-hybrid.nmsClickhouse.enabled`                    | Enable this if external ClickHouse is not used. | `true` |
-| `nms-hybrid.nmsClickhouse.fullnameOverride`           | Modify the name of ClickHouse resources. | `clickhouse` |
-| `nms-hybrid.nmsClickhouse.image.repository`           | Repository name and path for the public ClickHouse image. | `clickhouse/clickhouse-server` |
-| `nms-hybrid.nmsClickhouse.image.tag`                  | Tag used for pulling images from the registry. | `21.3.20.1-alpine` |
-| `nms-hybrid.nmsClickhouse.image.pullPolicy`           | Image pull policy. | `IfNotPresent` |
-| `nms-hybrid.nmsClickhouse.user`                       | Username to connect to the ClickHouse server. | N/A |
-| `nms-hybrid.nmsClickhouse.password`                   | Password for the ClickHouse server. | N/A |
-| `nms-hybrid.nmsClickhouse.service.name`               | ClickHouse service name. | `clickhouse` |
-| `nms-hybrid.nmsClickhouse.service.rpcPort`            | ClickHouse service port. | `9000` |
-| `nms-hybrid.nmsClickhouse.resources.requests.cpu`     | Minimum required CPU to run the ClickHouse server. | `500m` |
-| `nms-hybrid.nmsClickhouse.resources.requests.memory`  | Minimum required memory to run the ClickHouse server. | `1Gi` |
-| `nms-hybrid.nmsClickhouse.persistence.enabled`        | Use PVCs to persist ClickHouse data. | `true` |
-| `nms-hybrid.nmsClickhouse.persistence.existingClaim`  | Name of an existing Persistent Volume Claim (PVC) to use for ClickHouse persistence. | N/A |
-| `nms-hybrid.nmsClickhouse.persistence.storageClass`   | Storage class to use for creating a ClickHouse PVC. |  |
-| `nms-hybrid.nmsClickhouse.persistence.volumeName`     | Name to use for a ClickHouse PVC volume. |  |
-| `nms-hybrid.nmsClickhouse.persistence.accessMode`     | PVC access mode for ClickHouse. | `ReadWriteOnce` |
-| `nms-hybrid.nmsClickhouse.persistence.size`           | PVC size for ClickHouse. | `1G` |
-| `nms-hybrid.nmsClickhouse.tolerations`                | List of Kubernetes tolerations, if any. | See [Kubernetes taints and tolerations](#kubernetes-taints-and-tolerations) |
-| `nms-hybrid.externalClickhouse.address`               | Address of the external ClickHouse service. |  |
-| `nms-hybrid.externalClickhouse.user`                  | User of the external ClickHouse service. |  |
-| `nms-hybrid.externalClickhouse.password`              | Password of the external ClickHouse service. |  |
-| `nms-hybrid.serviceAccount.annotations`               | Set custom annotations for the service account used by NGINX Instance Manager. | `{}` |
-| `nms-hybrid.apigw.name`                               | Name used for API Gateway resources. | `apigw` |
-| `nms-hybrid.apigw.tlsSecret`                          | By default, this Helm chart creates its own Certificate Authority (CA) to self-sign HTTPS server cert key pairs. These are not managed by NGINX Instance Manager. You can bring your own NGINX API Gateway certificates for hosting the HTTPS server by setting `tlsSecret` to an existing Kubernetes secret name in the targeted namespace. The secret should include `tls.crt`, `tls.key`, and `ca.pem` in the data object. Using a self-provisioned "tlsSecret" is recommended for production.<br><br>Refer to the "Use your own certificates" section in [Frequently used Helm configurations]({{< ref "/nim/deploy/kubernetes/frequently-used-helm-configs.md#use-your-own-certificates" >}}) for an example. |  |
-| `nms-hybrid.apigw.image.repository`                   | Repository name and path for the `apigw` image. | `apigw` |
-| `nms-hybrid.apigw.image.tag`                          | Tag used for pulling images from the registry. | `latest` |
-| `nms-hybrid.apigw.image.pullPolicy`                   | Image pull policy. | `IfNotPresent` |
-| `nms-hybrid.apigw.container.port.https`               | Container HTTPS port. | `443` |
-| `nms-hybrid.apigw.service.name`                       | Service name. | `apigw` |
-| `nms-hybrid.apigw.service.type`                       | Service type (options: `ClusterIp`, `LoadBalancer`, `NodePort`). | `ClusterIp` |
-| `nms-hybrid.apigw.service.httpsPort`                  | Service HTTPS port. | `443` |
-| `nms-hybrid.apigw.resources.requests.cpu`             | Minimum required CPU to run `apigw`. | `250m` |
-| `nms-hybrid.apigw.resources.requests.memory`          | Minimum required memory to run `apigw`. | `256Mi` |
-| `nms-hybrid.apigw.tolerations`                        | List of Kubernetes tolerations, if any. | See [Kubernetes taints and tolerations](#kubernetes-taints-and-tolerations) |
-| `nms-hybrid.core.name`                                | Name used for core resources. | `core` |
-| `nms-hybrid.core.image.repository`                    | Repository name and path for the `core` image. | `core` |
-| `nms-hybrid.core.image.tag`                           | Tag used for pulling images from the registry. | `latest` |
-| `nms-hybrid.core.image.pullPolicy`                    | Image pull policy. | `IfNotPresent` |
-| `nms-hybrid.core.container.port.http`                 | Container HTTP port. | `8033` |
-| `nms-hybrid.core.container.port.db`                   | Container database port. | `7891` |
-| `nms-hybrid.core.container.port.grpc`                 | Container gRPC port. | `8038` |
-| `nms-hybrid.core.service.httpPort`                    | Service HTTP port. | `8033` |
-| `nms-hybrid.core.service.grpcPort`                    | Service gRPC port. | `8038` |
-| `nms-hybrid.core.resources.requests.cpu`              | Minimum required CPU to run `core`. | `500m` |
-| `nms-hybrid.core.resources.requests.memory`           | Minimum required memory to run `core`. | `512Mi` |
-| `nms-hybrid.core.persistence.enabled`                 | Enable persistence for `core` service. | `true` |
-| `nms-hybrid.core.persistence.claims`                  | An array of persistent volume claims for Dqlite and secrets. Can be modified to use an existing PVC. | See [Dqlite](#nim-dqlite-storage-configuration) and [Secrets](#nim-secrets-storage-configuration) |
-| `nms-hybrid.core.persistence.storageClass`            | Storage class to use for creating a `core` PVC. |  |
-| `nms-hybrid.core.persistence.volumeName`              | Name to use for a `core` PVC volume. |  |
-| `nms-hybrid.core.tolerations`                         | List of Kubernetes tolerations, if any. | See [Kubernetes taints and tolerations](#kubernetes-taints-and-tolerations) |
-| `nms-hybrid.dpm.name`                                 | Name used for `dpm`. | `dpm` |
-| `nms-hybrid.dpm.image.repository`                     | Repository name and path for the `dpm` image. | `dpm` |
-| `nms-hybrid.dpm.image.tag`                            | Tag used for pulling images from the registry. | `latest` |
-| `nms-hybrid.dpm.image.pullPolicy`                     | Image pull policy. | `IfNotPresent` |
-| `nms-hybrid.dpm.container.port.http`                  | Container HTTP port. | `8034` |
-| `nms-hybrid.dpm.container.port.nats`                  | Container NATS port. | `9100` |
-| `nms-hybrid.dpm.container.port.db`                    | Container database port. | `7890` |
-| `nms-hybrid.dpm.container.port.grpc`                  | Container gRPC port. | `8036` |
-
-{{</bootstrap-table>}}
+{{< call-out "important" "legacy chart name" >}}
+In version 2.20.0, we renamed the Helm chart from `nms-hybrid` to `nim` when we moved it to its own repository. For versions 2.19.0 and earlier, use `nms-hybrid` instead of `nim` in each parameter name.
+{{< /call-out >}}
+
+To update an existing release, run `helm upgrade` with the `-f <my-values-file>` flag, where `<my-values-file>` is the path to your values file.
+
+{{< bootstrap-table "table table-bordered table-striped table-responsive table-sm" >}}
+
+| Parameter                                   | Description                                                                                                                                                                                                                                                         | Default    |
+|:--------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------|
+| `nim.adminPasswordHash`                     | The hashed value of the password for the admin user.<br>To generate a hash using OpenSSL, run `openssl passwd -1 "YourPassword123#"`                                                                                                                               | N/A        |
+| `nim.nmsClickhouse.mode`                    | Controls ClickHouse deployment:<br>- `internal` (default, in-cluster)<br>- `external` (requires `nim.externalClickhouse.address`)<br>- `disabled` (lightweight mode). Available in the `nim` chart 2.20.0 and later.                                                 | `internal` |
+| `nms-hybrid.nmsClickhouse.enabled`          | (legacy, available in `nms-hybrid` chart 2.19.0 and earlier) Enable ClickHouse when using the legacy chart.                                                                                                                                                          | `true`     |
+| `nim.nmsClickhouse.fullnameOverride`        | Modify the name of ClickHouse resources.                                                                                                                                                                                                                            | `clickhouse` |
+| `nim.nmsClickhouse.image.repository`        | Repository path for the public ClickHouse image.                                                                                                                                                                                                                    | `clickhouse/clickhouse-server` |
+| `nim.nmsClickhouse.image.tag`               | Tag used for pulling ClickHouse images from the registry.                                                                                                                                                                                                           | `21.3.20.1-alpine` |
+| `nim.nmsClickhouse.image.pullPolicy`        | Image pull policy.                                                                                                                                                                                                                                                   | `IfNotPresent` |
+| `nim.nmsClickhouse.user`                    | Username for the ClickHouse server.                                                                                                                                                                                                                                  | N/A        |
+| `nim.nmsClickhouse.password`                | Password for the ClickHouse server.                                                                                                                                                                                                                                  | N/A        |
+| `nim.nmsClickhouse.service.name`            | ClickHouse service name.                                                                                                                                                                                                                                             | `clickhouse` |
+| `nim.nmsClickhouse.service.rpcPort`         | ClickHouse service port.                                                                                                                                                                                                                                             | `9000`     |
+| `nim.nmsClickhouse.resources.requests.cpu`  | Minimum required CPU to run the ClickHouse server.                                                                                                                                                                                                                   | `500m`     |
+| `nim.nmsClickhouse.resources.requests.memory` | Minimum required memory to run the ClickHouse server.                                                                                                                                                                                                               | `1Gi`      |
+| `nim.nmsClickhouse.persistence.enabled`     | Use a PVC to persist ClickHouse data.                                                                                                                                                                                                                                | `true`     |
+| `nim.nmsClickhouse.persistence.existingClaim` | Name of an existing PVC to use for ClickHouse persistence.                                                                                                                                                                                                             | N/A        |
+| `nim.nmsClickhouse.persistence.storageClass` | Storage class for creating a ClickHouse PVC.                                                                                                                                                                                                                         |            |
+| `nim.nmsClickhouse.persistence.volumeName`  | Name to use for a ClickHouse PVC volume.                                                                                                                                                                                                                             |            |
+| `nim.nmsClickhouse.persistence.accessMode`  | PVC access mode for ClickHouse.                                                                                                                                                                                                                                       | `ReadWriteOnce` |
+| `nim.nmsClickhouse.persistence.size`        | PVC size for ClickHouse.                                                                                                                                                                                                                                              | `1G`       |
+| `nim.nmsClickhouse.tolerations`             | List of Kubernetes tolerations if any.                                                                                                                                                                                                                                | See [Kubernetes taints and tolerations](#kubernetes-taints-and-tolerations) |
+| `nim.externalClickhouse.address`            | Address of the external ClickHouse service.                                                                                                                                                                                                                           |            |
+| `nim.externalClickhouse.user`               | User for the external ClickHouse service.                                                                                                                                                                                                                            |            |
+| `nim.externalClickhouse.password`           | Password for the external ClickHouse service.                                                                                                                                                                                                                        |            |
+| `nim.serviceAccount.annotations`            | Set custom annotations for the service account used by NGINX Instance Manager.                                                                                                                                                                                         | `{}`       |
+| `nim.apigw.name`                            | Name for API Gateway resources.                                                                                                                                                                                                                                       | `apigw`    |
+| `nim.apigw.tlsSecret`                       | By default, the chart creates its own CA to self-sign HTTPS server certs. To bring your own certificates, set `tlsSecret` to an existing Kubernetes secret in the target namespace. The secret must include `tls.crt`, `tls.key`, and `ca.pem`. See [Use your own certificates]({{< ref "/nim/deploy/kubernetes/frequently-used-helm-configs.md#use-your-own-certificates" >}}). |            |
+| `nim.apigw.image.repository`                | Repository path for the `apigw` image.                                                                                                                                                                                                                                 | `apigw`    |
+| `nim.apigw.image.tag`                       | Tag used for pulling `apigw` images.                                                                                                                                                                                                                                  | `latest`   |
+| `nim.apigw.image.pullPolicy`                | Image pull policy.                                                                                                                                                                                                                                                     | `IfNotPresent` |
+| `nim.apigw.container.port.https`            | Container HTTPS port.                                                                                                                                                                                                                                                  | `443`      |
+| `nim.apigw.service.name`                    | Service name.                                                                                                                                                                                                                                                          | `apigw`    |
+| `nim.apigw.service.type`                    | Service type (`ClusterIp`, `LoadBalancer`, `NodePort`).                                                                                                                                                                                                               | `ClusterIp` |
+| `nim.apigw.service.httpsPort`               | Service HTTPS port.                                                                                                                                                                                                                                                    | `443`      |
+| `nim.apigw.resources.requests.cpu`          | Minimum required CPU to run `apigw`.                                                                                                                                                                                                                                   | `250m`     |
+| `nim.apigw.resources.requests.memory`       | Minimum required memory to run `apigw`.                                                                                                                                                                                                                                | `256Mi`    |
+| `nim.apigw.tolerations`                     | List of Kubernetes tolerations if any.                                                                                                                                                                                                                                | See [Kubernetes taints and tolerations](#kubernetes-taints-and-tolerations) |
+| `nim.core.name`                             | Name for core resources.                                                                                                                                                                                                                                               | `core`     |
+| `nim.core.image.repository`                 | Repository path for the `core` image.                                                                                                                                                                                                                                   | `core`     |
+| `nim.core.image.tag`                        | Tag used for pulling `core` images.                                                                                                                                                                                                                                     | `latest`   |
+| `nim.core.image.pullPolicy`                 | Image pull policy.                                                                                                                                                                                                                                                     | `IfNotPresent` |
+| `nim.core.container.port.http`              | Container HTTP port.                                                                                                                                                                                                                                                    | `8033`     |
+| `nim.core.container.port.db`                | Container database port.                                                                                                                                                                                                                                               | `7891`     |
+| `nim.core.container.port.grpc`              | Container gRPC port.                                                                                                                                                                                                                                                                                                     | `8038`   |
+| `nim.core.service.httpPort`                 | Service HTTP port.                                                                                                                                                                                                                                                      | `8033`                 |
+| `nim.core.service.grpcPort`                 | Service gRPC port.                                                                                                                                                                                                                                                                                                     | `8038`   |
+| `nim.core.resources.requests.cpu`           | Minimum required CPU to run `core`.                                                                                                                                                                                                                                      | `500m`     |
+| `nim.core.resources.requests.memory`        | Minimum required memory to run `core`.                                                                                                                                                                                                                                   | `512Mi`    |
+| `nim.core.persistence.enabled`              | Enable persistence for `core`.                                                                                                                                                                                                                                          | `true`     |
+| `nim.core.persistence.claims`               | Array of PVCs for Dqlite and secrets. Modify to use an existing PVC.                                                                                                                                                                                                     | See [Dqlite storage](#nim-dqlite-storage-configuration) and [Secrets storage](#nim-secrets-storage-configuration) |
+| `nim.core.persistence.storageClass`         | Storage class for creating a `core` PVC.                                                                                                                                                                                                                                 |            |
+| `nim.core.persistence.volumeName`           | Name for a `core` PVC volume.                                                                                                                                                                                                                                            |            |
+| `nim.core.tolerations`                      | List of Kubernetes tolerations if any.                                                                                                                                                                                                                                   | See [Kubernetes taints and tolerations](#kubernetes-taints-and-tolerations) |
+| `nim.dpm.name`                              | Name for `dpm` resources.                                                                                                                                                                                                                                                | `dpm`      |
+| `nim.dpm.image.repository`                  | Repository path for the `dpm` image.                                                                                                                                                                                                                                      | `dpm`      |
+| `nim.dpm.image.tag`                         | Tag used for pulling `dpm` images.                                                                                                                                                                                                                                        | `latest`   |
+| `nim.dpm.image.pullPolicy`                  | Image pull policy.                                                                                                                                                                                                                                                                                                     | `IfNotPresent`|   
+| `nim.dpm.container.port.http`               | Container HTTP port.                                                                                                                                                                                                                                                      | `8034`     |
+| `nim.dpm.container.port.nats`               | Container NATS port.                                                                                                                                                                                                                                                      | `9100`     |
+| `nim.dpm.container.port.db`                 | Container database port.                                                                                                                                                                                                                                                  | `7890`     |
+| `nim.dpm.container.port.grpc`               | Container gRPC port.                                                                                                                                                                                                                                                      | `8036`     |
+{{</ bootstrap-table >}}
 
 ## NGINX Instance Manager dqlite storage configuration
 
 ```yaml
-  - name: dqlite
-    existingClaim:
-    size: 500Mi
-    accessMode: ReadWriteOnce
+- name: dqlite
+  existingClaim:
+  size: 500Mi
+  accessMode: ReadWriteOnce
 ```
 
 ## NGINX Instance Manager secrets storage configuration
@@ -112,7 +113,7 @@ To modify a configuration for an existing release, run the `helm upgrade` comman
 
 ## Kubernetes taints and tolerations
 
-The following example snippet shows a toleration for an NGINX Instance Manager API Gateway deployment. In this example, Kubernetes will tolerate the "NoExecute" effect for 60 seconds before evicting the pod from the tainted node.
+This example shows how to set the API Gateway pod to wait 60 seconds when Kubernetes applies the NoExecute taint (which marks a node as unschedulable) before it removes the pod.
 
 ```yaml
 tolerations:
diff --git a/content/nim/deploy/vm-bare-metal/install-nim-deprecated.md b/content/nim/deploy/vm-bare-metal/install-nim-deprecated.md
deleted file mode 100644
index d5af56dd0..000000000
--- a/content/nim/deploy/vm-bare-metal/install-nim-deprecated.md
+++ /dev/null
@@ -1,315 +0,0 @@
----
-description: ''
-docs: DOCS-1211
-title: Manually install on a virtual machine or bare metal (deprecated)
-toc: true
-weight: 10
-noindex: true
-type:
-- tutorial
----
-
-## Overview
-
-Follow the steps in this guide to install or upgrade NGINX Instance Manager.
-
-{{<call-out "caution" "Deprecated documentation notice" "fa fa-exclamation-triangle" >}}
-This document outlines manual steps that have been replaced by a simplified script-based process. For most users, we recommend using the updated process documented [here]({{< ref "nim/deploy/vm-bare-metal/install.md" >}}).{{</call-out>}}
-
-## Before You Begin
-
-### Security Considerations
-
-{{< include "installation/secure-installation.md" >}}
-
-### Requirements {#requirements}
-
-To install NGINX Instance Manager, you need the following:
-
-- A trial or paid subscription for NGINX Instance Manager. [Sign up for NGINX Instance Manager at MyF5](https://account.f5.com/myf5).
-- A Linux instance to host the NGINX Instance Manager platform and modules
-- [NGINX Plus or NGINX OSS](#install-nginx) installed on the instance hosting NGINX Instance Manager
-
-Allow external systems access by opening network firewalls. NGINX Instance Manager uses port `443` for both gRPC and API/web interfaces.
-
----
-
-## Download Certificate and Key {#download-cert-key}
-
-Follow these steps to download the certificate and private key for NGINX Instance Manager. You'll need these files when adding the official repository for installing NGINX Instance Manager. You can also use the certificate and key when installing NGINX Plus.
-
-1. On the host where you're installing NGINX Instance Manager, create the `/etc/ssl/nginx/` directory:
-
-   ``` bash
-   sudo mkdir -p /etc/ssl/nginx
-   ```
-
-2. Download the NGINX Instance Manager `.crt` and `.key` files from [MyF5](https://account.f5.com/myf5) or follow the download link in your  trial activation email.
-
-3. Move and rename the `.crt` and `.key` files:
-
-   ```bash
-   sudo mv <nginx-mgmt-suite-trial.crt> /etc/ssl/nginx/nginx-repo.crt
-   sudo mv <nginx-mgmt-suite-trial.key> /etc/ssl/nginx/nginx-repo.key
-   ```
-
-   {{<note>}}The downloaded filenames may vary depending on your subscription type. Modify the commands above accordingly to match the actual filenames.{{</note>}}
-
----
-
-## Install NGINX {#install-nginx}
-
-Install NGINX Open Source or NGINX Plus on the host where you'll install NGINX Instance Manager. NGINX Instance Manager uses NGINX as a front-end proxy and for managing user access.
-
-- [Installing NGINX and NGINX Plus](https://docs.nginx.com/nginx/admin-guide/installing-nginx/)
-
-   {{<note>}}If you're installing NGINX Plus, you can use the `nginx-repo.key` and `nginx-repo.crt` that you added in the [previous section](#download-cert-key).{{</note>}}
-
-<details open>
-<summary><i class="fa-solid fa-circle-info"></i> Supported NGINX versions</summary>
-
-{{< include "nim/tech-specs/supported-nginx-versions.md" >}}
-
-</details>
-
-<details open>
-<summary><i class="fa-solid fa-circle-info"></i> Supported Linux distributions</summary>
-
-{{< include "nim/tech-specs/supported-distros.md" >}}
-
-</details>
-
-{{<see-also>}}Make sure to review the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs" >}}) guide for sizing requirements and other recommended specs.{{</see-also>}}
-
----
-
-## Install ClickHouse {#install-clickhouse}
-
-{{<note>}}NGINX Instance Manager requires ClickHouse 22.3.15.33 or later.{{</note>}}
-
-NGINX Instance Manager uses [ClickHouse](https://clickhouse.com) to store metrics, events, and alerts, as well as configuration settings.
-
-Select the tab for your Linux distribution, then follow the instructions to install ClickHouse.
-
-{{<tabs name="clickhouse">}}
-
-{{%tab name="CentOS, RHEL, RPM-Based"%}}
-
-To install and enable ClickHouse CentOS, RHEL, and RPM-Based distributions, take the following steps:
-
-1. Set up the repository:
-
-    ``` bash
-    sudo yum install -y yum-utils
-    sudo yum-config-manager --add-repo https://packages.clickhouse.com/rpm/clickhouse.repo
-    ```
-
-1. Install the ClickHouse server and client:
-
-    ```bash
-    sudo yum install -y clickhouse-server clickhouse-client
-    ```
-
-    > <span style="color: #c20025;"><i class="fas fa-exclamation-triangle"></i> **IMPORTANT!**</span> When installing ClickHouse, you have the option to specify a password or leave the password blank (the default is an empty string). If you choose to specify a password for ClickHouse, you must also edit the `/etc/nms/nms.conf` file after installing NGINX Instance Manager and enter your ClickHouse password; otherwise, NGINX Instance Manager won't start.
-    >
-    > For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}) topic.
-
-1. Enable ClickHouse so that it starts automatically if the server is restarted:
-
-    ```bash
-    sudo systemctl enable clickhouse-server
-    ```
-
-1. Start the ClickHouse server:
-
-    ```bash
-    sudo systemctl start clickhouse-server
-    ```
-
-1. Verify ClickHouse is running:
-
-    ```bash
-    sudo systemctl status clickhouse-server
-    ```
-
-{{%/tab%}}
-
-{{%tab name="Debian, Ubuntu, Deb-Based"%}}
-
-To install and enable ClickHouse on Debian, Ubuntu, and Deb-Based distributions, take the following steps:
-
-1. Set up the repository:
-
-   ```bash
-   sudo apt-get install -y apt-transport-https ca-certificates dirmngr
-   GNUPGHOME=$(mktemp -d)
-   sudo GNUPGHOME="$GNUPGHOME" gpg --no-default-keyring --keyring /usr/share/keyrings/clickhouse-keyring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 8919F6BD2B48D754
-   sudo rm -r "$GNUPGHOME"
-   sudo chmod +r /usr/share/keyrings/clickhouse-keyring.gpg
-
-   echo "deb [signed-by=/usr/share/keyrings/clickhouse-keyring.gpg] https://packages.clickhouse.com/deb lts main" | sudo tee /etc/apt/sources.list.d/clickhouse.list
-   sudo apt-get update
-   ```
-
-1. Install the ClickHouse server and client:
-
-    ``` bash
-    sudo apt-get install -y clickhouse-server clickhouse-client
-    ```
-
-    > <span style="color: #c20025;"><i class="fas fa-exclamation-triangle"></i> **IMPORTANT!**</span> When installing ClickHouse, you have the option to specify a password or leave the password blank (the default is an empty string). If you choose to specify a password for ClickHouse, you must also edit the `/etc/nms/nms.conf` file after installing NGINX Instance Manager and enter your ClickHouse password; otherwise, NGINX Instance Manager won't start.
-    >
-    > For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}) topic.
-
-1. Enable ClickHouse so that it starts automatically if the server is restarted:
-
-    ```bash
-    sudo systemctl enable clickhouse-server
-    ```
-
-1. Start the ClickHouse server:
-
-    ``` bash
-    sudo systemctl start clickhouse-server
-    ```
-
-1. Verify ClickHouse is running:
-
-    ```bash
-    sudo systemctl status clickhouse-server
-    ```
-
-{{%/tab%}}
-
-{{</tabs>}}
-
-### ClickHouse Default Settings
-
-NGINX Instance Manager uses the following default values for ClickHouse:
-
-{{<important>}}You can customize these settings. However, if you use custom settings, make sure to follow the [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}) instructions to update the `nms.conf` file after you've installed NGINX Instance Manager; otherwise NGINX Instance Manager won't be able to connect to ClickHouse.{{</important>}}
-
-{{< include "installation/clickhouse-defaults.md" >}}
-
----
-
-## (Optional) Install and Configure Vault {#install-vault}
-
-NGINX Instance Manager can use [Vault](https://www.vaultproject.io/) as a datastore for secrets.
-
-To install and enable Vault, take the following steps:
-
-- Follow Vault's instructions to [install Vault 1.8.8 or later](https://www.vaultproject.io/docs/install) for your distribution.
-- Ensure you are running Vault in a [Production Hardened Environment](https://learn.hashicorp.com/tutorials/vault/production-hardening).
-- After installing NGINX Instance Manager, follow the steps to [Configure Vault for Storing Secrets]({{< ref "nim/system-configuration/configure-vault.md" >}}).
-
----
-
-## Add NGINX Instance Manager Repository {#add-nms-repo}
-
-To install NGINX Instance Manager, you need to add the official repository to pull the pre-compiled `deb` and `rpm` packages from.
-
-{{< include "installation/add-nms-repo.md" >}}
-
----
-
-## Install Instance Manager
-
-{{<tabs name="install-nim">}}
-
-{{%tab name="CentOS, RHEL, RPM-Based"%}}
-
-1. To install the latest version of Instance Manager, run the following command:
-
-    ```bash
-    sudo yum install -y nms-instance-manager
-    ```
-
-    > <span style="color: #c20025;"><i class="fas fa-exclamation-triangle"></i> **IMPORTANT!**</span> The Instance Manager's administrator username (default is `admin`) and generated password are displayed in the terminal during installation. You should make a note of the password and store it securely.
-
-{{%/tab%}}
-
-{{%tab name="Debian, Ubuntu, Deb-Based"%}}
-
-1. To install the latest version of Instance Manager, run the following commands:
-
-    ```bash
-    sudo apt-get update
-    sudo apt-get install -y nms-instance-manager
-    ```
-
-    > <span style="color: #c20025;"><i class="fas fa-exclamation-triangle"></i> **IMPORTANT!**</span> The Instance Manager's administrator username (default is `admin`) and generated password are displayed in the terminal during installation. You should make a note of the password and store it securely.
-
-{{%/tab%}}
-
-{{</tabs>}}
-
-2. Enable and start the NGINX Instance Manager platform services:
-
-    ```bash
-    sudo systemctl enable nms nms-core nms-dpm nms-ingestion nms-integrations --now
-    ```
-
-    NGINX Instance Manager components started this way run by default as the non-root `nms` user inside the `nms` group, both of which are created during installation.
-
-3. Restart the NGINX web server:
-
-   ```bash
-   sudo systemctl restart nginx
-   ```
-
-### Post-Installation Steps
-
-{{< include "installation/optional-installation-steps.md" >}}
-
-### Accessing the Web Interface
-
-{{< include "installation/access-web-ui.md" >}}
-
-
-### Add License
-
-{{< include "nim/admin-guide/license/connected-install-license-note.md" >}}
-
----
-
-## Upgrade Instance Manager {#upgrade-nim}
-
-{{<tabs name="upgrade_nim">}}
-{{%tab name="CentOS, RHEL, RPM-Based"%}}
-
-1. To upgrade to the latest version of the Instance Manager, run the following command:
-
-   ```bash
-   sudo yum update -y nms-instance-manager
-   ```
-
-{{%/tab%}}
-
-{{%tab name="Debian, Ubuntu, Deb-Based"%}}
-
-1. To upgrade to the latest version of the Instance Manager, run the following command:
-
-   ```bash
-   sudo apt-get update
-   sudo apt-get install -y --only-upgrade nms-instance-manager
-   ```
-
-{{%/tab%}}
-{{</tabs>}}
-
-2. Restart the NGINX Instance Manager platform services:
-
-    ```bash
-    sudo systemctl restart nms
-    ```
-
-    NGINX Instance Manager components started this way run by default as the non-root `nms` user inside the `nms` group, both of which are created during installation.
-
-3. Restart the NGINX web server:
-
-   ```bash
-   sudo systemctl restart nginx
-   ```
-
-4. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Management suite.
diff --git a/content/nim/deploy/vm-bare-metal/install-nim-manual.md b/content/nim/deploy/vm-bare-metal/install-nim-manual.md
new file mode 100644
index 000000000..fa8f6df42
--- /dev/null
+++ b/content/nim/deploy/vm-bare-metal/install-nim-manual.md
@@ -0,0 +1,233 @@
+---
+description: ''
+docs: DOCS-1211
+title: Manually install any version of NGINX Instance Manager
+toc: true
+weight: 10
+noindex: true
+type:
+- tutorial
+---
+
+## Overview
+
+Follow the steps in this guide to install or upgrade a specific version of NGINX Instance Manager.
+
+## Before You Begin
+
+### Security Considerations
+
+{{< include "installation/secure-installation.md" >}}
+
+### Requirements {#requirements}
+
+To install NGINX Instance Manager, you need the following:
+
+- A trial or paid subscription for NGINX Instance Manager. [Sign up for NGINX Instance Manager at MyF5](https://account.f5.com/myf5).
+- A Linux instance to host the NGINX Instance Manager platform and modules
+- [NGINX Plus or NGINX OSS](#install-nginx) installed on the instance hosting NGINX Instance Manager
+
+Allow external systems access by opening network firewalls. NGINX Instance Manager uses port `443` for both gRPC and API/web interfaces.
+
+---
+
+## Download Certificate and Key {#download-cert-key}
+
+Follow these steps to download the certificate and private key for NGINX Instance Manager. You'll need these files when adding the official repository for installing NGINX Instance Manager. You can also use the certificate and key when installing NGINX Plus.
+
+1. On the host where you're installing NGINX Instance Manager, create the `/etc/ssl/nginx/` directory:
+
+   ``` bash
+   sudo mkdir -p /etc/ssl/nginx
+   ```
+
+2. Download the NGINX Instance Manager `.crt` and `.key` files from [MyF5](https://account.f5.com/myf5) or follow the download link in your  trial activation email.
+
+3. Move and rename the `.crt` and `.key` files:
+
+   ```bash
+   sudo mv <nginx-mgmt-suite-trial.crt> /etc/ssl/nginx/nginx-repo.crt
+   sudo mv <nginx-mgmt-suite-trial.key> /etc/ssl/nginx/nginx-repo.key
+   ```
+
+   The downloaded filenames may vary depending on your subscription type. Modify the commands above accordingly to match the actual filenames.
+
+---
+
+## Install NGINX {#install-nginx}
+
+Install NGINX Open Source or NGINX Plus on the host where you'll install NGINX Instance Manager. NGINX Instance Manager uses NGINX as a front-end proxy and for managing user access.
+
+- [Installing NGINX and NGINX Plus](https://docs.nginx.com/nginx/admin-guide/installing-nginx/)
+
+   <br>
+
+   If you're installing NGINX Plus, you can use the `nginx-repo.key` and `nginx-repo.crt` that you added in the [previous section](#download-cert-key).
+
+<details open>
+<summary><i class="fa-solid fa-circle-info"></i> Supported NGINX versions</summary>
+
+{{< include "nim/tech-specs/supported-nginx-versions.md" >}}
+
+</details>
+
+<details open>
+<summary><i class="fa-solid fa-circle-info"></i> Supported Linux distributions</summary>
+
+{{< include "nim/tech-specs/supported-distros.md" >}}
+
+</details>
+
+Make sure to review the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs" >}}) guide for sizing requirements and other recommended specs.
+
+---
+
+## Configure metrics collection
+
+### Disable metrics collection
+
+NGINX Instance Manager uses ClickHouse to store metrics, events, alerts, and configuration data.
+
+In 2.20.0, we introduced Lightweight mode, which can skip the ClickHouse installation entirely. It’s ideal if you don’t need monitoring data or want a simpler setup. This reduces system requirements and avoids the work of managing a metrics database. You can add ClickHouse later if your needs change.
+
+If you don’t need to store metrics, you can skip installing ClickHouse. But you must use NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}, and you must disable metrics collection in the `/etc/nms/nms.conf` file.
+
+For instructions, see [Disable metrics collection]({{< ref "nim/system-configuration/configure-clickhouse.md#disable-metrics-collection" >}}).
+
+### Install ClickHouse to enable metrics
+
+{{< include "nim/clickhouse/clickhouse-install.md" >}}
+
+#### ClickHouse Default Settings
+
+NGINX Instance Manager uses the following default values for ClickHouse. To change these values, see the [Configure ClickHouse](nim/system-configuration/configure-clickhouse.md) guide.
+
+{{< include "nim/clickhouse/clickhouse-defaults.md" >}}
+
+---
+
+## Add NGINX Instance Manager Repository {#add-nms-repo}
+
+To install NGINX Instance Manager, you need to add the official repository to pull the pre-compiled `deb` and `rpm` packages from.
+
+{{< include "installation/add-nms-repo.md" >}}
+
+---
+
+## Install Instance Manager
+
+{{<tabs name="install-nim">}}
+
+{{%tab name="CentOS, RHEL, RPM-Based"%}}
+
+1. To install the latest version of Instance Manager, run the following command:
+
+    ```bash
+    sudo yum install -y nms-instance-manager
+    ```
+
+    > <span style="color: #c20025;"><i class="fas fa-exclamation-triangle"></i> **IMPORTANT!**</span> The Instance Manager's administrator username (default is `admin`) and generated password are displayed in the terminal during installation. You should make a note of the password and store it securely.
+
+{{%/tab%}}
+
+{{%tab name="Debian, Ubuntu, Deb-Based"%}}
+
+1. To install the latest version of Instance Manager, run the following commands:
+
+    ```bash
+    sudo apt-get update
+    sudo apt-get install -y nms-instance-manager
+    ```
+
+    > <span style="color: #c20025;"><i class="fas fa-exclamation-triangle"></i> **IMPORTANT!**</span> The Instance Manager's administrator username (default is `admin`) and generated password are displayed in the terminal during installation. You should make a note of the password and store it securely.
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+2. Enable and start the NGINX Instance Manager platform services:
+
+    ```bash
+    sudo systemctl enable nms nms-core nms-dpm nms-ingestion nms-integrations --now
+    ```
+
+    NGINX Instance Manager components started this way run by default as the non-root `nms` user inside the `nms` group, both of which are created during installation.
+
+3. Restart the NGINX web server:
+
+   ```bash
+   sudo systemctl restart nginx
+   ```
+
+## Optional post-installation steps
+
+### Configure ClickHouse
+
+{{< include "nim/installation/optional-steps/configure-clickhouse.md" >}}
+
+### Install and configure Vault {#install-vault}
+
+{{< include "nim/installation/optional-steps/install-configure-vault.md" >}}
+
+
+### Configure SELinux
+
+{{< include "nim/installation/optional-steps/configure-selinux.md" >}}
+
+## Accessing the Web Interface
+
+{{< include "installation/access-web-ui.md" >}}
+
+
+## Add License
+
+{{< include "nim/admin-guide/license/connected-install-license-note.md" >}}
+
+---
+
+## Upgrade Instance Manager {#upgrade-nim}
+
+{{<tabs name="upgrade_nim">}}
+{{%tab name="CentOS, RHEL, RPM-Based"%}}
+
+1. To upgrade to the latest version of the Instance Manager, run the following command:
+
+   ```bash
+   sudo yum update -y nms-instance-manager
+   ```
+
+{{%/tab%}}
+
+{{%tab name="Debian, Ubuntu, Deb-Based"%}}
+
+1. To upgrade to the latest version of the Instance Manager, run the following command:
+
+   ```bash
+   sudo apt-get update
+   sudo apt-get install -y --only-upgrade nms-instance-manager
+   ```
+
+{{%/tab%}}
+{{</tabs>}}
+
+2. Restart the NGINX Instance Manager platform services:
+
+    ```bash
+    sudo systemctl restart nms
+    ```
+
+    NGINX Instance Manager components started this way run by default as the non-root `nms` user inside the `nms` group, both of which are created during installation.
+
+3. Restart the NGINX web server:
+
+   ```bash
+   sudo systemctl restart nginx
+   ```
+
+4. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Management suite.
+
+---
+
+## Next steps
+
+- [Add NGINX Open Source and NGINX Plus instances to NGINX Instance Manager]({{< ref "nim/nginx-instances/add-instance.md" >}})
diff --git a/content/nim/deploy/vm-bare-metal/install.md b/content/nim/deploy/vm-bare-metal/install.md
index 8e4a1ae44..5e7dea31b 100644
--- a/content/nim/deploy/vm-bare-metal/install.md
+++ b/content/nim/deploy/vm-bare-metal/install.md
@@ -1,7 +1,7 @@
 ---
 description: ''
 docs: DOCS-1211
-title: Install on a virtual machine or bare metal using a script
+title: Install the latest NGINX Instance Manager with a script
 toc: true
 weight: 10
 type:
@@ -12,9 +12,16 @@ type:
 
 ## Overview
 
-This guide explains how to install F5 NGINX Instance Manager on a virtual machine or bare metal system using the `install-nim-bundle.sh` script.
+This guide shows you how to install and upgrade F5 NGINX Instance Manager on a virtual machine or bare metal system using the installation script in online mode.
 
-The script simplifies the installation by automating tasks such as verifying system requirements, configuring services, and managing environment-specific options. For more control or an alternative approach, you can refer to the [manual installation guide]({{< ref "nim/deploy/vm-bare-metal/install-nim-deprecated.md" >}}), which provides detailed, step-by-step instructions.
+The script installs:
+
+- The latest version of NGINX Open Source
+- The latest version of NGINX Instance Manager
+- ClickHouse by default, unless you choose to skip it
+- Optionally, NGINX Plus (requires a license and additional flags)
+
+The script also installs all required operating system packages automatically. If you need to install earlier versions of NGINX or NGINX Instance Manager, follow the [manual installation process](({{< ref "nim/deploy/vm-bare-metal/install-nim-manual.md" >}})) instead.
 
 ---
 
@@ -22,6 +29,10 @@ The script simplifies the installation by automating tasks such as verifying sys
 
 Follow these steps to prepare for installing NGINX Instance Manager:
 
+- **Download the installation script**:
+
+  {{<fa "download">}} {{<link "/scripts/install-nim-bundle.sh" "Download install-nim-bundle.sh script">}}
+
 - **Download the certificate and private key** (see the steps [below](#download-cert-key)):
   Use the certificate and private key for NGINX Instance Manager (the same files used for NGINX Plus).
   - Ensure the files have `.crt` and `.key` extensions.
@@ -31,43 +42,28 @@ Follow these steps to prepare for installing NGINX Instance Manager:
 
 - **Check for previous deployments**:
   Ensure that NGINX Instance Manager and its components are not already installed.
-  - If NGINX Instance Manager or its components (such as ClickHouse or NGINX) are detected, either follow the [upgrade instructions](#upgrade-nim) to update them or [manually remove the components](#uninstall-nim) before proceeding with the installation.
-
-- **Record the version details**:
-  Note the current version of NGINX Instance Manager and confirm the supported version of NGINX OSS or NGINX Plus you intend to use.
-  - By default, the script installs the latest version.
+  
+  If NGINX Instance Manager or its components (such as ClickHouse or NGINX) are detected, either follow the [upgrade instructions](#upgrade-nim) to update them or [manually remove the components](#uninstall-nim) before proceeding with the installation.
 
 - **(Optional) Install and configure Vault**:
   If you plan to use Vault, set it up before proceeding.
 
-### Security considerations
-
-To ensure that your NGINX Instance Manager deployment remains secure, follow these recommendations:
-
-- Install NGINX Instance Manager on a dedicated machine (bare metal, container, cloud, or VM).
-- Ensure that no other services are running on the same machine.
-
----
-
-## Requirements
-
 ### Supported NGINX versions and Linux distributions
 
-<details open>
-<summary><i class="fa-solid fa-circle-info"></i> Supported NGINX versions</summary>
-
-{{< include "nim/tech-specs/supported-nginx-versions.md" >}}
+The installation script installs the latest version of [NGINX Open Source](https://nginx.org/news.html) or [NGINX Plus](https://docs.nginx.com/nginx/releases/).
 
-</details>
+To see the list of supported distributions, run:
 
-<details open>
-<summary><i class="fa-solid fa-circle-info"></i> Supported Linux distributions</summary>
-
-{{< include "nim/tech-specs/supported-distros.md" >}}
+```shell
+grep '\-d distribution' install-nim-bundle.sh
+```
 
-</details>
+### Security considerations
 
+To ensure that your NGINX Instance Manager deployment remains secure, follow these recommendations:
 
+- Install NGINX Instance Manager on a dedicated machine (bare metal, container, cloud, or VM).
+- Ensure that no other services are running on the same machine.
 
 ---
 
@@ -77,7 +73,7 @@ Download the certificate and private key required for NGINX Instance Manager. Th
 
 1. On the host where you're installing NGINX Instance Manager, create the **/etc/ssl/nginx/** directory:
 
-    ```bash
+    ```shell
     sudo mkdir -p /etc/ssl/nginx
     ```
 
@@ -85,16 +81,16 @@ Download the certificate and private key required for NGINX Instance Manager. Th
 
 3. Move and rename the cert and key files to the correct directory:
 
-    ```bash
+    ```shell
     sudo mv nginx-<subscription id>.crt /etc/ssl/nginx/nginx-repo.crt
     sudo mv nginx-<subscription id>.key /etc/ssl/nginx/nginx-repo.key
     ```
 
 ---
 
-## Download and run the installation script {#download-install}
+## Prepare the system and run the installation script {#download-install}
 
-Download the `install-nim-bundle.sh` script:
+If you haven’t already downloaded the script, you can download it here:
 
 {{<fa "download">}} {{<link "/scripts/install-nim-bundle.sh" "Download install-nim-bundle.sh script">}}
 
@@ -116,66 +112,75 @@ The script supports only new installations. If NGINX Instance Manager is already
 
 Ensure that the required `.crt` and `.key` files are available, preferably in the default **/etc/ssl/nginx** directory. Missing certificates or keys will prevent the script from completing the installation.
 
+#### Verify If Metrics Are Required (Exclude ClickHouse)
+
+In 2.20.0, we introduced Lightweight mode, which means you can skip the ClickHouse installation entirely. It’s ideal if you don’t need monitoring data or want a simpler setup. This reduces system requirements and avoids the work of managing a metrics database. You can add ClickHouse later if your needs change.
+
 #### Use the manual installation steps if needed
 
-If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< ref "nim/deploy/vm-bare-metal/install-nim-deprecated.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups.
+If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< ref "nim/deploy/vm-bare-metal/install-nim-manual.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups.
 
 ### Run the installation script
 
-The `install-nim-bundle.sh` script automates the installation of NGINX Instance Manager. By default, the script:
-
-- Assumes no prior installation of NGINX Instance Manager or its dependencies and performs a fresh installation.
-- Reads SSL files from the `/etc/ssl/nginx` directory.
-- Installs the latest version of NGINX Open Source (OSS).
-- Installs the ClickHouse database.
-- Installs NGINX Instance Manager.
-- Requires an active internet connection.
+The `install-nim-bundle.sh` script automates installing NGINX Instance Manager. 
 
-{{< warning >}}
+By default, the script:
 
-As noted in [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md#apply-the-jwt" >}}), **custom paths won't work until you upgrade to NGINX Plus R33**.
+- Assumes no prior installation of NGINX Instance Manager or its dependencies
+- Reads SSL files from the `/etc/ssl/nginx` directory
+- Installs the latest version of NGINX Open Source (OSS)
+- Installs the ClickHouse database
+- Installs the latest version of NGINX Instance Manager
+- Requires an active internet connection
 
-{{< /warning >}}
+#### Installation script options
 
-When you run the script, it downloads and installs NGINX Instance Manager.
+You can customize the installation using the following options:
 
-If you want to use the script with non-default options, use these switches:
 
-- To point to a repository key stored in a directory other than **/etc/ssl/nginx**: `-k /path/to/your/<nginx-repo.key>` file
-- To point to a repository certificate stored in a directory other than **/etc/ssl/nginx**: `-c /path/to/your/<nginx-repo.crt>` file
-- To install NGINX Plus (instead of NGINX OSS): `-p <nginx_plus_version>  -j /path/to/license.jwt`
+| Category | Option or Flag |
+|----------|----------------|
+| **Installation platform** | {{< include "nim/installation/install-script-flags/distribution.md" >}} |
+| **SSL certificate and key** | {{< include "nim/installation/install-script-flags/cert.md" >}}<br>{{< include "nim/installation/install-script-flags/key.md" >}} |
+| **NGINX installation** | `-n` Install the latest version of NGINX Open Source. *(Default if `-n` or `-p` not specified)*<br><br>`-p` Install NGINX Plus as the API gateway. Must be used with `-j` to provide a JWT license.<br><br>`-j <path>` Path to the `license.jwt` file. Required when using `-p`. |
+| **ClickHouse installation** | {{< include "nim/installation/install-script-flags/skip-clickhouse.md" >}}<br>{{< include "nim/installation/install-script-flags/clickhouse-version.md" >}} |
 
-{{< note >}} Starting from [NGINX Plus Release 33]({{< ref "nginx/releases.md#r33" >}}), a JWT file is required for each NGINX Plus instance. For more information, see [About Subscription Licenses]({{< ref "/solutions/about-subscription-licenses.md">}}). {{< /note >}}
+**Example: install with default key and certificate paths**
 
-You also need to specify the current operating system. To get the latest list supported by the script, run the following command:
+To use the script to install NGINX Instance Manager on Ubuntu 24.04, with repository keys in the default `/etc/ssl/nginx` directory, with the latest version of NGINX Open Source, run the following command:
 
 ```bash
-grep '\-d distribution' install-nim-bundle.sh
+sudo bash install-nim-bundle.sh -d ubuntu24.04
 ```
 
-For example, to use the script to install NGINX Instance Manager on Ubuntu 24.04, with repository keys in the default `/etc/ssl/nginx` directory, with the latest version of NGINX OSS, run the following command:
+<br>
 
-```bash
-sudo bash install-nim-bundle.sh -n latest -d ubuntu24.04 -j /path/to/license.jwt
-```
+**Example: install with custom repo key and certificate**
 
 To install NGINX Instance Manager on Ubuntu 24.04 with the latest version of NGINX Plus by pointing to the location of your NGINX cert and key, run the following command:
 
 ```bash
-sudo bash install-nim-bundle.sh -c /path/to/nginx-repo.crt -k /path/to/nginx-repo.key -p latest -d ubuntu24.04 -j /path/to/license.jwt
+sudo bash install-nim-bundle.sh \
+  -c <path/to/nginx-repo.crt> \
+  -k <path/to/nginx-repo.key> \
+  -p \
+  -d ubuntu24.04 \
+  -j <path/to/license.jwt>
 ```
 
-In most cases, the script completes the installation of NGINX Instance Manager and associated packages. After installation is complete, the script takes a few minutes to generate a password. At the end of the process, you'll see an autogenerated password:
+<br>
+
+After installing NGINX Instance Manager and related packages, the script generates an admin password. This may take a few minutes to appear: 
 
 ```bash
 Regenerated Admin password: <encrypted password>
 ```
 
-Save that password. You'll need it when you sign in to NGINX Instance Manager.
+Save this password. You'll need it to log in to NGINX Instance Manager.
 
 ### Problems and additional script parameters
 
-There are multiple parameters to configure in the Installation script. If you see fatal errors when running the script, first run the following command, which includes command options that can help you bypass problems:
+There are multiple parameters to configure in the installation script. If you see fatal errors when running the script, first run the following command, which includes command options that can help you bypass problems:
 
 ```bash
 bash install-nim-bundle.sh -h
@@ -201,43 +206,30 @@ In some cases, the script may need to be re-run due to parameters not being set
 ```bash
 bash install-nim-bundle.sh -r
 ```
----
-
-## Post-installation steps
-
-### Configure ClickHouse {#configure-clickhouse}
-
-<!-- Updated per latest info in install-nim-bundle.sh  -->
-{{<call-out "note" "ClickHouse version requirement" "" >}}NGINX Instance Manager relies on [ClickHouse](https://clickhouse.com) **24.9.2.42** or later to store essential data, including metrics, events, alerts, and configuration settings.{{</call-out>}}
 
-<!-- Based on my understanding of the script, it is a blank password -->
-{{<call-out "important" "Setting a custom ClickHouse password" "fas fa-exclamation-triangle" >}}The NGINX Instance Manager installation script also installs ClickHouse with a blank password. Update the **/etc/nms/nms.conf** file with it after installing NGINX Instance Manager. Otherwise, NGINX Instance Manager won't start. For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "/nim/system-configuration/configure-clickhouse.md" >}}) topic. {{</call-out>}}
+---
 
-#### ClickHouse default settings
+## Optional post-installation steps
 
-NGINX Instance Manager uses the following default values for ClickHouse:
+### Configure ClickHouse
 
-{{<call-out "note" "Customizing ClickHouse" >}}You can customize these settings. However, if you use custom settings, make sure to follow the [Configure ClickHouse]({{< ref "/nim/system-configuration/configure-clickhouse.md" >}}) instructions to update the **nms.conf** file after you've installed NGINX Instance Manager. Otherwise, NGINX Instance Manager won't be able to connect to ClickHouse.{{</call-out>}}
+{{< include "nim/installation/optional-steps/configure-clickhouse.md" >}}
 
-{{< include "installation/clickhouse-defaults.md" >}}
+### Disable metrics collection
 
-### (Optional) Install and configure Vault {#install-vault}
+{{< include "nim/installation/optional-steps/disable-metrics-collection.md" >}}
 
-NGINX Instance Manager can use [Vault](https://www.vaultproject.io/) as a datastore for secrets.
 
-To install and enable Vault, follow these steps:
+### Install and configure Vault {#install-vault}
 
-- Follow Vault's instructions to [install Vault 1.8.8 or later](https://www.vaultproject.io/docs/install) for your distribution.
-- Ensure you're running Vault in a [production-hardened environment](https://learn.hashicorp.com/tutorials/vault/production-hardening).
-- After installing NGINX Instance Manager, follow the steps to [configure Vault for storing secrets]({{< ref "/nim/system-configuration/configure-vault.md" >}}).
+{{< include "nim/installation/optional-steps/install-configure-vault.md" >}}
 
-### (Optional) Configure SELinux
 
-SELinux helps secure your deployment by enforcing mandatory access control policies.
+### Configure SELinux
 
-If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Instance Manager.
+{{< include "nim/installation/optional-steps/configure-selinux.md" >}}
 
-### License NGINX Instance Manager
+## License NGINX Instance Manager
 
 {{< include "nim/admin-guide/license/connected-install-license-note.md" >}}
 
@@ -271,7 +263,7 @@ If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/sy
    sudo apt-get install -y --only-upgrade nms-instance-manager
    ```
 
-1. To upgrade to the latest version of Clickhouse, run the following commands:
+1. To upgrade to the latest version of ClickHouse, run the following commands:
 
    ```bash
    sudo apt-get update
@@ -308,3 +300,9 @@ If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/sy
 ## Uninstall NGINX Instance Manager {#uninstall-nim}
 
 {{< include "nim/uninstall/uninstall-nim.md" >}}
+
+---
+
+## Next steps
+
+- [Add NGINX Open Source and NGINX Plus instances to NGINX Instance Manager]({{< ref "nim/nginx-instances/add-instance.md" >}})
diff --git a/content/nim/disconnected/_index.md b/content/nim/disconnected/_index.md
index c0f6f954b..3df3312cb 100644
--- a/content/nim/disconnected/_index.md
+++ b/content/nim/disconnected/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Disconnected environments
+title: Deploy in a disconnected environment
 weight: 30
 url: /nginx-instance-manager/disconnected/
 cascade:
diff --git a/content/nim/disconnected/add-license-disconnected-deployment.md b/content/nim/disconnected/add-license-disconnected-deployment.md
index 0a38ddec3..e4a272a6a 100644
--- a/content/nim/disconnected/add-license-disconnected-deployment.md
+++ b/content/nim/disconnected/add-license-disconnected-deployment.md
@@ -1,5 +1,5 @@
 ---
-title: Add a license in a disconnected environment
+title: Add a license (disconnected)
 draft: false
 description: ''
 weight: 200
@@ -25,7 +25,7 @@ This guide shows you how to add a license to NGINX Instance Manager in a disconn
 
 ### Set the operation mode to disconnected
 
-To configure NGINX Instance Manager for a network-restricted environment, you need to set the `mode_of_operation` to `disconnected` in the configuration file.
+To configure NGINX Instance Manager for a disconnected environment, you need to set the `mode_of_operation` to `disconnected` in the configuration file.
 
 {{< include "nim/disconnected/set-mode-of-operation-disconnected.md" >}}
 
diff --git a/content/nim/disconnected/offline-install-guide-deprecated.md b/content/nim/disconnected/offline-install-guide-manual.md
similarity index 81%
rename from content/nim/disconnected/offline-install-guide-deprecated.md
rename to content/nim/disconnected/offline-install-guide-manual.md
index 7f07ebff4..13456b043 100644
--- a/content/nim/disconnected/offline-install-guide-deprecated.md
+++ b/content/nim/disconnected/offline-install-guide-manual.md
@@ -1,5 +1,5 @@
 ---
-title: Manually install in a disconnected environment (deprecated)
+title: Manually install any version of NGINX Instance Manager (disconnected)
 weight: 100
 toc: true
 noindex: true
@@ -8,18 +8,15 @@ product: NIM
 docs: DOCS-000
 ---
 
-{{<call-out "caution" "Deprecated documentation notice" "fa fa-exclamation-triangle" >}}
-This document outlines manual steps that have been replaced by a simplified script-based process. For most users, we recommend using the updated process documented [here]({{< ref "nim/disconnected/offline-install-guide.md" >}}).{{</call-out>}}
-
 ## Overview
 
 This guide explains how to install and upgrade NGINX Instance Manager in environments without Internet access. It covers key steps, including downloading packages, managing dependencies, and configuring the system for offline use. You’ll also learn how to set up NGINX Instance Manager in disconnected mode and manually update the CVE list to keep your system secure.
 
 ## Before you begin
 
-{{<call-out "important" "Complete the required prerequisites" "fas fa-exclamation-triangle">}}
+{{< call-out "important" "Complete the required prerequisites" "fas fa-exclamation-triangle" >}}
 You must complete the following prerequisite steps **before** installing NGINX Instance Manager. **Skipping these steps could cause installation issues**.
-{{</call-out>}}
+{{</ call-out >}}
 
 ### Security considerations
 
@@ -96,17 +93,14 @@ To download external dependencies:
         sudo dpkg -i ./*.deb
         ```
 
-    {{< call-out "important" "Setting a custom ClickHouse password" "fas fa-exclamation-triangle" >}}
-
-    When installing ClickHouse, you can set a password or leave it blank (default is an empty string). If you set a password, make sure to update the **/etc/nms/nms.conf** file with it after installing NGINX Instance Manager. Otherwise, NGINX Instance Manager won't start. For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "/nim/system-configuration/configure-clickhouse.md" >}}) topic.
-
-    {{</ call-out >}}
-
-
 ---
 
 ## Install NGINX Instance Manager {#install-nim-offline}
 
+{{< call-out "important" "Save the password!" "" >}}
+The administrator username (default: **admin**) and the generated password are displayed in the terminal during installation. Be sure to record the password and store it securely.
+{{</ call-out >}}
+
 1. Log in to the [MyF5 Customer Portal](https://account.f5.com/myf5) and download the NGINX Instance Manager package files.
 
 2. Install the NGINX Instance Manager package:
@@ -123,10 +117,6 @@ To download external dependencies:
         sudo apt-get -y install -f /home/<user>/nms-instance-manager_<version>_amd64.deb
         ```
 
-    {{< call-out "important" "Save the password!" "fas fa-exclamation-triangle" >}}
-    The administrator username (default: **admin**) and the generated password are displayed in the terminal during installation. Be sure to record the password and store it securely.
-    {{</ call-out >}}
-
 3. Enable and start NGINX Instance Manager services:
 
     ```bash
@@ -149,9 +139,25 @@ To download external dependencies:
 
 ---
 
-## Post-installation steps (optional)
+## Optional post-installation steps
+
+### Configure ClickHouse
+
+{{< include "nim/installation/optional-steps/configure-clickhouse.md" >}}
 
-{{< include "installation/optional-installation-steps.md"  >}}
+### Disable metrics collection
+
+{{< include "nim/installation/optional-steps/disable-metrics-collection.md" >}}
+
+
+### Install and configure Vault {#install-vault}
+
+{{< include "nim/installation/optional-steps/install-configure-vault.md" >}}
+
+
+### Configure SELinux
+
+{{< include "nim/installation/optional-steps/configure-selinux.md" >}}
 
 ## Upgrade NGINX Instance Manager {#upgrade-nim-offline}
 
@@ -192,3 +198,8 @@ sudo chmod 644 /usr/share/nms/cve.xml && \
 sudo systemctl restart nms-dpm
 ```
 
+---
+
+## Next steps
+
+- [Add NGINX Open Source and NGINX Plus instances to NGINX Instance Manager]({{< ref "nim/nginx-instances/add-instance.md" >}})
\ No newline at end of file
diff --git a/content/nim/disconnected/offline-install-guide.md b/content/nim/disconnected/offline-install-guide.md
index 039854089..ae422d800 100644
--- a/content/nim/disconnected/offline-install-guide.md
+++ b/content/nim/disconnected/offline-install-guide.md
@@ -1,5 +1,5 @@
 ---
-title: Install in a disconnected environment using a script
+title: Install the latest NGINX Instance Manager with a script (disconnected)
 toc: true
 weight: 100
 type: how-to
@@ -11,9 +11,17 @@ docs: DOCS-803
 
 ## Overview
 
-This guide shows you how to install and upgrade NGINX Instance Manager in environments without internet access. It covers key steps, including downloading packages, managing dependencies, and configuring the system for offline use. You’ll also learn how to set up NGINX Instance Manager in disconnected mode and update the CVE list manually to keep your system secure.
+This guide shows you how to install and upgrade F5 NGINX Instance Manager in disconnected environments.
 
-{{<call-out "note" "Access the deprecated manual steps" "">}}If you prefer to follow the original manual steps, you can access the [deprecated guide]({{< ref "nim/disconnected/offline-install-guide-deprecated.md" >}}). Please note that this guide is no longer actively maintained and may not reflect the latest updates or best practices.{{</call-out>}}
+The script installs:
+
+- The latest version of NGINX Open Source
+- The latest version of NGINX Instance Manager
+- ClickHouse by default, unless you choose to skip it
+
+NGINX Plus is not supported in disconnected mode.
+
+If you need to install earlier versions of NGINX or NGINX Instance Manager, follow the [manual installation process](({{< ref "nim/deploy/vm-bare-metal/install-nim-manual.md" >}})) instead.
 
 ---
 
@@ -41,7 +49,7 @@ Ensure that the required `.crt` and `.key` files are available, preferably in th
 
 #### Use the manual installation steps if needed
 
-If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< ref "nim/disconnected/offline-install-guide-deprecated.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups.
+If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< ref "nim/disconnected/offline-install-guide-manual.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups.
 
 ### Download the SSL Certificate and Private Key from MyF5
 
@@ -56,47 +64,45 @@ Download the SSL certificate and private key required for NGINX Instance Manager
 
 {{<fa "download">}} {{<link "/scripts/install-nim-bundle.sh" "Download the install-nim-bundle.sh script.">}}
 
-### Use the script to Download the necessary packages to Install NGINX Instance Manager in a Disconnected environment
-
-To run the script, enter the following command, replacing `<path/to/certificate.crt>` and `<path/to/private.key>` with the full paths and filenames of your SSL certificate and private key files:
+## Package NGINX Instance Manager and dependencies for offline installation
 
-```shell
-sudo bash install-nim-bundle.sh \
-  -c <path/to/certificate.crt> \
-  -k <path/to/private.key> \
-  -m offline \
-  -d <distribution> \
-  -v <version>
-```
+Run the installation script in `offline` mode to download NGINX Instance Manager, NGINX Open Source, ClickHouse (unless skipped), and all required dependencies into a tarball for use in disconnected environments.
 
-<br>
+### Installation script options
 
-By default, this command installs the latest version of NGINX Open Source to run NGINX Instance Manager. NGINX Plus is currently not supported when using the script in Disconnected mode. Please see this guide to install NGINX Plus offline if you would like to use this in front of NGINX Instance Manager
+| Category | Option or Flag |
+|----------|----------------|
+| **Installation mode and platform** | `-m offline`: Required to package the installation files into a tarball for disconnected environments.<br>{{< include "nim/installation/install-script-flags/distribution.md" >}} |
+| **SSL certificate and key** | {{< include "nim/installation/install-script-flags/cert.md" >}}<br>{{< include "nim/installation/install-script-flags/key.md" >}} |
+| **NGINX installation** | `-n`: Include the latest version of NGINX Open Source in the tarball.<br><br>This option is optional in `offline` mode—if not specified, the script installs the latest version of NGINX Open Source by default.<br><br>NGINX Plus is **not supported** when using the script in offline mode.<br><br>To install NGINX Plus offline, see the [manual installation guide]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md#offline_install" >}}). |
+| **ClickHouse installation** | {{< include "nim/installation/install-script-flags/skip-clickhouse.md" >}}<br>{{< include "nim/installation/install-script-flags/clickhouse-version.md" >}} |
 
-<br>
+### Example: packaging command
 
-**Explanation of options:**
-
-- **`-c`**: Uses the specified SSL certificate file. Copies the file to the /etc/ssl/nginx directory.
-- **`-k`**: Uses the specified private key file. Copies the file to the /etc/ssl/nginx directory.
-- **`-m`**: Sets the installation mode (use `offline` for disconnected environments).
-- **`-d`**: Defines the target distribution (replace `<distribution>` with one of the supported options below).
-- **`-n`**: Installs a specific version of NGINX Open Source. Use `latest` to install the most recent version or specify a version like `1.27.1`. The script defaults to installing the latest version of NGINX Open Source.
-- **`-v`**: Installs the specified version of NGINX Instance Manager. Use `latest` for the newest version or a specific release like `2.18.0`. If you skip this option, the script assumes you want to install `latest`.
+  ```shell
+  sudo bash install-nim-bundle.sh \
+  -c <path/to/nginx-repo.crt> \
+  -k <path/to/nginx-repo.key> \
+  -m offline \
+  -d <distribution> \
+  -v <clickhouse-version>
+  ```
 
-**Supported distributions:**
+---
 
-To get the latest list supported by the script, run the following command:
+## Install NGINX Instance Manager
 
-```bash
-grep '\-d distribution' install-nim-bundle.sh
-```
+After you’ve packaged the installation files on a connected system, copy the tarball, script, and SSL files to your disconnected system. Then, run the script again to install NGINX Instance Manager using the tarball.
 
-The script downloads the required packages and adds them to a tarball file. You’ll need to copy this tarball to the target machine in the disconnected environment.
+### Required flags for installing in offline mode
 
----
+- `-m offline`: Required to run the script in offline mode. When used with `-i`, the script installs NGINX Instance Manager and its dependencies from the specified tarball.
+- `-i <path/to/tarball.tar.gz>`: Path to the tarball created during the packaging step.
+- {{< include "nim/installation/install-script-flags/cert.md" >}}
+- {{< include "nim/installation/install-script-flags/key.md" >}}
+- `-d <distribution>`: Target Linux distribution (must match what was used during packaging).
 
-## Install NGINX Instance Manager
+### Install from the tarball
 
 1. Copy the following files to the target system:
    - `install-nim-bundle.sh` script
@@ -108,11 +114,11 @@ The script downloads the required packages and adds them to a tarball file. You
 
     ```shell
     sudo bash install-nim-bundle.sh \
-    -c <path/to/certificate.crt>
-    -k <path/to/private.key> \
-    -m offline \
-    -d <distribution> \
+    -m offline
     -i <path/to/tarball.tar.gz>
+    -c <path/to/nginx-repo.crt>
+    -k <path/to/nginx-repo.key> \
+    -d <distribution> \
     ```
 
 3. **Save the admin password**. In most cases, the script completes the installation of NGINX Instance Manager and associated packages. After installation is complete, the script takes a few minutes to generate a password. At the end of the process, you'll see an autogenerated password:
@@ -133,9 +139,25 @@ The script downloads the required packages and adds them to a tarball file. You
 
 ---
 
-## Post-installation steps (optional)
+## Optional post-installation steps
+
+### Configure ClickHouse
+
+{{< include "nim/installation/optional-steps/configure-clickhouse.md" >}}
+
+### Disable metrics collection
+
+{{< include "nim/installation/optional-steps/disable-metrics-collection.md" >}}
+
 
-{{< include "installation/optional-installation-steps.md"  >}}
+### Install and configure Vault {#install-vault}
+
+{{< include "nim/installation/optional-steps/install-configure-vault.md" >}}
+
+
+### Configure SELinux
+
+{{< include "nim/installation/optional-steps/configure-selinux.md" >}}
 
 ---
 
@@ -184,3 +206,8 @@ sudo chmod 644 /usr/share/nms/cve.xml && \
 sudo systemctl restart nms-dpm
 ```
 
+---
+
+## Next steps
+
+- [Add NGINX Open Source and NGINX Plus instances to NGINX Instance Manager]({{< ref "nim/nginx-instances/add-instance.md" >}})
\ No newline at end of file
diff --git a/content/nim/disconnected/report-usage-disconnected-deployment.md b/content/nim/disconnected/report-usage-disconnected-deployment.md
index a63763654..afe228b1a 100644
--- a/content/nim/disconnected/report-usage-disconnected-deployment.md
+++ b/content/nim/disconnected/report-usage-disconnected-deployment.md
@@ -1,5 +1,5 @@
 ---
-title: Report usage to F5 in a disconnected environment
+title: Report usage data to F5 (disconnected)
 draft: false
 weight: 300
 toc: true
diff --git a/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md b/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md
index 45745bd24..2a70c574d 100644
--- a/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md
+++ b/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md
@@ -30,7 +30,7 @@ Complete the following prerequisites before proceeding with the steps in this gu
    {{< include "nim/tech-specs/security-data-plane-dependencies.md" >}}
 
 1. Determine your use case: **Security Monitoring only** or **Security Monitoring and Configuration Management**.
-1. [Upload your license]({{< ref "/nim/admin-guide/license/add-license.md" >}}).
+1. [Upload your license]({{< ref "/nim/admin-guide/add-license.md" >}}).
 
 ---
 
diff --git a/content/nim/nginx-instances/add-instance.md b/content/nim/nginx-instances/add-instance.md
new file mode 100644
index 000000000..760052759
--- /dev/null
+++ b/content/nim/nginx-instances/add-instance.md
@@ -0,0 +1,49 @@
+---
+title: "Add an NGINX instance"
+weight: 100
+toc: false
+nd-content-type: how-to
+nd-product: NIM
+---
+
+This guide shows you how to add NGINX Open Source and NGINX Plus instances to F5 NGINX Instance Manager so you can manage them from a central dashboard.
+
+## Before you begin
+
+Make sure you have:
+
+- One or more instances running [NGINX Open Source]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-open-source.md" >}}) or [NGINX Plus]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}).
+- Admin access to NGINX Instance Manager.
+
+## Add instances
+
+1. Open the NGINX Instance Manager web interface and log in.
+2. In the **Manage** section on the left, select **Instances**.
+3. Select **Add**.
+4. Copy the `curl` command.
+5. On the host where your NGINX instance is running, run the `curl` command to install NGINX Agent:
+
+   ```shell
+   curl https://<NIM-FQDN>/install/nginx-agent | sudo sh
+   ```
+
+6. On the same host, run the following command to start NGINX Agent:
+
+   ```shell
+   sudo systemctl start nginx-agent
+   ```
+
+## Set up metrics reporting
+
+### Enable NGINX Plus API
+
+{{< include "/use-cases/monitoring/enable-nginx-plus-api.md" >}}
+
+### Enable NGINX Open Source Stub Status API
+
+{{< include "/use-cases/monitoring/enable-nginx-oss-stub-status.md" >}}
+
+## Next steps
+
+- [Add instances to instance groups]({{< ref "nim/nginx-instances/manage-instance-groups.md" >}})
+- [Add managed certificates]({{< ref "nim/nginx-instances/manage-certificates.md" >}})
\ No newline at end of file
diff --git a/content/nim/releases/known-issues.md b/content/nim/releases/known-issues.md
index e880979e4..b45a829c8 100644
--- a/content/nim/releases/known-issues.md
+++ b/content/nim/releases/known-issues.md
@@ -13,6 +13,83 @@ This document lists and describes the known issues and possible workarounds in F
 
 ---
 
+## 2.20.0
+
+June 16, 2025
+
+### {{% icon-bug %}} Failing to fetch CVE data when using forward proxy in K8s environments {#46177}
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| Issue ID       | Status |
+|----------------|--------|
+| 46177 | Open  |
+{{</bootstrap-table>}}
+
+#### Description
+
+Fetching latest CVE data from internet might fail if you enable "ssl_verify" in Kubernetes environments.
+
+
+#### Workaround
+
+1. Switch to the offline CVE database. To switch add the property "offline_nginx_cve: true" under the DPM section in the "nms.conf" file.
+
+   ```cfg
+   dpm:
+       offline_nginx_cve: true
+   ```
+
+2. Download the latest security advisories file from the [nginx.org repository]( https://raw.githubusercontent.com/nginx/nginx.org/main/xml/en/security_advisories.xml) and save them with "cve.xml" as filename in "/usr/share/nms/cve.xml”
+3. Restart the `nms` service.
+
+   ```shell
+   sudo systemctl restart nms
+   ```
+
+After the restart you will see the line “loading CVE data from file” in the "nms.log" file.
+
+---
+
+### {{% icon-bug %}} New warning message when no usage data or report is available {#46022}
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| Issue ID       | Status |
+|----------------|--------|
+| 46022 | Won't be resolved  |
+{{</bootstrap-table>}}
+
+#### Description
+
+Users now see a warning message when they click the **Send Usage To F5** button if no new usage data or report is available. The message reads:
+
+> "Usage data is not available at the moment. Please try submitting usage details again later."
+
+---
+
+
+## 2.19.1
+
+March 27, 2025
+
+### {{% icon-resolved %}} The certificate stats are not displayed correctly in the Certificates and Keys page as well as the Dashboard page. {#45991}
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| Issue ID       | Status |
+|----------------|--------|
+| 45991 | Fixed in Instance Manager 2.20.0  |
+{{</bootstrap-table>}}
+
+#### Description
+
+When the dashboard page and certificates page are loaded, the count displayed for total, valid, expired, expires soon, managed and unmanaged are incorrect.
+
+#### Workaround
+
+The changes required have been made and the UI displays the values correctly now. Pagination also works well along with the certificate stats.
+
+---
+
+
 ## 2.19.0
 
 February 06, 2025
@@ -134,71 +211,19 @@ There is an issue that causes previous error messages to persist in the web inte
 ---
 
 
-## 2.17.3
-
-September 13, 2024
-
-### {{% icon-resolved %}} The web interface can't display more than 100 certificates {#45565}
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-| Issue ID       | Status |
-|----------------|--------|
-| 45565 | Fixed in Instance Manager 2.19.0  |
-{{</bootstrap-table>}}
-
-#### Description
-
-The Certificate Management screen can only show up to 100 certificates.
-
----
-
-
 ## 2.17.0
 
 July 10, 2024
 
-### {{% icon-resolved %}} Mismatch in date formats in custom date selection on NGINX usage graph {#45512}
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-| Issue ID       | Status |
-|----------------|--------|
-| 45512 | Fixed in Instance Manager 2.18.0  |
-{{</bootstrap-table>}}
-
-#### Description
-
-The months in the custom date range were not displayed correctly because NGINX Instance Manager assumed the data format was in the US timezone.
-
----
-
-### {{% icon-resolved %}} NGINX Agent 2.36.0 fails to validate certain NGINX configurations in NGINX Instance Manager 2.17.0 {#45153}
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-| Issue ID       | Status |
-|----------------|--------|
-| 45153 | Fixed in nginxagent-2.36.0  |
-{{</bootstrap-table>}}
-
-#### Description
-
-In NGINX Instance Manager 2.17.0, an "invalid number of arguments" error appears in the web interface when using specific configuration parameters in NGINX Agent 2.36.0.
-
-#### Workaround
-
-Install NGINX Agent **2.35.1** if you're using NGINX Instance Manager 2.17.0. This version is included with NGINX Instance Manager 2.17.0 by default.
-
-If you're installing NGINX Agent from package files, follow the steps in the [Installing NGINX Agent](https://github.com/nginx/agent?tab=readme-ov-file#installing-nginx-agent-from-package-files) guide.
-
----
-
 ### {{% icon-bug %}} Web Analytics are not enabled after upgrading Instance Manager when keeping existing nms-http.conf {#45131}
 
 {{<bootstrap-table "table table-striped table-bordered">}}
+
 | Issue ID       | Status |
 |----------------|--------|
 | 45131 | Open  |
-{{</bootstrap-table>}}
 
+{{</bootstrap-table>}}
 #### Description
 
 When using NGINX Instance Manager, you configure OIDC by manually editing the /etc/nginx/conf.d/nms-http.conf and /etc/nms/nms.conf files.
@@ -218,11 +243,12 @@ add_header Content-Security-Policy "default-src 'none'; block-all-mixed-content;
 ### {{% icon-bug %}} Failure to retrieve instance configuration when NAP-enabled instance doesn't register properly {#45113}
 
 {{<bootstrap-table "table table-striped table-bordered">}}
+
 | Issue ID       | Status |
 |----------------|--------|
 | 45113 | Open  |
-{{</bootstrap-table>}}
 
+{{</bootstrap-table>}}
 #### Description
 
 If NGINX Agent is configured to monitor NGINX App Protect before App Protect is installed, NGINX Agent will send an empty App Protect metadata structure to NGINX Instance Manager. This causes Instance Manager to fail to register the NGINX instance properly.
@@ -233,34 +259,6 @@ Edit the "/etc/nginx-agent/nginx-agent.conf" file and configure "precompiled_pub
 
 ---
 
-### {{% icon-resolved %}} Failure to notify user when template configuration publish fails {#44975}
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-| Issue ID       | Status |
-|----------------|--------|
-| 44975 | Fixed in Instance Manager 2.18.0  |
-{{</bootstrap-table>}}
-
-#### Description
-
-When publishing a configuration template fails, the system only displays "Accepted" without providing the final result, such as "Success" or "Failure."
-
----
-
-### {{% icon-resolved %}} Editing template submissions now allows for using most recent template version {#44971}
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-| Issue ID       | Status |
-|----------------|--------|
-| 44971 | Fixed in Instance Manager 2.17.0  |
-{{</bootstrap-table>}}
-
-#### Description
-
-When editing a template submission, you can now choose between using a snapshot of the template from when it was first deployed or the latest version of the template. **Important:** Note that if you use the latest version, changes to the templates might make an augment template incompatible with a base template, causing the publication to the data plane to fail.
-
----
-
 
 ## 2.15.0
 
diff --git a/content/nim/releases/release-notes.md b/content/nim/releases/release-notes.md
index 9ab95c68a..0b0cbd200 100644
--- a/content/nim/releases/release-notes.md
+++ b/content/nim/releases/release-notes.md
@@ -17,11 +17,86 @@ The release notes for F5 NGINX Instance Manager highlight the latest features, i
 </details>
 
 
+---
+
+## 2.20.0
+
+June 16, 2025
+
+### Upgrade Paths {#2-20-0-upgrade-paths}
+
+NGINX Instance Manager 2.20.0 supports upgrades from these previous versions:
+
+- 2.17.0 - 2.19.2
+
+If your NGINX Instance Manager version is older, you may need to upgrade to an intermediate version before upgrading to the target version.
+
+### What's New{#2-20-0-whats-new}
+This release includes the following updates:
+
+- {{% icon-feature %}} **Added support to report on multiple NGINX One subscriptions using a single instance of NGINX Instance Manager**<a name="2-20-0-whats-new-Added-support-to-report-on-multiple-NGINX-One-subscriptions-using-a-single-instance-of-NGINX-Instance-Manager"></a>
+
+   Customers can have multiple NGINX One subscriptions or licenses with different attributes (prod, nonprod, etc.). Now a single NGINX Instance Manager can receive usage from these instances and send a bulk usage report to F5.
+
+  We also simplified the licensing process for disconnected use cases. When running NGINX Instance Manager in disconnected mode, all features are enabled for 90 days when a JWT is uploaded. Customers have these 90 days to send the first usage report to activate the NGINX Instance Manager license.
+
+- {{% icon-feature %}} **Introducing lightweight mode**<a name="2-20-0-whats-new-Introducing-lightweight-mode"></a>
+
+   NGINX Instance Manager can now run in lightweight mode without the ClickHouse database dependency. This mode requires fewer resources and is perfect for customers who don’t need metrics-related functionality. It supports basic use cases such as:
+
+  - Fleet management
+  - WAF configuration
+  - Usage tracking
+  - Certificate management
+  - Template automation
+
+- {{% icon-feature %}} **Improved web analytics sent to F5**<a name="2-20-0-whats-new-Improved-web-analytics-sent-to-F5"></a>
+
+   NGINX Instance Manager now sends improved web analytics to F5. This helps F5 understand common use cases of NGINX Instance Manager and improve functionality.
+
+
+### Changes in Default Behavior{#2-20-0-changes-in-behavior}
+This release has the following changes in default behavior:
+
+- {{% icon-feature %}} **Breadcrumbs added for Overview, Manage, and Config templates**<a name="2-20-0-changes-in-behavior-Breadcrumbs-added-for-Overview,-Manage,-and-Config-templates"></a>
+
+  We have added breadcrumb navigation links for the "Overview", "Manage", and "Config" templates in the NGINX Instance Manager user interface.
+
+- {{% icon-feature %}} **Export instance groups to Excel**<a name="2-20-0-changes-in-behavior-Export-instance-groups-to-Excel"></a>
+
+  You can now export instance groups to a Microsoft Excel spreadsheet from the Instance Group section.
+
+- {{% icon-feature %}} **Export all instances functionality added**<a name="2-20-0-changes-in-behavior-Export-all-instances-functionality-added"></a>
+
+  NGINX Instance Manager’s export function only included currently visible instances, not the full list. Customers had to run separate exports and merge data manually.
+
+  An `Export All` button is now available under the Instances section. Clicking it downloads all instance details in a single Excel file.
+
+- {{% icon-feature %}} **Automatic feature enablement in disconnected instances on license upload**<a name="2-20-0-changes-in-behavior-Automatic-feature-enablement-in-disconnected-instances-on-license-upload"></a>
+
+
+  NGINX Instance Manager now enables all features by default when you upload a license to a disconnected instance. This update ensures customers can begin using the full capabilities of the system without additional configuration.
+
+  Customers have a 90-day window to complete the full license process. If they don’t complete it within this period, the instance is automatically deactivated.
+
+
+
+### Resolved Issues{#2-20-0-resolved-issues}
+
+This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page.
+
+- {{% icon-resolved %}} The certificate stats are not displayed correctly in the Certificates and Keys page as well as the Dashboard page. (45991)
+
+
+### Known Issues{#2-20-0-known-issues}
+
+You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic.
+
 ---
 
 ## 2.19.2
 
-May 08, 2025
+May 06, 2025
 
 ### Upgrade Paths {#2-19-2-upgrade-paths}
 
@@ -188,11 +263,11 @@ This release includes the following updates:
 
   This [Docker Compose option]({{< ref "nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md" >}}) unlocks another easy, production-ready installation method for customers using Docker. It will also make upgrades easier when new Docker images are released by F5 NGINX. This option includes health checking, NGINX App Protect compilation support, and security monitoring.
 
-- {{% icon-feature %}} **Entitlement and visibility for NGINX Plus R33 – Telemetry reporting for network-restricted environments**<a name="2-18-0-whats-new-Entitlement-and-visibility-for-NGINX-Plus-R33-–-Telemetry-reporting-for-network-restricted-environments"></a>
+- {{% icon-feature %}} **Entitlement and visibility for NGINX Plus R33 – Telemetry reporting for disconnected environments**<a name="2-18-0-whats-new-Entitlement-and-visibility-for-NGINX-Plus-R33-–-Telemetry-reporting-for-disconnected-environments"></a>
 
-   If NGINX Instance Manager has internet access, customers can [automatically or manually send the usage data to F5]({{< ref "nim/admin-guide/license/report-usage-connected-deployment.md" >}}) as part of the new NGINX Plus R33 changes.
+   If NGINX Instance Manager has internet access, customers can [automatically or manually send the usage data to F5]({{< ref "nim/admin-guide/report-usage-connected-deployment.md" >}}) as part of the new NGINX Plus R33 changes.
 
-  For customers who have NGINX Instance Manager deployed in [network-restricted environments]({{< ref "nim/disconnected" >}}), this release also includes support for manual usage reporting. Customers can now manually license NGINX Instance Manager and export usage telemetry for fully disconnected environments. For usage reporting, customers can:
+  For customers who have NGINX Instance Manager deployed in [disconnected environments]({{< ref "nim/disconnected" >}}), this release also includes support for manual usage reporting. Customers can now manually license NGINX Instance Manager and export usage telemetry for fully disconnected environments. For usage reporting, customers can:
 
   - **Export the usage report**: Manually export the usage report from NGINX Instance Manager.
   - **Send the report to F5**: Submit the report to F5 for verification from a location with internet access.
@@ -692,7 +767,7 @@ This release includes the following updates:
 
 - {{% icon-feature %}} **Use NGINX Plus Health Checks to easily track NGINX Plus Usage with NGINX Instance Manager**<a name="2-13-0-whats-new-Use-NGINX-Plus-Health-Checks-to-easily-track-NGINX-Plus-Usage-with-NGINX-Instance-Manager"></a>
 
-   The NGINX Plus Health Check feature now allows you to monitor the count of both NGINX Plus and NGINX App Protect instances that you've deployed. You can view this information in the "NGINX Plus" area of the "Instance Manager" web interface, or through the `/inventory` API. For guidance on how to set this up, refer to the following documentation: [View Count of NGINX Plus Instances]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}).
+   The NGINX Plus Health Check feature now allows you to monitor the count of both NGINX Plus and NGINX App Protect instances that you've deployed. You can view this information in the "NGINX Plus" area of the "Instance Manager" web interface, or through the `/inventory` API. For guidance on how to set this up, refer to the following documentation: [View Count of NGINX Plus Instances]({{< ref "/nim/admin-guide/report-usage-connected-deployment.md" >}}).
 
 - {{% icon-feature %}} **Improved log output for better JSON parsing**<a name="2-13-0-whats-new-Improved-log-output-for-better-JSON-parsing"></a>
 
@@ -731,7 +806,7 @@ This release includes the following updates:
 
 - {{% icon-feature %}} **New support for license tokens for automatic entitlement updates, renewals, and Flexible Consumption Reporting**<a name="2-12-0-whats-new-New-support-for-license-tokens-for-automatic-entitlement-updates,-renewals,-and-Flexible-Consumption-Reporting"></a>
 
-   NGINX Management Suite now supports license tokens formatted as a JSON Web Token (JWT). With JWT licensing, you can automatically update entitlements during subscription renewals or amendments, and you can automate reporting for the Flexible Consumption Program (FCP). For more information, see the [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic.
+   NGINX Management Suite now supports license tokens formatted as a JSON Web Token (JWT). With JWT licensing, you can automatically update entitlements during subscription renewals or amendments, and you can automate reporting for the Flexible Consumption Program (FCP). For more information, see the [Add a License]({{< ref "/nim/admin-guide/add-license.md" >}}) topic.
 
 
 ### Resolved Issues{#2-12-0-resolved-issues}
@@ -1357,7 +1432,7 @@ This release includes the following updates:
 
 - {{% icon-feature %}} **Track NGINX Plus usage over time**<a name="2-5-0-whats-new-Track-NGINX-Plus-usage-over-time"></a>
 
-   When viewing your NGINX Plus instances in the Instnace Manager web interface, you can set a date and time filter to review the [NGINX Plus instance count]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}) for a specific period. Also, you can use the Instance Manager REST API to view the lowest, highest, and average number of NGINX Plus instances over time.
+   When viewing your NGINX Plus instances in the Instance Manager web interface, you can set a date and time filter to review the [NGINX Plus instance count]({{< ref "/nim/admin-guide/report-usage-connected-deployment.md" >}}) for a specific period. Also, you can use the Instance Manager REST API to view the lowest, highest, and average number of NGINX Plus instances over time.
 
 - {{% icon-feature %}} **New helm charts for each release of Instance Manager**<a name="2-5-0-whats-new-New-helm-charts-for-each-release-of-Instance-Manager"></a>
 
@@ -1400,7 +1475,7 @@ This release includes the following updates:
 
 - {{% icon-feature %}} **See which of your NGINX Plus instances have NGINX App Protect installed**<a name="2-4-0-whats-new-See-which-of-your-NGINX-Plus-instances-have-NGINX-App-Protect-installed"></a>
 
-   Now, when you [view your NGINX Plus inventory]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}), you can see which instances have [NGINX App Protect](https://www.nginx.com/products/nginx-app-protect/) installed. NGINX App Protect is a modern app‑security solution that works seamlessly in DevOps environments as a robust WAF or app‑level DoS defense, helping you deliver secure apps from code to customer.
+   Now, when you [view your NGINX Plus inventory]({{< ref "/nim/admin-guide/report-usage-connected-deployment.md" >}}), you can see which instances have [NGINX App Protect](https://www.nginx.com/products/nginx-app-protect/) installed. NGINX App Protect is a modern app‑security solution that works seamlessly in DevOps environments as a robust WAF or app‑level DoS defense, helping you deliver secure apps from code to customer.
 
 
 ### Changes in Default Behavior{#2-4-0-changes-in-behavior}
@@ -1494,7 +1569,7 @@ This release includes the following updates:
 
 - {{% icon-feature %}} **Track the details for your NGINX Plus instances**<a name="2-3-0-whats-new-Track-the-details-for-your-NGINX-Plus-instances"></a>
 
-   Easily track your NGINX Plus instances from the new NGINX Plus inventory list page. [View the current count for all your NGINX Plus instances]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}), as well as each instance's hostname, UID, version, and the last time each instance was reported to Instance Manager. Select the `Export` button to export the list of NGINX Plus instances to a `.csv` file.
+   Easily track your NGINX Plus instances from the new NGINX Plus inventory list page. [View the current count for all your NGINX Plus instances]({{< ref "/nim/admin-guide/report-usage-connected-deployment.md" >}}), as well as each instance's hostname, UID, version, and the last time each instance was reported to Instance Manager. Select the `Export` button to export the list of NGINX Plus instances to a `.csv` file.
 
 - {{% icon-feature %}} **Explore events in NGINX Instance Manager with the Events Catalogs API**<a name="2-3-0-whats-new-Explore-events-in-NGINX-Instance-Manager-with-the-Events-Catalogs-API"></a>
 
diff --git a/content/nim/system-configuration/configure-clickhouse.md b/content/nim/system-configuration/configure-clickhouse.md
index 32e50bdb4..3f4a7f1be 100644
--- a/content/nim/system-configuration/configure-clickhouse.md
+++ b/content/nim/system-configuration/configure-clickhouse.md
@@ -12,84 +12,52 @@ type:
 
 ## Overview
 
-Follow this guide to update the `/etc/nms/nms.conf` file if you used a custom address, username, or password, or enabled TLS during ClickHouse installation. NGINX Instance Manager requires this information to connect to ClickHouse.
+NGINX Instance Manager uses ClickHouse to store metrics, events, alerts, and configuration data.  
+If your setup differs from the default configuration—for example, if you use a custom address, enable TLS, set a password, or turn off metrics—you need to update the `/etc/nms/nms.conf` file.
 
-## Default ClickHouse values {#default-values}
+This guide explains how to update those settings so that NGINX Instance Manager can connect to ClickHouse correctly.
 
-Unless otherwise specified in the `/etc/nms/nms.conf` file, NGINX Instance Manager uses the following default values for ClickHouse:
-
-{{< include "installation/clickhouse-defaults.md" >}}
-
----
-
-## Use custom address, username, or password
-
-If your ClickHouse installation uses a custom address, username, or password, update the NGINX Instance Manager configuration to match.
+## Change default settings {#change-settings}
 
-To set custom values:
+To change a ClickHouse setting:
 
-1. Open the `/etc/nms/nms.conf` file on the NGINX Instance Manager server.
-2. Update the following settings to match your ClickHouse configuration:
+1. Open the configuration file at `/etc/nms/nms.conf`.
 
-    ```yaml
-    clickhouse:
-      address: tcp://localhost:9000
-      username: <INSERT USERNAME HERE>
-      password: <INSERT PASSWORD HERE>
-    ```
+2. In the `[clickhouse]` section, update the setting or settings you want to change.
 
-3. Save and close the file.
+3. Restart the NGINX Instance Manager service:
 
----
-
-## Configure TLS
-
-If you enabled TLS for ClickHouse, update the `nms.conf` file settings to enable secure connections.
+   ```shell
+   sudo systemctl restart nms
+   ```
 
-To configure TLS:
-
-1. Open the `/etc/nms/nms.conf` file on the NGINX Instance Manager server.
-2. Update the `clickhouse` TLS settings as needed:
-
-    ```yaml
-    clickhouse:
+Unless otherwise specified in the `/etc/nms/nms.conf` file, NGINX Instance Manager uses the following default values for ClickHouse:
 
-      # Sets the log level for ClickHouse processes within NMS.
-      log_level: debug
+{{< include "nim/clickhouse/clickhouse-defaults.md" >}}
 
-      # Sets the address that will be used to connect to ClickHouse.
-      address: 127.0.0.1:9001
 
-      ## Note: Username and password should only be set, if you have custom defined username and password for ClickHouse.
-      ## Ensure that any configured username or password is wrapped in single quotes.
-      # Sets the username that will be used to connect to ClickHouse.
-      username: 'test-1'
+## Disable metrics collection
 
-      # Sets the password that will be used to connect to ClickHouse.
-      password: 'test-2'
+As of version 2.20, NGINX Instance Manager can run without ClickHouse. This lightweight mode reduces system requirements and simplifies installation for users who do not need metrics. To use this setup, you must run NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}.
 
-      # Activates or deactivates TLS for connecting to ClickHouse.
-      # Note: `tls_mode` will be deprecated in the future, use the `tls` key to enable TLS connection for ClickHouse.
-      tls_mode: true
+To disable metrics collection after installing NGINX Instance Manager:
 
-      tls:
-        # Sets the address (form <ip-address:port>)used to connect to ClickHouse with a TLS connection.
-        address: 127.0.0.1:9441
+1. Open the configuration file at `/etc/nms/nms.conf`.
 
-        # Activates or deactivates TLS verification of ClickHouse connection.
-        skip_verify: false
+2. In the `[clickhouse]` section, set the following value:
 
-        # Sets the path of the certificate used for TLS connections in PEM encoded format.
-        cert_path: /etc/certs
+   ```yaml
+   enable = false
+   ```
 
-        # Sets the path of the client key used for TLS connections in PEM encoded format.
-        key_path: /etc/key
+3. Restart the NGINX Instance Manager service:
 
-        # Sets the path of the Certificate Authority installed on the system for verifying certificates.
-        cert_ca: /etc/ca
+   ```shell
+   sudo systemctl restart nms
+   ```
 
-      # Sets directory containing ClickHouse migration files.
-      migrations_path: /test/migrations
-    ```
+When metrics are turned off:
 
-3. Save and close the file.
+- The web interface no longer shows metrics dashboards. Instead, it displays a message explaining that metrics are turned off.
+- Metrics-related API endpoints return a 403 error.
+- All other NGINX Instance Manager features continue to work as expected.
diff --git a/content/nim/system-configuration/configure-forward-proxy.md b/content/nim/system-configuration/configure-forward-proxy.md
index a5f961404..f0d1bda26 100644
--- a/content/nim/system-configuration/configure-forward-proxy.md
+++ b/content/nim/system-configuration/configure-forward-proxy.md
@@ -1,5 +1,5 @@
 ---
-Title: Configure NGINX Instance Manager to use a forward proxy
+Title: Use a third-party forward proxy
 weight: 2
 toc: true
 type: how-to
diff --git a/content/nim/system-configuration/configure-high-availability.md b/content/nim/system-configuration/configure-high-availability.md
index 183288d10..5e679df7e 100644
--- a/content/nim/system-configuration/configure-high-availability.md
+++ b/content/nim/system-configuration/configure-high-availability.md
@@ -1,5 +1,5 @@
 ---
-Title: Configure high availability (HA) for NGINX Instance Manager
+Title: High availability with keepalived
 weight: 3
 toc: true
 type: how-to
diff --git a/content/nim/system-configuration/configure-telemetry.md b/content/nim/system-configuration/configure-telemetry.md
index 56bde9408..afdf834b8 100644
--- a/content/nim/system-configuration/configure-telemetry.md
+++ b/content/nim/system-configuration/configure-telemetry.md
@@ -37,13 +37,13 @@ The table below shows the captured telemetry data points, the trigger conditions
 | Login | When a user logs in to NGINX Instance Manager. No data about the user is sent, only the fact that a user successfully authenticated and the timestamp of the login event. | To understand how often users or systems access NGINX Instance Manager. |
 | Start/Stop processes | When any NGINX Instance Manager processes are started or stopped. | To gauge how often users upgrade NGINX Instance Manager or troubleshoot issues. This information helps F5 Support diagnose issues. |
 | Adding Data Plane(s)      | When NGINX Agent registers with NGINX Instance Manager for the first time. No data about the data plane is sent, just that an NGINX Agent registered with the platform. | To understand the frequency and quantity of data planes being added to NGINX Instance Manager. This information helps inform our scale and performance targets and helps F5 Support diagnose issues. |
-| Product Usage | Data is sent daily or when Send Usage is selected from the Licenses page in the web interface or initiated using the API. (Requires a [JWT license]({{< ref "/nim/admin-guide/license/add-license.md#jwt-license" >}}).) | To track and report commercial usage in accordance with entitlement and Flexible Consumption Program (FCP) requirements. |
+| Product Usage | Data is sent daily or when Send Usage is selected from the Licenses page in the web interface or initiated using the API. (Requires a [JWT license]({{< ref "/nim/admin-guide/add-license.md#jwt-license" >}}).) | To track and report commercial usage in accordance with entitlement and Flexible Consumption Program (FCP) requirements. |
 
 {{</bootstrap-table>}}
 
 ### Enable or disable telemetry
 
-Once you [apply a valid license]({{< ref "/nim/admin-guide/license/add-license.md" >}}), telemetry data starts transmitting. If the license is applied immediately after installation, the *Installation* data point is also sent.
+Once you [apply a valid license]({{< ref "/nim/admin-guide/add-license.md" >}}), telemetry data starts transmitting. If the license is applied immediately after installation, the *Installation* data point is also sent.
 
 #### Disable telemetry
 
diff --git a/content/nim/system-configuration/configure-vault.md b/content/nim/system-configuration/configure-vault.md
index 1400edeac..5f61cd308 100644
--- a/content/nim/system-configuration/configure-vault.md
+++ b/content/nim/system-configuration/configure-vault.md
@@ -1,6 +1,6 @@
 ---
 docs: DOCS-999
-title: Configure Vault for storing secrets
+title: Use Vault for storing secrets
 toc: true
 weight: 200
 type:
diff --git a/content/nim/system-configuration/configure-with-config.md b/content/nim/system-configuration/configure-with-config.md
index 87f54ba33..18db798ca 100644
--- a/content/nim/system-configuration/configure-with-config.md
+++ b/content/nim/system-configuration/configure-with-config.md
@@ -1,7 +1,7 @@
 ---
 description: ''
 docs: DOCS-1100
-title: Configure NGINX Instance Manager with nms.conf
+title: Configure settings with nms.conf
 toc: true
 weight: 1
 type:
diff --git a/content/nim/system-configuration/secure-traffic.md b/content/nim/system-configuration/secure-traffic.md
index aacba1d61..a4d03c4bf 100644
--- a/content/nim/system-configuration/secure-traffic.md
+++ b/content/nim/system-configuration/secure-traffic.md
@@ -1,6 +1,6 @@
 ---
 docs: DOCS-794
-title: Secure Client Access and Network Traffic
+title: Secure client access and network traffic
 toc: true
 weight: 600
 type:
@@ -468,7 +468,7 @@ To generate the necessary certificates, follow these steps. You can modify these
 ## Configure SSL verification for usage reporting with self-signed certificates {#configure-ssl-verify}
 
 {{<call-out "note" "Version requirements" "">}}
-Usage reporting for NGINX Plus R33 or later in network-restricted environments requires **NGINX Instance Manager version 2.18 or later**.
+Usage reporting for NGINX Plus R33 or later in disconnected environments requires **NGINX Instance Manager version 2.18 or later**.
 {{</call-out>}}
 
 Starting with NGINX Plus R33, NGINX Plus must report usage data to a reporting endpoint, such as NGINX Instance Manager. For more information, see [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md" >}}).
diff --git a/content/nms/acm/how-to/deploy-api-connectivity-manager.md b/content/nms/acm/how-to/deploy-api-connectivity-manager.md
index b8a4a8352..70e2dd054 100644
--- a/content/nms/acm/how-to/deploy-api-connectivity-manager.md
+++ b/content/nms/acm/how-to/deploy-api-connectivity-manager.md
@@ -198,7 +198,7 @@ If you've already deployed API Connectivity Manager and would like to upgrade to
 
 A valid license is required to make full use of all the features in API Connectivity Manager.
 
-Refer to the [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license.
+Refer to the [Add a License]({{< ref "/nim/admin-guide/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license.
 
 ---
 
diff --git a/content/nms/acm/how-to/install-acm.md b/content/nms/acm/how-to/install-acm.md
index 3aa0e760f..264143d9a 100644
--- a/content/nms/acm/how-to/install-acm.md
+++ b/content/nms/acm/how-to/install-acm.md
@@ -81,7 +81,7 @@ type:
 
 A valid license is required to make full use of all the features in API Connectivity Manager.
 
-Refer to the [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license.
+Refer to the [Add a License]({{< ref "/nim/admin-guide/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license.
 
 ---
 
diff --git a/content/nms/acm/tutorials/advanced-routing.md b/content/nms/acm/tutorials/advanced-routing.md
index 0531a0eb1..8977fbe40 100644
--- a/content/nms/acm/tutorials/advanced-routing.md
+++ b/content/nms/acm/tutorials/advanced-routing.md
@@ -43,7 +43,7 @@ In the steps that follow, we will:
 
 To complete the instructions in this guide, you need the following:
 
-- [API Connectivity Manager is installed]({{< ref "/nms/acm/how-to/install-acm.md" >}}), [licensed]({{< ref "/nim/admin-guide/license/add-license.md" >}}), and running
+- [API Connectivity Manager is installed]({{< ref "/nms/acm/how-to/install-acm.md" >}}), [licensed]({{< ref "/nim/admin-guide/add-license.md" >}}), and running
 - One or more [Service workspaces]({{< ref "/nms/acm/how-to/services/publish-api.md#create-a-service-workspace" >}})
 - One or more [Proxies]({{< ref "/nms/acm/how-to/services/publish-api.md" >}})
 
diff --git a/content/solutions/about-subscription-licenses.md b/content/solutions/about-subscription-licenses.md
index 1e942a09c..6fb2e484f 100644
--- a/content/solutions/about-subscription-licenses.md
+++ b/content/solutions/about-subscription-licenses.md
@@ -140,12 +140,12 @@ The instructions below use the terms "internet-connected" and "network-restricte
 
 #### License NGINX Instance Manager
 
-- **Internet-connected**: Follow the steps in [Add license]({{< ref "nim/admin-guide/license/add-license.md" >}}).
+- **Internet-connected**: Follow the steps in [Add license]({{< ref "nim/admin-guide/add-license.md" >}}).
 - **Network-restricted**: Follow the steps in [Add a license in a disconnected environment]({{< ref "nim/disconnected/add-license-disconnected-deployment.md" >}}).
 
 #### Submit usage reports to F5 from NGINX Instance Manager {#submit-usage-reports-from-nim}
 
-- **Internet-connected**: Follow the steps in [Report usage to F5]({{< ref "nim/admin-guide/license/report-usage-connected-deployment.md" >}}).
+- **Internet-connected**: Follow the steps in [Report usage to F5]({{< ref "nim/admin-guide/report-usage-connected-deployment.md" >}}).
 - **Network-restricted**: Follow the steps in [Report usage to F5 in a disconnected environment]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}).
 
 ### NGINX App Protect WAF
diff --git a/layouts/shortcodes/clickhouse-version.html b/layouts/shortcodes/clickhouse-version.html
new file mode 100644
index 000000000..bd2a1af86
--- /dev/null
+++ b/layouts/shortcodes/clickhouse-version.html
@@ -0,0 +1 @@
+24.8.12.28
\ No newline at end of file
diff --git a/layouts/shortcodes/lightweight-nim-nginx-agent-version.html b/layouts/shortcodes/lightweight-nim-nginx-agent-version.html
new file mode 100644
index 000000000..fe35b6ea2
--- /dev/null
+++ b/layouts/shortcodes/lightweight-nim-nginx-agent-version.html
@@ -0,0 +1 @@
+2.41.1 or later
\ No newline at end of file
diff --git a/static/scripts/docker-compose/docker-compose-lightweight.yaml b/static/scripts/docker-compose/docker-compose-lightweight.yaml
new file mode 100644
index 000000000..a88759453
--- /dev/null
+++ b/static/scripts/docker-compose/docker-compose-lightweight.yaml
@@ -0,0 +1,93 @@
+name: nim
+secrets:
+  nim_admin_password:
+    file: admin_password.txt
+  # Optional: set admin and user credentials from a .htpasswd file.
+  #nim_credential_file:
+  #  file: nim_creds.txt
+  # Optional: set external SSL certificate, key, and CA in PEM format for the NIM ingress proxy.
+  #nim_proxy_cert_file:
+  #  file: ./certs/nim_cert.pem
+  #nim_proxy_cert_key:
+  #  file: ./certs/nim_key.pem
+  #nim_proxy_ca_cert:
+  #  file: ./certs/nim_ca.pem
+services:
+  nim:
+    image: private-registry.nginx.com/nms/nim-standalone-compose:2.20.0
+    hostname: nim
+    ports:
+      - 443:443
+    networks:
+      - external_network
+    volumes:
+      - nim-data:/data
+      - proxy-certs:/usr/local/share/ca-certificates
+    # Uncomment to set custom service limits.
+    #deploy:
+    #  resources:
+    #    limits:
+    #      cpus: '0.5'
+    #      memory: '512M'
+    restart: no
+    healthcheck:
+      test: ["CMD", "sh", "/etc/nms/scripts/health.sh"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    stop_grace_period: 30s
+    secrets:
+      - nim_admin_password
+      # Uncomment this line if you use a .htpasswd credential file. The credential file takes priority over the nim_admin_password file.
+      #- nim_credential_file
+      # Uncomment these lines to use user-provided certificate, key, and CA for the NIM ingress proxy.
+      #- nim_proxy_cert_file
+      #- nim_proxy_cert_key
+      #- nim_proxy_ca_cert
+    environment:
+      # Set the NIM logging level.
+      NIM_LOG_LEVEL: "INFO"
+      # Set a custom time-to-live value (in days) for metrics retention.
+      NIM_METRICS_TTL: "1"
+      # Set a custom time-to-live value (in days) for event retention.
+      NIM_EVENTS_TTL: "1"
+      # Set a custom time-to-live value (in days) for security violation retention.
+      NIM_SECURITY_TTL: "1"
+      # Enable maintenance mode to perform backup, restore, and troubleshooting.
+      #NIM_MAINTENANCE: "true"
+      # Set a custom watchdog timeout (in seconds).
+      NIM_WATCHDOG_TIMEOUT: "60"
+      # Set the NIM license mode to connected or disconnected. Default is connected.
+      NIM_LICENSE_MODE_OF_OPERATION: "connected"
+      # Enable basic proxy support.
+      PROXY_ENABLE: false
+      # Configure the proxy server host.
+      PROXY_HOST: ""
+      # Configure the proxy server protocol (http or https). Default is http.
+      PROXY_PROTOCOL: "http"
+      # Configure the proxy server port.
+      PROXY_PORT: 3128
+      # Enable basic authentication for the proxy.
+      PROXY_AUTH_REQUIRED: false
+      # Configure proxy username for basic authentication (required when proxy_auth_required is true).
+      PROXY_AUTH_USERNAME: ""
+      # Configure proxy password for basic authentication (required when proxy_auth_required is true).
+      # We recommend using a .env file for the password.
+      # PROXY_PASSWORD: ""
+      # Configure proxy SSL verification to trust the proxy server.
+      PROXY_SSL_VERIFY: true
+      ENABLE_METRICS: false
+networks:
+  external_network:
+    driver: bridge
+volumes:
+  # By default, Docker Compose creates a named volume.
+  # For additional storage options such as NFS, see https://docs.docker.com/reference/compose-file/volumes/.
+  proxy-certs:
+    driver: local
+  nim-data:
+    driver: local
+    #driver_opts:
+    #  type: "nfs"
+    #  o: "addr=172.16.0.92,rw"
+    #  device: ":/mnt/nfs_share/data"
\ No newline at end of file
diff --git a/static/scripts/install-nim-bundle.sh b/static/scripts/install-nim-bundle.sh
index 105399f0f..7dc020eac 100755
--- a/static/scripts/install-nim-bundle.sh
+++ b/static/scripts/install-nim-bundle.sh
@@ -19,29 +19,116 @@ NGINX_CERT_PATH="/etc/ssl/nginx/nginx-repo.crt"
 NGINX_CERT_KEY_PATH="/etc/ssl/nginx/nginx-repo.key"
 LICENSE_JWT_PATH=""
 USE_NGINX_PLUS="false"
-USE_SM_MODULE="false"
 UNINSTALL_NIM="false"
 MODE="online"
 INSTALL_PATH=""
-NIM_VERSION="latest"
-NGINX_VERSION="latest"
-NGINX_PLUS_VERSION="latest"
-NIM_SM_VERSION="latest"
-CLICKHOUSE_VERSION="latest"
-CLICKHOUSE_LATEST_VERSION="24.9.2.42"
-NGINX_LATEST_VERSION=1.27.3-1
-NIM_LATEST_VERSION=2.19.1
+SKIP_CLICKHOUSE_INSTALL="false"
 CURRENT_TIME=$(date +%s)
 TEMP_DIR="/tmp/${CURRENT_TIME}"
 TARGET_DISTRIBUTION=""
-PACKAGE_INSTALLER=""
 NMS_NGINX_MGMT_BLOCK="mgmt { \n  usage_report endpoint=127.0.0.1 interval=30m; \n  ssl_verify off; \n}";
 NIM_FQDN=""
-NIM_CERTS_DIR="/etc/nms/certs"
-# Added to account for the renaming of the adc dimension from application to app.
-if [ -f "/usr/share/nms/catalogs/dimensions/application.yml" ]; then
-    rm /usr/share/nms/catalogs/dimensions/application.yml
-fi
+OS_ARCH="amd64"
+UBUNTU_2004="ubuntu20.04"
+UBUNTU_2204="ubuntu22.04"
+UBUNTU_2404="ubuntu24.04"
+DEBIAN_11="debian11"
+DEBIAN_12="debian12"
+CENTOS_8="centos8"
+REDHAT_8="rhel8"
+REDHAT_9="rhel9"
+ORACLE_8="oracle8"
+ORACLE_9="oracle9"
+CLICKHOUSE_VERSION="24.9.2.42"
+PKG_EXTENSION="deb"
+UBUNTU_OS=(
+    "${UBUNTU_2004}"
+    "${UBUNTU_2204}"
+    "${UBUNTU_2404}"
+)
+DEB_OS=(
+    "${DEBIAN_11}"
+    "${DEBIAN_12}"
+)
+CENT_OS=(
+    "${CENTOS_8}"
+)
+RPM_OS=(
+    "${REDHAT_8}"
+    "${REDHAT_9}"
+    "${ORACLE_8}"
+    "${ORACLE_9}"
+)
+SUPPORTED_OS=()
+SUPPORTED_OS+=("${DEB_OS[@]}")
+SUPPORTED_OS+=("${RPM_OS[@]}")
+SUPPORTED_OS+=("${CENT_OS[@]}")
+SUPPORTED_OS+=("${UBUNTU_OS[@]}")
+
+declare -A OS_DISTRO_MAP
+OS_DISTRO_MAP['ubuntu20.04']="focal"
+OS_DISTRO_MAP['ubuntu22.04']="jammy"
+OS_DISTRO_MAP['ubuntu24.04']="noble"
+OS_DISTRO_MAP['debian11']="bullseye"
+OS_DISTRO_MAP['debian12']="bookworm"
+OS_DISTRO_MAP['centos8']=".el8.ngx.x86_64"
+OS_DISTRO_MAP['rhel8']=".el8.ngx.x86_64"
+OS_DISTRO_MAP['rhel9']=".el9.ngx.x86_64"
+OS_DISTRO_MAP['oracle8']=".el8.ngx.x86_64"
+OS_DISTRO_MAP['oracle9']=".el9.ngx.x86_64"
+OS_DISTRO_MAP['amzn2']=".amzn2.ngx.x86_64"
+
+declare -A NGINX_PLUS_REPO
+NGINX_PLUS_REPO['ubuntu20.04']="https://pkgs.nginx.com/plus/ubuntu/pool/nginx-plus/n/nginx-plus"
+NGINX_PLUS_REPO['ubuntu22.04']="https://pkgs.nginx.com/plus/ubuntu/pool/nginx-plus/n/nginx-plus"
+NGINX_PLUS_REPO['ubuntu24.04']="https://pkgs.nginx.com/plus/ubuntu/pool/nginx-plus/n/nginx-plus"
+NGINX_PLUS_REPO['debian11']="https://pkgs.nginx.com/plus/debian/pool/nginx-plus/n/nginx-plus"
+NGINX_PLUS_REPO['debian12']="https://pkgs.nginx.com/plus/debian/pool/nginx-plus/n/nginx-plus"
+NGINX_PLUS_REPO['centos8']="https://pkgs.nginx.com/plus/centos/8/x86_64/RPMS"
+NGINX_PLUS_REPO['rhel8']="https://pkgs.nginx.com/plus/rhel/8/x86_64/RPMS"
+NGINX_PLUS_REPO['rhel9']="https://pkgs.nginx.com/plus/rhel/9/x86_64/RPMS"
+NGINX_PLUS_REPO['oracle8']="https://pkgs.nginx.com/plus/rhel/8/x86_64/RPMS"
+NGINX_PLUS_REPO['oracle9']="https://pkgs.nginx.com/plus/rhel/9/x86_64/RPMS"
+NGINX_PLUS_REPO['amzn2']="https://pkgs.nginx.com/plus/amzn2/2/x86_64/RPMS"
+
+declare -A NIM_REPO
+NIM_REPO['ubuntu20.04']="https://pkgs.nginx.com/nms/ubuntu/pool/nginx-plus/n/nms-instance-manager"
+NIM_REPO['ubuntu22.04']="https://pkgs.nginx.com/nms/ubuntu/pool/nginx-plus/n/nms-instance-manager"
+NIM_REPO['ubuntu24.04']="https://pkgs.nginx.com/nms/ubuntu/pool/nginx-plus/n/nms-instance-manager"
+NIM_REPO['debian11']="https://pkgs.nginx.com/nms/debian/pool/nginx-plus/n/nms-instance-manager"
+NIM_REPO['debian12']="https://pkgs.nginx.com/nms/debian/pool/nginx-plus/n/nms-instance-manager"
+NIM_REPO['centos8']="https://pkgs.nginx.com/nms/centos/8/x86_64/RPMS"
+NIM_REPO['rhel8']="https://pkgs.nginx.com/nms/centos/8/x86_64/RPMS"
+NIM_REPO['rhel9']="https://pkgs.nginx.com/nms/centos/9/x86_64/RPMS"
+NIM_REPO['oracle8']="https://pkgs.nginx.com/nms/centos/8/x86_64/RPMS"
+NIM_REPO['oracle9']="https://pkgs.nginx.com/nms/centos/9/x86_64/RPMS"
+NIM_REPO['amzn2']="https://pkgs.nginx.com/nms/amzn2/2/x86_64/RPMS"
+
+declare -A NGINX_REPO
+NGINX_REPO['ubuntu20.04']="https://nginx.org/packages/mainline/ubuntu/pool/nginx/n/nginx"
+NGINX_REPO['ubuntu22.04']="https://nginx.org/packages/mainline/ubuntu/pool/nginx/n/nginx"
+NGINX_REPO['ubuntu24.04']="https://nginx.org/packages/mainline/ubuntu/pool/nginx/n/nginx"
+NGINX_REPO['debian11']="https://nginx.org/packages/mainline/debian/pool/nginx/n/nginx"
+NGINX_REPO['debian12']="https://nginx.org/packages/mainline/debian/pool/nginx/n/nginx"
+NGINX_REPO['centos8']="https://nginx.org/packages/mainline/centos/8/x86_64/RPMS"
+NGINX_REPO['rhel8']="https://nginx.org/packages/mainline/rhel/8/x86_64/RPMS"
+NGINX_REPO['rhel9']="https://nginx.org/packages/mainline/rhel/9/x86_64/RPMS"
+NGINX_REPO['oracle8']="https://nginx.org/packages/mainline/rhel/8/x86_64/RPMS"
+NGINX_REPO['oracle9']="https://nginx.org/packages/mainline/rhel/9/x86_64/RPMS"
+NGINX_REPO['amzn2']="https://nginx.org/packages/mainline/amzn2/2/x86_64/RPMS"
+
+declare -A CLICKHOUSE_REPO
+CLICKHOUSE_REPO['ubuntu20.04']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse"
+CLICKHOUSE_REPO['ubuntu22.04']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse"
+CLICKHOUSE_REPO['ubuntu24.04']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse"
+CLICKHOUSE_REPO['debian11']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse"
+CLICKHOUSE_REPO['debian12']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse"
+CLICKHOUSE_REPO['centos8']="https://packages.clickhouse.com/rpm/stable"
+CLICKHOUSE_REPO['rhel8']="https://packages.clickhouse.com/rpm/stable"
+CLICKHOUSE_REPO['rhel9']="https://packages.clickhouse.com/rpm/stable"
+CLICKHOUSE_REPO['oracle8']="https://packages.clickhouse.com/rpm/stable"
+CLICKHOUSE_REPO['oracle9']="https://packages.clickhouse.com/rpm/stable"
+CLICKHOUSE_REPO['amzn2']="https://packages.clickhouse.com/rpm/stable"
 
 set -o pipefail
 
@@ -56,7 +143,16 @@ check_last_command_status(){
    fi
 }
 
-generate() {
+url_file_download() {
+  url=$1
+  dest=$2
+  if ! http_code=$(curl -fs "${url}" --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} --output "${dest}" --write-out '%{http_code}'); then
+    echo "-- Failed to download $url with HTTP code $http_code. Exiting."
+    exit 1
+  fi
+}
+
+generate_admin_password() {
     character_pool='A-Za-z0-9'
     password_length=30
     admin_password=$(LC_ALL=C tr -dc "$character_pool" </dev/urandom | head -c $password_length)
@@ -72,45 +168,7 @@ generate() {
     echo "admin:${encrypted_password}">/etc/nms/nginx/.htpasswd
 }
 
-updateClickhouseConfig(){
-  if  [ ! -f "/etc/clickhouse-server/conf.d/nms-clickhouse.conf" ] ; then
-    if [ ! -d "/etc/clickhouse-server/conf.d/" ]; then
-      mkdir -p "/etc/clickhouse-server/conf.d"
-    fi
-cat <<EOL >> /etc/clickhouse-server/conf.d/nms-clickhouse.conf
- <clickhouse>
-    <max_concurrent_queries>{{ 2 * number_of_cpu_cores }}</max_concurrent_queries>
-    <max_waiting_queries>5</max_waiting_queries>
-    <max_connections>100</max_connections>
-    <!--- Lower mark cache size from 5GB to 1GB. --->
-    <mark_cache_size>1073741824</mark_cache_size>
-    <!--- Wait up to 1000ms. --->
-    <queue_max_wait_ms>1000</queue_max_wait_ms>
-    <!-- maximum query execution time in seconds -->
-    <max_execution_time>10</max_execution_time>
-    <!-- maximum number of threads that could be allocated from the OS and used for query execution and background operations, default 10000 -->
-    <max_thread_pool_size>100</max_thread_pool_size>
-    <thread_pool_queue_size>max_thread_pool_size</thread_pool_queue_size>
-    <-- number of seconds that clickHouse waits for incoming requests before closing the connection. Defaults to 10 seconds. -->
-    <keep_alive_timeout>5</keep_alive_timeout>
-    <maximal number of requests through a single keep-alive connection until it will be closed by clickHouse server. Default to 10000.-->
-    <max_keep_alive_requests>100</max_keep_alive_requests>
-    <profiles>
-      <default>
-        <!--sets the number of threads performing background merges and mutations for tables with MergeTree engines. default value 16-->
-        <background_pool_size>4</background_pool_size>
-        <!-- number of rows that are read from the merged parts into memory. choose a value from 1024 and 4096.The default is 8192.-->
-        <merge_max_block_size>1024</merge_max_block_size>
-        <max_bytes_to_merge_at_max_space_in_pool>1073741824</max_bytes_to_merge_at_max_space_in_pool>
-        <number_of_free_entries_in_pool_to_lower_max_size_of_merge>0</number_of_free_entries_in_pool_to_lower_max_size_of_merge>
-      </default>
-    </profiles>
-  </clickhouse>
-EOL
-fi
-}
-
-createNginxMgmtFile(){
+create_nginx_mgmt_file(){
   # Check if the mgmt block exists in the file
     if grep -Eq '^[[:space:]]*mgmt' "/etc/nginx/nginx.conf"; then
         printf "Nginx 'mgmt' block found, skipping addition of nginx 'mgmt' block"
@@ -126,43 +184,6 @@ createNginxMgmtFile(){
     fi
 }
 
-findVersionForPackage(){
-   pkg_name=$1
-   pkg_version=$2
-   if [ "${PACKAGE_INSTALLER}" == "apt" ]; then
-     readarray -t versions < <(apt-cache madison "${pkg_name}" | grep "${pkg_version}" | cut -d '|' -f2 | tr -d ' ')
-     #readarray -t versions < <(echo "${available_versions[@]}"| grep "${pkg_version}") >&2
-   else
-     if [[ "$pkg_name" == "nginx" ]]; then
-      readarray -t versions < <(yum list "${pkg_name}" --repo nginx-stable --showduplicates | grep "${pkg_version}" | cut -d' ' -f2)
-     else
-      readarray -t versions < <(yum list "${pkg_name}" --showduplicates | grep "${pkg_version}" | tr -s ' ' | cut -d' ' -f2)
-     fi
-     #readarray -t versions < <(echo "${available_versions[@]}"| grep "${pkg_version}" | cut -d' ' -f2) >&2
-   fi
-   # Print the array contents
-   versions_count=${#versions[@]}
-   if [ "${versions_count}" -eq 0 ]; then
-      printf "Package %s with version %s not found. See available versions:" "${pkg_name}" "${pkg_version}"
-      if [ "${PACKAGE_INSTALLER}" == "apt" ]; then
-        apt-cache madison "${pkg_name}"
-      else
-        yum list "${pkg_name}" --showduplicates
-      fi
-      exit 110
-   elif [ "${versions_count}" -gt 1 ]; then
-      printf "Multiple versions found for the package %s. Select your desired version:\n" "${pkg_name}" >&2
-      for i in "${!versions[@]}"; do
-          printf "%s: %s\n" "$i" "${versions[$i]}" >&2
-      done
-      read -rp "" index
-      echo "${versions[$index]}"
-   else
-      echo "${pkg_name} with version ${pkg_version} found">&2
-      echo "${versions[0]}"
-   fi
-}
-
 debian_install_nginx(){
     apt-get update \
         && DEBIAN_FRONTEND=noninteractive \
@@ -210,40 +231,15 @@ debian_install_nginx(){
     fi
     url_file_download "https://cs.nginx.com/static/files/90pkgs-nginx" "/etc/apt/apt.conf.d/90pkgs-nginx"
     check_last_command_status "curl https://cs.nginx.com/static/files/90pkgs-nginx" $?
-
     apt-get update
-
     if [ "${USE_NGINX_PLUS}" == "true" ]; then
-      printf "Installing NGINX Plus...\n"
-      if [ "${NGINX_PLUS_VERSION}" == "latest" ]; then
-        apt-get install -y nginx-plus
-      else
-        package_version=$(findVersionForPackage "nginx-plus" "${NGINX_PLUS_VERSION}")
-        cmd_status=$?
-        if [ $cmd_status -ne 0 ]; then
-          echo "Package nginx-plus with version ${NGINX_PLUS_VERSION} not found"
-          exit $cmd_status
-        fi
-        apt-get install -y nginx-plus="${package_version}"
-        check_last_command_status "apt-get install -y nginx-plus=${package_version}" $?
-      fi
-      createNginxMgmtFile
+        printf "Installing NGINX Plus...\n"
+        DEBIAN_FRONTEND=noninteractive apt-get install -y nginx-plus
+        create_nginx_mgmt_file
     else
-      printf "Installing NGINX...\n"
-      if [ "${NGINX_VERSION}" == "latest" ]; then
-          apt install -y nginx
-          check_last_command_status "apt-get install -y nginx" $?
-      else
-          package_version=$(findVersionForPackage "nginx" "${NGINX_VERSION}")
-          cmd_status=$?
-          if [ $cmd_status -ne 0 ]; then
-            echo "Package nginx with version ${NGINX_VERSION} not found"
-            exit $cmd_status
-          fi
-          echo "Installing nginx version ${package_version}"
-          apt-get install -y nginx="${package_version}"
-          check_last_command_status "apt-get install -y nginx='${package_version}'" $?
-      fi
+        printf "Installing NGINX...\n"
+        DEBIAN_FRONTEND=noninteractive apt install -y nginx
+        check_last_command_status "apt-get install -y nginx" $?
     fi
 }
 
@@ -252,52 +248,36 @@ debian_install_clickhouse(){
           | sudo tee /usr/share/keyrings/clickhouse-keyring.gpg >/dev/null
     check_last_command_status "curl https://packages.clickhouse.com/rpm/lts/repodata/repomd.xml.key" $?
 
-    echo "deb [signed-by=/usr/share/keyrings/clickhouse-keyring.gpg] https://packages.clickhouse.com/deb stable main" | sudo tee \
+    echo "deb [signed-by=/usr/share/keyrings/clickhouse-keyring.gpg arch=${OS_ARCH}] https://packages.clickhouse.com/deb stable main" | sudo tee \
       /etc/apt/sources.list.d/clickhouse.list
     apt-get update
-
-    printf "Installing clickhouse....\n"
-    if [ "${CLICKHOUSE_VERSION}" == "latest" ]; then
-      DEBIAN_FRONTEND=noninteractive  apt-get install -y clickhouse-common-static clickhouse-server clickhouse-client
-      check_last_command_status "apt-get install -y clickhouse-server clickhouse-client" $?
-    else
-      ch_version=$(findVersionForPackage "clickhouse-server" "${CLICKHOUSE_VERSION}")
-      cmd_status=$?
-      if [ $cmd_status -ne 0 ]; then
-        echo "Package clickhouse-server with version ${CLICKHOUSE_VERSION} not found"
-        exit $cmd_status
-      fi
-      echo "Installing clickhouse-server with version ${ch_version}"
-      DEBIAN_FRONTEND=noninteractive apt-get install -y clickhouse-common-static="${ch_version}" clickhouse-server="${ch_version}"
-      DEBIAN_FRONTEND=noninteractive apt-get install -y clickhouse-client
-      check_last_command_status "apt-get install -y clickhouse-server=${ch_version}" $?
-    fi
+    echo "Installing clickhouse-server with version ${CLICKHOUSE_VERSION}"
+    DEBIAN_FRONTEND=noninteractive apt-get install -y clickhouse-common-static="${CLICKHOUSE_VERSION}" clickhouse-server="${CLICKHOUSE_VERSION}"
+    DEBIAN_FRONTEND=noninteractive apt-get install -y clickhouse-client="${CLICKHOUSE_VERSION}"
+    check_last_command_status "apt-get install -y clickhouse-server=${CLICKHOUSE_VERSION}" $?
 }
 
 debian_install_nim(){
 
-  echo "Installing NGINX Instance Manager..."
-  if [ "${NIM_VERSION}" == "latest" ]; then
-    apt-get install -y nms-instance-manager
-    check_last_command_status "installing NGINX Instance Manager" $?
-  else
-    package_version=$(findVersionForPackage "nms-instance-manager" "${NIM_VERSION}")
-    cmd_status=$?
-    if [ $cmd_status -ne 0 ]; then
-       echo "Package nms-instance-manager with version ${NIM_VERSION} not found"
-       exit $cmd_status
-    fi
-    apt-get install -y nms-instance-manager="${package_version}"
-    check_last_command_status "apt-get install -y nms-instance-manager=${package_version}" $?
+  if [ "${SKIP_CLICKHOUSE_INSTALL}" == "true" ]; then
+    echo "SKIP_CLICKHOUSE_INSTALL = ${SKIP_CLICKHOUSE_INSTALL} | blocking clickhouse-server to be installed"
+    echo "apt-mark hold clickhouse-server"
+    apt-mark hold clickhouse-server
   fi
 
-  echo "Enabling clickhouse-server..."
-  systemctl enable clickhouse-server
-  check_last_command_status "systemctl enable clickhouse-server" $?
+  echo "Installing NGINX Instance Manager..."
+  DEBIAN_FRONTEND=noninteractive apt-get install -y nms-instance-manager
+  check_last_command_status "installing NGINX Instance Manager" $?
 
-  echo "Starting clickhouse-server..."
-  systemctl start clickhouse-server
-  check_last_command_status "systemctl start clickhouse-server" $?
+  if [ "${SKIP_CLICKHOUSE_INSTALL}" == "false" ]; then
+      echo "Enabling clickhouse-server..."
+      systemctl enable clickhouse-server
+      check_last_command_status "systemctl enable clickhouse-server" $?
+
+      echo "Starting clickhouse-server..."
+      systemctl start clickhouse-server
+      check_last_command_status "systemctl start clickhouse-server" $?
+  fi
 
   echo "Starting nginx..."
   systemctl start nginx
@@ -305,6 +285,8 @@ debian_install_nim(){
 
   echo "Starting NGINX Instance Manager..."
   systemctl start nms
+
+  sleep 5
   check_last_command_status " systemctl start nms" $?
   echo "Installation is complete"
 
@@ -329,40 +311,13 @@ installBundleForDebianDistro() {
       "${NIM_USER}" >/dev/null
   fi
   debian_install_nginx
-  debian_install_clickhouse
-  debian_install_nim
-  echo "security module installation opted : ${USE_SM_MODULE}"
-  if [ "${USE_SM_MODULE}" == "true" ]; then
-      nim_major_version=$(nms-core --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | awk -F. '{print $1}')
-      nim_minor_version=$(nms-core --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | awk -F. '{print $2}')
-      echo "Installed NIM major Version: ${nim_major_version}, minor Version:${nim_minor_version}"
-      if [[ $nim_major_version -ge 2 && $nim_minor_version -ge 19 ]]; then
-        echo "Note: NGINX Instance Manager version 2.19.0 or later comes with security monitoring installed. skipping installing security monitoring"
-      else
-        printf "Installing security module...\n"
-        if [ "${NIM_SM_VERSION}" == "latest" ]; then
-          apt-get install -y nms-sm
-          check_last_command_status "apt-get install -y nms-sm" $?
-        else
-          sm_pkg_version=$(findVersionForPackage "nms-sm" "${NIM_SM_VERSION}")
-          cmd_status=$?
-          if [ $cmd_status -ne 0 ]; then
-             echo "Package nms-sm with version ${NIM_SM_VERSION} not found"
-             exit $cmd_status
-          fi
-          apt-get install -y nms-sm="${sm_pkg_version}"
-          check_last_command_status "apt-get install -y nms-sm=${NIM_SM_VERSION}" $?
-        fi
-        systemctl restart nms
-        sleep 5
-        systemctl restart nginx
-        systemctl start nms-sm
-      fi
-  else
-    systemctl restart nms
-    sleep 5
-    systemctl restart nginx
+  if [[ ${SKIP_CLICKHOUSE_INSTALL} == "false" ]]; then
+      debian_install_clickhouse
   fi
+  debian_install_nim
+  systemctl restart nms
+  sleep 5
+  systemctl restart nginx
 }
 
 installBundleForRPMDistro(){
@@ -407,52 +362,39 @@ installBundleForRPMDistro(){
 
     if [ "${USE_NGINX_PLUS}" == "true" ]; then
          echo "Installing nginx plus..."
-         if [ "${NGINX_PLUS_VERSION}" == "latest" ]; then
-            yum install -y nginx-plus
-            check_last_command_status "yum install -y nginx-plus" $?
-         else
-            nginx_plus_pkg_version=$(findVersionForPackage "nginx-plus" "${NGINX_PLUS_VERSION}")
-            cmd_status=$?
-            if [ $cmd_status -ne 0 ]; then
-               echo "Package nginx-plus with version ${NGINX_PLUS_VERSION} not found"
-               exit $cmd_status
-            fi
-            yum install -y nginx-plus-"${nginx_plus_pkg_version}"
-            check_last_command_status "yum install -y nginx-plus-${nginx_plus_pkg_version}" $?
-         fi
+         yum install -y nginx-plus
+         check_last_command_status "yum install -y nginx-plus" $?
          createNginxMgmtFile
     else
          echo "Installing nginx..."
-         if [ "${NGINX_VERSION}" == "latest" ]; then
-            yum install -y nginx --repo nginx-stable
-            check_last_command_status "yum install -y nginx" $?
-         else
-            nginx_pkg_version=$(findVersionForPackage "nginx" "${NGINX_VERSION}")
-            cmd_status=$?
-            if [ $cmd_status -ne 0 ]; then
-               echo "Package nginx with version ${NGINX_VERSION} not found"
-               exit $cmd_status
-            fi
-            yum install -y nginx-"${nginx_pkg_version}" --repo nginx-stable
-            check_last_command_status "yum install -y nginx-${nginx_pkg_version}" $?
-       fi
+         yum install -y nginx --repo nginx-stable
+         check_last_command_status "yum install -y nginx" $?
     fi
     echo "Enabling nginx service"
     systemctl enable nginx.service
     check_last_command_status "systemctl enable nginx.service" $?
 
-    yum-config-manager --add-repo https://packages.clickhouse.com/rpm/clickhouse.repo
-    echo "Installing clickhouse-server and clickhouse-client"
-    yum install -y clickhouse-server clickhouse-client
-    check_last_command_status "yum install -y clickhouse-server clickhouse-client" $?
+    if [[ ${SKIP_CLICKHOUSE_INSTALL} == "false" ]]; then
+        yum-config-manager --add-repo https://packages.clickhouse.com/rpm/clickhouse.repo
+        echo "Installing clickhouse-server and clickhouse-client"
 
-    echo "Enabling clickhouse-server"
-    systemctl enable clickhouse-server
-    check_last_command_status "systemctl enable clickhouse-server" $?
+        yum install -y "clickhouse-common-static-${CLICKHOUSE_VERSION}"
+        check_last_command_status "yum install -y clickhouse-common-static-${CLICKHOUSE_VERSION}" $?
 
-    echo "Starting clickhouse-server"
-    systemctl start clickhouse-server
-    check_last_command_status "systemctl start clickhouse-server" $?
+        yum install -y "clickhouse-server-${CLICKHOUSE_VERSION}"
+        check_last_command_status "yum install -y clickhouse-server-${CLICKHOUSE_VERSION}" $?
+
+        yum install -y "clickhouse-client-${CLICKHOUSE_VERSION}"
+        check_last_command_status "yum install -y clickhouse-client-${CLICKHOUSE_VERSION}" $?
+
+        echo "Enabling clickhouse-server"
+        systemctl enable clickhouse-server
+        check_last_command_status "systemctl enable clickhouse-server" $?
+
+        echo "Starting clickhouse-server"
+        systemctl start clickhouse-server
+        check_last_command_status "systemctl start clickhouse-server" $?
+    fi
 
     curl -o /etc/yum.repos.d/nms.repo https://cs.nginx.com/static/files/nms.repo
     check_last_command_status "get -P /etc/yum.repos.d https://cs.nginx.com/static/files/nms.repo" $?
@@ -462,128 +404,53 @@ installBundleForRPMDistro(){
     fi
 
     echo "Installing NGINX Instance Manager"
-    if [ "${NIM_VERSION}" == "latest" ]; then
-      yum install -y nms-instance-manager
-      check_last_command_status "installing nginx-instance-manager(nim)" $?
-    else
-      nim_pkg_version=$(findVersionForPackage "nms-instance-manager" "${NIM_VERSION}")
-      yum install -y nms-instance-manager-"${nim_pkg_version}"
-      check_last_command_status "apt-get install -y nms-instance-manager=${nim_pkg_version}" $?
-    fi
+    yum install -y nms-instance-manager
+    check_last_command_status "installing nginx-instance-manager(nim)" $?
+
     echo "Enabling  nms nms-core nms-dpm nms-ingestion nms-integrations"
     systemctl enable nms nms-core nms-dpm nms-ingestion nms-integrations --now
 
     echo "Restarting NGINX Instance Manager"
     systemctl restart nms
 
-    if [ "${USE_SM_MODULE}" == "true" ]; then
-      nim_major_version=$(nms-core --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | awk -F. '{print $1}')
-      nim_minor_version=$(nms-core --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | awk -F. '{print $2}')
-      echo "Installed NIM major Version: ${nim_major_version}, minor Version:${nim_minor_version}"
-      if [[ $nim_major_version -ge 2 && $nim_minor_version -ge 19 ]]; then
-        echo "Note: NGINX Instance Manager version 2.19.0 or later comes with security monitoring installed. skipping installing security monitoring"
-      else
-        printf "Installing security module...\n"
-        if [ "${NIM_SM_VERSION}" == "latest" ]; then
-          yum install -y nms-sm
-          check_last_command_status "yum install -y nms-sm" $?
-        else
-          sm_pkg_version=$(findVersionForPackage "nms-sm" "${NIM_SM_VERSION}")
-          cmd_status=$?
-          if [ $cmd_status -ne 0 ]; then
-             echo "Package nms-sm with version ${NIM_SM_VERSION} not found"
-             exit $cmd_status
-          fi
-          yum install -y nms-sm="${sm_pkg_version}"
-          check_last_command_status "yum install -y nms-sm=${NIM_SM_VERSION}" $?
-        fi
-        systemctl restart nms
-        sleep 5
-        systemctl restart nginx
-        systemctl start nms-sm
-      fi
-    fi
     sleep 5
     echo "Restarting nginx API gateway"
     systemctl restart nginx
 }
 
-url_file_download() {
-  url=$1
-  dest=$2
-  if ! http_code=$(curl -fs "${url}" --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} --output "${dest}" --write-out '%{http_code}'); then
-    echo "-- Failed to download $url with HTTP code $http_code. Exiting."
-    exit 1
-  fi
-}
-
 install_nim_online(){
   if cat /etc/*-release | grep -iq 'debian\|ubuntu'; then
-    PACKAGE_INSTALLER="apt"
     installBundleForDebianDistro
-    generate
+    generate_admin_password
   elif cat /etc/*-release | grep -iq 'centos\|fedora\|rhel\|Amazon Linux'; then
-    PACKAGE_INSTALLER="rpm"
     installBundleForRPMDistro
-    generate
-
+    generate_admin_password
   else
     printf "Unsupported distribution"
     exit 1
   fi
   if [[ -n ${NIM_FQDN} ]] ; then
-     if [ -d "${NIM_CERTS_DIR}" ]; then
-        echo "removing existing NIM certs"
-        rm -rf "/etc/nms/certs"
-     fi
-     bash -c "source /etc/nms/scripts/certs.sh 0 \"${NIM_FQDN}\" || /etc/nms/scripts/certs.sh 0 ${NIM_FQDN}"
+    echo "Using FQDN - ${NIM_FQDN}"
+    sudo rm -rf /etc/nms/certs/*
+    sudo bash /etc/nms/scripts/certs.sh 0 ${NIM_FQDN}
   fi
+  if [[ ${SKIP_CLICKHOUSE_INSTALL} == "true" ]]; then
+    sed -i '/clickhouse:/a \  enabled: false' /etc/nms/nms.conf
+  fi
+  sudo systemctl restart nms
   curl -s -o /dev/null --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} "https://pkgs.nginx.com/nms/?using_install_script=true&app=nim&mode=online"
 }
 
-printUsageInfo(){
-  echo "Usage: $0 [-c /path/to/nginx-repo.crt] [-k /path/to/nginx-repo.key] [-p nginx_plus_version] [-s security_module_version] -i [installable_tar_file_path] [-n nginx_oss_version] [-m mode(online/offline)] [-d distribution (ubuntu20.04,ubuntu22.04,ubuntu24.04,debian11,debian12,centos8,rhel8,rhel9,oracle7,oracle8,amzn2)] [-h print help]"
-  printf "\n\n  -m  <mode> online/offline. Controls whether to install from the internet or from a package created using this script. \n"
-  printf "\n  -c  /path/to/your/<nginx-repo.crt> file.\n"
-  printf "\n  -k  /path/to/your/<nginx-repo.key> file.\n"
-  printf "\n  -p  <nginx_plus_version>. Include NGINX Plus version to install as an API gateway. Valid values are 'latest' and specific versions like R32. For a list, see https://docs.nginx.com/nginx/releases/. Supersedes -n.\n"
-  printf "\n  -n  <nginx_oss_version>. Provide NGINX OSS version to install as an API gateway. Valid values are 'latest' or a specific version like 1.27.1. Ignored if you use -p to specify an NGINX Plus version. For a list, see https://nginx.org/en/download.html .\n"
-  printf "\n  -s  <security-module-version>. Installs a security module along with NGINX Instance Manager. You can specify latest or a version specified in https://docs.nginx.com/nginx-instance-manager/monitoring/security-monitoring/releases/release-notes/.\n"
-  printf "\n  -i  <installable_tar_file_path>. Include the path with an archive file to support NGINX Instance Manager installation. Requires -m Offline."
-  printf "\n  -d  <distribution>. Include the label of a distribution. Requires -m Offline. This creates a file with NGINX Instance Manager dependencies and NGINX Instance Manager install packages for the specified distribution.\n"
-  printf "\n  -v  <NIM_VERSION>. NGINX Instance Manager version to install/package.\n"
-  printf "\n  -j  <JWT_TOKEN_FILE_PATH>. Path to the JWT token file used for license and usage consumption reporting.\n"
-  printf "\n  -r  To uninstall NGINX Instance Manager and its dependencies. \n"
-  printf "\n  -l  Print supported operating systems.\n"
-  printf "\n  -h  Print this help message.\n"
-  exit 0
-}
-
-printSupportedOS(){
-  printf "This script can be run on the following operating systems"
-  printf "\n  1. ubuntu20.04(focal)"
-  printf "\n  2. ubuntu22.04(jammy)"
-  printf "\n  3. ubuntu24.04(noble)"
-  printf "\n  4. debian11(bullseye)"
-  printf "\n  5. debian12(bookworm)"
-  printf "\n  6. centos8(CentOS 8)"
-  printf "\n  7. rhel8(Redhat Enterprise Linux Version 8)"
-  printf "\n  8. rhel9( Redhat Enterprise Linux Version 9)"
-  printf "\n  9. oracle7(Oracle Linux Version 7)"
-  printf "\n 10. oracle8(Oracle Linux Version 8)"
-  printf "\n 11. amzn2(Amazon Linux 2)\n"
-  exit 0
-}
-
-check_NIM_status(){
-  sleep 5
+check_nim_dashboard_status(){
+  sleep 10
   GREEN='\033[0;32m'
   NC='\033[0m'
 
-  if ! curl -k https://localhost/ui 2>/dev/null | grep -q "NGINX"; then
-    sleep 2
-    if ! curl -k https://localhost/ui 2>/dev/null | grep -q "NGINX"; then
+  if ! curl -k https://localhost/ui/ 2>/dev/null | grep -q "NGINX"; then
+    sleep 60
+    if ! curl -k -v https://localhost/ui/ 2>/dev/null| grep -q "NGINX"; then
     	echo "NGINX Instance Manager failed to start"
+    	cat /var/log/nms/nms.log
       exit 1
     else
       echo -e "${GREEN}NGINX Instance Manager Successfully Started${NC}"
@@ -597,41 +464,12 @@ check_NIM_status(){
   fi
 }
 
-check_cert_key_jwt_path(){
-  if [[ ! -f "$NGINX_CERT_KEY_PATH" ]]; then
-    echo "Error: NGINX key not found. Please give cert path using -k"
-    exit 1
-  fi
-
-  if [[ ! -f "$NGINX_CERT_PATH" ]]; then
-    echo "Error: NGINX cert not found. Please give key path using -c"
-    exit 1
-  fi
-
-  if [[ "$USE_NGINX_PLUS" == true &&  "$NGINX_PLUS_VERSION" == "latest" ]]; then
-    if [[ ! -f "$LICENSE_JWT_PATH" ]]; then
-      echo "Error: JWT License not found. It is required with NGINX plus"
-      exit 1
-    fi
-    echo "Copying jwt"
-    if [ ! -d "/etc/nginx" ]; then
-      mkdir /etc/nginx
-      check_last_command_status "mkdir /etc/nginx" $?
-    fi
-    cp "${LICENSE_JWT_PATH}" "/etc/nginx/license.jwt"
-    check_last_command_status "cp $LICENSE_JWT_PATH /etc/nginx/license.jwt" $?
-  fi
-}
-
-check_if_nim_installed(){
-
+validate_nim_installation(){
   local all_services_present=0
-
   if nms-core --version > /dev/null 2>&1 && nms-dpm --version > /dev/null 2>&1 && nms-integrations --version > /dev/null 2>&1 \
-   && nms-ingestion --version > /dev/null 2>&1 && nginx -version > /dev/null 2>&1; then
+   && nms-ingestion --version > /dev/null 2>&1; then
     all_services_present=1
   fi
-
   if [[ "$all_services_present" == 1 ]]; then
     if [ "$UNINSTALL_NIM" == "true" ]; then
       uninstall_nim
@@ -647,6 +485,30 @@ check_if_nim_installed(){
   fi
 }
 
+validate_nginx_paths(){
+  if [[ ! -f "$NGINX_CERT_KEY_PATH" ]]; then
+    echo "Error: NGINX key not found. Please give key path using -k"
+    exit 1
+  fi
+  if [[ ! -f "$NGINX_CERT_PATH" ]]; then
+    echo "Error: NGINX cert not found. Please give cert path using -c"
+    exit 1
+  fi
+  if [[ "$USE_NGINX_PLUS" == true  ]]; then
+    if [[ ! -f "$LICENSE_JWT_PATH" ]]; then
+      echo "Error: JWT License $LICENSE_JWT_PATH not found. It is required with NGINX plus"
+      exit 1
+    fi
+    echo "Copying jwt"
+    if [ ! -d "/etc/nginx" ]; then
+      mkdir /etc/nginx
+      check_last_command_status "mkdir /etc/nginx" $?
+    fi
+    cp "${LICENSE_JWT_PATH}" "/etc/nginx/license.jwt"
+    check_last_command_status "cp $LICENSE_JWT_PATH /etc/nginx/license.jwt" $?
+  fi
+}
+
 uninstall_nim(){
 
   echo -e "\nAre you ready to remove all packages and files related to NGINX Instance Manager ? \n\
@@ -656,8 +518,11 @@ This action deletes all files in the following directories: /etc/nms , /etc/ngin
 
   if [[ "$response" =~ ^[Yy]$ ]]; then
       # Clickhouse server, Clickhouse client, clickhouse static, nms, nginx
-    systemctl stop clickhouse-server
-    check_last_command_status "systemctl stop clickhouse-server" $?
+    if systemctl status clickhouse-server &> /dev/null; then
+        systemctl stop clickhouse-server
+        check_last_command_status "systemctl stop clickhouse-server" $?
+    fi
+
     systemctl stop nginx
     check_last_command_status "systemctl stop nginx" $?
     systemctl stop nms nms-core nms-dpm nms-ingestion nms-integrations
@@ -687,6 +552,7 @@ This action deletes all files in the following directories: /etc/nms , /etc/ngin
       echo "NGINX Instance Manager Uninstalled successfully"
       exit 0
     else
+      cat /etc/*release
       printf "Unsupported distribution"
       exit 1
     fi
@@ -697,44 +563,270 @@ This action deletes all files in the following directories: /etc/nms , /etc/ngin
   fi
 }
 
-download_third_party_dependencies(){
-  if cat /etc/*-release | grep -iq 'debian\|ubuntu'; then
-      if echo "${target_distribution}" | grep -iq 'debian\|ubuntu'; then
-          mkdir "${TEMP_DIR}/${target_distribution}/keepalived"
-          apt-get install --download-only -o Dir::Cache="${TEMP_DIR}/${target_distribution}/keepalived" keepalived
-      else
-        if command -v docker >/dev/null 2>&1; then
-            mkdir "${TEMP_DIR}/${target_distribution}/keepalived"
-            docker run --rm -it -v "${TEMP_DIR}/${target_distribution}/keepalived":/downloads fedora dnf download --resolve --destdir=/downloads keepalived
-        else
-            echo "Cross platform packing requires Docker. Please install Docker and try again."
+getLatestPkgVersionFromRepo(){
+    repoUrl=$1
+    version=$2
+    pkg_extension=$3
+    if [[ "${pkg_extension}" == "rpm" ]]; then
+        response=$(curl --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} -sL  "${repoUrl}" | awk -F '"' '/href=/ {print $2}' | grep -E "$version"|  sort -t'-' -k4,4V | tac)
+        readarray -t versions < <(printf "%s" "${response}")
+    else
+        response=$(curl --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} -sL  "${repoUrl}" | awk -F '"' '/href=/ {print $2}' | grep -E "$version"|  sort -t'_' -k2,2V | tac)
+        readarray -t versions < <(printf "%s" "${response}")
+    fi
+    if [ "${#versions[@]}" -eq 0 ]; then
+        printf "Package %s not found. See available versions:" "${versions[@]}"
+        exit 1;
+    else
+      echo "${versions[0]}"
+    fi
+  }
+
+package_nim_offline(){
+        if [[ -z ${TARGET_DISTRIBUTION} ]]; then
+            echo "Error: target distribution is required when mode set to offline."
             exit 1
         fi
-      fi
-  elif cat /etc/*-release | grep -iq 'centos\|fedora\|rhel\|Amazon Linux'; then
-      if echo "${target_distribution}" | grep -iq 'centos\|fedora\|rhel\|Amazon Linux'; then
-          mkdir "${TEMP_DIR}/${target_distribution}/keepalived"
-          yumdownloader --destdir="${TEMP_DIR}/${target_distribution}/keepalived" --resolve keepalived
-      else
-          if command -v docker >/dev/null 2>&1; then
-              mkdir -p "${TEMP_DIR}/keepalived"
-              docker run --rm -it -v "${TEMP_DIR}/keepalived":/tmp/nim ubuntu bash -c "apt-get update && mkdir -p /tmp/nim && apt-get install -y --download-only -o Dir::Cache=\"/tmp/nim\" keepalived"
-              mkdir "${TEMP_DIR}/${target_distribution}/keepalived"
-              mv ${TEMP_DIR}/keepalived/archives/* ${TEMP_DIR}/${target_distribution}/keepalived
-          else
-              echo "Cross platform packing requires Docker. Please install Docker and try again."
-              exit 1
+        if [[ !  ${SUPPORTED_OS[*]} =~ ${TARGET_DISTRIBUTION} ]]; then
+            echo "Error: The TARGET_DISTRIBUTION ${TARGET_DISTRIBUTION} is not supported in this script... please select one of the following options - ${SUPPORTED_OS[*]}"
+            exit 1
+        fi
+        if [[ ${RPM_OS[*]} =~ ${TARGET_DISTRIBUTION} || ${CENT_OS[*]} =~ ${TARGET_DISTRIBUTION} ]]; then
+            PKG_EXTENSION="rpm"
+        fi
+        if [[ ! -d "${TEMP_DIR}/${TARGET_DISTRIBUTION}" ]]; then
+            echo "creating ${TEMP_DIR}/${TARGET_DISTRIBUTION}"
+            mkdir -p "${TEMP_DIR}/${TARGET_DISTRIBUTION}"
+        fi
+        CWD=$(pwd)
+        cd "${TEMP_DIR}/${TARGET_DISTRIBUTION}" || echo "directory ${TEMP_DIR} does not exits"
+        if [[ "${USE_NGINX_PLUS}" == "true" ]]; then
+            NGINX_PLUS_PACKAGE="^nginx-plus_[0-9]+-([0-9]+)~${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}_${OS_ARCH}\.${PKG_EXTENSION}$"
+            if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
+               NGINX_PLUS_PACKAGE="^nginx-plus-[0-9]+-([0-9]+)${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}\.${PKG_EXTENSION}$"
+            fi
+            echo "regex for looking latest version : ${NGINX_PLUS_PACKAGE}"
+            NGINX_PLUS_VERSION=$(getLatestPkgVersionFromRepo "${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}" "${NGINX_PLUS_PACKAGE}" "${PKG_EXTENSION}")
+            echo "latest version for nginx_plus is ${NGINX_PLUS_VERSION}"
+            echo "Downloading ${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_PLUS_VERSION}...."
+            curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} "${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_PLUS_VERSION}"
+            check_last_command_status "curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} \"${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_PLUS_VERSION}\"" $?
+        else
+            NGINX_OSS_PACKAGE="^nginx_[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)~${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}_${OS_ARCH}\.${PKG_EXTENSION}$"
+            if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
+              NGINX_OSS_PACKAGE="^nginx-[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}\.${PKG_EXTENSION}$"
+            fi
+            echo "fetching latest version using ${NGINX_OSS_PACKAGE}"
+            NGINX_OSS_VERSION=$(getLatestPkgVersionFromRepo "${NGINX_REPO[${TARGET_DISTRIBUTION}]}" "${NGINX_OSS_PACKAGE}" "${PKG_EXTENSION}")
+            echo "latest version for nginx is ${NGINX_OSS_VERSION}"
+            echo "Downloading ${NGINX_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_OSS_VERSION}...."
+            curl -sfLO "${NGINX_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_OSS_VERSION}"
+            check_last_command_status "curl -sfLO \"${NGINX_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_OSS_VERSION}\"" $?
+        fi
+        if [[ ${SKIP_CLICKHOUSE_INSTALL} == "false" ]]; then
+            CLICKHOUSE_COMMON_PATH="${CLICKHOUSE_REPO[${TARGET_DISTRIBUTION}]}/clickhouse-common-static_${CLICKHOUSE_VERSION}_${OS_ARCH}.${PKG_EXTENSION}"
+            if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
+               CLICKHOUSE_COMMON_PATH="${CLICKHOUSE_REPO[${TARGET_DISTRIBUTION}]}/clickhouse-common-static-${CLICKHOUSE_VERSION}.x86_64.${PKG_EXTENSION}"
+            fi
+            echo "Downloading ${CLICKHOUSE_COMMON_PATH}...."
+            curl -sfLO "${CLICKHOUSE_COMMON_PATH}"
+            check_last_command_status "curl -sfLO \"${CLICKHOUSE_COMMON_PATH}\"" $?
+
+            CLICKHOUSE_SERVER_PATH="${CLICKHOUSE_REPO[${TARGET_DISTRIBUTION}]}/clickhouse-server_${CLICKHOUSE_VERSION}_${OS_ARCH}.${PKG_EXTENSION}"
+            if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
+               CLICKHOUSE_SERVER_PATH="${CLICKHOUSE_REPO[${TARGET_DISTRIBUTION}]}/clickhouse-server-${CLICKHOUSE_VERSION}.x86_64.${PKG_EXTENSION}"
+            fi
+            echo "Downloading ${CLICKHOUSE_SERVER_PATH}...."
+            curl -sfLO  "${CLICKHOUSE_SERVER_PATH}"
+            check_last_command_status "curl -sfLO \"${CLICKHOUSE_SERVER_PATH}\"" $?
+
+            CLICKHOUSE_CLIENT_PATH="${CLICKHOUSE_REPO[${TARGET_DISTRIBUTION}]}/clickhouse-client_${CLICKHOUSE_VERSION}_${OS_ARCH}.${PKG_EXTENSION}"
+            if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
+               CLICKHOUSE_CLIENT_PATH="${CLICKHOUSE_REPO[${TARGET_DISTRIBUTION}]}/clickhouse-client-${CLICKHOUSE_VERSION}.x86_64.${PKG_EXTENSION}"
+            fi
+            echo "Downloading ${CLICKHOUSE_CLIENT_PATH}...."
+            curl -sfLO "${CLICKHOUSE_CLIENT_PATH}"
+            check_last_command_status "curl -sfLO \"${CLICKHOUSE_CLIENT_PATH}\"" $?
+        fi
+        NIM_PACKAGE_PATH="^nms-instance-manager_[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)~${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}_${OS_ARCH}\.${PKG_EXTENSION}$"
+        if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
+           NIM_PACKAGE_PATH="^nms-instance-manager-[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}\.${PKG_EXTENSION}$"
+        fi
+        NIM_PACKAGE_VERSION=$(getLatestPkgVersionFromRepo "${NIM_REPO[${TARGET_DISTRIBUTION}]}" "${NIM_PACKAGE_PATH}" "${PKG_EXTENSION}")
+        echo "Latest version for nginx instance manager is ${NIM_PACKAGE_VERSION}...."
+        curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH}  "${NIM_REPO[${TARGET_DISTRIBUTION}]}/${NIM_PACKAGE_VERSION}"
+        check_last_command_status "curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH}  \"${NIM_REPO[${TARGET_DISTRIBUTION}]}/${NIM_PACKAGE_VERSION}\"" $?
+
+        NIM_ARCHIVE_FILE_NAME="nim-oss-${TARGET_DISTRIBUTION}.tar.gz"
+        if [[ "${USE_NGINX_PLUS}" == "true" ]]; then
+          NIM_ARCHIVE_FILE_NAME="nim-plus-${TARGET_DISTRIBUTION}.tar.gz"
+        fi
+        echo -n "Creating NGINX instance manager install bundle ... ${NIM_ARCHIVE_FILE_NAME}"
+        cp ${NGINX_CERT_PATH}  "${TEMP_DIR}/${TARGET_DISTRIBUTION}/nginx-repo.crt"
+        cp ${NGINX_CERT_KEY_PATH} "${TEMP_DIR}/${TARGET_DISTRIBUTION}/nginx-repo.key"
+        cd "${CWD}" || echo "failed to change directory to ${CWD}"
+        tar -zcf "/tmp/${NIM_ARCHIVE_FILE_NAME}" -C "${TEMP_DIR}/${TARGET_DISTRIBUTION}" .
+        cp "/tmp/${NIM_ARCHIVE_FILE_NAME}" "${CWD}"
+        echo -e "\nSuccessfully created the NGINX Instance Manager bundle - ${NIM_ARCHIVE_FILE_NAME}"
+        rm -rf "${TEMP_DIR}" || echo "failed to delete the temporary directory ${TEMP_DIR}"
+        curl -s -o /dev/null --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} "https://pkgs.nginx.com/nms/?using_install_script=true&app=nim&mode=offline"
+}
+
+install_nim_offline_from_file(){
+      echo "Installing NGINX Instance Manager bundle from the path ${INSTALL_PATH}"
+      if [ -f "${INSTALL_PATH}" ]; then
+        if [ ! -f "${TEMP_DIR}" ]; then
+          mkdir -p "${TEMP_DIR}"
+        fi
+        tar xvf "${INSTALL_PATH}" -C "${TEMP_DIR}"
+        chmod -R 777 "${TEMP_DIR}"
+        chown -R "${USER}" "${TEMP_DIR}"
+        if cat /etc/*-release | grep -iq 'debian\|ubuntu'; then
+          for pkg_nginx in "${TEMP_DIR}"/nginx*.deb; do
+              echo "Installing nginx from ${pkg_nginx}"
+              DEBIAN_FRONTEND=noninteractive dpkg -i "$pkg_nginx"
+              check_last_command_status "dpkg -i \"$pkg_nginx\"" $?
+          done
+          if [[ ${SKIP_CLICKHOUSE_INSTALL} == "false" ]]; then
+              for pkg_clickhouse in "${TEMP_DIR}"/clickhouse-common*.deb; do
+                  echo "Installing clickhouse dependencies from ${pkg_clickhouse}"
+                  DEBIAN_FRONTEND=noninteractive dpkg -i  "$pkg_clickhouse"
+                  check_last_command_status "dpkg -i \"$pkg_clickhouse\"" $?
+              done
+              for pkg_clickhouse_srv in "${TEMP_DIR}"/clickhouse-server*.deb; do
+                  echo "Installing clickhouse dependencies from ${pkg_clickhouse_srv}"
+                  DEBIAN_FRONTEND=noninteractive dpkg -i  "$pkg_clickhouse_srv"
+                  check_last_command_status "dpkg -i \"$pkg_clickhouse_srv\"" $?
+              done
+          fi
+
+          for pkg_nim in "${TEMP_DIR}"/nms-instance-manager*.deb; do
+              echo "Installing NGINX Instance Manager from ${pkg_nim}"
+              DEBIAN_FRONTEND=noninteractive dpkg -i "$pkg_nim"
+              check_last_command_status "dpkg -i \"$pkg_nim\"" $?
+          done
+          generate_admin_password
+          if [[ ${SKIP_CLICKHOUSE_INSTALL} == "false" ]]; then
+              echo "Starting clickhouse-server"
+              systemctl start clickhouse-server
           fi
+          echo "Enabling and starting NGINX Instance Manager"
+          systemctl enable nms nms-core nms-dpm nms-ingestion nms-integrations --now
+          systemctl start nms nms-core nms-dpm nms-ingestion nms-integrations || journalctl -xeu nms*
+          echo "Restart nginx configuration"
+          systemctl restart nginx || journalctl -xeu nginx
+          check_nim_dashboard_status
+
+        elif cat /etc/*-release | grep -iq 'centos\|fedora\|rhel\|Amazon Linux'; then
+          yum update -y
+          for pkg_nginx in "${TEMP_DIR}"/nginx*.rpm; do
+            echo "Installing nginx from ${pkg_nginx}"
+            yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_nginx"
+          done
+          if [[ ${SKIP_CLICKHOUSE_INSTALL} == "false" ]]; then
+              for pkg_clickhouse in "${TEMP_DIR}"/clickhouse-common*.rpm; do
+                echo "Installing clickhouse dependencies from ${pkg_clickhouse}"
+                yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_clickhouse"
+              done
+              for pkg_clickhouse_srv in "${TEMP_DIR}"/clickhouse-server*.rpm; do
+                echo "Installing clickhouse dependencies from ${pkg_clickhouse}"
+                yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_clickhouse_srv"
+              done
+          fi
+          for pkg_nim in "${TEMP_DIR}"/nms-instance-manager*.rpm; do
+            echo "Installing NGINX Instance Manager from ${pkg_nim}"
+            yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_nim"
+          done
+
+          generate_admin_password
+          if [[ ${SKIP_CLICKHOUSE_INSTALL} == "false" ]]; then
+              echo "Starting clickhouse-server"
+              systemctl start clickhouse-server
+          fi
+
+          echo "Enabling and starting NGINX Instance Manager"
+          systemctl enable nms nms-core nms-dpm nms-ingestion nms-integrations --now
+          systemctl start nms nms-core nms-dpm nms-ingestion nms-integrations || journalctl -xeu nms*
+          systemctl restart nginx || journalctl -xeu nginx
+          check_nim_dashboard_status
+
+        else
+          echo "Unsupported distribution"
+          exit 1
+        fi
+
+      else
+        echo "Provided install path ${INSTALL_PATH} doesn't exists"
+        exit 1
       fi
-  else
-      printf "Unsupported distribution"
-      exit 1
-  fi
+      if [[ -n ${NIM_FQDN} ]] ; then
+        echo "Using FQDN - ${NIM_FQDN}"
+        sudo rm -rf /etc/nms/certs/*
+        sudo bash /etc/nms/scripts/certs.sh 0 ${NIM_FQDN}
+      fi
+      curl -s -o /dev/null --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} "https://pkgs.nginx.com/nms/?using_install_script=true&app=nim&mode=offline"
+}
+
+confirm_action() {
+    read -p "$1 (y/n)? " -n 1 -r
+    echo # (optional) move to a new line
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        echo "Installation cancelled by user."
+        exit 1
+    fi
+    echo ""
 }
 
-OPTS_STRING="k:c:m:d:i:s:p:n:hv:t:j:rf:l"
+printUsageInfo(){
+  echo "Usage: $0 [OPTIONS]"
+  printf "\nThis script is used to install and setup Nginx Instance Manager\n"
+  printf "\n\n Options:\n"
+  printf "\n  -a  arch(amd64/arm64) for the offline packages to download. Valid only when mode is set to offline \n"
+  printf "\n  -c  /path/to/your/<nginx-repo.crt> file.\n"
+  printf "\n  -d  <distribution>. Include the label of a distribution. Requires -m Offline. This creates a file with NGINX Instance Manager dependencies and NGINX Instance Manager install packages for the specified distribution"
+  printf "\n      [ubuntu20.04,ubuntu22.04,ubuntu24.04,debian11,debian12,centos8,rhel8,rhel9,oracle8,oracle9]\n"
+  printf "\n  -f  <NIM_FQDN> use to specify the fully qualified domain name to use for generating nim certificates.\n"
+  printf "\n  -h  Print this help message.\n"
+  printf "\n  -i  <installable_tar_file_path>. Include the path with an archive file to support NGINX Instance Manager installation. Requires -m Offline.\n"
+  printf "\n  -j  <JWT_TOKEN_FILE_PATH>. Path to the JWT token file used for license and usage consumption reporting.\n"
+  printf "\n  -k  /path/to/your/<nginx-repo.key> file.\n"
+  printf "\n  -l  Print supported operating systems.\n"
+  printf "\n  -m  <mode> online/offline. Controls whether to install from the internet or from a package created using this script. \n"
+  printf "\n  -p  Include NGINX Plus as an API gateway. \n"
+  printf "\n  -r  To uninstall NGINX Instance Manager and its dependencies. \n"
+  printf "\n  -s  Skip packaging/installing clickhouse packages. \n"
+  printf "\n  -v  clickhouse version to install/package. \n"
+  printf "\n  -y  Install Nginx Instance Manager if all the requirements are passed. \n"
+  exit 0
+}
+
+printSupportedOS(){
+  printf "This script can be run on the following operating systems"
+  printf "\n  1. ubuntu20.04(focal)"
+  printf "\n  2. ubuntu22.04(jammy)"
+  printf "\n  3. ubuntu24.04(noble)"
+  printf "\n  4. debian11(bullseye)"
+  printf "\n  5. debian12(bookworm)"
+  printf "\n  6. centos8(CentOS 8)"
+  printf "\n  7. rhel8(Redhat Enterprise Linux Version 8)"
+  printf "\n  8. rhel9( Redhat Enterprise Linux Version 9)"
+  printf "\n  9. oracle8(Oracle Linux Version 8)\n"
+  printf "\n  10. oracle9(Oracle Linux Version 9)\n"
+  exit 0
+}
+
+OPTS_STRING="a:c:d:f:hi:j:k:lm:prsv:y"
+
 while getopts ${OPTS_STRING} opt; do
   case ${opt} in
+    a)
+      if [[ "${OPTARG}" != "amd64" && "${OPTARG}" != "arm64" ]]; then
+          echo "invalid OS arch type ${OPTARG}"
+          echo "supported values are 'amd64' or 'arm64'"
+          exit 1
+      fi
+      OS_ARCH=${OPTARG}
+      ;;
     c)
       if [ ! -d "/etc/ssl/nginx" ]; then
         mkdir /etc/ssl/nginx
@@ -743,62 +835,56 @@ while getopts ${OPTS_STRING} opt; do
       cp "${OPTARG}" ${NGINX_CERT_PATH}
       check_last_command_status "cp ${OPTARG} ${NGINX_CERT_PATH}" $?
       ;;
-    k)
-      if [ ! -d "/etc/ssl/nginx" ]; then
-        mkdir /etc/ssl/nginx
-        check_last_command_status "mkdir /etc/ssl/nginx" $?
-      fi
-      cp "${OPTARG}" ${NGINX_CERT_KEY_PATH}
-      check_last_command_status "cp ${OPTARG} ${NGINX_CERT_KEY_PATH}" $?
+    d)
+      TARGET_DISTRIBUTION=${OPTARG}
       ;;
-    p)
-      USE_NGINX_PLUS="true"
-      NGINX_PLUS_VERSION=${OPTARG}
+    f)
+      NIM_FQDN=${OPTARG}
       ;;
-    s)
-      USE_SM_MODULE="true"
-      NIM_SM_VERSION="${OPTARG}"
+    h)
+      printUsageInfo
+      exit 0
       ;;
     i)
       INSTALL_PATH=${OPTARG}
       ;;
-    n)
-      NGINX_VERSION=${OPTARG}
+    j)
+      LICENSE_JWT_PATH=${OPTARG}
+      ;;
+    k)
+      if [ ! -d "/etc/ssl/nginx" ]; then
+          mkdir /etc/ssl/nginx
+          check_last_command_status "mkdir /etc/ssl/nginx" $?
+      fi
+      cp "${OPTARG}" ${NGINX_CERT_KEY_PATH}
+      check_last_command_status "cp ${OPTARG} ${NGINX_CERT_KEY_PATH}" $?
+      ;;
+    l)
+      printSupportedOS
+      exit 0
       ;;
     m)
       MODE="${OPTARG}"
       if [[ "${MODE}" != "online" && "${MODE}" != "offline" ]]; then
-          echo "invalid mode ${MODE}"
-          echo "supported values for mode are 'online' or 'offline'"
-          exit 1
+        echo "invalid mode ${MODE}"
+        echo "supported values for mode are 'online' or 'offline'"
+        exit 1
       fi
       ;;
-    d)
-      TARGET_DISTRIBUTION=${OPTARG}
-      ;;
-    v)
-      NIM_VERSION=${OPTARG}
-      ;;
-    j)
-      LICENSE_JWT_PATH=${OPTARG}
-      ;;
-    t)
-      CLICKHOUSE_VERSION=${OPTARG}
+    p)
+      USE_NGINX_PLUS="true"
       ;;
     r)
       UNINSTALL_NIM="true"
       ;;
-    f)
-      NIM_FQDN=${OPTARG}
+    s)
+      SKIP_CLICKHOUSE_INSTALL="true"
       ;;
-    h)
-       printUsageInfo
-       exit 0
+    v)
+      CLICKHOUSE_VERSION=${OPTARG}
+      ;;
+    y)
       ;;
-    l)
-       printSupportedOS
-       exit 0
-       ;;
     :)
       echo "Option -${OPTARG} requires an argument."
       exit 1
@@ -810,283 +896,27 @@ while getopts ${OPTS_STRING} opt; do
   esac
 done
 
-check_if_nim_installed
-check_cert_key_jwt_path
+if [[ "$#" == "0" ]]; then
+  printUsageInfo
+  exit 0
+fi
+
+if [[ $EUID -ne 0 ]]; then
+   echo "This script is not being executed with sudo permissions."
+   echo "Please run it with sudo, e.g., sudo bash install-nim-bundle.sh"
+   exit 1
+fi
+
+validate_nim_installation
+validate_nginx_paths
 
 if [ "${MODE}" == "online" ]; then
   install_nim_online
-  check_NIM_status
-
+  check_nim_dashboard_status
 else
-  if [ "${NGINX_VERSION}" == "latest" ]; then
-      NGINX_VERSION=${NGINX_LATEST_VERSION}
-  fi
-  if [ "${NIM_VERSION}" == "latest" ]; then
-      NIM_VERSION=${NIM_LATEST_VERSION}
-  fi
-  if [ "${CLICKHOUSE_VERSION}" == "latest" ]; then
-      CLICKHOUSE_VERSION=${CLICKHOUSE_LATEST_VERSION}
-  fi
-
-  declare -A CLICKHOUSE_REPO
-  CLICKHOUSE_REPO['ubuntu20.04']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse/"
-  CLICKHOUSE_REPO['ubuntu22.04']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse/"
-  CLICKHOUSE_REPO['ubuntu24.04']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse/"
-  CLICKHOUSE_REPO['debian11']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse/"
-  CLICKHOUSE_REPO['debian12']="https://packages.clickhouse.com/deb/pool/main/c/clickhouse/"
-  CLICKHOUSE_REPO['centos8']="https://packages.clickhouse.com/rpm/stable/"
-  CLICKHOUSE_REPO['rhel8']="https://packages.clickhouse.com/rpm/stable/"
-  CLICKHOUSE_REPO['rhel9']="https://packages.clickhouse.com/rpm/stable/"
-  CLICKHOUSE_REPO['oracle8']="https://packages.clickhouse.com/rpm/stable/"
-  CLICKHOUSE_REPO['oracle9']="https://packages.clickhouse.com/rpm/stable/"
-  CLICKHOUSE_REPO['amzn2']="https://packages.clickhouse.com/rpm/stable/"
-
-  declare -A NGINX_REPO
-  NGINX_REPO['ubuntu20.04']="https://nginx.org/packages/mainline/ubuntu/pool/nginx/n/nginx/"
-  NGINX_REPO['ubuntu22.04']="https://nginx.org/packages/mainline/ubuntu/pool/nginx/n/nginx/"
-  NGINX_REPO['ubuntu24.04']="https://nginx.org/packages/mainline/ubuntu/pool/nginx/n/nginx/"
-  NGINX_REPO['debian11']="https://nginx.org/packages/mainline/debian/pool/nginx/n/nginx/"
-  NGINX_REPO['debian12']="https://nginx.org/packages/mainline/debian/pool/nginx/n/nginx/"
-  NGINX_REPO['centos8']="https://nginx.org/packages/mainline/centos/8/x86_64/RPMS/"
-  NGINX_REPO['rhel8']="https://nginx.org/packages/mainline/rhel/8/x86_64/RPMS/"
-  NGINX_REPO['rhel9']="https://nginx.org/packages/mainline/rhel/9/x86_64/RPMS/"
-  NGINX_REPO['oracle8']="https://nginx.org/packages/mainline/rhel/8/x86_64/RPMS/"
-  NGINX_REPO['oracle9']="https://nginx.org/packages/mainline/rhel/9/x86_64/RPMS/"
-  NGINX_REPO['amzn2']="https://nginx.org/packages/mainline/amzn2/2/x86_64/RPMS/"
-  CLICKHOUSE_KEY="https://packages.clickhouse.com/rpm/lts/repodata/repomd.xml.key"
-  NGINX_KEY="https://nginx.org/keys/nginx_signing.key"
-
-  declare -A NMS_REPO
-  NMS_REPO['ubuntu20.04']="https://pkgs.nginx.com/nms/ubuntu/pool/nginx-plus/n/nms-instance-manager/"
-  NMS_REPO['ubuntu22.04']="https://pkgs.nginx.com/nms/ubuntu/pool/nginx-plus/n/nms-instance-manager/"
-  NMS_REPO['ubuntu24.04']="https://pkgs.nginx.com/nms/ubuntu/pool/nginx-plus/n/nms-instance-manager/"
-  NMS_REPO['debian11']="https://pkgs.nginx.com/nms/debian/pool/nginx-plus/n/nms-instance-manager/"
-  NMS_REPO['debian12']="https://pkgs.nginx.com/nms/debian/pool/nginx-plus/n/nms-instance-manager/"
-  NMS_REPO['centos8']="https://pkgs.nginx.com/nms/centos/8/x86_64/RPMS/"
-  NMS_REPO['rhel8']="https://pkgs.nginx.com/nms/centos/8/x86_64/RPMS/"
-  NMS_REPO['rhel9']="https://pkgs.nginx.com/nms/centos/9/x86_64/RPMS/"
-  NMS_REPO['oracle8']="https://pkgs.nginx.com/nms/centos/8/x86_64/RPMS/"
-  NMS_REPO['oracle9']="https://pkgs.nginx.com/nms/centos/9/x86_64/RPMS/"
-  NMS_REPO['amzn2']="https://pkgs.nginx.com/nms/amzn2/2/x86_64/RPMS/"
-
-  declare -A CLICKHOUSE_PACKAGES
-  # for Clickhouse package names are static between distributions
-  # we use ubuntu/centos entries as placeholders
-  CLICKHOUSE_PACKAGES['ubuntu']=$(printf "clickhouse-server_%s_amd64.deb\nclickhouse-common-static_%s_amd64.deb" ${CLICKHOUSE_VERSION} ${CLICKHOUSE_VERSION})
-  CLICKHOUSE_PACKAGES['centos']=$(printf "clickhouse-server-%s.x86_64.rpm\nclickhouse-common-static-%s.x86_64.rpm"  ${CLICKHOUSE_VERSION} ${CLICKHOUSE_VERSION})
-  CLICKHOUSE_PACKAGES['ubuntu20.04']=${CLICKHOUSE_PACKAGES['ubuntu']}
-  CLICKHOUSE_PACKAGES['ubuntu22.04']=${CLICKHOUSE_PACKAGES['ubuntu']}
-  CLICKHOUSE_PACKAGES['ubuntu24.04']=${CLICKHOUSE_PACKAGES['ubuntu']}
-  CLICKHOUSE_PACKAGES['debian11']=${CLICKHOUSE_PACKAGES['ubuntu']}
-  CLICKHOUSE_PACKAGES['debian12']=${CLICKHOUSE_PACKAGES['ubuntu']}
-  CLICKHOUSE_PACKAGES['centos8']=${CLICKHOUSE_PACKAGES['centos']}
-  CLICKHOUSE_PACKAGES['rhel8']=${CLICKHOUSE_PACKAGES['centos']}
-  CLICKHOUSE_PACKAGES['rhel9']=${CLICKHOUSE_PACKAGES['centos']}
-  CLICKHOUSE_PACKAGES['oracle8']=${CLICKHOUSE_PACKAGES['centos']}
-  CLICKHOUSE_PACKAGES['oracle9']=${CLICKHOUSE_PACKAGES['centos']}
-  CLICKHOUSE_PACKAGES['amzn2']=${CLICKHOUSE_PACKAGES['centos']}
-
-  declare -A NGINX_PACKAGES
-  NGINX_PACKAGES['ubuntu20.04']="nginx_${NGINX_VERSION}~focal_amd64.deb"
-  NGINX_PACKAGES['ubuntu22.04']="nginx_${NGINX_VERSION}~jammy_amd64.deb"
-  NGINX_PACKAGES['ubuntu24.04']="nginx_${NGINX_VERSION}~noble_amd64.deb"
-  NGINX_PACKAGES['debian11']="nginx_${NGINX_VERSION}~bullseye_amd64.deb"
-  NGINX_PACKAGES['debian12']="nginx_${NGINX_VERSION}~bookworm_amd64.deb"
-  NGINX_PACKAGES['centos8']="nginx-${NGINX_VERSION}.el8.ngx.x86_64.rpm"
-  NGINX_PACKAGES['rhel8']="nginx-${NGINX_VERSION}.el8.ngx.x86_64.rpm"
-  NGINX_PACKAGES['rhel9']="nginx-${NGINX_VERSION}.el9.ngx.x86_64.rpm"
-  NGINX_PACKAGES['oracle8']="nginx-${NGINX_VERSION}.el8.ngx.x86_64.rpm"
-  NGINX_PACKAGES['oracle9']="nginx-${NGINX_VERSION}.el9.ngx.x86_64.rpm"
-  NGINX_PACKAGES['amzn2']="nginx-${NGINX_VERSION}.amzn2.ngx.x86_64.rpm"
-
-  declare -A NIM_PACKAGES
-  NIM_PACKAGES['ubuntu20.04']="nms-instance-manager_${NIM_VERSION}-\d*~focal_amd64\.deb"
-  NIM_PACKAGES['ubuntu22.04']="nms-instance-manager_${NIM_VERSION}-\d*~jammy_amd64\.deb"
-  NIM_PACKAGES['ubuntu24.04']="nms-instance-manager_${NIM_VERSION}-\d*~jammy_amd64\.deb"
-  NIM_PACKAGES['debian11']="nms-instance-manager_${NIM_VERSION}-\d*~bullseye_amd64\.deb"
-  NIM_PACKAGES['debian12']="nms-instance-manager_${NIM_VERSION}-\d*~bookworm_amd64\.deb"
-  NIM_PACKAGES['centos8']="nms-instance-manager-${NIM_VERSION}-\d*.el8.ngx.x86_64\.rpm"
-  NIM_PACKAGES['rhel8']="nms-instance-manager-${NIM_VERSION}-\d*.el8.ngx.x86_64\.rpm"
-  NIM_PACKAGES['rhel9']="nms-instance-manager-${NIM_VERSION}-\d*.el9.ngx.x86_64\.rpm"
-  NIM_PACKAGES['oracle8']="nms-instance-manager-${NIM_VERSION}-\d*.el8.ngx.x86_64\.rpm"
-  NIM_PACKAGES['oracle9']="nms-instance-manager-${NIM_VERSION}-\d*.el9.ngx.x86_64\.rpm"
-  NIM_PACKAGES['amzn2']="nms-instance-manager-${NIM_VERSION}-\d*.amzn2.ngx.x86_64\.rpm"
-
   if [ -z "${INSTALL_PATH}" ]; then
-    target_distribution="$TARGET_DISTRIBUTION"
-    echo "Target distro - $target_distribution"
-    if [[ "${#CLICKHOUSE_REPO[$target_distribution]}" -eq 0 ]]; then
-        echo "Invalid target distribution. Supported target distributions: " "${!CLICKHOUSE_REPO[@]}"
-        exit 1
-    fi
-    echo  "Creating NGINX Instance Manager installation bundle for distribution ${CLICKHOUSE_PACKAGES[${target_distribution}]}..."
-    if [ -z "${target_distribution}" ]; then
-        echo "${target_distribution} - no target distribution specified"
-        exit 1
-    fi
-    mkdir -p "${TEMP_DIR}/${target_distribution}"
-    echo "Downloading clickhouse signing keys ${CLICKHOUSE_KEY}... "
-    url_file_download ${CLICKHOUSE_KEY} "${TEMP_DIR}/${target_distribution}/clickhouse-key.gpg"
-    echo "Downloaded clickhouse signing keys"
-
-    echo "downloading nginx signing keys ${NGINX_KEY}... "
-    url_file_download ${NGINX_KEY} "${TEMP_DIR}/${target_distribution}/nginx-key.gpg"
-    echo "Downloaded nginx signing keys"
-
-    readarray -t clickhouse_files <<<"${CLICKHOUSE_PACKAGES[$target_distribution]}"
-    readarray -t nginx_files <<<"${NGINX_PACKAGES[$target_distribution]}"
-    readarray -t nim_files <<<"${NIM_PACKAGES[$target_distribution]}"
-
-    for package_file in "${clickhouse_files[@]}"; do
-      if [ -z "$package_file" ]; then
-         continue
-      fi
-      file_to_download="${CLICKHOUSE_REPO[$target_distribution]}$package_file"
-      save_path="${TEMP_DIR}/${target_distribution}/$package_file"
-      echo -n "Downloading ${file_to_download} ... "
-      url_file_download "$file_to_download" "$save_path"
-      echo "Downloaded clickhouse package - $save_path"
-    done
-    for package_file in "${nginx_files[@]}"; do
-      if [ -z "$package_file" ]; then
-         continue
-      fi
-      file_to_download="${NGINX_REPO[$target_distribution]}$package_file"
-      save_path="${TEMP_DIR}/${target_distribution}/$package_file"
-      echo -n "Downloading ${package_file} ... "
-      url_file_download "$file_to_download" "$save_path"
-      echo "Downloaded nginx package - $save_path"
-    done
-    for package_file in "${nim_files[@]}"; do
-      if [ -z "$package_file" ]; then
-        continue
-      fi
-      nim_with_version=$(curl -fs --cert "${NGINX_CERT_PATH}" --key "${NGINX_CERT_KEY_PATH}" "${NMS_REPO[$target_distribution]}" \
-       | grep -P "${package_file}" | sed -n 's/.*<a[^>]*href="\([^"]*\)".*/\1/p')
-      if [[ "${#nim_with_version}" -eq 0 ]]; then
-        echo "Error: NGINX Instance Manager $NIM_VERSION ($target_distribution) version not found on ${NMS_REPO[$target_distribution]}"
-        exit 1
-      fi
-      file_to_download="${NMS_REPO[$target_distribution]}${nim_with_version}"
-      save_path="${TEMP_DIR}/${target_distribution}/$nim_with_version"
-      echo -n "Downloading ${nim_with_version} ... "
-      url_file_download "$file_to_download" "$save_path"
-      echo "Downloaded NGINX Instance Manager package - $save_path"
-    done
-    download_third_party_dependencies
-    bundle_file="nim-${NIM_VERSION}-${target_distribution}.tar.gz"
-    echo -n "Creating NGINX Instance Manager install bundle ... ${bundle_file}"
-    cp ${NGINX_CERT_PATH}  "${TEMP_DIR}/${target_distribution}/nginx-repo.crt"
-    cp ${NGINX_CERT_KEY_PATH} "${TEMP_DIR}/${target_distribution}/nginx-repo.key"
-    tar -zcf "$bundle_file" -C "${TEMP_DIR}/${target_distribution}/" .
-    echo -e "\nSuccessfully created the NGINX Instance Manager bundle - $bundle_file"
-    curl -s -o /dev/null --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} "https://pkgs.nginx.com/nms/?using_install_script=true&app=nim&mode=offline"
-
+    package_nim_offline
   else
-    echo "Installing NGINX Instance Manager bundle from the path ${INSTALL_PATH}"
-    if [ -f "${INSTALL_PATH}" ]; then
-      if [ ! -f "${TEMP_DIR}" ]; then
-        mkdir -p "${TEMP_DIR}"
-      fi
-      tar xvf "${INSTALL_PATH}" -C "${TEMP_DIR}"
-      chmod -R 777 "${TEMP_DIR}"
-      chown -R "${USER}" "${TEMP_DIR}"
-      if cat /etc/*-release | grep -iq 'debian\|ubuntu'; then
-        for pkg_nginx in "${TEMP_DIR}"/nginx*.deb; do
-            echo "Installing nginx from ${pkg_nginx}"
-            DEBIAN_FRONTEND=noninteractive dpkg -i "$pkg_nginx"
-            check_last_command_status "dpkg -i \"$pkg_nginx\"" $?
-        done
-        for pkg_clickhouse in "${TEMP_DIR}"/clickhouse-common*.deb; do
-            echo "Installing clickhouse dependencies from ${pkg_clickhouse}"
-            DEBIAN_FRONTEND=noninteractive dpkg -i  "$pkg_clickhouse"
-            check_last_command_status "dpkg -i \"$pkg_clickhouse\"" $?
-        done
-        for pkg_clickhouse_srv in "${TEMP_DIR}"/clickhouse-server*.deb; do
-            echo "Installing clickhouse dependencies from ${pkg_clickhouse_srv}"
-            DEBIAN_FRONTEND=noninteractive dpkg -i  "$pkg_clickhouse_srv"
-            check_last_command_status "dpkg -i \"$pkg_clickhouse_srv\"" $?
-        done
-        if [ -d "${TEMP_DIR}/keepalived" ]; then
-            echo "Installing keepalived from ${TEMP_DIR}/keepalived"
-            DEBIAN_FRONTEND=noninteractive dpkg -i ${TEMP_DIR}/keepalived/*.deb
-            check_last_command_status "dpkg -i ${TEMP_DIR}/keepalived/*.deb" $?
-        fi
-        for pkg_nim in "${TEMP_DIR}"/nms-instance-manager*.deb; do
-            echo "Installing NGINX Instance Manager from ${pkg_nim}"
-            DEBIAN_FRONTEND=noninteractive dpkg -i "$pkg_nim"
-            check_last_command_status "dpkg -i \"$pkg_nim\"" $?
-        done
-
-        generate
-        echo "Starting clickhouse-server"
-        systemctl start clickhouse-server
-
-        echo "Starting nginx"
-        systemctl start nginx
-
-        echo "Reloading nginx configuration"
-        systemctl restart nginx
-
-        echo "Enabling and starting NGINX Instance Manager"
-        systemctl enable nms nms-core nms-dpm nms-ingestion nms-integrations --now
-
-        check_NIM_status
-
-      elif cat /etc/*-release | grep -iq 'centos\|fedora\|rhel\|Amazon Linux'; then
-        for pkg_nginx in "${TEMP_DIR}"/nginx*.rpm; do
-          echo "Installing nginx from ${pkg_nginx}"
-          yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_nginx"
-        done
-        for pkg_clickhouse in "${TEMP_DIR}"/clickhouse-common*.rpm; do
-          echo "Installing clickhouse dependencies from ${pkg_clickhouse}"
-          yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_clickhouse"
-        done
-        for pkg_clickhouse_srv in "${TEMP_DIR}"/clickhouse-server*.rpm; do
-          echo "Installing clickhouse dependencies from ${pkg_clickhouse}"
-          yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_clickhouse_srv"
-        done
-        if [ -d "${TEMP_DIR}/keepalived" ]; then
-            echo "Installing keepalived from ${TEMP_DIR}/keepalived"
-            yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "${TEMP_DIR}/keepalived/*.rpm"
-            check_last_command_status "dpkg -i yum localinstall -y -v --disableplugin=subscription-manager --skip-broken ${TEMP_DIR}/keepalived/*.rpm" $?
-        fi
-        for pkg_nim in "${TEMP_DIR}"/nms-instance-manager*.rpm; do
-          echo "Installing NGINX Instance Manager from ${pkg_nim}"
-          yum localinstall -y -v --disableplugin=subscription-manager --skip-broken "$pkg_nim"
-        done
-
-        generate
-        echo "Starting clickhouse-server"
-        systemctl start clickhouse-server
-
-        echo "Starting nginx"
-        systemctl start nginx
-
-        echo "Reloading nginx configuration"
-        systemctl restart nginx
-
-        echo "Enabling and starting NGINX Instance Manager"
-        systemctl enable nms nms-core nms-dpm nms-ingestion nms-integrations --now
-
-        check_NIM_status
-
-      else
-        echo "Unsupported distribution"
-        exit 1
-      fi
-
-    else
-      echo "Provided install path ${INSTALL_PATH} doesn't exists"
-      exit 1
-    fi
-    if [[ -n ${NIM_FQDN} ]] ; then
-         if [ -d "${NIM_CERTS_DIR}" ]; then
-             echo "removing existing nim certs"
-             rm -rf "/etc/nms/certs"
-         fi
-         bash -c "source /etc/nms/scripts/certs.sh 0 \"${NIM_FQDN}\" || /etc/nms/scripts/certs.sh 0 ${NIM_FQDN}"
-    fi
-    curl -s -o /dev/null --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} "https://pkgs.nginx.com/nms/?using_install_script=true&app=nim&mode=offline"
+    install_nim_offline_from_file
   fi
 fi
diff --git a/static/scripts/license_usage_offline.sh b/static/scripts/license_usage_offline.sh
index 8a1a1eabd..be2cd3a65 100755
--- a/static/scripts/license_usage_offline.sh
+++ b/static/scripts/license_usage_offline.sh
@@ -1,282 +1,282 @@
 #!/bin/bash
 
-# Function to encode the username and password to Base64
-encode_base64() {
-  echo -n "$1:$2" | base64
-}
+# Enable strict mode for better error handling
+set -euo pipefail
+IFS=$'\n\t'
 
-# Print help text and exit.
-if [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
-  echo
-  echo "Usage: $0 -j <path-to-JWT> -i <NIM-IP> -u <username> -p <password> -o <output zip file> -s <step>"
-  echo
-  echo "This script alows you to license NGINX Instance Manager and submit usage reports to F5 in a disconnected environment."
-  echo "It needs to be run on a system that can reach NGINX Instance Manager and the following endpoint on port 443: https://product.apis.f5.com/"
+# Function to display usage
+usage() {
+  echo "Usage: $0 -j <JWT file> -i <NIM IP> -u <username> -p <password> -s <initial|telemetry>"
   echo
-  echo "If NGINX Instance Manager is connected to the internet (Connected Mode), please use the UI."
-  echo "This script is only necessary if NGINX Instance Manager is set to Disconnected Mode."
-  echo
-  echo "For Licensing in Disconnected Mode:"
-  echo "$0 -j my-jwt.jwt -i <NIM-IP> -u admin -p <password> -o report.zip -s initial"
-  echo 
-  echo "For Usage Reporting in Disconnected Mode:"
-  echo "$0 -j my-jwt.jwt -i <NIM-IP> -u admin -p <password> -o report.zip -s telemetry"
-  echo 
-  echo "Note: Since NGINX Instance Manager comes with self-signed certificates by default, the --insecure flag is set in this script to run specific Curl commands." 
-  echo "You can alter this script if you wish to change from self-signed to verified certificates in Instance Manager."
-  echo 
+  echo "Options:"
+  echo "  -j <JWT file>     Path to the JWT (JSON Web Token) file used for authentication."
+  echo "  -i <NIM IP>       IP address of the NIM (NGINX Instance Manager) to connect to."
+  echo "  -u <username>     Username for login/authentication to NIM (NGINX Instance Manager)."
+  echo "  -p <password>     Password corresponding to the username for NIM (NGINX Instance Manager) authentication."
+  echo "  -s <mode>         Script execution mode. One of the following:"
+  echo "                      initial       - Perform Initial License Activation"
+  echo "                      telemetry     - Perform telemetry submission: download usage report from NGINX Instance Manager and submit to F5."
   exit 1
-fi
-
-if ! command -v jq &> /dev/null; then
-	echo -e "\nPlease install jq (https://jqlang.github.io/jq/) as it is required to run the script\n"
-	exit 1
-fi
+}
 
 # Parse command-line arguments
-while getopts ":j:i:u:p:o:s:" opt; do
+while getopts ":j:i:u:p:s:" opt; do
   case $opt in
-    j) jwt_file="$OPTARG" ;;
-    i) ip_address="$OPTARG" ;;
-    u) username="$OPTARG" ;;
-    p) password="$OPTARG" ;;
-    o) output_file="$OPTARG" ;;
-    s) step="$OPTARG" ;;
-    \?) echo "Invalid option -$OPTARG" >&2 ;;
+    j) JWT_FILE="$OPTARG" ;;
+    i) NIM_IP="$OPTARG" ;;
+    u) USERNAME="$OPTARG" ;;
+    p) PASSWORD="$OPTARG" ;;
+    s) USE_CASE="$OPTARG" ;;
+    *) usage ;;
   esac
 done
 
+# Check if all required arguments are provided
+if [ -z "${JWT_FILE:-}" ] || [ -z "${NIM_IP:-}" ] || [ -z "${USERNAME:-}" ] || [ -z "${PASSWORD:-}" ] || [ -z "${USE_CASE:-}" ]; then
+  usage
+fi
 
-# Check if JWT_FILE is not empty and if the file exists
-if [ -z "$jwt_file" ]; then
-    echo "JWT file path is not defined. Please set the JWT_FILE variable."
-    exit 1
-elif [ ! -f "$jwt_file" ]; then
-    echo "JWT file not found: $jwt_file"
-    exit 1
-else
-    echo "JWT file found: $jwt_file"
+echo "Running $USE_CASE report"
+
+# Ensure /tmp directory exists or else create it and proceed
+if [ ! -d "/tmp" ]; then
+  echo "/tmp directory does not exist. Creating it now..."
+  mkdir -p /tmp || { echo "Failed to create /tmp directory. Exiting."; exit 1; }
 fi
 
 
-# Read the Bearer token from the file
-bearer_token=$(<"$jwt_file")
+# Read JWT contents
+if [ ! -f "$JWT_FILE" ]; then
+  echo -e "JWT file '$JWT_FILE' not found.$" >&2
+  exit 1
+fi
+JWT_CONTENT=$(<"$JWT_FILE")
 
-# Encode the username and password to Base64 for Basic Authorization
-basic_auth=$(encode_base64 "$username" "$password")
+# Encode credentials
+AUTH_HEADER=$(echo -n "$USERNAME:$PASSWORD" | base64)
 
+# Check connectivity to NGINX Instance Manager IP and the F5 licensing server (product.apis.f5.com)
+echo -e "Checking connectivity to NGINX Instance Manager and F5 licensing server..."
 
-# Initialize report_save_path if it's empty
-report_save_path=${output_file:-"report.zip"}
+# Function to test ping
+check_ping() {
+  local host=$1
+  echo "Pinging $host... "
+  if ! ping -c 2 -W 2 "$host" > /dev/null 2>&1; then
+    echo -e "Cannot reach $host. Please check your network, DNS or check if any proxy is set.$" >&2
+    exit 1
+  fi
+  echo -e "$host is reachable."
+}
 
-############################################################################
-# Step 1: Upload JWT to NGINX Instance Manager and Download telemetry report
-############################################################################
-echo "###################################################################"
-echo "# (if not already licensed) Upload JWT and Download the Telemetry report from NGINX Instance Manager  #"
-echo "###################################################################"
-if [ "$step" == "initial" ]; then
+# Call the function for each host
+is_ipv4() {
+  local ip=$1
+  if [[ $ip =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
+    IFS='.' read -r -a octets <<< "$ip"
+    for octet in "${octets[@]}"; do
+      if ((octet < 0 || octet > 255)); then
+        return 1
+      fi
+    done
+    return 0
+  else
+    return 1
+  fi
+}
 
-    # Function to print banner
-    print_banner() {
-        echo "===================================="
-        echo "$1"
-        echo "===================================="
+if is_ipv4 "$NIM_IP"; then
+  check_ping "$NIM_IP"
+else
+  echo "Checking connectivity to NGINX Instance Manager using Curl ..."
+  if ! curl -sk --output /dev/null --silent --fail "https://$NIM_IP"; then
+    echo -e "The NGINX Instance Manager UI is not reachable on $NIM_IP"
+    exit 1
+  fi  
+fi
+check_ping "product.apis.f5.com"
+
+# NGINX Instance Manager Version check 
+VERSION_JSON=$(curl -sk -X GET "https://$NIM_IP/api/platform/v1/modules/versions" \
+  --header "Content-Type: application/json" \
+  --header "Authorization: Basic $AUTH_HEADER")
+NIM_VER=$(echo "$VERSION_JSON" | sed -E 's/.*"nim"[ \t]*:[ \t]*"([0-9]+\.[0-9]+)(\.[0-9]+)?".*/\1/')
+echo "Current version of NGINX Instance Manager is $NIM_VER"
+JWT_CONTENT=$(<"$JWT_FILE")
+
+# Construct JSON payload
+JSON_PAYLOAD=$(cat <<EOF
+  {
+    "metadata": {
+      "name": "license"
+    },
+    "desiredState": {
+      "content": "$JWT_CONTENT"
     }
+  }
+EOF
+)
 
-    # Step 1: POST request
-    print_banner "Executing Step 1: POST request"
-    post_response=$(curl -k --location "https://$ip_address/api/platform/v1/license?telemetry=true" \
-        --header "Origin: https://$ip_address" \
-        --header "Referer: https://$ip_address/ui/settings/license" \
-        --header "Content-Type: application/json" \
-        --header "Authorization: Basic $basic_auth" \
-        --data "{
-            \"metadata\": {
-                \"name\": \"license\"
-            },
-            \"desiredState\": {
-                \"content\": \"$bearer_token\"
-            }
-        }")
-    # Use jq to extract modeOfOperation
-    modeOfOperation=$(jq -r '.currentStatus.modeOfOperation' <<< "$post_response")
-
-    # Output the modeOfOperation
-    echo "Mode of Operation: $modeOfOperation"
-
-    # Parse the modeOfOperation from the response
-    echo $modeOfOperation
-    # Step 2: Polling for the license status with conditional logic based on modeOfOperation
-    while true; do
-        print_banner "Checking License Status"
-
-        response=$(curl -k "https://$ip_address/api/platform/v1/license" \
-            -H "accept: application/json" \
-            -H "authorization: Basic $basic_auth" \
-            -H "referer: https://$ip_address/ui/settings/license" \
-            --insecure)
-        fileType=$(jq -r '.currentStatus.state.currentInstance.fileType' <<< "$response")
-        status=$(jq -r '.currentStatus.state.currentInstance.status' <<< "$response")
-        telemetry=$(jq -r '.currentStatus.state.currentInstance.telemetry' <<< "$response")
-
-        echo $fileType
-        echo $status
-        echo $telemetry
-        if [[ "$modeOfOperation" == "CONNECTED" ]]; then
-        if [[ "$fileType" == "JWT" && "$status" == "ACTIVATED" && "$telemetry" == "true" ]]; then
-                echo "Connected mode: Desired response received!"
-                break
-            else
-                echo "Connected mode: Waiting for the desired response..."
-            fi
-        elif [[ "$modeOfOperation" == "DISCONNECTED" ]]; then
-            if [[ "$fileType" == "JWT" && "$status" == "INITIALIZE_ACTIVATION_COMPLETE" ]]; then
-                echo "Disconnected mode: Desired response received!"
-                break
-            else
-                echo "Disconnected mode: Waiting for the desired response..."
-            fi
-        fi
-
-        sleep 5  # Poll every 5 seconds
-    done
+# Send GET request and capture response and status code
+response=$(curl -sk -w "%{http_code}" -o /tmp/device_mode.json "https://$NIM_IP/api/platform/v1/report/device_mode" -H 'accept: application/json' -H "Authorization: Basic $AUTH_HEADER")
 
-    # Step 3: PUT request
-    print_banner "Executing Step 2: PUT request"
-    put_response=$(curl -k --location --request PUT "https://$ip_address/api/platform/v1/license?telemetry=true" \
-        --header "Origin: https://$ip_address" \
-        --header "Referer: https://$ip_address/ui/settings/license" \
-        --header "Content-Type: application/json" \
-        --header "Authorization: Basic $basic_auth" \
-        --data '{
-            "desiredState": {
-                "content": "",
-                "type": "JWT",
-                "features": [
-                    {"limit": 0, "name": "NGINX_NAP_DOS", "valueType": ""},
-                    {"limit": 0, "name": "IM_INSTANCES", "valueType": ""},
-                    {"limit": 0, "name": "TM_INSTANCES", "valueType": ""},
-                    {"limit": 0, "name": "DATA_PER_HOUR_GB", "valueType": ""},
-                    {"limit": 0, "name": "NGINX_INSTANCES", "valueType": ""},
-                    {"limit": 0, "name": "NGINX_NAP", "valueType": ""},
-                    {"limit": 0, "name": "SUCCESSFUL_API_CALLS_MILLIONS", "valueType": ""},
-                    {"limit": 0, "name": "IC_PODS", "valueType": ""},
-                    {"limit": 0, "name": "IC_K8S_NODES", "valueType": ""}
-                ]
-            },
-            "metadata": {
-                "name": "license"
-            }
-        }')
-
-    echo "Response from Step 2: PUT request:"
-
-    # Step 4: Polling for the desired license status
-    while true; do
-        print_banner "Checking License Validation Status"
-
-        response=$(curl -s "https://$ip_address/api/platform/v1/license" \
-            -H "accept: application/json" \
-            -H "authorization: Basic $basic_auth" \
-            -H "referer: https://$ip_address/ui/settings/license" \
-            --insecure)
-        fileType=$(jq -r '.currentStatus.state.currentInstance.fileType' <<< "$response")
-        status=$(jq -r '.currentStatus.state.currentInstance.status' <<< "$response")
-        telemetry=$(jq -r '.currentStatus.state.currentInstance.telemetry' <<< "$response")
-
-
-        if [[ "$modeOfOperation" == "CONNECTED" ]]; then
-            if [[ "$fileType" == "JWT" && "$status" == "VALID" ]]; then
-                echo "Connected mode: Desired response received!"
-                break
-            else
-                echo "Connected mode: Current license response does not meet conditions. Retrying..."
-            fi
-        elif [[ "$modeOfOperation" == "DISCONNECTED" ]]; then
-            if [[ "$fileType" == "JWT" && "$status" == "CONFIG_REPORT_READY" ]]; then
-                echo "Disconnected mode: Desired response received!"
-                break
-            else
-                echo "Disconnected mode: Current license response does not meet conditions. Retrying..."
-            fi
-        fi
-
-        sleep 5
-    done
+# Extract status code and response body
+http_code="${response: -3}"
+body=$(cat /tmp/device_mode.json)
 
-    # Step 5: Loop to check if licensed
-    while true; do
-        print_banner "Checking Licensed Status"
-
-        licensed_response=$(curl -s "https://$ip_address/api/platform/v1/modules/licensed" \
-            -H "accept: application/json" \
-            -H "authorization: Basic $basic_auth" \
-            -H "referer: https://$ip_address/ui/settings/license" \
-            --insecure)
-
-        licensed_status=$(jq -r '.licensed' <<< "$licensed_response" )
-        if [[ "$modeOfOperation" == "CONNECTED" ]]; then
-
-            if [[ "$licensed_status" == "true" ]]; then
-                echo "The system is licensed on connected mode!"
-                break
-            else
-                echo "The system is not licensed yet. Retrying..."
-            fi
-        elif [[ "$modeOfOperation" == "DISCONNECTED" ]]; then
-            if [[ "$licensed_status" == "false" ]]; then
-                echo "Upload JWT success on disconnected mode"
-                break
-        fi
-        fi
-
-        sleep 5
-    done
+# Check response code
+if [[ "$http_code" != "200" ]]; then
+  echo "Request failed with status code $http_code"
+  exit 1
+fi
 
-    echo "Requests executed successfully."
+# Parse device_mode using jq
+device_mode=$(echo "$body" | jq -r '.device_mode')
 
-#################################################
-# Step 2: Download the telemetry report from NGINX Instance Manager #
-#################################################
-echo "#################################################"
-echo "# Download the telemetry report from NGINX Instance Manager #"
-echo "#################################################"
+# Use the value
+echo "Device mode is: $device_mode"
 
-  echo "Executing for step: initial"
-  download_usage_command="curl --insecure --location 'https://$ip_address/api/platform/v1/report/download?format=zip&reportType=initial' \
-          --header 'accept: */*' \
-          --header 'authorization: Basic $basic_auth' \
-          --output \"$report_save_path\""
+# Check value and act
+if [[ "$device_mode" == "CONNECTED" ]]; then
+  echo "Device mode is CONNECTED. This script is only for DISCONNECTED mode"
+  exit 1
+fi
 
-elif [ "$step" == "telemetry" ]; then
-  echo "Executing for step: telemetry"
-  prepare_usage_command="curl --insecure --location 'https://$ip_address/api/platform/v1/report/download?format=zip&reportType=telemetry&telemetryAction=prepare' \
-          --header 'accept: application/json' \
-          --header 'authorization: Basic $basic_auth' \
-          --header 'referer: https://$ip_address/ui/settings/license'"
+ORIGIN="https://$NIM_IP"
+REFERER="$ORIGIN/ui/settings/license"
 
-  download_usage_command="curl --insecure --location 'https://$ip_address/api/platform/v1/report/download?format=zip&reportType=telemetry&telemetryAction=download' \
-  --header 'accept: */*' \
-  --header 'authorization: Basic $basic_auth' \
-  --output \"$report_save_path\""
+
+
+if [[ "$USE_CASE" == "initial" ]]; then
+  # Read JWT content
+  if [ ! -f "$JWT_FILE" ]; then
+    echo -e "JWT file '$JWT_FILE' not found." >&2
+    exit 1
+  fi
+  # Step 1: Apply JWT license (only if use case is 'initial' or 'intial_only')
+  echo "Applying JWT license"
+  RESPONSE=$(curl -sS -k --max-time 10 -w "\n%{http_code}" -X POST "https://$NIM_IP/api/platform/v1/license?telemetry=true" \
+    -H "Origin: $ORIGIN" \
+    -H "Referer: $REFERER" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Basic $AUTH_HEADER" \
+    -d "$JSON_PAYLOAD")
+  echo "Uploaded License"
+  HTTP_BODY=$(echo "$RESPONSE" | sed '$d')
+  HTTP_STATUS=$(echo "$RESPONSE" | tail -n1)
+  if [ "$HTTP_STATUS" -ne 202 ]; then
+    echo -e "HTTP request failed with status code $HTTP_STATUS.
+          Response: $HTTP_BODY$" >&2
+    if echo "$HTTP_BODY" | jq -r '.message' | grep -q "failed to register token. already registered"; then
+      echo -e "NGINX Instance Manager already registered and licensed.
+      If needed, terminate the current license manually in the NGINX Instance Manager UI and re-run the script with the correct license.
+      https://docs.nginx.com/nginx-instance-manager/disconnected/add-license-disconnected-deployment/"
+    fi
+    exit 1
+  fi
 fi
-if [ "$step" == "telemetry" ]; then
-  echo "Running telemetry stage: "
-
-  # Run the saved command and store the response
-  response=$(eval $prepare_usage_command)
-
-  # Print the response
-  echo "Response: $response"
-  sleep 2
-  # Validate if the response contains "Report generation in progress"
-  if echo "$response" | grep -q '"telemetry":"Report generation in progress"'; then
-    echo "Success: Report generation is in progress."
+
+if [[ "$NIM_VER" < "2.18" ]]; then
+  echo "NGINX Instance Manager version $NIM_VER is not supported by this script. Please use NGINX Instance Manager 2.18 or later"
+  exit 1
+
+elif [[ "$NIM_VER" == "2.18" ]] || [[ "$NIM_VER" == "2.19" ]]; then
+  echo "NGINX Instance Manager version $NIM_VER detected."
+  ORIGIN="https://$NIM_IP"
+
+# Send the PUT request and separate body and status code
+  PUT_RESPONSE_CODE=$(curl -k -s -w "%{http_code}" -o /tmp/put_response.json --location --request PUT "https://$NIM_IP/api/platform/v1/license?telemetry=true" \
+    --header "Origin: $ORIGIN" \
+    --header "Referer: https://$NIM_IP/ui/settings/license" \
+    --header "Content-Type: application/json" \
+    --header "Authorization: Basic $AUTH_HEADER" \
+    --data '{
+      "desiredState": {
+          "content": "'"$JWT_CONTENT"'",
+          "type": "JWT",
+          "features": [
+              {"limit": 0, "name": "NGINX_NAP_DOS", "valueType": ""},
+              {"limit": 0, "name": "IM_INSTANCES", "valueType": ""},
+              {"limit": 0, "name": "TM_INSTANCES", "valueType": ""},
+              {"limit": 0, "name": "DATA_PER_HOUR_GB", "valueType": ""},
+              {"limit": 0, "name": "NGINX_INSTANCES", "valueType": ""},
+              {"limit": 0, "name": "NGINX_NAP", "valueType": ""},
+              {"limit": 0, "name": "SUCCESSFUL_API_CALLS_MILLIONS", "valueType": ""},
+              {"limit": 0, "name": "IC_PODS", "valueType": ""},
+              {"limit": 0, "name": "IC_K8S_NODES", "valueType": ""}
+          ]
+      },
+      "metadata": {
+          "name": "license"
+      }
+    }')
+
+  echo "Response status code: $PUT_RESPONSE_CODE"
+
+  if [[ "$PUT_RESPONSE_CODE" == "200" ]]; then
+    echo -e "(legacy): License applied successfully in DISCONNECTED mode for version $NIM_VER."
   else
-    echo "Failure: Report generation not in progress or unexpected response."
+    echo -e "(legacy): License PUT request failed. Status code: $PUT_RESPONSE_CODE$"
+    echo "clear the license database and re-trigger the script again"
     exit 1
   fi
+fi
+
+if [[ "$USE_CASE" != "telemetry" ]]; then
+
+  RESPONSE=$(curl -sS -k --max-time 10 -w "\n%{http_code}" -X POST "https://$NIM_IP/api/platform/v1/license?telemetry=true" \
+    -H "Origin: $ORIGIN" \
+    -H "Referer: $REFERER" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Basic $AUTH_HEADER" \
+    -d "$JSON_PAYLOAD")
+
+  HTTP_BODY=$(echo "$RESPONSE" | sed '$d')
+  HTTP_STATUS=$(echo "$RESPONSE" | tail -n1)
+
+  echo -e "License applied successfully in DISCONNECTED mode."
+fi
+
+
+
+# Continue with further steps for version >= 2.20...
+echo "Executing telemetry tasks "
+# Step 2: Download the usage report
+echo "Downloading usage report from NGINX Instance Manager at $NIM_IP..."
+if [[ "$NIM_VER" == "2.18" ]] || [[ "$NIM_VER" == "2.19" ]]; then
+  if [[ "$USE_CASE" == "initial" ]]; then
+    # Perform the request and capture the status code and output
+    HTTP_RESPONSE=$(curl -k -sS -w "\n%{http_code}" --location "https://$NIM_IP/api/platform/v1/report/download?format=zip&reportType=initial" \
+      --header "accept: application/json" \
+      --header "authorization: Basic $AUTH_HEADER" \
+      --header "content-type: application/json" \
+      --header "origin: https://$NIM_IP" \
+      --output /tmp/response.zip)
+  else
+     prepare_usage_command="curl --insecure --location 'https://$NIM_IP/api/platform/v1/report/download?format=zip&reportType=telemetry&telemetryAction=prepare' \
+          --header 'accept: application/json' \
+          --header 'authorization: Basic $AUTH_HEADER' \
+          --header 'referer: https://$NIM_IP/ui/settings/license'"
+    report_save_path="${output_file:-/tmp/response.zip}"
+
+    download_usage_command="curl --insecure --location 'https://$NIM_IP/api/platform/v1/report/download?format=zip&reportType=telemetry&telemetryAction=download' \
+      --header 'accept: */*' \
+      --header 'authorization: Basic $AUTH_HEADER' \
+      --output \"$report_save_path\""
+    if [ "$USE_CASE" == "telemetry" ]; then
+      echo "Running telemetry stage: "
+
+      # Run the saved command and store the response
+      response=$(eval $prepare_usage_command)
+
+      sleep 2
+      # Validate if the response contains "Report generation in progress"
+     if echo "$response" | grep -q '"telemetry":"Report generation in progress"'; then
+        echo -e "Success: Report generation is in progress."
+      else
+        echo -e "Failure: Report generation not in progress or unexpected response."
+        exit 1
+     fi
 
     echo "Running command: $download_usage_command"
     eval $download_usage_command
@@ -284,122 +284,187 @@ if [ "$step" == "telemetry" ]; then
     echo "Running command: $download_usage_command"
     eval $download_usage_command
   fi
+  fi
+else
+  # Perform the request and capture the status code and output
+  HTTP_RESPONSE=$(curl -k -sS -w "\n%{http_code}" --location "https://$NIM_IP/api/platform/v1/report/download?format=zip" \
+  --header "accept: application/json" \
+  --header "authorization: Basic $AUTH_HEADER" \
+  --header "content-type: application/json" \
+  --header "origin: https://$NIM_IP" \
+  --output /tmp/response.zip)
+  # Extract the HTTP status code (last line)
+  HTTP_STATUS=$(echo "$HTTP_RESPONSE" | tail -n1)
+
+  # Check the status code
+  if [ "$HTTP_STATUS" -ne 200 ]; then
+    echo -e "Failed to download usage report from NGINX Instance Manager. HTTP Status Code: $HTTP_STATUS" >&2
+    echo "Please verify that NGINX Instance Manager is reachable and the credentials are correct." >&2
+    echo "(or) Verify that NGINX Instance Manager is licensed before using the 'telemetry' flag (run it with 'initial' first)."
+    # Optionally, remove the partial or corrupt file
+    rm -f /tmp/response.zip
+    exit 1
+  fi
+fi
+
+echo -e "Usage report downloaded successfully as '/tmp/response.zip'."
+
+# Step 3: Upload the usage report to F5 server
+echo "Uploading the usage report to F5 Licensing server"
+
+TEEM_UPLOAD_URL="https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk"
+
+# Capture both response body and status code
+UPLOAD_RESULT=$(curl -sS -w "\n%{http_code}" --location "$TEEM_UPLOAD_URL" \
+  --header "Authorization: Bearer $JWT_CONTENT" \
+  --form "file=@/tmp/response.zip")
+
+# Extract HTTP status code and body
+UPLOAD_STATUS=$(echo "$UPLOAD_RESULT" | tail -n1)
+UPLOAD_BODY=$(echo "$UPLOAD_RESULT" | sed '$d')
+
+# Validate HTTP status code
+if [ "$UPLOAD_STATUS" -ne 202 ]; then
+  echo -e "Usage report upload failed. HTTP Status: $UPLOAD_STATUS$" >&2
+  echo "Response Body: $UPLOAD_BODY" >&2
+  exit 1
+fi
+
+# Check if response is valid JSON
+if ! echo "$UPLOAD_BODY" | jq empty >/dev/null 2>&1; then
+  echo -e "Upload response is not valid JSON. Response: $UPLOAD_BODY$" >&2
+  exit 1
+fi
+
+# Extract the statusLink
+STATUS_LINK=$(echo "$UPLOAD_BODY" | jq -r '.statusLink // empty')
 
-############################################################
-# Step 3: Upload the telemetry report to F5's licensing endpoint
-############################################################
-echo "############################################################"
-echo "# Upload the telemetry report to F5's licensing endpoint  #"
-echo "############################################################"
-
-echo "Uploading $report_save_path to telemetry endpoint..."
-upload_command="curl --location 'https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk' \
---header 'Authorization: Bearer $bearer_token' \
---form 'file=@\"$report_save_path\"'"
-
-response=$(eval $upload_command)
-echo "Response from upload: $response"
-
-############################################################
-# Step 4: Extract the status ID from the response
-############################################################
-echo "############################################################"
-echo "# Extract status ID from the response#"
-echo "############################################################"
-
-status_link=$(jq -r '.statusLink | split("/") | last' <<< "$response")
-if [ -z "$status_link" ]; then
-  echo "Failed to extract status link from response. Please try again."
+if [ -z "$STATUS_LINK" ]; then
+  echo -e "Failed to extract statusLink from the upload response. Response: $UPLOAD_BODY$" >&2
   exit 1
 fi
-echo "Extracted status link ID: $status_link"
 
-##############################################################
-# Step 5: Check the status to ensure the acknowledgement file is ready to download
-############################################################
-echo "############################################################"
-echo "# Check the status to ensure the acknowledgement file is ready to download     #"
-echo "############################################################"
+echo "StatusLink extracted: $STATUS_LINK"
 
-# Initialize variables for the loop
-max_attempts=10
-attempt=0
+# Extract the unique status ID from the statusLink
+STATUS_ID=$(echo "$STATUS_LINK" | sed 's|/ee/v1/entitlements/telemetry/bulk/status/||')
 
-# Loop to check the status until percentageComplete and percentageSuccessful are 100 or the max attempts is reached
-while [ $attempt -lt $max_attempts ]; do
-  echo "Checking status for the upload... (Attempt: $((attempt + 1)))"
+# Step 4: Validate the submit report status
+echo "Validating the report status"
+echo "Validating report status using status ID: $STATUS_LINK"
 
-  # Run the curl command to get the status
-  status_command="curl --location 'https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk/status/$status_link' --header 'Authorization: Bearer $bearer_token'"
+STATUS_URL="https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk/status/$STATUS_ID"
 
-  status_response=$(eval $status_command)
+# Get the response from F5 status endpoint
+sleep 5
+STATUS_RESPONSE=$(curl -k -sS -w "\n%{http_code}" --location "$STATUS_URL" \
+  --header "Authorization: Bearer $JWT_CONTENT")
 
-  # Extract values from the response
-  percentage_complete=$(jq -r '.percentageComplete' <<< "$status_response")
-  percentage_successful=$(jq -r '.percentageSuccessful' <<<  "$status_response")
-  ready_for_download=$(jq -r '.readyForDownload' <<< "$status_response")
+# Separate body and HTTP status code
+STATUS_BODY=$(echo "$STATUS_RESPONSE" | sed '$d')
+STATUS_CODE=$(echo "$STATUS_RESPONSE" | tail -n1)
 
-  echo "Percentage Complete: $percentage_complete"
-  echo "Percentage Successful: $percentage_successful"
-  echo "Ready for Download: $ready_for_download"
+# Validate HTTP status
+if [ "$STATUS_CODE" -ne 200 ]; then
+  echo -e "Status check failed. HTTP Status: $STATUS_CODE$" >&2
+  echo "Response Body: $STATUS_BODY" >&2
+  exit 1
+fi
+
+# Validate that it's valid JSON
+if ! echo "$STATUS_BODY" | jq empty >/dev/null 2>&1; then
+  echo -e "Invalid JSON in status body: $STATUS_BODY$" >&2
+  exit 1
+fi
+
+# Now safely extract values
+PERCENTAGE_COMPLETE=$(echo "$STATUS_BODY" | jq -r '.percentageComplete')
+PERCENTAGE_SUCCESSFUL=$(echo "$STATUS_BODY" | jq -r '.percentageSuccessful')
+READY_FOR_DOWNLOAD=$(echo "$STATUS_BODY" | jq -r '.readyForDownload')
 
-  # Check if the report is ready for download
-  if [ "$percentage_complete" == "100" ] && [ "$percentage_successful" == "100" ] && [ "$ready_for_download" == "true" ]; then
-    echo "File is ready for download."
+# Set a time limit (in seconds)
+TIME_LIMIT=30  # 30 sec for example
+START_TIME=$(date +%s)
+
+# Function to calculate elapsed time
+elapsed_time() {
+  echo $(($(date +%s) - $START_TIME))
+}
+
+# Keep checking until conditions are met or time limit is reached
+while true; do
+  # Validate all required conditions
+  if [ "$PERCENTAGE_COMPLETE" -eq "100" ] && [ "$READY_FOR_DOWNLOAD" == "true" ]; then
+    echo -e "Validating Report."
     break
-  else
-    echo "File is not ready for download yet. Sleeping for 2 seconds..."
-    sleep 2
   fi
 
-  # Increment the attempt counter
-  attempt=$((attempt + 1))
+  # Check if we've exceeded the time limit
+  if [ $(elapsed_time) -ge "$TIME_LIMIT" ]; then
+    echo -e "Time limit exceeded. Report validation failed."
+    echo "  percentageComplete: $PERCENTAGE_COMPLETE"
+    echo "  percentageSuccessful: $PERCENTAGE_SUCCESSFUL"
+    echo "  readyForDownload: $READY_FOR_DOWNLOAD"
+    echo "  F5 upload issue failed even after 30 seconds"
+    echo "  re-run the script"
+    exit 1
+  fi
+
+  # Print current validation status
+  echo -e "Report validation failed. Waiting for conditions to be met...$"
+  echo "  percentageComplete: $PERCENTAGE_COMPLETE"
+  echo "  percentageSuccessful: $PERCENTAGE_SUCCESSFUL"
+  echo "  readyForDownload: $READY_FOR_DOWNLOAD"
+
+  # Sleep for some time before checking again (e.g., 30 seconds)
+  sleep 5
 done
 
-# If after 10 attempts it's still not ready, show a message
-if [ $attempt -eq $max_attempts ]; then
-  echo "Reached maximum attempts. The file is not ready for download."
+echo -e "Report validated successfully. All conditions met."
+
+# Step 5: Download the report from F5
+
+echo "Downloading report from F5 License server..."
+
+DOWNLOAD_URL="https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk/download/$STATUS_ID"
+DOWNLOAD_RESPONSE=$(curl -sS -w "%{http_code}" --location "$DOWNLOAD_URL" \
+  --header "Authorization: Bearer $JWT_CONTENT" \
+  --output /tmp/response_teem.zip)
+
+# Check HTTP status code
+HTTP_STATUS=$(echo "$DOWNLOAD_RESPONSE" | tail -n1)
+if [ "$HTTP_STATUS" -ne 200 ]; then
+  echo -e "Failed to download the report from F5. HTTP Status Code: $HTTP_STATUS$" >&2
   exit 1
 fi
 
-############################################################
-# Step 6: Download the acknowledgement file from F5's licensing endpoint
-############################################################
-echo "############################################################"
-echo "# Download the acknowledgement report from F5's licensing endpoint #"
-echo "############################################################"
-
-# Extract downloadLink
-download_link=$(jq -r '.downloadLink | split("/") | last' <<< "$status_response")
-echo $download_link
-# Ensure the report_save_path is not empty
-if [ -z "$report_save_path" ]; then
-  # If the report_save_path is empty, set a default path and filename
-  report_save_path="report_download.zip"
-fi
+echo -e "Report downloaded successfully from F5 as '/tmp/response_teem.zip'."
 
-echo "Downloading file from telemetry..."
+# Step 6: Upload the acknowledgement report to NGINX Instance Manager
+echo "Uploading the license acknowledgement to NGINX Instance Manager..."
 
-download_command="curl --location 'https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk/download/$download_link' \
-        --header 'Authorization: Bearer $bearer_token' \
-        --output '$report_save_path'"
+UPLOAD_URL="https://$NIM_IP/api/platform/v1/report/upload"
+UPLOAD_RESPONSE=$(curl -k -sS --location "$UPLOAD_URL" \
+  --header "Authorization: Basic $AUTH_HEADER" \
+  --form "file=@/tmp/response_teem.zip" \
+  -w "%{http_code}" -o /tmp/temp_response.json)
 
-curl --location "https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk/download/$download_link" \
---header "Authorization: Bearer $bearer_token" \
---output "$report_save_path"
+# Extract the HTTP status code
+HTTP_STATUS=$(echo "$UPLOAD_RESPONSE" | tail -n1)
 
-echo "Downloaded file saved as: $report_save_path"
+# Extract the message from the response body (temp_response.json)
+UPLOAD_MESSAGE=$(cat /tmp/temp_response.json | jq -r '.message')
 
-############################################################
-# Step 7: Upload the acknowledgement report to NGINX Instance Manager
-############################################################
-echo "############################################################"
-echo "# Upload the acknowledgement report to NGINX Instance Manager   #"
-echo "############################################################"
+# Ensure HTTP_STATUS is a valid integer
+if ! [[ "$HTTP_STATUS" =~ ^[0-9]+$ ]]; then
+  echo -e "Invalid HTTP status code. Response: $UPLOAD_RESPONSE$" >&2
+  exit 1
+fi
 
-curl --insecure --location "https://$ip_address/api/platform/v1/report/upload" \
---header "Authorization: Basic $basic_auth" \
---form "file=@\"$report_save_path\"" \
---silent --output /dev/null
+# Check if the upload response contains the success message and validate the status code
+if [ "$UPLOAD_MESSAGE" != "Report uploaded successfully." ] || [ "$HTTP_STATUS" -ne 200 ]; then
+  echo -e "Upload failed. Response: $UPLOAD_RESPONSE$" >&2
+  exit 1
+fi
+echo -e "Acknowledgement uploaded successfully to NGINX Instance Manager."
 
-echo "Report acknowledgement successfully uploaded to NGINX Instance Manager $ip_address."

From a4f9eb261c0c5a4d81929b85a41b7634de4e37ce Mon Sep 17 00:00:00 2001
From: Travis Martin <33876974+travisamartin@users.noreply.github.com>
Date: Mon, 16 Jun 2025 11:28:50 -0700
Subject: [PATCH 021/117] edits to NIM 2.20 docs and install script (#686)

* edits to NIM 2.20 docs and install script

* updates to install script

* edits

* edits to tech spec guide

* fix: Update install-nim-bundle.sh

---------

Co-authored-by: Chetan Jain <46200286+Chetan-99@users.noreply.github.com>
---
 .../disable-metrics-collection.md             |  2 +-
 .../deploy/kubernetes/deploy-using-helm.md    |  2 +-
 .../vm-bare-metal/install-nim-manual.md       |  8 +++----
 .../add-license-disconnected-deployment.md    |  8 +++----
 content/nim/fundamentals/tech-specs.md        | 23 ++++++++++++++-----
 .../configure-clickhouse.md                   | 20 +++++++++++-----
 static/scripts/install-nim-bundle.sh          | 23 ++++++++++---------
 7 files changed, 53 insertions(+), 33 deletions(-)
 mode change 100755 => 100644 static/scripts/install-nim-bundle.sh

diff --git a/content/includes/nim/installation/optional-steps/disable-metrics-collection.md b/content/includes/nim/installation/optional-steps/disable-metrics-collection.md
index 9ccd93654..3204e6299 100644
--- a/content/includes/nim/installation/optional-steps/disable-metrics-collection.md
+++ b/content/includes/nim/installation/optional-steps/disable-metrics-collection.md
@@ -6,6 +6,6 @@ files:
 - content/nim/disconnected/offline-install-guide.md
 ---
 
-If you’re not collecting metrics—because you didn’t install ClickHouse or don’t plan to use it—you must disable metrics collection in the `/etc/nms/nms.conf` file. This setup requires NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}.
+If you’re not collecting metrics — because you didn’t install ClickHouse or don’t plan to use it — you must disable metrics collection in the `/etc/nms/nms.conf` and `/etc/nms/nms-sm-conf.yaml` files. This setup requires NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}.
 
 For instructions, see [Disable metrics collection]({{< ref "nim/system-configuration/configure-clickhouse.md#disable-metrics-collection" >}}).
\ No newline at end of file
diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md
index 3b36c5a0e..bed9203a9 100644
--- a/content/nim/deploy/kubernetes/deploy-using-helm.md
+++ b/content/nim/deploy/kubernetes/deploy-using-helm.md
@@ -72,7 +72,7 @@ kubectl create secret docker-registry regcred \
 ### OpenShift
 
 ```shell
-oc new-project nms
+oc new-project nms && \
 oc create secret docker-registry regcred \
   --docker-server=private-registry.nginx.com \
   --docker-username=<NGINX JWT Token> \
diff --git a/content/nim/deploy/vm-bare-metal/install-nim-manual.md b/content/nim/deploy/vm-bare-metal/install-nim-manual.md
index fa8f6df42..3c8e956c0 100644
--- a/content/nim/deploy/vm-bare-metal/install-nim-manual.md
+++ b/content/nim/deploy/vm-bare-metal/install-nim-manual.md
@@ -58,7 +58,7 @@ Follow these steps to download the certificate and private key for NGINX Instanc
 
 Install NGINX Open Source or NGINX Plus on the host where you'll install NGINX Instance Manager. NGINX Instance Manager uses NGINX as a front-end proxy and for managing user access.
 
-- [Installing NGINX and NGINX Plus](https://docs.nginx.com/nginx/admin-guide/installing-nginx/)
+- [Installing NGINX and NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}})
 
    <br>
 
@@ -88,9 +88,9 @@ Make sure to review the [Technical Specifications]({{< ref "/nim/fundamentals/te
 
 NGINX Instance Manager uses ClickHouse to store metrics, events, alerts, and configuration data.
 
-In 2.20.0, we introduced Lightweight mode, which can skip the ClickHouse installation entirely. It’s ideal if you don’t need monitoring data or want a simpler setup. This reduces system requirements and avoids the work of managing a metrics database. You can add ClickHouse later if your needs change.
+Starting in version 2.20.0, you can run NGINX Instance Manager in Lightweight mode, which skips the ClickHouse installation entirely. This setup works well if you don’t need monitoring data or want to reduce system requirements. It also avoids the effort of managing a metrics database. You can add ClickHouse later if your needs change.
 
-If you don’t need to store metrics, you can skip installing ClickHouse. But you must use NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}, and you must disable metrics collection in the `/etc/nms/nms.conf` file.
+If you don’t need to store metrics, you can skip installing ClickHouse. But you must use NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}, and you must disable metrics collection in the `/etc/nms/nms.conf` and `/etc/nms-sm.conf.yaml` files.
 
 For instructions, see [Disable metrics collection]({{< ref "nim/system-configuration/configure-clickhouse.md#disable-metrics-collection" >}}).
 
@@ -203,7 +203,7 @@ To install NGINX Instance Manager, you need to add the official repository to pu
 1. To upgrade to the latest version of the Instance Manager, run the following command:
 
    ```bash
-   sudo apt-get update
+   sudo apt-get update && \
    sudo apt-get install -y --only-upgrade nms-instance-manager
    ```
 
diff --git a/content/nim/disconnected/add-license-disconnected-deployment.md b/content/nim/disconnected/add-license-disconnected-deployment.md
index e4a272a6a..1039852aa 100644
--- a/content/nim/disconnected/add-license-disconnected-deployment.md
+++ b/content/nim/disconnected/add-license-disconnected-deployment.md
@@ -18,7 +18,7 @@ type:
 
 This guide shows you how to add a license to NGINX Instance Manager in a disconnected (offline) environment. In this setup, systems don’t have internet access. You’ll download and apply your subscription’s JSON Web Token (JWT) license, then verify your entitlements with F5.
 
-{{< call-out "tip" "Using the REST API" "" >}}{{< include "nim/how-to-access-nim-api.md" >}}{{</call-out>}}
+{{< call-out "tip" "Using the REST API" "" >}}{{< include "nim/how-to-access-nim-api.md" >}}{{</ call-out >}}
 
 
 ## Before you begin
@@ -39,7 +39,7 @@ To configure NGINX Instance Manager for a disconnected environment, you need to
 ## Add license and submit initial usage report {#add-license-submit-initial-usage-report}
 
 
-{{<tabs name="submit-usage-report">}}
+{{< tabs name="submit-usage-report" >}}
 
 {{%tab name="Bash script (recommended)"%}}
 
@@ -86,7 +86,7 @@ To license NGINX Instance Manager, complete each of the following steps in order
 
 Run these `curl` commands on a system that can access NGINX Instance Manager and connect to `https://product.apis.f5.com/` on port `443`. Replace each placeholder with your specific values.
 
-{{<important>}}The `-k` flag skips SSL certificate validation. Use this only if your NGINX Instance Manager is using a self-signed certificate or if the certificate is not trusted by your system.{{</important>}}
+{{< important >}}The `-k` flag skips SSL certificate validation. Use this only if your NGINX Instance Manager is using a self-signed certificate or if the certificate is not trusted by your system.{{</ important >}}
 
 1. **Add the license to NGINX Instance Manager**:
 
@@ -117,7 +117,7 @@ Run these `curl` commands on a system that can access NGINX Instance Manager and
     --header "referer: https://<NIM-FQDN>/ui/settings/license"
     ```
 
-1. **Update the license configuration on NGINX Instance Manager**:
+1. **Update the license configuration on NGINX Instance Manager (not required in 2.20 or later)**:
 
    This step ensures that the license configuration is fully applied.
 
diff --git a/content/nim/fundamentals/tech-specs.md b/content/nim/fundamentals/tech-specs.md
index d5035bac0..685794aec 100644
--- a/content/nim/fundamentals/tech-specs.md
+++ b/content/nim/fundamentals/tech-specs.md
@@ -38,13 +38,13 @@ This section outlines the recommendations for NGINX Instance Manager deployments
 
 We recommend using SSDs to enhance storage performance.
 
-{{<bootstrap-table "table table-striped table-bordered">}}
+{{< bootstrap-table "table table-striped table-bordered" >}}
 | Number of Data Plane Instances | CPU    | Memory   | Network   | Storage |
 |--------------------------------|--------|----------|-----------|---------|
 | 10                             | 2 vCPU | 4 GB RAM | 1 GbE NIC | 100 GB  |
 | 100                            | 2 vCPU | 4 GB RAM | 1 GbE NIC | 1 TB    |
 | 1000                           | 4 vCPU | 8 GB RAM | 1 GbE NIC | 3 TB    |
-{{</bootstrap-table>}}
+{{</ bootstrap-table >}}
 
 These values represent the minimum resources needed for deployments that fall under standard configurations.
 
@@ -52,22 +52,33 @@ These values represent the minimum resources needed for deployments that fall un
 
 For environments requiring more resources, **large configurations** are suitable. These configurations can support up to **300 upstream servers** and are designed for enterprise environments or applications handling high traffic and complex configurations, without NGINX App Protect.
 
-{{<bootstrap-table "table table-striped table-bordered">}}
+{{< bootstrap-table "table table-striped table-bordered" >}}
 | Number of Data Plane Instances | CPU    | Memory   | Network   | Storage |
 |--------------------------------|--------|----------|-----------|---------|
 | 50                             | 4 vCPU | 8 GB RAM | 1 GbE NIC | 1 TB    |
 | 250                            | 4 vCPU | 8 GB RAM | 1 GbE NIC | 2 TB    |
-{{</bootstrap-table>}}
+{{</ bootstrap-table >}}
 
 ### NGINX configuration deployments with NGINX App Protect {#system-sizing-app-protect}
 
 If using NGINX App Protect features in NGINX Instance Manager, this requires additional CPU and Memory for policy compilation and security monitoring features. At a minimum, 8gb Memory and 4 CPUs are required for a standard NGINX App Protect use case (under 20 NGINX Plus instances). The requirements are heavily dependent on the number of policies being managed, the frequency of updates and the number of events being that occur in the security monitoring feature.
 
+### Lightweight mode {#lightweight-mode}
+
+(New in 2.20.0) You can run NGINX Instance Manager without installing ClickHouse. This setup is useful if you don’t need monitoring data or prefer a simpler deployment. It reduces system requirements and removes the need to manage a metrics database. You can add ClickHouse later if your needs change. For instructions, see [Disable metrics collection]({{< ref "nim/system-configuration/configure-clickhouse.md#disable-metrics-collection" >}}).
+
+In Lightweight mode, we tested NGINX Instance Manager with ten managed NGINX instances and configuration publishing. It ran with as little as 1 CPU core and 1 GB of memory (without App Protect). When App Protect was enabled, we needed 2 CPU cores and 4 GB of memory to compile policies.
+
+These figures are guidelines only. They reflect the minimum tested configuration and may cause performance issues depending on your setup. For better performance, consider allocating more system resources.
+
+
 ### License and usage reporting only {#reporting-sizing}
 
-This section assumes you've configured NGINX Instance Manager to manage your NGINX instances for licensing and usage reporting only. NGINX commercial license and usage reporting is done in an “unmanaged” way, where NGINX sends a request periodically to NGINX Instance Manager solely for counting purposes. For more information, see how you would [Prepare your environment for reporting]({{< ref "/solutions/about-subscription-licenses.md#set-up-environment" >}}).
+This section applies when you’ve set up NGINX Instance Manager to handle licensing and usage reporting only. In this setup, NGINX instances report license and usage data in an "unmanaged" way. Each instance sends periodic updates to NGINX Instance Manager for counting purposes only.
+
+For details on how to configure this setup, see [Prepare your environment for reporting]({{< ref "/solutions/about-subscription-licenses.md#set-up-environment" >}}).
 
-Therefore, the requirements for NGINX Instance Manager when used solely for licensing and usage reporting are minimal.
+When used only for licensing and usage reporting, NGINX Instance Manager has minimal system requirements. We recommend using [Lightweight mode](#lightweight-mode) in this case to avoid the ClickHouse dependency, especially if you don’t plan to use other features.
 
 {{<bootstrap-table "table table-striped table-bordered">}}
 | Number of Data Plane Instances | CPU    | Memory   | Network   | Storage |
diff --git a/content/nim/system-configuration/configure-clickhouse.md b/content/nim/system-configuration/configure-clickhouse.md
index 3f4a7f1be..2e2990d21 100644
--- a/content/nim/system-configuration/configure-clickhouse.md
+++ b/content/nim/system-configuration/configure-clickhouse.md
@@ -13,7 +13,7 @@ type:
 ## Overview
 
 NGINX Instance Manager uses ClickHouse to store metrics, events, alerts, and configuration data.  
-If your setup differs from the default configuration—for example, if you use a custom address, enable TLS, set a password, or turn off metrics—you need to update the `/etc/nms/nms.conf` file.
+If your setup differs from the default configuration — for example, if you use a custom address, enable TLS, set a password, or turn off metrics — you need to update the `/etc/nms/nms.conf` file.
 
 This guide explains how to update those settings so that NGINX Instance Manager can connect to ClickHouse correctly.
 
@@ -38,19 +38,27 @@ Unless otherwise specified in the `/etc/nms/nms.conf` file, NGINX Instance Manag
 
 ## Disable metrics collection
 
-As of version 2.20, NGINX Instance Manager can run without ClickHouse. This lightweight mode reduces system requirements and simplifies installation for users who do not need metrics. To use this setup, you must run NGINX Agent version {{< lightweight-nim-nginx-agent-version >}}.
+Starting in version 2.20, NGINX Instance Manager can run without ClickHouse. This lightweight mode reduces system requirements and simplifies installation for users who don't need metrics. To use this setup, you must run NGINX Agent version `{{< lightweight-nim-nginx-agent-version >}}`.
 
 To disable metrics collection after installing NGINX Instance Manager:
 
-1. Open the configuration file at `/etc/nms/nms.conf`.
-
+1. Open the config file at `/etc/nms/nms.conf`.
+   
 2. In the `[clickhouse]` section, set the following value:
 
    ```yaml
-   enable = false
+   clickhouse:
+      enable = false
    ```
 
-3. Restart the NGINX Instance Manager service:
+3. Open the `/etc/nms/nms-sm-conf.yaml` file and set:
+
+   ```yaml
+   clickhouse:
+      enable = false
+   ```
+
+4. Restart the NGINX Instance Manager service:
 
    ```shell
    sudo systemctl restart nms
diff --git a/static/scripts/install-nim-bundle.sh b/static/scripts/install-nim-bundle.sh
old mode 100755
new mode 100644
index 7dc020eac..fb60d615a
--- a/static/scripts/install-nim-bundle.sh
+++ b/static/scripts/install-nim-bundle.sh
@@ -566,14 +566,9 @@ This action deletes all files in the following directories: /etc/nms , /etc/ngin
 getLatestPkgVersionFromRepo(){
     repoUrl=$1
     version=$2
-    pkg_extension=$3
-    if [[ "${pkg_extension}" == "rpm" ]]; then
-        response=$(curl --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} -sL  "${repoUrl}" | awk -F '"' '/href=/ {print $2}' | grep -E "$version"|  sort -t'-' -k4,4V | tac)
-        readarray -t versions < <(printf "%s" "${response}")
-    else
-        response=$(curl --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} -sL  "${repoUrl}" | awk -F '"' '/href=/ {print $2}' | grep -E "$version"|  sort -t'_' -k2,2V | tac)
-        readarray -t versions < <(printf "%s" "${response}")
-    fi
+    sort_fields=$3
+    response=$(curl --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} -sL  "${repoUrl}" | awk -F '"' '/href=/ {print $2}' | grep -E "$version"|  eval sort "$sort_fields" | tac)
+    readarray -t versions < <(printf "%s" "${response}")
     if [ "${#versions[@]}" -eq 0 ]; then
         printf "Package %s not found. See available versions:" "${versions[@]}"
         exit 1;
@@ -602,22 +597,26 @@ package_nim_offline(){
         cd "${TEMP_DIR}/${TARGET_DISTRIBUTION}" || echo "directory ${TEMP_DIR} does not exits"
         if [[ "${USE_NGINX_PLUS}" == "true" ]]; then
             NGINX_PLUS_PACKAGE="^nginx-plus_[0-9]+-([0-9]+)~${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}_${OS_ARCH}\.${PKG_EXTENSION}$"
+            SORT_FIELDS="-t'_' -k2,2V"
             if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
                NGINX_PLUS_PACKAGE="^nginx-plus-[0-9]+-([0-9]+)${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}\.${PKG_EXTENSION}$"
+               SORT_FIELDS="-t'-' -k3,3V"
             fi
             echo "regex for looking latest version : ${NGINX_PLUS_PACKAGE}"
-            NGINX_PLUS_VERSION=$(getLatestPkgVersionFromRepo "${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}" "${NGINX_PLUS_PACKAGE}" "${PKG_EXTENSION}")
+            NGINX_PLUS_VERSION=$(getLatestPkgVersionFromRepo "${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}" "${NGINX_PLUS_PACKAGE}" "${SORT_FIELDS}")
             echo "latest version for nginx_plus is ${NGINX_PLUS_VERSION}"
             echo "Downloading ${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_PLUS_VERSION}...."
             curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} "${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_PLUS_VERSION}"
             check_last_command_status "curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH} \"${NGINX_PLUS_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_PLUS_VERSION}\"" $?
         else
             NGINX_OSS_PACKAGE="^nginx_[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)~${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}_${OS_ARCH}\.${PKG_EXTENSION}$"
+            SORT_FIELDS="-t'_' -k2,2V"
             if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
               NGINX_OSS_PACKAGE="^nginx-[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}\.${PKG_EXTENSION}$"
+               SORT_FIELDS="-t'-' -k2,2V"
             fi
             echo "fetching latest version using ${NGINX_OSS_PACKAGE}"
-            NGINX_OSS_VERSION=$(getLatestPkgVersionFromRepo "${NGINX_REPO[${TARGET_DISTRIBUTION}]}" "${NGINX_OSS_PACKAGE}" "${PKG_EXTENSION}")
+            NGINX_OSS_VERSION=$(getLatestPkgVersionFromRepo "${NGINX_REPO[${TARGET_DISTRIBUTION}]}" "${NGINX_OSS_PACKAGE}" "${SORT_FIELDS}")
             echo "latest version for nginx is ${NGINX_OSS_VERSION}"
             echo "Downloading ${NGINX_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_OSS_VERSION}...."
             curl -sfLO "${NGINX_REPO[${TARGET_DISTRIBUTION}]}/${NGINX_OSS_VERSION}"
@@ -649,10 +648,12 @@ package_nim_offline(){
             check_last_command_status "curl -sfLO \"${CLICKHOUSE_CLIENT_PATH}\"" $?
         fi
         NIM_PACKAGE_PATH="^nms-instance-manager_[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)~${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}_${OS_ARCH}\.${PKG_EXTENSION}$"
+        SORT_FIELDS="-t'_' -k2,2V"
         if [[ "${PKG_EXTENSION}" == "rpm" ]]; then
            NIM_PACKAGE_PATH="^nms-instance-manager-[0-9]+\.[0-9]+\.[0-9]+-([0-9]+)${OS_DISTRO_MAP[${TARGET_DISTRIBUTION}]}\.${PKG_EXTENSION}$"
+           SORT_FIELDS="-t'-' -k4,4V"
         fi
-        NIM_PACKAGE_VERSION=$(getLatestPkgVersionFromRepo "${NIM_REPO[${TARGET_DISTRIBUTION}]}" "${NIM_PACKAGE_PATH}" "${PKG_EXTENSION}")
+        NIM_PACKAGE_VERSION=$(getLatestPkgVersionFromRepo "${NIM_REPO[${TARGET_DISTRIBUTION}]}" "${NIM_PACKAGE_PATH}" "${SORT_FIELDS}")
         echo "Latest version for nginx instance manager is ${NIM_PACKAGE_VERSION}...."
         curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH}  "${NIM_REPO[${TARGET_DISTRIBUTION}]}/${NIM_PACKAGE_VERSION}"
         check_last_command_status "curl -sfLO --cert ${NGINX_CERT_PATH} --key ${NGINX_CERT_KEY_PATH}  \"${NIM_REPO[${TARGET_DISTRIBUTION}]}/${NIM_PACKAGE_VERSION}\"" $?

From a1263f99fa4ad093918d1eee37790a74f31eff56 Mon Sep 17 00:00:00 2001
From: Saylor Berman <s.berman@f5.com>
Date: Mon, 16 Jun 2025 13:43:01 -0600
Subject: [PATCH 022/117] Update NGF example certs (#683)

Problem: The BackendTLSPolicy guide was using expired certs in its example configuration.

Solution: Update the sample certs to expire in 10 years.
---
 .../ngf/traffic-security/secure-backend.md    | 53 +++++++++++--------
 1 file changed, 32 insertions(+), 21 deletions(-)

diff --git a/content/ngf/traffic-security/secure-backend.md b/content/ngf/traffic-security/secure-backend.md
index d532bdbc3..cde85cd2a 100644
--- a/content/ngf/traffic-security/secure-backend.md
+++ b/content/ngf/traffic-security/secure-backend.md
@@ -105,8 +105,8 @@ metadata:
   name: app-tls-secret
 type: Opaque
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lVVDQwYTFYd3doUHVBdDJNMkdZZUovYXluZlFBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1JqRWZNQjBHQTFVRUF3d1djMlZqZFhKbExXRndjQzVsZUdGdGNHeGxMbU52YlRFTE1Ba0dBMVVFQmhNQwpWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1YzJselkyOHdIaGNOTWpRd01URTRNVGd3TVRBeFdoY05NalV3Ck1URTNNVGd3TVRBeFdqQi9NUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUdBMVVFQ0F3S1EyRnNhV1p2Y201cFlURVcKTUJRR0ExVUVCd3dOVTJGdUlFWnlZVzV6YVhOamJ6RU9NQXdHQTFVRUNnd0ZUa2RKVGxneEVqQVFCZ05WQkFzTQpDVTVIU1U1WUlFUmxkakVmTUIwR0ExVUVBd3dXYzJWamRYSmxMV0Z3Y0M1bGVHRnRjR3hsTG1OdmJUQ0NBU0l3CkRRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMeUx0eURNbTZ4M0ZEUFJsOGZ0azNweCtrRWQKYTVpTGZOQ3lDbUVjYktBQVBDNEhZckl5b1B5QXpSTlJCMWErekE0UTlrbzJZRG5vR0dkeFJaMEdydldKZUV2Mgo3MWlHNGxhbHRVTS9WOWNvSktQY0UyTEI0R3R6cFA3ckdIWXNvRDlOUXFpV3YwZ0lOdE42MjdrWGg4UW41V1hYCk92Y2FkS2h0bjJER3RvU0VzT3dpNzR5NEt3SmFkWnlwLzJaM0hPakRTNjVIVmxydmUxUXpBMVRzTEp6S3cva3gKbHBSR0lWK0lhUjZXbXZsaVFVdDJxWFg0L3hGeVVEM2Vic05TeXpHUk5mQ0NOTWxlWlV3MTR3ZUdhOEVnc2tDcQprOGdYSmpFZXQxMlR4OGxkY3BpVWlxYVpkOStYZjJmUS8yL2Y5c1IzM3Q4K0VVUWpoZ2ZIbHlsLzV1RUNBd0VBCkFhTjlNSHN3SHdZRFZSMGpCQmd3Rm9BVTRUT096c1d0Q3ZWdGJlWXFSU0FqN2tXajFkb3dDUVlEVlIwVEJBSXcKQURBTEJnTlZIUThFQkFNQ0JQQXdJUVlEVlIwUkJCb3dHSUlXYzJWamRYSmxMV0Z3Y0M1bGVHRnRjR3hsTG1OdgpiVEFkQmdOVkhRNEVGZ1FVZmtWREFFWmIwcjRTZ2swck10a0FvQ2c2RjRnd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQWFiQit6RzVSODl6WitBT2RsRy9wWE9nYjF6VkJsQ0dMSkhyYTl1cTMvcXRPR1VacDlnd2dZSWJ4VnkKUkVLbWVRa05pV0haSDNCSlNTZ3czbE9abGNxcW5xbUJ2OFAxTUxDZ3JqbDJSN1d2NVhkb2RlQkJxc0lvZkNxVgp3ZG51THJUU3RTbmd2MGhDcldBNlBmTnlQeXMzSGJva1k3RExNREhuNmhBQWcwMUNDT0pWWGpNZjFqLzNIMFNCClBQSWxtek5aRUpEd0JMR2hyb1V3aUY3NkNUV1Fudi8yc1pvWHMwUlFiRTY3TmNraXc2Z0svaWRwVTVzMmlkOEQKVExjVjNxenVFaE1ZeUlua0ZWNEJLZlFkTWxDQnE1QWdyU1Jqb2FoaCszbFRwYVpUalJGUGFVd3VZYXVsQXRzNgpra1ROaGltWWQ3Ym1aVk5MK2I0MzhmN1RMaGc9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzhpN2Nnekp1c2R4UXoKMFpmSDdaTjZjZnBCSFd1WWkzelFzZ3BoSEd5Z0FEd3VCMkt5TXFEOGdNMFRVUWRXdnN3T0VQWktObUE1NkJobgpjVVdkQnE3MWlYaEw5dTlZaHVKV3BiVkRQMWZYS0NTajNCTml3ZUJyYzZUKzZ4aDJMS0EvVFVLb2xyOUlDRGJUCmV0dTVGNGZFSitWbDF6cjNHblNvYlo5Z3hyYUVoTERzSXUrTXVDc0NXbldjcWY5bWR4em93MHV1UjFaYTczdFUKTXdOVTdDeWN5c1A1TVphVVJpRmZpR2tlbHByNVlrRkxkcWwxK1A4UmNsQTkzbTdEVXNzeGtUWHdnalRKWG1WTQpOZU1IaG12QklMSkFxcFBJRnlZeEhyZGRrOGZKWFhLWWxJcW1tWGZmbDM5bjBQOXYzL2JFZDk3ZlBoRkVJNFlICng1Y3BmK2JoQWdNQkFBRUNnZ0VBUXJucGJleXJmVTVKTW91Ty9UenBrQkJ0UWdVZzhvUVBBS2E1d0tONEYrbnQKWWxiUHlZUGNjSEErNDRLdUo3ZHZiTno0NU11NG8xV3Q2Vkh2a29KdWdjd01iRW53YTdLVXdKaDFmVjZaL2pXaApQZkpoVS9hTUwwcm1qaWJ5YWNRaVZEVEtEZk1Ici96a05sVEpGUWlzVGpIV1lBUGJSTjh5Z1BjR3pBK1hRVzg5CmxsOFdoeWwrZndjRVAzNTM4TUdKYUpHVmV4Q2d5cVRyKzZwQ29yRUpFL1pSNytiMTNyejRsbmxpZXVYa2pCVkcKSnYvUVI0RVhTSDhuRit3K2FvWTFQaGd2QnFJTnFQZjJMT1V0MzNiN3FDTkFmSVBRdFZFejJsN3NqbmJlcElTTwpvTkhNUFY0N21XTzY2dzhFMzJVMjNjVEtUbytJcWovM0d1eGhweXlYaHdLQmdRRDVNRDhmY3ZyM0xVZHkvZ3I0Ci82MVBqUXNSaWRYdjN0Mk1MVEk4UkduNzJWcGxvVVExNDZHV2xGTGVVVDY1L1ZVMjNsZFUrUWt2eFNMK3U1bW4KRUJIdXUyVmtBUWVYcUJXWkpPTmFSZG9Ia1YzK2Fyc0U4Qld0SWVtZHJ0MWN6bHFjc1VzMWdGdG1COGI3RHB3UwpHKzRoZDlzZG0weDBNS2hoOFVGOUQrZytUd0tCZ1FEQnN4dUpoZ1hnck14S0dVMHJ5MW9WWTJtMGpDUEpJcTkzCmNZRUZGY3lYZ0U4OWlDVmlob3dVVE8yMXpTZ3o0SVVKNUxoc2M5N3VIVER1VXdwcVI5NFBsdjlyaXJvakowM1UKT3FyWHgwbWdNN2xibVM1L1RwS0czZG1QblZ0WEZMektISFgyWDVnUW56emYvdXVKK3NtbDVLQW5WN0VZc1oxcgpkVXJvRm8zcnp3S0JnUUNZdjM5aUdzeEdLaVpMRWZqTjY0UmthRFBwdTFFOTZhSnE0K1dRVmV1VnF3V2ptTGhFClJGWHdCTm5MVjRnWTRIYVUzTFF4N1RvNVl5RnhmclBRV2FSMGI4RFdEVitIRWt5ekJJNnM3bmFZL3YzY0Q3YTIKYnlrS2FPaFlkVEZTUzFmMkJ5UHdGczl2K3NKNWNOb3dxNWhNUWJrNks5RXd4QWJqaXN5M0NjSTJOd0tCZ1FDbwo2c2pZNVVlNjV2WkFxRS9rSVRJdDlNUDU3enhGNnptWnNDSVRqUzhkNzRjcTRjKzRYQjFNbHNtMkFYTk55ajQ2Cm9uc3lHTm9RVE9TZThVdmo0MGlEeitwdW5rdzAyOUhEZ21YNlJwQ3VaRzBBdEZVWU1DMFg3K0FLbmU5SndZdmgKdFhBcHFyT3h5eXdMS3dPOUVEZEp0RmIxK0VNNGhhd0NTZ2RJM21KbGdRS0JnRzIxeEJNRXRzMFBVN3lDYTZ0YwpadDc1NUV4aEdkR3F5MmtHYmtmdzBEaHBQQVVUZmdncVF3NVBYdGVIS1ZBSDlKaG5kVnBBZFFxNmZ1MER1MDNKCkl0cGpxNWluZXVoR0x0alpMR1Nhd0dwY0FUU3h4Z3dCM0l0Z29LKzBCRFhteWxId0lEcUc5Z2crRU5KK0VhL0MKeTFOMmV0ZG1sQ01hNjM4cVJlNFlTWk55Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVpekNDQW5PZ0F3SUJBZ0lVQ0g2NWhwVDNkSlI0SVdPTXdaL2lCb3M5Q0Rrd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1d6RUxNQWtHQTFVRUJoTUNWVk14Q3pBSkJnTlZCQWdNQWxkQk1SQXdEZ1lEVlFRSERBZFRaV0YwZEd4bApNUk13RVFZRFZRUUtEQXBGZUdGdGNHeGxJRU5CTVJnd0ZnWURWUVFEREE5RmVHRnRjR3hsSUZKdmIzUWdRMEV3CkhoY05NalV3TmpFMk1UVXpOelUzV2hjTk16VXdOakUwTVRVek56VTNXakJnTVFzd0NRWURWUVFHRXdKVlV6RUwKTUFrR0ExVUVDQXdDVjBFeEVEQU9CZ05WQkFjTUIxTmxZWFIwYkdVeEVUQVBCZ05WQkFvTUNFWTFJRTVIU1U1WQpNUjh3SFFZRFZRUUREQlp6WldOMWNtVXRZWEJ3TG1WNFlXMXdiR1V1WTI5dE1JSUJJakFOQmdrcWhraUc5dzBCCkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTM3M0JyRG5kU1Z1UG0xSm5VNCtFVFZqSTFVSTJydVhIY0srUUJ5am4KNk5jMklEZ0NPNzdMOVdTajQzcmRicnlKNm1LMEFrVTBjekhlM1ZVUndaaG95TlM2QnEwaHJIOTFOWHlVcGNaMQpzaTJrbEdFbnVRYSs4dHgrVUwrUGYzck4yTlZ2TytTdnZSL2NxUWpYNnEzeURVMXJLWTZEQUlWaWxBNytDdHhVClE0KzI2MXluSlNTaWZ6YnB0R1ExTmZuV1Y5eHNoOWNyVklqbk9MNlhiek90eHNoYnBxU04xVENoQTR0KzVSb0kKOFo0aG0wWmpMNll3bVYycDB0R2ZFbVV0WGszelRjVVRYTitSODE4MVE0c0JPbEt5YjJpMG1seE9GYUpqc3hQVAprYjBsQmU2WS95TVBrallaT0o5c3YwR0k1YmszaHUwb0lGRDBOb0N5bFNmUmx3SURBUUFCbzBJd1FEQWRCZ05WCkhRNEVGZ1FVS29FbkhWU1dqSFRIeEVoK2xFazFQT2hUYWU4d0h3WURWUjBqQkJnd0ZvQVU0NS9URHQwUVE5dTQKTDN5OVJUOW50Z0VhQnE0d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dJQkFBN1ZNKzZ6bEtKZGlZVElWTjN4ZzJrOApkUG1zSm8vR1UwRW1WTFRzaFJtQWppdnI0bXBkYXRpL0p2UEtIcGtSTTNLcDNqQURmVFRqRnhuZ2ZJajNSN1J5CkpJamZVMGdrdHBKOG9UWVJlMlNsdXdVQ2VrYWlLa1BmWDRLdHcwUWVRSU4vSVN6YTdOS2krWklXOVJhRE1kbzIKNHZYUzIySDRIcjN6dmtFYVhvdHB6YXBlTzJBU1BDS3hoOWRkZWlyVzNydGZpZkRhSFF2UUpZSGpGYWpYcGZhaQpMazRHSWNrdHY2WGNqeFA5V1ArQ1RUWWFxZTVIMkg1dXlheDNyckRWRm43Y3Yzb29mcDJrTVhGUmRjTG9ERGdOCllUT3czTjhRLzl1bjNPRHBZR1l6b3V5RmJieXJ1MUlhcTZKeTRQNURnLzFSaEl3MnpuaWlCdzR0aXBzV2tqSTgKSEtRcWxKZE1KYlZUMHkraUlPMThxdWVsL1hDSC9hS1FEclpMd2Z0WVEvczVTWUtXUG5UZzhIbjJpeUlhUmZ0dQorbkgyMCszZkJuQnorK0hOd1duY2g0WmJDM0k3UklpcXFpdm1ML09YMWkvbng2UG5BVTlQMFlsOGhsMFFINndGCmtOd0NuTmE5TEp6eXBCandjY0IzU1ZaNUIxanhRTTJTcTYrSnB2cFZJSDQzL29paWJ0anhLMDhQenVVZ2luTUgKVC9aMXQ0NDBhRmk2V2VIZHRHM2RkVkM0SGxhS0JqQXVkZm44MHA1M3RPbXN6dkFRUUFidlhpd3pzZVZxYW5mdgpnS1BqWTd5aE9oZzZTdUJ2OFRTVTkvSVBDUklBTnRiMXkvOGxnVVlkVDJ0dGVmTVlnMnhFempndGIxQWEzMzBWCk1ONXV5ZFpCTU92aTRReHJuVzVICi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRRGZ2Y0dzT2QxSlc0K2IKVW1kVGo0Uk5XTWpWUWphdTVjZHdyNUFIS09mbzF6WWdPQUk3dnN2MVpLUGpldDF1dklucVlyUUNSVFJ6TWQ3ZApWUkhCbUdqSTFMb0dyU0dzZjNVMWZKU2x4bld5TGFTVVlTZTVCcjd5M0g1UXY0OS9lczNZMVc4NzVLKzlIOXlwCkNOZnFyZklOVFdzcGpvTUFoV0tVRHY0SzNGUkRqN2JyWEtjbEpLSi9OdW0wWkRVMStkWlgzR3lIMXl0VWlPYzQKdnBkdk02M0d5RnVtcEkzVk1LRURpMzdsR2dqeG5pR2JSbU12cGpDWlhhblMwWjhTWlMxZVRmTk54Uk5jMzVIegpYelZEaXdFNlVySnZhTFNhWEU0Vm9tT3pFOU9SdlNVRjdwai9JdytTTmhrNG4yeS9RWWpsdVRlRzdTZ2dVUFEyCmdMS1ZKOUdYQWdNQkFBRUNnZ0VBYXhSQXpYRkFFNnlyVlBXaUY5NjJ2ZUhBOURkbFBsMGdEekVtcUJhT3J1UFkKdHFDM2lPcHVhSG9LNllMUzJQMklyOUVmUDNycGVEd2s0aDZsaWRhc1IzbHZzbVJIbW12QnA2Q0E3N25FZUVyWgoybDJKQ2tkTk9hUUhIQlFoMUN2c3VscWppckdPM2QrUzFwOHgzdEh5NXlUbkpaTmI1UEx4VTlTOUJtdWVORnA5ClBiSWwwV0Ewb1h6VWlPa0VESFpJaE9LeEQ1SExNQkpEUGIzYy9ZRE9HSlFtTGRtRldYS1VsL3NHNHJJdzFGNWYKZzhvYzRyekJpRlhVY0EvRlhoWllNcW9lMlp6MFhXWWVCYWhINFB2Sm4zdFVhd0xFQ0NTbW1nYkVzT1ltNHdvZQptUHZmT2k3TDR3VmhGNjNBNkxnL3hpR3VFUkd0cmJlMS8xcVFlTXFGU1FLQmdRRDRmT2ZPaUVpUkViODlJeDdKCjJra3ZuS1ZERXl1YjExc3NzZTNjU054R1haVFBkK0JjTGc5YVBTdXFrWC9NbmJsQ2JBOXZhSzZOL3U2YkxsSkEKQXNnVFM0Rkc0K2J2d2hBTzQybUVKQTJIRG0zNDVGRmRFQ2JYblhjV1VxVzJWblBqNkpDdDB2d1R1ZDNMVGdxbgpFM3RmZVZuM0J4bkpsVU4vOHdXUlB1M2NoUUtCZ1FEbWdWVDJHUDZvanBudC92SjRPOTBrYnEzVVJHYklGK0tOCjYrUnJmb0kxWkN2dElXaGV4OVhtZi8wWVlBaFQvaXJTSDd3RTk3QmpIbWJTMlZId051cDNmc1dDNFNYMDFYTkwKYnFjQmxOeW1JUzFiNGN0U01jMFFyeWM5YWlMUVM1d3Fvc1UwNGZubGdkM2o2cHRjdW8vd0Z6Q3JoV0xUZDk1bgpHeUc5NTZYdWF3S0JnUURySDJWSUsvUmVNR2pBTk1jaFFJY1hvaVZOL29tNUFHR3BQUU5RK1RCVTlKK21ZRXZQCmJWWGhrUmdNWVhpSDZJWXZyNGc3WnRZa1RpRUFmU2dlb1lNbm5yNUlrY1VuQUgycFdNMnkxMXBsZk9YYUtGQkUKdXMvR0haMWRaZjZmTmRhYXhLaUJrYTRzRENjdUJENVlNVHIvOEJlTWd3K0hpdEUvOUhoRUkwTjI4UUtCZ1FDagoxazJEVnFTN1BoQ2ZIMVZNckpBMHN3NlBEOGRXZGRPc09IejFBc2llRm9NNlcwS0tDOVEzcjhVL3JCSi9VT3N5Cnl5ZWpDRUt4VVF5WTFhcnQ2THFqRU5KbWdvMnVCb0dhbmgzS2UvcVJnb2R4Qlg2MC8zellYUWF4R2wyQVhCMjIKR0ZlL2pOZElrQlFkU2NZQUZRTDJEaVdqNUgwbi9jMXd6OUlkM3ljTDNRS0JnQ3NNV1NxU1lobUN3ajdON1U2awpyWndjTGxJdS94UEZsMWFTL2Q2MGV4UXpzWmxzd0xkMzJMcStKdkxVYXNPdWVQaGlCajZZNFNiNlk3bDBLMmNvCkZndXFFbmxBL3JNY2Qxa1h6L0dEbVZvYVVoSk8rZlFNSmk3ZEQzS0tidm80SGxhSG1kSkUvNGN5ek1jQmZVeUUKUUtXUElyVS9WZFU0ckZHV0xqRjJKc1ZPCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
 
 EOF
 ```
@@ -224,25 +224,36 @@ metadata:
 data:
   ca.crt: |
     -----BEGIN CERTIFICATE-----
-    MIIDbTCCAlWgAwIBAgIUPA3fFnkLl63GZ7noUjb5NoLhSYkwDQYJKoZIhvcNAQEL
-    BQAwRjEfMB0GA1UEAwwWc2VjdXJlLWFwcC5leGFtcGxlLmNvbTELMAkGA1UEBhMC
-    VVMxFjAUBgNVBAcMDVNhbiBGcmFuc2lzY28wHhcNMjQwMTE4MTgwMTAxWhcNMjUw
-    MTA4MTgwMTAxWjBGMR8wHQYDVQQDDBZzZWN1cmUtYXBwLmV4YW1wbGUuY29tMQsw
-    CQYDVQQGEwJVUzEWMBQGA1UEBwwNU2FuIEZyYW5zaXNjbzCCASIwDQYJKoZIhvcN
-    AQEBBQADggEPADCCAQoCggEBAJGgn81BrqzmI4aQmGrg7RgkO5oYwlThQ9X/xVHB
-    YVFptjRPAZz9g92g5birI/NZ43C6nEbZrJrSCqN3wgvV84jJmBAgpAvW+LhF4caa
-    nhAnecJCcTbwrd542vCDoDRsNV5ffbpESgC4FxPGkRVbSa0KHQz8qCLqS2+uaB7X
-    t76iw6y4pQ3klobVp1XtUpzZMGMBqZFnsAdl+PWMmSTvqjixkSlfcUY6Crnk9W6d
-    Sns5cpzKdUs+2ZkBe6VkBgSs8xbaz8Y2YC1GhRqGlxYLT3WBaIlSCKPuRrGjwE3r
-    AsW6gSL919H1O1a+MjQuLuQ4lnCbCpNzM9OV1JISMWfwifMCAwEAAaNTMFEwHQYD
-    VR0OBBYEFOEzjs7FrQr1bW3mKkUgI+5Fo9XaMB8GA1UdIwQYMBaAFOEzjs7FrQr1
-    bW3mKkUgI+5Fo9XaMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
-    AG/eX4pctINIrHvRyHOusdac5iXSJbQRZgWvP1F2p95qoIDESciAU1Sh1oJv+As5
-    IlJOZPJNuZFpDLjc8kzSoEbc1Q5+QyTBlyNNsagWYYwK0CEJ6KJt80vytffmdOIg
-    z8/a+2Ax829vcn1w1SUi5V6ea/l8K74f2SL/zSSHgtEiz8V0TlvT7J6wurgmnk4t
-    yQRmsXlDGefuijMNCVf7jWwLx2BODfKoEA1pJkthnNvdizlikmz+9elxhV9bRf3Y
-    NnubytWPfO1oeHjVGvxVjCouIYine+VlskvwHmMi/dYod6yd7aFYu4CU3g/hjwKo
-    LY2WNv5j3JhDnEYK9Zj3z7A=
+    MIIFlzCCA3+gAwIBAgIULQcgBeB9ApX+Wf+FYLMLAVOLwYIwDQYJKoZIhvcNAQEL
+    BQAwWzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYDVQQHDAdTZWF0dGxl
+    MRMwEQYDVQQKDApFeGFtcGxlIENBMRgwFgYDVQQDDA9FeGFtcGxlIFJvb3QgQ0Ew
+    HhcNMjUwNjE2MTUzNjQzWhcNMzUwNjE0MTUzNjQzWjBbMQswCQYDVQQGEwJVUzEL
+    MAkGA1UECAwCV0ExEDAOBgNVBAcMB1NlYXR0bGUxEzARBgNVBAoMCkV4YW1wbGUg
+    Q0ExGDAWBgNVBAMMD0V4YW1wbGUgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+    ggIPADCCAgoCggIBAI4fKNzZU/9IEifa6k9L38Ei4lFwFt6wjCZt70Rb5IpJfOkr
+    PsZf+XaCgIQZh3ZTBIPZoa2uNxVF1BoKEhEqzGdWdH82lVDmbkSaLeW4YnYhM9fe
+    IuYHqyVrNFsp7M+xJD3XWwwCXDN//H+vx8JLQIOX4tQ9RM4rB7avcu0rmaXJuqJi
+    N0AU8AsEFpoIiC/vFBucqpG2KzC+FsVPe/Ri+PQTWJ6aLVUvGJ3hXRAQdOMzIGys
+    +WTugzqk+Sv9pKDB7/EMJg+5IagNP5QWrDmdBwROdRhd8wq+zYJMxVaaSqetNrnY
+    aqWPdGj+RSB5YuiL8kwDiJOPc5G4t2I/hbol5hpBleL84qijclzJQeFOKdEbRzMa
+    w2QfyZxZ24TCZGwDzs480x5bKmUoRufdk8X4DSjV4tnKMh9sfHX3w4cokp2IWBqt
+    B59HMN4nAKELftjfKjI9L0jnEbJR/Xae0qPLxjAuN0HARQNx1/EvvsWGhgu4Sr5S
+    Ua604wHU9p85a5zWOgOJ471f/sA3q2yEiiHPYqbZ2YXmVMrHvMROO5EVCN7HOjoL
+    QW4z85fX7QT3OwF6Xckk8jA45tcy0cIlOHsl19XbZUJ5Gc7jAiYbmy2IRYgNiMmb
+    iSBL0eoC2jan1Y6Of0UcOiAfsMvt5f21dehYkP7Mwe7sGmMk8Lkva1PRSUFfAgMB
+    AAGjUzBRMB0GA1UdDgQWBBTjn9MO3RBD27gvfL1FP2e2ARoGrjAfBgNVHSMEGDAW
+    gBTjn9MO3RBD27gvfL1FP2e2ARoGrjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+    DQEBCwUAA4ICAQBD/b0Vu1vbRYQIeBbaPLCHS5IO8R2G18w+RyUBYpcr50FLI81X
+    YPTCnEXw5sVd7Y7PNZ6q3crr4u/tGWwDWr9vHL5YWApEnUJzdp9NGv9Z29pgRrQS
+    Dzr+ggv8/NRMy4xFZ/U5JKy1lHgNFhSp68PrZI6T4xN3zyTCj29qC9hxoxhYpbXS
+    1m3PB84T1VqZu2dwNZll+kOIMv+Qon8MWZbuGLkFrcxuDqHB6RRAWyRB7WKKZZXu
+    r+Uw+9+0htNcASNuEx1yXUaE9Bf9V22fs4ARilP2QpFtMN8BCVQiKp8tj+em3ZX0
+    5KfUavNIZekrHKn/3pc9M+PhX+CEPLNncgywBVYZN89ZujyNVCKVwWD3LmH5NZ8w
+    JMJ9f3SC8ZqTu7xqX6FVLvmNAm5sS7lE8M0wGzp9cZHHEmstC1//jc+JzhRu8XyU
+    wGJyANVFlPn7+nnSq7dWbv4OTFsurbWrHQlzwjHaht84DGR4E0QgLUtA+ICGU0Ig
+    3/Ma5N7Jugw2mbx8NupgOE3AL6aScbuSt2E1/4QZ2uNPh8soxbANu9WbEXOXzxd5
+    LItmVd4ltG/4i2qwLu4NLSNA56iaCDIRD/cfr6WmNLfcMTGRMIJ+AlxnETAIy+pK
+    s6cpSfBLcDUhStgvr5oNDFeCbmsXRgyJZE9I4mKijG8v+LkS9RgKsS7tRw==
     -----END CERTIFICATE-----
 EOF
 ```

From 232e708ba5feef8b4c147a3b89393dcd8773605e Mon Sep 17 00:00:00 2001
From: Chetan Jain <46200286+Chetan-99@users.noreply.github.com>
Date: Tue, 17 Jun 2025 17:03:14 +0530
Subject: [PATCH 023/117] fix: Update deploy-using-helm.md nms => nim (#687)

---
 content/nim/deploy/kubernetes/deploy-using-helm.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md
index bed9203a9..cfb7e23e3 100644
--- a/content/nim/deploy/kubernetes/deploy-using-helm.md
+++ b/content/nim/deploy/kubernetes/deploy-using-helm.md
@@ -61,23 +61,23 @@ Make sure there are no extra characters or spaces when copying the JWT token. Th
 ### Kubernetes
 
 ```shell
-kubectl create namespace nms
+kubectl create namespace nim
 kubectl create secret docker-registry regcred \
   --docker-server=private-registry.nginx.com \
   --docker-username=<NGINX JWT Token> \
   --docker-password=none \
-  -n nms
+  -n nim
 ```
 
 ### OpenShift
 
 ```shell
-oc new-project nms && \
+oc new-project nim && \
 oc create secret docker-registry regcred \
   --docker-server=private-registry.nginx.com \
   --docker-username=<NGINX JWT Token> \
   --docker-password=none \
-  -n nms
+  -n nim
 ```
 
 {{< call-out "note" "Note" >}}
@@ -91,13 +91,13 @@ As a best practice, you can delete the JWT token and clear your shell history af
 - Kubernetes
 
     ```shell
-    kubectl get secret regcred --output=yaml -n nms
+    kubectl get secret regcred --output=yaml -n nim
     ```
 
 - OpenShift
 
     ```shell
-    oc get secret regcred --output=yaml -n nms
+    oc get secret regcred --output=yaml -n nim
     ```
 
 You can now use this secret for Helm deployments and point the chart to the private registry.

From b515241f508155218b3aae9c4c0acb9078fbee5a Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 17 Jun 2025 06:34:36 -0700
Subject: [PATCH 024/117] Changed variable name for Slack webhook in
 notification workflow (#689)

chore: Changed variable name for Slack webhook in notification workflow
---
 .github/workflows/notification.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/notification.yml b/.github/workflows/notification.yml
index 076db92ca..810345ea2 100644
--- a/.github/workflows/notification.yml
+++ b/.github/workflows/notification.yml
@@ -75,4 +75,4 @@ jobs:
                 }]
             }
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
\ No newline at end of file
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_DOCS_INCIDENT }}
\ No newline at end of file

From 259a174b3692b74cad8f3b763e9271a82ed76596 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 17 Jun 2025 07:10:12 -0700
Subject: [PATCH 025/117] Moved slack notification direct into job instead of
 dispatch for security (#690)

---
 .github/workflows/build-push.yml | 39 ++++++++++++++++++++++++--------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index e990e6afb..db52d7759 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -79,16 +79,37 @@ jobs:
     runs-on: ubuntu-latest
     permissions: read-all
     steps:
-      - name: Trigger 'Slack notification for new theme release' workflow in 'nginx-hugo-theme' repo.
-        run: |
-           curl -L \
-              -X POST \
-              -H "Accept: application/vnd.github+json" \
-              -H "Authorization: Bearer ${{ secrets.THEME_SLACK_FLOW_PAT }}" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/repos/${{ secrets.OWNER }}/${{ secrets.REPO }}/dispatches" \
-              -d "{\"event_type\": \"trigger-slack-notification\", \"client_payload\": {\"previewURL\": \"${{ env.PREVIEW_URL }}\",  \"author\": \"${{ github.event.client_payload.author}}\", \"tag_name\": \"${{ github.event.client_payload.tag_name }}\", \"release_name\": \"${{ github.event.client_payload.release_name }}\"}}"
+      - name: Send notification
+        uses:  8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
+        with: 
+          status: custom
+          custom_payload: |
+            {
+                username: 'Github',
+                mention: 'channel',
+                attachments: [{
+                  title: `New theme release - ${{ github.event.client_payload.release_name }}`,
+                  color: '#009223',
+                  fields: [
+                  {
+                    title: 'Tag',
+                    value: ${{ github.event.client_payload.tag_name }},
+                    short: true
+                  },
+                  {
+                    title: 'Author',
+                    value: ${{ github.event.client_payload.author }},
+                    short: true
+                  },
+                  {
+                    title: 'Preview URL',
+                    value: ${{ env.PREVIEW_URL }},
+                    short: true
+                  }]
+                }]
+            }
     env:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_FRIENDS_OF_DOCS }}
       PREVIEW_URL: ${{ needs.call-docs-build-push.outputs.PREVIEW_URL }}
 
 

From a6d621400e4969fcab3d4e0748fef2f667d66676 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 17 Jun 2025 07:19:52 -0700
Subject: [PATCH 026/117] Small fix to add quotes to build-push for slack
 (#691)

---
 .github/workflows/build-push.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index db52d7759..1d2bdee5f 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -93,17 +93,17 @@ jobs:
                   fields: [
                   {
                     title: 'Tag',
-                    value: ${{ github.event.client_payload.tag_name }},
+                    value: `${{ github.event.client_payload.tag_name }}`,
                     short: true
                   },
                   {
                     title: 'Author',
-                    value: ${{ github.event.client_payload.author }},
+                    value: `${{ github.event.client_payload.author }}`,
                     short: true
                   },
                   {
                     title: 'Preview URL',
-                    value: ${{ env.PREVIEW_URL }},
+                    value: `${{ env.PREVIEW_URL }}`,
                     short: true
                   }]
                 }]

From 17fb33129f225a879a9c0b944286ac0e6e1e4901 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 17 Jun 2025 07:49:04 -0700
Subject: [PATCH 027/117] Bump docs-action to 1.0.8 from 1.0.7 (#692)

chore: Bump docs-action to 1.0.8 from 1.0.7
---
 .github/workflows/build-push.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index 1d2bdee5f..da2534a36 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -58,7 +58,7 @@ jobs:
 
   call-docs-build-push:
     needs: prod-check-branch
-    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@9c59fab05a8131f4d691ba6ea2b6a119f3ef832a # v1.0.7
+    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@bc2ae667727ba02b3d70dacee231ce04f7d94344 # v1.0.8
     with:
       production_url_path: ""
       preview_url_path: "${{ vars.PREVIEW_URL_PATH }}"

From 8a256bad89970b564c23384821c368411f85282a Mon Sep 17 00:00:00 2001
From: Travis Martin <33876974+travisamartin@users.noreply.github.com>
Date: Tue, 17 Jun 2025 08:16:35 -0700
Subject: [PATCH 028/117] fixed broken links in NIM deployment guides (#696)

* fixed broken links in NIM deployment guides

* fixed link to correct doc
---
 content/nim/deploy/vm-bare-metal/install.md       | 2 +-
 content/nim/disconnected/offline-install-guide.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/nim/deploy/vm-bare-metal/install.md b/content/nim/deploy/vm-bare-metal/install.md
index 5e7dea31b..c6afac65d 100644
--- a/content/nim/deploy/vm-bare-metal/install.md
+++ b/content/nim/deploy/vm-bare-metal/install.md
@@ -21,7 +21,7 @@ The script installs:
 - ClickHouse by default, unless you choose to skip it
 - Optionally, NGINX Plus (requires a license and additional flags)
 
-The script also installs all required operating system packages automatically. If you need to install earlier versions of NGINX or NGINX Instance Manager, follow the [manual installation process](({{< ref "nim/deploy/vm-bare-metal/install-nim-manual.md" >}})) instead.
+The script also installs all required operating system packages automatically. If you need to install earlier versions of NGINX or NGINX Instance Manager, follow the [manual installation process]({{< ref "nim/deploy/vm-bare-metal/install-nim-manual.md" >}}) instead.
 
 ---
 
diff --git a/content/nim/disconnected/offline-install-guide.md b/content/nim/disconnected/offline-install-guide.md
index ae422d800..6dda33a5d 100644
--- a/content/nim/disconnected/offline-install-guide.md
+++ b/content/nim/disconnected/offline-install-guide.md
@@ -21,7 +21,7 @@ The script installs:
 
 NGINX Plus is not supported in disconnected mode.
 
-If you need to install earlier versions of NGINX or NGINX Instance Manager, follow the [manual installation process](({{< ref "nim/deploy/vm-bare-metal/install-nim-manual.md" >}})) instead.
+If you need to install earlier versions of NGINX or NGINX Instance Manager, follow the [manual installation process]({{< ref "nim/disconnected/offline-install-guide-manual.md" >}}) instead.
 
 ---
 

From 90f5e085c526ef890ac88ef17ec753fa9326ac88 Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Tue, 17 Jun 2025 17:04:03 +0100
Subject: [PATCH 029/117] feat: Migrate NGINX Ingress Controller documentation
 into repository (#688)

* feat: Add NIC content

* feat: Move NIC files into appropriate folders

* feat: Fix remaining references and configuration

* feat: Add NIC to CODEOWNERS

* Update .github/CODEOWNERS

* Update .github/CODEOWNERS

* feat: Codeowners formatting change

* Update content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md

---------

Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
---
 .github/CODEOWNERS                            |    4 +
 config/_default/config.toml                   |    5 +-
 .../nic/compatibility-tables/nic-nap.md       |   10 +
 content/includes/nic/configuration/_index.md  |    8 +
 .../nic/configuration/access-control.md       |  120 +
 .../configuration/configuration-examples.md   |   13 +
 .../global-configuration/_index.md            |    8 +
 .../command-line-arguments.md                 |  685 +++++
 .../configmap-resource.md                     |  250 ++
 .../global-configuration/custom-templates.md  |   11 +
 .../globalconfiguration-resource.md           |  183 ++
 .../mgmt-configmap-resource.md                |   50 +
 .../reporting-resources-status.md             |  195 ++
 .../host-and-listener-collisions.md           |  168 ++
 .../configuration/ingress-resources/_index.md |    8 +
 ...advanced-configuration-with-annotations.md |  225 ++
 .../advanced-configuration-with-snippets.md   |  128 +
 .../ingress-resources/basic-configuration.md  |  107 +
 .../cross-namespace-configuration.md          |   14 +
 .../ingress-resources/custom-annotations.md   |  146 +
 .../nic/configuration/policy-resource.md      |  945 +++++++
 .../includes/nic/configuration/security.md    |  102 +
 .../configuration/transportserver-resource.md |  416 +++
 ...server-and-virtualserverroute-resources.md | 1101 ++++++++
 .../installation/create-common-resources.md   |   27 +
 .../installation/create-custom-resources.md   |   49 +
 .../nic/installation/deploy-controller.md     |   10 +
 .../includes/nic/installation/download-jwt.md |   10 +
 .../nic/installation/jwt-password-note.md     |   11 +
 .../nic/installation/manifests/daemonset.md   |   21 +
 .../nic/installation/manifests/deployment.md  |   21 +
 .../manifests/verify-pods-are-running.md      |   10 +
 content/includes/nic/rbac/set-up-rbac.md      |   33 +
 content/nic/_index.md                         |    5 +
 content/nic/community.md                      |   23 +
 content/nic/configuration/_index.md           |    4 +
 content/nic/configuration/access-control.md   |  120 +
 .../configuration/configuration-examples.md   |   13 +
 .../global-configuration/_index.md            |    8 +
 .../command-line-arguments.md                 |  685 +++++
 .../configmap-resource.md                     |  250 ++
 .../global-configuration/custom-templates.md  |   11 +
 .../globalconfiguration-resource.md           |  183 ++
 .../mgmt-configmap-resource.md                |   50 +
 .../reporting-resources-status.md             |  195 ++
 .../host-and-listener-collisions.md           |  168 ++
 .../configuration/ingress-resources/_index.md |    8 +
 ...advanced-configuration-with-annotations.md |  225 ++
 .../advanced-configuration-with-snippets.md   |  128 +
 .../ingress-resources/basic-configuration.md  |  107 +
 .../cross-namespace-configuration.md          |   14 +
 .../ingress-resources/custom-annotations.md   |  146 +
 content/nic/configuration/policy-resource.md  |  947 +++++++
 content/nic/configuration/security.md         |  102 +
 .../configuration/transportserver-resource.md |  416 +++
 ...server-and-virtualserverroute-resources.md | 1101 ++++++++
 content/nic/glossary.md                       |   30 +
 content/nic/installation/_index.md            |    8 +
 .../build-nginx-ingress-controller.md         |  203 ++
 .../nic/installation/create-license-secret.md |  155 ++
 content/nic/installation/ingress-nginx.md     |  546 ++++
 .../nic/installation/installing-nic/_index.md |    5 +
 .../deploy-with-nap-using-helm.md             |  343 +++
 .../installing-nic/installation-with-helm.md  |  493 ++++
 .../installation-with-manifests.md            |  300 ++
 .../installation-with-operator.md             |   72 +
 .../installing-nic/upgrade-to-v4.md           |  129 +
 .../nic/installation/integrations/_index.md   |    5 +
 .../integrations/app-protect-dos/_index.md    |    8 +
 .../app-protect-dos/configuration.md          |  164 ++
 .../app-protect-dos/dos-protected.md          |  126 +
 .../app-protect-dos/installation.md           |  230 ++
 .../troubleshoot-app-protect-dos.md           |  111 +
 .../integrations/app-protect-waf-v5/_index.md |    8 +
 .../compile-waf-policies.md                   |  371 +++
 .../app-protect-waf-v5/configuration.md       |  180 ++
 .../app-protect-waf-v5/installation.md        |  505 ++++
 .../troubleshoot-app-protect-waf.md           |  136 +
 .../integrations/app-protect-waf/_index.md    |    9 +
 .../app-protect-waf/configuration.md          |  563 ++++
 .../app-protect-waf/installation.md           |  221 ++
 .../integrations/f5-ingresslink.md            |   95 +
 .../integrations/nic-n1-console.md            |  130 +
 .../installation/integrations/opentracing.md  |  114 +
 content/nic/installation/nic-images/_index.md |    4 +
 .../nic-images/get-image-using-jwt.md         |  209 ++
 .../nic-images/get-registry-image.md          |  193 ++
 .../installation/nic-images/use-aws-image.md  |  139 +
 .../installation/nic-images/use-gcp-image.md  |  118 +
 .../run-multiple-ingress-controllers.md       |   60 +
 content/nic/logging-and-monitoring/_index.md  |    8 +
 content/nic/logging-and-monitoring/logging.md |   35 +
 .../nic/logging-and-monitoring/prometheus.md  |   85 +
 .../logging-and-monitoring/service-insight.md |   56 +
 .../nic/logging-and-monitoring/status-page.md |   64 +
 content/nic/overview/_index.md                |    8 +
 content/nic/overview/about.md                 |   17 +
 content/nic/overview/controller-comparison.md |   65 +
 content/nic/overview/design.md                |  346 +++
 content/nic/overview/nginx-plus.md            |   35 +
 content/nic/overview/product-telemetry.md     |   84 +
 content/nic/releases.md                       | 2407 +++++++++++++++++
 content/nic/technical-specifications.md       |   99 +
 content/nic/troubleshooting/_index.md         |    8 +
 .../troubleshooting/troubleshoot-common.md    |  201 ++
 .../troubleshoot-configmap-policy.md          |   48 +
 .../troubleshooting/troubleshoot-ingress.md   |   29 +
 .../troubleshooting/troubleshoot-support.md   |   38 +
 .../troubleshoot-transportserver.md           |    9 +
 .../troubleshoot-virtualserver.md             |   38 +
 content/nic/tutorials/_index.md               |    8 +
 content/nic/tutorials/custom-listen-ports.md  |  159 ++
 .../ingress-path-regex-annotation.md          |  456 ++++
 content/nic/tutorials/nginx-dynamic-module.md |  117 +
 content/nic/tutorials/nginx-ingress-istio.md  |  262 ++
 .../nic/tutorials/nginx-ingress-linkerd.md    |  181 ++
 content/nic/tutorials/nginx-ingress-osm.md    |  459 ++++
 .../tutorials/oidc-custom-configuration.md    |  214 ++
 content/nic/tutorials/security-monitoring.md  |   96 +
 ...rtual-server-with-custom-listener-ports.md |  185 ++
 content/nic/usage-reporting.md                |  294 ++
 layouts/shortcodes/call-out.html              |    3 +
 layouts/shortcodes/nic-helm-version.html      |    1 +
 layouts/shortcodes/nic-operator-version.html  |    1 +
 layouts/shortcodes/nic-version.html           |    1 +
 static/nic/control-loop.png                   |  Bin 0 -> 5633 bytes
 static/nic/controller-sync.png                |  Bin 0 -> 34320 bytes
 static/nic/ecr-pull-instructions.png          |  Bin 0 -> 148462 bytes
 static/nic/gke-create-cluster.png             |  Bin 0 -> 101052 bytes
 static/nic/gke-creating-cluster.png           |  Bin 0 -> 66820 bytes
 static/nic/gke-existing-cluster.png           |  Bin 0 -> 169834 bytes
 .../gke-ingress-controller-application.png    |  Bin 0 -> 150715 bytes
 static/nic/gke-install-to-new-cluster.png     |  Bin 0 -> 201085 bytes
 static/nic/ic-high-level.png                  |  Bin 0 -> 99912 bytes
 static/nic/ic-pod.png                         |  Bin 0 -> 54934 bytes
 static/nic/ic-process-components.png          |  Bin 0 -> 51942 bytes
 static/nic/ic-process.png                     |  Bin 0 -> 24035 bytes
 static/nic/nginx-envoy.png                    |  Bin 0 -> 152518 bytes
 static/nic/nginx_istio_small.png              |  Bin 0 -> 125996 bytes
 static/nic/nginx_plain.png                    |  Bin 0 -> 119752 bytes
 140 files changed, 22101 insertions(+), 2 deletions(-)
 create mode 100644 content/includes/nic/compatibility-tables/nic-nap.md
 create mode 100644 content/includes/nic/configuration/_index.md
 create mode 100644 content/includes/nic/configuration/access-control.md
 create mode 100644 content/includes/nic/configuration/configuration-examples.md
 create mode 100644 content/includes/nic/configuration/global-configuration/_index.md
 create mode 100644 content/includes/nic/configuration/global-configuration/command-line-arguments.md
 create mode 100644 content/includes/nic/configuration/global-configuration/configmap-resource.md
 create mode 100644 content/includes/nic/configuration/global-configuration/custom-templates.md
 create mode 100644 content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md
 create mode 100644 content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md
 create mode 100644 content/includes/nic/configuration/global-configuration/reporting-resources-status.md
 create mode 100644 content/includes/nic/configuration/host-and-listener-collisions.md
 create mode 100644 content/includes/nic/configuration/ingress-resources/_index.md
 create mode 100644 content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
 create mode 100644 content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
 create mode 100644 content/includes/nic/configuration/ingress-resources/basic-configuration.md
 create mode 100644 content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md
 create mode 100644 content/includes/nic/configuration/ingress-resources/custom-annotations.md
 create mode 100644 content/includes/nic/configuration/policy-resource.md
 create mode 100644 content/includes/nic/configuration/security.md
 create mode 100644 content/includes/nic/configuration/transportserver-resource.md
 create mode 100644 content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md
 create mode 100644 content/includes/nic/installation/create-common-resources.md
 create mode 100644 content/includes/nic/installation/create-custom-resources.md
 create mode 100644 content/includes/nic/installation/deploy-controller.md
 create mode 100644 content/includes/nic/installation/download-jwt.md
 create mode 100644 content/includes/nic/installation/jwt-password-note.md
 create mode 100644 content/includes/nic/installation/manifests/daemonset.md
 create mode 100644 content/includes/nic/installation/manifests/deployment.md
 create mode 100644 content/includes/nic/installation/manifests/verify-pods-are-running.md
 create mode 100644 content/includes/nic/rbac/set-up-rbac.md
 create mode 100644 content/nic/_index.md
 create mode 100644 content/nic/community.md
 create mode 100644 content/nic/configuration/_index.md
 create mode 100644 content/nic/configuration/access-control.md
 create mode 100644 content/nic/configuration/configuration-examples.md
 create mode 100644 content/nic/configuration/global-configuration/_index.md
 create mode 100644 content/nic/configuration/global-configuration/command-line-arguments.md
 create mode 100644 content/nic/configuration/global-configuration/configmap-resource.md
 create mode 100644 content/nic/configuration/global-configuration/custom-templates.md
 create mode 100644 content/nic/configuration/global-configuration/globalconfiguration-resource.md
 create mode 100644 content/nic/configuration/global-configuration/mgmt-configmap-resource.md
 create mode 100644 content/nic/configuration/global-configuration/reporting-resources-status.md
 create mode 100644 content/nic/configuration/host-and-listener-collisions.md
 create mode 100644 content/nic/configuration/ingress-resources/_index.md
 create mode 100644 content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
 create mode 100644 content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
 create mode 100644 content/nic/configuration/ingress-resources/basic-configuration.md
 create mode 100644 content/nic/configuration/ingress-resources/cross-namespace-configuration.md
 create mode 100644 content/nic/configuration/ingress-resources/custom-annotations.md
 create mode 100644 content/nic/configuration/policy-resource.md
 create mode 100644 content/nic/configuration/security.md
 create mode 100644 content/nic/configuration/transportserver-resource.md
 create mode 100644 content/nic/configuration/virtualserver-and-virtualserverroute-resources.md
 create mode 100644 content/nic/glossary.md
 create mode 100644 content/nic/installation/_index.md
 create mode 100644 content/nic/installation/build-nginx-ingress-controller.md
 create mode 100644 content/nic/installation/create-license-secret.md
 create mode 100644 content/nic/installation/ingress-nginx.md
 create mode 100644 content/nic/installation/installing-nic/_index.md
 create mode 100644 content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
 create mode 100644 content/nic/installation/installing-nic/installation-with-helm.md
 create mode 100644 content/nic/installation/installing-nic/installation-with-manifests.md
 create mode 100644 content/nic/installation/installing-nic/installation-with-operator.md
 create mode 100644 content/nic/installation/installing-nic/upgrade-to-v4.md
 create mode 100644 content/nic/installation/integrations/_index.md
 create mode 100644 content/nic/installation/integrations/app-protect-dos/_index.md
 create mode 100644 content/nic/installation/integrations/app-protect-dos/configuration.md
 create mode 100644 content/nic/installation/integrations/app-protect-dos/dos-protected.md
 create mode 100644 content/nic/installation/integrations/app-protect-dos/installation.md
 create mode 100644 content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf-v5/_index.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf-v5/configuration.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf-v5/installation.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf/_index.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf/configuration.md
 create mode 100644 content/nic/installation/integrations/app-protect-waf/installation.md
 create mode 100644 content/nic/installation/integrations/f5-ingresslink.md
 create mode 100644 content/nic/installation/integrations/nic-n1-console.md
 create mode 100644 content/nic/installation/integrations/opentracing.md
 create mode 100644 content/nic/installation/nic-images/_index.md
 create mode 100644 content/nic/installation/nic-images/get-image-using-jwt.md
 create mode 100644 content/nic/installation/nic-images/get-registry-image.md
 create mode 100644 content/nic/installation/nic-images/use-aws-image.md
 create mode 100644 content/nic/installation/nic-images/use-gcp-image.md
 create mode 100644 content/nic/installation/run-multiple-ingress-controllers.md
 create mode 100644 content/nic/logging-and-monitoring/_index.md
 create mode 100644 content/nic/logging-and-monitoring/logging.md
 create mode 100644 content/nic/logging-and-monitoring/prometheus.md
 create mode 100644 content/nic/logging-and-monitoring/service-insight.md
 create mode 100644 content/nic/logging-and-monitoring/status-page.md
 create mode 100644 content/nic/overview/_index.md
 create mode 100644 content/nic/overview/about.md
 create mode 100644 content/nic/overview/controller-comparison.md
 create mode 100644 content/nic/overview/design.md
 create mode 100644 content/nic/overview/nginx-plus.md
 create mode 100644 content/nic/overview/product-telemetry.md
 create mode 100644 content/nic/releases.md
 create mode 100644 content/nic/technical-specifications.md
 create mode 100644 content/nic/troubleshooting/_index.md
 create mode 100644 content/nic/troubleshooting/troubleshoot-common.md
 create mode 100644 content/nic/troubleshooting/troubleshoot-configmap-policy.md
 create mode 100644 content/nic/troubleshooting/troubleshoot-ingress.md
 create mode 100644 content/nic/troubleshooting/troubleshoot-support.md
 create mode 100644 content/nic/troubleshooting/troubleshoot-transportserver.md
 create mode 100644 content/nic/troubleshooting/troubleshoot-virtualserver.md
 create mode 100644 content/nic/tutorials/_index.md
 create mode 100644 content/nic/tutorials/custom-listen-ports.md
 create mode 100644 content/nic/tutorials/ingress-path-regex-annotation.md
 create mode 100644 content/nic/tutorials/nginx-dynamic-module.md
 create mode 100644 content/nic/tutorials/nginx-ingress-istio.md
 create mode 100644 content/nic/tutorials/nginx-ingress-linkerd.md
 create mode 100644 content/nic/tutorials/nginx-ingress-osm.md
 create mode 100644 content/nic/tutorials/oidc-custom-configuration.md
 create mode 100644 content/nic/tutorials/security-monitoring.md
 create mode 100644 content/nic/tutorials/virtual-server-with-custom-listener-ports.md
 create mode 100644 content/nic/usage-reporting.md
 create mode 100644 layouts/shortcodes/call-out.html
 create mode 100644 layouts/shortcodes/nic-helm-version.html
 create mode 100644 layouts/shortcodes/nic-operator-version.html
 create mode 100644 layouts/shortcodes/nic-version.html
 create mode 100644 static/nic/control-loop.png
 create mode 100644 static/nic/controller-sync.png
 create mode 100644 static/nic/ecr-pull-instructions.png
 create mode 100644 static/nic/gke-create-cluster.png
 create mode 100644 static/nic/gke-creating-cluster.png
 create mode 100644 static/nic/gke-existing-cluster.png
 create mode 100644 static/nic/gke-ingress-controller-application.png
 create mode 100644 static/nic/gke-install-to-new-cluster.png
 create mode 100644 static/nic/ic-high-level.png
 create mode 100644 static/nic/ic-pod.png
 create mode 100644 static/nic/ic-process-components.png
 create mode 100644 static/nic/ic-process.png
 create mode 100644 static/nic/nginx-envoy.png
 create mode 100644 static/nic/nginx_istio_small.png
 create mode 100644 static/nic/nginx_plain.png

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 9f28ec942..3d6f1daf8 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -37,6 +37,10 @@ content/includes/nginxaas-azure/* @nginx/n4a-docs-approvers
 content/ngf/*               @nginx/nginx-gateway-fabric
 content/includes/ngf/*      @nginx/nginx-gateway-fabric
 
+# NGINX Ingress Controller
+content/nic/*                   @nginx/kic
+content/includes/nic/*          @nginx/kic
+
 # NGINX Instance Manager
 content/nms/nim/*           @nginx/nim-docs-approvers
 content/nim/*               @nginx/nim-docs-approvers
diff --git a/config/_default/config.toml b/config/_default/config.toml
index 10337a908..faf409f46 100644
--- a/config/_default/config.toml
+++ b/config/_default/config.toml
@@ -7,18 +7,19 @@ pygmentsUseClasses = true
 enableGitInfo = true
 
 [permalinks]
+  agent = '/nginx-agent/:sections[1:]/:filename'
   amplify = '/nginx-amplify/:sections[1:]/:filename'
   controller = '/nginx-controller/:sections[1:]/:filename'
   mesh = '/nginx-service-mesh/:sections[1:]/:filename'
   modsec-waf = '/nginx-waf/:sections[1:]/:filename'
   nap-dos = '/nginx-app-protect-dos/:sections[1:]/:filename'
   nap-waf = '/nginx-app-protect-waf/:sections[1:]/:filename'
+  nginxaas = '/nginxaas/azure/:sections[1:]/:filename'
   ngf = '/nginx-gateway-fabric/:sections[1:]/:filename'
+  nic = '/nginx-ingress-controller/:sections[1:]/:filename'
   nim = '/nginx-instance-manager/:sections[1:]/:filename'
   nms = '/nginx-management-suite/:sections[1:]/:filename'
   unit = '/nginx-unit/:sections[1:]/:filename'
-  agent = '/nginx-agent/:sections[1:]/:filename'
-  nginxaas = '/nginxaas/azure/:sections[1:]/:filename'
 
 [caches]
   [caches.modules]
diff --git a/content/includes/nic/compatibility-tables/nic-nap.md b/content/includes/nic/compatibility-tables/nic-nap.md
new file mode 100644
index 000000000..aaf914ca1
--- /dev/null
+++ b/content/includes/nic/compatibility-tables/nic-nap.md
@@ -0,0 +1,10 @@
+The following table shows compatibility between NGINX Ingress Controller (NIC) and NGINX App Protect WAF (NAP-WAF) versions:
+
+{{< bootstrap-table "table table-striped table-responsive" >}}
+| NIC Version         | NAP-WAF Version | Config Manager | Enforcer |
+| ------------------- | --------------- | -------------- | -------- |
+| {{< nic-version >}} | 34+5.332        | 5.6.0          | 5.6.0    |
+| 4.0.1               | 33+5.264        | 5.5.0          | 5.5.0    |
+| 3.7.2               | 32+5.1          | 5.3.0          | 5.3.0    |
+| 3.6.2               | 32+5.48         | 5.2.0          | 5.2.0    |
+{{% /bootstrap-table %}}
diff --git a/content/includes/nic/configuration/_index.md b/content/includes/nic/configuration/_index.md
new file mode 100644
index 000000000..7e1500973
--- /dev/null
+++ b/content/includes/nic/configuration/_index.md
@@ -0,0 +1,8 @@
+---
+title: Configuration
+description:
+weight: 1400
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/includes/nic/configuration/access-control.md b/content/includes/nic/configuration/access-control.md
new file mode 100644
index 000000000..fade2941c
--- /dev/null
+++ b/content/includes/nic/configuration/access-control.md
@@ -0,0 +1,120 @@
+---
+title: Deploy a Policy for access control
+weight: 900
+toc: true
+docs: DOCS-000
+---
+
+This topic describes how to use F5 NGINX Ingress Controller to apply and update a Policy for access control. It demonstrates it using an example application and a [VirtualServer custom resource]({{< ref "/configuration/virtualserver-and-virtualserverroute-resources.md" >}}).
+
+---
+
+## Before you begin
+
+You should have a [working NGINX Ingress Controller]({{< ref "/installation/installing-nic/installation-with-helm.md" >}}) instance.
+
+For ease of use in shell commands, set two shell variables:
+
+1. The public IP address for your NGINX Ingress Controller instance.
+
+```shell
+IC_IP=<ip-address>
+```
+
+2. The HTTP port of the same instance.
+
+```shell
+IC_HTTP_PORT=<port number>
+```
+
+---
+
+## Deploy the example application
+
+Create the file _webapp.yaml_ with the following contents:
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/webapp.yaml" >}}
+
+Apply it using `kubectl`:
+
+```shell
+kubectl apply -f webapp.yaml
+```
+
+---
+
+## Deploy a Policy to create a deny rule
+
+Create a file named _access-control-policy-deny.yaml_. The highlighted _deny_ field will be used by the example application, and should be changed to the subnet of your machine.
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/access-control-policy-deny.yaml" "hl_lines=7-8" >}}
+
+Apply the policy:
+
+```shell
+kubectl apply -f access-control-policy-deny.yaml
+```
+
+---
+
+## Configure load balancing
+
+Create a file named _virtual-server.yaml_ for the VirtualServer resource. The _policies_ field references the access control Policy created in the previous section.
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/virtual-server.yaml" "hl_lines=7-8" >}}
+
+Apply the policy:
+
+```shell
+kubectl apply -f virtual-server.yaml
+```
+
+---
+
+## Test the example application
+
+Use `curl` to attempt to access the application:
+
+```shell
+curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
+```
+```text
+<html>
+<head><title>403 Forbidden</title></head>
+<body>
+<center><h1>403 Forbidden</h1></center>
+</body>
+</html>
+```
+
+The *403* response is expected, successfully blocking your machine.
+
+---
+
+## Update the Policy to create an allow rule
+
+Update the Policy with the file _access-control-policy-allow.yaml_, setting the _allow_ field to the subnet of your machine.
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/access-control-policy-allow.yaml" "hl_lines=7-8" >}}
+
+Apply the Policy:
+
+```shell
+kubectl apply -f access-control-policy-allow.yaml
+```
+
+----
+
+## Verify the Policy update
+
+Attempt to access the application again:
+
+```shell
+curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
+```
+```text
+Server address: 10.64.0.13:8080
+Server name: webapp-5cbbc7bd78-wf85w
+```
+
+The successful response demonstrates that the policy has been updated.
diff --git a/content/includes/nic/configuration/configuration-examples.md b/content/includes/nic/configuration/configuration-examples.md
new file mode 100644
index 000000000..0a0e6e3bb
--- /dev/null
+++ b/content/includes/nic/configuration/configuration-examples.md
@@ -0,0 +1,13 @@
+---
+docs: DOCS-584
+doctypes:
+- ''
+title: Configuration examples
+toc: true
+weight: 400
+---
+
+Our [GitHub repo](https://github.com/nginx/kubernetes-ingress) includes a number of configuration examples:
+
+- [*Examples of Custom Resources*](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources) show how to advanced NGINX features by using VirtualServer, VirtualServerRoute, TransportServer and Policy Custom Resources.
+- [*Examples of Ingress Resources*](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources) show how to use advanced NGINX features in Ingress resources with annotations.
diff --git a/content/includes/nic/configuration/global-configuration/_index.md b/content/includes/nic/configuration/global-configuration/_index.md
new file mode 100644
index 000000000..4f71e2f5f
--- /dev/null
+++ b/content/includes/nic/configuration/global-configuration/_index.md
@@ -0,0 +1,8 @@
+---
+title: Global configuration
+description:
+weight: 100
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/includes/nic/configuration/global-configuration/command-line-arguments.md b/content/includes/nic/configuration/global-configuration/command-line-arguments.md
new file mode 100644
index 000000000..230345052
--- /dev/null
+++ b/content/includes/nic/configuration/global-configuration/command-line-arguments.md
@@ -0,0 +1,685 @@
+---
+docs: DOCS-585
+doctypes:
+- ''
+title: Command-line arguments
+toc: true
+weight: 100
+---
+
+F5 NGINX Ingress Controller supports several command-line arguments, which are set based on installation method:
+
+- If you're using *Kubernetes Manifests* to install NGINX Ingress Controller, modify the Manifests to set the command-line arguments. View the [Installation with Manifests]({{<relref "/installation/installing-nic/installation-with-manifests.md">}}) topic for more information.
+- If you're using *Helm* to install NGINX Ingress Controller, modify the parameters of the Helm chart to set the command-line arguments. View the [Installation with Helm]({{<relref "/installation/installing-nic/installation-with-helm.md">}}) topic for more information.
+
+<a name="cmdoption-enable-snippets"></a>
+
+### -enable-snippets
+
+Enable custom NGINX configuration snippets in Ingress, VirtualServer, VirtualServerRoute and TransportServer resources.
+
+Default `false`.
+
+<a name="cmdoption-default-server-tls-secret"></a>
+
+---
+
+### -default-server-tls-secret `<string>`
+
+Secret with a TLS certificate and key for TLS termination of the default server.
+
+- If not set, certificate and key in the file `/etc/nginx/secrets/default` are used.
+- If `/etc/nginx/secrets/default` doesn't exist, NGINX Ingress Controller will configure NGINX to reject TLS connections to the default server.
+- If a secret is set, but NGINX Ingress Controller is not able to fetch it from Kubernetes API, or it is not set and NGINX Ingress Controller fails to read the file "/etc/nginx/secrets/default", NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-wildcard-tls-secret"></a>
+
+---
+
+### -wildcard-tls-secret `<string>`
+
+A Secret with a TLS certificate and key for TLS termination of every Ingress/VirtualServer host for which TLS termination is enabled but the Secret is not specified.
+
+- If the argument is not set, for such Ingress/VirtualServer hosts NGINX will break any attempt to establish a TLS connection
+- If the argument is set, but NGINX Ingress Controller is not able to fetch the Secret from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-enable-custom-resources"></a>
+
+---
+
+### -enable-custom-resources
+
+Enables custom resources.
+
+Default `true`.
+
+
+<a name="cmdoption-enable-oidc"></a>
+
+---
+
+### -enable-oidc
+
+Enables OIDC policies.
+
+Default `false`.
+
+<a name="cmdoption-enable-leader-election"></a>
+
+---
+
+### -enable-leader-election
+
+Enables Leader election to avoid multiple replicas of the controller reporting the status of Ingress, VirtualServer and VirtualServerRoute resources -- only one replica will report status.
+Default `true`.
+
+See [-report-ingress-status](#cmdoption-report-ingress-status) flag.
+
+<a name="cmdoption-enable-tls-passthrough"></a>
+
+---
+
+### -enable-tls-passthrough
+
+Enable TLS Passthrough on port 443.
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-tls-passthrough-port"></a>
+
+---
+
+### -tls-passthrough-port `<int>`
+
+Set the port for TLS Passthrough.
+Format: `[1024 - 65535]` (default `443`)
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-enable-cert-manager"></a>
+
+---
+
+### -enable-cert-manager
+
+Enable x509 automated certificate management for VirtualServer resources using cert-manager (cert-manager.io).
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-enable-external-dns"></a>
+
+---
+
+### -enable-external-dns
+
+Enable integration with ExternalDNS for configuring public DNS entries for VirtualServer resources using [ExternalDNS](https://github.com/kubernetes-sigs/external-dns).
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+<a name="cmdoption-external-service"></a>
+
+---
+
+### -external-service `<string>`
+
+Specifies the name of the service with the type LoadBalancer through which the NGINX Ingress Controller pods are exposed externally. The external address of the service is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources.
+
+For Ingress resources only: Requires [-report-ingress-status](#cmdoption-report-ingress-status).
+
+<a name="cmdoption-ingresslink"></a>
+
+---
+
+### -ingresslink `<string>`
+
+Specifies the name of the IngressLink resource, which exposes the NGINX Ingress Controller pods via a BIG-IP system. The IP of the BIG-IP system is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources.
+
+For Ingress resources only: Requires [-report-ingress-status](#cmdoption-report-ingress-status).
+
+<a name="cmdoption-global-configuration"></a>
+
+---
+
+### -global-configuration `<string>`
+
+A GlobalConfiguration resource for global configuration of NGINX Ingress Controller.
+
+Format: `<namespace>/<name>`
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-health-status"></a>
+
+---
+
+### -health-status
+
+Adds a location "/nginx-health" to the default server. The location responds with the 200 status code for any request.
+
+Useful for external health-checking of NGINX Ingress Controller.
+
+<a name="cmdoption-health-status-uri"></a>
+
+---
+
+### -health-status-uri `<string>`
+
+Sets the URI of health status location in the default server. Requires [-health-status](#cmdoption-health-status). (default `/nginx-health`)
+
+<a name="cmdoption-ingress-class"></a>
+
+---
+
+### -ingress-class `<string>`
+
+The `-ingress-class` argument refers to the name of the resource `kind: IngressClass`. An IngressClass resource with a name equal to the class must be deployed. Otherwise, NGINX Ingress Controller will fail to start.
+NGINX Ingress Controller will only process Ingress resources that belong to its class (Whose `ingressClassName` value matches the value of `-ingress-class`), skipping the ones without it. It will also process all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the `ingressClassName` field.
+
+Default `nginx`.
+
+<a name="cmdoption-ingress-template-path"></a>
+
+---
+
+### -ingress-template-path `<string>`
+
+Path to the ingress NGINX configuration template for an ingress resource. Default for NGINX is `nginx.ingress.tmpl`; default for NGINX Plus is `nginx-plus.ingress.tmpl`.
+
+<a name="cmdoption-leader-election-lock-name"></a>
+
+---
+
+### -leader-election-lock-name `<string>`
+
+Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election.
+
+Requires [-enable-leader-election](#cmdoption-enable-leader-election).
+
+<a name="cmdoption-log_backtrace_at"></a>
+
+---
+
+### -log_backtrace_at `<value>`
+
+When logging hits line `file:N`, emit a stack trace.
+
+<a name="cmdoption-main-template-path"></a>
+
+---
+
+### -main-template-path `<string>`
+
+Path to the main NGINX configuration template.
+
+- Default for NGINX is `nginx.tmpl`.
+- Default for NGINX Plus is `nginx-plus.tmpl`.
+
+<a name="cmdoption-nginx-configmaps"></a>
+
+---
+
+### -nginx-configmaps `<string>`
+
+A ConfigMap resource for customizing NGINX configuration. If a ConfigMap is set, but NGINX Ingress Controller is not able to fetch it from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-nginx-debug"></a>
+
+---
+
+### -mgmt-configmap `<string>`
+
+The Management ConfigMap resource is used for customizing the NGINX mgmt block. If using NGINX Plus, a Management ConfigMap must be set. If NGINX Ingress Controller is not able to fetch it from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-nginx-debug"></a>
+
+---
+
+### -nginx-debug
+
+Enable debugging for NGINX. Uses the nginx-debug binary. Requires 'error-log-level: debug' in the ConfigMap.
+
+<a name="cmdoption-nginx-plus"></a>
+
+---
+
+### -nginx-plus
+
+Enable support for NGINX Plus.
+
+<a name="cmdoption-nginx-reload-timeout"></a>
+
+---
+
+### -nginx-reload-timeout `<value>`
+
+Timeout in milliseconds which NGINX Ingress Controller will wait for a successful NGINX reload after a change or at the initial start.
+
+Default is 60000.
+
+<a name="cmdoption-nginx-status"></a>
+
+---
+
+### -nginx-status
+
+Enable the NGINX stub_status, or the NGINX Plus API.
+
+Default `true`.
+
+<a name="cmdoption-nginx-status-allow-cidrs"></a>
+
+---
+
+### -nginx-status-allow-cidrs `<string>`
+
+Add IP/CIDR blocks to the allow list for NGINX stub_status or the NGINX Plus API.
+
+Separate multiple IP/CIDR by commas. (default `127.0.0.1,::1`)
+
+<a name="cmdoption-nginx-status-port"></a>
+
+---
+
+### -nginx-status-port `<int>`
+
+Set the port where the NGINX stub_status or the NGINX Plus API is exposed.
+
+Format: `[1024 - 65535]` (default `8080`)
+
+<a name="cmdoption-proxy"></a>
+
+---
+
+### -proxy `<string>`
+
+{{< warning >}} This argument is intended for testing purposes only. {{< /warning >}}
+
+Use a proxy server to connect to Kubernetes API started with `kubectl proxy`.
+
+NGINX Ingress Controller does not start NGINX and does not write any generated NGINX configuration files to disk.
+
+<a name="cmdoption-report-ingress-status"></a>
+
+---
+
+### -report-ingress-status
+
+Updates the address field in the status of Ingress resources.
+
+Requires the [-external-service](#cmdoption-external-service) or [-ingresslink](#cmdoption-ingresslink) flag, or the `external-status-address` key in the ConfigMap.
+
+<a name="cmdoption-transportserver-template-path"></a>
+
+---
+
+### -transportserver-template-path `<string>`
+
+Path to the TransportServer NGINX configuration template for a TransportServer resource.
+
+- Default for NGINX is `nginx.transportserver.tmpl`.
+- Default for NGINX Plus is `nginx-plus.transportserver.tmpl`.
+
+<a name="cmdoption-log-level"></a>
+
+---
+
+### -log-level `<string>`
+
+Log level for Ingress Controller logs. Allowed values: fatal, error, warn, info, debug, trace.
+
+- Default is `info`.
+
+<a name="cmdoption-log-format"></a>
+
+---
+
+### -log-format `<string>`
+
+Log format for Ingress Controller logs. Allowed values: glog, json, text.
+
+- Default is `glog`.
+
+<a name="cmdoption-version"></a>
+
+---
+
+### -version
+
+Print the version, git-commit hash and build date and exit.
+
+<a name="cmdoption-virtualserver-template-path"></a>
+
+---
+
+### -virtualserver-template-path `<string>`
+
+Path to the VirtualServer NGINX configuration template for a VirtualServer resource.
+
+- Default for NGINX is `nginx.virtualserver.tmpl`.
+- Default for NGINX Plus is `nginx-plus.virtualserver.tmpl`.
+
+
+<a name="cmdoption-vmodule"></a>
+
+---
+
+### -vmodule `<value>`
+
+A comma-separated list of pattern=N settings for file-filtered logging.
+
+<a name="cmdoption-watch-namespace"></a>
+
+---
+
+### -watch-namespace `<string>`
+
+Comma separated list of namespaces NGINX Ingress Controller should watch for resources. By default NGINX Ingress Controller watches all namespaces. Mutually exclusive with "watch-namespace-label".
+
+<a name="cmdoption-watch-namespace-label"></a>
+
+---
+
+### -watch-namespace-label `<string>`
+
+Configures NGINX Ingress Controller to watch only those namespaces with label foo=bar. By default NGINX Ingress Controller watches all namespaces. Mutually exclusive with "watch-namespace".
+
+<a name="cmdoption-watch-secret-namespace"></a>
+
+---
+
+### -watch-secret-namespace `<string>`
+
+Comma separated list of namespaces NGINX Ingress Controller should watch for secrets. If this arg is not configured, NGINX Ingress Controller watches the same namespaces for all resources, see "watch-namespace" and "watch-namespace-label". All namespaces included with this argument must be part of either `-watch-namespace` or  `-watch-namespace-label`.
+
+<a name="cmdoption-enable-prometheus-metrics"></a>
+
+---
+
+### -enable-prometheus-metrics
+
+Enables exposing NGINX or NGINX Plus metrics in the Prometheus format.
+
+<a name="cmdoption-prometheus-metrics-listen-port"></a>
+
+---
+
+### -prometheus-metrics-listen-port `<int>`
+
+Sets the port where the Prometheus metrics are exposed.
+
+Format: `[1024 - 65535]` (default `9113`)
+
+<a name="cmdoption-prometheus-tls-secret"></a>
+
+---
+
+### -prometheus-tls-secret `<string>`
+
+A Secret with a TLS certificate and key for TLS termination of the Prometheus metrics endpoint.
+
+- If the argument is not set, the Prometheus endpoint will not use a TLS connection.
+- If the argument is set, but NGINX Ingress Controller is not able to fetch the Secret from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-enable-service-insight"></a>
+
+---
+
+### -enable-service-insight
+
+Exposes the Service Insight endpoint for Ingress Controller.
+
+<a name="cmdoption-service-insight-listen-port"></a>
+
+---
+
+### -service-insight-listen-port `<int>`
+
+Sets the port where the Service Insight is exposed.
+
+Format: `[1024 - 65535]` (default `9114`)
+
+<a name="cmdoption-service-insight-tls-secret"></a>
+
+---
+
+### -service-insight-tls-secret `<string>`
+
+A Secret with a TLS certificate and key for TLS termination of the Service Insight endpoint.
+
+- If the argument is not set, the Service Insight endpoint will not use a TLS connection.
+- If the argument is set, but NGINX Ingress Controller is not able to fetch the Secret from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-spire-agent-address"></a>
+
+---
+
+### -spire-agent-address `<string>`
+
+Specifies the address of a running Spire agent. **For use with NGINX Service Mesh only**.
+
+- If the argument is set, but NGINX Ingress Controller is unable to connect to the Spire Agent, NGINX Ingress Controller will fail to start.
+
+
+<a name="cmdoption-enable-internal-routes"></a>
+
+---
+
+### -enable-internal-routes
+
+Enable support for internal routes with NGINX Service Mesh. **For use with NGINX Service Mesh only**.
+
+Requires [-spire-agent-address](#cmdoption-spire-agent-address).
+
+- If the argument is set, but `spire-agent-address` is not provided, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-enable-latency-metrics"></a>
+
+---
+
+### -enable-latency-metrics
+
+Enable collection of latency metrics for upstreams.
+Requires [-enable-prometheus-metrics](#cmdoption-enable-prometheus-metrics).
+
+<a name="cmdoption-enable-app-protect"></a>
+
+---
+
+### -enable-app-protect
+
+Enables support for App Protect.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus).
+
+- If the argument is set, but `nginx-plus` is set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-log-level"></a>
+
+---
+
+### -app-protect-log-level `<string>`
+
+Sets log level for App Protect. Allowed values: fatal, error, warn, info, debug, trace.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect](#cmdoption-enable-app-protect).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-enable-app-protect-dos"></a>
+
+---
+
+### -enable-app-protect-dos
+
+Enables support for App Protect DoS.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus).
+
+- If the argument is set, but `nginx-plus` is set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-debug"></a>
+
+---
+
+### -app-protect-dos-debug
+
+Enable debugging for App Protect DoS.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-max-daemons"></a>
+
+---
+
+### -app-protect-dos-max-daemons
+
+Max number of ADMD instances.
+
+Default `1`.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-max-workers"></a>
+
+---
+
+### -app-protect-dos-max-workers
+
+Max number of nginx processes to support.
+
+Default `Number of CPU cores in the machine`.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-memory"></a>
+
+---
+
+### -app-protect-dos-memory
+
+RAM memory size to consume in MB
+
+Default `50% of free RAM in the container or 80MB, the smaller`.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-ready-status"></a>
+
+---
+
+### -ready-status
+
+Enables the readiness endpoint `/nginx-ready`. The endpoint returns a success code when NGINX has loaded all the config after the startup.
+
+Default `true`.
+
+<a name="cmdoption-ready-status-port"></a>
+
+---
+
+### -ready-status-port
+
+The HTTP port for the readiness endpoint.
+
+Format: `[1024 - 65535]` (default `8081`)
+
+---
+
+### -disable-ipv6
+
+Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack.
+
+Default `false`.
+
+<a name="cmdoption-disable-ipv6"></a>
+
+---
+
+### -default-http-listener-port
+
+Sets the port for the HTTP `default_server` listener.
+
+Default `80`.
+
+<a name="cmdoption-default-http-listener-port"></a>
+
+---
+
+### -default-https-listener-port
+
+Sets the port for the HTTPS `default_server` listener.
+
+Default `443`.
+
+<a name="cmdoption-default-https-listener-port"></a>
+
+---
+
+### -ssl-dynamic-reload
+
+Used to activate or deactivate lazy loading for SSL Certificates.
+
+The default value is `true`.
+
+<a name="cmdoption-ssl-dynamic-reload"></a>
+
+---
+
+### -weight-changes-dynamic-reload
+
+Enables the ability to change the weight distribution of two-way split clients without reloading NGINX.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus).
+
+Using this feature may require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the ConfigMap based on the number of two-way splits.
+
+The default value is `false`.
+
+- If the argument is set, but `nginx-plus` is set to false, NGINX Ingress Controller will ignore the flag.
+
+<a name="cmdoption-weight-changes-dynamic-reload"></a>
+
+---
+
+### -enable-telemetry-reporting
+
+Enable gathering and reporting of software telemetry.
+
+The default value is `true`.
+
+<a name="cmdoption-enable-telemetry-reporting"></a>
+
+---
+
+### -agent
+
+Enable NGINX Agent which can used with `-enable-app-protect` to send events to Security Monitoring.
+
+The default value is `false`.
+
+<a name="cmdoption-agent"></a>
+
+---
+
+### -agent-instance-group
+
+Specify the instance group name to use for the NGINX Ingress Controller deployment when using `-agent`.
+
+<a name="cmdoption-agent-instance-group"></a>
diff --git a/content/includes/nic/configuration/global-configuration/configmap-resource.md b/content/includes/nic/configuration/global-configuration/configmap-resource.md
new file mode 100644
index 000000000..afa0bcf17
--- /dev/null
+++ b/content/includes/nic/configuration/global-configuration/configmap-resource.md
@@ -0,0 +1,250 @@
+---
+title: ConfigMap resources
+weight: 300
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-586
+---
+
+When using F5 NGINX Ingress Controller, you can customize or fine tune NGINX behavior using ConfigMap resources. Examples include setting the number of worker processes or customizing the access log format.
+
+## Using ConfigMap
+
+1. The [Installation with Manifests]({{< relref "installation/installing-nic/installation-with-manifests.md" >}}) documentation deploy an empty ConfigMap while the default installation manifests specify it in the command-line arguments of the Ingress Controller. However, if you customized the manifests, to use ConfigMap, make sure to specify the ConfigMap resource to use the [command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) of NGINX Ingress Controller.
+
+1. Create a ConfigMap file with the name *nginx-config.yaml* and set the values
+that make sense for your setup:
+
+    ```yaml
+    kind: ConfigMap
+    apiVersion: v1
+    metadata:
+      name: nginx-config
+      namespace: nginx-ingress
+    data:
+      proxy-connect-timeout: "10s"
+      proxy-read-timeout: "10s"
+      client-max-body-size: "2m"
+    ```
+
+    See the section [Summary of ConfigMap Keys](#summary-of-configmap-keys) for the explanation of the available ConfigMap keys (such as `proxy-connect-timeout` in this example).
+
+1. Create a new (or update the existing) ConfigMap resource:
+
+    ```shell
+    kubectl apply -f nginx-config.yaml
+    ```
+
+    The NGINX configuration will be updated.
+
+---
+
+## ConfigMap and Ingress annotations
+
+ConfigMap applies globally, meaning that it affects every Ingress resource. In contrast, annotations always apply to their Ingress resource. Annotations can override some ConfigMap keys: an example is that the `nginx.org/proxy-connect-timeout` annotations overrides the `proxy-connect-timeout` ConfigMap key.
+
+For more information, view the [Advanced configuration with annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations" >}}) topic.
+
+---
+
+## ConfigMap and VirtualServer/VirtualServerRoute resources
+
+The ConfigMap affects every VirtualServer and VirtualServerRoute resources. However, the fields of those resources allow overriding some ConfigMap keys. For example, the `connect-timeout` field of the `upstream` overrides the `proxy-connect-timeout` ConfigMap key.
+
+For more information, view the [VirtualServer and VirtualServerRoute resources]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources" >}}) topic.
+
+---
+
+## ConfigMap keys
+
+### Ingress Controller (Unrelated to NGINX Configuration)
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*external-status-address* | Sets the address to be reported in the status of Ingress resources. Requires the *-report-status* command-line argument. Overrides the *-external-service* argument. | N/A | [Reporting resource status]({{< ref "/nic/configuration/global-configuration/reporting-resources-status" >}}) |
+{{</bootstrap-table>}}
+
+---
+
+### General customization
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*proxy-connect-timeout* | Sets the value of the [proxy_connect_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) and [grpc_connect_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_connect_timeout) directive. | *60s* |  |
+|*proxy-read-timeout* | Sets the value of the [proxy_read_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) and [grpc_read_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_read_timeout) directive. | *60s* |  |
+|*proxy-send-timeout* | Sets the value of the [proxy_send_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) and [grpc_send_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_send_timeout) directive. | *60s* |  |
+|*client-max-body-size* | Sets the value of the [client_max_body_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size) directive. | *1m* |  |
+|*proxy-buffering* | Enables or disables [buffering of responses](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) from the proxied server. | *True* |  |
+|*proxy-buffers* | Sets the value of the [proxy_buffers](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) directive. | Depends on the platform. |  |
+|*proxy-buffer-size* | Sets the value of the [proxy_buffer_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) and [grpc_buffer_size](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_buffer_size) directives. | Depends on the platform. |  |
+|*proxy-max-temp-file-size* | Sets the value of the  [proxy_max_temp_file_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_max_temp_file_size) directive. | *1024m* |  |
+|*set-real-ip-from* | Sets the value of the [set_real_ip_from](https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from) directive. | N/A |  |
+|*real-ip-header* | Sets the value of the [real_ip_header](https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header) directive. | *X-Real-IP* |  |
+|*real-ip-recursive* | Enables or disables the [real_ip_recursive](https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive) directive. | *False* |  |
+|*default-server-return* | Configures the [return](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return)  directive in the default server, which handles a client request if none of the hosts of Ingress or VirtualServer resources match. The default value configures NGINX to return a 404 error page. You can configure a fixed response or a redirect. For example, *default-server-return: 302 https://nginx.org* will redirect a client to *https://nginx.org*. | *404* |  |
+|*server-tokens* | Enables or disables the [server_tokens](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens) directive. Additionally, with the NGINX Plus, you can specify a custom string value, including the empty string value, which disables the emission of the “Server” field. | *True* |  |
+|*worker-processes* | Sets the value of the [worker_processes](https://nginx.org/en/docs/ngx_core_module.html#worker_processes) directive. | *auto* |  |
+|*worker-rlimit-nofile* | Sets the value of the [worker_rlimit_nofile](https://nginx.org/en/docs/ngx_core_module.html#worker_rlimit_nofile) directive. | N/A |  |
+|*worker-connections* | Sets the value of the [worker_connections](https://nginx.org/en/docs/ngx_core_module.html#worker_connections) directive. | *1024* |  |
+|*worker-cpu-affinity* | Sets the value of the [worker_cpu_affinity](https://nginx.org/en/docs/ngx_core_module.html#worker_cpu_affinity) directive. | N/A |  |
+|*worker-shutdown-timeout* | Sets the value of the [worker_shutdown_timeout](https://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout) directive. | N/A |  |
+|*server-names-hash-bucket-size* | Sets the value of the [server_names_hash_bucket_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size) directive. | *256* |  |
+|*server-names-hash-max-size* | Sets the value of the [server_names_hash_max_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size) directive. | *1024* |  |
+|*map-hash-bucket-size* | Sets the value of the [map_hash_bucket_size](http://nginx.org/en/docs/http/ngx_http_map_module.html#map_hash_bucket_size) directive.| *256* |  |
+|*map-hash-max-size* | Sets the value of the [map_hash_max_size](http://nginx.org/en/docs/http/ngx_http_map_module.html#map_hash_max_size) directive. | *2048* |  |
+|*resolver-addresses* | Sets the value of the [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) addresses. Note: If you use a DNS name (for example, *kube-dns.kube-system.svc.cluster.local* ) as a resolver address, NGINX Plus will resolve it using the system resolver during the start and on every configuration reload. If the name cannot be resolved or the DNS server doesn't respond, NGINX Plus will fail to start or reload. To avoid this, we recommend using IP addresses as resolver addresses instead of DNS names. Supported in NGINX Plus only. | N/A | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*resolver-ipv6* | Enables IPv6 resolution in the resolver. Supported in NGINX Plus only. | *True* | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*resolver-valid* | Sets the time NGINX caches the resolved DNS records. Supported in NGINX Plus only. | TTL value of a DNS record | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*resolver-timeout* | Sets the [resolver_timeout](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver_timeout) for name resolution. Supported in NGINX Plus only. | *30s* | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*keepalive-timeout* | Sets the value of the [keepalive_timeout](https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) directive. | *75s* |  |
+|*keepalive-requests* | Sets the value of the [keepalive_requests](https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests) directive. | *1000* |  |
+|*variables-hash-bucket-size* | Sets the value of the [variables_hash_bucket_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#variables_hash_bucket_size) directive. | *256* |  |
+|*variables-hash-max-size* | Sets the value of the [variables-hash-max-size](https://nginx.org/en/docs/http/ngx_http_core_module.html#variables_hash_max_size) directive. | *1024* |  |
+{{</bootstrap-table>}}
+
+---
+
+### Logging
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*error-log-level* | Sets the global [error log level](https://nginx.org/en/docs/ngx_core_module.html#error_log) for NGINX. | *notice* |  |
+|*access-log* | Sets the directive [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log). A syslog destination is the only valid value. The value will be set to its default in-case user tries to configure it with location other than a syslog.
+| ``/dev/stdout main`` | ``syslog:server=localhost:514`` |
+|*access-log-off* | Disables the [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log). | *False* |  |
+|*default-server-access-log-off* | Disables the [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log) for the default server. If access log is disabled globally (*access-log-off: "True"*), then the default server access log is always disabled. | *False* |  |
+|*log-format* | Sets the custom [log format](https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) for HTTP and HTTPS traffic. For convenience, it is possible to define the log format across multiple lines (each line separated by *\n*). In that case, the Ingress Controller will replace every *\n* character with a space character. All *'* characters must be escaped. | See the [template file](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx.tmpl) for the access log. | [Custom Log Format](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/shared-examples/custom-log-format). |
+|*log-format-escaping* | Sets the characters escaping for the variables of the log format. Supported values: *json* (JSON escaping), *default* (the default escaping) *none* (disables escaping). | *default* |  |
+|*stream-log-format* | Sets the custom [log format](https://nginx.org/en/docs/stream/ngx_stream_log_module.html#log_format) for TCP, UDP, and TLS Passthrough traffic. For convenience, it is possible to define the log format across multiple lines (each line separated by *\n*). In that case, the Ingress Controller will replace every *\n* character with a space character. All *'* characters must be escaped. | See the [template file](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx.tmpl). |  |
+|*stream-log-format-escaping* | Sets the characters escaping for the variables of the stream log format. Supported values: *json* (JSON escaping), *default* (the default escaping) *none* (disables escaping). | *default* |  |
+{{</bootstrap-table>}}
+
+---
+
+### Request URI/Header manipulation
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*proxy-hide-headers* | Sets the value of one or more  [proxy_hide_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directives. Example: *"nginx.org/proxy-hide-headers": "header-a,header-b"* | N/A |  |
+|*proxy-pass-headers* | Sets the value of one or more   [proxy_pass_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header) directives. Example: *"nginx.org/proxy-pass-headers": "header-a,header-b"* | N/A |  |
+{{</bootstrap-table>}}
+
+---
+
+### Auth and SSL/TLS
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*redirect-to-https* | Sets the 301 redirect rule based on the value of the *http_x_forwarded_proto* header on the server block to force incoming traffic to be over HTTPS. Useful when terminating SSL in a load balancer in front of the Ingress Controller — see [115](https://github.com/nginx/kubernetes-ingress/issues/115) | *False* |  |
+|*ssl-redirect* | Sets an unconditional 301 redirect rule for all incoming HTTP traffic to force incoming traffic over HTTPS. | *True* |  |
+|*hsts* | Enables [HTTP Strict Transport Security (HSTS)](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/) : the HSTS header is added to the responses from backends. The *preload* directive is included in the header. | *False* |  |
+|*hsts-max-age* | Sets the value of the *max-age* directive of the HSTS header. | *2592000* (1 month) |  |
+|*hsts-include-subdomains* | Adds the *includeSubDomains* directive to the HSTS header. | *False* |  |
+|*hsts-behind-proxy* | Enables HSTS based on the value of the *http_x_forwarded_proto* request header. Should only be used when TLS termination is configured in a load balancer (proxy) in front of the Ingress Controller. Note: to control redirection from HTTP to HTTPS configure the *nginx.org/redirect-to-https* annotation. | *False* |  |
+|*ssl-protocols* | Sets the value of the [ssl_protocols](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) directive. | *TLSv1 TLSv1.1 TLSv1.2* |  |
+|*ssl-prefer-server-ciphers* | Enables or disables the [ssl_prefer_server_ciphers](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) directive. | *False* |  |
+|*ssl-ciphers* | Sets the value of the [ssl_ciphers](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers) directive. | *HIGH:!aNULL:!MD5* |  |
+|*ssl-dhparam-file* | Sets the content of the dhparam file. The controller will create the file and set the value of the [ssl_dhparam](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) directive with the path of the file. | N/A |  |
+{{</bootstrap-table>}}
+
+---
+
+### Listeners
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*http2* | Enables HTTP/2 in servers with SSL enabled. | *False* |  |
+|*proxy-protocol* | Enables PROXY Protocol for incoming connections. | *False* | [Proxy Protocol](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/shared-examples/proxy-protocol). |
+{{</bootstrap-table>}}
+
+---
+
+### Backend services (Upstreams)
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*lb-method* | Sets the [load balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify *"round_robin"*. | *"random two least_conn"* |  |
+|*max-fails* | Sets the value of the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the *server* directive. | *1* |  |
+|*upstream-zone-size* | Sets the size of the shared memory [zone](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone) for upstreams. For NGINX, the special value 0 disables the shared memory zones. For NGINX Plus, shared memory zones are required and cannot be disabled. The special value 0 will be ignored. | *256k* for NGINX, *512k* for NGINX Plus  |  |
+|*fail-timeout* | Sets the value of the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the *server* directive. | *10s* |  |
+|*keepalive* | Sets the value of the [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) directive. Note that *proxy_set_header Connection "";* is added to the generated configuration when the value > 0. | *0* |  |
+{{</bootstrap-table>}}
+
+---
+
+### Zone Sync
+
+Zone Sync enables the [ngx_stream_zone_sync_module](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html) in NGINX Ingress Controller when NGINX Plus is used.  Multiple replicas are required to effectively utililise this functionality. More information is available in the [How NGINX Plus Performs Zone Synchronization](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync_details/) topic.
+
+Zone synchronization with TLS for NGINX Ingress Controller is not yet available with ConfigMap. If you would like to enable Zone Sync with TLS, please remove `zone-sync` from ConfigMap and add Zone Sync parameters via [`stream-snippets`]({{< ref "/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) similar to [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-config.yaml) and adding the [zone_sync_ssl directive](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_ssl) along with any other TLS parameters to the `stream-snippets`. 
+
+You will also need to manually add the headless service, such as in [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml).
+
+{{< caution >}} 
+If you previously installed OIDC or used the `zone_sync` directive with `stream-snippets` in [v4.0.1](https://github.com/nginx/kubernetes-ingress/tree/v4.0.1) or earlier, and you plan to enable the `zone-sync` ConfigMap key, the `zone_sync` directive should be removed from `stream-snippets`. 
+
+If you encounter the error `error [emerg] 13#13: "zone_sync" directive is duplicate in /etc/nginx/nginx.conf:164` it is likely due to `zone_sync` being enabled in both `stream-snippets` and the ConfigMap. Once upgraded, remove the [old headless service](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml) deployed for OIDC.
+{{< /caution >}}
+
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*zone-sync* | Enables zone synchronization between NGINX Ingress Controller Pods. This autogenerates a [zone_sync_server](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_server) and a headless service using the `ReplicaSet` or `DaemonSet` name. Please note that this headless service will be automatically cleaned up when uninstalling via Helm or by removing the value from the ConfigMap. The headless service will need to be manually removed if the `controller.customConfigMap` value is set via Helm or the deployment is uninstalled via Manifests. Each Ingress Controller manages its own headless service.  NGINX Plus Required. | *False* |  |
+|*zone-sync-port* | Specifies the optional port on which NGINX Ingress Controller listens for zone sync traffic. NGINX Plus & `zone-sync` Required. | *12345* |  |
+|*zone-sync-resolver-addresses* | Configures optional addresses used in the [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) directive for zone-sync. This field takes a comma separated list of addresses. NGINX Plus & `zone-sync` Required | `kube-dns.kube-system.svc.cluster.local` |  |
+|*zone-sync-resolver-ipv6* | Configures whether the optional [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) directive for zone-sync will look up IPv6 addresses. NGINX Plus & `zone-sync` Required | `true` |  |
+|*zone-sync-resolver-valid* | Configures an [NGINX time](https://nginx.org/en/docs/syntax.html) that the optional [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) directive for zone-sync will override the TTL value of responses from nameservers with. NGINX Plus & `zone-sync` Required | `5s` |  |
+{{</bootstrap-table>}}
+
+---
+
+### Snippets and custom templates
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*main-snippets* | Sets a custom snippet in main context. | N/A |  |
+|*http-snippets* | Sets a custom snippet in http context. | N/A |  |
+|*location-snippets* | Sets a custom snippet in location context. | N/A |  |
+|*server-snippets* | Sets a custom snippet in server context. | N/A |  |
+|*stream-snippets* | Sets a custom snippet in stream context. | N/A | [Support for TCP/UDP Load Balancing](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/tcp-udp). |
+|*main-template* | Sets the main NGINX configuration template. | By default the template is read from the file in the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+|*ingress-template* | Sets the NGINX configuration template for an Ingress resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+|*virtualserver-template* | Sets the NGINX configuration template for an VirtualServer resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+|*transportserver-template* | Sets the NGINX configuration template for a TransportServer resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+{{</bootstrap-table>}}
+
+---
+
+### Modules
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*otel-exporter-endpoint* | OTLP/gRPC endpoint that will accept [OpenTelemetry](https://opentelemetry.io) data. Set `otel-trace-in-http` to *"true"* to enable OpenTelemetry at the global level. | N/A | *"https://otel-collector:4317"* |
+|*otel-exporter-header-name* | The name of a custom HTTP header to add to telemetry export request. `otel-exporter-endpoint` and `otel-exporter-header-value` required. | N/A | *"X-custom-header"* |
+|*otel-exporter-header-value* | The value of a custom HTTP header to add to telemetry export request. `otel-exporter-endpoint` and `otel-exporter-header-name` required. | N/A | *"custom-value"* |
+|*otel-service-name* | Sets the `service.name` attribute of the OTel resource. `otel-exporter-endpoint` required. | N/A | *"nginx-ingress-controller:nginx"* |
+| *otel-trace-in-http* | Enables [OpenTelemetry](https://opentelemetry.io) globally (for all Ingress, VirtualServer and VirtualServerRoute resources). Set this to *"false"* to enable OpenTelemetry for individual routes with snippets. `otel-exporter-endpoint` required. | *"false"* | *"true"* |
+|*opentracing* | Removed in v5.0.0.  Enables [OpenTracing](https://opentracing.io) globally (for all Ingress, VirtualServer and VirtualServerRoute resources). Note: requires the Ingress Controller image with OpenTracing module and a tracer. See the [docs]({{< relref "/installation/integrations/opentracing.md" >}}) for more information. | *False* |  |
+|*opentracing-tracer* | Removed in v5.0.0.  Sets the path to the vendor tracer binary plugin. | N/A |  |
+|*opentracing-tracer-config* | Removed in v5.0.0.  Sets the tracer configuration in JSON format. | N/A |  |
+|*app-protect-compressed-requests-action* | Sets the *app_protect_compressed_requests_action* [global directive](/nginx-app-protect/configuration/#global-directives). | *drop* |  |
+|*app-protect-cookie-seed* | Sets the *app_protect_cookie_seed* [global directive](/nginx-app-protect/configuration/#global-directives). | Random automatically generated string |  |
+|*app-protect-failure-mode-action* | Sets the *app_protect_failure_mode_action* [global directive](/nginx-app-protect/configuration/#global-directives). | *pass* |  |
+|*app-protect-cpu-thresholds* | Sets the *app_protect_cpu_thresholds* [global directive](/nginx-app-protect/configuration/#global-directives). | *high=100 low=100* |  |
+|*app-protect-physical-memory-util-thresholds* | Sets the *app_protect_physical_memory_util_thresholds* [global directive](/nginx-app-protect/configuration/#global-directives). | *high=100 low=100* |  |
+|`app-protect-reconnect-period-seconds` | Sets the `app_protect_reconnect_period_seconds` [global directive](/nginx-app-protect/configuration/#global-directives). | `5` |  |
+|*app-protect-dos-log-format* | Sets the custom [log format](https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) for Dos Access log traffic. For convenience, it is possible to define the log format across multiple lines (each line separated by *\n*). In that case, the Ingress Controller will replace every *\n* character with a space character. All *'* characters must be escaped. | `, vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, policy_name=$app_protect_dos_policy_name, dos_version=$app_protect_dos_version, ip_tls=$remote_addr:$app_protect_dos_tls_fp,` | |
+|*app-protect-dos-log-format-escaping* | Sets the characters escaping for the variables of the stream log format. Supported values: *json* (JSON escaping), *default* (the default escaping) *none* (disables escaping). | *default* |  |
+|*app-protect-dos-arb-fqdn* | Sets the *app-protect-dos-arb-fqdn* [directive](/nginx-app-protect-dos/directives-and-policy/learn-about-directives-and-policy/#arbitrator-fqdn-directive-app_protect_dos_arb_fqdn). | *svc-appprotect-dos-arb* |  |
+{{</bootstrap-table>}}
diff --git a/content/includes/nic/configuration/global-configuration/custom-templates.md b/content/includes/nic/configuration/global-configuration/custom-templates.md
new file mode 100644
index 000000000..589ce5951
--- /dev/null
+++ b/content/includes/nic/configuration/global-configuration/custom-templates.md
@@ -0,0 +1,11 @@
+---
+docs: DOCS-587
+doctypes:
+- ''
+title: Custom templates
+toc: true
+weight: 500
+---
+
+
+F5 NGINX Ingress Controller uses templates to generate NGINX configuration for Ingress resources, VirtualServer resources and the main NGINX configuration file. You can customize the templates and apply them via the ConfigMap. See the [corresponding example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/shared-examples/custom-templates).
diff --git a/content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md b/content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md
new file mode 100644
index 000000000..605ab301f
--- /dev/null
+++ b/content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md
@@ -0,0 +1,183 @@
+---
+docs: DOCS-588
+doctypes:
+- ''
+title: GlobalConfiguration resource
+toc: true
+weight: 200
+---
+
+This page explains how to use the GlobalConfiguration resource to define the global configuration parameters of F5 NGINX Ingress Controller.
+
+The resource supports configuring listeners for TCP and UDP load balancing, and is implemented as a [Custom resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+Listeners are required by [TransportServer resources]({{< relref "/configuration/transportserver-resource.md" >}}) and can be used to [configure custom listeners for VirtualServers]({{< relref "tutorials/virtual-server-with-custom-listener-ports.md" >}}).
+
+---
+
+## Prerequisites
+
+When [installing NGINX Ingress Controller using Manifests]({{< relref "/installation/installing-nic/installation-with-manifests.md" >}}), you need to reference a GlobalConfiguration resource in the [`-global-configuration`](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments#cmdoption-global-configuration) command-line argument. NGINX Ingress Controller only needs one GlobalConfiguration resource.
+
+---
+
+## GlobalConfiguration specification
+
+The GlobalConfiguration resource defines the global configuration parameters of the Ingress Controller. Below is an example:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: GlobalConfiguration
+metadata:
+  name: nginx-configuration
+  namespace: nginx-ingress
+spec:
+  listeners:
+  - name: dns-udp
+    port: 5353
+    protocol: UDP
+  - name: dns-tcp
+    port: 5353
+    protocol: TCP
+  - name: http-8083
+    port: 8083
+    protocol: HTTP
+  - name: https-8443
+    port: 8443
+    protocol: HTTP
+    ssl: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+| *listeners* | A list of listeners. | [listener](#listener) | No |
+{{</bootstrap-table>}}
+
+### Listener
+
+The `listeners:` key defines a listener (a combination of a protocol and a port) that NGINX will use to accept traffic for a [TransportServer]({{< relref "/configuration/transportserver-resource.md" >}})  and a [VirtualServer]({{< relref "/configuration/virtualserver-and-virtualserverroute-resources.md" >}}):
+
+```yaml
+- name: dns-tcp
+  port: 5353
+  protocol: TCP
+- name: http-8083
+  port: 8083
+  protocol: HTTP
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+| *name* | The name of the listener. Must be a valid DNS label as defined in RFC 1035. For example, ``hello`` and ``listener-123`` are valid. The name must be unique among all listeners. The name ``tls-passthrough`` is reserved for the built-in TLS Passthrough listener and cannot be used. | *string* | Yes |
+| *port* | The port of the listener. The port must fall into the range ``1..65535`` with the following exceptions: ``80``, ``443``, the [status port](/nginx-ingress-controller/logging-and-monitoring/status-page), the [Prometheus metrics port](/nginx-ingress-controller/logging-and-monitoring/prometheus). Among all listeners, only a single combination of a port-protocol is allowed. | *int* | Yes |
+| *protocol* | The protocol of the listener. Supported values: ``TCP``, ``UDP`` and ``HTTP``. | *string* | Yes |
+| *ssl* | Configures the listener with SSL. This is currently only supported for ``HTTP`` listeners. Default value is ``false`` | *bool* | No |
+| *ipv4* | Specifies the IPv4 address to listen on. | *string* | No |
+| *ipv6* | Specifies the IPv6 address to listen on. | *string* | No |
+
+{{</bootstrap-table>}}
+
+---
+
+## Using GlobalConfiguration
+
+You can use the usual `kubectl` commands to work with a GlobalConfiguration resource.
+
+For example, the following command creates a GlobalConfiguration resource defined in `global-configuration.yaml` with the name `nginx-configuration`:
+
+```shell
+kubectl apply -f global-configuration.yaml
+```
+```shell
+globalconfiguration.k8s.nginx.org/nginx-configuration created
+```
+
+Assuming the namespace of the resource is `nginx-ingress`, you can get the resource by running:
+
+```shell
+kubectl get globalconfiguration nginx-configuration -n nginx-ingress
+```
+```shell
+NAME                  AGE
+nginx-configuration   13s
+```
+
+With `kubectl get` and similar commands, you can use the short name `gc` instead of `globalconfiguration`.
+
+---
+
+### Validation
+
+Two types of validation are available for the GlobalConfiguration resource:
+
+- *Structural validation* by `kubectl` and Kubernetes API server.
+- *Comprehensive validation* by NGINX Ingress Controller.
+
+
+#### Structural validation
+
+The custom resource definition for the GlobalConfiguration includes structural OpenAPI schema which describes the type of every field of the resource.
+
+If you try to create (or update) a resource that violates the structural schema (for example, you use a string value for the port field of a listener), `kubectl` and Kubernetes API server will reject such a resource:
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f global-configuration.yaml
+    ```
+    ```text
+    error: error validating "global-configuration.yaml": error validating data: ValidationError(GlobalConfiguration.spec.listeners[0].port): invalid type for org.nginx.k8s.v1.GlobalConfiguration.spec.listeners.port: got "string", expected "integer"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f global-configuration.yaml --validate=false
+    ```
+    ```text
+    The GlobalConfiguration "nginx-configuration" is invalid: []: Invalid value: map[string]interface {}{ ... }: validation failure list:
+    spec.listeners.port in body must be of type integer: "string"
+    ```
+
+If a resource is not rejected (it doesn't violate the structural schema), NGINX Ingress Controller will validate it further.
+
+#### Comprehensive validation
+
+NGINX Ingress Controller validates the fields of a GlobalConfiguration resource. If a GlobalConfiguration resource is partially invalid, NGINX Ingress Controller use the valid listeners and emit events about invalid listeners.
+
+You can check if the Ingress Controller successfully applied the configuration for a GlobalConfiguration. For our  `nginx-configuration` GlobalConfiguration, we can run:
+
+```shell
+kubectl describe gc nginx-configuration -n nginx-ingress
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Normal   Updated   11s   nginx-ingress-controller  GlobalConfiguration nginx-ingress/nginx-configuration was updated
+```
+
+The events section includes a Normal event with the Updated reason that informs us that the configuration was successfully applied.
+
+If you create a GlobalConfiguration `nginx-configuration` with two or more listeners that have the same protocol UDP and port 53, you will get:
+
+```shell
+kubectl describe gc nginx-configuration -n nginx-ingress
+```
+```text
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Normal   Updated   55s   nginx-ingress-controller  GlobalConfiguration nginx-ingress/nginx-configuration was updated
+  Warning  AddedOrUpdatedWithError  6s    nginx-ingress-controller  GlobalConfiguration nginx-ingress/nginx-configuration is invalid and was rejected: spec.listeners: Duplicate value: "Duplicated port/protocol combination 53/UDP"
+```
+
+The events section includes a Warning event with the AddedOrUpdatedWithError reason.
+
+
+## Using IPV4 and IPV6 Addresses with GlobalConfiguration
+
+You can customize the IPv4 and IPv6 Address listeners in the global configuration and apply them to your VirtualServer resources. See the corresponding example [here](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/custom-ip-listeners/virtualserver/)
diff --git a/content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md b/content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md
new file mode 100644
index 000000000..e1d9a120c
--- /dev/null
+++ b/content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md
@@ -0,0 +1,50 @@
+---
+docs: DOCS-586
+doctypes:
+- ''
+title: Management ConfigMap resource
+toc: true
+weight: 300
+---
+
+When using F5 NGINX Ingress Controller with NGINX Plus, it is required to pass a [command line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) to NGINX Ingress Controller, `--mgmt-configmap=<namespace/name>` which specifies the ConfigMap to use. The minimal required ConfigMap must have a `license-token-secret-name` key. Helm users will not need to create this map or pass the argument, it will be created with a Helm install. 
+
+---
+
+1. Create a ConfigMap file with the name *nginx-config-mgmt.yaml* and set the values
+that make sense for your setup:
+
+    ```yaml
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: nginx-config-mgmt
+      namespace: nginx-ingress
+    data:
+      license-token-secret-name: "license-token"
+    ```
+1. Create a new (or update the existing) ConfigMap resource:
+
+    ```shell
+    kubectl apply -f nginx-config-mgmt.yaml
+    ```
+
+    The [NGINX Management](https://nginx.org/en/docs/ngx_mgmt_module.html) block configuration will be updated.
+---
+## Management ConfigMap keys
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default |
+| ---| ---| ---|
+|*license-token-secret-name* | Configures the secret used in the [license_token](https://nginx.org/en/docs/ngx_mgmt_module.html#license_token) directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.com/license` with the base64 encoded JWT in the `license.jwt` key.  | N/A |
+|*ssl-verify* | Configures the [ssl_verify](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_verify) directive, which enables or disables verification of the usage reporting endpoint certificate. | `true` |
+|*enforce-initial-report* | Configures the [enforce_initial_report](https://nginx.org/en/docs/ngx_mgmt_module.html#enforce_initial_report) directive, which enables or disables the 180-day grace period for sending the initial usage report. | `false` |
+|*usage-report-endpoint* | Configures the endpoint of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This is used to configure the endpoint NGINX uses to send usage reports to NIM. | `product.connect.nginx.com` |
+|*usage-report-interval* | Configures the interval of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This specifies the frequency that usage reports are sent. This field takes an [NGINX time](https://nginx.org/en/docs/syntax.html). | `1h` |
+|*usage-report-proxy-host* | Configures the host name of the [proxy](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy) directive with optional port. | N/A |
+|*ssl-trusted-certificate-secret-name* | Configures the secret used to create the file(s) referenced the in [ssl_trusted_certifcate](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_trusted_certificate), and [ssl_crl](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.org/ca`, where the `ca.crt` key contains a base64 encoded trusted cert, and the optional `ca.crl` key can contain a base64 encoded CRL. If the optional `ca.crl` key is supplied, it will configure the NGINX `ssl_crl` directive. | N/A |
+|*ssl-certificate-secret-name* | Configures the secret used to create the `ssl_certificate` and `ssl_certificate_key` directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `kubernetes.io/tls`| N/A |
+|*resolver-addresses* | Configures addresses used in the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive. This field takes a comma separated list of addresses. | N/A |
+|*resolver-ipv6* | Configures whether the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will look up IPv6 addresses. | `true` |
+|*resolver-valid* | Configures an [NGINX time](https://nginx.org/en/docs/syntax.html) that the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will override the TTL value of responses from nameservers with. | N/A |
+{{</bootstrap-table>}}
diff --git a/content/includes/nic/configuration/global-configuration/reporting-resources-status.md b/content/includes/nic/configuration/global-configuration/reporting-resources-status.md
new file mode 100644
index 000000000..8e36733eb
--- /dev/null
+++ b/content/includes/nic/configuration/global-configuration/reporting-resources-status.md
@@ -0,0 +1,195 @@
+---
+docs: DOCS-589
+doctypes:
+- ''
+title: Reporting resource status
+toc: true
+weight: 600
+---
+
+This page describes how to view the status of resources managed by F5 NGINX Ingress Controller.
+
+## Ingress resources
+
+An Ingress resource status includes the address (an IP address or a DNS name), through which the hosts of that Ingress resource are publicly accessible.
+
+You can see the address in the output of the `kubectl get ingress` command, in the ADDRESS column, as shown below:
+
+```shell
+kubectl get ingresses
+```
+```text
+NAME           HOSTS              ADDRESS           PORTS     AGE
+cafe-ingress   cafe.example.com   12.13.23.123      80, 443   2m
+```
+
+NGINX Ingress Controller must be configured to report an Ingress status:
+
+1. Use the command-line flag `-report-ingress-status`.
+1. Define a source for an external address. This can be either of:
+    1. A user defined address, specified in the `external-status-address` ConfigMap key.
+    1. A Service of the type LoadBalancer configured with an external IP or address and specified by the `-external-service` command-line flag.
+
+View the [ConfigMap keys](/nginx-ingress-controller/configuration/global-configuration/configmap-resource) and [Command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) topics for more information.
+
+{{< note >}} NGINX Ingress Controller does not clear the status of Ingress resources when it is being shut down. {{< /note >}}
+
+## VirtualServer and VirtualServerRoute resources
+
+A VirtualServer or VirtualServerRoute resource includes the status field with information about the state of the resource and the IP address, through which the hosts of that resource are publicly accessible.
+
+You can see the status in the output of the `kubectl get virtualservers` or `kubectl get virtualserverroutes` commands as shown below:
+
+```shell
+kubectl get virtualservers
+```
+```text
+  NAME   STATE   HOST                   IP            PORTS      AGE
+  cafe   Valid   cafe.example.com       12.13.23.123  [80,443]   34s
+```
+
+To see an external hostname address associated with a VirtualServer resource, use the `-o wide` option:
+
+```shell
+kubectl get virtualservers -o wide
+```
+```text
+  NAME   STATE   HOST               IP    EXTERNALHOSTNAME                                                         PORTS      AGE
+  cafe   Valid   cafe.example.com         ae430f41a1a0042908655abcdefghijkl-12345678.eu-west-2.elb.amazonaws.com   [80,443]   106s
+```
+
+{{< note >}} If there are multiple addresses, only the first one is shown. {{< /note >}}
+
+In order to see additional addresses or extra information about the `Status` of the resource, use the following command:
+
+```shell
+kubectl describe virtualserver <NAME>
+```
+```text
+...
+Status:
+  External Endpoints:
+    Ip:        12.13.23.123
+    Ports:     [80,443]
+  Message:  Configuration for cafe/cafe was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+```
+
+### Status specification
+
+The following fields are reported in both VirtualServer and VirtualServerRoute status:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+|*State* | Current state of the resource. Can be ``Valid``, ``Warning`` an ``Invalid``. For more information, refer to the ``message`` field. | *string* |
+|*Reason* | The reason of the last update. | *string* |
+|*Message* | Additional information about the state. | *string* |
+|*ExternalEndpoints* | A list of external endpoints for which the hosts of the resource are publicly accessible. | *[externalEndpoint](#externalendpoint)* |
+{{</bootstrap-table>}}
+
+The *ReferencedBy* field is reported for the VirtualServerRoute status only:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+| *ReferencedBy* | The VirtualServer that references this VirtualServerRoute. Format as ``namespace/name`` | *string* |
+{{</bootstrap-table>}}
+
+### externalEndpoint
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+|``IP`` | The external IP address. | ``string`` |
+|``Hostname`` | The external LoadBalancer Hostname address. | ``string`` |
+|``Ports`` | A list of external ports. | ``string`` |
+{{</bootstrap-table>}}
+
+NGINX Ingress Controller must be configured to report a VirtualServer or VirtualServerRoute status:
+
+1. If you want NGINX Ingress Controller to report the `externalEndpoints`, define a source for an external address (The rest of the fields will be reported without the external address configured). This can be:
+    1. A user defined address, specified in the `external-status-address` ConfigMap key.
+    1. A Service of the type LoadBalancer configured with an external IP or address and specified by the `-external-service` command-line flag.
+
+View the [ConfigMap keys](/nginx-ingress-controller/configuration/global-configuration/configmap-resource) and [Command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) topics for more information.
+
+{{< note >}} NGINX Ingress Controller does not clear the status of VirtualServer and VirtualServerRoute resources when it is being shut down. {{< /note >}}
+
+## Policy resources
+
+A Policy resource includes the status field with information about the state of the resource.
+
+You can see the status in the output of the `kubectl get policy` command as shown below:
+
+```shell
+kubectl get policy
+```
+```text
+  NAME              STATE   AGE
+  webapp-policy     Valid   30s
+```
+
+In order to see additional addresses or extra information about the `Status` of the resource, use the following command:
+
+```shell
+kubectl describe policy <NAME>
+```
+```text
+...
+Status:
+  Message:  Configuration for default/webapp-policy was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+```
+
+### Status specification
+
+The following fields are reported in Policy status:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+|``State`` | Current state of the resource. Can be ``Valid`` or ``Invalid``. For more information, refer to the ``message`` field. | ``string`` |
+|``Reason`` | The reason of the last update. | ``string`` |
+|``Message`` | Additional information about the state. | ``string`` |
+{{</bootstrap-table>}}
+
+## TransportServer resources
+
+A TransportServer resource includes the status field with information about the state of the resource.
+
+You can see the status in the output of the `kubectl get transportserver` command as shown below:
+
+```shell
+kubectl get transportserver
+```
+```text
+  NAME      STATE   REASON           AGE
+  dns-tcp   Valid   AddedOrUpdated   47m
+```
+
+To see additional addresses or extra information about the `Status` of the resource, use the following command:
+
+```shell
+kubectl describe transportserver <NAME>
+```
+```text
+Status:
+  Message:  Configuration for default/dns-tcp was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+```
+
+### Status specification
+
+The following fields are reported in TransportServer status:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+| *State* | Current state of the resource. Can be ``Valid``, ``Warning`` or ``Invalid``. For more information, refer to the ``message`` field. | *string* |
+| *Reason* | The reason of the last update. | *string* |
+| *Message* | Additional information about the state. | *string* |
+{{</bootstrap-table>}}
diff --git a/content/includes/nic/configuration/host-and-listener-collisions.md b/content/includes/nic/configuration/host-and-listener-collisions.md
new file mode 100644
index 000000000..502ef830c
--- /dev/null
+++ b/content/includes/nic/configuration/host-and-listener-collisions.md
@@ -0,0 +1,168 @@
+---
+title: Host and Listener collisions
+toc: true
+weight: 800
+docs: DOCS-590
+---
+
+This document explains how F5 NGINX Ingress Controller handles host and listener collisions between resources.
+
+---
+
+## Winner Selection Algorithm
+
+If multiple resources contend for the same host or listener, NGINX Ingress Controller will pick the winner based on the `creationTimestamp` of the resources: the oldest resource will win. In case there are more than one oldest resource (their `creationTimestamp` is the same),  NGINX Ingress Controller will choose the resource with the lexicographically smallest `uid`.
+
+{{< note >}} The `creationTimestamp` and `uid` fields are part of the [ObjectMeta](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/object-meta/) resource. {{< /note >}}
+
+---
+
+## Host collisions
+
+A host collision occurs when multiple Ingress, VirtualServer, and TransportServer (configured for TLS Passthrough) resources configure the same `host`. NGINX Ingress Controller has two strategies for handling host collisions:
+
+- Choosing a single "winner" resource to handle the host.
+- Merging the configuration of the conflicting resources.
+
+---
+
+### Choosing the winner
+
+Consider the following two resources:
+
+- `cafe-ingress` Ingress:
+
+    ```yaml
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    metadata:
+      name: cafe-ingress
+    spec:
+      ingressClassName: nginx
+      rules:
+      - host: cafe.example.com
+        . . .
+    ```
+
+- `cafe-virtual-server` VirtualServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: VirtualServer
+    metadata:
+      name: cafe-virtual-server
+    spec:
+      host: cafe.example.com
+      . . .
+    ```
+
+If a user creates both resources in the cluster, a host collision will occur. NGINX Ingress Controller will pick the winner using the [winner selection algorithm](#winner-selection-algorithm).
+
+If `cafe-virtual-server` was created first, it will win the host `cafe.example.com` and NGINX Ingress Controller will reject `cafe-ingress`. This will be reflected in the events and in the resource's status field:
+
+```shell
+kubectl describe vs cafe-virtual-server
+```
+```text
+...
+Status:
+  ...
+  Message:  Configuration for default/cafe-virtual-server was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  9s    nginx-ingress-controller  Configuration for default/cafe-virtual-server was added or updated
+```
+
+```shell
+kubectl describe ingress cafe-ingress
+```
+```text
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  66s   nginx-ingress-controller  All hosts are taken by other resources
+```
+
+Similarly, if `cafe-ingress` was created first, it will win `cafe.example.com` and NGINX Ingress Controller will reject `cafe-virtual-server`.
+
+{{< note >}} You can configure multiple hosts for Ingress resources, and its possible that an Ingress resource can be the winner for some of its hosts and a loser for the others.
+
+For example, if `cafe-ingress` had an additional rule host rule for `pub.example.com`, NGINX Ingress Controller would not reject the Ingress. Instead, it would allow `cafe-ingress` to handle `pub.example.com`. {{< /note >}}
+
+---
+
+### Merging configuration for the same host
+
+It is possible to merge configuration for multiple Ingress resources for the same host. One common use case for this approach is distributing resources across multiple namespaces.
+
+The [Cross-namespace configuration]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration.md">}}) topic has more information.
+
+It is *not* possible to merge the configurations for multiple VirtualServer resources for the same host. However, you can split the VirtualServers into multiple VirtualServerRoute resources, which a single VirtualServer can then reference. See the [corresponding example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/cross-namespace-configuration) on GitHub.
+
+It is *not* possible to merge configuration for multiple TransportServer resources.
+
+---
+
+## Listener/Host collisions
+
+Listener/Host collisions occur when multiple TransportServer resources (configured for TCP/UDP load balancing) specify the same combination of `spec.listener.name` and `spec.host`.
+
+The combination of `spec.listener.name` and `spec.host` must be unique among all TransportServer resources. If two TransportServer resources specify the same spec.listener.name and spec.host, one of them will be rejected to prevent conflicts. In the case where spec.host is not specified, it is considered an empty string.
+
+NGINX Ingress Controller will choose the winner, which will own that listener and host combination.
+
+---
+
+### Choosing the winner
+
+Consider the following two resources:
+
+- `tcp-1` TransportServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: TransportServer
+    metadata:
+      name: tcp-1
+    spec:
+      host: dns.example.com
+      listener:
+        name: dns-tcp
+        protocol: TCP
+        . . .
+    ```
+
+- `tcp-2` TransportServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: TransportServer
+    metadata:
+      name: tcp-2
+    spec:
+      host: dns.example.com
+      listener:
+        name: dns-tcp
+        protocol: TCP
+        . . .
+    ```
+
+If a user creates both resources in the cluster, a listener collision will occur. As a result, NGINX Ingress Controller will pick the winner using the [winner selection algorithm](#winner-selection-algorithm).
+
+In our example, if `tcp-1` was created first, it will win the listener `dns-tcp` and NGINX Ingress Controller will reject `tcp-2`. This will be reflected in the events and in the resource's status field:
+
+```shell
+kubectl describe ts tcp-2
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  10s   nginx-ingress-controller  Listener dns-tcp is taken by another resource
+```
+
+Similarly, if `tcp-2` was created first, it will win `dns-tcp` and NGINX Ingress Controller will reject `tcp-1`.
diff --git a/content/includes/nic/configuration/ingress-resources/_index.md b/content/includes/nic/configuration/ingress-resources/_index.md
new file mode 100644
index 000000000..8a2b5b282
--- /dev/null
+++ b/content/includes/nic/configuration/ingress-resources/_index.md
@@ -0,0 +1,8 @@
+---
+title: Ingress resources
+description:
+weight: 200
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
new file mode 100644
index 000000000..ecc12435f
--- /dev/null
+++ b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
@@ -0,0 +1,225 @@
+---
+docs: DOCS-591
+doctypes:
+- ''
+title: Advanced configuration with Annotations
+toc: true
+weight: 200
+---
+
+This topic explains how to enable advanced features in F5 NGINX Ingress Controller with Annotations.
+
+The Ingress resource can use basic NGINX features such as host or path-based routing and TLS termination. Advanced features like rewriting the request URI or inserting additional response headers can be enabled with Annotations.
+
+Outside of advanced features, Annotations are necessary for customizing NGINX behavior such as setting the value of connection timeouts.
+
+Customization is also available through the [ConfigMap]({{< relref "/configuration/global-configuration/configmap-resource.md" >}}) resources: Annotations take priority.
+
+## Using Annotations
+
+This example uses Annotations to customize the configuration for an Ingress resource:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-with-annotations
+  annotations:
+    nginx.org/proxy-connect-timeout: "30s"
+    nginx.org/proxy-read-timeout: "20s"
+    nginx.org/client-max-body-size: "4m"
+    nginx.org/server-snippets: |
+      location / {
+        return 302 /coffee;
+      }
+spec:
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea
+        pathType: Prefix
+        backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+      - path: /coffee
+        pathType: Prefix
+        backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+```
+
+## Validation
+
+NGINX Ingress Controller validates the annotations of Ingress resources. If an Ingress is invalid, NGINX Ingress Controller will reject it: the Ingress will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can check if NGINX Ingress Controller successfully applied the configuration for an Ingress resource. For the example `cafe-ingress-with-annotations` Ingress, you can run:
+
+```shell
+kubectl describe ing cafe-ingress-with-annotations
+```
+```text
+...
+Events:
+  Type     Reason          Age   From                      Message
+  ----     ------          ----  ----                      -------
+  Normal   AddedOrUpdated  3s    nginx-ingress-controller  Configuration for default/cafe-ingress-with-annotations was added or updated
+```
+
+The events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid Ingress, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create an Ingress `cafe-ingress-with-annotations`, with an annotation `nginx.org/redirect-to-https` set to `yes please` instead of `true`, you will get:
+
+```shell
+kubectl describe ing cafe-ingress-with-annotations
+```
+```text
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  13s   nginx-ingress-controller  annotations.nginx.org/redirect-to-https: Invalid value: "yes please": must be a boolean
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+{{< note >}} If you make an existing Ingress invalid, NGINX Ingress Controller will reject it and remove the corresponding configuration from NGINX. {{< /note >}}
+
+The `nginx.com/jwt-token` Ingress annotation has limited validation.
+
+## Summary of Annotations
+
+The table below summarizes the available annotations.
+
+{{< note >}} Annotations that start with `nginx.com` are only supported with NGINX Plus. {{< /note >}}
+
+### General customization
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/proxy-connect-timeout* | *proxy-connect-timeout* | Sets the value of the [proxy_connect_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) and [grpc_connect_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_connect_timeout) directive. | *60s* |  |
+| *nginx.org/proxy-read-timeout* | *proxy-read-timeout* | Sets the value of the [proxy_read_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) and [grpc_read_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_read_timeout) directive. | *60s* |  |
+| *nginx.org/proxy-send-timeout* | *proxy-send-timeout* | Sets the value of the [proxy_send_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) and [grpc_send_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_send_timeout) directive. | *60s* |  |
+| *nginx.org/client-max-body-size* | *client-max-body-size* | Sets the value of the [client_max_body_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size) directive. | *1m* |  |
+| *nginx.org/proxy-buffering* | *proxy-buffering* | Enables or disables [buffering of responses](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) from the proxied server. | *True* |  |
+| *nginx.org/proxy-buffers* | *proxy-buffers* | Sets the value of the [proxy_buffers](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) directive. | Depends on the platform. |  |
+| *nginx.org/proxy-buffer-size* | *proxy-buffer-size* | Sets the value of the [proxy_buffer_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) and [grpc_buffer_size](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_buffer_size) directives. | Depends on the platform. |  |
+| *nginx.org/proxy-max-temp-file-size* | *proxy-max-temp-file-size* | Sets the value of the  [proxy_max_temp_file_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_max_temp_file_size) directive. | *1024m* |  |
+| *nginx.org/server-tokens* | *server-tokens* | Enables or disables the [server_tokens](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens) directive. Additionally, with the NGINX Plus, you can specify a custom string value, including the empty string value, which disables the emission of the “Server” field. | *True* |  |
+| *nginx.org/path-regex* | N/A | Enables regular expression modifiers for Ingress path parameter. This translates to the NGINX [location](https://nginx.org/en/docs/http/ngx_http_core_module.html#location) directive. You can specify one of these values: "case_sensitive", "case_insensitive", or "exact". The annotation is applied to the entire Ingress resource and its paths. While using Master and Minion Ingresses i.e. Mergeable Ingresses, this annotation can be specified on Minion types. The `path-regex` annotation specified on Master is ignored, and has no effect on paths defined on Minions.   | N/A |  [path-regex](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/path-regex) |
+{{</bootstrap-table>}}
+
+### Request URI/Header Manipulation
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/proxy-hide-headers* | *proxy-hide-headers* | Sets the value of one or more  [proxy_hide_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directives. Example: ``"nginx.org/proxy-hide-headers": "header-a,header-b"* | N/A |  |
+| *nginx.org/proxy-pass-headers* | *proxy-pass-headers* | Sets the value of one or more   [proxy_pass_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header) directives. Example: ``"nginx.org/proxy-pass-headers": "header-a,header-b"* | N/A |  |
+| *nginx.org/rewrites* | N/A | Configures URI rewriting using [proxy_pass](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass) directive. | N/A | [rewrites](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/rewrites) |
+|*nginx.org/proxy-set-headers* | N/A | Enables customization of proxy headers and values using the [proxy_set_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header) directive. Example: ``"nginx.org/proxy-set-headers": "header-a: valueA,header-b: valueB,header-c: valueC"`` | N/A | [Proxy Set Headers](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/proxy-set-headers). |
+{{</bootstrap-table>}}
+
+### Auth and SSL/TLS
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/redirect-to-https* | *redirect-to-https* | Sets the 301 redirect rule based on the value of the ``http_x_forwarded_proto* header on the server block to force incoming traffic to be over HTTPS. Useful when terminating SSL in a load balancer in front of NGINX Ingress Controller — see [115](https://github.com/nginx/kubernetes-ingress/issues/115) | *False* |  |
+| *ingress.kubernetes.io/ssl-redirect* | *ssl-redirect* | Sets an unconditional 301 redirect rule for all incoming HTTP traffic to force incoming traffic over HTTPS. | *True* |  |
+| *nginx.org/hsts* | *hsts* | Enables [HTTP Strict Transport Security (HSTS)](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/)\ : the HSTS header is added to the responses from backends. The ``preload* directive is included in the header. | *False* |  |
+| *nginx.org/hsts-max-age* | *hsts-max-age* | Sets the value of the ``max-age* directive of the HSTS header. | *2592000* (1 month) |  |
+| *nginx.org/hsts-include-subdomains* | *hsts-include-subdomains* | Adds the ``includeSubDomains* directive to the HSTS header. | *False* |  |
+| *nginx.org/hsts-behind-proxy* | *hsts-behind-proxy* | Enables HSTS based on the value of the ``http_x_forwarded_proto* request header. Should only be used when TLS termination is configured in a load balancer (proxy) in front of NGINX Ingress Controller. Note: to control redirection from HTTP to HTTPS configure the ``nginx.org/redirect-to-https* annotation. | *False* |  |
+| *nginx.org/basic-auth-secret* | N/A | Specifies a Secret resource with a user list for HTTP Basic authentication. | N/A | |
+| *nginx.org/basic-auth-realm* | N/A | Specifies a realm. | N/A | |
+| *nginx.com/jwt-key* | N/A | Specifies a Secret resource with keys for validating JSON Web Tokens (JWTs). | N/A | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+| *nginx.com/jwt-realm* | N/A | Specifies a realm. | N/A | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+| *nginx.com/jwt-token* | N/A | Specifies a variable that contains a JSON Web Token. | By default, a JWT is expected in the ``Authorization* header as a Bearer Token. | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+| *nginx.com/jwt-login-url* | N/A | Specifies a URL to which a client is redirected in case of an invalid or missing JWT. | N/A | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+{{</bootstrap-table>}}
+
+### Listeners
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/listen-ports* | N/A | Configures HTTP ports that NGINX will listen on. | *[80]* |  |
+| *nginx.org/listen-ports-ssl* | N/A | Configures HTTPS ports that NGINX will listen on. | *[443]* |  |
+{{</bootstrap-table>}}
+
+### Backend services (Upstreams)
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/lb-method* | *lb-method* | Sets the [load balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify ``"round_robin"``. | *"random two least_conn"* |  |
+| *nginx.org/ssl-services* | N/A | Enables HTTPS or gRPC over SSL when connecting to the endpoints of services. | N/A | [ssl-services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/ssl-services) |
+| *nginx.org/grpc-services* | N/A | Enables gRPC for services. Note: requires HTTP/2 (see ``http2* ConfigMap key); only works for Ingresses with TLS termination enabled. | N/A | [grpc-services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/grpc-services) |
+| *nginx.org/websocket-services* | N/A | Enables WebSocket for services. | N/A | [websocket](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/websocket) |
+| *nginx.org/max-fails* | *max-fails* | Sets the value of the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the ``server* directive. | *1* |  |
+| *nginx.org/max-conns* | N\A | Sets the value of the [max_conns](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_conns) parameter of the ``server* directive. | *0* |  |
+| *nginx.org/upstream-zone-size* | *upstream-zone-size* | Sets the size of the shared memory [zone](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone) for upstreams. For NGINX, the special value 0 disables the shared memory zones. For NGINX Plus, shared memory zones are required and cannot be disabled. The special value 0 will be ignored. | *256K* |  |
+| *nginx.org/fail-timeout* | *fail-timeout* | Sets the value of the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the ``server* directive. | *10s* |  |
+| *nginx.com/sticky-cookie-services* | N/A | Configures session persistence. | N/A | [session-persistence](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/session-persistence) |
+| *nginx.org/keepalive* | *keepalive* | Sets the value of the [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) directive. Note that ``proxy_set_header Connection "";* is added to the generated configuration when the value > 0. | *0* |  |
+| *nginx.com/health-checks* | N/A | Enables active health checks. | *False* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
+| *nginx.com/health-checks-mandatory* | N/A | Configures active health checks as mandatory. | *False* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
+| *nginx.com/health-checks-mandatory-queue* | N/A | When active health checks are mandatory, creates a queue where incoming requests are temporarily stored while NGINX Plus is checking the health of the endpoints after a configuration reload. | *0* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
+| *nginx.com/slow-start* | N/A | Sets the upstream server [slow-start period](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#server-slow-start). By default, slow-start is activated after a server becomes [available](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks) or [healthy](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#active-health-checks). To enable slow-start for newly-added servers, configure [mandatory active health checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks). | *"0s"* |  |
+| *nginx.org/use-cluster-ip* | N/A | Enables using the Cluster IP and port of the service instead of the default behavior of using the IP and port of the pods. When this field is enabled, the fields that configure NGINX behavior related to multiple upstream servers (like ``lb-method* and ``next-upstream``) will have no effect, as NGINX Ingress Controller will configure NGINX with only one upstream server that will match the service Cluster IP.   | *False* |  |
+{{</bootstrap-table>}}
+
+### Rate limiting
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/limit-req-rate* | N/A | Enables request-rate-limiting for this ingress by creating a [limit_req_zone](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone) and matching [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) for each location. All servers/locations of one ingress share the same zone. Must have unit r/s or r/m. | N/A | 200r/s |
+| *nginx.org/limit-req-key* | N/A | The key to which the rate limit is applied. Can contain text, variables, or a combination of them. Variables must be surrounded by ${}. | ${binary_remote_addr} | ${binary_remote_addr} |
+| *nginx.org/limit-req-zone-size* | N/A | Configures the size of the created [limit_req_zone](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone). | 10m | 20m |
+| *nginx.org/limit-req-delay* | N/A | Configures the delay-parameter of the [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) directive. | 0 | 100 |
+| *nginx.org/limit-req-no-delay* | N/A | Configures the nodelay-parameter of the [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) directive. | false | true |
+| *nginx.org/limit-req-burst* | N/A | Configures the burst-parameter of the [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) directive. | N/A | 100 |
+| *nginx.org/limit-req-dry-run* | N/A | Enables the dry run mode. In this mode, the rate limit is not actually applied, but the number of excessive requests is accounted as usual in the shared memory zone. | false | true |
+| *nginx.org/limit-req-log-level* | N/A | Sets the desired logging level for cases when the server refuses to process requests due to rate exceeding, or delays request processing. Allowed values are info, notice, warn or error. | error | info |
+| *nginx.org/limit-req-reject-code* | N/A | Sets the status code to return in response to rejected requests. Must fall into the range 400..599. | 429 | 503 |
+| *nginx.org/limit-req-scale* | N/A | Enables a constant rate-limit by dividing the configured rate by the number of nginx-ingress pods currently serving traffic. This adjustment ensures that the rate-limit remains consistent, even as the number of nginx-pods fluctuates due to autoscaling. Note: This will not work properly if requests from a client are not evenly distributed accross all ingress pods (sticky sessions, long lived TCP-Connections with many requests etc.). In such cases using [zone-sync]({{< ref "/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) instead would give better results.  Enabling `zone-sync` will suppress this setting. | false | true |
+{{</bootstrap-table>}}
+
+### Snippets and custom templates
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/location-snippets* | *location-snippets* | Sets a custom snippet in location context. | N/A |  |
+| *nginx.org/server-snippets* | *server-snippets* | Sets a custom snippet in server context. | N/A |  |
+{{</bootstrap-table>}}
+
+### App Protect WAF {#app-protect}
+
+{{< note >}} The App Protect annotations only work if the App Protect WAF module is [installed]({{< relref "installation/integrations/app-protect-waf/installation.md" >}}). {{< /note >}}
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *appprotect.f5.com/app-protect-policy* | N/A | The name of the App Protect Policy for the Ingress Resource. Format is ``namespace/name``. If no namespace is specified, the same namespace of the Ingress Resource is used. If not specified but ``appprotect.f5.com/app-protect-enable* is true, a default policy id applied. If the referenced policy resource does not exist, or policy is invalid, this annotation will be ignored, and the default policy will be applied. | N/A | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-enable* | N/A | Enable App Protect for the Ingress Resource. | *False* | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-security-log-enable* | N/A | Enable the [security log](/nginx-app-protect/troubleshooting/#app-protect-logging-overview) for App Protect. | *False* | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-security-log* | N/A | The App Protect log configuration for the Ingress Resource. Format is ``namespace/name``. If no namespace is specified, the same namespace as the Ingress Resource is used. If not specified the  default is used which is:  filter: ``illegal``, format: ``default``. Multiple configurations can be specified in a comma separated list. Both log configurations and destinations list (see below) must be of equal length. Configs and destinations are paired by the list indices. | N/A | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-security-log-destination* | N/A | The destination of the security log. For more information check the [DESTINATION argument](/nginx-app-protect/troubleshooting/#app-protect-logging-overview). Multiple destinations can be specified in a comma-separated list.  Both log configurations and destinations list (see above) must be of equal length. Configs and destinations are paired by the list indices. | *syslog:server=localhost:514* | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+{{</bootstrap-table>}}
+
+### App Protect DoS
+
+{{< note >}} The App Protect DoS annotations only work if the App Protect DoS module is [installed]({{< relref "installation/integrations/app-protect-dos/installation.md" >}}). {{< /note >}}
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *appprotectdos.f5.com/app-protect-dos-resource* | N/A | Enable App Protect DoS for the Ingress Resource by specifying a [DosProtectedResource]({{< relref "installation/integrations/app-protect-dos/dos-protected.md" >}}). | N/A | [app-protect-dos](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-dos) |
+{{</bootstrap-table>}}
diff --git a/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
new file mode 100644
index 000000000..642d041ae
--- /dev/null
+++ b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
@@ -0,0 +1,128 @@
+---
+docs: DOCS-592
+doctypes:
+- ''
+title: Advanced configuration with Snippets
+toc: true
+weight: 400
+---
+
+Snippets allow you to insert raw NGINX config into different contexts of the NGINX configurations that F5 NGINX Ingress Controller generates. 
+
+Snippets are intended for advanced NGINX users who need more control over the generated NGINX configuration, and can be used in cases where Annotations and ConfigMap entries would not apply. 
+
+
+
+## Disadvantages of snippets
+
+Snippets are configured [using Annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#snippets-and-custom-templates" >}}), but are disabled by default due to their complexity. They are also available through the [ConfigMap]({{< relref "/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}}) resource.
+
+To use snippets, set the [`enable-snippets`]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-snippets" >}}) command-line argument.
+
+Snippets have the following disadvantages:
+
+- *Complexity*. Snippets require you to:
+  - Understand NGINX configuration primitives and implement a correct NGINX configuration.
+  - Understand how NGINX Ingress Controller generates NGINX configuration so that a snippet doesn't interfere with the other features in the configuration.
+- *Decreased robustness*. An incorrect snippet can invalidate NGINX configuration, causing reload failures. Until the snippet is fixed, it will prevent any new configuration updates, including updates for the other Ingress resources.
+- *Security implications*. Snippets give access to NGINX configuration primitives, which are not validated by NGINX Ingress Controller. For example, a snippet can configure NGINX to serve the TLS certificates and keys used for TLS termination for Ingress resources.
+
+{{< note >}} If the NGINX configuration includes an invalid snippet, NGINX will continue to operate with the last valid configuration. {{< /note >}} 
+
+## Using snippets
+
+The example below shows how to use snippets to customize the NGINX configuration template using annotations.
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-with-snippets
+  annotations:
+    nginx.org/server-snippets: |
+      location / {
+          return 302 /coffee;
+      }
+    nginx.org/location-snippets: |
+      add_header my-test-header test-value;
+spec:
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea
+        pathType: Prefix
+        backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+      - path: /coffee
+        pathType: Prefix
+        backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+```
+
+These snippets generate the following NGINX configuration:
+
+{{< note >}} The example is shortened for conciseness. {{< /note >}} 
+
+```nginx
+server {
+    listen 80;
+
+
+    location / {
+        return 302 /coffee;
+    }
+
+
+    location /coffee {
+        proxy_http_version 1.1;
+
+
+        add_header my-test-header test-value;
+        ...
+        proxy_pass http://default-cafe-ingress-with-snippets-cafe.example.com-coffee-svc-80;
+    }
+
+    location /tea {
+        proxy_http_version 1.1;
+
+        add_header my-test-header test-value;
+        ...
+        proxy_pass http://default-cafe-ingress-with-snippets-cafe.example.com-tea-svc-80;
+    }
+}
+```
+
+## Troubleshooting
+
+If a snippet includes an invalid NGINX configuration, NGINX Ingress Controller will fail to reload NGINX. The error will be reported in NGINX Ingress Controller logs and an event with the error will be associated with the Ingress resource:
+
+An example of an error from the logs:
+
+```text
+[emerg] 31#31: unknown directive "badd_header" in /etc/nginx/conf.d/default-cafe-ingress-with-snippets.conf:54
+Event(v1.ObjectReference{Kind:"Ingress", Namespace:"default", Name:"cafe-ingress-with-snippets", UID:"f9656dc9-63a6-41dd-a499-525b0e0309bb", APIVersion:"extensions/v1beta1", ResourceVersion:"2322030", FieldPath:""}): type: 'Warning' reason: 'AddedOrUpdatedWithError' Configuration for default/cafe-ingress-with-snippets was added or updated, but not applied: Error reloading NGINX for default/cafe-ingress-with-snippets: nginx reload failed: Command /usr/sbin/nginx -s reload stdout: ""
+stderr: "nginx: [emerg] unknown directive \"badd_header\" in /etc/nginx/conf.d/default-cafe-ingress-with-snippets.conf:54\n"
+finished with error: exit status 1
+```
+
+An example of an event with an error (you can view events associated with the Ingress by running `kubectl describe -n nginx-ingress ingress nginx-ingress`):
+
+```text
+Events:
+Type     Reason                   Age                From                      Message
+----     ------                   ----               ----                      -------
+Normal   AddedOrUpdated           52m (x3 over 61m)  nginx-ingress-controller  Configuration for default/cafe-ingress-with-snippets was added or updated
+finished with error: exit status 1
+Warning  AddedOrUpdatedWithError  54s (x2 over 89s)  nginx-ingress-controller  Configuration for default/cafe-ingress-with-snippets was added or updated, but not applied: Error reloading NGINX for default/cafe-ingress-with-snippets: nginx reload failed: Command /usr/sbin/nginx -s reload stdout: ""
+stderr: "nginx: [emerg] unknown directive \"badd_header\" in /etc/nginx/conf.d/default-cafe-ingress-with-snippets.conf:54\n"
+finished with error: exit status 1
+```
+
+Additionally, to help troubleshoot snippets, a number of Prometheus metrics show the stats about failed reloads – `controller_nginx_last_reload_status` and `controller_nginx_reload_errors_total`.
diff --git a/content/includes/nic/configuration/ingress-resources/basic-configuration.md b/content/includes/nic/configuration/ingress-resources/basic-configuration.md
new file mode 100644
index 000000000..bd2c10d26
--- /dev/null
+++ b/content/includes/nic/configuration/ingress-resources/basic-configuration.md
@@ -0,0 +1,107 @@
+---
+title: Basic configuration
+weight: 100
+toc: true
+type: reference
+product: NIC
+docs: DOCS-593
+---
+
+This document shows a basic Ingress resource definition for F5 NGINX Ingress Controller. It load balances requests for two services as part of a single application.
+
+{{< ghcode `https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/ingress-resources/complete-example/cafe-ingress.yaml`>}}
+
+Here is a breakdown of what this Ingress resource definition means:
+
+- The `metadata.name` field defines the name of the resource `cafe‑ingress`.
+- The `spec.tls` field sets up SSL/TLS termination:
+  - The `hosts` field applies the certificate and key to the `cafe.example.com` host.
+  - The `secretName` references a secret resource by its name, `cafe‑secret`. The secret must belong to the same namespace as the Ingress, of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that hold the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls>). If the secret doesn't exist or is invalid, NGINX will break any attempt to establish a TLS connection to the hosts to which the secret is applied.
+- The `spec.rules` field defines a host with the domain name `cafe.example.com`.
+- The `paths` field defines two path‑based rules:
+  - The rule with the path `/tea` instructs NGINX to distribute the requests with the `/tea` URI among the pods of the *tea* service, which is deployed with the name `tea‑svc` in the cluster.
+  - The rule with the path `/coffee` instructs NGINX to distribute the requests with the `/coffee` URI among the pods of the *coffee* service, which is deployed with the name `coffee‑svc` in the cluster.
+  - Both rules instruct NGINX to distribute the requests to `port 80` of the corresponding service (the `servicePort` field).
+
+To learn more about the Ingress resource, view [the official Kubernetes documentation for Ingress resources](https://kubernetes.io/docs/concepts/services-networking/ingress/).
+
+{{< note >}} For complete instructions on deploying Ingress and Secret resources in the cluster, see the [complete example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/complete-example) in the GitHub repository. {{< /note >}}
+
+---
+
+## New features available in Kubernetes 1.18
+
+Starting from Kubernetes 1.18, you can use the following new features:
+
+- The host field supports wildcard domain names, such as `*.example.com`.
+- The path supports different matching rules with the new field `pathType`, which takes the following values: `Prefix` for prefix-based matching, `Exact` for exact matching and `ImplementationSpecific`, which is the default type and is the same as `Prefix`. For example:
+
+  ```yaml {hl_lines=[2, 7, 14]}
+    - path: /tea
+      pathType: Prefix
+      backend:
+        serviceName: tea-svc
+        servicePort: 80
+    - path: /tea/green
+      pathType: Exact
+      backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+    - path: /coffee
+      pathType: ImplementationSpecific
+      backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+  ```
+
+- The `ingressClassName` field is now supported:
+
+  ```yaml {hl_lines=[6]}
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    metadata:
+      name: cafe-ingress
+    spec:
+      ingressClassName: nginx
+      tls:
+      - hosts:
+        - cafe.example.com
+        secretName: cafe-secret
+      rules:
+      - host: cafe.example.com
+    . . .
+  ```
+
+  When using this field you need to create the `IngressClass` resource with the corresponding `name`. View the [Create common resources]({{< relref "installation/installing-nic/installation-with-manifests.md#create-common-resources" >}}) section of the Installation with Manifests topic for more information.
+
+---
+
+## Restrictions
+
+NGINX Ingress Controller imposes the following restrictions on Ingress resources:
+
+- When defining an Ingress resource, the `host` field is required.
+- The `host` value needs to be unique among all Ingress and VirtualServer resources unless the Ingress resource is a [mergeable minion]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration.md" >}}). View the [Host and Listener collisions]({{< ref "/nic/configuration/host-and-listener-collisions.md" >}}) topic for more information.
+- The `path` field in `spec.rules[].http.paths[]` is required for `Exact` and `Prefix` `pathTypes`.
+- The ImplementationSpecific `pathType` is treated as equivalent to `Prefix` `pathType`, with the exception that when this `pathType` is configured, the `path` field in `spec.rules[].http.paths[]` is not mandatory. `path` defaults to `/` if not set but the `pathType` is set to ImplementationSpecific.
+
+---
+
+## Advanced configuration
+
+NGINX Ingress Controller generates NGINX configuration by executing a template file that contains the configuration options. 
+
+These options are set with the Ingress resource and NGINX Ingress Controller's ConfigMap.  
+
+The Ingress resource only allows you to use basic NGINX features: host and path-based routing and TLS termination.
+
+For advanced configuration, you have two options:
+
+- [Annotations]({{< ref "/configuration/ingress-resources/advanced-configuration-with-annotations.md" >}}) can be used to rewrite request URIs or inserting additional response headers.
+- [Snippets]({{< ref "/configuration/ingress-resources/advanced-configuration-with-snippets" >}}) can be used to insert raw NGINX configuration, changing generated files.
+
+Additionally, it is possible to customize the template, described in the [Custom templates]({{< relref "/configuration/global-configuration/custom-templates.md" >}}) topic.
diff --git a/content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md b/content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md
new file mode 100644
index 000000000..3e92b6403
--- /dev/null
+++ b/content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md
@@ -0,0 +1,14 @@
+---
+docs: DOCS-594
+doctypes:
+- ''
+title: Cross-namespace configuration
+toc: true
+weight: 500
+---
+
+This topic explains how to spread Ingress configuration across different namespaces in F5 NGINX Ingress Controller.
+
+You can spread the Ingress configuration for a common host across multiple Ingress resources using Mergeable Ingress resources. Such resources can belong to the *same* or *different* namespaces. This enables easier management when using a large number of paths. See the [Mergeable Ingress Resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/mergeable-ingress-types) example in our GitHub repo.
+
+As an alternative to Mergeable Ingress resources, you can use [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) for cross-namespace configuration. See the [Cross-Namespace Configuration](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/cross-namespace-configuration) example in our GitHub repo.
diff --git a/content/includes/nic/configuration/ingress-resources/custom-annotations.md b/content/includes/nic/configuration/ingress-resources/custom-annotations.md
new file mode 100644
index 000000000..8bbd136b0
--- /dev/null
+++ b/content/includes/nic/configuration/ingress-resources/custom-annotations.md
@@ -0,0 +1,146 @@
+---
+docs: DOCS-595
+doctypes:
+- ''
+title: Custom annotations
+toc: true
+weight: 300
+---
+
+This topic explains how you can use custom annotations with F5 NGINX Ingress Controller.
+
+Custom annotations enable you to quickly extend the Ingress resource to support many advanced features of NGINX, such as rate limiting, caching, etc.
+
+## Overview
+
+NGINX Ingress Controller supports a number of annotations for the Ingress resource that fine tune NGINX configuration (for example, connection timeouts) or enable additional features (for example, JWT validation). The complete list of annotations is available [here](/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations).
+
+The annotations are provided only for the most common features and use cases, meaning that not every NGINX feature or a customization option is available through the annotations. Additionally, even if an annotation is available, it might not give you the satisfactory level of control of a particular NGINX feature.
+
+Custom annotations allow you to add an annotation for an NGINX feature that is not available as a regular annotation. In contrast with regular annotations, to add a custom annotation, you don't need to modify the Ingress Controller source code -- just modify the template. Additionally, with a custom annotation, you get full control of how the feature is implemented in NGINX configuration.
+
+## Usage
+
+The Ingress Controller generates NGINX configuration for Ingress resources by executing a configuration template. See [NGINX template](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx.ingress.tmpl) or [NGINX Plus template](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx-plus.ingress.tmpl).
+
+To support custom annotations, the template has access to the information about the Ingress resource - its *name*, *namespace* and *annotations*. It is possible to check if a particular annotation present in the Ingress resource and conditionally insert NGINX configuration directives at multiple NGINX contexts - `http`, `server`, `location` or `upstream`. Additionally, you can get the value that is set to the annotation.
+
+Consider the following excerpt from the template, which was extended to support two custom annotations:
+
+```jinja2
+# This is the configuration for {{$.Ingress.Name}}/{{$.Ingress.Namespace}}
+
+{{if index $.Ingress.Annotations "custom.nginx.org/feature-a"}}
+# Insert config for feature A if the annotation is set
+{{end}}
+
+{{with $value := index $.Ingress.Annotations "custom.nginx.org/feature-b"}}
+# Insert config for feature B if the annotation is set
+# Print the value assigned to the annotation: {{$value}}
+{{end}}
+```
+
+Consider the following Ingress resource and note how we set two annotations:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: example-ingress
+  namespace: production
+  annotations:
+    custom.nginx.org/feature-a: "on"
+    custom.nginx.org/feature-b: "512"
+spec:
+  rules:
+  - host: example.com
+    . . .
+```
+
+Assuming that the Ingress Controller is using that customized template, it will generate a config for the Ingress resource that will include the following part, generated by our template excerpt:
+
+```yaml
+# This is the configuration for cafe-ingress/default
+
+# Insert config for feature A if the annotation is set
+
+
+
+# Insert config for feature B if the annotation is set
+# Print the value assigned to the annotation: 512
+```
+
+**Notes**:
+
+- You can customize the template to insert you custom annotations via [custom templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates).
+- The Ingress Controller uses go templates to generate NGINX config. You can read more information about go templates [here](https://golang.org/pkg/text/template/).
+
+See the examples in the next section that use custom annotations to configure NGINX features.
+
+### Custom Annotations with Mergeable Ingress Resources
+
+A Mergeable Ingress resource consists of multiple Ingress resources - one master and one or several minions. Read more about Mergeable Ingress resources [here](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration).
+
+If you'd like to use custom annotations with Mergeable Ingress resources, please keep the following in mind:
+
+- Custom annotations can be used in the Master and in Minions. For Minions, you can access them in the template only when processing locations.
+
+    If you access `$.Ingress` anywhere in the Ingress template, you will get the master Ingress resource. To access a Minion Ingress resource, use `$location.MinionIngress`. However, it is only available when processing locations:
+
+    ```jinja2
+      {{range $location := $server.Locations}}
+      location {{$location.Path}} {
+        {{with $location.MinionIngress}}
+          # location for minion {{$location.MinionIngress.Namespace}}/{{$location.MinionIngress.Name}}
+        {{end}}
+      } {{end}}
+    ```
+
+    **Note**: `$location.MinionIngress` is a pointer. When a regular Ingress resource is processed in the template, the value of the pointer is `nil`. Thus, it is important that you check that `$location.MinionIngress` is not `nil` as in the example above using the `with` action.
+
+- Minions do not inherent custom annotations of the master.
+
+### Helper Functions
+
+Helper functions can be used in the Ingress template to parse the values of custom annotations.
+
+{{% table %}}
+| Function | Input Arguments | Return Arguments | Description |
+| ---| ---| ---| --- |
+| ``split`` | ``s, sep string`` | ``[]string`` | Splits the string ``s`` into a slice of strings separated by the ``sep``. |
+| ``trim`` | ``s string`` | ``string`` | Trims the trailing and leading whitespace from the string ``s``. |
+| ``contains`` | ``s, substr string`` | ``bool`` | Tests whether the string ``substr`` is a substring of the string ``s``. |
+| ``hasPrefix`` | ``s, prefix string`` | ``bool`` | Tests whether the string ``prefix`` is a prefix of the string ``s``. |
+| ``hasSuffix`` | ``s, suffix string`` | ``bool`` | Tests whether the string ``suffix`` is a suffix of the string ``s``. |
+| ``toLower`` | ``s string`` | ``bool`` | Converts all letters in the string ``s`` to their lower case. |
+| ``toUpper`` | ``s string`` | ``bool`` | Converts all letters in the string ``s`` to their upper case. |
+| ``replaceAll`` | ``s, old, new string`` | ``string`` | Replaces all occurrences of ``old`` with ``new`` in the string ``s``. |
+{{% /table %}}
+
+Consider the following custom annotation `custom.nginx.org/allowed-ips`, which expects a comma-separated list of IP addresses:
+
+```yaml
+annotations:
+  custom.nginx.org/allowed-ips: "192.168.1.3, 10.0.0.13"
+```
+
+ The helper functions can parse the value of the `custom.nginx.org/allowed-ips` annotation, so that in the template you can use each IP address separately. Consider the following template excerpt:
+
+```jinja2
+{{range $ip := split (index $.Ingress.Annotations "custom.nginx.org/allowed-ips") ","}}
+    allow {{trim $ip}};
+{{end}}
+deny all;
+```
+
+The template excerpt will generate the following configuration:
+
+```
+allow 192.168.1.3;
+allow 10.0.0.13;
+deny all;
+```
+
+## Example
+
+See the [custom annotations example](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/ingress-resources/custom-annotations).
diff --git a/content/includes/nic/configuration/policy-resource.md b/content/includes/nic/configuration/policy-resource.md
new file mode 100644
index 000000000..6ea2c8121
--- /dev/null
+++ b/content/includes/nic/configuration/policy-resource.md
@@ -0,0 +1,945 @@
+---
+title: Policy resources
+weight: 500
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-596
+---
+
+The Policy resource allows you to configure features like access control and rate-limiting, which you can add to your [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/).
+
+The resource is implemented as a [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+This document is the reference documentation for the Policy resource. An example of a Policy for access control is available in our [GitHub repository](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/custom-resources/access-control).
+
+## Prerequisites
+
+Policies work together with [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/), which you need to create separately.
+
+## Policy Specification
+
+Below is an example of a policy that allows access for clients from the subnet `10.0.0.0/8` and denies access for any other clients:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: allow-localhost
+spec:
+  accessControl:
+    allow:
+    - 10.0.0.0/8
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``accessControl`` | The access control policy based on the client IP address. | [accessControl](#accesscontrol) | No |
+|``ingressClassName`` | Specifies which instance of NGINX Ingress Controller must handle the Policy resource. | ``string`` | No |
+|``rateLimit`` | The rate limit policy controls the rate of processing requests per a defined key. | [rateLimit](#ratelimit) | No |
+|``apiKey`` | The API Key policy configures NGINX to authorize requests which provide a valid API Key in a specified header or query param. | [apiKey](#apikey) | No |
+|``basicAuth`` | The basic auth policy configures NGINX to authenticate client requests using HTTP Basic authentication credentials. | [basicAuth](#basicauth) | No |
+|``jwt`` | The JWT policy configures NGINX Plus to authenticate client requests using JSON Web Tokens. | [jwt](#jwt) | No |
+|``ingressMTLS`` | The IngressMTLS policy configures client certificate verification. | [ingressMTLS](#ingressmtls) | No |
+|``egressMTLS`` | The EgressMTLS policy configures upstreams authentication and certificate verification. | [egressMTLS](#egressmtls) | No |
+|``waf`` | The WAF policy configures WAF and log configuration policies for [NGINX AppProtect]({{< relref "installation/integrations/app-protect-waf/configuration.md" >}}) | [WAF](#waf) | No |
+{{% /table %}}
+
+\* A policy must include exactly one policy.
+
+### AccessControl
+
+The access control policy configures NGINX to deny or allow requests from clients with the specified IP addresses/subnets.
+
+For example, the following policy allows access for clients from the subnet `10.0.0.0/8` and denies access for any other clients:
+
+```yaml
+accessControl:
+  allow:
+  - 10.0.0.0/8
+```
+
+In contrast, the policy below does the opposite: denies access for clients from `10.0.0.0/8` and allows access for any other clients:
+
+```yaml
+accessControl:
+  deny:
+  - 10.0.0.0/8
+```
+{{< note >}}
+
+The feature is implemented using the NGINX [ngx_http_access_module](http://nginx.org/en/docs/http/ngx_http_access_module.html). NGINX Ingress Controller access control policy supports either allow or deny rules, but not both (as the module does).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``allow`` | Allows access for the specified networks or addresses. For example, ``192.168.1.1`` or ``10.1.1.0/16``. | ``[]string`` | No |
+|``deny`` | Denies access for the specified networks or addresses. For example, ``192.168.1.1`` or ``10.1.1.0/16``. | ``[]string`` | No | \* an accessControl must include either `allow` or `deny`. |
+{{% /table %}}
+
+#### AccessControl Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple access control policies. For example, here we reference two policies, each with configured allow lists:
+
+```yaml
+policies:
+- name: allow-policy-one
+- name: allow-policy-two
+```
+
+When you reference more than one access control policy, NGINX Ingress Controller will merge the contents into a single allow list or a single deny list.
+
+Referencing both allow and deny policies, as shown in the example below, is not supported. If both allow and deny lists are referenced, NGINX Ingress Controller uses just the allow list policies.
+
+```yaml
+policies:
+- name: deny-policy
+- name: allow-policy-one
+- name: allow-policy-two
+```
+
+### RateLimit
+
+The rate limit policy configures NGINX to limit the processing rate of requests.
+
+For example, the following policy will limit all subsequent requests coming from a single IP address once a rate of 10 requests per second is exceeded:
+
+```yaml
+rateLimit:
+  rate: 10r/s
+  zoneSize: 10M
+  key: ${binary_remote_addr}
+```
+{{< note >}}
+
+The feature is implemented using the NGINX [ngx_http_limit_req_module](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html).
+
+{{< /note >}}
+
+{{< note >}}
+
+When the [Zone Sync feature]({{< ref "/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) is enabled with NGINX Plus, the rate limiting zone will be synchronized across all replicas in the cluster.  This means all replicas are aware of the requests that have been rate limited by other replicas in the cluster.
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``rate`` | The rate of requests permitted. The rate is specified in requests per second (r/s) or requests per minute (r/m). | ``string`` | Yes |
+|``key`` | The key to which the rate limit is applied. Can contain text, variables, or a combination of them. Variables must be surrounded by ``${}``. For example: ``${binary_remote_addr}``. Accepted variables are ``$binary_remote_addr``, ``$request_uri``,``$request_method``, ``$url``, ``$http_``, ``$args``, ``$arg_``, ``$cookie_``, ``$jwt_claim_``. | ``string`` | Yes |
+|``zoneSize`` | Size of the shared memory zone. Only positive values are allowed. Allowed suffixes are ``k`` or ``m``, if none are present ``k`` is assumed. | ``string`` | Yes |
+|``delay`` | The delay parameter specifies a limit at which excessive requests become delayed. If not set all excessive requests are delayed. | ``int`` | No |
+|``noDelay`` | Disables the delaying of excessive requests while requests are being limited. Overrides ``delay`` if both are set. | ``bool`` | No |
+|``burst`` | Excessive requests are delayed until their number exceeds the ``burst`` size, in which case the request is terminated with an error. | ``int`` | No |
+|``dryRun`` | Enables the dry run mode. In this mode, the rate limit is not actually applied, but the number of excessive requests is accounted as usual in the shared memory zone. | ``bool`` | No |
+|``logLevel`` | Sets the desired logging level for cases when the server refuses to process requests due to rate exceeding, or delays request processing. Allowed values are ``info``, ``notice``, ``warn`` or ``error``. Default is ``error``. | ``string`` | No |
+|``rejectCode`` | Sets the status code to return in response to rejected requests. Must fall into the range ``400..599``. Default is ``503``. | ``int`` | No |
+|``scale`` | Enables a constant rate-limit by dividing the configured rate by the number of nginx-ingress pods currently serving traffic. This adjustment ensures that the rate-limit remains consistent, even as the number of nginx-pods fluctuates due to autoscaling. **This will not work properly if requests from a client are not evenly distributed across all ingress pods** (Such as with sticky sessions, long lived TCP Connections with many requests, and so forth). In such cases using [zone-sync]({{< ref "/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) instead would give better results.  Enabling `zone-sync` will suppress this setting. | ``bool`` | No |
+|``condition`` | Add a condition to a rate-limit policy. | [ratelimit.condition](#ratelimitcondition) | No |
+{{% /table %}}
+
+{{< note >}}
+
+For each policy referenced in a VirtualServer and/or its VirtualServerRoutes, NGINX Ingress Controller will generate a single rate limiting zone defined by the [`limit_req_zone`](http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone) directive. If two VirtualServer resources reference the same policy, NGINX Ingress Controller will generate two different rate limiting zones, one zone per VirtualServer.
+
+{{< /note >}}
+
+#### RateLimit Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple rate limit policies. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: rate-limit-policy-one
+- name: rate-limit-policy-two
+```
+
+When you reference more than one rate limit policy, NGINX Ingress Controller will configure NGINX to use all referenced rate limits. When you define multiple policies, each additional policy inherits the `dryRun`, `logLevel`, and `rejectCode` parameters from the first policy referenced (`rate-limit-policy-one`, in the example above).
+
+### RateLimit.Condition
+
+RateLimit.Condition defines a condition for a rate limit policy. For example:
+
+```yaml
+condition:
+  jwt:
+    claim: user_details.level
+    match: premium
+  default: true
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``jwt`` | defines a JWT condition to rate limit against. | [ratelimit.condition.jwt](#ratelimitconditionjwt) | No |
+|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same JWT condition, only one policy can be the default. | ``bool`` | No |
+{{% /table %}}
+
+The rate limit policy with condition is designed to be used in combination with one or more rate limit policies. For example, multiple rate limit policies with [RateLimit.Condition.JWT](#ratelimitconditionjwt) can be used to apply different tiers of rate limit based on the value of a JWT claim. For a practical example of tiered rate limiting by the value of a JWT claim, see the example in our [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/rate-limit-tiered-jwt-claim/README.md).
+
+### RateLimit.Condition.JWT
+{{< note >}}
+
+This feature is only available with NGINX Plus.
+
+{{< /note >}}
+
+RateLimit.Condition.JWT defines a condition for a rate limit by JWT claim. For example, here we define a condition for a rate limit policy that only applies to requests with a JWT claim `user_details.level` with a value `premium`:
+
+```yaml
+jwt:
+  claim: user_details.level
+  match: premium
+```
+
+The rate limit policy will only apply to requests that contain a JWT with the specified claim and value. For example, the following JWT payload will match the JWT condition:
+
+```json
+{
+  "user_details": {
+    "level": "premium"
+  }, 
+  "sub": "client1"
+}
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``claim`` | Claim is the JWT claim to be rate limit by. Nested claims should be separated by ".". | ``string`` | Yes |
+|``match`` | the value of the claim to match against. | ``string`` | Yes |
+{{% /table %}}
+
+### APIKey
+
+The API Key auth policy configures NGINX to authorize client requests based on the presence of a valid API Key in a header or query param specified in the policy.
+
+{{< note >}}
+
+The feature is implemented using NGINX [ngx_http_auth_request_module](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) and [NGINX JavaScript (NJS)](https://nginx.org/en/docs/njs/).
+
+{{< /note >}}
+
+The policies' API keys are securely stored using SHA-256 hashing. When a client sends an API Key, it is hashed by NJS and then compared to the hashed API Key in the NGINX config.
+
+If the hashed keys match, the NGINX JavaScript (NJS) subrequest issues a 204 No Content response to the `auth_request` directive, indicating successful authorization. Conversely, if no API Key is provided in the specified header or query parameter, a 401 Unauthorized response is returned. Similarly, if an invalid key is presented in the expected header or query parameter, a 403 Forbidden response is issued, denying access.
+
+It is possible to use the [errorPages](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#errorpage) property on a route, to change the default behaviour of 401 or 403 errors.
+
+At least one header or query param is required.
+
+The policy below configures NGINX Ingress Controller to require the API Key `password` in the header "my-header".
+
+```yaml
+apiKey:
+    suppliedIn:
+      header:
+      - "my-header"
+    clientSecret: api-key-secret
+```
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: api-key-secret
+type: nginx.org/apikey
+data:
+    client1: cGFzc3dvcmQ= # password
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``suppliedIn`` | `header` or `query`. | | Yes |
+|``suppliedIn.header`` | An array of headers that the API Key may appear in. | ``string[]`` | No |
+|``suppliedIn.query`` | An array of query params that the API Key may appear in. | ``string[]`` | No |
+|``clientSecret`` | The name of the Kubernetes secret that stores the API Key(s). It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/apikey``, and the API Key(s) must be stored in a key: val format where each key is a unique clientID and each value is a unique base64 encoded API Key  | ``string`` | Yes |
+{{% /table %}}
+
+{{<important>}}An APIKey Policy must include a minimum of one of the `suppliedIn.header` or `suppliedIn.query` parameters.  Both can also be supplied.{{</important>}}
+
+#### APIKey Merging Behavior
+
+A VirtualServer or VirtualServerRoute can be associated with only one API Key policy per route or subroute. However, it is possible to replace an API Key policy from a higher-level with a different policy defined on a more specific route.
+
+For example, a VirtualServer can implement different API Key policies at various levels. In the configuration below, the server-wide api-key-policy-server applies to /backend1 for authorization, as it lacks a more specific policy. Meanwhile, /backend2 uses the api-key-policy-route defined at the route level.
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: virtual-server
+spec:
+  host: virtual-server.example.com
+  policies:
+  - name: api-key-policy-server
+  upstreams:
+  - name: backend2
+    service: backend2-svc
+    port: 80
+  - name: backend1
+    service: backend1-svc
+    port: 80
+  routes:
+  - path: /backend1
+    action:
+      pass: backend1
+  - path: /backend2
+    action:
+      pass: backend2
+    policies:
+      - name: api-key-policy-route
+```
+
+### BasicAuth
+
+The basic auth policy configures NGINX to authenticate client requests using the [HTTP Basic authentication scheme](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication).
+
+For example, the following policy will reject all requests that do not include a valid username/password combination in the HTTP header `Authentication`
+
+```yaml
+basicAuth:
+  secret: htpasswd-secret
+  realm: "My API"
+```
+{{< note >}}
+The feature is implemented using the NGINX [ngx_http_auth_basic_module](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html).
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of the Kubernetes secret that stores the Htpasswd configuration. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/htpasswd``, and the config must be stored in the secret under the key ``htpasswd``, otherwise the secret will be rejected as invalid. | ``string`` | Yes |
+|``realm`` | The realm for the basic authentication. | ``string`` | No |
+{{% /table %}}
+
+#### BasicAuth Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple basic auth policies. However, only one can be applied. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: basic-auth-policy-one
+- name: basic-auth-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `basic-auth-policy-one`, and ignores `basic-auth-policy-two`.
+
+### JWT Using Local Kubernetes Secret
+
+{{< note >}}
+
+This feature is only available with NGINX Plus.
+
+{{< /note >}}
+
+The JWT policy configures NGINX Plus to authenticate client requests using JSON Web Tokens.
+
+The following example policy will reject all requests that do not include a valid JWT in the HTTP header `token`:
+
+```yaml
+jwt:
+  secret: jwk-secret
+  realm: "My API"
+  token: $http_token
+```
+
+You can pass the JWT claims and JOSE headers to the upstream servers. For example:
+
+```yaml
+action:
+  proxy:
+    upstream: webapp
+    requestHeaders:
+      set:
+      - name: user
+        value: ${jwt_claim_user}
+      - name: alg
+        value: ${jwt_header_alg}
+```
+
+We use the `requestHeaders` of the [Action.Proxy](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#actionproxy) to set the values of two headers that NGINX will pass to the upstream servers.
+
+The value of the `${jwt_claim_user}` variable is the `user` claim of a JWT. For other claims, use `${jwt_claim_name}`, where `name` is the name of the claim. Note that nested claims and claims that include a period (`.`) are not supported. Similarly, use `${jwt_header_name}` where `name` is the name of a header. In our example, we use the `alg` header.
+
+{{< note >}}
+
+This feature is implemented using the NGINX Plus [ngx_http_auth_jwt_module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of the Kubernetes secret that stores the JWK. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/jwk``, and the JWK must be stored in the secret under the key ``jwk``, otherwise the secret will be rejected as invalid. | ``string`` | Yes |
+|``realm`` | The realm of the JWT. | ``string`` | Yes |
+|``token`` | The token specifies a variable that contains the JSON Web Token. By default the JWT is passed in the ``Authorization`` header as a Bearer Token. JWT may be also passed as a cookie or a part of a query string, for example: ``$cookie_auth_token``. Accepted variables are ``$http_``, ``$arg_``, ``$cookie_``. | ``string`` | No |
+{{% /table %}}
+
+#### JWT Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple JWT policies. However, only one can be applied: every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: jwt-policy-one
+- name: jwt-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `jwt-policy-one`, and ignores `jwt-policy-two`.
+
+### JWT Using JWKS From Remote Location
+
+{{< note >}}
+
+This feature is only available with NGINX Plus.
+
+{{< /note >}}
+
+The JWT policy configures NGINX Plus to authenticate client requests using JSON Web Tokens, allowing import of the keys (JWKS) for JWT policy by means of a URL (for a remote server or an identity provider) as a result they don't have to be copied and updated to the IC pod.
+
+The following example policy will reject all requests that do not include a valid JWT in the HTTP header fetched from the identity provider:
+
+```yaml
+jwt:
+  realm: MyProductAPI
+  token: $http_token
+  jwksURI: <uri_to_remote_server_or_idp>
+  keyCache: 1h
+```
+
+{{< note >}}
+
+This feature is implemented using the NGINX Plus directive [auth_jwt_key_request](http://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html#auth_jwt_key_request) under [ngx_http_auth_jwt_module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``jwksURI`` | The remote URI where the request will be sent to retrieve JSON Web Key set| ``string`` | Yes |
+|``keyCache`` | Enables in-memory caching of JWKS (JSON Web Key Sets) that are obtained from the ``jwksURI`` and sets a valid time for expiration. | ``string`` | Yes |
+|``realm`` | The realm of the JWT. | ``string`` | Yes |
+|``token`` | The token specifies a variable that contains the JSON Web Token. By default the JWT is passed in the ``Authorization`` header as a Bearer Token. JWT may be also passed as a cookie or a part of a query string, for example: ``$cookie_auth_token``. Accepted variables are ``$http_``, ``$arg_``, ``$cookie_``. | ``string`` | No |
+{{% /table %}}
+
+{{< note >}}
+
+Content caching is enabled by default for each JWT policy with a default time of 12 hours.
+
+This is done to ensure to improve resiliency by allowing the JWKS (JSON Web Key Set) to be retrieved from the cache even when it has expired.
+
+{{< /note >}}
+
+#### JWT Merging Behavior
+
+This behavior is similar to using a local Kubernetes secret where a VirtualServer/VirtualServerRoute can reference multiple JWT policies. However, only one can be applied: every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: jwt-policy-one
+- name: jwt-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `jwt-policy-one`, and ignores `jwt-policy-two`.
+
+### IngressMTLS
+
+The IngressMTLS policy configures client certificate verification.
+
+For example, the following policy will verify a client certificate using the CA certificate specified in the `ingress-mtls-secret`:
+
+```yaml
+ingressMTLS:
+  clientCertSecret: ingress-mtls-secret
+  verifyClient: "on"
+  verifyDepth: 1
+```
+
+Below is an example of the `ingress-mtls-secret` using the secret type `nginx.org/ca`
+
+```yaml
+kind: Secret
+metadata:
+  name: ingress-mtls-secret
+apiVersion: v1
+type: nginx.org/ca
+data:
+  ca.crt: <base64encoded-certificate>
+```
+
+A VirtualServer that references an IngressMTLS policy must:
+
+- Enable [TLS termination](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualservertls).
+- Reference the policy in the VirtualServer [`spec`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserver-specification). It is not allowed to reference an IngressMTLS policy in a [`route`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroute) or in a VirtualServerRoute [`subroute`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroutesubroute).
+
+If the conditions above are not met, NGINX will send the `500` status code to clients.
+
+You can pass the client certificate details, including the certificate, to the upstream servers. For example:
+
+```yaml
+action:
+  proxy:
+    upstream: webapp
+    requestHeaders:
+      set:
+      - name: client-cert-subj-dn
+        value: ${ssl_client_s_dn} # subject DN
+      - name: client-cert
+        value: ${ssl_client_escaped_cert} # client certificate in the PEM format (urlencoded)
+```
+
+We use the `requestHeaders` of the [Action.Proxy](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#actionproxy) to set the values of the two headers that NGINX will pass to the upstream servers. See the [list of embedded variables](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables) that are supported by the `ngx_http_ssl_module`, which you can use to pass the client certificate details.
+
+{{< note >}}
+
+ The feature is implemented using the NGINX [ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html).
+
+ {{< /note >}}
+
+#### Using a Certificate Revocation List
+
+The IngressMTLS policy supports configuring at CRL for your policy.
+This can be done in one of two ways.
+
+{{< note >}}
+
+ Only one of these configurations options can be used at a time.
+
+{{< /note >}}
+
+1. Adding the `ca.crl` field to the `nginx.org/ca` secret type, which accepts a base64 encoded certificate revocation list (crl).
+   Example YAML:
+
+```yaml
+kind: Secret
+metadata:
+  name: ingress-mtls-secret
+apiVersion: v1
+type: nginx.org/ca
+data:
+  ca.crt: <base64encoded-certificate>
+  ca.crl: <base64encoded-crl>
+```
+
+2. Adding the `crlFileName` field to your IngressMTLS policy spec with the name of the CRL file.
+
+{{< note >}}
+
+This configuration option should only be used when using a CRL that is larger than 1MiB.
+
+Otherwise we recommend using the `nginx.org/ca` secret type for managing your CRL.
+
+{{< /note >}}
+
+Example YAML:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: ingress-mtls-policy
+spec:
+ingressMTLS:
+    clientCertSecret: ingress-mtls-secret
+    crlFileName: webapp.crl
+    verifyClient: "on"
+    verifyDepth: 1
+```
+
+**IMPORTANT NOTE**
+When configuring a CRL with the `ingressMTLS.crlFileName` field, there is additional context to keep in mind:
+
+1. NGINX Ingress Controller will expect the CRL, in this case `webapp.crl`, will be in `/etc/nginx/secrets`. A volume mount will need to be added to NGINX Ingress Controller deployment add your CRL to `/etc/nginx/secrets`
+2. When updating the content of your CRL (e.g a new certificate has been revoked), NGINX will need to be reloaded to pick up the latest changes. Depending on your environment this may require updating the name of your CRL and applying this update to your `ingress-mtls.yaml` policy to ensure NGINX picks up the latest CRL.
+
+Please refer to the Kubernetes documentation on [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) to find the best implementation for your environment.
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``clientCertSecret`` | The name of the Kubernetes secret that stores the CA certificate. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/ca``, and the certificate must be stored in the secret under the key ``ca.crt``, otherwise the secret will be rejected as invalid. | ``string`` | Yes |
+|``verifyClient`` | Verification for the client. Possible values are ``"on"``, ``"off"``, ``"optional"``, ``"optional_no_ca"``. The default is ``"on"``. | ``string`` | No |
+|``verifyDepth`` | Sets the verification depth in the client certificates chain. The default is ``1``. | ``int`` | No |
+|``crlFileName`` | The file name of the Certificate Revocation List. NGINX Ingress Controller will look for this file in `/etc/nginx/secrets` | ``string`` | No |
+{{% /table %}}
+
+#### IngressMTLS Merging Behavior
+
+A VirtualServer can reference only a single IngressMTLS policy. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: ingress-mtls-policy-one
+- name: ingress-mtls-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `ingress-mtls-policy-one`, and ignores `ingress-mtls-policy-two`.
+
+### EgressMTLS
+
+The EgressMTLS policy configures upstreams authentication and certificate verification.
+
+For example, the following policy will use `egress-mtls-secret` to authenticate with the upstream application and `egress-trusted-ca-secret` to verify the certificate of the application:
+
+```yaml
+egressMTLS:
+  tlsSecret: egress-mtls-secret
+  trustedCertSecret: egress-trusted-ca-secret
+  verifyServer: on
+  verifyDepth: 2
+```
+
+{{< note >}}
+
+The feature is implemented using the NGINX [ngx_http_proxy_module](https://nginx.org/en/docs/http/ngx_http_proxy_module.html).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``tlsSecret`` | The name of the Kubernetes secret that stores the TLS certificate and key. It must be in the same namespace as the Policy resource. The secret must be of the type ``kubernetes.io/tls``, the certificate must be stored in the secret under the key ``tls.crt``, and the key must be stored under the key ``tls.key``, otherwise the secret will be rejected as invalid. | ``string`` | No |
+|``trustedCertSecret`` | The name of the Kubernetes secret that stores the CA certificate. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/ca``, and the certificate must be stored in the secret under the key ``ca.crt``, otherwise the secret will be rejected as invalid. | ``string`` | No |
+|``verifyServer`` | Enables verification of the upstream HTTPS server certificate. | ``bool`` | No |
+|``verifyDepth`` | Sets the verification depth in the proxied HTTPS server certificates chain. The default is ``1``. | ``int`` | No |
+|``sessionReuse`` | Enables reuse of SSL sessions to the upstreams. The default is ``true``. | ``bool`` | No |
+|``serverName`` | Enables passing of the server name through ``Server Name Indication`` extension. | ``bool`` | No |
+|``sslName`` | Allows overriding the server name used to verify the certificate of the upstream HTTPS server. | ``string`` | No |
+|``ciphers`` | Specifies the enabled ciphers for requests to an upstream HTTPS server. The default is ``DEFAULT``. | ``string`` | No |
+|``protocols`` | Specifies the protocols for requests to an upstream HTTPS server. The default is ``TLSv1 TLSv1.1 TLSv1.2``. | ``string`` | No | > Note: the value of ``ciphers`` and ``protocols`` is not validated by NGINX Ingress Controller. As a result, NGINX can fail to reload the configuration. To ensure that the configuration for a VirtualServer/VirtualServerRoute that references the policy was successfully applied, check its [status](/nginx-ingress-controller/configuration/global-configuration/reporting-resources-status/#virtualserver-and-virtualserverroute-resources). The validation will be added in the future releases. |
+{{% /table %}}
+
+#### EgressMTLS Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple EgressMTLS policies. However, only one can be applied. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: egress-mtls-policy-one
+- name: egress-mtls-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `egress-mtls-policy-one`, and ignores `egress-mtls-policy-two`.
+
+### OIDC
+
+{{< tip >}}
+
+This feature is disabled by default. To enable it, set the [enable-oidc]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-oidc" >}}) command-line argument of NGINX Ingress Controller.
+
+{{< /tip >}}
+
+The OIDC policy configures NGINX Plus as a relying party for OpenID Connect authentication.
+
+For example, the following policy will use the client ID `nginx-plus` and the client secret `oidc-secret` to authenticate with the OpenID Connect provider `https://idp.example.com`:
+
+```yaml
+spec:
+  oidc:
+    clientID: nginx-plus
+    clientSecret: oidc-secret
+    authEndpoint: https://idp.example.com/openid-connect/auth
+    tokenEndpoint: https://idp.example.com/openid-connect/token
+    jwksURI: https://idp.example.com/openid-connect/certs
+    endSessionEndpoint: https://idp.example.com/openid-connect/logout
+    postLogoutRedirectURI: /
+    accessTokenEnable: true
+```
+
+NGINX Plus will pass the ID of an authenticated user to the backend in the HTTP header `username`.
+
+{{< note >}}
+
+The feature is implemented using the [reference implementation](https://github.com/nginxinc/nginx-openid-connect/) of NGINX Plus as a relying party for OpenID Connect authentication.
+
+{{< /note >}}
+
+#### Prerequisites
+
+In order to use OIDC, you need to enable [zone synchronization](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync/). If you don't set up zone synchronization, NGINX Plus will fail to reload.
+You also need to configure a resolver, which NGINX Plus will use to resolve the IDP authorization endpoint. You can find an example configuration [in our GitHub repository](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/custom-resources/oidc#step-7---configure-nginx-plus-zone-synchronization-and-resolver).
+
+{{< warning >}}
+
+The configuration in the example doesn't enable TLS and the synchronization between the replica happens in clear text. This could lead to the exposure of tokens.
+
+{{< /warning >}}
+
+#### Limitations
+
+The OIDC policy defines a few internal locations that can't be customized: `/_jwks_uri`, `/_token`, `/_refresh`, `/_id_token_validation`, `/logout`. In addition, as explained below, `/_codexch` is the default value for redirect URI, and `/_logout` is the default value for post logout redirect URI, both of which can be customized. Specifying one of these locations as a route in the VirtualServer or VirtualServerRoute will result in a collision and NGINX Plus will fail to reload.
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``clientID`` | The client ID provided by your OpenID Connect provider. | ``string`` | Yes |
+|``clientSecret`` | The name of the Kubernetes secret that stores the client secret provided by your OpenID Connect provider. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/oidc``, and the secret under the key ``client-secret``, otherwise the secret will be rejected as invalid. | ``string`` | Yes |
+|``authEndpoint`` | URL for the authorization endpoint provided by your OpenID Connect provider. | ``string`` | Yes |
+|``authExtraArgs`` | A list of extra URL arguments to pass to the authorization endpoint provided by your OpenID Connect provider. Arguments must be URL encoded, multiple arguments may be included in the list, for example ``[ arg1=value1, arg2=value2 ]`` | ``string[]`` | No |
+|``tokenEndpoint`` | URL for the token endpoint provided by your OpenID Connect provider. | ``string`` | Yes |
+|``endSessionEndpoint`` | URL provided by your OpenID Connect provider to request the end user be logged out. | ``string`` | No |
+|``jwksURI`` | URL for the JSON Web Key Set (JWK) document provided by your OpenID Connect provider. | ``string`` | Yes |
+|``scope`` | List of OpenID Connect scopes. The scope ``openid`` always needs to be present and others can be added concatenating them with a ``+`` sign, for example ``openid+profile+email``, ``openid+email+userDefinedScope``. The default is ``openid``. | ``string`` | No |
+|``redirectURI`` | Allows overriding the default redirect URI. The default is ``/_codexch``. | ``string`` | No |
+|``postLogoutRedirectURI`` | URI to redirect to after the logout has been performed. Requires ``endSessionEndpoint``. The default is ``/_logout``. | ``string`` | No |
+|``zoneSyncLeeway`` | Specifies the maximum timeout in milliseconds for synchronizing ID/access tokens and shared values between Ingress Controller pods. The default is ``200``. | ``int`` | No |
+|``accessTokenEnable`` | Option of whether Bearer token is used to authorize NGINX to access protected backend. | ``boolean`` | No |
+{{% /table %}}
+
+{{< note >}}
+
+Only one OIDC policy can be referenced in a VirtualServer and its VirtualServerRoutes. However, the same policy can still be applied to different routes in the VirtualServer and VirtualServerRoutes.
+
+{{< /note >}}
+
+#### OIDC Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference only a single OIDC policy. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: oidc-policy-one
+- name: oidc-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `oidc-policy-one`, and ignores `oidc-policy-two`.
+
+## Using Policy
+
+You can use the usual `kubectl` commands to work with Policy resources, just as with built-in Kubernetes resources.
+
+For example, the following command creates a Policy resource defined in `access-control-policy-allow.yaml` with the name `webapp-policy`:
+
+```shell
+kubectl apply -f access-control-policy-allow.yaml
+
+policy.k8s.nginx.org/webapp-policy configured
+```
+
+You can get the resource by running:
+
+```shell
+kubectl get policy webapp-policy
+
+NAME            AGE
+webapp-policy   27m
+```
+
+For `kubectl get` and similar commands, you can also use the short name `pol` instead of `policy`.
+
+### WAF {#waf}
+
+{{< note >}} The feature is implemented using the NGINX Plus [NGINX App Protect WAF Module](https://docs.nginx.com/nginx-app-protect/configuration/). {{< /note >}}
+
+The WAF policy configures NGINX Plus to secure client requests using App Protect WAF policies.
+
+For example, the following policy will enable the referenced APPolicy. You can configure multiple APLogConfs with log destinations:
+
+```yaml
+waf:
+  enable: true
+  apPolicy: "default/dataguard-alarm"
+  securityLogs:
+  - enable: true
+    apLogConf: "default/logconf"
+    logDest: "syslog:server=syslog-svc.default:514"
+  - enable: true
+    apLogConf: "default/logconf"
+    logDest: "syslog:server=syslog-svc-secondary.default:514"
+```
+
+{{< note >}} The field `waf.securityLog` is deprecated and will be removed in future releases.It will be ignored if `waf.securityLogs` is populated. {{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables NGINX App Protect WAF. | ``bool`` | Yes |
+|``apPolicy`` | The [App Protect WAF policy]({{< relref "installation/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. Accepts an optional namespace. Mutually exclusive with ``apBundle``. | ``string`` | No |
+|``apBundle`` | The [App Protect WAF policy bundle]({{< relref "installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}). Mutually exclusive with ``apPolicy``. | ``string`` | No |
+|``securityLog.enable`` | Enables security log. | ``bool`` | No |
+|``securityLog.apLogConf`` | The [App Protect WAF log conf]({{< relref "installation/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. Accepts an optional namespace. Only works with ``apPolicy``. | ``string`` | No |
+|``securityLog.apLogBundle`` | The [App Protect WAF log bundle]({{< relref "installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) resource. Only works with ``apBundle``. | ``string`` | No |
+|``securityLog.logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=<ip-address &#124; localhost; fqdn>:<port>``, ``stderr``, ``<absolute path to file>``. | ``string`` | No |
+{{% /table %}}
+
+#### WAF Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple WAF policies. However, only one can be applied. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: waf-policy-one
+- name: waf-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `waf-policy-one`, and ignores `waf-policy-two`.
+
+### Applying Policies
+
+You can apply policies to both VirtualServer and VirtualServerRoute resources. For example:
+
+- VirtualServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: VirtualServer
+    metadata:
+      name: cafe
+      namespace: cafe
+    spec:
+      host: cafe.example.com
+      tls:
+        secret: cafe-secret
+      policies: # spec policies
+      - name: policy1
+      upstreams:
+      - name: coffee
+        service: coffee-svc
+        port: 80
+      routes:
+      - path: /tea
+        policies: # route policies
+        - name: policy2
+          namespace: cafe
+        route: tea/tea
+      - path: /coffee
+        policies: # route policies
+        - name: policy3
+          namespace: cafe
+        action:
+          pass: coffee
+      ```
+
+      For VirtualServer, you can apply a policy:
+  * to all routes (spec policies)
+  * to a specific route (route policies)
+
+      Route policies of the *same type* override spec policies. In the example above, if the type of the policies `policy-1` and `policy-3` is `accessControl`, then for requests to `cafe.example.com/coffee`, NGINX will apply `policy-3`.
+
+      The overriding is enforced by NGINX: the spec policies are implemented in the `server` context of the config, and the route policies are implemented in the `location` context. As a result, the route policies of the same type win.
+
+- VirtualServerRoute, which is referenced by the VirtualServer above:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: VirtualServerRoute
+    metadata:
+      name: tea
+      namespace: tea
+    spec:
+      host: cafe.example.com
+      upstreams:
+      - name: tea
+        service: tea-svc
+        port: 80
+      subroutes: # subroute policies
+      - path: /tea
+        policies:
+        - name: policy4
+          namespace: tea
+        action:
+          pass: tea
+    ```
+
+    For VirtualServerRoute, you can apply a policy to a subroute (subroute policies).
+
+    Subroute policies of the same type override spec policies. In the example above, if the type of the policies `policy-1` (in the VirtualServer) and `policy-4` is `accessControl`, then for requests to `cafe.example.com/tea`, NGINX will apply `policy-4`. As with the VirtualServer, the overriding is enforced by NGINX.
+
+    Subroute policies always override route policies no matter the types. For example, the policy `policy-2` in the VirtualServer route will be ignored for the subroute `/tea`, because the subroute has its own policies (in our case, only one policy `policy4`). If the subroute didn't have any policies, then the `policy-2` would be applied. This overriding is enforced by NGINX Ingress Controller -- the `location` context for the subroute will either have route policies or subroute policies, but not both.
+
+### Invalid Policies
+
+NGINX will treat a policy as invalid if one of the following conditions is met:
+
+- The policy doesn't pass the [comprehensive validation](#comprehensive-validation).
+- The policy isn't present in the cluster.
+- The policy doesn't meet its type-specific requirements. For example, an `ingressMTLS` policy requires TLS termination enabled in the VirtualServer.
+
+For an invalid policy, NGINX returns the 500 status code for client requests with the following rules:
+
+- If a policy is referenced in a VirtualServer `route` or a VirtualServerRoute `subroute`, then NGINX will return the 500 status code for requests for the URIs of that route/subroute.
+- If a policy is referenced in the VirtualServer `spec`, then NGINX will return the 500 status code for requests for all URIs of that VirtualServer.
+
+If a policy is invalid, the VirtualServer or VirtualServerRoute will have the [status](/nginx-ingress-controller/configuration/global-configuration/reporting-resources-status#virtualserver-and-virtualserverroute-resources) with the state `Warning` and the message explaining why the policy wasn't considered invalid.
+
+### Validation
+
+Two types of validation are available for the Policy resource:
+
+- *Structural validation*, done by `kubectl` and the Kubernetes API server.
+- *Comprehensive validation*, done by NGINX Ingress Controller.
+
+#### Structural Validation
+
+The custom resource definition for the Policy includes a structural OpenAPI schema, which describes the type of every field of the resource.
+
+If you try to create (or update) a resource that violates the structural schema -- for example, the resource uses a string value instead of an array of strings in the `allow` field -- `kubectl` and the Kubernetes API server will reject the resource.
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f access-control-policy-allow.yaml
+
+    error: error validating "access-control-policy-allow.yaml": error validating data: ValidationError(Policy.spec.accessControl.allow): invalid type for org.nginx.k8s.v1.Policy.spec.accessControl.allow: got "string", expected "array"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f access-control-policy-allow.yaml --validate=false
+
+    The Policy "webapp-policy" is invalid: spec.accessControl.allow: Invalid value: "string": spec.accessControl.allow in body must be of type array: "string"
+    ```
+
+If a resource passes structural validation, then NGINX Ingress Controller's comprehensive validation runs.
+
+#### Comprehensive Validation
+
+NGINX Ingress Controller validates the fields of a Policy resource. If a resource is invalid, NGINX Ingress Controller will reject it. The resource will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can use `kubectl` to check whether or not NGINX Ingress Controller successfully applied a Policy configuration. For our example `webapp-policy` Policy, we can run:
+
+```shell
+kubectl describe pol webapp-policy
+
+. . .
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  11s   nginx-ingress-controller  Policy default/webapp-policy was added or updated
+```
+
+Note how the events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid resource, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create a Policy `webapp-policy` with an invalid IP `10.0.0.` in the `allow` field, you will get:
+
+```shell
+kubectl describe policy webapp-policy
+
+. . .
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  7s    nginx-ingress-controller  Policy default/webapp-policy is invalid and was rejected: spec.accessControl.allow[0]: Invalid value: "10.0.0.": must be a CIDR or IP
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+Additionally, this information is also available in the `status` field of the Policy resource. Note the Status section of the Policy:
+
+```shell
+kubectl describe pol webapp-policy
+
+. . .
+Status:
+  Message:  Policy default/webapp-policy is invalid and was rejected: spec.accessControl.allow[0]: Invalid value: "10.0.0.": must be a CIDR or IP
+  Reason:   Rejected
+  State:    Invalid
+```
+
+**Note**: If you make an existing resource invalid, NGINX Ingress Controller will reject it.
diff --git a/content/includes/nic/configuration/security.md b/content/includes/nic/configuration/security.md
new file mode 100644
index 000000000..ae2f9648f
--- /dev/null
+++ b/content/includes/nic/configuration/security.md
@@ -0,0 +1,102 @@
+---
+docs: DOCS-597
+doctypes:
+- ''
+title: Security recommendations
+toc: true
+weight: 300
+---
+
+F5 NGINX Ingress Controller follows Kubernetes best practices: this page outlines configuration specific to NGINX Ingress Controller you may require, including links to examples in the [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples).
+
+For general guidance, we recommend the official Kubernetes documentation for [Securing a Cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/).
+
+## Kubernetes recommendations
+
+### RBAC and Service Accounts
+
+Kubernetes uses [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) to control the resources and operations available to different types of users.
+
+NGINX Ingress Controller requires RBAC to configure a [ServiceUser](https://kubernetes.io/docs/concepts/security/service-accounts/#default-service-accounts), and provides least privilege access in its standard deployment configurations:
+
+- [Helm](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/deployments/rbac/rbac.yaml)
+- [Manifests](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/deployments/rbac/rbac.yaml)
+
+By default, the ServiceAccount has access to all Secret resources in the cluster.
+
+### Secrets
+
+[Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) are required by NGINX Ingress Controller for certificates and privacy keys, which Kubernetes stores unencrypted by default. We recommend following the [Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) to store these Secrets using at-rest encryption.
+
+
+## NGINX Ingress Controller recommendations
+
+### Configure root filesystem as read-only
+
+{{< caution >}}
+ This feature is compatible with [NGINX App Protect WAFv5](https://docs.nginx.com/nginx-app-protect-waf/v5/). It is not compatible with [NGINX App Protect WAFv4](https://docs.nginx.com/nginx-app-protect-waf/v4/) or [NGINX App Protect DoS](https://docs.nginx.com/nginx-app-protect-dos/).
+{{< /caution >}}
+
+NGINX Ingress Controller is designed to be resilient against attacks in various ways, such as running the service as non-root to avoid changes to files. We recommend setting filesystems on all containers to read-only, this includes `nginx-ingress-controller`, though also includes `waf-enforcer` and `waf-config-mgr` when NGINX App Protect WAFv5 is in use.  This is so that the attack surface is further reduced by limiting changes to binaries and libraries.
+
+This is not enabled by default, but can be enabled with **Helm** using the [**readOnlyRootFilesystem**]({{< relref "installation/installing-nic/installation-with-helm.md#configuration" >}}) argument in security contexts on all containers: `nginx-ingress-controller`, `waf_enforcer` and `waf_config_mgr`.
+
+For **Manifests**, uncomment the following sections of the deployment and add sections for `waf-enforcer` and `waf-config-mgr` containers:
+
+- `readOnlyRootFilesystem: true`
+- The entire **volumeMounts** section
+- The entire **initContainers** section
+
+The block below shows the code you will look for:
+
+```yaml
+#      volumes:
+#      - name: nginx-etc
+#        emptyDir: {}
+#      - name: nginx-cache
+#        emptyDir: {}
+#      - name: nginx-lib
+#        emptyDir: {}
+#      - name: nginx-log
+#        emptyDir: {}
+.
+.
+.
+#          readOnlyRootFilesystem: true
+.
+.
+.
+#        volumeMounts:
+#        - mountPath: /etc/nginx
+#          name: nginx-etc
+#        - mountPath: /var/cache/nginx
+#          name: nginx-cache
+#        - mountPath: /var/lib/nginx
+#          name: nginx-lib
+#        - mountPath: /var/log/nginx
+#          name: nginx-log
+```
+
+- Add **waf-enforcer** and **waf-config-mgr** container sections
+- Add `readOnlyFilesystem: true` in both containers security context sections
+
+### Prometheus
+
+If Prometheus metrics are [enabled]({{< relref "/logging-and-monitoring/prometheus.md" >}}), we recommend [using HTTPS]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-prometheus-tls-secret" >}}).
+
+### Snippets
+
+Snippets allow raw NGINX configuration to be inserted into resources. They are intended for advanced NGINX users and could create vulnerabilities in a cluster if misused.
+
+Snippets are disabled by default. To use snippets, set the [**enable-snippets**]({{< relref"configuration/global-configuration/command-line-arguments.md#cmdoption-enable-snippets" >}}) command-line argument.
+
+{{< caution >}}
+ Snippets are **always** enabled for ConfigMap.
+{{< /caution >}}
+
+For more information, read the following:
+
+- [Advanced configuration using Snippets]({{< relref "/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}})
+- [Using Snippets with VirtualServer/VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#using-snippets" >}})
+- [Using Snippets with TransportServer]({{< relref "/configuration/transportserver-resource.md#using-snippets" >}})
+- [ConfigMap snippets and custom templates]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}})
diff --git a/content/includes/nic/configuration/transportserver-resource.md b/content/includes/nic/configuration/transportserver-resource.md
new file mode 100644
index 000000000..b725ea2e6
--- /dev/null
+++ b/content/includes/nic/configuration/transportserver-resource.md
@@ -0,0 +1,416 @@
+---
+title: TransportServer resources
+toc: true
+weight: 600
+docs: DOCS-598
+---
+
+This document is reference material for the TransportServer resource used by F5 NGINX Ingress Controller.
+
+The TransportServer resource allows you to configure TCP, UDP, and TLS Passthrough load balancing. The resource is implemented as a [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+The GitHub repository has [examples of the resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources) for specific use cases.
+
+## Prerequisites
+
+- For TCP and UDP, the TransportServer resource must be used in conjunction with the [GlobalConfiguration resource]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}), which must be created separately.
+- For TLS Passthrough, make sure to enable the [`-enable-tls-passthrough`]({{< ref "/nic/configuration/global-configuration/command-line-arguments#cmdoption-enable-tls-passthrough.md" >}}) command-line argument of NGINX Ingress Controller.
+
+## TransportServer Specification
+
+The TransportServer resource defines load balancing configuration for TCP, UDP, or TLS Passthrough traffic. Below are a few examples:
+
+- TCP load balancing:
+
+  ```yaml
+  apiVersion: k8s.nginx.org/v1
+  kind: TransportServer
+  metadata:
+    name: dns-tcp
+  spec:
+    host: dns.example.com
+    listener:
+      name: dns-tcp
+      protocol: TCP
+    tls:
+      secret: cafe-secret
+    upstreams:
+    - name: dns-app
+      service: dns-service
+      port: 5353
+    action:
+      pass: dns-app
+  ```
+
+- UDP load balancing:
+
+  ```yaml
+  apiVersion: k8s.nginx.org/v1
+  kind: TransportServer
+  metadata:
+    name: dns-udp
+  spec:
+    listener:
+      name: dns-udp
+      protocol: UDP
+    upstreams:
+    - name: dns-app
+      service: dns-service
+      port: 5353
+    upstreamParameters:
+      udpRequests: 1
+      udpResponses: 1
+    action:
+      pass: dns-app
+  ```
+
+- TLS passthrough load balancing:
+
+  ```yaml
+  apiVersion: k8s.nginx.org/v1
+  kind: TransportServer
+  metadata:
+    name: secure-app
+  spec:
+    listener:
+      name: tls-passthrough
+      protocol: TLS_PASSTHROUGH
+    host: app.example.com
+    upstreams:
+    - name: secure-app
+      service: secure-app
+      port: 8443
+    action:
+      pass: secure-app
+  ```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``listener`` | The listener on NGINX that will accept incoming connections/datagrams. | [listener](#listener) | Yes |
+|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. Wildcard domains like ``*.example.com`` are not allowed. When specified, NGINX will use this host for SNI-based routing. For TLS Passthrough, this field is required. For TCP with TLS termination, specifying the host enables SNI routing and requires specifying a TLS secret.| ``string`` | No |
+|``tls`` | The TLS termination configuration. Not supported for TLS Passthrough load balancing. | [tls](#tls) | No |
+|``upstreams`` | A list of upstreams. | [[]upstream](#upstream) | Yes |
+|``upstreamParameters`` | The upstream parameters. | [upstreamParameters](#upstreamparameters) | No |
+|``action`` | The action to perform for a client connection/datagram. | [action](#action) | Yes |
+|``ingressClassName`` | Specifies which Ingress Controller must handle the TransportServer resource. | ``string`` | No |
+|``streamSnippets`` | Sets a custom snippet in the ``stream`` context. | ``string`` | No |
+|``serverSnippets`` | Sets a custom snippet in the ``server`` context. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- Required for TLS Passthrough load balancing.
+
+### Listener
+
+The listener field references a listener that NGINX will use to accept incoming traffic for the TransportServer. For TCP and UDP, the listener must be defined in the [GlobalConfiguration resource]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}). When referencing a listener, both the name and the protocol must match. For TLS Passthrough, use the built-in listener with the name `tls-passthrough` and the protocol `TLS_PASSTHROUGH`.
+
+The combination of ``spec.listener.name`` and ``spec.host`` must be unique among all TransportServers. If two TransportServers specify the same combination of ``spec.listener.name`` and ``spec.host``, one of them will be rejected to prevent conflicts. In the case where no host is specified, it is considered an empty string.
+
+An example:
+
+```yaml
+listener:
+  name: dns-udp
+  protocol: UDP
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the listener. | ``string`` | Yes |
+|``protocol`` | The protocol of the listener. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### TLS
+
+The tls field defines TLS configuration for a TransportServer. When using TLS termination (not TLS Passthrough), you can specify the host field to enable SNI-based routing, allowing multiple applications to share the same listener port and be distinguished by the TLS SNI hostname. Each application can use its own TLS certificate and key specified via the secret field.
+
+```yaml
+secret: cafe-secret
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of a secret with a TLS certificate and key. The secret must belong to the same namespace as the TransportServer. The secret must be of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that contain the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Upstream
+
+The upstream defines a destination for the TransportServer. For example:
+
+```yaml
+name: secure-app
+service: secure-app
+port: 8443
+maxFails: 3
+maxConns: 100
+failTimeout: 30s
+loadBalancingMethod: least_conn
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the upstream. Must be a valid DNS label as defined in RFC 1035. For example, ``hello`` and ``upstream-123`` are valid. The name must be unique among all upstreams of the resource. | ``string`` | Yes |
+|``service`` | The name of a [service](https://kubernetes.io/docs/concepts/services-networking/service/). The service must belong to the same namespace as the resource. If the service doesn't exist, NGINX will assume the service has zero endpoints and close client connections/ignore datagrams. | ``string`` | Yes |
+|``port`` | The port of the service. If the service doesn't define that port, NGINX will assume the service has zero endpoints and close client connections/ignore datagrams. The port must fall into the range ``1..65535``. | ``int`` | Yes |
+|``maxFails`` | Sets the [number](https://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#max_fails) of unsuccessful attempts to communicate with the server that should happen in the duration set by the failTimeout parameter to consider the server unavailable. The default ``1``. | ``int`` | No |
+|``maxConns`` | Sets the [number](https://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#max_conns) of maximum connections to the proxied server. Default value is zero, meaning there is no limit. The default is ``0``. | ``int`` | No |
+|``failTimeout`` | Sets the [time](https://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#fail_timeout) during which the specified number of unsuccessful attempts to communicate with the server should happen to consider the server unavailable and the period of time the server will be considered unavailable. The default is ``10s``. | ``string`` | No |
+|``healthCheck`` | The health check configuration for the Upstream. See the [health_check](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html#health_check) directive. Note: this feature is supported only in NGINX Plus. | [healthcheck](#upstreamhealthcheck) | No |
+|``loadBalancingMethod`` | The method used to load balance the upstream servers. By default, connections are distributed between the servers using a weighted round-robin balancing method. See the [upstream](http://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#upstream) section for available methods and their details. | ``string`` | No |
+|``backup`` | The name of the backup service of type [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname). This will be used when the primary servers are unavailable. Note: The parameter cannot be used along with the ``random`` , ``hash`` or ``ip_hash`` load balancing methods. | ``string`` | No |
+|``backupPort`` | The port of the backup service. The backup port is required if the backup service name is provided. The port must fall into the range ``1..65535``. | ``uint16`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Healthcheck
+
+The Healthcheck defines an [active health check](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html?#health_check). In the example below we enable a health check for an upstream and configure all the available parameters:
+
+```yaml
+name: secure-app
+service: secure-app
+port: 8443
+healthCheck:
+  enable: true
+  interval: 20s
+  timeout: 30s
+  jitter: 3s
+  fails: 5
+  passes: 5
+  port: 8080
+```
+
+{{< note >}} This feature is only supported with NGINX Plus. {{< /note >}}
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables a health check for an upstream server. The default is ``false``. | ``boolean`` | No |
+|``interval`` | The interval between two consecutive health checks. The default is ``5s``. | ``string`` | No |
+|``timeout`` | This overrides the timeout set by [proxy_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout) which is set in `SessionParameters` for health checks. The default value is ``5s``. | ``string`` | No |
+|``jitter`` | The time within which each health check will be randomly delayed. By default, there is no delay. | ``string`` | No |
+|``fails`` | The number of consecutive failed health checks of a particular upstream server after which this server will be considered unhealthy. The default is ``1``. | ``integer`` | No |
+|``passes`` | The number of consecutive passed health checks of a particular upstream server after which the server will be considered healthy. The default is ``1``. | ``integer`` | No |
+|``port`` | The port used for health check requests. By default, the [server port is used](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html#health_check_port). Note: in contrast with the port of the upstream, this port is not a service port, but a port of a pod. | ``integer`` | No |
+|``match`` | Controls the data to send and the response to expect for the healthcheck. | [match](#upstreamhealthcheckmatch) | No |
+{{</bootstrap-table>}}
+
+### Upstream.Healthcheck.Match
+
+The match controls the data to send and the response to expect for the healthcheck:
+
+```yaml
+match:
+  send: 'GET / HTTP/1.0\r\nHost: localhost\r\n\r\n'
+  expect: "~200 OK"
+```
+
+Both `send` and `expect` fields can contain hexadecimal literals with the prefix `\x` followed by two hex digits, for example, `\x80`.
+
+See the [match](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html#match) directive for details.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``send`` | A string to send to an upstream server. | ``string`` | No |
+|``expect`` | A literal string or a regular expression that the data obtained from the server should match. The regular expression is specified with the preceding ``~*`` modifier (for case-insensitive matching), or the ``~`` modifier (for case-sensitive matching). NGINX Ingress Controller validates a regular expression using the RE2 syntax. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### UpstreamParameters
+
+The upstream parameters define various parameters for the upstreams:
+
+```yaml
+upstreamParameters:
+  udpRequests: 1
+  udpResponses: 1
+  connectTimeout: 60s
+  nextUpstream: true
+  nextUpstreamTimeout: 50s
+  nextUpstreamTries: 1
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``udpRequests`` | The number of datagrams, after receiving which, the next datagram from the same client starts a new session. See the [proxy_requests](https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_requests) directive. The default is ``0``. | ``int`` | No |
+|``udpResponses`` | The number of datagrams expected from the proxied server in response to a client datagram. See the [proxy_responses](https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_responses) directive. By default, the number of datagrams is not limited. | ``int`` | No |
+|``connectTimeout`` | The timeout for establishing a connection with a proxied server. See the [proxy_connect_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_connect_timeout) directive. The default is ``60s``. | ``string`` | No |
+|``nextUpstream`` | If a connection to the proxied server cannot be established, determines whether a client connection will be passed to the next server. See the [proxy_next_upstream](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_next_upstream) directive. The default is ``true``. | bool | No |
+|``nextUpstreamTries`` | The number of tries for passing a connection to the next server. See the [proxy_next_upstream_tries](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_next_upstream_tries) directive. The default is ``0``. | ``int`` | No |
+|``nextUpstreamTimeout`` | The time allowed to pass a connection to the next server. See the [proxy_next_upstream_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_next_upstream_timeout) directive. The default us ``0``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### SessionParameters
+
+The session parameters define various parameters for TCP connections and UDP sessions.
+
+```yaml
+sessionParameters:
+  timeout: 50s
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``timeout`` | The timeout between two successive read or write operations on client or proxied server connections. See [proxy_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout) directive. The default is ``10m``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Action
+
+The action defines an action to perform for a client connection/datagram.
+
+In the example below, client connections/datagrams are passed to an upstream `dns-app`:
+
+```yaml
+action:
+  pass: dns-app
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``pass`` | Passes connections/datagrams to an upstream. The upstream with that name must be defined in the resource. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+## Using TransportServer
+
+You can use the usual `kubectl` commands to work with TransportServer resources, similar to Ingress resources.
+
+For example, the following command creates a TransportServer resource defined in `transport-server-passthrough.yaml` with the name `secure-app`:
+
+```shell
+kubectl apply -f transport-server-passthrough.yaml
+```
+```text
+transportserver.k8s.nginx.org/secure-app created
+```
+
+You can get the resource by running:
+
+```shell
+kubectl get transportserver secure-app
+```
+```text
+NAME         AGE
+secure-app   46sm
+```
+
+In the kubectl get and similar commands, you can also use the short name `ts` instead of `transportserver`.
+
+### Using Snippets
+
+Snippets allow you to insert raw NGINX config into different contexts of NGINX configuration. In the example below, we use snippets to configure [access control](http://nginx.org/en/docs/stream/ngx_stream_access_module.html) in a TransportServer:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: TransportServer
+metadata:
+  name: cafe
+spec:
+  host: cafe.example.com
+  serverSnippets: |
+    deny  192.168.1.1;
+    allow 192.168.1.0/24;
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+```
+
+Snippets can also be specified for a stream. In the example below, we use snippets to [limit the number of connections](https://nginx.org/en/docs/stream/ngx_stream_limit_conn_module.html):
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: TransportServer
+metadata:
+  name: cafe
+spec:
+  host: cafe.example.com
+  streamSnippets: limit_conn_zone $binary_remote_addr zone=addr:10m;
+  serverSnippets: limit_conn addr 1;
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+```
+
+{{< note >}} To configure snippets in the `stream` context, use `stream-snippets` ConfigMap key. {{< /note >}}
+
+For additional information, view the [Advanced configuration with Snippets]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) topic.
+
+### Validation
+
+Two types of validation are available for the TransportServer resource:
+
+- *Structural validation* by the `kubectl` and Kubernetes API server.
+- *Comprehensive validation* by NGINX Ingress Controller.
+
+#### Structural Validation
+
+The custom resource definition for the TransportServer includes structural OpenAPI schema which describes the type of every field of the resource.
+
+If you try to create (or update) a resource that violates the structural schema (for example, you use a string value for the port field of an upstream), `kubectl` and Kubernetes API server will reject such a resource:
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f transport-server-passthrough.yaml
+    ```
+    ```text
+    error: error validating "transport-server-passthrough.yaml": error validating data: ValidationError(TransportServer.spec.upstreams[0].port): invalid type for org.nginx.k8s.v1.TransportServer.spec.upstreams.port: got "string", expected "integer"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f transport-server-passthrough.yaml --validate=false
+    ```
+    ```text
+    The TransportServer "secure-app" is invalid: []: Invalid value: map[string]interface {}{ ... }: validation failure list:
+    spec.upstreams.port in body must be of type integer: "string"
+    ```
+
+If a resource is not rejected (it doesn't violate the structural schema), NGINX Ingress Controller will validate it further.
+
+#### Comprehensive Validation
+
+NGINX Ingress Controller validates the fields of a TransportServer resource. If a resource is invalid, NGINX Ingress Controller will reject it: the resource will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can check if NGINX Ingress Controller successfully applied the configuration for a TransportServer. For our example `secure-app` TransportServer, we can run:
+
+```shell
+kubectl describe ts secure-app
+```
+```text
+...
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  3s    nginx-ingress-controller  Configuration for default/secure-app was added or updated
+```
+
+Note how the events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid resource, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create a TransportServer `secure-app` with a pass action that references a non-existing upstream, you will get  :
+
+```shell
+kubectl describe ts secure-app
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  2s    nginx-ingress-controller  TransportServer default/secure-app is invalid and was rejected: spec.action.pass: Not found: "some-app"
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+**Note**: If you make an existing resource invalid, NGINX Ingress Controller will reject it and remove the corresponding configuration from NGINX.
+
+## Customization via ConfigMap
+
+The [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) keys (except for `stream-snippets`, `stream-log-format`, `resolver-addresses`, `resolver-ipv6`, `resolver-valid` and `resolver-timeout`) do not affect TransportServer resources.
diff --git a/content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md b/content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md
new file mode 100644
index 000000000..1acd05b02
--- /dev/null
+++ b/content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md
@@ -0,0 +1,1101 @@
+---
+title: VirtualServer and VirtualServerRoute resources
+toc: true
+weight: 700
+docs: DOCS-599
+---
+
+This document is reference material for the VirtualServer and VirtualServerRoute resources used by F5 NGINX Ingress Controller.
+
+VirtualServer and VirtualServerRoute resources are load balancing configurations recommended as an alternative to the Ingress resource.
+
+They enable use cases not supported with the Ingress resource, such as traffic splitting and advanced content-based routing. The resources are implemented as [Custom Resources](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+The GitHub repository has [examples of the resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources) for specific use cases.
+
+---
+
+## VirtualServer specification
+
+The VirtualServer resource defines load balancing configuration for a domain name, such as `example.com`. Below is an example of such configuration:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+spec:
+  host: cafe.example.com
+  listener:
+    http: http-8083
+    https: https-8443
+  tls:
+    secret: cafe-secret
+  gunzip: on
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+  - name: coffee
+    service: coffee-svc
+    port: 80
+  routes:
+  - path: /tea
+    action:
+      pass: tea
+  - path: /coffee
+    action:
+      pass: coffee
+  - path: ~ ^/decaf/.*\\.jpg$
+    action:
+      pass: coffee
+  - path: = /green/tea
+    action:
+      pass: tea
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. When using a wildcard domain like ``*.example.com`` the domain must be contained in double quotes.  The ``host`` value needs to be unique among all Ingress and VirtualServer resources. See also [Handling Host and Listener Collisions](/nginx-ingress-controller/configuration/host-and-listener-collisions). | ``string`` | Yes |
+|``listener`` | Sets a custom HTTP and/or HTTPS listener. Valid fields are `listener.http` and `listener.https`. Each field must reference the name of a valid listener defined in a GlobalConfiguration resource | [listener](#virtualserverlistener) | No |
+|``tls`` | The TLS termination configuration. | [tls](#virtualservertls) | No |
+|``gunzip`` | Enables or disables [decompression](https://docs.nginx.com/nginx/admin-guide/web-server/compression/) of gzipped responses for clients. Allowed values “on”/“off”, “true”/“false” or “yes”/“no”. If the ``gunzip`` value is not set, it defaults to ``off``.   | ``boolean`` | No |
+|``externalDNS`` | The externalDNS configuration for a VirtualServer. | [externalDNS](#virtualserverexternaldns) | No |
+|``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServer. | ``string`` | No |
+|``policies`` | A list of policies. | [[]policy](#virtualserverpolicy) | No |
+|``upstreams`` | A list of upstreams. | [[]upstream](#upstream) | No |
+|``routes`` | A list of routes. | [[]route](#virtualserverroute) | No |
+|``ingressClassName`` | Specifies which Ingress Controller must handle the VirtualServer resource. | ``string`` | No |
+|``internalRoute`` | Specifies if the VirtualServer resource is an internal route or not. | ``boolean`` | No |
+|``http-snippets`` | Sets a custom snippet in the http context. | ``string`` | No |
+|``server-snippets`` | Sets a custom snippet in server context. Overrides the ``server-snippets`` ConfigMap key. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.TLS
+
+The tls field defines TLS configuration for a VirtualServer. For example:
+
+```yaml
+secret: cafe-secret
+redirect:
+  enable: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of a secret with a TLS certificate and key. The secret must belong to the same namespace as the VirtualServer. The secret must be of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that contain the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). If the secret doesn't exist or is invalid, NGINX will break any attempt to establish a TLS connection to the host of the VirtualServer. If the secret is not specified but [wildcard TLS secret](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments#cmdoption-wildcard-tls-secret) is configured, NGINX will use the wildcard secret for TLS termination. | ``string`` | No |
+|``redirect`` | The redirect configuration of the TLS for a VirtualServer. | [tls.redirect](#virtualservertlsredirect) | No | ### VirtualServer.TLS.Redirect |
+|``cert-manager`` | The cert-manager configuration of the TLS for a VirtualServer. | [tls.cert-manager](#virtualservertlscertmanager) | No | ### VirtualServer.TLS.CertManager |
+{{</bootstrap-table>}}
+
+### VirtualServer.TLS.Redirect
+
+The redirect field configures a TLS redirect for a VirtualServer:
+
+```yaml
+enable: true
+code: 301
+basedOn: scheme
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables a TLS redirect for a VirtualServer. The default is ``False``. | ``boolean`` | No |
+|``code`` | The status code of a redirect. The allowed values are: ``301`` , ``302`` , ``307`` , ``308``.  The default is ``301``. | ``int`` | No |
+|``basedOn`` | The attribute of a request that NGINX will evaluate to send a redirect. The allowed values are ``scheme`` (the scheme of the request) or ``x-forwarded-proto`` (the ``X-Forwarded-Proto`` header of the request). The default is ``scheme``. | ``string`` | No | ### VirtualServer.Policy |
+{{</bootstrap-table>}}
+
+### VirtualServer.TLS.CertManager
+
+The cert-manager field configures x509 automated Certificate management for VirtualServer resources using cert-manager (cert-manager.io). Please see the [cert-manager configuration documentation](https://cert-manager.io/docs/configuration/) for more information on deploying and configuring Issuers. Example:
+
+```yaml
+cert-manager:
+  cluster-issuer: "my-issuer-name"
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``issuer`` |  the name of an Issuer. An Issuer is a cert-manager resource which describes the certificate authority capable of signing certificates. The Issuer must be in the same namespace as the VirtualServer resource. Please note that one of `issuer` and `cluster-issuer` are required, but they are mutually exclusive - one and only one must be defined. | ``string`` | No |
+|``cluster-issuer`` | the name of a ClusterIssuer. A ClusterIssuer is a cert-manager resource which describes the certificate authority capable of signing certificates. It does not matter which namespace your VirtualServer resides, as ClusterIssuers are non-namespaced resources. Please note that one of `issuer` and `cluster-issuer` are required, but they are mutually exclusive - one and only one must be defined. | ``string`` | No |
+|``issuer-kind`` | The kind of the external issuer resource, for example AWSPCAIssuer. This is only necessary for out-of-tree issuers. This cannot be defined if `cluster-issuer` is also defined. | ``string`` | No |
+|``issuer-group`` | The API group of the external issuer controller, for example awspca.cert-manager.io. This is only necessary for out-of-tree issuers. This cannot be defined if `cluster-issuer` is also defined. | ``string`` | No |
+|``common-name`` | This field allows you to configure spec.commonName for the Certificate to be generated. This configuration adds a CN to the x509 certificate. | ``string`` | No |
+|``duration`` | This field allows you to configure spec.duration field for the Certificate to be generated. Must be specified using a [Go time.Duration](https://pkg.go.dev/time#ParseDuration) string format, which does not allow the d (days) suffix. You must specify these values using s, m, and h suffixes instead. | ``string`` | No |
+|``renew-before`` |  this annotation allows you to configure spec.renewBefore field for the Certificate to be generated. Must be specified using a [Go time.Duration](https://pkg.go.dev/time#ParseDuration) string format, which does not allow the d (days) suffix. You must specify these values using s, m, and h suffixes instead. | ``string`` | No |
+|``usages`` |  This field allows you to configure spec.usages field for the Certificate to be generated. Pass a string with comma-separated values i.e. ``key agreement,digital signature, server auth``. An exhaustive list of supported key usages can be found in the [the cert-manager api documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage). | ``string`` | No |
+|``issue-temp-cert`` | When ``true``, ask cert-manager for a [temporary self-signed certificate](https://cert-manager.io/docs/usage/certificate/#temporary-certificates-while-issuing) pending the issuance of the Certificate. This allows HTTPS-only servers to use ACME HTTP01 challenges when the TLS secret does not exist yet. | ``boolean`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.Listener
+The listener field defines a custom HTTP and/or HTTPS listener.
+The respective listeners used must reference the name of a listener defined using a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource.
+For example:
+```yaml
+http: http-8083
+https: https-8443
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``http`` |  The name of am HTTP listener defined in a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource. | ``string`` | No |
+|``https`` |  The name of an HTTPS listener defined in a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.ExternalDNS
+
+The externalDNS field configures controlling DNS records dynamically for VirtualServer resources using [ExternalDNS](https://github.com/kubernetes-sigs/external-dns). Please see the [ExternalDNS configuration documentation](https://kubernetes-sigs.github.io/external-dns/) for more information on deploying and configuring ExternalDNS and Providers. Example:
+
+```yaml
+enable: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables ExternalDNS integration for a VirtualServer resource. The default is ``false``. | ``string`` | No |
+|``labels`` | Configure labels to be applied to the Endpoint resources that will be consumed by ExternalDNS. | ``map[string]string`` | No |
+|``providerSpecific`` | Configure provider specific properties which holds the name and value of a configuration which is specific to individual DNS providers. | [[]ProviderSpecific](#virtualserverexternaldnsproviderspecific) | No |
+|``recordTTL`` | TTL for the DNS record. This defaults to 0 if not defined. See [the ExternalDNS TTL documentation for provider-specific defaults](https://kubernetes-sigs.github.io/external-dns/v0.14.2/ttl/#providers) | ``int64`` | No |
+|``recordType`` | The record Type that should be created, e.g. "A", "AAAA", "CNAME". This is automatically computed based on the external endpoints if not defined. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.ExternalDNS.ProviderSpecific
+
+The providerSpecific field of the externalDNS block allows the specification of provider specific properties which is a list of key value pairs of configurations which are specific to individual DNS providers. Example:
+
+```yaml
+- name: my-name
+  value: my-value
+- name: my-name2
+  value: my-value2
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the key value pair. | ``string`` | Yes |
+|``value`` | The value of the key value pair. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### VirtualServer.Policy
+
+The policy field references a [Policy resource](/nginx-ingress-controller/configuration/policy-resource/) by its name and optional namespace. For example:
+
+```yaml
+name: access-control
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of a policy. If the policy doesn't exist or invalid, NGINX will respond with an error response with the `500` status code. | ``string`` | Yes |
+|``namespace`` | The namespace of a policy. If not specified, the namespace of the VirtualServer resource is used. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.Route
+
+The route defines rules for matching client requests to actions like passing a request to an upstream. For example:
+
+```yaml
+  path: /tea
+  action:
+    pass: tea
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``path`` | The path of the route. NGINX will match it against the URI of a request. Possible values are: a prefix ( ``/`` , ``/path`` ), an exact match ( ``=/exact/match`` ), a case insensitive regular expression ( ``~*^/Bar.*\.jpg`` ) or a case sensitive regular expression ( ``~^/foo.*\.jpg`` ). In the case of a prefix (must start with ``/`` ) or an exact match (must start with ``=`` ), the path must not include any whitespace characters, ``{`` , ``}`` or ``;``. In the case of the regex matches, all double quotes ``"`` must be escaped and the match can't end in an unescaped backslash ``\``. The path must be unique among the paths of all routes of the VirtualServer. Check the [location](https://nginx.org/en/docs/http/ngx_http_core_module.html#location) directive for more information. | ``string`` | Yes |
+|``policies`` | A list of policies. The policies override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies](/nginx-ingress-controller/configuration/policy-resource/#applying-policies) for more details. | [[]policy](#virtualserverpolicy) | No |
+|``action`` | The default action to perform for a request. | [action](#action) | No |
+|``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServer route. | ``string`` | No |
+|``splits`` | The default splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
+|``matches`` | The matching rules for advanced content-based routing. Requires the default ``action`` or ``splits``.  Unmatched requests will be handled by the default ``action`` or ``splits``. | [matches](#match) | No |
+|``route`` | The name of a VirtualServerRoute resource that defines this route. If the VirtualServerRoute belongs to a different namespace than the VirtualServer, you need to include the namespace. For example, ``tea-namespace/tea``. | ``string`` | No |
+|``errorPages`` | The custom responses for error codes. NGINX will use those responses instead of returning the error responses from the upstream servers or the default responses generated by NGINX. A custom response can be a redirect or a canned response. For example, a redirect to another URL if an upstream server responded with a 404 status code. | [[]errorPage](#errorpage) | No |
+|``location-snippets`` | Sets a custom snippet in the location context. Overrides the ``location-snippets`` ConfigMap key. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- a route must include exactly one of the following: `action`, `splits`, or `route`.
+
+## VirtualServerRoute specification
+
+The VirtualServerRoute resource defines a route for a VirtualServer. It can consist of one or multiple subroutes. The VirtualServerRoute is an alternative to [Mergeable Ingress types](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration).
+
+In the example below, the VirtualServer `cafe` from the namespace `cafe-ns` defines a route with the path `/coffee`, which is further defined in the VirtualServerRoute `coffee` from the namespace `coffee-ns`.
+
+VirtualServer:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+  namespace: cafe-ns
+spec:
+  host: cafe.example.com
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+  routes:
+  - path: /tea
+    action:
+      pass: tea
+  - path: /coffee
+    route: coffee-ns/coffee
+```
+
+VirtualServerRoute:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServerRoute
+metadata:
+  name: coffee
+  namespace: coffee-ns
+spec:
+  host: cafe.example.com
+  upstreams:
+  - name: latte
+    service: latte-svc
+    port: 80
+  - name: espresso
+    service: espresso-svc
+    port: 80
+  subroutes:
+  - path: /coffee/latte
+    action:
+      pass: latte
+  - path: /coffee/espresso
+    action:
+      pass: espresso
+```
+
+Note that each subroute must have a `path` that starts with the same prefix (here `/coffee`), which is defined in the route of the VirtualServer. Additionally, the `host` in the VirtualServerRoute must be the same as the `host` of the VirtualServer.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. When using a wildcard domain like ``*.example.com`` the domain must be contained in double quotes. Must be the same as the ``host`` of the VirtualServer that references this resource. | ``string`` | Yes |
+|``upstreams`` | A list of upstreams. | [[]upstream](#upstream) | No |
+|``subroutes`` | A list of subroutes. | [[]subroute](#virtualserverroutesubroute) | No |
+|``ingressClassName`` | Specifies which Ingress Controller must handle the VirtualServerRoute resource. Must be the same as the ``ingressClassName`` of the VirtualServer that references this resource. | ``string``_ | No |
+{{</bootstrap-table>}}
+
+### VirtualServerRoute.Subroute
+
+The subroute defines rules for matching client requests to actions like passing a request to an upstream. For example:
+
+```yaml
+path: /coffee
+action:
+  pass: coffee
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``path`` | The path of the subroute. NGINX will match it against the URI of a request. Possible values are: a prefix ( ``/`` , ``/path`` ), an exact match ( ``=/exact/match`` ), a case insensitive regular expression ( ``~*^/Bar.*\.jpg`` ) or a case sensitive regular expression ( ``~^/foo.*\.jpg`` ). In the case of a prefix, the path must start with the same path as the path of the route of the VirtualServer that references this resource. In the case of an exact or regex match, the path must be the same as the path of the route of the VirtualServer that references this resource. A matching path of the route of the VirtualServer but in different type is not accepted, e.g. a regex path (`~/match`) cannot be used with a prefix path in VirtualServer (`/match`) In the case of a prefix or an exact match, the path must not include any whitespace characters, ``{`` , ``}`` or ``;``.  In the case of the regex matches, all double quotes ``"`` must be escaped and the match can't end in an unescaped backslash ``\``. The path must be unique among the paths of all subroutes of the VirtualServerRoute. | ``string`` | Yes |
+|``policies`` | A list of policies. The policies override *all* policies defined in the route of the VirtualServer that references this resource. The policies also override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies](/nginx-ingress-controller/configuration/policy-resource/#applying-policies) for more details. | [[]policy](#virtualserverpolicy) | No |
+|``action`` | The default action to perform for a request. | [action](#action) | No |
+|``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServerRoute subroute. | ``string`` | No |
+|``splits`` | The default splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
+|``matches`` | The matching rules for advanced content-based routing. Requires the default ``action`` or ``splits``.  Unmatched requests will be handled by the default ``action`` or ``splits``. | [matches](#match) | No |
+|``errorPages`` | The custom responses for error codes. NGINX will use those responses instead of returning the error responses from the upstream servers or the default responses generated by NGINX. A custom response can be a redirect or a canned response. For example, a redirect to another URL if an upstream server responded with a 404 status code. | [[]errorPage](#errorpage) | No |
+|``location-snippets`` | Sets a custom snippet in the location context. Overrides the ``location-snippets`` of the VirtualServer (if set) or the ``location-snippets`` ConfigMap key. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- a subroute must include exactly one of the following: `action` or `splits`.
+
+## Common VirtualServer and VirtualServerRoute specifications
+
+### Upstream
+
+The upstream defines a destination for the routing configuration. For example:
+
+```yaml
+name: tea
+service: tea-svc
+subselector:
+  version: canary
+port: 80
+lb-method: round_robin
+fail-timeout: 10s
+max-fails: 1
+max-conns: 32
+keepalive: 32
+connect-timeout: 30s
+read-timeout: 30s
+send-timeout: 30s
+next-upstream: "error timeout non_idempotent"
+next-upstream-timeout: 5s
+next-upstream-tries: 10
+client-max-body-size: 2m
+tls:
+  enable: true
+```
+
+**Note**: The WebSocket protocol is supported without any additional configuration.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the upstream. Must be a valid DNS label as defined in RFC 1035. For example, ``hello`` and ``upstream-123`` are valid. The name must be unique among all upstreams of the resource. | ``string`` | Yes |
+|``service`` | The name of a [service](https://kubernetes.io/docs/concepts/services-networking/service/). The service must belong to the same namespace as the resource. If the service doesn't exist, NGINX will assume the service has zero endpoints and return a ``502`` response for requests for this upstream. For NGINX Plus only, services of type [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) are also supported (check the [prerequisites](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services#prerequisites) ). | ``string`` | Yes |
+|``subselector`` | Selects the pods within the service using label keys and values. By default, all pods of the service are selected. Note: the specified labels are expected to be present in the pods when they are created. If the pod labels are updated, NGINX Ingress Controller will not see that change until the number of the pods is changed. | ``map[string]string`` | No |
+|``use-cluster-ip`` | Enables using the Cluster IP and port of the service instead of the default behavior of using the IP and port of the pods. When this field is enabled, the fields that configure NGINX behavior related to multiple upstream servers (like ``lb-method`` and ``next-upstream``) will have no effect, as NGINX Ingress Controller will configure NGINX with only one upstream server that will match the service Cluster IP. | ``boolean`` | No |
+|``port`` | The port of the service. If the service doesn't define that port, NGINX will assume the service has zero endpoints and return a ``502`` response for requests for this upstream. The port must fall into the range ``1..65535``. | ``uint16`` | Yes |
+|``lb-method`` | The load [balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify ``round_robin``. The default is specified in the ``lb-method`` ConfigMap key. | ``string`` | No |
+|``fail-timeout`` | The time during which the specified number of unsuccessful attempts to communicate with an upstream server should happen to consider the server unavailable. See the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the server directive. The default is set in the ``fail-timeout`` ConfigMap key. | ``string`` | No |
+|``max-fails`` | The number of unsuccessful attempts to communicate with an upstream server that should happen in the duration set by the ``fail-timeout`` to consider the server unavailable. See the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the server directive. The default is set in the ``max-fails`` ConfigMap key. | ``int`` | No |
+|``max-conns`` | The maximum number of simultaneous active connections to an upstream server. See the [max_conns](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_conns) parameter of the server directive. By default there is no limit. Note: if keepalive connections are enabled, the total number of active and idle keepalive connections to an upstream server may exceed the ``max_conns`` value. | ``int`` | No |
+|``keepalive`` | Configures the cache for connections to upstream servers. The value ``0`` disables the cache. See the [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) directive. The default is set in the ``keepalive`` ConfigMap key. | ``int`` | No |
+|``connect-timeout`` | The timeout for establishing a connection with an upstream server. See the [proxy_connect_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) directive. The default is specified in the ``proxy-connect-timeout`` ConfigMap key. | ``string`` | No |
+|``read-timeout`` | The timeout for reading a response from an upstream server. See the [proxy_read_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) directive.  The default is specified in the ``proxy-read-timeout`` ConfigMap key. | ``string`` | No |
+|``send-timeout`` | The timeout for transmitting a request to an upstream server. See the [proxy_send_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) directive. The default is specified in the ``proxy-send-timeout`` ConfigMap key. | ``string`` | No |
+|``next-upstream`` | Specifies in which cases a request should be passed to the next upstream server. See the [proxy_next_upstream](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream) directive. The default is ``error timeout``. | ``string`` | No |
+|``next-upstream-timeout`` | The time during which a request can be passed to the next upstream server. See the [proxy_next_upstream_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream_timeout) directive. The ``0`` value turns off the time limit. The default is ``0``. | ``string`` | No |
+|``next-upstream-tries`` | The number of possible tries for passing a request to the next upstream server. See the [proxy_next_upstream_tries](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream_tries) directive. The ``0`` value turns off this limit. The default is ``0``. | ``int`` | No |
+|``client-max-body-size`` | Sets the maximum allowed size of the client request body. See the [client_max_body_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size) directive. The default is set in the ``client-max-body-size`` ConfigMap key. | ``string`` | No |
+|``tls`` | The TLS configuration for the Upstream. | [tls](#upstreamtls) | No |
+|``healthCheck`` | The health check configuration for the Upstream. See the [health_check](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html#health_check) directive. Note: this feature is supported only in NGINX Plus. | [healthcheck](#upstreamhealthcheck) | No |
+|``slow-start`` | The slow start allows an upstream server to gradually recover its weight from 0 to its nominal value after it has been recovered or became available or when the server becomes available after a period of time it was considered unavailable. By default, the slow start is disabled. See the [slow_start](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start) parameter of the server directive. Note: The parameter cannot be used along with the ``random`` , ``hash`` or ``ip_hash`` load balancing methods and will be ignored. | ``string`` | No |
+|``queue`` | Configures a queue for an upstream. A client request will be placed into the queue if an upstream server cannot be selected immediately while processing the request. By default, no queue is configured. Note: this feature is supported only in NGINX Plus. | [queue](#upstreamqueue) | No |
+|``buffering`` | Enables buffering of responses from the upstream server. See the [proxy_buffering](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) directive. The default is set in the ``proxy-buffering`` ConfigMap key. | ``boolean`` | No |
+|``buffers`` | Configures the buffers used for reading a response from the upstream server for a single connection. | [buffers](#upstreambuffers) | No |
+|``buffer-size`` | Sets the size of the buffer used for reading the first part of a response received from the upstream server. See the [proxy_buffer_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) directive. The default is set in the ``proxy-buffer-size`` ConfigMap key. | ``string`` | No |
+|``ntlm`` | Allows proxying requests with NTLM Authentication. See the [ntlm](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#ntlm) directive. In order for NTLM authentication to work, it is necessary to enable keepalive connections to upstream servers using the ``keepalive`` field. Note: this feature is supported only in NGINX Plus.| ``boolean`` | No |
+|``type`` |The type of the upstream. Supported values are ``http`` and ``grpc``. The default is ``http``. For gRPC, it is necessary to enable HTTP/2 in the [ConfigMap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#listeners) and configure TLS termination in the VirtualServer. | ``string`` | No |
+|``backup`` | The name of the backup service of type [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname). This will be used when the primary servers are unavailable. Note: The parameter cannot be used along with the ``random`` , ``hash`` or ``ip_hash`` load balancing methods. | ``string`` | No |
+|``backupPort`` | The port of the backup service. The backup port is required if the backup service name is provided. The port must fall into the range ``1..65535``. | ``uint16`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Buffers
+
+The buffers field configures the buffers used for reading a response from the upstream server for a single connection:
+
+```yaml
+number: 4
+size: 8K
+```
+
+See the [proxy_buffers](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) directive for additional information.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``number`` | Configures the number of buffers. The default is set in the ``proxy-buffers`` ConfigMap key. | ``int`` | Yes |
+|``size`` | Configures the size of a buffer. The default is set in the ``proxy-buffers`` ConfigMap key. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### Upstream.TLS
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables HTTPS for requests to upstream servers. The default is ``False`` , meaning that HTTP will be used. Note: by default, NGINX will not verify the upstream server certificate. To enable the verification, configure an [EgressMTLS Policy](/nginx-ingress-controller/configuration/policy-resource/#egressmtls). | ``boolean`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Queue
+
+The queue field configures a queue. A client request will be placed into the queue if an upstream server cannot be selected immediately while processing the request:
+
+```yaml
+size: 10
+timeout: 60s
+```
+
+See [`queue`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#queue) directive for additional information.
+
+Note: This feature is supported only in NGINX Plus.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``size`` | The size of the queue. | ``int`` | Yes |
+|``timeout`` | The timeout of the queue. A request cannot be queued for a period longer than the timeout. The default is ``60s``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Healthcheck
+
+The Healthcheck defines an [active health check](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/). In the example below we enable a health check for an upstream and configure all the available parameters, including the `slow-start` parameter combined with [`mandatory` and `persistent`](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#mandatory-health-checks):
+
+```yaml
+name: tea
+service: tea-svc
+port: 80
+slow-start: 30s
+healthCheck:
+  enable: true
+  path: /healthz
+  interval: 20s
+  jitter: 3s
+  fails: 5
+  passes: 5
+  port: 8080
+  tls:
+    enable: true
+  connect-timeout: 10s
+  read-timeout: 10s
+  send-timeout: 10s
+  headers:
+  - name: Host
+    value: my.service
+  statusMatch: "! 500"
+  mandatory: true
+  persistent: true
+  keepalive-time: 60s
+```
+
+Note: This feature is supported only in NGINX Plus.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables a health check for an upstream server. The default is ``false``. | ``boolean`` | No |
+|``path`` | The path used for health check requests. The default is ``/``. This not configurable for gRPC type upstreams. | ``string`` | No |
+|``interval`` | The interval between two consecutive health checks. The default is ``5s``. | ``string`` | No |
+|``jitter`` | The time within which each health check will be randomly delayed. By default, there is no delay. | ``string`` | No |
+|``fails`` | The number of consecutive failed health checks of a particular upstream server after which this server will be considered unhealthy. The default is ``1``. | ``integer`` | No |
+|``passes`` | The number of consecutive passed health checks of a particular upstream server after which the server will be considered healthy. The default is ``1``. | ``integer`` | No |
+|``port`` | The port used for health check requests. By default, the [server port is used](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html#health_check_port). Note: in contrast with the port of the upstream, this port is not a service port, but a port of a pod. | ``integer`` | No |
+|``tls`` | The TLS configuration used for health check requests. By default, the ``tls`` field of the upstream is used. | [upstream.tls](#upstreamtls) | No |
+|``connect-timeout`` | The timeout for establishing a connection with an upstream server. By default, the ``connect-timeout`` of the upstream is used. | ``string`` | No |
+|``read-timeout`` | The timeout for reading a response from an upstream server. By default, the ``read-timeout`` of the upstream is used. | ``string`` | No |
+|``send-timeout`` | The timeout for transmitting a request to an upstream server. By default, the ``send-timeout`` of the upstream is used. | ``string`` | No |
+|``headers`` | The request headers used for health check requests. NGINX Plus always sets the ``Host`` , ``User-Agent`` and ``Connection`` headers for health check requests. | [[]header](#header) | No |
+|``statusMatch`` | The expected response status codes of a health check. By default, the response should have status code 2xx or 3xx. Examples: ``"200"`` , ``"! 500"`` , ``"301-303 307"``. See the documentation of the [match](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html?#match) directive. This not supported for gRPC type upstreams. | ``string`` | No |
+|``grpcStatus`` | The expected [gRPC status code](https://github.com/grpc/grpc/blob/master/doc/statuscodes.md#status-codes-and-their-use-in-grpc) of the upstream server response to the [Check method](https://github.com/grpc/grpc/blob/master/doc/health-checking.md). Configure this field only if your gRPC services do not implement the gRPC health checking protocol. For example, configure ``12`` if the upstream server responds with `12 (UNIMPLEMENTED)` status code. Only valid on gRPC type upstreams. | ``int`` | No |
+|``grpcService`` | The gRPC service to be monitored on the upstream server. Only valid on gRPC type upstreams. | ``string`` | No |
+|``mandatory`` | Require every newly added server to pass all configured health checks before NGINX Plus sends traffic to it. If this is not specified, or is set to false, the server will be initially considered healthy. When combined with [slow-start](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start), it gives a new server more time to connect to databases and “warm up” before being asked to handle their full share of traffic. | ``bool`` | No |
+|``persistent`` | Set the initial “up” state for a server after reload if the server was considered healthy before reload. Enabling persistent requires that the mandatory parameter is also set to `true`. | ``bool`` | No |
+|``keepalive-time`` | Enables [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) connections for health checks and specifies the time during which requests can be processed through one keepalive connection. The default is ``60s``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.SessionCookie
+
+The SessionCookie field configures session persistence which allows requests from the same client to be passed to the same upstream server. The information about the designated upstream server is passed in a session cookie generated by NGINX Plus.
+
+In the example below, we configure session persistence with a session cookie for an upstream and configure all the available parameters:
+
+```yaml
+name: tea
+service: tea-svc
+port: 80
+sessionCookie:
+  enable: true
+  name: srv_id
+  path: /
+  expires: 1h
+  domain: .example.com
+  httpOnly: false
+  secure: true
+  samesite: strict
+```
+
+See the [`sticky`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html?#sticky) directive for additional information. The session cookie corresponds to the `sticky cookie` method.
+
+Note: This feature is supported only in NGINX Plus.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables session persistence with a session cookie for an upstream server. The default is ``false``. | ``boolean`` | No |
+|``name`` | The name of the cookie. | ``string`` | Yes |
+|``path`` | The path for which the cookie is set. | ``string`` | No |
+|``expires`` | The time for which a browser should keep the cookie. Can be set to the special value ``max`` , which will cause the cookie to expire on ``31 Dec 2037 23:55:55 GMT``. | ``string`` | No |
+|``domain`` | The domain for which the cookie is set. | ``string`` | No |
+|``httpOnly`` | Adds the ``HttpOnly`` attribute to the cookie. | ``boolean`` | No |
+|``secure`` | Adds the ``Secure`` attribute to the cookie. | ``boolean`` | No |
+|``samesite`` | Adds the ``SameSite`` attribute to the cookie. The allowed values are: ``strict``, ``lax``, ``none`` | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Header
+
+The header defines an HTTP Header:
+
+```yaml
+name: Host
+value: example.com
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Action
+
+The action defines an action to perform for a request.
+
+In the example below, client requests are passed to an upstream `coffee`:
+
+```yaml
+ path: /coffee
+ action:
+  pass: coffee
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``pass`` | Passes requests to an upstream. The upstream with that name must be defined in the resource. | ``string`` | No |
+|``redirect`` | Redirects requests to a provided URL. | [action.redirect](#actionredirect) | No |
+|``return`` | Returns a preconfigured response. | [action.return](#actionreturn) | No |
+|``proxy`` | Passes requests to an upstream with the ability to modify the request/response (for example, rewrite the URI or modify the headers). | [action.proxy](#actionproxy) | No |
+{{</bootstrap-table>}}
+
+\* -- an action must include exactly one of the following: `pass`, `redirect`, `return` or `proxy`.
+
+### Action.Redirect
+
+The redirect action defines a redirect to return for a request.
+
+In the example below, client requests are passed to a url `http://www.nginx.com`:
+
+```yaml
+redirect:
+  url: http://www.nginx.com
+  code: 301
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``url`` | The URL to redirect the request to. Supported NGINX variables: ``$scheme`` , ``$http_x_forwarded_proto`` , ``$request_uri`` , ``$host``. Variables must be enclosed in curly braces. For example: ``${host}${request_uri}``. | ``string`` | Yes |
+|``code`` | The status code of a redirect. The allowed values are: ``301`` , ``302`` , ``307`` , ``308``. The default is ``301``. | ``int`` | No |
+{{</bootstrap-table>}}
+
+### Action.Return
+
+The return action defines a preconfigured response for a request.
+
+In the example below, NGINX will respond with the preconfigured response for every request:
+
+```yaml
+return:
+  code: 200
+  type: text/plain
+  body: "Hello World\n"
+  headers:
+  - name: x-coffee
+    value: espresso
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``code`` | The status code of the response. The allowed values are: ``2XX``, ``4XX`` or ``5XX``. The default is ``200``. | ``int`` | No |
+|``type`` | The MIME type of the response. The default is ``text/plain``. | ``string`` | No |
+|``body`` | The body of the response. Supports NGINX variables*. Variables must be enclosed in curly brackets. For example: ``Request is ${request_uri}\n``. | ``string`` | Yes |
+|``headers`` | The custom headers of the response. | [[]Action.Return.Header](#actionreturnheader) | No |
+{{</bootstrap-table>}}
+
+\* -- Supported NGINX variables: `$request_uri`, `$request_method`, `$request_body`, `$scheme`, `$http_`, `$args`, `$arg_`, `$cookie_`, `$host`, `$request_time`, `$request_length`, `$nginx_version`, `$pid`, `$connection`, `$remote_addr`, `$remote_port`, `$time_iso8601`, `$time_local`, `$server_addr`, `$server_port`, `$server_name`, `$server_protocol`, `$connections_active`, `$connections_reading`, `$connections_writing` and `$connections_waiting`.
+
+### Action.Return.Header
+
+The header defines an HTTP Header for a canned response in an actionReturn:
+
+```yaml
+name: x-coffee
+value: espresso
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### Action.Proxy
+
+The proxy action passes requests to an upstream with the ability to modify the request/response (for example, rewrite the URI or modify the headers).
+
+In the example below, the request URI is rewritten to `/`, and the request and the response headers are modified:
+
+```yaml
+proxy:
+  upstream: coffee
+  requestHeaders:
+    pass: true
+    set:
+    - name: My-Header
+      value: Value
+    - name: Client-Cert
+      value: ${ssl_client_escaped_cert}
+  responseHeaders:
+    add:
+    - name: My-Header
+      value: Value
+    - name: IC-Nginx-Version
+      value: ${nginx_version}
+      always: true
+    hide:
+    - x-internal-version
+    ignore:
+    - Expires
+    - Set-Cookie
+    pass:
+    - Server
+  rewritePath: /
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``upstream`` | The name of the upstream which the requests will be proxied to. The upstream with that name must be defined in the resource. | ``string`` | Yes |
+|``requestHeaders`` | The request headers modifications. | [action.Proxy.RequestHeaders](#actionproxyrequestheaders) | No |
+|``responseHeaders`` | The response headers modifications. | [action.Proxy.ResponseHeaders](#actionproxyresponseheaders) | No |
+|``rewritePath`` | The rewritten URI. If the route path is a regular expression -- starts with `~` -- the `rewritePath` can include capture groups with ``$1-9``. For example `$1` for the first group, and so on. For more information, check the [rewrite](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/rewrites) example. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Action.Proxy.RequestHeaders
+
+The RequestHeaders field modifies the headers of the request to the proxied upstream server.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``pass`` | Passes the original request headers to the proxied upstream server. See the [proxy_pass_request_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_request_headers) directive for more information. Default is true. | ``bool`` | No |
+|``set`` | Allows redefining or appending fields to present request headers passed to the proxied upstream servers. See the [proxy_set_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header) directive for more information. | [[]header](#actionproxyrequestheaderssetheader) | No |
+{{</bootstrap-table>}}
+
+### Action.Proxy.RequestHeaders.Set.Header
+
+The header defines an HTTP Header:
+
+```yaml
+name: My-Header
+value: My-Value
+```
+
+It is possible to override the default value of the `Host` header, which NGINX Ingress Controller sets to [`$host`](https://nginx.org/en/docs/http/ngx_http_core_module.html#var_host):
+
+```yaml
+name: Host
+value: example.com
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. Supports NGINX variables*. Variables must be enclosed in curly brackets. For example: ``${scheme}``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- Supported NGINX variables: `$request_uri`, `$request_method`, `$request_body`, `$scheme`, `$http_`, `$args`, `$arg_`, `$cookie_`, `$host`, `$request_time`, `$request_length`, `$nginx_version`, `$pid`, `$connection`, `$remote_addr`, `$remote_port`, `$time_iso8601`, `$time_local`, `$server_addr`, `$server_port`, `$server_name`, `$server_protocol`, `$connections_active`, `$connections_reading`, `$connections_writing`, `$connections_waiting`, `$ssl_cipher`, `$ssl_ciphers`, `$ssl_client_cert`, `$ssl_client_escaped_cert`, `$ssl_client_fingerprint`, `$ssl_client_i_dn`, `$ssl_client_i_dn_legacy`, `$ssl_client_raw_cert`, `$ssl_client_s_dn`, `$ssl_client_s_dn_legacy`, `$ssl_client_serial`, `$ssl_client_v_end`, `$ssl_client_v_remain`, `$ssl_client_v_start`, `$ssl_client_verify`, `$ssl_curves`, `$ssl_early_data`, `$ssl_protocol`, `$ssl_server_name`, `$ssl_session_id`, `$ssl_session_reused`, `$jwt_claim_` (NGINX Plus only) and `$jwt_header_` (NGINX Plus only).
+
+### Action.Proxy.ResponseHeaders
+
+The ResponseHeaders field modifies the headers of the response to the client.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``hide`` | The headers that will not be passed* in the response to the client from a proxied upstream server. See the [proxy_hide_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directive for more information. | ``[]string`` | No |
+|``pass`` | Allows passing the hidden header fields* to the client from a proxied upstream server. See the [proxy_pass_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header) directive for more information. | ``[]string`` | No |
+|``ignore`` | Disables processing of certain headers** to the client from a proxied upstream server. See the [proxy_ignore_headers](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ignore_headers) directive for more information. | ``[]string`` | No |
+|``add`` | Adds headers to the response to the client. | [[]addHeader](#addheader) | No |
+{{</bootstrap-table>}}
+
+\* -- Default hidden headers are: `Date`, `Server`, `X-Pad` and `X-Accel-...`.
+
+\** -- The following fields can be ignored: `X-Accel-Redirect`, `X-Accel-Expires`, `X-Accel-Limit-Rate`, `X-Accel-Buffering`, `X-Accel-Charset`, `Expires`, `Cache-Control`, `Set-Cookie` and `Vary`.
+
+### AddHeader
+
+The addHeader defines an HTTP Header with an optional `always` field:
+
+```yaml
+name: My-Header
+value: My-Value
+always: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. Supports NGINX variables*. Variables must be enclosed in curly brackets. For example: ``${scheme}``. | ``string`` | No |
+|``always`` | If set to true, add the header regardless of the response status code**. Default is false. See the [add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header) directive for more information. | ``bool`` | No |
+{{</bootstrap-table>}}
+
+\* -- Supported NGINX variables: `$request_uri`, `$request_method`, `$request_body`, `$scheme`, `$http_`, `$args`, `$arg_`, `$cookie_`, `$host`, `$request_time`, `$request_length`, `$nginx_version`, `$pid`, `$connection`, `$remote_addr`, `$remote_port`, `$time_iso8601`, `$time_local`, `$server_addr`, `$server_port`, `$server_name`, `$server_protocol`, `$connections_active`, `$connections_reading`, `$connections_writing`, `$connections_waiting`, `$ssl_cipher`, `$ssl_ciphers`, `$ssl_client_cert`, `$ssl_client_escaped_cert`, `$ssl_client_fingerprint`, `$ssl_client_i_dn`, `$ssl_client_i_dn_legacy`, `$ssl_client_raw_cert`, `$ssl_client_s_dn`, `$ssl_client_s_dn_legacy`, `$ssl_client_serial`, `$ssl_client_v_end`, `$ssl_client_v_remain`, `$ssl_client_v_start`, `$ssl_client_verify`, `$ssl_curves`, `$ssl_early_data`, `$ssl_protocol`, `$ssl_server_name`, `$ssl_session_id`, `$ssl_session_reused`, `$jwt_claim_` (NGINX Plus only) and `$jwt_header_` (NGINX Plus only).
+
+{{< note >}} If `always` is false, the response header is added only if the response status code is any of `200`, `201`, `204`, `206`, `301`, `302`, `303`, `304`, `307` or `308`. {{< /note >}}
+
+### Split
+
+The split defines a weight for an action as part of the splits configuration.
+
+In the example below NGINX passes 80% of requests to the upstream `coffee-v1` and the remaining 20% to `coffee-v2`:
+
+```yaml
+splits:
+- weight: 80
+  action:
+    pass: coffee-v1
+- weight: 20
+  action:
+    pass: coffee-v2
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``weight`` | The weight of an action. Must fall into the range ``0..100``. The sum of the weights of all splits must be equal to ``100``. | ``int`` | Yes |
+|``action`` | The action to perform for a request. | [action](#action) | Yes |
+{{</bootstrap-table>}}
+
+### Match
+
+The match defines a match between conditions and an action or splits.
+
+In the example below, NGINX routes requests with the path `/coffee` to different upstreams based on the value of the cookie `user`:
+
+- `user=john` -> `coffee-future`
+- `user=bob` -> `coffee-deprecated`
+- If the cookie is not set or not equal to either `john` or `bob`, NGINX routes to `coffee-stable`
+
+```yaml
+path: /coffee
+matches:
+- conditions:
+  - cookie: user
+    value: john
+  action:
+    pass: coffee-future
+- conditions:
+  - cookie: user
+    value: bob
+  action:
+    pass: coffee-deprecated
+action:
+  pass: coffee-stable
+```
+
+In the next example, NGINX routes requests based on the value of the built-in [`$request_method` variable](https://nginx.org/en/docs/http/ngx_http_core_module.html#var_request_method), which represents the HTTP method of a request:
+
+- all POST requests -> `coffee-post`
+- all non-POST requests -> `coffee`
+
+```yaml
+path: /coffee
+matches:
+- conditions:
+  - variable: $request_method
+    value: POST
+  action:
+    pass: coffee-post
+action:
+  pass: coffee
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``conditions`` | A list of conditions. Must include at least 1 condition. | [[]condition](#condition) | Yes |
+|``action`` | The action to perform for a request. | [action](#action) | No |
+|``splits`` | The splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
+{{</bootstrap-table>}}
+
+{{< note >}} A match must include exactly one of the following: `action` or `splits`. {{< /note >}}
+
+### Condition
+
+The condition defines a condition in a match.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``header`` | The name of a header. Must consist of alphanumeric characters or ``-``. | ``string`` | No |
+|``cookie`` | The name of a cookie. Must consist of alphanumeric characters or ``_``. | ``string`` | No |
+|``argument`` | The name of an argument. Must consist of alphanumeric characters or ``_``. | ``string`` | No |
+|``variable`` | The name of an NGINX variable. Must start with ``$``. See the list of the supported variables below the table. | ``string`` | No |
+|``value`` | The value to match the condition against. How to define a value is shown below the table. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+{{< note >}}  a condition must include exactly one of the following: `header`, `cookie`, `argument` or `variable`. {{< /note >}}
+
+Supported NGINX variables: `$args`, `$http2`, `$https`, `$remote_addr`, `$remote_port`, `$query_string`, `$request`, `$request_body`, `$request_uri`, `$request_method`, `$scheme`. Find the documentation for each variable [here](https://nginx.org/en/docs/varindex.html).
+
+The value supports two kinds of matching:
+
+- *Case-insensitive string comparison*. For example:
+  - `john` -- case-insensitive matching that succeeds for strings, such as `john`, `John`, `JOHN`.
+  - `!john` -- negation of the case-insensitive matching for john that succeeds for strings, such as `bob`, `anything`, `''` (empty string).
+- *Matching with a regular expression*. Note that NGINX supports regular expressions compatible with those used by the Perl programming language (PCRE). For example:
+  - `~^yes` -- a case-sensitive regular expression that matches any string that starts with `yes`. For example: `yes`, `yes123`.
+  - `!~^yes` -- negation of the previous regular expression that succeeds for strings like `YES`, `Yes123`, `noyes`. (The negation mechanism is not part of the PCRE syntax).
+  - `~*no$` -- a case-insensitive regular expression that matches any string that ends with `no`. For example: `no`, `123no`, `123NO`.
+
+{{< note >}} A value must not include any unescaped double quotes (`"`) and must not end with an unescaped backslash (`\`). For example, the following are invalid values: `some"value`, `somevalue\`. {{< /note >}}
+
+### ErrorPage
+
+The errorPage defines a custom response for a route for the case when either an upstream server responds with (or NGINX generates) an error status code. The custom response can be a redirect or a canned response. See the [error_page](https://nginx.org/en/docs/http/ngx_http_core_module.html#error_page) directive for more information.
+
+```yaml
+path: /coffee
+errorPages:
+- codes: [502, 503]
+  redirect:
+    code: 301
+    url: https://nginx.org
+- codes: [404]
+  return:
+    code: 200
+    body: "Original resource not found, but success!"
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``codes`` | A list of error status codes. | ``[]int`` | Yes |
+|``redirect`` | The redirect action for the given status codes. | [errorPage.Redirect](#errorpageredirect) | No |
+|``return`` | The canned response action for the given status codes. | [errorPage.Return](#errorpagereturn) | No |
+{{</bootstrap-table>}}
+
+{{< note >}} An errorPage must include exactly one of the following: `return` or `redirect`. {{< /note >}}
+
+### ErrorPage.Redirect
+
+The redirect defines a redirect for an errorPage.
+
+In the example below, NGINX responds with a redirect when a response from an upstream server has a 404 status code.
+
+```yaml
+codes: [404]
+redirect:
+  code: 301
+  url: ${scheme}://cafe.example.com/error.html
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``code`` | The status code of a redirect. The allowed values are: ``301`` , ``302`` , ``307`` , ``308``.  The default is ``301``. | ``int`` | No |
+|``url`` | The URL to redirect the request to. Supported NGINX variables: ``$scheme`` and ``$http_x_forwarded_proto``. Variables must be enclosed in curly braces. For example: ``${scheme}``. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### ErrorPage.Return
+
+The return defines a canned response for an errorPage.
+
+In the example below, NGINX responds with a canned response when a response from an upstream server has either 401 or 403 status code.
+
+```yaml
+codes: [401, 403]
+return:
+  code: 200
+  type: application/json
+  body: |
+    {\"msg\": \"You don't have permission to do this\"}
+  headers:
+  - name: x-debug-original-statuses
+    value: ${upstream_status}
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``code`` | The status code of the response. The default is the status code of the original response. | ``int`` | No |
+|``type`` | The MIME type of the response. The default is ``text/html``. | ``string`` | No |
+|``body`` | The body of the response. Supported NGINX variable: ``$upstream_status`` . Variables must be enclosed in curly braces. For example: ``${upstream_status}``. | ``string`` | Yes |
+|``headers`` | The custom headers of the response. | [[]errorPage.Return.Header](#errorpagereturnheader) | No |
+{{</bootstrap-table>}}
+
+### ErrorPage.Return.Header
+
+The header defines an HTTP Header for a canned response in an errorPage:
+
+```yaml
+name: x-debug-original-statuses
+value: ${upstream_status}
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. Supported NGINX variable: ``$upstream_status`` . Variables must be enclosed in curly braces. For example: ``${upstream_status}``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+## Using VirtualServer and VirtualServerRoute
+
+You can use the usual `kubectl` commands to work with VirtualServer and VirtualServerRoute resources, similar to Ingress resources.
+
+For example, the following command creates a VirtualServer resource defined in `cafe-virtual-server.yaml` with the name `cafe`:
+
+```shell
+kubectl apply -f cafe-virtual-server.yaml
+```
+```text
+virtualserver.k8s.nginx.org "cafe" created
+```
+
+You can get the resource by running:
+
+```shell
+kubectl get virtualserver cafe
+```
+```text
+NAME   STATE   HOST                   IP            PORTS      AGE
+cafe   Valid   cafe.example.com       12.13.23.123  [80,443]   3m
+```
+
+In `kubectl get` and similar commands, you can use the short name `vs` instead of `virtualserver`.
+
+Similarly, for VirtualServerRoute you can use `virtualserverroute` or the short name `vsr`.
+
+### Using Snippets
+
+Snippets allow you to insert raw NGINX config into different contexts of NGINX configuration. In the example below, we use snippets to configure several NGINX features in a VirtualServer:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+  namespace: cafe
+spec:
+  http-snippets: |
+    limit_req_zone $binary_remote_addr zone=mylimit:10m rate=1r/s;
+    proxy_cache_path /tmp keys_zone=one:10m;
+  host: cafe.example.com
+  tls:
+    secret: cafe-secret
+  server-snippets: |
+    limit_req zone=mylimit burst=20;
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+  - name: coffee
+    service: coffee-svc
+    port: 80
+  routes:
+  - path: /tea
+    location-snippets: |
+      proxy_cache one;
+      proxy_cache_valid 200 10m;
+    action:
+      pass: tea
+  - path: /coffee
+    action:
+      pass: coffee
+```
+
+For additional information, view the [Advanced configuration with Snippets]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) topic.
+
+### Validation
+
+Two types of validation are available for VirtualServer and VirtualServerRoute resources:
+
+- *Structural validation* by the `kubectl` and Kubernetes API server.
+- *Comprehensive validation* by NGINX Ingress Controller.
+
+#### Structural Validation
+
+The custom resource definitions for VirtualServer and VirtualServerRoute include structural OpenAPI schema which describes the type of every field of those resources.
+
+If you try to create (or update) a resource that violates the structural schema (for example, you use a string value for the port field of an upstream), `kubectl` and Kubernetes API server will reject such a resource:
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f cafe-virtual-server.yaml
+    ```
+    ```text
+    error: error validating "cafe-virtual-server.yaml": error validating data: ValidationError(VirtualServer.spec.upstreams[0].port): invalid type for org.nginx.k8s.v1.VirtualServer.spec.upstreams.port: got "string", expected "integer"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f cafe-virtual-server.yaml --validate=false
+    ```
+    ```text
+    The VirtualServer "cafe" is invalid: []: Invalid value: map[string]interface {}{ ... }: validation failure list:
+    spec.upstreams.port in body must be of type integer: "string"
+    ```
+
+If a resource is not rejected (it doesn't violate the structural schema), NGINX Ingress Controller will validate it further.
+
+#### Comprehensive Validation
+
+NGINX Ingress Controller validates the fields of the VirtualServer and VirtualServerRoute resources. If a resource is invalid, NGINX Ingress Controller will reject it: the resource will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can check if NGINX Ingress Controller successfully applied the configuration for a VirtualServer. For our example `cafe` VirtualServer, we can run:
+
+```shell
+kubectl describe vs cafe
+```
+```text
+...
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  16s   nginx-ingress-controller  Configuration for default/cafe was added or updated
+```
+
+Note how the events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid resource, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create a VirtualServer `cafe` with two upstream with the same name `tea`, you will get:
+
+```shell
+kubectl describe vs cafe
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  12s   nginx-ingress-controller  VirtualServer default/cafe is invalid and was rejected: spec.upstreams[1].name: Duplicate value: "tea"
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+Additionally, this information is also available in the `status` field of the VirtualServer resource. Note the Status section of the VirtualServer:
+
+```shell
+kubectl describe vs cafe
+```
+```text
+...
+Status:
+  External Endpoints:
+    Ip:        12.13.23.123
+    Ports:     [80,443]
+  Message:  VirtualServer default/cafe is invalid and was rejected: spec.upstreams[1].name: Duplicate value: "tea"
+  Reason:   Rejected
+  State:    Invalid
+```
+
+NGINX Ingress Controller validates VirtualServerRoute resources in a similar way.
+
+**Note**: If you make an existing resource invalid, NGINX Ingress Controller will reject it and remove the corresponding configuration from NGINX.
+
+## Customization using ConfigMap
+
+You can customize the NGINX configuration for VirtualServer and VirtualServerRoutes resources using the [ConfigMap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource). Most of the ConfigMap keys are supported, with the following exceptions:
+
+- `proxy-hide-headers`
+- `proxy-pass-headers`
+- `hsts`
+- `hsts-max-age`
+- `hsts-include-subdomains`
+- `hsts-behind-proxy`
+- `redirect-to-https`
+- `ssl-redirect`
diff --git a/content/includes/nic/installation/create-common-resources.md b/content/includes/nic/installation/create-common-resources.md
new file mode 100644
index 000000000..7cfe90e48
--- /dev/null
+++ b/content/includes/nic/installation/create-common-resources.md
@@ -0,0 +1,27 @@
+---
+docs: DOCS-1464
+---
+
+In this section, you'll create resources that most NGINX Ingress Controller installations require:
+
+1. (Optional) Create a secret for the default NGINX server's TLS certificate and key. Complete this step only if you're using the [default server TLS secret]({{< ref "/nic/configuration/global-configuration/command-line-arguments#cmdoption-default-server-tls-secret.md" >}}) command-line argument. If you're not, feel free to skip this step.
+
+    By default, the server returns a _404 Not Found_ page for all requests when no ingress rules are set up. Although we provide a self-signed certificate and key for testing purposes, we recommend using your own certificate.
+
+    ```shell
+    kubectl apply -f examples/shared-examples/default-server-secret/default-server-secret.yaml
+    ```
+
+2. Create a ConfigMap to customize your NGINX settings:
+
+    ```shell
+    kubectl apply -f deployments/common/nginx-config.yaml
+    ```
+
+3. Create an `IngressClass` resource. NGINX Ingress Controller won't start without an `IngressClass` resource.
+
+    ```shell
+    kubectl apply -f deployments/common/ingress-class.yaml
+    ```
+
+    If you want to make this NGINX Ingress Controller instance your cluster's default, uncomment the `ingressclass.kubernetes.io/is-default-class` annotation. This action will auto-assign `IngressClass` to new ingresses that don't specify an `ingressClassName`.
diff --git a/content/includes/nic/installation/create-custom-resources.md b/content/includes/nic/installation/create-custom-resources.md
new file mode 100644
index 000000000..d7ad9ec27
--- /dev/null
+++ b/content/includes/nic/installation/create-custom-resources.md
@@ -0,0 +1,49 @@
+---
+docs: DOCS-1463
+---
+
+To make sure your NGINX Ingress Controller pods reach the `Ready` state, you'll need to create custom resource definitions (CRDs) for various components.
+
+Alternatively, you can disable this requirement by setting the `-enable-custom-resources` command-line argument to `false`.
+
+There are two ways you can install the custom resource definitions:
+
+1. Using a URL to apply a single CRD yaml file, which we recommend.
+1. Applying your local copy of the CRD yaml files, which requires you to clone the repository.
+
+The core custom CRDs are the following:
+
+- [VirtualServer and VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}})
+- [TransportServer]({{< ref "/nic/configuration/transportserver-resource.md" >}})
+- [Policy]({{< ref "/nic/configuration/policy-resource.md" >}})
+- [GlobalConfiguration]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}})
+
+{{<tabs name="install-crds">}}
+
+{{%tab name="Install CRDs from single YAML"%}}
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds.yaml
+```
+
+{{%/tab%}}
+
+{{%tab name="Install CRDs after cloning the repo"%}}
+
+{{< note >}} If you are installing the CRDs this way, ensure you have first cloned the repository. {{< /note >}}
+
+{{< note >}} Please make sure to read the steps outlined in [Upgrade to V4](https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/upgrade-to-v4/#update-custom-resource-apiversion) before running the CRD upgrade and perform the steps if applicable.
+{{< /note >}}
+
+
+```shell
+kubectl apply -f config/crd/bases/k8s.nginx.org_virtualservers.yaml
+kubectl apply -f config/crd/bases/k8s.nginx.org_virtualserverroutes.yaml
+kubectl apply -f config/crd/bases/k8s.nginx.org_transportservers.yaml
+kubectl apply -f config/crd/bases/k8s.nginx.org_policies.yaml
+kubectl apply -f config/crd/bases/k8s.nginx.org_globalconfigurations.yaml
+```
+
+{{%/tab%}}
+
+{{</tabs>}}
diff --git a/content/includes/nic/installation/deploy-controller.md b/content/includes/nic/installation/deploy-controller.md
new file mode 100644
index 000000000..5723c73ae
--- /dev/null
+++ b/content/includes/nic/installation/deploy-controller.md
@@ -0,0 +1,10 @@
+---
+docs: DOCS-1462
+---
+
+You have two options for deploying NGINX Ingress Controller:
+
+- **Deployment**. Choose this method for the flexibility to dynamically change the number of NGINX Ingress Controller replicas.
+- **DaemonSet**. Choose this method if you want NGINX Ingress Controller to run on all nodes or a subset of nodes.
+
+Before you start, update the [command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) for the NGINX Ingress Controller container in the relevant manifest file to meet your specific requirements.
diff --git a/content/includes/nic/installation/download-jwt.md b/content/includes/nic/installation/download-jwt.md
new file mode 100644
index 000000000..d89c65a43
--- /dev/null
+++ b/content/includes/nic/installation/download-jwt.md
@@ -0,0 +1,10 @@
+---
+docs: "DOCS-000"
+---
+
+1. Log in to [MyF5](https://my.f5.com/manage/s/).
+2. Go to **My Products & Plans > Subscriptions** to see your active subscriptions.
+3. Find your NGINX products or services subscription, and select the **Subscription ID** for details.
+4. Download the **JSON Web Token (JWT)** from the subscription page.
+
+{{< note >}} The Connectivity Stack for Kubernetes JWT does not work with NGINX Plus reporting. A regular NGINX Plus instance JWT must be used. {{< /note >}}
diff --git a/content/includes/nic/installation/jwt-password-note.md b/content/includes/nic/installation/jwt-password-note.md
new file mode 100644
index 000000000..147c67af3
--- /dev/null
+++ b/content/includes/nic/installation/jwt-password-note.md
@@ -0,0 +1,11 @@
+---
+docs: 
+---
+
+{{< note >}} For security, follow these practices with JSON Web Tokens (JWTs), passwords, and shell history:
+
+1. **JWTs:** JWTs are sensitive information. Store them securely. Delete them after use to prevent unauthorized access.
+
+1. **Shell history:** Commands that include JWTs or passwords are recorded in the history of your shell, in plain text. Clear your shell history after running such commands. For example, if you use bash, you can delete commands in your `~/.bash_history` file. Alternatively, you can run the `history -c` command to erase your shell history.
+
+Follow these practices to help ensure the security of your system and data. {{< /note >}}
diff --git a/content/includes/nic/installation/manifests/daemonset.md b/content/includes/nic/installation/manifests/daemonset.md
new file mode 100644
index 000000000..c19376eb2
--- /dev/null
+++ b/content/includes/nic/installation/manifests/daemonset.md
@@ -0,0 +1,21 @@
+---
+docs: DOCS-1465
+---
+
+For additional context on managing containers using Kubernetes DaemonSets, refer to the official Kubernetes [DaemonSets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) documentation.
+
+When you deploy NGINX Ingress Controller as a DaemonSet, Kubernetes creates an Ingress Controller pod on every node in the cluster.
+
+- For NGINX, run:
+
+    ```shell
+    kubectl apply -f deployments/daemon-set/nginx-ingress.yaml
+    ```
+
+- For NGINX Plus, run:
+
+    ```shell
+    kubectl apply -f deployments/daemon-set/nginx-plus-ingress.yaml
+    ```
+
+    Update the `nginx-plus-ingress.yaml` file to include your chosen image from the F5 Container registry or your custom container image.
diff --git a/content/includes/nic/installation/manifests/deployment.md b/content/includes/nic/installation/manifests/deployment.md
new file mode 100644
index 000000000..3786a2256
--- /dev/null
+++ b/content/includes/nic/installation/manifests/deployment.md
@@ -0,0 +1,21 @@
+---
+docs: DOCS-1467
+---
+
+For additional context on managing containers using Kubernetes Deployments, refer to the official Kubernetes [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) documentation.
+
+When you deploy NGINX Ingress Controller as a Deployment, Kubernetes automatically sets up a single NGINX Ingress Controller pod.
+
+- For NGINX, run:
+
+    ```shell
+    kubectl apply -f deployments/deployment/nginx-ingress.yaml
+    ```
+
+- For NGINX Plus, run:
+
+    ```shell
+    kubectl apply -f deployments/deployment/nginx-plus-ingress.yaml
+    ```
+
+    Update the `nginx-plus-ingress.yaml` file to include your chosen image from the F5 Container registry or your custom container image.
diff --git a/content/includes/nic/installation/manifests/verify-pods-are-running.md b/content/includes/nic/installation/manifests/verify-pods-are-running.md
new file mode 100644
index 000000000..9f11fa7b0
--- /dev/null
+++ b/content/includes/nic/installation/manifests/verify-pods-are-running.md
@@ -0,0 +1,10 @@
+---
+docs: DOCS-1466
+---
+
+
+To confirm the NGINX Ingress Controller pods are operational, run:
+
+```shell
+kubectl get pods --namespace=nginx-ingress
+```
diff --git a/content/includes/nic/rbac/set-up-rbac.md b/content/includes/nic/rbac/set-up-rbac.md
new file mode 100644
index 000000000..a8bd5a176
--- /dev/null
+++ b/content/includes/nic/rbac/set-up-rbac.md
@@ -0,0 +1,33 @@
+---
+docs: DOCS-1468
+---
+
+{{<call-out "important" "Admin access required" >}}To complete these steps you need admin access to your cluster. Refer to to your Kubernetes platform's documentation to set up admin access. For Google Kubernetes Engine (GKE), you can refer to their [Role-Based Access Control guide](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).{{</call-out>}}
+
+1. Create a namespace and a service account:
+
+    ```shell
+    kubectl apply -f deployments/common/ns-and-sa.yaml
+    ```
+
+2. Create a cluster role and binding for the service account:
+
+    ```shell
+    kubectl apply -f deployments/rbac/rbac.yaml
+    ```
+
+<br>
+
+If you're planning to use NGINX App Protect or NGINX App Protect DoS, additional roles and bindings are needed.
+
+1. (NGINX App Protect only) Create the *App Protect* role and binding:
+
+    ```shell
+    kubectl apply -f deployments/rbac/ap-rbac.yaml
+    ```
+
+2. (NGINX App Protect DoS only) Create the *App Protect DoS* role and binding:
+
+    ```shell
+    kubectl apply -f deployments/rbac/apdos-rbac.yaml
+    ```
diff --git a/content/nic/_index.md b/content/nic/_index.md
new file mode 100644
index 000000000..8d93ce681
--- /dev/null
+++ b/content/nic/_index.md
@@ -0,0 +1,5 @@
+---
+title: NGINX Ingress Controller
+menu: docs
+url: /nginx-ingress-controller/
+---
diff --git a/content/nic/community.md b/content/nic/community.md
new file mode 100644
index 000000000..4a10a6083
--- /dev/null
+++ b/content/nic/community.md
@@ -0,0 +1,23 @@
+---
+title: Community and contributing
+weight: 2200
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-1447
+---
+
+There are a few ways to get involved with the F5 NGINX Ingress Controller community and contribute to the project.
+
+# Community
+
+- Our [GitHub issues page](https://github.com/nginx/kubernetes-ingress/issues) or [GitHub discussions page](https://github.com/nginx/kubernetes-ingress/discussions) offers more space for an asynchronous technical discussion.
+
+- You can can also get help through the [NGINX Community Forum](https://community.nginx.org/).
+
+# Contribute
+
+Please see our [contributing guide](https://github.com/nginx/kubernetes-ingress/blob/main/CONTRIBUTING.md) to get involved with code or documentation.
+
+# License
+
+[Apache License, Version 2.0](https://github.com/nginx/kubernetes-ingress/blob/main/LICENSE)
diff --git a/content/nic/configuration/_index.md b/content/nic/configuration/_index.md
new file mode 100644
index 000000000..5554b2f83
--- /dev/null
+++ b/content/nic/configuration/_index.md
@@ -0,0 +1,4 @@
+---
+title: Configuration
+weight: 1400
+---
diff --git a/content/nic/configuration/access-control.md b/content/nic/configuration/access-control.md
new file mode 100644
index 000000000..54fee5f91
--- /dev/null
+++ b/content/nic/configuration/access-control.md
@@ -0,0 +1,120 @@
+---
+title: Deploy a Policy for access control
+weight: 900
+toc: true
+docs: DOCS-000
+---
+
+This topic describes how to use F5 NGINX Ingress Controller to apply and update a Policy for access control. It demonstrates it using an example application and a [VirtualServer custom resource]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}).
+
+---
+
+## Before you begin
+
+You should have a [working NGINX Ingress Controller]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) instance.
+
+For ease of use in shell commands, set two shell variables:
+
+1. The public IP address for your NGINX Ingress Controller instance.
+
+```shell
+IC_IP=<ip-address>
+```
+
+2. The HTTP port of the same instance.
+
+```shell
+IC_HTTP_PORT=<port number>
+```
+
+---
+
+## Deploy the example application
+
+Create the file _webapp.yaml_ with the following contents:
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/webapp.yaml" >}}
+
+Apply it using `kubectl`:
+
+```shell
+kubectl apply -f webapp.yaml
+```
+
+---
+
+## Deploy a Policy to create a deny rule
+
+Create a file named _access-control-policy-deny.yaml_. The highlighted _deny_ field will be used by the example application, and should be changed to the subnet of your machine.
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/access-control-policy-deny.yaml" "hl_lines=7-8" >}}
+
+Apply the policy:
+
+```shell
+kubectl apply -f access-control-policy-deny.yaml
+```
+
+---
+
+## Configure load balancing
+
+Create a file named _virtual-server.yaml_ for the VirtualServer resource. The _policies_ field references the access control Policy created in the previous section.
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/virtual-server.yaml" "hl_lines=7-8" >}}
+
+Apply the policy:
+
+```shell
+kubectl apply -f virtual-server.yaml
+```
+
+---
+
+## Test the example application
+
+Use `curl` to attempt to access the application:
+
+```shell
+curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
+```
+```text
+<html>
+<head><title>403 Forbidden</title></head>
+<body>
+<center><h1>403 Forbidden</h1></center>
+</body>
+</html>
+```
+
+The *403* response is expected, successfully blocking your machine.
+
+---
+
+## Update the Policy to create an allow rule
+
+Update the Policy with the file _access-control-policy-allow.yaml_, setting the _allow_ field to the subnet of your machine.
+
+{{< ghcode "https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/custom-resources/access-control/access-control-policy-allow.yaml" "hl_lines=7-8" >}}
+
+Apply the Policy:
+
+```shell
+kubectl apply -f access-control-policy-allow.yaml
+```
+
+----
+
+## Verify the Policy update
+
+Attempt to access the application again:
+
+```shell
+curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
+```
+```text
+Server address: 10.64.0.13:8080
+Server name: webapp-5cbbc7bd78-wf85w
+```
+
+The successful response demonstrates that the policy has been updated.
diff --git a/content/nic/configuration/configuration-examples.md b/content/nic/configuration/configuration-examples.md
new file mode 100644
index 000000000..0a0e6e3bb
--- /dev/null
+++ b/content/nic/configuration/configuration-examples.md
@@ -0,0 +1,13 @@
+---
+docs: DOCS-584
+doctypes:
+- ''
+title: Configuration examples
+toc: true
+weight: 400
+---
+
+Our [GitHub repo](https://github.com/nginx/kubernetes-ingress) includes a number of configuration examples:
+
+- [*Examples of Custom Resources*](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources) show how to advanced NGINX features by using VirtualServer, VirtualServerRoute, TransportServer and Policy Custom Resources.
+- [*Examples of Ingress Resources*](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources) show how to use advanced NGINX features in Ingress resources with annotations.
diff --git a/content/nic/configuration/global-configuration/_index.md b/content/nic/configuration/global-configuration/_index.md
new file mode 100644
index 000000000..4f71e2f5f
--- /dev/null
+++ b/content/nic/configuration/global-configuration/_index.md
@@ -0,0 +1,8 @@
+---
+title: Global configuration
+description:
+weight: 100
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/configuration/global-configuration/command-line-arguments.md b/content/nic/configuration/global-configuration/command-line-arguments.md
new file mode 100644
index 000000000..79d8f3f02
--- /dev/null
+++ b/content/nic/configuration/global-configuration/command-line-arguments.md
@@ -0,0 +1,685 @@
+---
+docs: DOCS-585
+doctypes:
+- ''
+title: Command-line arguments
+toc: true
+weight: 100
+---
+
+F5 NGINX Ingress Controller supports several command-line arguments, which are set based on installation method:
+
+- If you're using *Kubernetes Manifests* to install NGINX Ingress Controller, modify the Manifests to set the command-line arguments. View the [Installation with Manifests]({{<ref "/nic/installation/installing-nic/installation-with-manifests.md">}}) topic for more information.
+- If you're using *Helm* to install NGINX Ingress Controller, modify the parameters of the Helm chart to set the command-line arguments. View the [Installation with Helm]({{<ref "/nic/installation/installing-nic/installation-with-helm.md">}}) topic for more information.
+
+<a name="cmdoption-enable-snippets"></a>
+
+### -enable-snippets
+
+Enable custom NGINX configuration snippets in Ingress, VirtualServer, VirtualServerRoute and TransportServer resources.
+
+Default `false`.
+
+<a name="cmdoption-default-server-tls-secret"></a>
+
+---
+
+### -default-server-tls-secret `<string>`
+
+Secret with a TLS certificate and key for TLS termination of the default server.
+
+- If not set, certificate and key in the file `/etc/nginx/secrets/default` are used.
+- If `/etc/nginx/secrets/default` doesn't exist, NGINX Ingress Controller will configure NGINX to reject TLS connections to the default server.
+- If a secret is set, but NGINX Ingress Controller is not able to fetch it from Kubernetes API, or it is not set and NGINX Ingress Controller fails to read the file "/etc/nginx/secrets/default", NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-wildcard-tls-secret"></a>
+
+---
+
+### -wildcard-tls-secret `<string>`
+
+A Secret with a TLS certificate and key for TLS termination of every Ingress/VirtualServer host for which TLS termination is enabled but the Secret is not specified.
+
+- If the argument is not set, for such Ingress/VirtualServer hosts NGINX will break any attempt to establish a TLS connection
+- If the argument is set, but NGINX Ingress Controller is not able to fetch the Secret from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-enable-custom-resources"></a>
+
+---
+
+### -enable-custom-resources
+
+Enables custom resources.
+
+Default `true`.
+
+
+<a name="cmdoption-enable-oidc"></a>
+
+---
+
+### -enable-oidc
+
+Enables OIDC policies.
+
+Default `false`.
+
+<a name="cmdoption-enable-leader-election"></a>
+
+---
+
+### -enable-leader-election
+
+Enables Leader election to avoid multiple replicas of the controller reporting the status of Ingress, VirtualServer and VirtualServerRoute resources -- only one replica will report status.
+Default `true`.
+
+See [-report-ingress-status](#cmdoption-report-ingress-status) flag.
+
+<a name="cmdoption-enable-tls-passthrough"></a>
+
+---
+
+### -enable-tls-passthrough
+
+Enable TLS Passthrough on port 443.
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-tls-passthrough-port"></a>
+
+---
+
+### -tls-passthrough-port `<int>`
+
+Set the port for TLS Passthrough.
+Format: `[1024 - 65535]` (default `443`)
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-enable-cert-manager"></a>
+
+---
+
+### -enable-cert-manager
+
+Enable x509 automated certificate management for VirtualServer resources using cert-manager (cert-manager.io).
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-enable-external-dns"></a>
+
+---
+
+### -enable-external-dns
+
+Enable integration with ExternalDNS for configuring public DNS entries for VirtualServer resources using [ExternalDNS](https://github.com/kubernetes-sigs/external-dns).
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+<a name="cmdoption-external-service"></a>
+
+---
+
+### -external-service `<string>`
+
+Specifies the name of the service with the type LoadBalancer through which the NGINX Ingress Controller pods are exposed externally. The external address of the service is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources.
+
+For Ingress resources only: Requires [-report-ingress-status](#cmdoption-report-ingress-status).
+
+<a name="cmdoption-ingresslink"></a>
+
+---
+
+### -ingresslink `<string>`
+
+Specifies the name of the IngressLink resource, which exposes the NGINX Ingress Controller pods via a BIG-IP system. The IP of the BIG-IP system is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources.
+
+For Ingress resources only: Requires [-report-ingress-status](#cmdoption-report-ingress-status).
+
+<a name="cmdoption-global-configuration"></a>
+
+---
+
+### -global-configuration `<string>`
+
+A GlobalConfiguration resource for global configuration of NGINX Ingress Controller.
+
+Format: `<namespace>/<name>`
+
+Requires [-enable-custom-resources](#cmdoption-enable-custom-resources).
+
+<a name="cmdoption-health-status"></a>
+
+---
+
+### -health-status
+
+Adds a location "/nginx-health" to the default server. The location responds with the 200 status code for any request.
+
+Useful for external health-checking of NGINX Ingress Controller.
+
+<a name="cmdoption-health-status-uri"></a>
+
+---
+
+### -health-status-uri `<string>`
+
+Sets the URI of health status location in the default server. Requires [-health-status](#cmdoption-health-status). (default `/nginx-health`)
+
+<a name="cmdoption-ingress-class"></a>
+
+---
+
+### -ingress-class `<string>`
+
+The `-ingress-class` argument refers to the name of the resource `kind: IngressClass`. An IngressClass resource with a name equal to the class must be deployed. Otherwise, NGINX Ingress Controller will fail to start.
+NGINX Ingress Controller will only process Ingress resources that belong to its class (Whose `ingressClassName` value matches the value of `-ingress-class`), skipping the ones without it. It will also process all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the `ingressClassName` field.
+
+Default `nginx`.
+
+<a name="cmdoption-ingress-template-path"></a>
+
+---
+
+### -ingress-template-path `<string>`
+
+Path to the ingress NGINX configuration template for an ingress resource. Default for NGINX is `nginx.ingress.tmpl`; default for NGINX Plus is `nginx-plus.ingress.tmpl`.
+
+<a name="cmdoption-leader-election-lock-name"></a>
+
+---
+
+### -leader-election-lock-name `<string>`
+
+Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election.
+
+Requires [-enable-leader-election](#cmdoption-enable-leader-election).
+
+<a name="cmdoption-log_backtrace_at"></a>
+
+---
+
+### -log_backtrace_at `<value>`
+
+When logging hits line `file:N`, emit a stack trace.
+
+<a name="cmdoption-main-template-path"></a>
+
+---
+
+### -main-template-path `<string>`
+
+Path to the main NGINX configuration template.
+
+- Default for NGINX is `nginx.tmpl`.
+- Default for NGINX Plus is `nginx-plus.tmpl`.
+
+<a name="cmdoption-nginx-configmaps"></a>
+
+---
+
+### -nginx-configmaps `<string>`
+
+A ConfigMap resource for customizing NGINX configuration. If a ConfigMap is set, but NGINX Ingress Controller is not able to fetch it from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-nginx-debug"></a>
+
+---
+
+### -mgmt-configmap `<string>`
+
+The Management ConfigMap resource is used for customizing the NGINX mgmt block. If using NGINX Plus, a Management ConfigMap must be set. If NGINX Ingress Controller is not able to fetch it from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-nginx-debug"></a>
+
+---
+
+### -nginx-debug
+
+Enable debugging for NGINX. Uses the nginx-debug binary. Requires 'error-log-level: debug' in the ConfigMap.
+
+<a name="cmdoption-nginx-plus"></a>
+
+---
+
+### -nginx-plus
+
+Enable support for NGINX Plus.
+
+<a name="cmdoption-nginx-reload-timeout"></a>
+
+---
+
+### -nginx-reload-timeout `<value>`
+
+Timeout in milliseconds which NGINX Ingress Controller will wait for a successful NGINX reload after a change or at the initial start.
+
+Default is 60000.
+
+<a name="cmdoption-nginx-status"></a>
+
+---
+
+### -nginx-status
+
+Enable the NGINX stub_status, or the NGINX Plus API.
+
+Default `true`.
+
+<a name="cmdoption-nginx-status-allow-cidrs"></a>
+
+---
+
+### -nginx-status-allow-cidrs `<string>`
+
+Add IP/CIDR blocks to the allow list for NGINX stub_status or the NGINX Plus API.
+
+Separate multiple IP/CIDR by commas. (default `127.0.0.1,::1`)
+
+<a name="cmdoption-nginx-status-port"></a>
+
+---
+
+### -nginx-status-port `<int>`
+
+Set the port where the NGINX stub_status or the NGINX Plus API is exposed.
+
+Format: `[1024 - 65535]` (default `8080`)
+
+<a name="cmdoption-proxy"></a>
+
+---
+
+### -proxy `<string>`
+
+{{< warning >}} This argument is intended for testing purposes only. {{< /warning >}}
+
+Use a proxy server to connect to Kubernetes API started with `kubectl proxy`.
+
+NGINX Ingress Controller does not start NGINX and does not write any generated NGINX configuration files to disk.
+
+<a name="cmdoption-report-ingress-status"></a>
+
+---
+
+### -report-ingress-status
+
+Updates the address field in the status of Ingress resources.
+
+Requires the [-external-service](#cmdoption-external-service) or [-ingresslink](#cmdoption-ingresslink) flag, or the `external-status-address` key in the ConfigMap.
+
+<a name="cmdoption-transportserver-template-path"></a>
+
+---
+
+### -transportserver-template-path `<string>`
+
+Path to the TransportServer NGINX configuration template for a TransportServer resource.
+
+- Default for NGINX is `nginx.transportserver.tmpl`.
+- Default for NGINX Plus is `nginx-plus.transportserver.tmpl`.
+
+<a name="cmdoption-log-level"></a>
+
+---
+
+### -log-level `<string>`
+
+Log level for Ingress Controller logs. Allowed values: fatal, error, warn, info, debug, trace.
+
+- Default is `info`.
+
+<a name="cmdoption-log-format"></a>
+
+---
+
+### -log-format `<string>`
+
+Log format for Ingress Controller logs. Allowed values: glog, json, text.
+
+- Default is `glog`.
+
+<a name="cmdoption-version"></a>
+
+---
+
+### -version
+
+Print the version, git-commit hash and build date and exit.
+
+<a name="cmdoption-virtualserver-template-path"></a>
+
+---
+
+### -virtualserver-template-path `<string>`
+
+Path to the VirtualServer NGINX configuration template for a VirtualServer resource.
+
+- Default for NGINX is `nginx.virtualserver.tmpl`.
+- Default for NGINX Plus is `nginx-plus.virtualserver.tmpl`.
+
+
+<a name="cmdoption-vmodule"></a>
+
+---
+
+### -vmodule `<value>`
+
+A comma-separated list of pattern=N settings for file-filtered logging.
+
+<a name="cmdoption-watch-namespace"></a>
+
+---
+
+### -watch-namespace `<string>`
+
+Comma separated list of namespaces NGINX Ingress Controller should watch for resources. By default NGINX Ingress Controller watches all namespaces. Mutually exclusive with "watch-namespace-label".
+
+<a name="cmdoption-watch-namespace-label"></a>
+
+---
+
+### -watch-namespace-label `<string>`
+
+Configures NGINX Ingress Controller to watch only those namespaces with label foo=bar. By default NGINX Ingress Controller watches all namespaces. Mutually exclusive with "watch-namespace".
+
+<a name="cmdoption-watch-secret-namespace"></a>
+
+---
+
+### -watch-secret-namespace `<string>`
+
+Comma separated list of namespaces NGINX Ingress Controller should watch for secrets. If this arg is not configured, NGINX Ingress Controller watches the same namespaces for all resources, see "watch-namespace" and "watch-namespace-label". All namespaces included with this argument must be part of either `-watch-namespace` or  `-watch-namespace-label`.
+
+<a name="cmdoption-enable-prometheus-metrics"></a>
+
+---
+
+### -enable-prometheus-metrics
+
+Enables exposing NGINX or NGINX Plus metrics in the Prometheus format.
+
+<a name="cmdoption-prometheus-metrics-listen-port"></a>
+
+---
+
+### -prometheus-metrics-listen-port `<int>`
+
+Sets the port where the Prometheus metrics are exposed.
+
+Format: `[1024 - 65535]` (default `9113`)
+
+<a name="cmdoption-prometheus-tls-secret"></a>
+
+---
+
+### -prometheus-tls-secret `<string>`
+
+A Secret with a TLS certificate and key for TLS termination of the Prometheus metrics endpoint.
+
+- If the argument is not set, the Prometheus endpoint will not use a TLS connection.
+- If the argument is set, but NGINX Ingress Controller is not able to fetch the Secret from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-enable-service-insight"></a>
+
+---
+
+### -enable-service-insight
+
+Exposes the Service Insight endpoint for Ingress Controller.
+
+<a name="cmdoption-service-insight-listen-port"></a>
+
+---
+
+### -service-insight-listen-port `<int>`
+
+Sets the port where the Service Insight is exposed.
+
+Format: `[1024 - 65535]` (default `9114`)
+
+<a name="cmdoption-service-insight-tls-secret"></a>
+
+---
+
+### -service-insight-tls-secret `<string>`
+
+A Secret with a TLS certificate and key for TLS termination of the Service Insight endpoint.
+
+- If the argument is not set, the Service Insight endpoint will not use a TLS connection.
+- If the argument is set, but NGINX Ingress Controller is not able to fetch the Secret from Kubernetes API, NGINX Ingress Controller will fail to start.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-spire-agent-address"></a>
+
+---
+
+### -spire-agent-address `<string>`
+
+Specifies the address of a running Spire agent. **For use with NGINX Service Mesh only**.
+
+- If the argument is set, but NGINX Ingress Controller is unable to connect to the Spire Agent, NGINX Ingress Controller will fail to start.
+
+
+<a name="cmdoption-enable-internal-routes"></a>
+
+---
+
+### -enable-internal-routes
+
+Enable support for internal routes with NGINX Service Mesh. **For use with NGINX Service Mesh only**.
+
+Requires [-spire-agent-address](#cmdoption-spire-agent-address).
+
+- If the argument is set, but `spire-agent-address` is not provided, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-enable-latency-metrics"></a>
+
+---
+
+### -enable-latency-metrics
+
+Enable collection of latency metrics for upstreams.
+Requires [-enable-prometheus-metrics](#cmdoption-enable-prometheus-metrics).
+
+<a name="cmdoption-enable-app-protect"></a>
+
+---
+
+### -enable-app-protect
+
+Enables support for App Protect.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus).
+
+- If the argument is set, but `nginx-plus` is set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-log-level"></a>
+
+---
+
+### -app-protect-log-level `<string>`
+
+Sets log level for App Protect. Allowed values: fatal, error, warn, info, debug, trace.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect](#cmdoption-enable-app-protect).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-enable-app-protect-dos"></a>
+
+---
+
+### -enable-app-protect-dos
+
+Enables support for App Protect DoS.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus).
+
+- If the argument is set, but `nginx-plus` is set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-debug"></a>
+
+---
+
+### -app-protect-dos-debug
+
+Enable debugging for App Protect DoS.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-max-daemons"></a>
+
+---
+
+### -app-protect-dos-max-daemons
+
+Max number of ADMD instances.
+
+Default `1`.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-max-workers"></a>
+
+---
+
+### -app-protect-dos-max-workers
+
+Max number of nginx processes to support.
+
+Default `Number of CPU cores in the machine`.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-app-protect-dos-memory"></a>
+
+---
+
+### -app-protect-dos-memory
+
+RAM memory size to consume in MB
+
+Default `50% of free RAM in the container or 80MB, the smaller`.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect-dos](#cmdoption-enable-app-protect-dos).
+
+- If the argument is set, but `nginx-plus` and `enable-app-protect-dos` are set to false, NGINX Ingress Controller will fail to start.
+
+<a name="cmdoption-ready-status"></a>
+
+---
+
+### -ready-status
+
+Enables the readiness endpoint `/nginx-ready`. The endpoint returns a success code when NGINX has loaded all the config after the startup.
+
+Default `true`.
+
+<a name="cmdoption-ready-status-port"></a>
+
+---
+
+### -ready-status-port
+
+The HTTP port for the readiness endpoint.
+
+Format: `[1024 - 65535]` (default `8081`)
+
+---
+
+### -disable-ipv6
+
+Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack.
+
+Default `false`.
+
+<a name="cmdoption-disable-ipv6"></a>
+
+---
+
+### -default-http-listener-port
+
+Sets the port for the HTTP `default_server` listener.
+
+Default `80`.
+
+<a name="cmdoption-default-http-listener-port"></a>
+
+---
+
+### -default-https-listener-port
+
+Sets the port for the HTTPS `default_server` listener.
+
+Default `443`.
+
+<a name="cmdoption-default-https-listener-port"></a>
+
+---
+
+### -ssl-dynamic-reload
+
+Used to activate or deactivate lazy loading for SSL Certificates.
+
+The default value is `true`.
+
+<a name="cmdoption-ssl-dynamic-reload"></a>
+
+---
+
+### -weight-changes-dynamic-reload
+
+Enables the ability to change the weight distribution of two-way split clients without reloading NGINX.
+
+Requires [-nginx-plus](#cmdoption-nginx-plus).
+
+Using this feature may require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the ConfigMap based on the number of two-way splits.
+
+The default value is `false`.
+
+- If the argument is set, but `nginx-plus` is set to false, NGINX Ingress Controller will ignore the flag.
+
+<a name="cmdoption-weight-changes-dynamic-reload"></a>
+
+---
+
+### -enable-telemetry-reporting
+
+Enable gathering and reporting of software telemetry.
+
+The default value is `true`.
+
+<a name="cmdoption-enable-telemetry-reporting"></a>
+
+---
+
+### -agent
+
+Enable NGINX Agent which can used with `-enable-app-protect` to send events to Security Monitoring.
+
+The default value is `false`.
+
+<a name="cmdoption-agent"></a>
+
+---
+
+### -agent-instance-group
+
+Specify the instance group name to use for the NGINX Ingress Controller deployment when using `-agent`.
+
+<a name="cmdoption-agent-instance-group"></a>
diff --git a/content/nic/configuration/global-configuration/configmap-resource.md b/content/nic/configuration/global-configuration/configmap-resource.md
new file mode 100644
index 000000000..711ac7065
--- /dev/null
+++ b/content/nic/configuration/global-configuration/configmap-resource.md
@@ -0,0 +1,250 @@
+---
+title: ConfigMap resources
+weight: 300
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-586
+---
+
+When using F5 NGINX Ingress Controller, you can customize or fine tune NGINX behavior using ConfigMap resources. Examples include setting the number of worker processes or customizing the access log format.
+
+## Using ConfigMap
+
+1. The [Installation with Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) documentation deploy an empty ConfigMap while the default installation manifests specify it in the command-line arguments of the Ingress Controller. However, if you customized the manifests, to use ConfigMap, make sure to specify the ConfigMap resource to use the [command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) of NGINX Ingress Controller.
+
+1. Create a ConfigMap file with the name *nginx-config.yaml* and set the values
+that make sense for your setup:
+
+    ```yaml
+    kind: ConfigMap
+    apiVersion: v1
+    metadata:
+      name: nginx-config
+      namespace: nginx-ingress
+    data:
+      proxy-connect-timeout: "10s"
+      proxy-read-timeout: "10s"
+      client-max-body-size: "2m"
+    ```
+
+    See the section [Summary of ConfigMap Keys](#summary-of-configmap-keys) for the explanation of the available ConfigMap keys (such as `proxy-connect-timeout` in this example).
+
+1. Create a new (or update the existing) ConfigMap resource:
+
+    ```shell
+    kubectl apply -f nginx-config.yaml
+    ```
+
+    The NGINX configuration will be updated.
+
+---
+
+## ConfigMap and Ingress annotations
+
+ConfigMap applies globally, meaning that it affects every Ingress resource. In contrast, annotations always apply to their Ingress resource. Annotations can override some ConfigMap keys: an example is that the `nginx.org/proxy-connect-timeout` annotations overrides the `proxy-connect-timeout` ConfigMap key.
+
+For more information, view the [Advanced configuration with annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations" >}}) topic.
+
+---
+
+## ConfigMap and VirtualServer/VirtualServerRoute resources
+
+The ConfigMap affects every VirtualServer and VirtualServerRoute resources. However, the fields of those resources allow overriding some ConfigMap keys. For example, the `connect-timeout` field of the `upstream` overrides the `proxy-connect-timeout` ConfigMap key.
+
+For more information, view the [VirtualServer and VirtualServerRoute resources]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources" >}}) topic.
+
+---
+
+## ConfigMap keys
+
+### Ingress Controller (Unrelated to NGINX Configuration)
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*external-status-address* | Sets the address to be reported in the status of Ingress resources. Requires the *-report-status* command-line argument. Overrides the *-external-service* argument. | N/A | [Reporting resource status]({{< ref "/nic/configuration/global-configuration/reporting-resources-status" >}}) |
+{{</bootstrap-table>}}
+
+---
+
+### General customization
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*proxy-connect-timeout* | Sets the value of the [proxy_connect_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) and [grpc_connect_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_connect_timeout) directive. | *60s* |  |
+|*proxy-read-timeout* | Sets the value of the [proxy_read_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) and [grpc_read_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_read_timeout) directive. | *60s* |  |
+|*proxy-send-timeout* | Sets the value of the [proxy_send_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) and [grpc_send_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_send_timeout) directive. | *60s* |  |
+|*client-max-body-size* | Sets the value of the [client_max_body_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size) directive. | *1m* |  |
+|*proxy-buffering* | Enables or disables [buffering of responses](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) from the proxied server. | *True* |  |
+|*proxy-buffers* | Sets the value of the [proxy_buffers](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) directive. | Depends on the platform. |  |
+|*proxy-buffer-size* | Sets the value of the [proxy_buffer_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) and [grpc_buffer_size](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_buffer_size) directives. | Depends on the platform. |  |
+|*proxy-max-temp-file-size* | Sets the value of the  [proxy_max_temp_file_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_max_temp_file_size) directive. | *1024m* |  |
+|*set-real-ip-from* | Sets the value of the [set_real_ip_from](https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from) directive. | N/A |  |
+|*real-ip-header* | Sets the value of the [real_ip_header](https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header) directive. | *X-Real-IP* |  |
+|*real-ip-recursive* | Enables or disables the [real_ip_recursive](https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive) directive. | *False* |  |
+|*default-server-return* | Configures the [return](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return)  directive in the default server, which handles a client request if none of the hosts of Ingress or VirtualServer resources match. The default value configures NGINX to return a 404 error page. You can configure a fixed response or a redirect. For example, *default-server-return: 302 https://nginx.org* will redirect a client to *https://nginx.org*. | *404* |  |
+|*server-tokens* | Enables or disables the [server_tokens](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens) directive. Additionally, with the NGINX Plus, you can specify a custom string value, including the empty string value, which disables the emission of the “Server” field. | *True* |  |
+|*worker-processes* | Sets the value of the [worker_processes](https://nginx.org/en/docs/ngx_core_module.html#worker_processes) directive. | *auto* |  |
+|*worker-rlimit-nofile* | Sets the value of the [worker_rlimit_nofile](https://nginx.org/en/docs/ngx_core_module.html#worker_rlimit_nofile) directive. | N/A |  |
+|*worker-connections* | Sets the value of the [worker_connections](https://nginx.org/en/docs/ngx_core_module.html#worker_connections) directive. | *1024* |  |
+|*worker-cpu-affinity* | Sets the value of the [worker_cpu_affinity](https://nginx.org/en/docs/ngx_core_module.html#worker_cpu_affinity) directive. | N/A |  |
+|*worker-shutdown-timeout* | Sets the value of the [worker_shutdown_timeout](https://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout) directive. | N/A |  |
+|*server-names-hash-bucket-size* | Sets the value of the [server_names_hash_bucket_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size) directive. | *256* |  |
+|*server-names-hash-max-size* | Sets the value of the [server_names_hash_max_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size) directive. | *1024* |  |
+|*map-hash-bucket-size* | Sets the value of the [map_hash_bucket_size](http://nginx.org/en/docs/http/ngx_http_map_module.html#map_hash_bucket_size) directive.| *256* |  |
+|*map-hash-max-size* | Sets the value of the [map_hash_max_size](http://nginx.org/en/docs/http/ngx_http_map_module.html#map_hash_max_size) directive. | *2048* |  |
+|*resolver-addresses* | Sets the value of the [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) addresses. Note: If you use a DNS name (for example, *kube-dns.kube-system.svc.cluster.local* ) as a resolver address, NGINX Plus will resolve it using the system resolver during the start and on every configuration reload. If the name cannot be resolved or the DNS server doesn't respond, NGINX Plus will fail to start or reload. To avoid this, we recommend using IP addresses as resolver addresses instead of DNS names. Supported in NGINX Plus only. | N/A | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*resolver-ipv6* | Enables IPv6 resolution in the resolver. Supported in NGINX Plus only. | *True* | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*resolver-valid* | Sets the time NGINX caches the resolved DNS records. Supported in NGINX Plus only. | TTL value of a DNS record | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*resolver-timeout* | Sets the [resolver_timeout](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver_timeout) for name resolution. Supported in NGINX Plus only. | *30s* | [Support for Type ExternalName Services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services). |
+|*keepalive-timeout* | Sets the value of the [keepalive_timeout](https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) directive. | *75s* |  |
+|*keepalive-requests* | Sets the value of the [keepalive_requests](https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests) directive. | *1000* |  |
+|*variables-hash-bucket-size* | Sets the value of the [variables_hash_bucket_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#variables_hash_bucket_size) directive. | *256* |  |
+|*variables-hash-max-size* | Sets the value of the [variables-hash-max-size](https://nginx.org/en/docs/http/ngx_http_core_module.html#variables_hash_max_size) directive. | *1024* |  |
+{{</bootstrap-table>}}
+
+---
+
+### Logging
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*error-log-level* | Sets the global [error log level](https://nginx.org/en/docs/ngx_core_module.html#error_log) for NGINX. | *notice* |  |
+|*access-log* | Sets the directive [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log). A syslog destination is the only valid value. The value will be set to its default in-case user tries to configure it with location other than a syslog.
+| ``/dev/stdout main`` | ``syslog:server=localhost:514`` |
+|*access-log-off* | Disables the [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log). | *False* |  |
+|*default-server-access-log-off* | Disables the [access log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log) for the default server. If access log is disabled globally (*access-log-off: "True"*), then the default server access log is always disabled. | *False* |  |
+|*log-format* | Sets the custom [log format](https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) for HTTP and HTTPS traffic. For convenience, it is possible to define the log format across multiple lines (each line separated by *\n*). In that case, the Ingress Controller will replace every *\n* character with a space character. All *'* characters must be escaped. | See the [template file](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx.tmpl) for the access log. | [Custom Log Format](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/shared-examples/custom-log-format). |
+|*log-format-escaping* | Sets the characters escaping for the variables of the log format. Supported values: *json* (JSON escaping), *default* (the default escaping) *none* (disables escaping). | *default* |  |
+|*stream-log-format* | Sets the custom [log format](https://nginx.org/en/docs/stream/ngx_stream_log_module.html#log_format) for TCP, UDP, and TLS Passthrough traffic. For convenience, it is possible to define the log format across multiple lines (each line separated by *\n*). In that case, the Ingress Controller will replace every *\n* character with a space character. All *'* characters must be escaped. | See the [template file](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx.tmpl). |  |
+|*stream-log-format-escaping* | Sets the characters escaping for the variables of the stream log format. Supported values: *json* (JSON escaping), *default* (the default escaping) *none* (disables escaping). | *default* |  |
+{{</bootstrap-table>}}
+
+---
+
+### Request URI/Header manipulation
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*proxy-hide-headers* | Sets the value of one or more  [proxy_hide_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directives. Example: *"nginx.org/proxy-hide-headers": "header-a,header-b"* | N/A |  |
+|*proxy-pass-headers* | Sets the value of one or more   [proxy_pass_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header) directives. Example: *"nginx.org/proxy-pass-headers": "header-a,header-b"* | N/A |  |
+{{</bootstrap-table>}}
+
+---
+
+### Auth and SSL/TLS
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*redirect-to-https* | Sets the 301 redirect rule based on the value of the *http_x_forwarded_proto* header on the server block to force incoming traffic to be over HTTPS. Useful when terminating SSL in a load balancer in front of the Ingress Controller — see [115](https://github.com/nginx/kubernetes-ingress/issues/115) | *False* |  |
+|*ssl-redirect* | Sets an unconditional 301 redirect rule for all incoming HTTP traffic to force incoming traffic over HTTPS. | *True* |  |
+|*hsts* | Enables [HTTP Strict Transport Security (HSTS)](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/) : the HSTS header is added to the responses from backends. The *preload* directive is included in the header. | *False* |  |
+|*hsts-max-age* | Sets the value of the *max-age* directive of the HSTS header. | *2592000* (1 month) |  |
+|*hsts-include-subdomains* | Adds the *includeSubDomains* directive to the HSTS header. | *False* |  |
+|*hsts-behind-proxy* | Enables HSTS based on the value of the *http_x_forwarded_proto* request header. Should only be used when TLS termination is configured in a load balancer (proxy) in front of the Ingress Controller. Note: to control redirection from HTTP to HTTPS configure the *nginx.org/redirect-to-https* annotation. | *False* |  |
+|*ssl-protocols* | Sets the value of the [ssl_protocols](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) directive. | *TLSv1 TLSv1.1 TLSv1.2* |  |
+|*ssl-prefer-server-ciphers* | Enables or disables the [ssl_prefer_server_ciphers](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) directive. | *False* |  |
+|*ssl-ciphers* | Sets the value of the [ssl_ciphers](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers) directive. | *HIGH:!aNULL:!MD5* |  |
+|*ssl-dhparam-file* | Sets the content of the dhparam file. The controller will create the file and set the value of the [ssl_dhparam](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) directive with the path of the file. | N/A |  |
+{{</bootstrap-table>}}
+
+---
+
+### Listeners
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*http2* | Enables HTTP/2 in servers with SSL enabled. | *False* |  |
+|*proxy-protocol* | Enables PROXY Protocol for incoming connections. | *False* | [Proxy Protocol](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/shared-examples/proxy-protocol). |
+{{</bootstrap-table>}}
+
+---
+
+### Backend services (Upstreams)
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*lb-method* | Sets the [load balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify *"round_robin"*. | *"random two least_conn"* |  |
+|*max-fails* | Sets the value of the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the *server* directive. | *1* |  |
+|*upstream-zone-size* | Sets the size of the shared memory [zone](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone) for upstreams. For NGINX, the special value 0 disables the shared memory zones. For NGINX Plus, shared memory zones are required and cannot be disabled. The special value 0 will be ignored. | *256k* for NGINX, *512k* for NGINX Plus  |  |
+|*fail-timeout* | Sets the value of the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the *server* directive. | *10s* |  |
+|*keepalive* | Sets the value of the [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) directive. Note that *proxy_set_header Connection "";* is added to the generated configuration when the value > 0. | *0* |  |
+{{</bootstrap-table>}}
+
+---
+
+### Zone Sync
+
+Zone Sync enables the [ngx_stream_zone_sync_module](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html) in NGINX Ingress Controller when NGINX Plus is used.  Multiple replicas are required to effectively utililise this functionality. More information is available in the [How NGINX Plus Performs Zone Synchronization](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync_details/) topic.
+
+Zone synchronization with TLS for NGINX Ingress Controller is not yet available with ConfigMap. If you would like to enable Zone Sync with TLS, please remove `zone-sync` from ConfigMap and add Zone Sync parameters via [`stream-snippets`]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) similar to [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-config.yaml) and adding the [zone_sync_ssl directive](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_ssl) along with any other TLS parameters to the `stream-snippets`. 
+
+You will also need to manually add the headless service, such as in [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml).
+
+{{< caution >}} 
+If you previously installed OIDC or used the `zone_sync` directive with `stream-snippets` in [v4.0.1](https://github.com/nginx/kubernetes-ingress/tree/v4.0.1) or earlier, and you plan to enable the `zone-sync` ConfigMap key, the `zone_sync` directive should be removed from `stream-snippets`. 
+
+If you encounter the error `error [emerg] 13#13: "zone_sync" directive is duplicate in /etc/nginx/nginx.conf:164` it is likely due to `zone_sync` being enabled in both `stream-snippets` and the ConfigMap. Once upgraded, remove the [old headless service](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml) deployed for OIDC.
+{{< /caution >}}
+
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*zone-sync* | Enables zone synchronization between NGINX Ingress Controller Pods. This autogenerates a [zone_sync_server](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_server) and a headless service using the `ReplicaSet` or `DaemonSet` name. Please note that this headless service will be automatically cleaned up when uninstalling via Helm or by removing the value from the ConfigMap. The headless service will need to be manually removed if the `controller.customConfigMap` value is set via Helm or the deployment is uninstalled via Manifests. Each Ingress Controller manages its own headless service.  NGINX Plus Required. | *False* |  |
+|*zone-sync-port* | Specifies the optional port on which NGINX Ingress Controller listens for zone sync traffic. NGINX Plus & `zone-sync` Required. | *12345* |  |
+|*zone-sync-resolver-addresses* | Configures optional addresses used in the [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) directive for zone-sync. This field takes a comma separated list of addresses. NGINX Plus & `zone-sync` Required | `kube-dns.kube-system.svc.cluster.local` |  |
+|*zone-sync-resolver-ipv6* | Configures whether the optional [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) directive for zone-sync will look up IPv6 addresses. NGINX Plus & `zone-sync` Required | `true` |  |
+|*zone-sync-resolver-valid* | Configures an [NGINX time](https://nginx.org/en/docs/syntax.html) that the optional [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) directive for zone-sync will override the TTL value of responses from nameservers with. NGINX Plus & `zone-sync` Required | `5s` |  |
+{{</bootstrap-table>}}
+
+---
+
+### Snippets and custom templates
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*main-snippets* | Sets a custom snippet in main context. | N/A |  |
+|*http-snippets* | Sets a custom snippet in http context. | N/A |  |
+|*location-snippets* | Sets a custom snippet in location context. | N/A |  |
+|*server-snippets* | Sets a custom snippet in server context. | N/A |  |
+|*stream-snippets* | Sets a custom snippet in stream context. | N/A | [Support for TCP/UDP Load Balancing](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/tcp-udp). |
+|*main-template* | Sets the main NGINX configuration template. | By default the template is read from the file in the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+|*ingress-template* | Sets the NGINX configuration template for an Ingress resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+|*virtualserver-template* | Sets the NGINX configuration template for an VirtualServer resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+|*transportserver-template* | Sets the NGINX configuration template for a TransportServer resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+{{</bootstrap-table>}}
+
+---
+
+### Modules
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| --- |
+|*otel-exporter-endpoint* | OTLP/gRPC endpoint that will accept [OpenTelemetry](https://opentelemetry.io) data. Set `otel-trace-in-http` to *"true"* to enable OpenTelemetry at the global level. | N/A | *"https://otel-collector:4317"* |
+|*otel-exporter-header-name* | The name of a custom HTTP header to add to telemetry export request. `otel-exporter-endpoint` and `otel-exporter-header-value` required. | N/A | *"X-custom-header"* |
+|*otel-exporter-header-value* | The value of a custom HTTP header to add to telemetry export request. `otel-exporter-endpoint` and `otel-exporter-header-name` required. | N/A | *"custom-value"* |
+|*otel-service-name* | Sets the `service.name` attribute of the OTel resource. `otel-exporter-endpoint` required. | N/A | *"nginx-ingress-controller:nginx"* |
+| *otel-trace-in-http* | Enables [OpenTelemetry](https://opentelemetry.io) globally (for all Ingress, VirtualServer and VirtualServerRoute resources). Set this to *"false"* to enable OpenTelemetry for individual routes with snippets. `otel-exporter-endpoint` required. | *"false"* | *"true"* |
+|*opentracing* | Removed in v5.0.0.  Enables [OpenTracing](https://opentracing.io) globally (for all Ingress, VirtualServer and VirtualServerRoute resources). Note: requires the Ingress Controller image with OpenTracing module and a tracer. See the [docs]({{< ref "/nic/installation/integrations/opentracing.md" >}}) for more information. | *False* |  |
+|*opentracing-tracer* | Removed in v5.0.0.  Sets the path to the vendor tracer binary plugin. | N/A |  |
+|*opentracing-tracer-config* | Removed in v5.0.0.  Sets the tracer configuration in JSON format. | N/A |  |
+|*app-protect-compressed-requests-action* | Sets the *app_protect_compressed_requests_action* [global directive](/nginx-app-protect/configuration/#global-directives). | *drop* |  |
+|*app-protect-cookie-seed* | Sets the *app_protect_cookie_seed* [global directive](/nginx-app-protect/configuration/#global-directives). | Random automatically generated string |  |
+|*app-protect-failure-mode-action* | Sets the *app_protect_failure_mode_action* [global directive](/nginx-app-protect/configuration/#global-directives). | *pass* |  |
+|*app-protect-cpu-thresholds* | Sets the *app_protect_cpu_thresholds* [global directive](/nginx-app-protect/configuration/#global-directives). | *high=100 low=100* |  |
+|*app-protect-physical-memory-util-thresholds* | Sets the *app_protect_physical_memory_util_thresholds* [global directive](/nginx-app-protect/configuration/#global-directives). | *high=100 low=100* |  |
+|`app-protect-reconnect-period-seconds` | Sets the `app_protect_reconnect_period_seconds` [global directive](/nginx-app-protect/configuration/#global-directives). | `5` |  |
+|*app-protect-dos-log-format* | Sets the custom [log format](https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) for Dos Access log traffic. For convenience, it is possible to define the log format across multiple lines (each line separated by *\n*). In that case, the Ingress Controller will replace every *\n* character with a space character. All *'* characters must be escaped. | `, vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, policy_name=$app_protect_dos_policy_name, dos_version=$app_protect_dos_version, ip_tls=$remote_addr:$app_protect_dos_tls_fp,` | |
+|*app-protect-dos-log-format-escaping* | Sets the characters escaping for the variables of the stream log format. Supported values: *json* (JSON escaping), *default* (the default escaping) *none* (disables escaping). | *default* |  |
+|*app-protect-dos-arb-fqdn* | Sets the *app-protect-dos-arb-fqdn* [directive](/nginx-app-protect-dos/directives-and-policy/learn-about-directives-and-policy/#arbitrator-fqdn-directive-app_protect_dos_arb_fqdn). | *svc-appprotect-dos-arb* |  |
+{{</bootstrap-table>}}
diff --git a/content/nic/configuration/global-configuration/custom-templates.md b/content/nic/configuration/global-configuration/custom-templates.md
new file mode 100644
index 000000000..589ce5951
--- /dev/null
+++ b/content/nic/configuration/global-configuration/custom-templates.md
@@ -0,0 +1,11 @@
+---
+docs: DOCS-587
+doctypes:
+- ''
+title: Custom templates
+toc: true
+weight: 500
+---
+
+
+F5 NGINX Ingress Controller uses templates to generate NGINX configuration for Ingress resources, VirtualServer resources and the main NGINX configuration file. You can customize the templates and apply them via the ConfigMap. See the [corresponding example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/shared-examples/custom-templates).
diff --git a/content/nic/configuration/global-configuration/globalconfiguration-resource.md b/content/nic/configuration/global-configuration/globalconfiguration-resource.md
new file mode 100644
index 000000000..84b4e4002
--- /dev/null
+++ b/content/nic/configuration/global-configuration/globalconfiguration-resource.md
@@ -0,0 +1,183 @@
+---
+docs: DOCS-588
+doctypes:
+- ''
+title: GlobalConfiguration resource
+toc: true
+weight: 200
+---
+
+This page explains how to use the GlobalConfiguration resource to define the global configuration parameters of F5 NGINX Ingress Controller.
+
+The resource supports configuring listeners for TCP and UDP load balancing, and is implemented as a [Custom resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+Listeners are required by [TransportServer resources]({{< ref "/nic/configuration/transportserver-resource.md" >}}) and can be used to [configure custom listeners for VirtualServers]({{< ref "/nic/tutorials/virtual-server-with-custom-listener-ports.md" >}}).
+
+---
+
+## Prerequisites
+
+When [installing NGINX Ingress Controller using Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), you need to reference a GlobalConfiguration resource in the [`-global-configuration`](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments#cmdoption-global-configuration) command-line argument. NGINX Ingress Controller only needs one GlobalConfiguration resource.
+
+---
+
+## GlobalConfiguration specification
+
+The GlobalConfiguration resource defines the global configuration parameters of the Ingress Controller. Below is an example:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: GlobalConfiguration
+metadata:
+  name: nginx-configuration
+  namespace: nginx-ingress
+spec:
+  listeners:
+  - name: dns-udp
+    port: 5353
+    protocol: UDP
+  - name: dns-tcp
+    port: 5353
+    protocol: TCP
+  - name: http-8083
+    port: 8083
+    protocol: HTTP
+  - name: https-8443
+    port: 8443
+    protocol: HTTP
+    ssl: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+| *listeners* | A list of listeners. | [listener](#listener) | No |
+{{</bootstrap-table>}}
+
+### Listener
+
+The `listeners:` key defines a listener (a combination of a protocol and a port) that NGINX will use to accept traffic for a [TransportServer]({{< ref "/nic/configuration/transportserver-resource.md" >}})  and a [VirtualServer]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}):
+
+```yaml
+- name: dns-tcp
+  port: 5353
+  protocol: TCP
+- name: http-8083
+  port: 8083
+  protocol: HTTP
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+| *name* | The name of the listener. Must be a valid DNS label as defined in RFC 1035. For example, ``hello`` and ``listener-123`` are valid. The name must be unique among all listeners. The name ``tls-passthrough`` is reserved for the built-in TLS Passthrough listener and cannot be used. | *string* | Yes |
+| *port* | The port of the listener. The port must fall into the range ``1..65535`` with the following exceptions: ``80``, ``443``, the [status port](/nginx-ingress-controller/logging-and-monitoring/status-page), the [Prometheus metrics port](/nginx-ingress-controller/logging-and-monitoring/prometheus). Among all listeners, only a single combination of a port-protocol is allowed. | *int* | Yes |
+| *protocol* | The protocol of the listener. Supported values: ``TCP``, ``UDP`` and ``HTTP``. | *string* | Yes |
+| *ssl* | Configures the listener with SSL. This is currently only supported for ``HTTP`` listeners. Default value is ``false`` | *bool* | No |
+| *ipv4* | Specifies the IPv4 address to listen on. | *string* | No |
+| *ipv6* | Specifies the IPv6 address to listen on. | *string* | No |
+
+{{</bootstrap-table>}}
+
+---
+
+## Using GlobalConfiguration
+
+You can use the usual `kubectl` commands to work with a GlobalConfiguration resource.
+
+For example, the following command creates a GlobalConfiguration resource defined in `global-configuration.yaml` with the name `nginx-configuration`:
+
+```shell
+kubectl apply -f global-configuration.yaml
+```
+```shell
+globalconfiguration.k8s.nginx.org/nginx-configuration created
+```
+
+Assuming the namespace of the resource is `nginx-ingress`, you can get the resource by running:
+
+```shell
+kubectl get globalconfiguration nginx-configuration -n nginx-ingress
+```
+```shell
+NAME                  AGE
+nginx-configuration   13s
+```
+
+With `kubectl get` and similar commands, you can use the short name `gc` instead of `globalconfiguration`.
+
+---
+
+### Validation
+
+Two types of validation are available for the GlobalConfiguration resource:
+
+- *Structural validation* by `kubectl` and Kubernetes API server.
+- *Comprehensive validation* by NGINX Ingress Controller.
+
+
+#### Structural validation
+
+The custom resource definition for the GlobalConfiguration includes structural OpenAPI schema which describes the type of every field of the resource.
+
+If you try to create (or update) a resource that violates the structural schema (for example, you use a string value for the port field of a listener), `kubectl` and Kubernetes API server will reject such a resource:
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f global-configuration.yaml
+    ```
+    ```text
+    error: error validating "global-configuration.yaml": error validating data: ValidationError(GlobalConfiguration.spec.listeners[0].port): invalid type for org.nginx.k8s.v1.GlobalConfiguration.spec.listeners.port: got "string", expected "integer"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f global-configuration.yaml --validate=false
+    ```
+    ```text
+    The GlobalConfiguration "nginx-configuration" is invalid: []: Invalid value: map[string]interface {}{ ... }: validation failure list:
+    spec.listeners.port in body must be of type integer: "string"
+    ```
+
+If a resource is not rejected (it doesn't violate the structural schema), NGINX Ingress Controller will validate it further.
+
+#### Comprehensive validation
+
+NGINX Ingress Controller validates the fields of a GlobalConfiguration resource. If a GlobalConfiguration resource is partially invalid, NGINX Ingress Controller use the valid listeners and emit events about invalid listeners.
+
+You can check if the Ingress Controller successfully applied the configuration for a GlobalConfiguration. For our  `nginx-configuration` GlobalConfiguration, we can run:
+
+```shell
+kubectl describe gc nginx-configuration -n nginx-ingress
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Normal   Updated   11s   nginx-ingress-controller  GlobalConfiguration nginx-ingress/nginx-configuration was updated
+```
+
+The events section includes a Normal event with the Updated reason that informs us that the configuration was successfully applied.
+
+If you create a GlobalConfiguration `nginx-configuration` with two or more listeners that have the same protocol UDP and port 53, you will get:
+
+```shell
+kubectl describe gc nginx-configuration -n nginx-ingress
+```
+```text
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Normal   Updated   55s   nginx-ingress-controller  GlobalConfiguration nginx-ingress/nginx-configuration was updated
+  Warning  AddedOrUpdatedWithError  6s    nginx-ingress-controller  GlobalConfiguration nginx-ingress/nginx-configuration is invalid and was rejected: spec.listeners: Duplicate value: "Duplicated port/protocol combination 53/UDP"
+```
+
+The events section includes a Warning event with the AddedOrUpdatedWithError reason.
+
+
+## Using IPV4 and IPV6 Addresses with GlobalConfiguration
+
+You can customize the IPv4 and IPv6 Address listeners in the global configuration and apply them to your VirtualServer resources. See the corresponding example [here](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/custom-ip-listeners/virtualserver/)
diff --git a/content/nic/configuration/global-configuration/mgmt-configmap-resource.md b/content/nic/configuration/global-configuration/mgmt-configmap-resource.md
new file mode 100644
index 000000000..e1d9a120c
--- /dev/null
+++ b/content/nic/configuration/global-configuration/mgmt-configmap-resource.md
@@ -0,0 +1,50 @@
+---
+docs: DOCS-586
+doctypes:
+- ''
+title: Management ConfigMap resource
+toc: true
+weight: 300
+---
+
+When using F5 NGINX Ingress Controller with NGINX Plus, it is required to pass a [command line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) to NGINX Ingress Controller, `--mgmt-configmap=<namespace/name>` which specifies the ConfigMap to use. The minimal required ConfigMap must have a `license-token-secret-name` key. Helm users will not need to create this map or pass the argument, it will be created with a Helm install. 
+
+---
+
+1. Create a ConfigMap file with the name *nginx-config-mgmt.yaml* and set the values
+that make sense for your setup:
+
+    ```yaml
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: nginx-config-mgmt
+      namespace: nginx-ingress
+    data:
+      license-token-secret-name: "license-token"
+    ```
+1. Create a new (or update the existing) ConfigMap resource:
+
+    ```shell
+    kubectl apply -f nginx-config-mgmt.yaml
+    ```
+
+    The [NGINX Management](https://nginx.org/en/docs/ngx_mgmt_module.html) block configuration will be updated.
+---
+## Management ConfigMap keys
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|ConfigMap Key | Description | Default |
+| ---| ---| ---|
+|*license-token-secret-name* | Configures the secret used in the [license_token](https://nginx.org/en/docs/ngx_mgmt_module.html#license_token) directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.com/license` with the base64 encoded JWT in the `license.jwt` key.  | N/A |
+|*ssl-verify* | Configures the [ssl_verify](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_verify) directive, which enables or disables verification of the usage reporting endpoint certificate. | `true` |
+|*enforce-initial-report* | Configures the [enforce_initial_report](https://nginx.org/en/docs/ngx_mgmt_module.html#enforce_initial_report) directive, which enables or disables the 180-day grace period for sending the initial usage report. | `false` |
+|*usage-report-endpoint* | Configures the endpoint of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This is used to configure the endpoint NGINX uses to send usage reports to NIM. | `product.connect.nginx.com` |
+|*usage-report-interval* | Configures the interval of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This specifies the frequency that usage reports are sent. This field takes an [NGINX time](https://nginx.org/en/docs/syntax.html). | `1h` |
+|*usage-report-proxy-host* | Configures the host name of the [proxy](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy) directive with optional port. | N/A |
+|*ssl-trusted-certificate-secret-name* | Configures the secret used to create the file(s) referenced the in [ssl_trusted_certifcate](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_trusted_certificate), and [ssl_crl](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.org/ca`, where the `ca.crt` key contains a base64 encoded trusted cert, and the optional `ca.crl` key can contain a base64 encoded CRL. If the optional `ca.crl` key is supplied, it will configure the NGINX `ssl_crl` directive. | N/A |
+|*ssl-certificate-secret-name* | Configures the secret used to create the `ssl_certificate` and `ssl_certificate_key` directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `kubernetes.io/tls`| N/A |
+|*resolver-addresses* | Configures addresses used in the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive. This field takes a comma separated list of addresses. | N/A |
+|*resolver-ipv6* | Configures whether the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will look up IPv6 addresses. | `true` |
+|*resolver-valid* | Configures an [NGINX time](https://nginx.org/en/docs/syntax.html) that the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will override the TTL value of responses from nameservers with. | N/A |
+{{</bootstrap-table>}}
diff --git a/content/nic/configuration/global-configuration/reporting-resources-status.md b/content/nic/configuration/global-configuration/reporting-resources-status.md
new file mode 100644
index 000000000..8e36733eb
--- /dev/null
+++ b/content/nic/configuration/global-configuration/reporting-resources-status.md
@@ -0,0 +1,195 @@
+---
+docs: DOCS-589
+doctypes:
+- ''
+title: Reporting resource status
+toc: true
+weight: 600
+---
+
+This page describes how to view the status of resources managed by F5 NGINX Ingress Controller.
+
+## Ingress resources
+
+An Ingress resource status includes the address (an IP address or a DNS name), through which the hosts of that Ingress resource are publicly accessible.
+
+You can see the address in the output of the `kubectl get ingress` command, in the ADDRESS column, as shown below:
+
+```shell
+kubectl get ingresses
+```
+```text
+NAME           HOSTS              ADDRESS           PORTS     AGE
+cafe-ingress   cafe.example.com   12.13.23.123      80, 443   2m
+```
+
+NGINX Ingress Controller must be configured to report an Ingress status:
+
+1. Use the command-line flag `-report-ingress-status`.
+1. Define a source for an external address. This can be either of:
+    1. A user defined address, specified in the `external-status-address` ConfigMap key.
+    1. A Service of the type LoadBalancer configured with an external IP or address and specified by the `-external-service` command-line flag.
+
+View the [ConfigMap keys](/nginx-ingress-controller/configuration/global-configuration/configmap-resource) and [Command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) topics for more information.
+
+{{< note >}} NGINX Ingress Controller does not clear the status of Ingress resources when it is being shut down. {{< /note >}}
+
+## VirtualServer and VirtualServerRoute resources
+
+A VirtualServer or VirtualServerRoute resource includes the status field with information about the state of the resource and the IP address, through which the hosts of that resource are publicly accessible.
+
+You can see the status in the output of the `kubectl get virtualservers` or `kubectl get virtualserverroutes` commands as shown below:
+
+```shell
+kubectl get virtualservers
+```
+```text
+  NAME   STATE   HOST                   IP            PORTS      AGE
+  cafe   Valid   cafe.example.com       12.13.23.123  [80,443]   34s
+```
+
+To see an external hostname address associated with a VirtualServer resource, use the `-o wide` option:
+
+```shell
+kubectl get virtualservers -o wide
+```
+```text
+  NAME   STATE   HOST               IP    EXTERNALHOSTNAME                                                         PORTS      AGE
+  cafe   Valid   cafe.example.com         ae430f41a1a0042908655abcdefghijkl-12345678.eu-west-2.elb.amazonaws.com   [80,443]   106s
+```
+
+{{< note >}} If there are multiple addresses, only the first one is shown. {{< /note >}}
+
+In order to see additional addresses or extra information about the `Status` of the resource, use the following command:
+
+```shell
+kubectl describe virtualserver <NAME>
+```
+```text
+...
+Status:
+  External Endpoints:
+    Ip:        12.13.23.123
+    Ports:     [80,443]
+  Message:  Configuration for cafe/cafe was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+```
+
+### Status specification
+
+The following fields are reported in both VirtualServer and VirtualServerRoute status:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+|*State* | Current state of the resource. Can be ``Valid``, ``Warning`` an ``Invalid``. For more information, refer to the ``message`` field. | *string* |
+|*Reason* | The reason of the last update. | *string* |
+|*Message* | Additional information about the state. | *string* |
+|*ExternalEndpoints* | A list of external endpoints for which the hosts of the resource are publicly accessible. | *[externalEndpoint](#externalendpoint)* |
+{{</bootstrap-table>}}
+
+The *ReferencedBy* field is reported for the VirtualServerRoute status only:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+| *ReferencedBy* | The VirtualServer that references this VirtualServerRoute. Format as ``namespace/name`` | *string* |
+{{</bootstrap-table>}}
+
+### externalEndpoint
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+|``IP`` | The external IP address. | ``string`` |
+|``Hostname`` | The external LoadBalancer Hostname address. | ``string`` |
+|``Ports`` | A list of external ports. | ``string`` |
+{{</bootstrap-table>}}
+
+NGINX Ingress Controller must be configured to report a VirtualServer or VirtualServerRoute status:
+
+1. If you want NGINX Ingress Controller to report the `externalEndpoints`, define a source for an external address (The rest of the fields will be reported without the external address configured). This can be:
+    1. A user defined address, specified in the `external-status-address` ConfigMap key.
+    1. A Service of the type LoadBalancer configured with an external IP or address and specified by the `-external-service` command-line flag.
+
+View the [ConfigMap keys](/nginx-ingress-controller/configuration/global-configuration/configmap-resource) and [Command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) topics for more information.
+
+{{< note >}} NGINX Ingress Controller does not clear the status of VirtualServer and VirtualServerRoute resources when it is being shut down. {{< /note >}}
+
+## Policy resources
+
+A Policy resource includes the status field with information about the state of the resource.
+
+You can see the status in the output of the `kubectl get policy` command as shown below:
+
+```shell
+kubectl get policy
+```
+```text
+  NAME              STATE   AGE
+  webapp-policy     Valid   30s
+```
+
+In order to see additional addresses or extra information about the `Status` of the resource, use the following command:
+
+```shell
+kubectl describe policy <NAME>
+```
+```text
+...
+Status:
+  Message:  Configuration for default/webapp-policy was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+```
+
+### Status specification
+
+The following fields are reported in Policy status:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+|``State`` | Current state of the resource. Can be ``Valid`` or ``Invalid``. For more information, refer to the ``message`` field. | ``string`` |
+|``Reason`` | The reason of the last update. | ``string`` |
+|``Message`` | Additional information about the state. | ``string`` |
+{{</bootstrap-table>}}
+
+## TransportServer resources
+
+A TransportServer resource includes the status field with information about the state of the resource.
+
+You can see the status in the output of the `kubectl get transportserver` command as shown below:
+
+```shell
+kubectl get transportserver
+```
+```text
+  NAME      STATE   REASON           AGE
+  dns-tcp   Valid   AddedOrUpdated   47m
+```
+
+To see additional addresses or extra information about the `Status` of the resource, use the following command:
+
+```shell
+kubectl describe transportserver <NAME>
+```
+```text
+Status:
+  Message:  Configuration for default/dns-tcp was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+```
+
+### Status specification
+
+The following fields are reported in TransportServer status:
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type |
+| ---| ---| --- |
+| *State* | Current state of the resource. Can be ``Valid``, ``Warning`` or ``Invalid``. For more information, refer to the ``message`` field. | *string* |
+| *Reason* | The reason of the last update. | *string* |
+| *Message* | Additional information about the state. | *string* |
+{{</bootstrap-table>}}
diff --git a/content/nic/configuration/host-and-listener-collisions.md b/content/nic/configuration/host-and-listener-collisions.md
new file mode 100644
index 000000000..502ef830c
--- /dev/null
+++ b/content/nic/configuration/host-and-listener-collisions.md
@@ -0,0 +1,168 @@
+---
+title: Host and Listener collisions
+toc: true
+weight: 800
+docs: DOCS-590
+---
+
+This document explains how F5 NGINX Ingress Controller handles host and listener collisions between resources.
+
+---
+
+## Winner Selection Algorithm
+
+If multiple resources contend for the same host or listener, NGINX Ingress Controller will pick the winner based on the `creationTimestamp` of the resources: the oldest resource will win. In case there are more than one oldest resource (their `creationTimestamp` is the same),  NGINX Ingress Controller will choose the resource with the lexicographically smallest `uid`.
+
+{{< note >}} The `creationTimestamp` and `uid` fields are part of the [ObjectMeta](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/object-meta/) resource. {{< /note >}}
+
+---
+
+## Host collisions
+
+A host collision occurs when multiple Ingress, VirtualServer, and TransportServer (configured for TLS Passthrough) resources configure the same `host`. NGINX Ingress Controller has two strategies for handling host collisions:
+
+- Choosing a single "winner" resource to handle the host.
+- Merging the configuration of the conflicting resources.
+
+---
+
+### Choosing the winner
+
+Consider the following two resources:
+
+- `cafe-ingress` Ingress:
+
+    ```yaml
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    metadata:
+      name: cafe-ingress
+    spec:
+      ingressClassName: nginx
+      rules:
+      - host: cafe.example.com
+        . . .
+    ```
+
+- `cafe-virtual-server` VirtualServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: VirtualServer
+    metadata:
+      name: cafe-virtual-server
+    spec:
+      host: cafe.example.com
+      . . .
+    ```
+
+If a user creates both resources in the cluster, a host collision will occur. NGINX Ingress Controller will pick the winner using the [winner selection algorithm](#winner-selection-algorithm).
+
+If `cafe-virtual-server` was created first, it will win the host `cafe.example.com` and NGINX Ingress Controller will reject `cafe-ingress`. This will be reflected in the events and in the resource's status field:
+
+```shell
+kubectl describe vs cafe-virtual-server
+```
+```text
+...
+Status:
+  ...
+  Message:  Configuration for default/cafe-virtual-server was added or updated
+  Reason:   AddedOrUpdated
+  State:    Valid
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  9s    nginx-ingress-controller  Configuration for default/cafe-virtual-server was added or updated
+```
+
+```shell
+kubectl describe ingress cafe-ingress
+```
+```text
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  66s   nginx-ingress-controller  All hosts are taken by other resources
+```
+
+Similarly, if `cafe-ingress` was created first, it will win `cafe.example.com` and NGINX Ingress Controller will reject `cafe-virtual-server`.
+
+{{< note >}} You can configure multiple hosts for Ingress resources, and its possible that an Ingress resource can be the winner for some of its hosts and a loser for the others.
+
+For example, if `cafe-ingress` had an additional rule host rule for `pub.example.com`, NGINX Ingress Controller would not reject the Ingress. Instead, it would allow `cafe-ingress` to handle `pub.example.com`. {{< /note >}}
+
+---
+
+### Merging configuration for the same host
+
+It is possible to merge configuration for multiple Ingress resources for the same host. One common use case for this approach is distributing resources across multiple namespaces.
+
+The [Cross-namespace configuration]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration.md">}}) topic has more information.
+
+It is *not* possible to merge the configurations for multiple VirtualServer resources for the same host. However, you can split the VirtualServers into multiple VirtualServerRoute resources, which a single VirtualServer can then reference. See the [corresponding example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/cross-namespace-configuration) on GitHub.
+
+It is *not* possible to merge configuration for multiple TransportServer resources.
+
+---
+
+## Listener/Host collisions
+
+Listener/Host collisions occur when multiple TransportServer resources (configured for TCP/UDP load balancing) specify the same combination of `spec.listener.name` and `spec.host`.
+
+The combination of `spec.listener.name` and `spec.host` must be unique among all TransportServer resources. If two TransportServer resources specify the same spec.listener.name and spec.host, one of them will be rejected to prevent conflicts. In the case where spec.host is not specified, it is considered an empty string.
+
+NGINX Ingress Controller will choose the winner, which will own that listener and host combination.
+
+---
+
+### Choosing the winner
+
+Consider the following two resources:
+
+- `tcp-1` TransportServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: TransportServer
+    metadata:
+      name: tcp-1
+    spec:
+      host: dns.example.com
+      listener:
+        name: dns-tcp
+        protocol: TCP
+        . . .
+    ```
+
+- `tcp-2` TransportServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: TransportServer
+    metadata:
+      name: tcp-2
+    spec:
+      host: dns.example.com
+      listener:
+        name: dns-tcp
+        protocol: TCP
+        . . .
+    ```
+
+If a user creates both resources in the cluster, a listener collision will occur. As a result, NGINX Ingress Controller will pick the winner using the [winner selection algorithm](#winner-selection-algorithm).
+
+In our example, if `tcp-1` was created first, it will win the listener `dns-tcp` and NGINX Ingress Controller will reject `tcp-2`. This will be reflected in the events and in the resource's status field:
+
+```shell
+kubectl describe ts tcp-2
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  10s   nginx-ingress-controller  Listener dns-tcp is taken by another resource
+```
+
+Similarly, if `tcp-2` was created first, it will win `dns-tcp` and NGINX Ingress Controller will reject `tcp-1`.
diff --git a/content/nic/configuration/ingress-resources/_index.md b/content/nic/configuration/ingress-resources/_index.md
new file mode 100644
index 000000000..8a2b5b282
--- /dev/null
+++ b/content/nic/configuration/ingress-resources/_index.md
@@ -0,0 +1,8 @@
+---
+title: Ingress resources
+description:
+weight: 200
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md b/content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
new file mode 100644
index 000000000..ee3dbc860
--- /dev/null
+++ b/content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
@@ -0,0 +1,225 @@
+---
+docs: DOCS-591
+doctypes:
+- ''
+title: Advanced configuration with Annotations
+toc: true
+weight: 200
+---
+
+This topic explains how to enable advanced features in F5 NGINX Ingress Controller with Annotations.
+
+The Ingress resource can use basic NGINX features such as host or path-based routing and TLS termination. Advanced features like rewriting the request URI or inserting additional response headers can be enabled with Annotations.
+
+Outside of advanced features, Annotations are necessary for customizing NGINX behavior such as setting the value of connection timeouts.
+
+Customization is also available through the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) resources: Annotations take priority.
+
+## Using Annotations
+
+This example uses Annotations to customize the configuration for an Ingress resource:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-with-annotations
+  annotations:
+    nginx.org/proxy-connect-timeout: "30s"
+    nginx.org/proxy-read-timeout: "20s"
+    nginx.org/client-max-body-size: "4m"
+    nginx.org/server-snippets: |
+      location / {
+        return 302 /coffee;
+      }
+spec:
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea
+        pathType: Prefix
+        backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+      - path: /coffee
+        pathType: Prefix
+        backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+```
+
+## Validation
+
+NGINX Ingress Controller validates the annotations of Ingress resources. If an Ingress is invalid, NGINX Ingress Controller will reject it: the Ingress will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can check if NGINX Ingress Controller successfully applied the configuration for an Ingress resource. For the example `cafe-ingress-with-annotations` Ingress, you can run:
+
+```shell
+kubectl describe ing cafe-ingress-with-annotations
+```
+```text
+...
+Events:
+  Type     Reason          Age   From                      Message
+  ----     ------          ----  ----                      -------
+  Normal   AddedOrUpdated  3s    nginx-ingress-controller  Configuration for default/cafe-ingress-with-annotations was added or updated
+```
+
+The events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid Ingress, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create an Ingress `cafe-ingress-with-annotations`, with an annotation `nginx.org/redirect-to-https` set to `yes please` instead of `true`, you will get:
+
+```shell
+kubectl describe ing cafe-ingress-with-annotations
+```
+```text
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  13s   nginx-ingress-controller  annotations.nginx.org/redirect-to-https: Invalid value: "yes please": must be a boolean
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+{{< note >}} If you make an existing Ingress invalid, NGINX Ingress Controller will reject it and remove the corresponding configuration from NGINX. {{< /note >}}
+
+The `nginx.com/jwt-token` Ingress annotation has limited validation.
+
+## Summary of Annotations
+
+The table below summarizes the available annotations.
+
+{{< note >}} Annotations that start with `nginx.com` are only supported with NGINX Plus. {{< /note >}}
+
+### General customization
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/proxy-connect-timeout* | *proxy-connect-timeout* | Sets the value of the [proxy_connect_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) and [grpc_connect_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_connect_timeout) directive. | *60s* |  |
+| *nginx.org/proxy-read-timeout* | *proxy-read-timeout* | Sets the value of the [proxy_read_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) and [grpc_read_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_read_timeout) directive. | *60s* |  |
+| *nginx.org/proxy-send-timeout* | *proxy-send-timeout* | Sets the value of the [proxy_send_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) and [grpc_send_timeout](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_send_timeout) directive. | *60s* |  |
+| *nginx.org/client-max-body-size* | *client-max-body-size* | Sets the value of the [client_max_body_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size) directive. | *1m* |  |
+| *nginx.org/proxy-buffering* | *proxy-buffering* | Enables or disables [buffering of responses](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) from the proxied server. | *True* |  |
+| *nginx.org/proxy-buffers* | *proxy-buffers* | Sets the value of the [proxy_buffers](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) directive. | Depends on the platform. |  |
+| *nginx.org/proxy-buffer-size* | *proxy-buffer-size* | Sets the value of the [proxy_buffer_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) and [grpc_buffer_size](https://nginx.org/en/docs/http/ngx_http_grpc_module.html#grpc_buffer_size) directives. | Depends on the platform. |  |
+| *nginx.org/proxy-max-temp-file-size* | *proxy-max-temp-file-size* | Sets the value of the  [proxy_max_temp_file_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_max_temp_file_size) directive. | *1024m* |  |
+| *nginx.org/server-tokens* | *server-tokens* | Enables or disables the [server_tokens](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens) directive. Additionally, with the NGINX Plus, you can specify a custom string value, including the empty string value, which disables the emission of the “Server” field. | *True* |  |
+| *nginx.org/path-regex* | N/A | Enables regular expression modifiers for Ingress path parameter. This translates to the NGINX [location](https://nginx.org/en/docs/http/ngx_http_core_module.html#location) directive. You can specify one of these values: "case_sensitive", "case_insensitive", or "exact". The annotation is applied to the entire Ingress resource and its paths. While using Master and Minion Ingresses i.e. Mergeable Ingresses, this annotation can be specified on Minion types. The `path-regex` annotation specified on Master is ignored, and has no effect on paths defined on Minions.   | N/A |  [path-regex](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/path-regex) |
+{{</bootstrap-table>}}
+
+### Request URI/Header Manipulation
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/proxy-hide-headers* | *proxy-hide-headers* | Sets the value of one or more  [proxy_hide_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directives. Example: ``"nginx.org/proxy-hide-headers": "header-a,header-b"* | N/A |  |
+| *nginx.org/proxy-pass-headers* | *proxy-pass-headers* | Sets the value of one or more   [proxy_pass_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header) directives. Example: ``"nginx.org/proxy-pass-headers": "header-a,header-b"* | N/A |  |
+| *nginx.org/rewrites* | N/A | Configures URI rewriting using [proxy_pass](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass) directive. | N/A | [rewrites](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/rewrites) |
+|*nginx.org/proxy-set-headers* | N/A | Enables customization of proxy headers and values using the [proxy_set_header](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header) directive. Example: ``"nginx.org/proxy-set-headers": "header-a: valueA,header-b: valueB,header-c: valueC"`` | N/A | [Proxy Set Headers](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/proxy-set-headers). |
+{{</bootstrap-table>}}
+
+### Auth and SSL/TLS
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/redirect-to-https* | *redirect-to-https* | Sets the 301 redirect rule based on the value of the ``http_x_forwarded_proto* header on the server block to force incoming traffic to be over HTTPS. Useful when terminating SSL in a load balancer in front of NGINX Ingress Controller — see [115](https://github.com/nginx/kubernetes-ingress/issues/115) | *False* |  |
+| *ingress.kubernetes.io/ssl-redirect* | *ssl-redirect* | Sets an unconditional 301 redirect rule for all incoming HTTP traffic to force incoming traffic over HTTPS. | *True* |  |
+| *nginx.org/hsts* | *hsts* | Enables [HTTP Strict Transport Security (HSTS)](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/)\ : the HSTS header is added to the responses from backends. The ``preload* directive is included in the header. | *False* |  |
+| *nginx.org/hsts-max-age* | *hsts-max-age* | Sets the value of the ``max-age* directive of the HSTS header. | *2592000* (1 month) |  |
+| *nginx.org/hsts-include-subdomains* | *hsts-include-subdomains* | Adds the ``includeSubDomains* directive to the HSTS header. | *False* |  |
+| *nginx.org/hsts-behind-proxy* | *hsts-behind-proxy* | Enables HSTS based on the value of the ``http_x_forwarded_proto* request header. Should only be used when TLS termination is configured in a load balancer (proxy) in front of NGINX Ingress Controller. Note: to control redirection from HTTP to HTTPS configure the ``nginx.org/redirect-to-https* annotation. | *False* |  |
+| *nginx.org/basic-auth-secret* | N/A | Specifies a Secret resource with a user list for HTTP Basic authentication. | N/A | |
+| *nginx.org/basic-auth-realm* | N/A | Specifies a realm. | N/A | |
+| *nginx.com/jwt-key* | N/A | Specifies a Secret resource with keys for validating JSON Web Tokens (JWTs). | N/A | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+| *nginx.com/jwt-realm* | N/A | Specifies a realm. | N/A | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+| *nginx.com/jwt-token* | N/A | Specifies a variable that contains a JSON Web Token. | By default, a JWT is expected in the ``Authorization* header as a Bearer Token. | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+| *nginx.com/jwt-login-url* | N/A | Specifies a URL to which a client is redirected in case of an invalid or missing JWT. | N/A | [Support for JSON Web Tokens (JWTs)](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt). |
+{{</bootstrap-table>}}
+
+### Listeners
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/listen-ports* | N/A | Configures HTTP ports that NGINX will listen on. | *[80]* |  |
+| *nginx.org/listen-ports-ssl* | N/A | Configures HTTPS ports that NGINX will listen on. | *[443]* |  |
+{{</bootstrap-table>}}
+
+### Backend services (Upstreams)
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/lb-method* | *lb-method* | Sets the [load balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify ``"round_robin"``. | *"random two least_conn"* |  |
+| *nginx.org/ssl-services* | N/A | Enables HTTPS or gRPC over SSL when connecting to the endpoints of services. | N/A | [ssl-services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/ssl-services) |
+| *nginx.org/grpc-services* | N/A | Enables gRPC for services. Note: requires HTTP/2 (see ``http2* ConfigMap key); only works for Ingresses with TLS termination enabled. | N/A | [grpc-services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/grpc-services) |
+| *nginx.org/websocket-services* | N/A | Enables WebSocket for services. | N/A | [websocket](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/websocket) |
+| *nginx.org/max-fails* | *max-fails* | Sets the value of the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the ``server* directive. | *1* |  |
+| *nginx.org/max-conns* | N\A | Sets the value of the [max_conns](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_conns) parameter of the ``server* directive. | *0* |  |
+| *nginx.org/upstream-zone-size* | *upstream-zone-size* | Sets the size of the shared memory [zone](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone) for upstreams. For NGINX, the special value 0 disables the shared memory zones. For NGINX Plus, shared memory zones are required and cannot be disabled. The special value 0 will be ignored. | *256K* |  |
+| *nginx.org/fail-timeout* | *fail-timeout* | Sets the value of the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the ``server* directive. | *10s* |  |
+| *nginx.com/sticky-cookie-services* | N/A | Configures session persistence. | N/A | [session-persistence](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/session-persistence) |
+| *nginx.org/keepalive* | *keepalive* | Sets the value of the [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) directive. Note that ``proxy_set_header Connection "";* is added to the generated configuration when the value > 0. | *0* |  |
+| *nginx.com/health-checks* | N/A | Enables active health checks. | *False* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
+| *nginx.com/health-checks-mandatory* | N/A | Configures active health checks as mandatory. | *False* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
+| *nginx.com/health-checks-mandatory-queue* | N/A | When active health checks are mandatory, creates a queue where incoming requests are temporarily stored while NGINX Plus is checking the health of the endpoints after a configuration reload. | *0* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
+| *nginx.com/slow-start* | N/A | Sets the upstream server [slow-start period](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#server-slow-start). By default, slow-start is activated after a server becomes [available](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks) or [healthy](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#active-health-checks). To enable slow-start for newly-added servers, configure [mandatory active health checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks). | *"0s"* |  |
+| *nginx.org/use-cluster-ip* | N/A | Enables using the Cluster IP and port of the service instead of the default behavior of using the IP and port of the pods. When this field is enabled, the fields that configure NGINX behavior related to multiple upstream servers (like ``lb-method* and ``next-upstream``) will have no effect, as NGINX Ingress Controller will configure NGINX with only one upstream server that will match the service Cluster IP.   | *False* |  |
+{{</bootstrap-table>}}
+
+### Rate limiting
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/limit-req-rate* | N/A | Enables request-rate-limiting for this ingress by creating a [limit_req_zone](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone) and matching [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) for each location. All servers/locations of one ingress share the same zone. Must have unit r/s or r/m. | N/A | 200r/s |
+| *nginx.org/limit-req-key* | N/A | The key to which the rate limit is applied. Can contain text, variables, or a combination of them. Variables must be surrounded by ${}. | ${binary_remote_addr} | ${binary_remote_addr} |
+| *nginx.org/limit-req-zone-size* | N/A | Configures the size of the created [limit_req_zone](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone). | 10m | 20m |
+| *nginx.org/limit-req-delay* | N/A | Configures the delay-parameter of the [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) directive. | 0 | 100 |
+| *nginx.org/limit-req-no-delay* | N/A | Configures the nodelay-parameter of the [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) directive. | false | true |
+| *nginx.org/limit-req-burst* | N/A | Configures the burst-parameter of the [limit_req](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req) directive. | N/A | 100 |
+| *nginx.org/limit-req-dry-run* | N/A | Enables the dry run mode. In this mode, the rate limit is not actually applied, but the number of excessive requests is accounted as usual in the shared memory zone. | false | true |
+| *nginx.org/limit-req-log-level* | N/A | Sets the desired logging level for cases when the server refuses to process requests due to rate exceeding, or delays request processing. Allowed values are info, notice, warn or error. | error | info |
+| *nginx.org/limit-req-reject-code* | N/A | Sets the status code to return in response to rejected requests. Must fall into the range 400..599. | 429 | 503 |
+| *nginx.org/limit-req-scale* | N/A | Enables a constant rate-limit by dividing the configured rate by the number of nginx-ingress pods currently serving traffic. This adjustment ensures that the rate-limit remains consistent, even as the number of nginx-pods fluctuates due to autoscaling. Note: This will not work properly if requests from a client are not evenly distributed accross all ingress pods (sticky sessions, long lived TCP-Connections with many requests etc.). In such cases using [zone-sync]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) instead would give better results.  Enabling `zone-sync` will suppress this setting. | false | true |
+{{</bootstrap-table>}}
+
+### Snippets and custom templates
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *nginx.org/location-snippets* | *location-snippets* | Sets a custom snippet in location context. | N/A |  |
+| *nginx.org/server-snippets* | *server-snippets* | Sets a custom snippet in server context. | N/A |  |
+{{</bootstrap-table>}}
+
+### App Protect WAF {#app-protect}
+
+{{< note >}} The App Protect annotations only work if the App Protect WAF module is [installed]({{< ref "/nic/installation/integrations/app-protect-waf/installation.md" >}}). {{< /note >}}
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *appprotect.f5.com/app-protect-policy* | N/A | The name of the App Protect Policy for the Ingress Resource. Format is ``namespace/name``. If no namespace is specified, the same namespace of the Ingress Resource is used. If not specified but ``appprotect.f5.com/app-protect-enable* is true, a default policy id applied. If the referenced policy resource does not exist, or policy is invalid, this annotation will be ignored, and the default policy will be applied. | N/A | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-enable* | N/A | Enable App Protect for the Ingress Resource. | *False* | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-security-log-enable* | N/A | Enable the [security log](/nginx-app-protect/troubleshooting/#app-protect-logging-overview) for App Protect. | *False* | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-security-log* | N/A | The App Protect log configuration for the Ingress Resource. Format is ``namespace/name``. If no namespace is specified, the same namespace as the Ingress Resource is used. If not specified the  default is used which is:  filter: ``illegal``, format: ``default``. Multiple configurations can be specified in a comma separated list. Both log configurations and destinations list (see below) must be of equal length. Configs and destinations are paired by the list indices. | N/A | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+| *appprotect.f5.com/app-protect-security-log-destination* | N/A | The destination of the security log. For more information check the [DESTINATION argument](/nginx-app-protect/troubleshooting/#app-protect-logging-overview). Multiple destinations can be specified in a comma-separated list.  Both log configurations and destinations list (see above) must be of equal length. Configs and destinations are paired by the list indices. | *syslog:server=localhost:514* | [app-protect-waf](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf) |
+{{</bootstrap-table>}}
+
+### App Protect DoS
+
+{{< note >}} The App Protect DoS annotations only work if the App Protect DoS module is [installed]({{< ref "/nic/installation/integrations/app-protect-dos/installation.md" >}}). {{< /note >}}
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Annotation | ConfigMap Key | Description | Default | Example |
+| ---| ---| ---| ---| --- |
+| *appprotectdos.f5.com/app-protect-dos-resource* | N/A | Enable App Protect DoS for the Ingress Resource by specifying a [DosProtectedResource]({{< ref "/nic/installation/integrations/app-protect-dos/dos-protected.md" >}}). | N/A | [app-protect-dos](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-dos) |
+{{</bootstrap-table>}}
diff --git a/content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md b/content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
new file mode 100644
index 000000000..0060a7e3b
--- /dev/null
+++ b/content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
@@ -0,0 +1,128 @@
+---
+docs: DOCS-592
+doctypes:
+- ''
+title: Advanced configuration with Snippets
+toc: true
+weight: 400
+---
+
+Snippets allow you to insert raw NGINX config into different contexts of the NGINX configurations that F5 NGINX Ingress Controller generates. 
+
+Snippets are intended for advanced NGINX users who need more control over the generated NGINX configuration, and can be used in cases where Annotations and ConfigMap entries would not apply. 
+
+
+
+## Disadvantages of snippets
+
+Snippets are configured [using Annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#snippets-and-custom-templates" >}}), but are disabled by default due to their complexity. They are also available through the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}}) resource.
+
+To use snippets, set the [`enable-snippets`]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-snippets" >}}) command-line argument.
+
+Snippets have the following disadvantages:
+
+- *Complexity*. Snippets require you to:
+  - Understand NGINX configuration primitives and implement a correct NGINX configuration.
+  - Understand how NGINX Ingress Controller generates NGINX configuration so that a snippet doesn't interfere with the other features in the configuration.
+- *Decreased robustness*. An incorrect snippet can invalidate NGINX configuration, causing reload failures. Until the snippet is fixed, it will prevent any new configuration updates, including updates for the other Ingress resources.
+- *Security implications*. Snippets give access to NGINX configuration primitives, which are not validated by NGINX Ingress Controller. For example, a snippet can configure NGINX to serve the TLS certificates and keys used for TLS termination for Ingress resources.
+
+{{< note >}} If the NGINX configuration includes an invalid snippet, NGINX will continue to operate with the last valid configuration. {{< /note >}} 
+
+## Using snippets
+
+The example below shows how to use snippets to customize the NGINX configuration template using annotations.
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-with-snippets
+  annotations:
+    nginx.org/server-snippets: |
+      location / {
+          return 302 /coffee;
+      }
+    nginx.org/location-snippets: |
+      add_header my-test-header test-value;
+spec:
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea
+        pathType: Prefix
+        backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+      - path: /coffee
+        pathType: Prefix
+        backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+```
+
+These snippets generate the following NGINX configuration:
+
+{{< note >}} The example is shortened for conciseness. {{< /note >}} 
+
+```nginx
+server {
+    listen 80;
+
+
+    location / {
+        return 302 /coffee;
+    }
+
+
+    location /coffee {
+        proxy_http_version 1.1;
+
+
+        add_header my-test-header test-value;
+        ...
+        proxy_pass http://default-cafe-ingress-with-snippets-cafe.example.com-coffee-svc-80;
+    }
+
+    location /tea {
+        proxy_http_version 1.1;
+
+        add_header my-test-header test-value;
+        ...
+        proxy_pass http://default-cafe-ingress-with-snippets-cafe.example.com-tea-svc-80;
+    }
+}
+```
+
+## Troubleshooting
+
+If a snippet includes an invalid NGINX configuration, NGINX Ingress Controller will fail to reload NGINX. The error will be reported in NGINX Ingress Controller logs and an event with the error will be associated with the Ingress resource:
+
+An example of an error from the logs:
+
+```text
+[emerg] 31#31: unknown directive "badd_header" in /etc/nginx/conf.d/default-cafe-ingress-with-snippets.conf:54
+Event(v1.ObjectReference{Kind:"Ingress", Namespace:"default", Name:"cafe-ingress-with-snippets", UID:"f9656dc9-63a6-41dd-a499-525b0e0309bb", APIVersion:"extensions/v1beta1", ResourceVersion:"2322030", FieldPath:""}): type: 'Warning' reason: 'AddedOrUpdatedWithError' Configuration for default/cafe-ingress-with-snippets was added or updated, but not applied: Error reloading NGINX for default/cafe-ingress-with-snippets: nginx reload failed: Command /usr/sbin/nginx -s reload stdout: ""
+stderr: "nginx: [emerg] unknown directive \"badd_header\" in /etc/nginx/conf.d/default-cafe-ingress-with-snippets.conf:54\n"
+finished with error: exit status 1
+```
+
+An example of an event with an error (you can view events associated with the Ingress by running `kubectl describe -n nginx-ingress ingress nginx-ingress`):
+
+```text
+Events:
+Type     Reason                   Age                From                      Message
+----     ------                   ----               ----                      -------
+Normal   AddedOrUpdated           52m (x3 over 61m)  nginx-ingress-controller  Configuration for default/cafe-ingress-with-snippets was added or updated
+finished with error: exit status 1
+Warning  AddedOrUpdatedWithError  54s (x2 over 89s)  nginx-ingress-controller  Configuration for default/cafe-ingress-with-snippets was added or updated, but not applied: Error reloading NGINX for default/cafe-ingress-with-snippets: nginx reload failed: Command /usr/sbin/nginx -s reload stdout: ""
+stderr: "nginx: [emerg] unknown directive \"badd_header\" in /etc/nginx/conf.d/default-cafe-ingress-with-snippets.conf:54\n"
+finished with error: exit status 1
+```
+
+Additionally, to help troubleshoot snippets, a number of Prometheus metrics show the stats about failed reloads – `controller_nginx_last_reload_status` and `controller_nginx_reload_errors_total`.
diff --git a/content/nic/configuration/ingress-resources/basic-configuration.md b/content/nic/configuration/ingress-resources/basic-configuration.md
new file mode 100644
index 000000000..8d1948693
--- /dev/null
+++ b/content/nic/configuration/ingress-resources/basic-configuration.md
@@ -0,0 +1,107 @@
+---
+title: Basic configuration
+weight: 100
+toc: true
+type: reference
+product: NIC
+docs: DOCS-593
+---
+
+This document shows a basic Ingress resource definition for F5 NGINX Ingress Controller. It load balances requests for two services as part of a single application.
+
+{{< ghcode `https://raw.githubusercontent.com/nginx/kubernetes-ingress/refs/heads/main/examples/ingress-resources/complete-example/cafe-ingress.yaml`>}}
+
+Here is a breakdown of what this Ingress resource definition means:
+
+- The `metadata.name` field defines the name of the resource `cafe‑ingress`.
+- The `spec.tls` field sets up SSL/TLS termination:
+  - The `hosts` field applies the certificate and key to the `cafe.example.com` host.
+  - The `secretName` references a secret resource by its name, `cafe‑secret`. The secret must belong to the same namespace as the Ingress, of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that hold the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls>). If the secret doesn't exist or is invalid, NGINX will break any attempt to establish a TLS connection to the hosts to which the secret is applied.
+- The `spec.rules` field defines a host with the domain name `cafe.example.com`.
+- The `paths` field defines two path‑based rules:
+  - The rule with the path `/tea` instructs NGINX to distribute the requests with the `/tea` URI among the pods of the *tea* service, which is deployed with the name `tea‑svc` in the cluster.
+  - The rule with the path `/coffee` instructs NGINX to distribute the requests with the `/coffee` URI among the pods of the *coffee* service, which is deployed with the name `coffee‑svc` in the cluster.
+  - Both rules instruct NGINX to distribute the requests to `port 80` of the corresponding service (the `servicePort` field).
+
+To learn more about the Ingress resource, view [the official Kubernetes documentation for Ingress resources](https://kubernetes.io/docs/concepts/services-networking/ingress/).
+
+{{< note >}} For complete instructions on deploying Ingress and Secret resources in the cluster, see the [complete example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/complete-example) in the GitHub repository. {{< /note >}}
+
+---
+
+## New features available in Kubernetes 1.18
+
+Starting from Kubernetes 1.18, you can use the following new features:
+
+- The host field supports wildcard domain names, such as `*.example.com`.
+- The path supports different matching rules with the new field `pathType`, which takes the following values: `Prefix` for prefix-based matching, `Exact` for exact matching and `ImplementationSpecific`, which is the default type and is the same as `Prefix`. For example:
+
+  ```yaml {hl_lines=[2, 7, 14]}
+    - path: /tea
+      pathType: Prefix
+      backend:
+        serviceName: tea-svc
+        servicePort: 80
+    - path: /tea/green
+      pathType: Exact
+      backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+    - path: /coffee
+      pathType: ImplementationSpecific
+      backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+  ```
+
+- The `ingressClassName` field is now supported:
+
+  ```yaml {hl_lines=[6]}
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    metadata:
+      name: cafe-ingress
+    spec:
+      ingressClassName: nginx
+      tls:
+      - hosts:
+        - cafe.example.com
+        secretName: cafe-secret
+      rules:
+      - host: cafe.example.com
+    . . .
+  ```
+
+  When using this field you need to create the `IngressClass` resource with the corresponding `name`. View the [Create common resources]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md#create-common-resources" >}}) section of the Installation with Manifests topic for more information.
+
+---
+
+## Restrictions
+
+NGINX Ingress Controller imposes the following restrictions on Ingress resources:
+
+- When defining an Ingress resource, the `host` field is required.
+- The `host` value needs to be unique among all Ingress and VirtualServer resources unless the Ingress resource is a [mergeable minion]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration.md" >}}). View the [Host and Listener collisions]({{< ref "/nic/configuration/host-and-listener-collisions.md" >}}) topic for more information.
+- The `path` field in `spec.rules[].http.paths[]` is required for `Exact` and `Prefix` `pathTypes`.
+- The ImplementationSpecific `pathType` is treated as equivalent to `Prefix` `pathType`, with the exception that when this `pathType` is configured, the `path` field in `spec.rules[].http.paths[]` is not mandatory. `path` defaults to `/` if not set but the `pathType` is set to ImplementationSpecific.
+
+---
+
+## Advanced configuration
+
+NGINX Ingress Controller generates NGINX configuration by executing a template file that contains the configuration options. 
+
+These options are set with the Ingress resource and NGINX Ingress Controller's ConfigMap.  
+
+The Ingress resource only allows you to use basic NGINX features: host and path-based routing and TLS termination.
+
+For advanced configuration, you have two options:
+
+- [Annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md" >}}) can be used to rewrite request URIs or inserting additional response headers.
+- [Snippets]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets" >}}) can be used to insert raw NGINX configuration, changing generated files.
+
+Additionally, it is possible to customize the template, described in the [Custom templates]({{< ref "/nic/configuration/global-configuration/custom-templates.md" >}}) topic.
diff --git a/content/nic/configuration/ingress-resources/cross-namespace-configuration.md b/content/nic/configuration/ingress-resources/cross-namespace-configuration.md
new file mode 100644
index 000000000..3e92b6403
--- /dev/null
+++ b/content/nic/configuration/ingress-resources/cross-namespace-configuration.md
@@ -0,0 +1,14 @@
+---
+docs: DOCS-594
+doctypes:
+- ''
+title: Cross-namespace configuration
+toc: true
+weight: 500
+---
+
+This topic explains how to spread Ingress configuration across different namespaces in F5 NGINX Ingress Controller.
+
+You can spread the Ingress configuration for a common host across multiple Ingress resources using Mergeable Ingress resources. Such resources can belong to the *same* or *different* namespaces. This enables easier management when using a large number of paths. See the [Mergeable Ingress Resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/mergeable-ingress-types) example in our GitHub repo.
+
+As an alternative to Mergeable Ingress resources, you can use [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) for cross-namespace configuration. See the [Cross-Namespace Configuration](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/cross-namespace-configuration) example in our GitHub repo.
diff --git a/content/nic/configuration/ingress-resources/custom-annotations.md b/content/nic/configuration/ingress-resources/custom-annotations.md
new file mode 100644
index 000000000..8bbd136b0
--- /dev/null
+++ b/content/nic/configuration/ingress-resources/custom-annotations.md
@@ -0,0 +1,146 @@
+---
+docs: DOCS-595
+doctypes:
+- ''
+title: Custom annotations
+toc: true
+weight: 300
+---
+
+This topic explains how you can use custom annotations with F5 NGINX Ingress Controller.
+
+Custom annotations enable you to quickly extend the Ingress resource to support many advanced features of NGINX, such as rate limiting, caching, etc.
+
+## Overview
+
+NGINX Ingress Controller supports a number of annotations for the Ingress resource that fine tune NGINX configuration (for example, connection timeouts) or enable additional features (for example, JWT validation). The complete list of annotations is available [here](/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations).
+
+The annotations are provided only for the most common features and use cases, meaning that not every NGINX feature or a customization option is available through the annotations. Additionally, even if an annotation is available, it might not give you the satisfactory level of control of a particular NGINX feature.
+
+Custom annotations allow you to add an annotation for an NGINX feature that is not available as a regular annotation. In contrast with regular annotations, to add a custom annotation, you don't need to modify the Ingress Controller source code -- just modify the template. Additionally, with a custom annotation, you get full control of how the feature is implemented in NGINX configuration.
+
+## Usage
+
+The Ingress Controller generates NGINX configuration for Ingress resources by executing a configuration template. See [NGINX template](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx.ingress.tmpl) or [NGINX Plus template](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/internal/configs/version1/nginx-plus.ingress.tmpl).
+
+To support custom annotations, the template has access to the information about the Ingress resource - its *name*, *namespace* and *annotations*. It is possible to check if a particular annotation present in the Ingress resource and conditionally insert NGINX configuration directives at multiple NGINX contexts - `http`, `server`, `location` or `upstream`. Additionally, you can get the value that is set to the annotation.
+
+Consider the following excerpt from the template, which was extended to support two custom annotations:
+
+```jinja2
+# This is the configuration for {{$.Ingress.Name}}/{{$.Ingress.Namespace}}
+
+{{if index $.Ingress.Annotations "custom.nginx.org/feature-a"}}
+# Insert config for feature A if the annotation is set
+{{end}}
+
+{{with $value := index $.Ingress.Annotations "custom.nginx.org/feature-b"}}
+# Insert config for feature B if the annotation is set
+# Print the value assigned to the annotation: {{$value}}
+{{end}}
+```
+
+Consider the following Ingress resource and note how we set two annotations:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: example-ingress
+  namespace: production
+  annotations:
+    custom.nginx.org/feature-a: "on"
+    custom.nginx.org/feature-b: "512"
+spec:
+  rules:
+  - host: example.com
+    . . .
+```
+
+Assuming that the Ingress Controller is using that customized template, it will generate a config for the Ingress resource that will include the following part, generated by our template excerpt:
+
+```yaml
+# This is the configuration for cafe-ingress/default
+
+# Insert config for feature A if the annotation is set
+
+
+
+# Insert config for feature B if the annotation is set
+# Print the value assigned to the annotation: 512
+```
+
+**Notes**:
+
+- You can customize the template to insert you custom annotations via [custom templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates).
+- The Ingress Controller uses go templates to generate NGINX config. You can read more information about go templates [here](https://golang.org/pkg/text/template/).
+
+See the examples in the next section that use custom annotations to configure NGINX features.
+
+### Custom Annotations with Mergeable Ingress Resources
+
+A Mergeable Ingress resource consists of multiple Ingress resources - one master and one or several minions. Read more about Mergeable Ingress resources [here](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration).
+
+If you'd like to use custom annotations with Mergeable Ingress resources, please keep the following in mind:
+
+- Custom annotations can be used in the Master and in Minions. For Minions, you can access them in the template only when processing locations.
+
+    If you access `$.Ingress` anywhere in the Ingress template, you will get the master Ingress resource. To access a Minion Ingress resource, use `$location.MinionIngress`. However, it is only available when processing locations:
+
+    ```jinja2
+      {{range $location := $server.Locations}}
+      location {{$location.Path}} {
+        {{with $location.MinionIngress}}
+          # location for minion {{$location.MinionIngress.Namespace}}/{{$location.MinionIngress.Name}}
+        {{end}}
+      } {{end}}
+    ```
+
+    **Note**: `$location.MinionIngress` is a pointer. When a regular Ingress resource is processed in the template, the value of the pointer is `nil`. Thus, it is important that you check that `$location.MinionIngress` is not `nil` as in the example above using the `with` action.
+
+- Minions do not inherent custom annotations of the master.
+
+### Helper Functions
+
+Helper functions can be used in the Ingress template to parse the values of custom annotations.
+
+{{% table %}}
+| Function | Input Arguments | Return Arguments | Description |
+| ---| ---| ---| --- |
+| ``split`` | ``s, sep string`` | ``[]string`` | Splits the string ``s`` into a slice of strings separated by the ``sep``. |
+| ``trim`` | ``s string`` | ``string`` | Trims the trailing and leading whitespace from the string ``s``. |
+| ``contains`` | ``s, substr string`` | ``bool`` | Tests whether the string ``substr`` is a substring of the string ``s``. |
+| ``hasPrefix`` | ``s, prefix string`` | ``bool`` | Tests whether the string ``prefix`` is a prefix of the string ``s``. |
+| ``hasSuffix`` | ``s, suffix string`` | ``bool`` | Tests whether the string ``suffix`` is a suffix of the string ``s``. |
+| ``toLower`` | ``s string`` | ``bool`` | Converts all letters in the string ``s`` to their lower case. |
+| ``toUpper`` | ``s string`` | ``bool`` | Converts all letters in the string ``s`` to their upper case. |
+| ``replaceAll`` | ``s, old, new string`` | ``string`` | Replaces all occurrences of ``old`` with ``new`` in the string ``s``. |
+{{% /table %}}
+
+Consider the following custom annotation `custom.nginx.org/allowed-ips`, which expects a comma-separated list of IP addresses:
+
+```yaml
+annotations:
+  custom.nginx.org/allowed-ips: "192.168.1.3, 10.0.0.13"
+```
+
+ The helper functions can parse the value of the `custom.nginx.org/allowed-ips` annotation, so that in the template you can use each IP address separately. Consider the following template excerpt:
+
+```jinja2
+{{range $ip := split (index $.Ingress.Annotations "custom.nginx.org/allowed-ips") ","}}
+    allow {{trim $ip}};
+{{end}}
+deny all;
+```
+
+The template excerpt will generate the following configuration:
+
+```
+allow 192.168.1.3;
+allow 10.0.0.13;
+deny all;
+```
+
+## Example
+
+See the [custom annotations example](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/ingress-resources/custom-annotations).
diff --git a/content/nic/configuration/policy-resource.md b/content/nic/configuration/policy-resource.md
new file mode 100644
index 000000000..4188188ef
--- /dev/null
+++ b/content/nic/configuration/policy-resource.md
@@ -0,0 +1,947 @@
+---
+title: Policy resources
+weight: 500
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-596
+---
+
+The Policy resource allows you to configure features like access control and rate-limiting, which you can add to your [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/).
+
+The resource is implemented as a [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+This document is the reference documentation for the Policy resource. An example of a Policy for access control is available in our [GitHub repository](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/custom-resources/access-control).
+
+## Prerequisites
+
+Policies work together with [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/), which you need to create separately.
+
+## Policy Specification
+
+Below is an example of a policy that allows access for clients from the subnet `10.0.0.0/8` and denies access for any other clients:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: allow-localhost
+spec:
+  accessControl:
+    allow:
+    - 10.0.0.0/8
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``accessControl`` | The access control policy based on the client IP address. | [accessControl](#accesscontrol) | No |
+|``ingressClassName`` | Specifies which instance of NGINX Ingress Controller must handle the Policy resource. | ``string`` | No |
+|``rateLimit`` | The rate limit policy controls the rate of processing requests per a defined key. | [rateLimit](#ratelimit) | No |
+|``apiKey`` | The API Key policy configures NGINX to authorize requests which provide a valid API Key in a specified header or query param. | [apiKey](#apikey) | No |
+|``basicAuth`` | The basic auth policy configures NGINX to authenticate client requests using HTTP Basic authentication credentials. | [basicAuth](#basicauth) | No |
+|``jwt`` | The JWT policy configures NGINX Plus to authenticate client requests using JSON Web Tokens. | [jwt](#jwt) | No |
+|``ingressMTLS`` | The IngressMTLS policy configures client certificate verification. | [ingressMTLS](#ingressmtls) | No |
+|``egressMTLS`` | The EgressMTLS policy configures upstreams authentication and certificate verification. | [egressMTLS](#egressmtls) | No |
+|``waf`` | The WAF policy configures WAF and log configuration policies for [NGINX AppProtect]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md" >}}) | [WAF](#waf) | No |
+{{% /table %}}
+
+\* A policy must include exactly one policy.
+
+### AccessControl
+
+The access control policy configures NGINX to deny or allow requests from clients with the specified IP addresses/subnets.
+
+For example, the following policy allows access for clients from the subnet `10.0.0.0/8` and denies access for any other clients:
+
+```yaml
+accessControl:
+  allow:
+  - 10.0.0.0/8
+```
+
+In contrast, the policy below does the opposite: denies access for clients from `10.0.0.0/8` and allows access for any other clients:
+
+```yaml
+accessControl:
+  deny:
+  - 10.0.0.0/8
+```
+{{< note >}}
+
+The feature is implemented using the NGINX [ngx_http_access_module](http://nginx.org/en/docs/http/ngx_http_access_module.html). NGINX Ingress Controller access control policy supports either allow or deny rules, but not both (as the module does).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``allow`` | Allows access for the specified networks or addresses. For example, ``192.168.1.1`` or ``10.1.1.0/16``. | ``[]string`` | No |
+|``deny`` | Denies access for the specified networks or addresses. For example, ``192.168.1.1`` or ``10.1.1.0/16``. | ``[]string`` | No | \* an accessControl must include either `allow` or `deny`. |
+{{% /table %}}
+
+#### AccessControl Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple access control policies. For example, here we reference two policies, each with configured allow lists:
+
+```yaml
+policies:
+- name: allow-policy-one
+- name: allow-policy-two
+```
+
+When you reference more than one access control policy, NGINX Ingress Controller will merge the contents into a single allow list or a single deny list.
+
+Referencing both allow and deny policies, as shown in the example below, is not supported. If both allow and deny lists are referenced, NGINX Ingress Controller uses just the allow list policies.
+
+```yaml
+policies:
+- name: deny-policy
+- name: allow-policy-one
+- name: allow-policy-two
+```
+
+### RateLimit
+
+The rate limit policy configures NGINX to limit the processing rate of requests.
+
+For example, the following policy will limit all subsequent requests coming from a single IP address once a rate of 10 requests per second is exceeded:
+
+```yaml
+rateLimit:
+  rate: 10r/s
+  zoneSize: 10M
+  key: ${binary_remote_addr}
+```
+{{< note >}}
+
+The feature is implemented using the NGINX [ngx_http_limit_req_module](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html).
+
+{{< /note >}}
+
+{{< note >}}
+
+When the [Zone Sync feature]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) is enabled with NGINX Plus, the rate limiting zone will be synchronized across all replicas in the cluster.  This means all replicas are aware of the requests that have been rate limited by other replicas in the cluster.
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``rate`` | The rate of requests permitted. The rate is specified in requests per second (r/s) or requests per minute (r/m). | ``string`` | Yes |
+|``key`` | The key to which the rate limit is applied. Can contain text, variables, or a combination of them. Variables must be surrounded by ``${}``. For example: ``${binary_remote_addr}``. Accepted variables are ``$binary_remote_addr``, ``$request_uri``,``$request_method``, ``$url``, ``$http_``, ``$args``, ``$arg_``, ``$cookie_``, ``$jwt_claim_``. | ``string`` | Yes |
+|``zoneSize`` | Size of the shared memory zone. Only positive values are allowed. Allowed suffixes are ``k`` or ``m``, if none are present ``k`` is assumed. | ``string`` | Yes |
+|``delay`` | The delay parameter specifies a limit at which excessive requests become delayed. If not set all excessive requests are delayed. | ``int`` | No |
+|``noDelay`` | Disables the delaying of excessive requests while requests are being limited. Overrides ``delay`` if both are set. | ``bool`` | No |
+|``burst`` | Excessive requests are delayed until their number exceeds the ``burst`` size, in which case the request is terminated with an error. | ``int`` | No |
+|``dryRun`` | Enables the dry run mode. In this mode, the rate limit is not actually applied, but the number of excessive requests is accounted as usual in the shared memory zone. | ``bool`` | No |
+|``logLevel`` | Sets the desired logging level for cases when the server refuses to process requests due to rate exceeding, or delays request processing. Allowed values are ``info``, ``notice``, ``warn`` or ``error``. Default is ``error``. | ``string`` | No |
+|``rejectCode`` | Sets the status code to return in response to rejected requests. Must fall into the range ``400..599``. Default is ``503``. | ``int`` | No |
+|``scale`` | Enables a constant rate-limit by dividing the configured rate by the number of nginx-ingress pods currently serving traffic. This adjustment ensures that the rate-limit remains consistent, even as the number of nginx-pods fluctuates due to autoscaling. **This will not work properly if requests from a client are not evenly distributed across all ingress pods** (Such as with sticky sessions, long lived TCP Connections with many requests, and so forth). In such cases using [zone-sync]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) instead would give better results.  Enabling `zone-sync` will suppress this setting. | ``bool`` | No |
+|``condition`` | Add a condition to a rate-limit policy. | [ratelimit.condition](#ratelimitcondition) | No |
+{{% /table %}}
+
+{{< note >}}
+
+For each policy referenced in a VirtualServer and/or its VirtualServerRoutes, NGINX Ingress Controller will generate a single rate limiting zone defined by the [`limit_req_zone`](http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone) directive. If two VirtualServer resources reference the same policy, NGINX Ingress Controller will generate two different rate limiting zones, one zone per VirtualServer.
+
+{{< /note >}}
+
+#### RateLimit Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple rate limit policies. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: rate-limit-policy-one
+- name: rate-limit-policy-two
+```
+
+When you reference more than one rate limit policy, NGINX Ingress Controller will configure NGINX to use all referenced rate limits. When you define multiple policies, each additional policy inherits the `dryRun`, `logLevel`, and `rejectCode` parameters from the first policy referenced (`rate-limit-policy-one`, in the example above).
+
+### RateLimit.Condition
+
+RateLimit.Condition defines a condition for a rate limit policy. For example:
+
+```yaml
+condition:
+  jwt:
+    claim: user_details.level
+    match: premium
+  default: true
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``jwt`` | defines a JWT condition to rate limit against. | [ratelimit.condition.jwt](#ratelimitconditionjwt) | No |
+|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same JWT condition, only one policy can be the default. | ``bool`` | No |
+{{% /table %}}
+
+The rate limit policy with condition is designed to be used in combination with one or more rate limit policies. For example, multiple rate limit policies with [RateLimit.Condition.JWT](#ratelimitconditionjwt) can be used to apply different tiers of rate limit based on the value of a JWT claim. For a practical example of tiered rate limiting by the value of a JWT claim, see the example in our [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/rate-limit-tiered-jwt-claim/README.md).
+
+### RateLimit.Condition.JWT
+{{< note >}}
+
+This feature is only available with NGINX Plus.
+
+{{< /note >}}
+
+RateLimit.Condition.JWT defines a condition for a rate limit by JWT claim. For example, here we define a condition for a rate limit policy that only applies to requests with a JWT claim `user_details.level` with a value `premium`:
+
+```yaml
+jwt:
+  claim: user_details.level
+  match: premium
+```
+
+The rate limit policy will only apply to requests that contain a JWT with the specified claim and value. For example, the following JWT payload will match the JWT condition:
+
+```json
+{
+  "user_details": {
+    "level": "premium"
+  }, 
+  "sub": "client1"
+}
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``claim`` | Claim is the JWT claim to be rate limit by. Nested claims should be separated by ".". | ``string`` | Yes |
+|``match`` | the value of the claim to match against. | ``string`` | Yes |
+{{% /table %}}
+
+### APIKey
+
+The API Key auth policy configures NGINX to authorize client requests based on the presence of a valid API Key in a header or query param specified in the policy.
+
+{{< note >}}
+
+The feature is implemented using NGINX [ngx_http_auth_request_module](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) and [NGINX JavaScript (NJS)](https://nginx.org/en/docs/njs/).
+
+{{< /note >}}
+
+The policies' API keys are securely stored using SHA-256 hashing. When a client sends an API Key, it is hashed by NJS and then compared to the hashed API Key in the NGINX config.
+
+If the hashed keys match, the NGINX JavaScript (NJS) subrequest issues a 204 No Content response to the `auth_request` directive, indicating successful authorization. Conversely, if no API Key is provided in the specified header or query parameter, a 401 Unauthorized response is returned. Similarly, if an invalid key is presented in the expected header or query parameter, a 403 Forbidden response is issued, denying access.
+
+It is possible to use the [errorPages](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#errorpage) property on a route, to change the default behaviour of 401 or 403 errors.
+
+At least one header or query param is required.
+
+The policy below configures NGINX Ingress Controller to require the API Key `password` in the header "my-header".
+
+```yaml
+apiKey:
+    suppliedIn:
+      header:
+      - "my-header"
+    clientSecret: api-key-secret
+```
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: api-key-secret
+type: nginx.org/apikey
+data:
+    client1: cGFzc3dvcmQ= # password
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``suppliedIn`` | `header` or `query`. | | Yes |
+|``suppliedIn.header`` | An array of headers that the API Key may appear in. | ``string[]`` | No |
+|``suppliedIn.query`` | An array of query params that the API Key may appear in. | ``string[]`` | No |
+|``clientSecret`` | The name of the Kubernetes secret that stores the API Key(s). It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/apikey``, and the API Key(s) must be stored in a key: val format where each key is a unique clientID and each value is a unique base64 encoded API Key  | ``string`` | Yes |
+{{% /table %}}
+
+{{<important>}}An APIKey Policy must include a minimum of one of the `suppliedIn.header` or `suppliedIn.query` parameters.  Both can also be supplied.{{</important>}}
+
+#### APIKey Merging Behavior
+
+A VirtualServer or VirtualServerRoute can be associated with only one API Key policy per route or subroute. However, it is possible to replace an API Key policy from a higher-level with a different policy defined on a more specific route.
+
+For example, a VirtualServer can implement different API Key policies at various levels. In the configuration below, the server-wide api-key-policy-server applies to /backend1 for authorization, as it lacks a more specific policy. Meanwhile, /backend2 uses the api-key-policy-route defined at the route level.
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: virtual-server
+spec:
+  host: virtual-server.example.com
+  policies:
+  - name: api-key-policy-server
+  upstreams:
+  - name: backend2
+    service: backend2-svc
+    port: 80
+  - name: backend1
+    service: backend1-svc
+    port: 80
+  routes:
+  - path: /backend1
+    action:
+      pass: backend1
+  - path: /backend2
+    action:
+      pass: backend2
+    policies:
+      - name: api-key-policy-route
+```
+
+### BasicAuth
+
+The basic auth policy configures NGINX to authenticate client requests using the [HTTP Basic authentication scheme](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication).
+
+For example, the following policy will reject all requests that do not include a valid username/password combination in the HTTP header `Authentication`
+
+```yaml
+basicAuth:
+  secret: htpasswd-secret
+  realm: "My API"
+```
+{{< note >}}
+The feature is implemented using the NGINX [ngx_http_auth_basic_module](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html).
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of the Kubernetes secret that stores the Htpasswd configuration. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/htpasswd``, and the config must be stored in the secret under the key ``htpasswd``, otherwise the secret will be rejected as invalid. | ``string`` | Yes |
+|``realm`` | The realm for the basic authentication. | ``string`` | No |
+{{% /table %}}
+
+#### BasicAuth Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple basic auth policies. However, only one can be applied. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: basic-auth-policy-one
+- name: basic-auth-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `basic-auth-policy-one`, and ignores `basic-auth-policy-two`.
+
+### JWT Using Local Kubernetes Secret
+
+{{< note >}}
+
+This feature is only available with NGINX Plus.
+
+{{< /note >}}
+
+The JWT policy configures NGINX Plus to authenticate client requests using JSON Web Tokens.
+
+The following example policy will reject all requests that do not include a valid JWT in the HTTP header `token`:
+
+```yaml
+jwt:
+  secret: jwk-secret
+  realm: "My API"
+  token: $http_token
+```
+
+You can pass the JWT claims and JOSE headers to the upstream servers. For example:
+
+```yaml
+action:
+  proxy:
+    upstream: webapp
+    requestHeaders:
+      set:
+      - name: user
+        value: ${jwt_claim_user}
+      - name: alg
+        value: ${jwt_header_alg}
+```
+
+We use the `requestHeaders` of the [Action.Proxy](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#actionproxy) to set the values of two headers that NGINX will pass to the upstream servers.
+
+The value of the `${jwt_claim_user}` variable is the `user` claim of a JWT. For other claims, use `${jwt_claim_name}`, where `name` is the name of the claim. Note that nested claims and claims that include a period (`.`) are not supported. Similarly, use `${jwt_header_name}` where `name` is the name of a header. In our example, we use the `alg` header.
+
+{{< note >}}
+
+This feature is implemented using the NGINX Plus [ngx_http_auth_jwt_module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of the Kubernetes secret that stores the JWK. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/jwk``, and the JWK must be stored in the secret under the key ``jwk``, otherwise the secret will be rejected as invalid. | ``string`` | Yes |
+|``realm`` | The realm of the JWT. | ``string`` | Yes |
+|``token`` | The token specifies a variable that contains the JSON Web Token. By default the JWT is passed in the ``Authorization`` header as a Bearer Token. JWT may be also passed as a cookie or a part of a query string, for example: ``$cookie_auth_token``. Accepted variables are ``$http_``, ``$arg_``, ``$cookie_``. | ``string`` | No |
+{{% /table %}}
+
+#### JWT Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple JWT policies. However, only one can be applied: every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: jwt-policy-one
+- name: jwt-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `jwt-policy-one`, and ignores `jwt-policy-two`.
+
+### JWT Using JWKS From Remote Location
+
+{{< note >}}
+
+This feature is only available with NGINX Plus.
+
+{{< /note >}}
+
+The JWT policy configures NGINX Plus to authenticate client requests using JSON Web Tokens, allowing import of the keys (JWKS) for JWT policy by means of a URL (for a remote server or an identity provider) as a result they don't have to be copied and updated to the IC pod.
+
+The following example policy will reject all requests that do not include a valid JWT in the HTTP header fetched from the identity provider:
+
+```yaml
+jwt:
+  realm: MyProductAPI
+  token: $http_token
+  jwksURI: <uri_to_remote_server_or_idp>
+  keyCache: 1h
+```
+
+{{< note >}}
+
+This feature is implemented using the NGINX Plus directive [auth_jwt_key_request](http://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html#auth_jwt_key_request) under [ngx_http_auth_jwt_module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``jwksURI`` | The remote URI where the request will be sent to retrieve JSON Web Key set| ``string`` | Yes |
+|``keyCache`` | Enables in-memory caching of JWKS (JSON Web Key Sets) that are obtained from the ``jwksURI`` and sets a valid time for expiration. | ``string`` | Yes |
+|``realm`` | The realm of the JWT. | ``string`` | Yes |
+|``token`` | The token specifies a variable that contains the JSON Web Token. By default the JWT is passed in the ``Authorization`` header as a Bearer Token. JWT may be also passed as a cookie or a part of a query string, for example: ``$cookie_auth_token``. Accepted variables are ``$http_``, ``$arg_``, ``$cookie_``. | ``string`` | No |
+{{% /table %}}
+
+{{< note >}}
+
+Content caching is enabled by default for each JWT policy with a default time of 12 hours.
+
+This is done to ensure to improve resiliency by allowing the JWKS (JSON Web Key Set) to be retrieved from the cache even when it has expired.
+
+{{< /note >}}
+
+#### JWT Merging Behavior
+
+This behavior is similar to using a local Kubernetes secret where a VirtualServer/VirtualServerRoute can reference multiple JWT policies. However, only one can be applied: every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: jwt-policy-one
+- name: jwt-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `jwt-policy-one`, and ignores `jwt-policy-two`.
+
+### IngressMTLS
+
+The IngressMTLS policy configures client certificate verification.
+
+For example, the following policy will verify a client certificate using the CA certificate specified in the `ingress-mtls-secret`:
+
+```yaml
+ingressMTLS:
+  clientCertSecret: ingress-mtls-secret
+  verifyClient: "on"
+  verifyDepth: 1
+```
+
+Below is an example of the `ingress-mtls-secret` using the secret type `nginx.org/ca`
+
+```yaml
+kind: Secret
+metadata:
+  name: ingress-mtls-secret
+apiVersion: v1
+type: nginx.org/ca
+data:
+  ca.crt: <base64encoded-certificate>
+```
+
+A VirtualServer that references an IngressMTLS policy must:
+
+- Enable [TLS termination](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualservertls).
+- Reference the policy in the VirtualServer [`spec`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserver-specification). It is not allowed to reference an IngressMTLS policy in a [`route`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroute) or in a VirtualServerRoute [`subroute`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroutesubroute).
+
+If the conditions above are not met, NGINX will send the `500` status code to clients.
+
+You can pass the client certificate details, including the certificate, to the upstream servers. For example:
+
+```yaml
+action:
+  proxy:
+    upstream: webapp
+    requestHeaders:
+      set:
+      - name: client-cert-subj-dn
+        value: ${ssl_client_s_dn} # subject DN
+      - name: client-cert
+        value: ${ssl_client_escaped_cert} # client certificate in the PEM format (urlencoded)
+```
+
+We use the `requestHeaders` of the [Action.Proxy](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#actionproxy) to set the values of the two headers that NGINX will pass to the upstream servers. See the [list of embedded variables](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables) that are supported by the `ngx_http_ssl_module`, which you can use to pass the client certificate details.
+
+{{< note >}}
+
+ The feature is implemented using the NGINX [ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html).
+
+ {{< /note >}}
+
+#### Using a Certificate Revocation List
+
+The IngressMTLS policy supports configuring at CRL for your policy.
+This can be done in one of two ways.
+
+{{< note >}}
+
+ Only one of these configurations options can be used at a time.
+
+{{< /note >}}
+
+1. Adding the `ca.crl` field to the `nginx.org/ca` secret type, which accepts a base64 encoded certificate revocation list (crl).
+   Example YAML:
+
+```yaml
+kind: Secret
+metadata:
+  name: ingress-mtls-secret
+apiVersion: v1
+type: nginx.org/ca
+data:
+  ca.crt: <base64encoded-certificate>
+  ca.crl: <base64encoded-crl>
+```
+
+2. Adding the `crlFileName` field to your IngressMTLS policy spec with the name of the CRL file.
+
+{{< note >}}
+
+This configuration option should only be used when using a CRL that is larger than 1MiB.
+
+Otherwise we recommend using the `nginx.org/ca` secret type for managing your CRL.
+
+{{< /note >}}
+
+Example YAML:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: ingress-mtls-policy
+spec:
+ingressMTLS:
+    clientCertSecret: ingress-mtls-secret
+    crlFileName: webapp.crl
+    verifyClient: "on"
+    verifyDepth: 1
+```
+
+**IMPORTANT NOTE**
+When configuring a CRL with the `ingressMTLS.crlFileName` field, there is additional context to keep in mind:
+
+1. NGINX Ingress Controller will expect the CRL, in this case `webapp.crl`, will be in `/etc/nginx/secrets`. A volume mount will need to be added to NGINX Ingress Controller deployment add your CRL to `/etc/nginx/secrets`
+2. When updating the content of your CRL (e.g a new certificate has been revoked), NGINX will need to be reloaded to pick up the latest changes. Depending on your environment this may require updating the name of your CRL and applying this update to your `ingress-mtls.yaml` policy to ensure NGINX picks up the latest CRL.
+
+Please refer to the Kubernetes documentation on [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) to find the best implementation for your environment.
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``clientCertSecret`` | The name of the Kubernetes secret that stores the CA certificate. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/ca``, and the certificate must be stored in the secret under the key ``ca.crt``, otherwise the secret will be rejected as invalid. | ``string`` | Yes |
+|``verifyClient`` | Verification for the client. Possible values are ``"on"``, ``"off"``, ``"optional"``, ``"optional_no_ca"``. The default is ``"on"``. | ``string`` | No |
+|``verifyDepth`` | Sets the verification depth in the client certificates chain. The default is ``1``. | ``int`` | No |
+|``crlFileName`` | The file name of the Certificate Revocation List. NGINX Ingress Controller will look for this file in `/etc/nginx/secrets` | ``string`` | No |
+{{% /table %}}
+
+#### IngressMTLS Merging Behavior
+
+A VirtualServer can reference only a single IngressMTLS policy. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: ingress-mtls-policy-one
+- name: ingress-mtls-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `ingress-mtls-policy-one`, and ignores `ingress-mtls-policy-two`.
+
+### EgressMTLS
+
+The EgressMTLS policy configures upstreams authentication and certificate verification.
+
+For example, the following policy will use `egress-mtls-secret` to authenticate with the upstream application and `egress-trusted-ca-secret` to verify the certificate of the application:
+
+```yaml
+egressMTLS:
+  tlsSecret: egress-mtls-secret
+  trustedCertSecret: egress-trusted-ca-secret
+  verifyServer: on
+  verifyDepth: 2
+```
+
+{{< note >}}
+
+The feature is implemented using the NGINX [ngx_http_proxy_module](https://nginx.org/en/docs/http/ngx_http_proxy_module.html).
+
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``tlsSecret`` | The name of the Kubernetes secret that stores the TLS certificate and key. It must be in the same namespace as the Policy resource. The secret must be of the type ``kubernetes.io/tls``, the certificate must be stored in the secret under the key ``tls.crt``, and the key must be stored under the key ``tls.key``, otherwise the secret will be rejected as invalid. | ``string`` | No |
+|``trustedCertSecret`` | The name of the Kubernetes secret that stores the CA certificate. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/ca``, and the certificate must be stored in the secret under the key ``ca.crt``, otherwise the secret will be rejected as invalid. | ``string`` | No |
+|``verifyServer`` | Enables verification of the upstream HTTPS server certificate. | ``bool`` | No |
+|``verifyDepth`` | Sets the verification depth in the proxied HTTPS server certificates chain. The default is ``1``. | ``int`` | No |
+|``sessionReuse`` | Enables reuse of SSL sessions to the upstreams. The default is ``true``. | ``bool`` | No |
+|``serverName`` | Enables passing of the server name through ``Server Name Indication`` extension. | ``bool`` | No |
+|``sslName`` | Allows overriding the server name used to verify the certificate of the upstream HTTPS server. | ``string`` | No |
+|``ciphers`` | Specifies the enabled ciphers for requests to an upstream HTTPS server. The default is ``DEFAULT``. | ``string`` | No |
+|``protocols`` | Specifies the protocols for requests to an upstream HTTPS server. The default is ``TLSv1 TLSv1.1 TLSv1.2``. | ``string`` | No | > Note: the value of ``ciphers`` and ``protocols`` is not validated by NGINX Ingress Controller. As a result, NGINX can fail to reload the configuration. To ensure that the configuration for a VirtualServer/VirtualServerRoute that references the policy was successfully applied, check its [status](/nginx-ingress-controller/configuration/global-configuration/reporting-resources-status/#virtualserver-and-virtualserverroute-resources). The validation will be added in the future releases. |
+{{% /table %}}
+
+#### EgressMTLS Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple EgressMTLS policies. However, only one can be applied. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: egress-mtls-policy-one
+- name: egress-mtls-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `egress-mtls-policy-one`, and ignores `egress-mtls-policy-two`.
+
+### OIDC
+
+{{< tip >}}
+
+This feature is disabled by default. To enable it, set the [enable-oidc]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-oidc" >}}) command-line argument of NGINX Ingress Controller.
+
+{{< /tip >}}
+
+The OIDC policy configures NGINX Plus as a relying party for OpenID Connect authentication.
+
+For example, the following policy will use the client ID `nginx-plus` and the client secret `oidc-secret` to authenticate with the OpenID Connect provider `https://idp.example.com`:
+
+```yaml
+spec:
+  oidc:
+    clientID: nginx-plus
+    clientSecret: oidc-secret
+    authEndpoint: https://idp.example.com/openid-connect/auth
+    tokenEndpoint: https://idp.example.com/openid-connect/token
+    jwksURI: https://idp.example.com/openid-connect/certs
+    endSessionEndpoint: https://idp.example.com/openid-connect/logout
+    postLogoutRedirectURI: /
+    accessTokenEnable: true
+    pkceEnable: false
+```
+
+NGINX Plus will pass the ID of an authenticated user to the backend in the HTTP header `username`.
+
+{{< note >}}
+
+The feature is implemented using the [reference implementation](https://github.com/nginxinc/nginx-openid-connect/) of NGINX Plus as a relying party for OpenID Connect authentication.
+
+{{< /note >}}
+
+#### Prerequisites
+
+In order to use OIDC, you need to enable [zone synchronization](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync/). If you don't set up zone synchronization, NGINX Plus will fail to reload.
+You also need to configure a resolver, which NGINX Plus will use to resolve the IDP authorization endpoint. You can find an example configuration [in our GitHub repository](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/custom-resources/oidc#step-7---configure-nginx-plus-zone-synchronization-and-resolver).
+
+{{< warning >}}
+
+The configuration in the example doesn't enable TLS and the synchronization between the replica happens in clear text. This could lead to the exposure of tokens.
+
+{{< /warning >}}
+
+#### Limitations
+
+The OIDC policy defines a few internal locations that can't be customized: `/_jwks_uri`, `/_token`, `/_refresh`, `/_id_token_validation`, `/logout`. In addition, as explained below, `/_codexch` is the default value for redirect URI, and `/_logout` is the default value for post logout redirect URI, both of which can be customized. Specifying one of these locations as a route in the VirtualServer or VirtualServerRoute will result in a collision and NGINX Plus will fail to reload.
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``clientID`` | The client ID provided by your OpenID Connect provider. | ``string`` | Yes |
+|``clientSecret`` | The name of the Kubernetes secret that stores the client secret provided by your OpenID Connect provider. It must be in the same namespace as the Policy resource. The secret must be of the type ``nginx.org/oidc``, and the secret under the key ``client-secret``, otherwise the secret will be rejected as invalid. If PKCE is enabled, this should be not configured. | ``string`` | Yes |
+|``authEndpoint`` | URL for the authorization endpoint provided by your OpenID Connect provider. | ``string`` | Yes |
+|``authExtraArgs`` | A list of extra URL arguments to pass to the authorization endpoint provided by your OpenID Connect provider. Arguments must be URL encoded, multiple arguments may be included in the list, for example ``[ arg1=value1, arg2=value2 ]`` | ``string[]`` | No |
+|``tokenEndpoint`` | URL for the token endpoint provided by your OpenID Connect provider. | ``string`` | Yes |
+|``endSessionEndpoint`` | URL provided by your OpenID Connect provider to request the end user be logged out. | ``string`` | No |
+|``jwksURI`` | URL for the JSON Web Key Set (JWK) document provided by your OpenID Connect provider. | ``string`` | Yes |
+|``scope`` | List of OpenID Connect scopes. The scope ``openid`` always needs to be present and others can be added concatenating them with a ``+`` sign, for example ``openid+profile+email``, ``openid+email+userDefinedScope``. The default is ``openid``. | ``string`` | No |
+|``redirectURI`` | Allows overriding the default redirect URI. The default is ``/_codexch``. | ``string`` | No |
+|``postLogoutRedirectURI`` | URI to redirect to after the logout has been performed. Requires ``endSessionEndpoint``. The default is ``/_logout``. | ``string`` | No |
+|``zoneSyncLeeway`` | Specifies the maximum timeout in milliseconds for synchronizing ID/access tokens and shared values between Ingress Controller pods. The default is ``200``. | ``int`` | No |
+|``accessTokenEnable`` | Option of whether Bearer token is used to authorize NGINX to access protected backend. | ``boolean`` | No |
+|``pkceEnable`` | Switches Proof Key for Code Exchange on. The OpenID client needs to be in public mode. `clientSecret` is not used in this mode. | ``boolean`` | No |
+{{% /table %}}
+
+{{< note >}}
+
+Only one OIDC policy can be referenced in a VirtualServer and its VirtualServerRoutes. However, the same policy can still be applied to different routes in the VirtualServer and VirtualServerRoutes.
+
+{{< /note >}}
+
+#### OIDC Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference only a single OIDC policy. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: oidc-policy-one
+- name: oidc-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `oidc-policy-one`, and ignores `oidc-policy-two`.
+
+## Using Policy
+
+You can use the usual `kubectl` commands to work with Policy resources, just as with built-in Kubernetes resources.
+
+For example, the following command creates a Policy resource defined in `access-control-policy-allow.yaml` with the name `webapp-policy`:
+
+```shell
+kubectl apply -f access-control-policy-allow.yaml
+
+policy.k8s.nginx.org/webapp-policy configured
+```
+
+You can get the resource by running:
+
+```shell
+kubectl get policy webapp-policy
+
+NAME            AGE
+webapp-policy   27m
+```
+
+For `kubectl get` and similar commands, you can also use the short name `pol` instead of `policy`.
+
+### WAF {#waf}
+
+{{< note >}} The feature is implemented using the NGINX Plus [NGINX App Protect WAF Module](https://docs.nginx.com/nginx-app-protect/configuration/). {{< /note >}}
+
+The WAF policy configures NGINX Plus to secure client requests using App Protect WAF policies.
+
+For example, the following policy will enable the referenced APPolicy. You can configure multiple APLogConfs with log destinations:
+
+```yaml
+waf:
+  enable: true
+  apPolicy: "default/dataguard-alarm"
+  securityLogs:
+  - enable: true
+    apLogConf: "default/logconf"
+    logDest: "syslog:server=syslog-svc.default:514"
+  - enable: true
+    apLogConf: "default/logconf"
+    logDest: "syslog:server=syslog-svc-secondary.default:514"
+```
+
+{{< note >}} The field `waf.securityLog` is deprecated and will be removed in future releases.It will be ignored if `waf.securityLogs` is populated. {{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables NGINX App Protect WAF. | ``bool`` | Yes |
+|``apPolicy`` | The [App Protect WAF policy]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. Accepts an optional namespace. Mutually exclusive with ``apBundle``. | ``string`` | No |
+|``apBundle`` | The [App Protect WAF policy bundle]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}). Mutually exclusive with ``apPolicy``. | ``string`` | No |
+|``securityLog.enable`` | Enables security log. | ``bool`` | No |
+|``securityLog.apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. Accepts an optional namespace. Only works with ``apPolicy``. | ``string`` | No |
+|``securityLog.apLogBundle`` | The [App Protect WAF log bundle]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) resource. Only works with ``apBundle``. | ``string`` | No |
+|``securityLog.logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=<ip-address &#124; localhost; fqdn>:<port>``, ``stderr``, ``<absolute path to file>``. | ``string`` | No |
+{{% /table %}}
+
+#### WAF Merging Behavior
+
+A VirtualServer/VirtualServerRoute can reference multiple WAF policies. However, only one can be applied. Every subsequent reference will be ignored. For example, here we reference two policies:
+
+```yaml
+policies:
+- name: waf-policy-one
+- name: waf-policy-two
+```
+
+In this example NGINX Ingress Controller will use the configuration from the first policy reference `waf-policy-one`, and ignores `waf-policy-two`.
+
+### Applying Policies
+
+You can apply policies to both VirtualServer and VirtualServerRoute resources. For example:
+
+- VirtualServer:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: VirtualServer
+    metadata:
+      name: cafe
+      namespace: cafe
+    spec:
+      host: cafe.example.com
+      tls:
+        secret: cafe-secret
+      policies: # spec policies
+      - name: policy1
+      upstreams:
+      - name: coffee
+        service: coffee-svc
+        port: 80
+      routes:
+      - path: /tea
+        policies: # route policies
+        - name: policy2
+          namespace: cafe
+        route: tea/tea
+      - path: /coffee
+        policies: # route policies
+        - name: policy3
+          namespace: cafe
+        action:
+          pass: coffee
+      ```
+
+      For VirtualServer, you can apply a policy:
+  * to all routes (spec policies)
+  * to a specific route (route policies)
+
+      Route policies of the *same type* override spec policies. In the example above, if the type of the policies `policy-1` and `policy-3` is `accessControl`, then for requests to `cafe.example.com/coffee`, NGINX will apply `policy-3`.
+
+      The overriding is enforced by NGINX: the spec policies are implemented in the `server` context of the config, and the route policies are implemented in the `location` context. As a result, the route policies of the same type win.
+
+- VirtualServerRoute, which is referenced by the VirtualServer above:
+
+    ```yaml
+    apiVersion: k8s.nginx.org/v1
+    kind: VirtualServerRoute
+    metadata:
+      name: tea
+      namespace: tea
+    spec:
+      host: cafe.example.com
+      upstreams:
+      - name: tea
+        service: tea-svc
+        port: 80
+      subroutes: # subroute policies
+      - path: /tea
+        policies:
+        - name: policy4
+          namespace: tea
+        action:
+          pass: tea
+    ```
+
+    For VirtualServerRoute, you can apply a policy to a subroute (subroute policies).
+
+    Subroute policies of the same type override spec policies. In the example above, if the type of the policies `policy-1` (in the VirtualServer) and `policy-4` is `accessControl`, then for requests to `cafe.example.com/tea`, NGINX will apply `policy-4`. As with the VirtualServer, the overriding is enforced by NGINX.
+
+    Subroute policies always override route policies no matter the types. For example, the policy `policy-2` in the VirtualServer route will be ignored for the subroute `/tea`, because the subroute has its own policies (in our case, only one policy `policy4`). If the subroute didn't have any policies, then the `policy-2` would be applied. This overriding is enforced by NGINX Ingress Controller -- the `location` context for the subroute will either have route policies or subroute policies, but not both.
+
+### Invalid Policies
+
+NGINX will treat a policy as invalid if one of the following conditions is met:
+
+- The policy doesn't pass the [comprehensive validation](#comprehensive-validation).
+- The policy isn't present in the cluster.
+- The policy doesn't meet its type-specific requirements. For example, an `ingressMTLS` policy requires TLS termination enabled in the VirtualServer.
+
+For an invalid policy, NGINX returns the 500 status code for client requests with the following rules:
+
+- If a policy is referenced in a VirtualServer `route` or a VirtualServerRoute `subroute`, then NGINX will return the 500 status code for requests for the URIs of that route/subroute.
+- If a policy is referenced in the VirtualServer `spec`, then NGINX will return the 500 status code for requests for all URIs of that VirtualServer.
+
+If a policy is invalid, the VirtualServer or VirtualServerRoute will have the [status](/nginx-ingress-controller/configuration/global-configuration/reporting-resources-status#virtualserver-and-virtualserverroute-resources) with the state `Warning` and the message explaining why the policy wasn't considered invalid.
+
+### Validation
+
+Two types of validation are available for the Policy resource:
+
+- *Structural validation*, done by `kubectl` and the Kubernetes API server.
+- *Comprehensive validation*, done by NGINX Ingress Controller.
+
+#### Structural Validation
+
+The custom resource definition for the Policy includes a structural OpenAPI schema, which describes the type of every field of the resource.
+
+If you try to create (or update) a resource that violates the structural schema -- for example, the resource uses a string value instead of an array of strings in the `allow` field -- `kubectl` and the Kubernetes API server will reject the resource.
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f access-control-policy-allow.yaml
+
+    error: error validating "access-control-policy-allow.yaml": error validating data: ValidationError(Policy.spec.accessControl.allow): invalid type for org.nginx.k8s.v1.Policy.spec.accessControl.allow: got "string", expected "array"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f access-control-policy-allow.yaml --validate=false
+
+    The Policy "webapp-policy" is invalid: spec.accessControl.allow: Invalid value: "string": spec.accessControl.allow in body must be of type array: "string"
+    ```
+
+If a resource passes structural validation, then NGINX Ingress Controller's comprehensive validation runs.
+
+#### Comprehensive Validation
+
+NGINX Ingress Controller validates the fields of a Policy resource. If a resource is invalid, NGINX Ingress Controller will reject it. The resource will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can use `kubectl` to check whether or not NGINX Ingress Controller successfully applied a Policy configuration. For our example `webapp-policy` Policy, we can run:
+
+```shell
+kubectl describe pol webapp-policy
+
+. . .
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  11s   nginx-ingress-controller  Policy default/webapp-policy was added or updated
+```
+
+Note how the events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid resource, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create a Policy `webapp-policy` with an invalid IP `10.0.0.` in the `allow` field, you will get:
+
+```shell
+kubectl describe policy webapp-policy
+
+. . .
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  7s    nginx-ingress-controller  Policy default/webapp-policy is invalid and was rejected: spec.accessControl.allow[0]: Invalid value: "10.0.0.": must be a CIDR or IP
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+Additionally, this information is also available in the `status` field of the Policy resource. Note the Status section of the Policy:
+
+```shell
+kubectl describe pol webapp-policy
+
+. . .
+Status:
+  Message:  Policy default/webapp-policy is invalid and was rejected: spec.accessControl.allow[0]: Invalid value: "10.0.0.": must be a CIDR or IP
+  Reason:   Rejected
+  State:    Invalid
+```
+
+**Note**: If you make an existing resource invalid, NGINX Ingress Controller will reject it.
diff --git a/content/nic/configuration/security.md b/content/nic/configuration/security.md
new file mode 100644
index 000000000..f0b74f6a3
--- /dev/null
+++ b/content/nic/configuration/security.md
@@ -0,0 +1,102 @@
+---
+docs: DOCS-597
+doctypes:
+- ''
+title: Security recommendations
+toc: true
+weight: 300
+---
+
+F5 NGINX Ingress Controller follows Kubernetes best practices: this page outlines configuration specific to NGINX Ingress Controller you may require, including links to examples in the [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples).
+
+For general guidance, we recommend the official Kubernetes documentation for [Securing a Cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/).
+
+## Kubernetes recommendations
+
+### RBAC and Service Accounts
+
+Kubernetes uses [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) to control the resources and operations available to different types of users.
+
+NGINX Ingress Controller requires RBAC to configure a [ServiceUser](https://kubernetes.io/docs/concepts/security/service-accounts/#default-service-accounts), and provides least privilege access in its standard deployment configurations:
+
+- [Helm](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/deployments/rbac/rbac.yaml)
+- [Manifests](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/deployments/rbac/rbac.yaml)
+
+By default, the ServiceAccount has access to all Secret resources in the cluster.
+
+### Secrets
+
+[Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) are required by NGINX Ingress Controller for certificates and privacy keys, which Kubernetes stores unencrypted by default. We recommend following the [Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) to store these Secrets using at-rest encryption.
+
+
+## NGINX Ingress Controller recommendations
+
+### Configure root filesystem as read-only
+
+{{< caution >}}
+ This feature is compatible with [NGINX App Protect WAFv5](https://docs.nginx.com/nginx-app-protect-waf/v5/). It is not compatible with [NGINX App Protect WAFv4](https://docs.nginx.com/nginx-app-protect-waf/v4/) or [NGINX App Protect DoS](https://docs.nginx.com/nginx-app-protect-dos/).
+{{< /caution >}}
+
+NGINX Ingress Controller is designed to be resilient against attacks in various ways, such as running the service as non-root to avoid changes to files. We recommend setting filesystems on all containers to read-only, this includes `nginx-ingress-controller`, though also includes `waf-enforcer` and `waf-config-mgr` when NGINX App Protect WAFv5 is in use.  This is so that the attack surface is further reduced by limiting changes to binaries and libraries.
+
+This is not enabled by default, but can be enabled with **Helm** using the [**readOnlyRootFilesystem**]({{< ref "/nic/installation/installing-nic/installation-with-helm.md#configuration" >}}) argument in security contexts on all containers: `nginx-ingress-controller`, `waf_enforcer` and `waf_config_mgr`.
+
+For **Manifests**, uncomment the following sections of the deployment and add sections for `waf-enforcer` and `waf-config-mgr` containers:
+
+- `readOnlyRootFilesystem: true`
+- The entire **volumeMounts** section
+- The entire **initContainers** section
+
+The block below shows the code you will look for:
+
+```yaml
+#      volumes:
+#      - name: nginx-etc
+#        emptyDir: {}
+#      - name: nginx-cache
+#        emptyDir: {}
+#      - name: nginx-lib
+#        emptyDir: {}
+#      - name: nginx-log
+#        emptyDir: {}
+.
+.
+.
+#          readOnlyRootFilesystem: true
+.
+.
+.
+#        volumeMounts:
+#        - mountPath: /etc/nginx
+#          name: nginx-etc
+#        - mountPath: /var/cache/nginx
+#          name: nginx-cache
+#        - mountPath: /var/lib/nginx
+#          name: nginx-lib
+#        - mountPath: /var/log/nginx
+#          name: nginx-log
+```
+
+- Add **waf-enforcer** and **waf-config-mgr** container sections
+- Add `readOnlyFilesystem: true` in both containers security context sections
+
+### Prometheus
+
+If Prometheus metrics are [enabled]({{< ref "/nic/logging-and-monitoring/prometheus.md" >}}), we recommend [using HTTPS]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-prometheus-tls-secret" >}}).
+
+### Snippets
+
+Snippets allow raw NGINX configuration to be inserted into resources. They are intended for advanced NGINX users and could create vulnerabilities in a cluster if misused.
+
+Snippets are disabled by default. To use snippets, set the [**enable-snippets**]({{< ref"/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-snippets" >}}) command-line argument.
+
+{{< caution >}}
+ Snippets are **always** enabled for ConfigMap.
+{{< /caution >}}
+
+For more information, read the following:
+
+- [Advanced configuration using Snippets]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}})
+- [Using Snippets with VirtualServer/VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#using-snippets" >}})
+- [Using Snippets with TransportServer]({{< ref "/nic/configuration/transportserver-resource.md#using-snippets" >}})
+- [ConfigMap snippets and custom templates]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}})
diff --git a/content/nic/configuration/transportserver-resource.md b/content/nic/configuration/transportserver-resource.md
new file mode 100644
index 000000000..b725ea2e6
--- /dev/null
+++ b/content/nic/configuration/transportserver-resource.md
@@ -0,0 +1,416 @@
+---
+title: TransportServer resources
+toc: true
+weight: 600
+docs: DOCS-598
+---
+
+This document is reference material for the TransportServer resource used by F5 NGINX Ingress Controller.
+
+The TransportServer resource allows you to configure TCP, UDP, and TLS Passthrough load balancing. The resource is implemented as a [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+The GitHub repository has [examples of the resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources) for specific use cases.
+
+## Prerequisites
+
+- For TCP and UDP, the TransportServer resource must be used in conjunction with the [GlobalConfiguration resource]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}), which must be created separately.
+- For TLS Passthrough, make sure to enable the [`-enable-tls-passthrough`]({{< ref "/nic/configuration/global-configuration/command-line-arguments#cmdoption-enable-tls-passthrough.md" >}}) command-line argument of NGINX Ingress Controller.
+
+## TransportServer Specification
+
+The TransportServer resource defines load balancing configuration for TCP, UDP, or TLS Passthrough traffic. Below are a few examples:
+
+- TCP load balancing:
+
+  ```yaml
+  apiVersion: k8s.nginx.org/v1
+  kind: TransportServer
+  metadata:
+    name: dns-tcp
+  spec:
+    host: dns.example.com
+    listener:
+      name: dns-tcp
+      protocol: TCP
+    tls:
+      secret: cafe-secret
+    upstreams:
+    - name: dns-app
+      service: dns-service
+      port: 5353
+    action:
+      pass: dns-app
+  ```
+
+- UDP load balancing:
+
+  ```yaml
+  apiVersion: k8s.nginx.org/v1
+  kind: TransportServer
+  metadata:
+    name: dns-udp
+  spec:
+    listener:
+      name: dns-udp
+      protocol: UDP
+    upstreams:
+    - name: dns-app
+      service: dns-service
+      port: 5353
+    upstreamParameters:
+      udpRequests: 1
+      udpResponses: 1
+    action:
+      pass: dns-app
+  ```
+
+- TLS passthrough load balancing:
+
+  ```yaml
+  apiVersion: k8s.nginx.org/v1
+  kind: TransportServer
+  metadata:
+    name: secure-app
+  spec:
+    listener:
+      name: tls-passthrough
+      protocol: TLS_PASSTHROUGH
+    host: app.example.com
+    upstreams:
+    - name: secure-app
+      service: secure-app
+      port: 8443
+    action:
+      pass: secure-app
+  ```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``listener`` | The listener on NGINX that will accept incoming connections/datagrams. | [listener](#listener) | Yes |
+|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. Wildcard domains like ``*.example.com`` are not allowed. When specified, NGINX will use this host for SNI-based routing. For TLS Passthrough, this field is required. For TCP with TLS termination, specifying the host enables SNI routing and requires specifying a TLS secret.| ``string`` | No |
+|``tls`` | The TLS termination configuration. Not supported for TLS Passthrough load balancing. | [tls](#tls) | No |
+|``upstreams`` | A list of upstreams. | [[]upstream](#upstream) | Yes |
+|``upstreamParameters`` | The upstream parameters. | [upstreamParameters](#upstreamparameters) | No |
+|``action`` | The action to perform for a client connection/datagram. | [action](#action) | Yes |
+|``ingressClassName`` | Specifies which Ingress Controller must handle the TransportServer resource. | ``string`` | No |
+|``streamSnippets`` | Sets a custom snippet in the ``stream`` context. | ``string`` | No |
+|``serverSnippets`` | Sets a custom snippet in the ``server`` context. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- Required for TLS Passthrough load balancing.
+
+### Listener
+
+The listener field references a listener that NGINX will use to accept incoming traffic for the TransportServer. For TCP and UDP, the listener must be defined in the [GlobalConfiguration resource]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}). When referencing a listener, both the name and the protocol must match. For TLS Passthrough, use the built-in listener with the name `tls-passthrough` and the protocol `TLS_PASSTHROUGH`.
+
+The combination of ``spec.listener.name`` and ``spec.host`` must be unique among all TransportServers. If two TransportServers specify the same combination of ``spec.listener.name`` and ``spec.host``, one of them will be rejected to prevent conflicts. In the case where no host is specified, it is considered an empty string.
+
+An example:
+
+```yaml
+listener:
+  name: dns-udp
+  protocol: UDP
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the listener. | ``string`` | Yes |
+|``protocol`` | The protocol of the listener. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### TLS
+
+The tls field defines TLS configuration for a TransportServer. When using TLS termination (not TLS Passthrough), you can specify the host field to enable SNI-based routing, allowing multiple applications to share the same listener port and be distinguished by the TLS SNI hostname. Each application can use its own TLS certificate and key specified via the secret field.
+
+```yaml
+secret: cafe-secret
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of a secret with a TLS certificate and key. The secret must belong to the same namespace as the TransportServer. The secret must be of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that contain the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Upstream
+
+The upstream defines a destination for the TransportServer. For example:
+
+```yaml
+name: secure-app
+service: secure-app
+port: 8443
+maxFails: 3
+maxConns: 100
+failTimeout: 30s
+loadBalancingMethod: least_conn
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the upstream. Must be a valid DNS label as defined in RFC 1035. For example, ``hello`` and ``upstream-123`` are valid. The name must be unique among all upstreams of the resource. | ``string`` | Yes |
+|``service`` | The name of a [service](https://kubernetes.io/docs/concepts/services-networking/service/). The service must belong to the same namespace as the resource. If the service doesn't exist, NGINX will assume the service has zero endpoints and close client connections/ignore datagrams. | ``string`` | Yes |
+|``port`` | The port of the service. If the service doesn't define that port, NGINX will assume the service has zero endpoints and close client connections/ignore datagrams. The port must fall into the range ``1..65535``. | ``int`` | Yes |
+|``maxFails`` | Sets the [number](https://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#max_fails) of unsuccessful attempts to communicate with the server that should happen in the duration set by the failTimeout parameter to consider the server unavailable. The default ``1``. | ``int`` | No |
+|``maxConns`` | Sets the [number](https://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#max_conns) of maximum connections to the proxied server. Default value is zero, meaning there is no limit. The default is ``0``. | ``int`` | No |
+|``failTimeout`` | Sets the [time](https://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#fail_timeout) during which the specified number of unsuccessful attempts to communicate with the server should happen to consider the server unavailable and the period of time the server will be considered unavailable. The default is ``10s``. | ``string`` | No |
+|``healthCheck`` | The health check configuration for the Upstream. See the [health_check](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html#health_check) directive. Note: this feature is supported only in NGINX Plus. | [healthcheck](#upstreamhealthcheck) | No |
+|``loadBalancingMethod`` | The method used to load balance the upstream servers. By default, connections are distributed between the servers using a weighted round-robin balancing method. See the [upstream](http://nginx.org/en/docs/stream/ngx_stream_upstream_module.html#upstream) section for available methods and their details. | ``string`` | No |
+|``backup`` | The name of the backup service of type [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname). This will be used when the primary servers are unavailable. Note: The parameter cannot be used along with the ``random`` , ``hash`` or ``ip_hash`` load balancing methods. | ``string`` | No |
+|``backupPort`` | The port of the backup service. The backup port is required if the backup service name is provided. The port must fall into the range ``1..65535``. | ``uint16`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Healthcheck
+
+The Healthcheck defines an [active health check](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html?#health_check). In the example below we enable a health check for an upstream and configure all the available parameters:
+
+```yaml
+name: secure-app
+service: secure-app
+port: 8443
+healthCheck:
+  enable: true
+  interval: 20s
+  timeout: 30s
+  jitter: 3s
+  fails: 5
+  passes: 5
+  port: 8080
+```
+
+{{< note >}} This feature is only supported with NGINX Plus. {{< /note >}}
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables a health check for an upstream server. The default is ``false``. | ``boolean`` | No |
+|``interval`` | The interval between two consecutive health checks. The default is ``5s``. | ``string`` | No |
+|``timeout`` | This overrides the timeout set by [proxy_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout) which is set in `SessionParameters` for health checks. The default value is ``5s``. | ``string`` | No |
+|``jitter`` | The time within which each health check will be randomly delayed. By default, there is no delay. | ``string`` | No |
+|``fails`` | The number of consecutive failed health checks of a particular upstream server after which this server will be considered unhealthy. The default is ``1``. | ``integer`` | No |
+|``passes`` | The number of consecutive passed health checks of a particular upstream server after which the server will be considered healthy. The default is ``1``. | ``integer`` | No |
+|``port`` | The port used for health check requests. By default, the [server port is used](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html#health_check_port). Note: in contrast with the port of the upstream, this port is not a service port, but a port of a pod. | ``integer`` | No |
+|``match`` | Controls the data to send and the response to expect for the healthcheck. | [match](#upstreamhealthcheckmatch) | No |
+{{</bootstrap-table>}}
+
+### Upstream.Healthcheck.Match
+
+The match controls the data to send and the response to expect for the healthcheck:
+
+```yaml
+match:
+  send: 'GET / HTTP/1.0\r\nHost: localhost\r\n\r\n'
+  expect: "~200 OK"
+```
+
+Both `send` and `expect` fields can contain hexadecimal literals with the prefix `\x` followed by two hex digits, for example, `\x80`.
+
+See the [match](https://nginx.org/en/docs/stream/ngx_stream_upstream_hc_module.html#match) directive for details.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``send`` | A string to send to an upstream server. | ``string`` | No |
+|``expect`` | A literal string or a regular expression that the data obtained from the server should match. The regular expression is specified with the preceding ``~*`` modifier (for case-insensitive matching), or the ``~`` modifier (for case-sensitive matching). NGINX Ingress Controller validates a regular expression using the RE2 syntax. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### UpstreamParameters
+
+The upstream parameters define various parameters for the upstreams:
+
+```yaml
+upstreamParameters:
+  udpRequests: 1
+  udpResponses: 1
+  connectTimeout: 60s
+  nextUpstream: true
+  nextUpstreamTimeout: 50s
+  nextUpstreamTries: 1
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``udpRequests`` | The number of datagrams, after receiving which, the next datagram from the same client starts a new session. See the [proxy_requests](https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_requests) directive. The default is ``0``. | ``int`` | No |
+|``udpResponses`` | The number of datagrams expected from the proxied server in response to a client datagram. See the [proxy_responses](https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_responses) directive. By default, the number of datagrams is not limited. | ``int`` | No |
+|``connectTimeout`` | The timeout for establishing a connection with a proxied server. See the [proxy_connect_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_connect_timeout) directive. The default is ``60s``. | ``string`` | No |
+|``nextUpstream`` | If a connection to the proxied server cannot be established, determines whether a client connection will be passed to the next server. See the [proxy_next_upstream](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_next_upstream) directive. The default is ``true``. | bool | No |
+|``nextUpstreamTries`` | The number of tries for passing a connection to the next server. See the [proxy_next_upstream_tries](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_next_upstream_tries) directive. The default is ``0``. | ``int`` | No |
+|``nextUpstreamTimeout`` | The time allowed to pass a connection to the next server. See the [proxy_next_upstream_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_next_upstream_timeout) directive. The default us ``0``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### SessionParameters
+
+The session parameters define various parameters for TCP connections and UDP sessions.
+
+```yaml
+sessionParameters:
+  timeout: 50s
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``timeout`` | The timeout between two successive read or write operations on client or proxied server connections. See [proxy_timeout](http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout) directive. The default is ``10m``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Action
+
+The action defines an action to perform for a client connection/datagram.
+
+In the example below, client connections/datagrams are passed to an upstream `dns-app`:
+
+```yaml
+action:
+  pass: dns-app
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``pass`` | Passes connections/datagrams to an upstream. The upstream with that name must be defined in the resource. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+## Using TransportServer
+
+You can use the usual `kubectl` commands to work with TransportServer resources, similar to Ingress resources.
+
+For example, the following command creates a TransportServer resource defined in `transport-server-passthrough.yaml` with the name `secure-app`:
+
+```shell
+kubectl apply -f transport-server-passthrough.yaml
+```
+```text
+transportserver.k8s.nginx.org/secure-app created
+```
+
+You can get the resource by running:
+
+```shell
+kubectl get transportserver secure-app
+```
+```text
+NAME         AGE
+secure-app   46sm
+```
+
+In the kubectl get and similar commands, you can also use the short name `ts` instead of `transportserver`.
+
+### Using Snippets
+
+Snippets allow you to insert raw NGINX config into different contexts of NGINX configuration. In the example below, we use snippets to configure [access control](http://nginx.org/en/docs/stream/ngx_stream_access_module.html) in a TransportServer:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: TransportServer
+metadata:
+  name: cafe
+spec:
+  host: cafe.example.com
+  serverSnippets: |
+    deny  192.168.1.1;
+    allow 192.168.1.0/24;
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+```
+
+Snippets can also be specified for a stream. In the example below, we use snippets to [limit the number of connections](https://nginx.org/en/docs/stream/ngx_stream_limit_conn_module.html):
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: TransportServer
+metadata:
+  name: cafe
+spec:
+  host: cafe.example.com
+  streamSnippets: limit_conn_zone $binary_remote_addr zone=addr:10m;
+  serverSnippets: limit_conn addr 1;
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+```
+
+{{< note >}} To configure snippets in the `stream` context, use `stream-snippets` ConfigMap key. {{< /note >}}
+
+For additional information, view the [Advanced configuration with Snippets]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) topic.
+
+### Validation
+
+Two types of validation are available for the TransportServer resource:
+
+- *Structural validation* by the `kubectl` and Kubernetes API server.
+- *Comprehensive validation* by NGINX Ingress Controller.
+
+#### Structural Validation
+
+The custom resource definition for the TransportServer includes structural OpenAPI schema which describes the type of every field of the resource.
+
+If you try to create (or update) a resource that violates the structural schema (for example, you use a string value for the port field of an upstream), `kubectl` and Kubernetes API server will reject such a resource:
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f transport-server-passthrough.yaml
+    ```
+    ```text
+    error: error validating "transport-server-passthrough.yaml": error validating data: ValidationError(TransportServer.spec.upstreams[0].port): invalid type for org.nginx.k8s.v1.TransportServer.spec.upstreams.port: got "string", expected "integer"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f transport-server-passthrough.yaml --validate=false
+    ```
+    ```text
+    The TransportServer "secure-app" is invalid: []: Invalid value: map[string]interface {}{ ... }: validation failure list:
+    spec.upstreams.port in body must be of type integer: "string"
+    ```
+
+If a resource is not rejected (it doesn't violate the structural schema), NGINX Ingress Controller will validate it further.
+
+#### Comprehensive Validation
+
+NGINX Ingress Controller validates the fields of a TransportServer resource. If a resource is invalid, NGINX Ingress Controller will reject it: the resource will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can check if NGINX Ingress Controller successfully applied the configuration for a TransportServer. For our example `secure-app` TransportServer, we can run:
+
+```shell
+kubectl describe ts secure-app
+```
+```text
+...
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  3s    nginx-ingress-controller  Configuration for default/secure-app was added or updated
+```
+
+Note how the events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid resource, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create a TransportServer `secure-app` with a pass action that references a non-existing upstream, you will get  :
+
+```shell
+kubectl describe ts secure-app
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  2s    nginx-ingress-controller  TransportServer default/secure-app is invalid and was rejected: spec.action.pass: Not found: "some-app"
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+**Note**: If you make an existing resource invalid, NGINX Ingress Controller will reject it and remove the corresponding configuration from NGINX.
+
+## Customization via ConfigMap
+
+The [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) keys (except for `stream-snippets`, `stream-log-format`, `resolver-addresses`, `resolver-ipv6`, `resolver-valid` and `resolver-timeout`) do not affect TransportServer resources.
diff --git a/content/nic/configuration/virtualserver-and-virtualserverroute-resources.md b/content/nic/configuration/virtualserver-and-virtualserverroute-resources.md
new file mode 100644
index 000000000..1acd05b02
--- /dev/null
+++ b/content/nic/configuration/virtualserver-and-virtualserverroute-resources.md
@@ -0,0 +1,1101 @@
+---
+title: VirtualServer and VirtualServerRoute resources
+toc: true
+weight: 700
+docs: DOCS-599
+---
+
+This document is reference material for the VirtualServer and VirtualServerRoute resources used by F5 NGINX Ingress Controller.
+
+VirtualServer and VirtualServerRoute resources are load balancing configurations recommended as an alternative to the Ingress resource.
+
+They enable use cases not supported with the Ingress resource, such as traffic splitting and advanced content-based routing. The resources are implemented as [Custom Resources](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+The GitHub repository has [examples of the resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources) for specific use cases.
+
+---
+
+## VirtualServer specification
+
+The VirtualServer resource defines load balancing configuration for a domain name, such as `example.com`. Below is an example of such configuration:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+spec:
+  host: cafe.example.com
+  listener:
+    http: http-8083
+    https: https-8443
+  tls:
+    secret: cafe-secret
+  gunzip: on
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+  - name: coffee
+    service: coffee-svc
+    port: 80
+  routes:
+  - path: /tea
+    action:
+      pass: tea
+  - path: /coffee
+    action:
+      pass: coffee
+  - path: ~ ^/decaf/.*\\.jpg$
+    action:
+      pass: coffee
+  - path: = /green/tea
+    action:
+      pass: tea
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. When using a wildcard domain like ``*.example.com`` the domain must be contained in double quotes.  The ``host`` value needs to be unique among all Ingress and VirtualServer resources. See also [Handling Host and Listener Collisions](/nginx-ingress-controller/configuration/host-and-listener-collisions). | ``string`` | Yes |
+|``listener`` | Sets a custom HTTP and/or HTTPS listener. Valid fields are `listener.http` and `listener.https`. Each field must reference the name of a valid listener defined in a GlobalConfiguration resource | [listener](#virtualserverlistener) | No |
+|``tls`` | The TLS termination configuration. | [tls](#virtualservertls) | No |
+|``gunzip`` | Enables or disables [decompression](https://docs.nginx.com/nginx/admin-guide/web-server/compression/) of gzipped responses for clients. Allowed values “on”/“off”, “true”/“false” or “yes”/“no”. If the ``gunzip`` value is not set, it defaults to ``off``.   | ``boolean`` | No |
+|``externalDNS`` | The externalDNS configuration for a VirtualServer. | [externalDNS](#virtualserverexternaldns) | No |
+|``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServer. | ``string`` | No |
+|``policies`` | A list of policies. | [[]policy](#virtualserverpolicy) | No |
+|``upstreams`` | A list of upstreams. | [[]upstream](#upstream) | No |
+|``routes`` | A list of routes. | [[]route](#virtualserverroute) | No |
+|``ingressClassName`` | Specifies which Ingress Controller must handle the VirtualServer resource. | ``string`` | No |
+|``internalRoute`` | Specifies if the VirtualServer resource is an internal route or not. | ``boolean`` | No |
+|``http-snippets`` | Sets a custom snippet in the http context. | ``string`` | No |
+|``server-snippets`` | Sets a custom snippet in server context. Overrides the ``server-snippets`` ConfigMap key. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.TLS
+
+The tls field defines TLS configuration for a VirtualServer. For example:
+
+```yaml
+secret: cafe-secret
+redirect:
+  enable: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``secret`` | The name of a secret with a TLS certificate and key. The secret must belong to the same namespace as the VirtualServer. The secret must be of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that contain the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). If the secret doesn't exist or is invalid, NGINX will break any attempt to establish a TLS connection to the host of the VirtualServer. If the secret is not specified but [wildcard TLS secret](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments#cmdoption-wildcard-tls-secret) is configured, NGINX will use the wildcard secret for TLS termination. | ``string`` | No |
+|``redirect`` | The redirect configuration of the TLS for a VirtualServer. | [tls.redirect](#virtualservertlsredirect) | No | ### VirtualServer.TLS.Redirect |
+|``cert-manager`` | The cert-manager configuration of the TLS for a VirtualServer. | [tls.cert-manager](#virtualservertlscertmanager) | No | ### VirtualServer.TLS.CertManager |
+{{</bootstrap-table>}}
+
+### VirtualServer.TLS.Redirect
+
+The redirect field configures a TLS redirect for a VirtualServer:
+
+```yaml
+enable: true
+code: 301
+basedOn: scheme
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables a TLS redirect for a VirtualServer. The default is ``False``. | ``boolean`` | No |
+|``code`` | The status code of a redirect. The allowed values are: ``301`` , ``302`` , ``307`` , ``308``.  The default is ``301``. | ``int`` | No |
+|``basedOn`` | The attribute of a request that NGINX will evaluate to send a redirect. The allowed values are ``scheme`` (the scheme of the request) or ``x-forwarded-proto`` (the ``X-Forwarded-Proto`` header of the request). The default is ``scheme``. | ``string`` | No | ### VirtualServer.Policy |
+{{</bootstrap-table>}}
+
+### VirtualServer.TLS.CertManager
+
+The cert-manager field configures x509 automated Certificate management for VirtualServer resources using cert-manager (cert-manager.io). Please see the [cert-manager configuration documentation](https://cert-manager.io/docs/configuration/) for more information on deploying and configuring Issuers. Example:
+
+```yaml
+cert-manager:
+  cluster-issuer: "my-issuer-name"
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``issuer`` |  the name of an Issuer. An Issuer is a cert-manager resource which describes the certificate authority capable of signing certificates. The Issuer must be in the same namespace as the VirtualServer resource. Please note that one of `issuer` and `cluster-issuer` are required, but they are mutually exclusive - one and only one must be defined. | ``string`` | No |
+|``cluster-issuer`` | the name of a ClusterIssuer. A ClusterIssuer is a cert-manager resource which describes the certificate authority capable of signing certificates. It does not matter which namespace your VirtualServer resides, as ClusterIssuers are non-namespaced resources. Please note that one of `issuer` and `cluster-issuer` are required, but they are mutually exclusive - one and only one must be defined. | ``string`` | No |
+|``issuer-kind`` | The kind of the external issuer resource, for example AWSPCAIssuer. This is only necessary for out-of-tree issuers. This cannot be defined if `cluster-issuer` is also defined. | ``string`` | No |
+|``issuer-group`` | The API group of the external issuer controller, for example awspca.cert-manager.io. This is only necessary for out-of-tree issuers. This cannot be defined if `cluster-issuer` is also defined. | ``string`` | No |
+|``common-name`` | This field allows you to configure spec.commonName for the Certificate to be generated. This configuration adds a CN to the x509 certificate. | ``string`` | No |
+|``duration`` | This field allows you to configure spec.duration field for the Certificate to be generated. Must be specified using a [Go time.Duration](https://pkg.go.dev/time#ParseDuration) string format, which does not allow the d (days) suffix. You must specify these values using s, m, and h suffixes instead. | ``string`` | No |
+|``renew-before`` |  this annotation allows you to configure spec.renewBefore field for the Certificate to be generated. Must be specified using a [Go time.Duration](https://pkg.go.dev/time#ParseDuration) string format, which does not allow the d (days) suffix. You must specify these values using s, m, and h suffixes instead. | ``string`` | No |
+|``usages`` |  This field allows you to configure spec.usages field for the Certificate to be generated. Pass a string with comma-separated values i.e. ``key agreement,digital signature, server auth``. An exhaustive list of supported key usages can be found in the [the cert-manager api documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage). | ``string`` | No |
+|``issue-temp-cert`` | When ``true``, ask cert-manager for a [temporary self-signed certificate](https://cert-manager.io/docs/usage/certificate/#temporary-certificates-while-issuing) pending the issuance of the Certificate. This allows HTTPS-only servers to use ACME HTTP01 challenges when the TLS secret does not exist yet. | ``boolean`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.Listener
+The listener field defines a custom HTTP and/or HTTPS listener.
+The respective listeners used must reference the name of a listener defined using a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource.
+For example:
+```yaml
+http: http-8083
+https: https-8443
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``http`` |  The name of am HTTP listener defined in a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource. | ``string`` | No |
+|``https`` |  The name of an HTTPS listener defined in a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.ExternalDNS
+
+The externalDNS field configures controlling DNS records dynamically for VirtualServer resources using [ExternalDNS](https://github.com/kubernetes-sigs/external-dns). Please see the [ExternalDNS configuration documentation](https://kubernetes-sigs.github.io/external-dns/) for more information on deploying and configuring ExternalDNS and Providers. Example:
+
+```yaml
+enable: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables ExternalDNS integration for a VirtualServer resource. The default is ``false``. | ``string`` | No |
+|``labels`` | Configure labels to be applied to the Endpoint resources that will be consumed by ExternalDNS. | ``map[string]string`` | No |
+|``providerSpecific`` | Configure provider specific properties which holds the name and value of a configuration which is specific to individual DNS providers. | [[]ProviderSpecific](#virtualserverexternaldnsproviderspecific) | No |
+|``recordTTL`` | TTL for the DNS record. This defaults to 0 if not defined. See [the ExternalDNS TTL documentation for provider-specific defaults](https://kubernetes-sigs.github.io/external-dns/v0.14.2/ttl/#providers) | ``int64`` | No |
+|``recordType`` | The record Type that should be created, e.g. "A", "AAAA", "CNAME". This is automatically computed based on the external endpoints if not defined. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.ExternalDNS.ProviderSpecific
+
+The providerSpecific field of the externalDNS block allows the specification of provider specific properties which is a list of key value pairs of configurations which are specific to individual DNS providers. Example:
+
+```yaml
+- name: my-name
+  value: my-value
+- name: my-name2
+  value: my-value2
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the key value pair. | ``string`` | Yes |
+|``value`` | The value of the key value pair. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### VirtualServer.Policy
+
+The policy field references a [Policy resource](/nginx-ingress-controller/configuration/policy-resource/) by its name and optional namespace. For example:
+
+```yaml
+name: access-control
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of a policy. If the policy doesn't exist or invalid, NGINX will respond with an error response with the `500` status code. | ``string`` | Yes |
+|``namespace`` | The namespace of a policy. If not specified, the namespace of the VirtualServer resource is used. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### VirtualServer.Route
+
+The route defines rules for matching client requests to actions like passing a request to an upstream. For example:
+
+```yaml
+  path: /tea
+  action:
+    pass: tea
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``path`` | The path of the route. NGINX will match it against the URI of a request. Possible values are: a prefix ( ``/`` , ``/path`` ), an exact match ( ``=/exact/match`` ), a case insensitive regular expression ( ``~*^/Bar.*\.jpg`` ) or a case sensitive regular expression ( ``~^/foo.*\.jpg`` ). In the case of a prefix (must start with ``/`` ) or an exact match (must start with ``=`` ), the path must not include any whitespace characters, ``{`` , ``}`` or ``;``. In the case of the regex matches, all double quotes ``"`` must be escaped and the match can't end in an unescaped backslash ``\``. The path must be unique among the paths of all routes of the VirtualServer. Check the [location](https://nginx.org/en/docs/http/ngx_http_core_module.html#location) directive for more information. | ``string`` | Yes |
+|``policies`` | A list of policies. The policies override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies](/nginx-ingress-controller/configuration/policy-resource/#applying-policies) for more details. | [[]policy](#virtualserverpolicy) | No |
+|``action`` | The default action to perform for a request. | [action](#action) | No |
+|``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServer route. | ``string`` | No |
+|``splits`` | The default splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
+|``matches`` | The matching rules for advanced content-based routing. Requires the default ``action`` or ``splits``.  Unmatched requests will be handled by the default ``action`` or ``splits``. | [matches](#match) | No |
+|``route`` | The name of a VirtualServerRoute resource that defines this route. If the VirtualServerRoute belongs to a different namespace than the VirtualServer, you need to include the namespace. For example, ``tea-namespace/tea``. | ``string`` | No |
+|``errorPages`` | The custom responses for error codes. NGINX will use those responses instead of returning the error responses from the upstream servers or the default responses generated by NGINX. A custom response can be a redirect or a canned response. For example, a redirect to another URL if an upstream server responded with a 404 status code. | [[]errorPage](#errorpage) | No |
+|``location-snippets`` | Sets a custom snippet in the location context. Overrides the ``location-snippets`` ConfigMap key. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- a route must include exactly one of the following: `action`, `splits`, or `route`.
+
+## VirtualServerRoute specification
+
+The VirtualServerRoute resource defines a route for a VirtualServer. It can consist of one or multiple subroutes. The VirtualServerRoute is an alternative to [Mergeable Ingress types](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration).
+
+In the example below, the VirtualServer `cafe` from the namespace `cafe-ns` defines a route with the path `/coffee`, which is further defined in the VirtualServerRoute `coffee` from the namespace `coffee-ns`.
+
+VirtualServer:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+  namespace: cafe-ns
+spec:
+  host: cafe.example.com
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+  routes:
+  - path: /tea
+    action:
+      pass: tea
+  - path: /coffee
+    route: coffee-ns/coffee
+```
+
+VirtualServerRoute:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServerRoute
+metadata:
+  name: coffee
+  namespace: coffee-ns
+spec:
+  host: cafe.example.com
+  upstreams:
+  - name: latte
+    service: latte-svc
+    port: 80
+  - name: espresso
+    service: espresso-svc
+    port: 80
+  subroutes:
+  - path: /coffee/latte
+    action:
+      pass: latte
+  - path: /coffee/espresso
+    action:
+      pass: espresso
+```
+
+Note that each subroute must have a `path` that starts with the same prefix (here `/coffee`), which is defined in the route of the VirtualServer. Additionally, the `host` in the VirtualServerRoute must be the same as the `host` of the VirtualServer.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. When using a wildcard domain like ``*.example.com`` the domain must be contained in double quotes. Must be the same as the ``host`` of the VirtualServer that references this resource. | ``string`` | Yes |
+|``upstreams`` | A list of upstreams. | [[]upstream](#upstream) | No |
+|``subroutes`` | A list of subroutes. | [[]subroute](#virtualserverroutesubroute) | No |
+|``ingressClassName`` | Specifies which Ingress Controller must handle the VirtualServerRoute resource. Must be the same as the ``ingressClassName`` of the VirtualServer that references this resource. | ``string``_ | No |
+{{</bootstrap-table>}}
+
+### VirtualServerRoute.Subroute
+
+The subroute defines rules for matching client requests to actions like passing a request to an upstream. For example:
+
+```yaml
+path: /coffee
+action:
+  pass: coffee
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``path`` | The path of the subroute. NGINX will match it against the URI of a request. Possible values are: a prefix ( ``/`` , ``/path`` ), an exact match ( ``=/exact/match`` ), a case insensitive regular expression ( ``~*^/Bar.*\.jpg`` ) or a case sensitive regular expression ( ``~^/foo.*\.jpg`` ). In the case of a prefix, the path must start with the same path as the path of the route of the VirtualServer that references this resource. In the case of an exact or regex match, the path must be the same as the path of the route of the VirtualServer that references this resource. A matching path of the route of the VirtualServer but in different type is not accepted, e.g. a regex path (`~/match`) cannot be used with a prefix path in VirtualServer (`/match`) In the case of a prefix or an exact match, the path must not include any whitespace characters, ``{`` , ``}`` or ``;``.  In the case of the regex matches, all double quotes ``"`` must be escaped and the match can't end in an unescaped backslash ``\``. The path must be unique among the paths of all subroutes of the VirtualServerRoute. | ``string`` | Yes |
+|``policies`` | A list of policies. The policies override *all* policies defined in the route of the VirtualServer that references this resource. The policies also override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies](/nginx-ingress-controller/configuration/policy-resource/#applying-policies) for more details. | [[]policy](#virtualserverpolicy) | No |
+|``action`` | The default action to perform for a request. | [action](#action) | No |
+|``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServerRoute subroute. | ``string`` | No |
+|``splits`` | The default splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
+|``matches`` | The matching rules for advanced content-based routing. Requires the default ``action`` or ``splits``.  Unmatched requests will be handled by the default ``action`` or ``splits``. | [matches](#match) | No |
+|``errorPages`` | The custom responses for error codes. NGINX will use those responses instead of returning the error responses from the upstream servers or the default responses generated by NGINX. A custom response can be a redirect or a canned response. For example, a redirect to another URL if an upstream server responded with a 404 status code. | [[]errorPage](#errorpage) | No |
+|``location-snippets`` | Sets a custom snippet in the location context. Overrides the ``location-snippets`` of the VirtualServer (if set) or the ``location-snippets`` ConfigMap key. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- a subroute must include exactly one of the following: `action` or `splits`.
+
+## Common VirtualServer and VirtualServerRoute specifications
+
+### Upstream
+
+The upstream defines a destination for the routing configuration. For example:
+
+```yaml
+name: tea
+service: tea-svc
+subselector:
+  version: canary
+port: 80
+lb-method: round_robin
+fail-timeout: 10s
+max-fails: 1
+max-conns: 32
+keepalive: 32
+connect-timeout: 30s
+read-timeout: 30s
+send-timeout: 30s
+next-upstream: "error timeout non_idempotent"
+next-upstream-timeout: 5s
+next-upstream-tries: 10
+client-max-body-size: 2m
+tls:
+  enable: true
+```
+
+**Note**: The WebSocket protocol is supported without any additional configuration.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the upstream. Must be a valid DNS label as defined in RFC 1035. For example, ``hello`` and ``upstream-123`` are valid. The name must be unique among all upstreams of the resource. | ``string`` | Yes |
+|``service`` | The name of a [service](https://kubernetes.io/docs/concepts/services-networking/service/). The service must belong to the same namespace as the resource. If the service doesn't exist, NGINX will assume the service has zero endpoints and return a ``502`` response for requests for this upstream. For NGINX Plus only, services of type [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) are also supported (check the [prerequisites](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/externalname-services#prerequisites) ). | ``string`` | Yes |
+|``subselector`` | Selects the pods within the service using label keys and values. By default, all pods of the service are selected. Note: the specified labels are expected to be present in the pods when they are created. If the pod labels are updated, NGINX Ingress Controller will not see that change until the number of the pods is changed. | ``map[string]string`` | No |
+|``use-cluster-ip`` | Enables using the Cluster IP and port of the service instead of the default behavior of using the IP and port of the pods. When this field is enabled, the fields that configure NGINX behavior related to multiple upstream servers (like ``lb-method`` and ``next-upstream``) will have no effect, as NGINX Ingress Controller will configure NGINX with only one upstream server that will match the service Cluster IP. | ``boolean`` | No |
+|``port`` | The port of the service. If the service doesn't define that port, NGINX will assume the service has zero endpoints and return a ``502`` response for requests for this upstream. The port must fall into the range ``1..65535``. | ``uint16`` | Yes |
+|``lb-method`` | The load [balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify ``round_robin``. The default is specified in the ``lb-method`` ConfigMap key. | ``string`` | No |
+|``fail-timeout`` | The time during which the specified number of unsuccessful attempts to communicate with an upstream server should happen to consider the server unavailable. See the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the server directive. The default is set in the ``fail-timeout`` ConfigMap key. | ``string`` | No |
+|``max-fails`` | The number of unsuccessful attempts to communicate with an upstream server that should happen in the duration set by the ``fail-timeout`` to consider the server unavailable. See the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the server directive. The default is set in the ``max-fails`` ConfigMap key. | ``int`` | No |
+|``max-conns`` | The maximum number of simultaneous active connections to an upstream server. See the [max_conns](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_conns) parameter of the server directive. By default there is no limit. Note: if keepalive connections are enabled, the total number of active and idle keepalive connections to an upstream server may exceed the ``max_conns`` value. | ``int`` | No |
+|``keepalive`` | Configures the cache for connections to upstream servers. The value ``0`` disables the cache. See the [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) directive. The default is set in the ``keepalive`` ConfigMap key. | ``int`` | No |
+|``connect-timeout`` | The timeout for establishing a connection with an upstream server. See the [proxy_connect_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) directive. The default is specified in the ``proxy-connect-timeout`` ConfigMap key. | ``string`` | No |
+|``read-timeout`` | The timeout for reading a response from an upstream server. See the [proxy_read_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) directive.  The default is specified in the ``proxy-read-timeout`` ConfigMap key. | ``string`` | No |
+|``send-timeout`` | The timeout for transmitting a request to an upstream server. See the [proxy_send_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) directive. The default is specified in the ``proxy-send-timeout`` ConfigMap key. | ``string`` | No |
+|``next-upstream`` | Specifies in which cases a request should be passed to the next upstream server. See the [proxy_next_upstream](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream) directive. The default is ``error timeout``. | ``string`` | No |
+|``next-upstream-timeout`` | The time during which a request can be passed to the next upstream server. See the [proxy_next_upstream_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream_timeout) directive. The ``0`` value turns off the time limit. The default is ``0``. | ``string`` | No |
+|``next-upstream-tries`` | The number of possible tries for passing a request to the next upstream server. See the [proxy_next_upstream_tries](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream_tries) directive. The ``0`` value turns off this limit. The default is ``0``. | ``int`` | No |
+|``client-max-body-size`` | Sets the maximum allowed size of the client request body. See the [client_max_body_size](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size) directive. The default is set in the ``client-max-body-size`` ConfigMap key. | ``string`` | No |
+|``tls`` | The TLS configuration for the Upstream. | [tls](#upstreamtls) | No |
+|``healthCheck`` | The health check configuration for the Upstream. See the [health_check](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html#health_check) directive. Note: this feature is supported only in NGINX Plus. | [healthcheck](#upstreamhealthcheck) | No |
+|``slow-start`` | The slow start allows an upstream server to gradually recover its weight from 0 to its nominal value after it has been recovered or became available or when the server becomes available after a period of time it was considered unavailable. By default, the slow start is disabled. See the [slow_start](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start) parameter of the server directive. Note: The parameter cannot be used along with the ``random`` , ``hash`` or ``ip_hash`` load balancing methods and will be ignored. | ``string`` | No |
+|``queue`` | Configures a queue for an upstream. A client request will be placed into the queue if an upstream server cannot be selected immediately while processing the request. By default, no queue is configured. Note: this feature is supported only in NGINX Plus. | [queue](#upstreamqueue) | No |
+|``buffering`` | Enables buffering of responses from the upstream server. See the [proxy_buffering](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) directive. The default is set in the ``proxy-buffering`` ConfigMap key. | ``boolean`` | No |
+|``buffers`` | Configures the buffers used for reading a response from the upstream server for a single connection. | [buffers](#upstreambuffers) | No |
+|``buffer-size`` | Sets the size of the buffer used for reading the first part of a response received from the upstream server. See the [proxy_buffer_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) directive. The default is set in the ``proxy-buffer-size`` ConfigMap key. | ``string`` | No |
+|``ntlm`` | Allows proxying requests with NTLM Authentication. See the [ntlm](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#ntlm) directive. In order for NTLM authentication to work, it is necessary to enable keepalive connections to upstream servers using the ``keepalive`` field. Note: this feature is supported only in NGINX Plus.| ``boolean`` | No |
+|``type`` |The type of the upstream. Supported values are ``http`` and ``grpc``. The default is ``http``. For gRPC, it is necessary to enable HTTP/2 in the [ConfigMap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#listeners) and configure TLS termination in the VirtualServer. | ``string`` | No |
+|``backup`` | The name of the backup service of type [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname). This will be used when the primary servers are unavailable. Note: The parameter cannot be used along with the ``random`` , ``hash`` or ``ip_hash`` load balancing methods. | ``string`` | No |
+|``backupPort`` | The port of the backup service. The backup port is required if the backup service name is provided. The port must fall into the range ``1..65535``. | ``uint16`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Buffers
+
+The buffers field configures the buffers used for reading a response from the upstream server for a single connection:
+
+```yaml
+number: 4
+size: 8K
+```
+
+See the [proxy_buffers](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) directive for additional information.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``number`` | Configures the number of buffers. The default is set in the ``proxy-buffers`` ConfigMap key. | ``int`` | Yes |
+|``size`` | Configures the size of a buffer. The default is set in the ``proxy-buffers`` ConfigMap key. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### Upstream.TLS
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables HTTPS for requests to upstream servers. The default is ``False`` , meaning that HTTP will be used. Note: by default, NGINX will not verify the upstream server certificate. To enable the verification, configure an [EgressMTLS Policy](/nginx-ingress-controller/configuration/policy-resource/#egressmtls). | ``boolean`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Queue
+
+The queue field configures a queue. A client request will be placed into the queue if an upstream server cannot be selected immediately while processing the request:
+
+```yaml
+size: 10
+timeout: 60s
+```
+
+See [`queue`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#queue) directive for additional information.
+
+Note: This feature is supported only in NGINX Plus.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``size`` | The size of the queue. | ``int`` | Yes |
+|``timeout`` | The timeout of the queue. A request cannot be queued for a period longer than the timeout. The default is ``60s``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.Healthcheck
+
+The Healthcheck defines an [active health check](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/). In the example below we enable a health check for an upstream and configure all the available parameters, including the `slow-start` parameter combined with [`mandatory` and `persistent`](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#mandatory-health-checks):
+
+```yaml
+name: tea
+service: tea-svc
+port: 80
+slow-start: 30s
+healthCheck:
+  enable: true
+  path: /healthz
+  interval: 20s
+  jitter: 3s
+  fails: 5
+  passes: 5
+  port: 8080
+  tls:
+    enable: true
+  connect-timeout: 10s
+  read-timeout: 10s
+  send-timeout: 10s
+  headers:
+  - name: Host
+    value: my.service
+  statusMatch: "! 500"
+  mandatory: true
+  persistent: true
+  keepalive-time: 60s
+```
+
+Note: This feature is supported only in NGINX Plus.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables a health check for an upstream server. The default is ``false``. | ``boolean`` | No |
+|``path`` | The path used for health check requests. The default is ``/``. This not configurable for gRPC type upstreams. | ``string`` | No |
+|``interval`` | The interval between two consecutive health checks. The default is ``5s``. | ``string`` | No |
+|``jitter`` | The time within which each health check will be randomly delayed. By default, there is no delay. | ``string`` | No |
+|``fails`` | The number of consecutive failed health checks of a particular upstream server after which this server will be considered unhealthy. The default is ``1``. | ``integer`` | No |
+|``passes`` | The number of consecutive passed health checks of a particular upstream server after which the server will be considered healthy. The default is ``1``. | ``integer`` | No |
+|``port`` | The port used for health check requests. By default, the [server port is used](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html#health_check_port). Note: in contrast with the port of the upstream, this port is not a service port, but a port of a pod. | ``integer`` | No |
+|``tls`` | The TLS configuration used for health check requests. By default, the ``tls`` field of the upstream is used. | [upstream.tls](#upstreamtls) | No |
+|``connect-timeout`` | The timeout for establishing a connection with an upstream server. By default, the ``connect-timeout`` of the upstream is used. | ``string`` | No |
+|``read-timeout`` | The timeout for reading a response from an upstream server. By default, the ``read-timeout`` of the upstream is used. | ``string`` | No |
+|``send-timeout`` | The timeout for transmitting a request to an upstream server. By default, the ``send-timeout`` of the upstream is used. | ``string`` | No |
+|``headers`` | The request headers used for health check requests. NGINX Plus always sets the ``Host`` , ``User-Agent`` and ``Connection`` headers for health check requests. | [[]header](#header) | No |
+|``statusMatch`` | The expected response status codes of a health check. By default, the response should have status code 2xx or 3xx. Examples: ``"200"`` , ``"! 500"`` , ``"301-303 307"``. See the documentation of the [match](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html?#match) directive. This not supported for gRPC type upstreams. | ``string`` | No |
+|``grpcStatus`` | The expected [gRPC status code](https://github.com/grpc/grpc/blob/master/doc/statuscodes.md#status-codes-and-their-use-in-grpc) of the upstream server response to the [Check method](https://github.com/grpc/grpc/blob/master/doc/health-checking.md). Configure this field only if your gRPC services do not implement the gRPC health checking protocol. For example, configure ``12`` if the upstream server responds with `12 (UNIMPLEMENTED)` status code. Only valid on gRPC type upstreams. | ``int`` | No |
+|``grpcService`` | The gRPC service to be monitored on the upstream server. Only valid on gRPC type upstreams. | ``string`` | No |
+|``mandatory`` | Require every newly added server to pass all configured health checks before NGINX Plus sends traffic to it. If this is not specified, or is set to false, the server will be initially considered healthy. When combined with [slow-start](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start), it gives a new server more time to connect to databases and “warm up” before being asked to handle their full share of traffic. | ``bool`` | No |
+|``persistent`` | Set the initial “up” state for a server after reload if the server was considered healthy before reload. Enabling persistent requires that the mandatory parameter is also set to `true`. | ``bool`` | No |
+|``keepalive-time`` | Enables [keepalive](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) connections for health checks and specifies the time during which requests can be processed through one keepalive connection. The default is ``60s``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Upstream.SessionCookie
+
+The SessionCookie field configures session persistence which allows requests from the same client to be passed to the same upstream server. The information about the designated upstream server is passed in a session cookie generated by NGINX Plus.
+
+In the example below, we configure session persistence with a session cookie for an upstream and configure all the available parameters:
+
+```yaml
+name: tea
+service: tea-svc
+port: 80
+sessionCookie:
+  enable: true
+  name: srv_id
+  path: /
+  expires: 1h
+  domain: .example.com
+  httpOnly: false
+  secure: true
+  samesite: strict
+```
+
+See the [`sticky`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html?#sticky) directive for additional information. The session cookie corresponds to the `sticky cookie` method.
+
+Note: This feature is supported only in NGINX Plus.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables session persistence with a session cookie for an upstream server. The default is ``false``. | ``boolean`` | No |
+|``name`` | The name of the cookie. | ``string`` | Yes |
+|``path`` | The path for which the cookie is set. | ``string`` | No |
+|``expires`` | The time for which a browser should keep the cookie. Can be set to the special value ``max`` , which will cause the cookie to expire on ``31 Dec 2037 23:55:55 GMT``. | ``string`` | No |
+|``domain`` | The domain for which the cookie is set. | ``string`` | No |
+|``httpOnly`` | Adds the ``HttpOnly`` attribute to the cookie. | ``boolean`` | No |
+|``secure`` | Adds the ``Secure`` attribute to the cookie. | ``boolean`` | No |
+|``samesite`` | Adds the ``SameSite`` attribute to the cookie. The allowed values are: ``strict``, ``lax``, ``none`` | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Header
+
+The header defines an HTTP Header:
+
+```yaml
+name: Host
+value: example.com
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Action
+
+The action defines an action to perform for a request.
+
+In the example below, client requests are passed to an upstream `coffee`:
+
+```yaml
+ path: /coffee
+ action:
+  pass: coffee
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``pass`` | Passes requests to an upstream. The upstream with that name must be defined in the resource. | ``string`` | No |
+|``redirect`` | Redirects requests to a provided URL. | [action.redirect](#actionredirect) | No |
+|``return`` | Returns a preconfigured response. | [action.return](#actionreturn) | No |
+|``proxy`` | Passes requests to an upstream with the ability to modify the request/response (for example, rewrite the URI or modify the headers). | [action.proxy](#actionproxy) | No |
+{{</bootstrap-table>}}
+
+\* -- an action must include exactly one of the following: `pass`, `redirect`, `return` or `proxy`.
+
+### Action.Redirect
+
+The redirect action defines a redirect to return for a request.
+
+In the example below, client requests are passed to a url `http://www.nginx.com`:
+
+```yaml
+redirect:
+  url: http://www.nginx.com
+  code: 301
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``url`` | The URL to redirect the request to. Supported NGINX variables: ``$scheme`` , ``$http_x_forwarded_proto`` , ``$request_uri`` , ``$host``. Variables must be enclosed in curly braces. For example: ``${host}${request_uri}``. | ``string`` | Yes |
+|``code`` | The status code of a redirect. The allowed values are: ``301`` , ``302`` , ``307`` , ``308``. The default is ``301``. | ``int`` | No |
+{{</bootstrap-table>}}
+
+### Action.Return
+
+The return action defines a preconfigured response for a request.
+
+In the example below, NGINX will respond with the preconfigured response for every request:
+
+```yaml
+return:
+  code: 200
+  type: text/plain
+  body: "Hello World\n"
+  headers:
+  - name: x-coffee
+    value: espresso
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``code`` | The status code of the response. The allowed values are: ``2XX``, ``4XX`` or ``5XX``. The default is ``200``. | ``int`` | No |
+|``type`` | The MIME type of the response. The default is ``text/plain``. | ``string`` | No |
+|``body`` | The body of the response. Supports NGINX variables*. Variables must be enclosed in curly brackets. For example: ``Request is ${request_uri}\n``. | ``string`` | Yes |
+|``headers`` | The custom headers of the response. | [[]Action.Return.Header](#actionreturnheader) | No |
+{{</bootstrap-table>}}
+
+\* -- Supported NGINX variables: `$request_uri`, `$request_method`, `$request_body`, `$scheme`, `$http_`, `$args`, `$arg_`, `$cookie_`, `$host`, `$request_time`, `$request_length`, `$nginx_version`, `$pid`, `$connection`, `$remote_addr`, `$remote_port`, `$time_iso8601`, `$time_local`, `$server_addr`, `$server_port`, `$server_name`, `$server_protocol`, `$connections_active`, `$connections_reading`, `$connections_writing` and `$connections_waiting`.
+
+### Action.Return.Header
+
+The header defines an HTTP Header for a canned response in an actionReturn:
+
+```yaml
+name: x-coffee
+value: espresso
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### Action.Proxy
+
+The proxy action passes requests to an upstream with the ability to modify the request/response (for example, rewrite the URI or modify the headers).
+
+In the example below, the request URI is rewritten to `/`, and the request and the response headers are modified:
+
+```yaml
+proxy:
+  upstream: coffee
+  requestHeaders:
+    pass: true
+    set:
+    - name: My-Header
+      value: Value
+    - name: Client-Cert
+      value: ${ssl_client_escaped_cert}
+  responseHeaders:
+    add:
+    - name: My-Header
+      value: Value
+    - name: IC-Nginx-Version
+      value: ${nginx_version}
+      always: true
+    hide:
+    - x-internal-version
+    ignore:
+    - Expires
+    - Set-Cookie
+    pass:
+    - Server
+  rewritePath: /
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``upstream`` | The name of the upstream which the requests will be proxied to. The upstream with that name must be defined in the resource. | ``string`` | Yes |
+|``requestHeaders`` | The request headers modifications. | [action.Proxy.RequestHeaders](#actionproxyrequestheaders) | No |
+|``responseHeaders`` | The response headers modifications. | [action.Proxy.ResponseHeaders](#actionproxyresponseheaders) | No |
+|``rewritePath`` | The rewritten URI. If the route path is a regular expression -- starts with `~` -- the `rewritePath` can include capture groups with ``$1-9``. For example `$1` for the first group, and so on. For more information, check the [rewrite](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/rewrites) example. | ``string`` | No |
+{{</bootstrap-table>}}
+
+### Action.Proxy.RequestHeaders
+
+The RequestHeaders field modifies the headers of the request to the proxied upstream server.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``pass`` | Passes the original request headers to the proxied upstream server. See the [proxy_pass_request_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_request_headers) directive for more information. Default is true. | ``bool`` | No |
+|``set`` | Allows redefining or appending fields to present request headers passed to the proxied upstream servers. See the [proxy_set_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header) directive for more information. | [[]header](#actionproxyrequestheaderssetheader) | No |
+{{</bootstrap-table>}}
+
+### Action.Proxy.RequestHeaders.Set.Header
+
+The header defines an HTTP Header:
+
+```yaml
+name: My-Header
+value: My-Value
+```
+
+It is possible to override the default value of the `Host` header, which NGINX Ingress Controller sets to [`$host`](https://nginx.org/en/docs/http/ngx_http_core_module.html#var_host):
+
+```yaml
+name: Host
+value: example.com
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. Supports NGINX variables*. Variables must be enclosed in curly brackets. For example: ``${scheme}``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+\* -- Supported NGINX variables: `$request_uri`, `$request_method`, `$request_body`, `$scheme`, `$http_`, `$args`, `$arg_`, `$cookie_`, `$host`, `$request_time`, `$request_length`, `$nginx_version`, `$pid`, `$connection`, `$remote_addr`, `$remote_port`, `$time_iso8601`, `$time_local`, `$server_addr`, `$server_port`, `$server_name`, `$server_protocol`, `$connections_active`, `$connections_reading`, `$connections_writing`, `$connections_waiting`, `$ssl_cipher`, `$ssl_ciphers`, `$ssl_client_cert`, `$ssl_client_escaped_cert`, `$ssl_client_fingerprint`, `$ssl_client_i_dn`, `$ssl_client_i_dn_legacy`, `$ssl_client_raw_cert`, `$ssl_client_s_dn`, `$ssl_client_s_dn_legacy`, `$ssl_client_serial`, `$ssl_client_v_end`, `$ssl_client_v_remain`, `$ssl_client_v_start`, `$ssl_client_verify`, `$ssl_curves`, `$ssl_early_data`, `$ssl_protocol`, `$ssl_server_name`, `$ssl_session_id`, `$ssl_session_reused`, `$jwt_claim_` (NGINX Plus only) and `$jwt_header_` (NGINX Plus only).
+
+### Action.Proxy.ResponseHeaders
+
+The ResponseHeaders field modifies the headers of the response to the client.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``hide`` | The headers that will not be passed* in the response to the client from a proxied upstream server. See the [proxy_hide_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directive for more information. | ``[]string`` | No |
+|``pass`` | Allows passing the hidden header fields* to the client from a proxied upstream server. See the [proxy_pass_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header) directive for more information. | ``[]string`` | No |
+|``ignore`` | Disables processing of certain headers** to the client from a proxied upstream server. See the [proxy_ignore_headers](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ignore_headers) directive for more information. | ``[]string`` | No |
+|``add`` | Adds headers to the response to the client. | [[]addHeader](#addheader) | No |
+{{</bootstrap-table>}}
+
+\* -- Default hidden headers are: `Date`, `Server`, `X-Pad` and `X-Accel-...`.
+
+\** -- The following fields can be ignored: `X-Accel-Redirect`, `X-Accel-Expires`, `X-Accel-Limit-Rate`, `X-Accel-Buffering`, `X-Accel-Charset`, `Expires`, `Cache-Control`, `Set-Cookie` and `Vary`.
+
+### AddHeader
+
+The addHeader defines an HTTP Header with an optional `always` field:
+
+```yaml
+name: My-Header
+value: My-Value
+always: true
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. Supports NGINX variables*. Variables must be enclosed in curly brackets. For example: ``${scheme}``. | ``string`` | No |
+|``always`` | If set to true, add the header regardless of the response status code**. Default is false. See the [add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header) directive for more information. | ``bool`` | No |
+{{</bootstrap-table>}}
+
+\* -- Supported NGINX variables: `$request_uri`, `$request_method`, `$request_body`, `$scheme`, `$http_`, `$args`, `$arg_`, `$cookie_`, `$host`, `$request_time`, `$request_length`, `$nginx_version`, `$pid`, `$connection`, `$remote_addr`, `$remote_port`, `$time_iso8601`, `$time_local`, `$server_addr`, `$server_port`, `$server_name`, `$server_protocol`, `$connections_active`, `$connections_reading`, `$connections_writing`, `$connections_waiting`, `$ssl_cipher`, `$ssl_ciphers`, `$ssl_client_cert`, `$ssl_client_escaped_cert`, `$ssl_client_fingerprint`, `$ssl_client_i_dn`, `$ssl_client_i_dn_legacy`, `$ssl_client_raw_cert`, `$ssl_client_s_dn`, `$ssl_client_s_dn_legacy`, `$ssl_client_serial`, `$ssl_client_v_end`, `$ssl_client_v_remain`, `$ssl_client_v_start`, `$ssl_client_verify`, `$ssl_curves`, `$ssl_early_data`, `$ssl_protocol`, `$ssl_server_name`, `$ssl_session_id`, `$ssl_session_reused`, `$jwt_claim_` (NGINX Plus only) and `$jwt_header_` (NGINX Plus only).
+
+{{< note >}} If `always` is false, the response header is added only if the response status code is any of `200`, `201`, `204`, `206`, `301`, `302`, `303`, `304`, `307` or `308`. {{< /note >}}
+
+### Split
+
+The split defines a weight for an action as part of the splits configuration.
+
+In the example below NGINX passes 80% of requests to the upstream `coffee-v1` and the remaining 20% to `coffee-v2`:
+
+```yaml
+splits:
+- weight: 80
+  action:
+    pass: coffee-v1
+- weight: 20
+  action:
+    pass: coffee-v2
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``weight`` | The weight of an action. Must fall into the range ``0..100``. The sum of the weights of all splits must be equal to ``100``. | ``int`` | Yes |
+|``action`` | The action to perform for a request. | [action](#action) | Yes |
+{{</bootstrap-table>}}
+
+### Match
+
+The match defines a match between conditions and an action or splits.
+
+In the example below, NGINX routes requests with the path `/coffee` to different upstreams based on the value of the cookie `user`:
+
+- `user=john` -> `coffee-future`
+- `user=bob` -> `coffee-deprecated`
+- If the cookie is not set or not equal to either `john` or `bob`, NGINX routes to `coffee-stable`
+
+```yaml
+path: /coffee
+matches:
+- conditions:
+  - cookie: user
+    value: john
+  action:
+    pass: coffee-future
+- conditions:
+  - cookie: user
+    value: bob
+  action:
+    pass: coffee-deprecated
+action:
+  pass: coffee-stable
+```
+
+In the next example, NGINX routes requests based on the value of the built-in [`$request_method` variable](https://nginx.org/en/docs/http/ngx_http_core_module.html#var_request_method), which represents the HTTP method of a request:
+
+- all POST requests -> `coffee-post`
+- all non-POST requests -> `coffee`
+
+```yaml
+path: /coffee
+matches:
+- conditions:
+  - variable: $request_method
+    value: POST
+  action:
+    pass: coffee-post
+action:
+  pass: coffee
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``conditions`` | A list of conditions. Must include at least 1 condition. | [[]condition](#condition) | Yes |
+|``action`` | The action to perform for a request. | [action](#action) | No |
+|``splits`` | The splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
+{{</bootstrap-table>}}
+
+{{< note >}} A match must include exactly one of the following: `action` or `splits`. {{< /note >}}
+
+### Condition
+
+The condition defines a condition in a match.
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``header`` | The name of a header. Must consist of alphanumeric characters or ``-``. | ``string`` | No |
+|``cookie`` | The name of a cookie. Must consist of alphanumeric characters or ``_``. | ``string`` | No |
+|``argument`` | The name of an argument. Must consist of alphanumeric characters or ``_``. | ``string`` | No |
+|``variable`` | The name of an NGINX variable. Must start with ``$``. See the list of the supported variables below the table. | ``string`` | No |
+|``value`` | The value to match the condition against. How to define a value is shown below the table. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+{{< note >}}  a condition must include exactly one of the following: `header`, `cookie`, `argument` or `variable`. {{< /note >}}
+
+Supported NGINX variables: `$args`, `$http2`, `$https`, `$remote_addr`, `$remote_port`, `$query_string`, `$request`, `$request_body`, `$request_uri`, `$request_method`, `$scheme`. Find the documentation for each variable [here](https://nginx.org/en/docs/varindex.html).
+
+The value supports two kinds of matching:
+
+- *Case-insensitive string comparison*. For example:
+  - `john` -- case-insensitive matching that succeeds for strings, such as `john`, `John`, `JOHN`.
+  - `!john` -- negation of the case-insensitive matching for john that succeeds for strings, such as `bob`, `anything`, `''` (empty string).
+- *Matching with a regular expression*. Note that NGINX supports regular expressions compatible with those used by the Perl programming language (PCRE). For example:
+  - `~^yes` -- a case-sensitive regular expression that matches any string that starts with `yes`. For example: `yes`, `yes123`.
+  - `!~^yes` -- negation of the previous regular expression that succeeds for strings like `YES`, `Yes123`, `noyes`. (The negation mechanism is not part of the PCRE syntax).
+  - `~*no$` -- a case-insensitive regular expression that matches any string that ends with `no`. For example: `no`, `123no`, `123NO`.
+
+{{< note >}} A value must not include any unescaped double quotes (`"`) and must not end with an unescaped backslash (`\`). For example, the following are invalid values: `some"value`, `somevalue\`. {{< /note >}}
+
+### ErrorPage
+
+The errorPage defines a custom response for a route for the case when either an upstream server responds with (or NGINX generates) an error status code. The custom response can be a redirect or a canned response. See the [error_page](https://nginx.org/en/docs/http/ngx_http_core_module.html#error_page) directive for more information.
+
+```yaml
+path: /coffee
+errorPages:
+- codes: [502, 503]
+  redirect:
+    code: 301
+    url: https://nginx.org
+- codes: [404]
+  return:
+    code: 200
+    body: "Original resource not found, but success!"
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``codes`` | A list of error status codes. | ``[]int`` | Yes |
+|``redirect`` | The redirect action for the given status codes. | [errorPage.Redirect](#errorpageredirect) | No |
+|``return`` | The canned response action for the given status codes. | [errorPage.Return](#errorpagereturn) | No |
+{{</bootstrap-table>}}
+
+{{< note >}} An errorPage must include exactly one of the following: `return` or `redirect`. {{< /note >}}
+
+### ErrorPage.Redirect
+
+The redirect defines a redirect for an errorPage.
+
+In the example below, NGINX responds with a redirect when a response from an upstream server has a 404 status code.
+
+```yaml
+codes: [404]
+redirect:
+  code: 301
+  url: ${scheme}://cafe.example.com/error.html
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``code`` | The status code of a redirect. The allowed values are: ``301`` , ``302`` , ``307`` , ``308``.  The default is ``301``. | ``int`` | No |
+|``url`` | The URL to redirect the request to. Supported NGINX variables: ``$scheme`` and ``$http_x_forwarded_proto``. Variables must be enclosed in curly braces. For example: ``${scheme}``. | ``string`` | Yes |
+{{</bootstrap-table>}}
+
+### ErrorPage.Return
+
+The return defines a canned response for an errorPage.
+
+In the example below, NGINX responds with a canned response when a response from an upstream server has either 401 or 403 status code.
+
+```yaml
+codes: [401, 403]
+return:
+  code: 200
+  type: application/json
+  body: |
+    {\"msg\": \"You don't have permission to do this\"}
+  headers:
+  - name: x-debug-original-statuses
+    value: ${upstream_status}
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``code`` | The status code of the response. The default is the status code of the original response. | ``int`` | No |
+|``type`` | The MIME type of the response. The default is ``text/html``. | ``string`` | No |
+|``body`` | The body of the response. Supported NGINX variable: ``$upstream_status`` . Variables must be enclosed in curly braces. For example: ``${upstream_status}``. | ``string`` | Yes |
+|``headers`` | The custom headers of the response. | [[]errorPage.Return.Header](#errorpagereturnheader) | No |
+{{</bootstrap-table>}}
+
+### ErrorPage.Return.Header
+
+The header defines an HTTP Header for a canned response in an errorPage:
+
+```yaml
+name: x-debug-original-statuses
+value: ${upstream_status}
+```
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | The name of the header. | ``string`` | Yes |
+|``value`` | The value of the header. Supported NGINX variable: ``$upstream_status`` . Variables must be enclosed in curly braces. For example: ``${upstream_status}``. | ``string`` | No |
+{{</bootstrap-table>}}
+
+## Using VirtualServer and VirtualServerRoute
+
+You can use the usual `kubectl` commands to work with VirtualServer and VirtualServerRoute resources, similar to Ingress resources.
+
+For example, the following command creates a VirtualServer resource defined in `cafe-virtual-server.yaml` with the name `cafe`:
+
+```shell
+kubectl apply -f cafe-virtual-server.yaml
+```
+```text
+virtualserver.k8s.nginx.org "cafe" created
+```
+
+You can get the resource by running:
+
+```shell
+kubectl get virtualserver cafe
+```
+```text
+NAME   STATE   HOST                   IP            PORTS      AGE
+cafe   Valid   cafe.example.com       12.13.23.123  [80,443]   3m
+```
+
+In `kubectl get` and similar commands, you can use the short name `vs` instead of `virtualserver`.
+
+Similarly, for VirtualServerRoute you can use `virtualserverroute` or the short name `vsr`.
+
+### Using Snippets
+
+Snippets allow you to insert raw NGINX config into different contexts of NGINX configuration. In the example below, we use snippets to configure several NGINX features in a VirtualServer:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+  namespace: cafe
+spec:
+  http-snippets: |
+    limit_req_zone $binary_remote_addr zone=mylimit:10m rate=1r/s;
+    proxy_cache_path /tmp keys_zone=one:10m;
+  host: cafe.example.com
+  tls:
+    secret: cafe-secret
+  server-snippets: |
+    limit_req zone=mylimit burst=20;
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+  - name: coffee
+    service: coffee-svc
+    port: 80
+  routes:
+  - path: /tea
+    location-snippets: |
+      proxy_cache one;
+      proxy_cache_valid 200 10m;
+    action:
+      pass: tea
+  - path: /coffee
+    action:
+      pass: coffee
+```
+
+For additional information, view the [Advanced configuration with Snippets]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) topic.
+
+### Validation
+
+Two types of validation are available for VirtualServer and VirtualServerRoute resources:
+
+- *Structural validation* by the `kubectl` and Kubernetes API server.
+- *Comprehensive validation* by NGINX Ingress Controller.
+
+#### Structural Validation
+
+The custom resource definitions for VirtualServer and VirtualServerRoute include structural OpenAPI schema which describes the type of every field of those resources.
+
+If you try to create (or update) a resource that violates the structural schema (for example, you use a string value for the port field of an upstream), `kubectl` and Kubernetes API server will reject such a resource:
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f cafe-virtual-server.yaml
+    ```
+    ```text
+    error: error validating "cafe-virtual-server.yaml": error validating data: ValidationError(VirtualServer.spec.upstreams[0].port): invalid type for org.nginx.k8s.v1.VirtualServer.spec.upstreams.port: got "string", expected "integer"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f cafe-virtual-server.yaml --validate=false
+    ```
+    ```text
+    The VirtualServer "cafe" is invalid: []: Invalid value: map[string]interface {}{ ... }: validation failure list:
+    spec.upstreams.port in body must be of type integer: "string"
+    ```
+
+If a resource is not rejected (it doesn't violate the structural schema), NGINX Ingress Controller will validate it further.
+
+#### Comprehensive Validation
+
+NGINX Ingress Controller validates the fields of the VirtualServer and VirtualServerRoute resources. If a resource is invalid, NGINX Ingress Controller will reject it: the resource will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can check if NGINX Ingress Controller successfully applied the configuration for a VirtualServer. For our example `cafe` VirtualServer, we can run:
+
+```shell
+kubectl describe vs cafe
+```
+```text
+...
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  16s   nginx-ingress-controller  Configuration for default/cafe was added or updated
+```
+
+Note how the events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid resource, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create a VirtualServer `cafe` with two upstream with the same name `tea`, you will get:
+
+```shell
+kubectl describe vs cafe
+```
+```text
+...
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  12s   nginx-ingress-controller  VirtualServer default/cafe is invalid and was rejected: spec.upstreams[1].name: Duplicate value: "tea"
+```
+
+Note how the events section includes a Warning event with the Rejected reason.
+
+Additionally, this information is also available in the `status` field of the VirtualServer resource. Note the Status section of the VirtualServer:
+
+```shell
+kubectl describe vs cafe
+```
+```text
+...
+Status:
+  External Endpoints:
+    Ip:        12.13.23.123
+    Ports:     [80,443]
+  Message:  VirtualServer default/cafe is invalid and was rejected: spec.upstreams[1].name: Duplicate value: "tea"
+  Reason:   Rejected
+  State:    Invalid
+```
+
+NGINX Ingress Controller validates VirtualServerRoute resources in a similar way.
+
+**Note**: If you make an existing resource invalid, NGINX Ingress Controller will reject it and remove the corresponding configuration from NGINX.
+
+## Customization using ConfigMap
+
+You can customize the NGINX configuration for VirtualServer and VirtualServerRoutes resources using the [ConfigMap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource). Most of the ConfigMap keys are supported, with the following exceptions:
+
+- `proxy-hide-headers`
+- `proxy-pass-headers`
+- `hsts`
+- `hsts-max-age`
+- `hsts-include-subdomains`
+- `hsts-behind-proxy`
+- `redirect-to-https`
+- `ssl-redirect`
diff --git a/content/nic/glossary.md b/content/nic/glossary.md
new file mode 100644
index 000000000..d76f9e3db
--- /dev/null
+++ b/content/nic/glossary.md
@@ -0,0 +1,30 @@
+---
+description: null
+docs: DOCS-1446
+title: Glossary
+weight: 10000
+---
+
+This is a glossary of terms related to F5 NGINX Ingress Controller and Kubernetes as a whole.
+
+---
+
+## Ingress {#ingress}
+
+_Ingress_ refers to an _Ingress Resource_, a Kubernetes API object which allows access to [Services](https://kubernetes.io/docs/concepts/services-networking/service/) within a cluster. They are managed by an [Ingress Controller]({{< ref "/nic/glossary.md#ingress-controller">}}).
+
+_Ingress_ resources enable the following functionality:
+
+- **Load balancing**, extended through the use of Services
+- **Content-based routing**, using hosts and paths
+- **TLS/SSL termination**, based on hostnames
+
+For additional information, please read the official [Kubernetes Ingress Documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/).
+
+---
+
+## Ingress Controller {#ingress-controller}
+
+*Ingress Controllers* are applications within a Kubernetes cluster that enable [Ingress]({{< ref "/nic/glossary.md#ingress">}}) resources to function. They are not automatically deployed with a Kubernetes cluster, and can vary in implementation based on intended use, such as load balancing algorithms for Ingress resources.
+
+[The design of NGINX Ingress Controller]({{< ref "/nic/overview/design.md">}}) explains the technical details of NGINX Ingress Controller.
diff --git a/content/nic/installation/_index.md b/content/nic/installation/_index.md
new file mode 100644
index 000000000..4ed49bfcb
--- /dev/null
+++ b/content/nic/installation/_index.md
@@ -0,0 +1,8 @@
+---
+title: Installation
+description:
+weight: 400
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/installation/build-nginx-ingress-controller.md b/content/nic/installation/build-nginx-ingress-controller.md
new file mode 100644
index 000000000..4f37d8f25
--- /dev/null
+++ b/content/nic/installation/build-nginx-ingress-controller.md
@@ -0,0 +1,203 @@
+---
+title: Build NGINX Ingress Controller
+toc: true
+weight: 400
+type: how-to
+product: NIC
+docs: DOCS-1453
+---
+
+This document describes how to build an F5 NGINX Ingress Controller image from source code and upload it to a private Docker registry.
+
+It also includes information on the Makefile targets and variables.
+
+{{<call-out "tip" "Pre-built image alternatives" >}} If you do not need to build a custom image, see the [pre-built image options](#pre-built-images) at the end of this guide. {{</call-out>}}
+
+## Before you begin
+
+To get started, you need the following software installed on your machine:
+
+- [Docker v19.03 or higher](https://docs.docker.com/engine/release-notes/19.03/)
+- [GNU Make](https://www.gnu.org/software/make/)
+- [git](https://git-scm.com/)
+- [OpenSSL](https://www.openssl.org/), optionally, if you would like to generate a self-signed certificate and a key for the default server.
+- For NGINX Plus users, download the certificate (_nginx-repo.crt_) and key (_nginx-repo.key_) from [MyF5](https://my.f5.com).
+
+Although NGINX Ingress Controller is written in Golang, you don't need to have Golang installed.
+
+You can download the precompiled binary file or build NGINX Ingress Controller in a Docker container.
+
+---
+
+## Prepare the environment {#prepare-environment}
+
+Get your system ready for building and pushing the NGINX Ingress Controller image.
+
+1. Sign in to your private registry. Replace `<my-docker-registry>` with the path to your own private registry.
+
+    ```shell
+    docker login <my-docker-registry>
+    ```
+
+2. Clone the NGINX Ingress Controller GitHub repository. Replace `<version_number>` with the version of NGINX Ingress Controller you want.
+
+    ```shell
+    git clone https://github.com/nginx/kubernetes-ingress.git --branch <version_number>
+    cd kubernetes-ingress
+    ```
+
+    For instance if you want to clone version v{{< nic-version >}}, the commands to run would be:
+
+    ```shell
+    git clone https://github.com/nginx/kubernetes-ingress.git --branch v{{< nic-version >}}
+    cd kubernetes-ingress
+    ```
+
+---
+
+## Build the NGINX Ingress Controller image {#build-image}
+
+After setting up your environment, follow these steps to build the NGINX Ingress Controller image.
+
+{{< note >}} If you have a local Golang environment and want to build the binary yourself, remove `TARGET=download` from the make commands. If you don't have Golang but still want to build the binary, use `TARGET=container`. {{< /note >}}
+
+### For NGINX
+
+Build the image. Replace `<my-docker-registry>` with your private registry's path.
+
+- For a Debian-based image:
+
+    ```shell
+    make debian-image PREFIX=<my-docker-registry>/nginx-ingress TARGET=download
+    ```
+
+- For an Alpine-based image:
+
+    ```shell
+    make alpine-image PREFIX=<my-docker-registry>/nginx-ingress TARGET=download
+    ```
+
+**What to expect**: The image is built and tagged with a version number, which is derived from the `VERSION` variable in the [_Makefile_](#makefile-details). This version number is used for tracking and deployment purposes.
+
+### For NGINX Plus
+
+Place your NGINX Plus license files (_nginx-repo.crt_ and _nginx-repo.key_) in the project's root folder. To verify they're in place, run:
+
+```shell
+ls nginx-repo.*
+```
+
+You should see:
+
+```text
+nginx-repo.crt  nginx-repo.key
+```
+
+Build the image. Replace `<my-docker-registry>` with your private registry's path.
+
+```shell
+make debian-image-plus PREFIX=<my-docker-registry>/nginx-plus-ingress TARGET=download
+```
+
+<br>
+
+**What to expect**: The image is built and tagged with a version number, which is derived from the `VERSION` variable in the [_Makefile_](#makefile-details). This version number is used for tracking and deployment purposes.
+
+{{<note>}} If a patch for NGINX Plus is released, make sure to rebuild your image to get the latest version. If your system is caching the Docker layers and not updating the packages, add `DOCKER_BUILD_OPTIONS="--pull --no-cache"` to the make command. {{</note>}}
+
+---
+
+## Push the image to your private registry {#push-image}
+
+Once you've successfully built the NGINX or NGINX Plus Ingress Controller image, the next step is to upload it to your private Docker registry. This makes the image available for deployment to your Kubernetes cluster.
+
+### For NGINX
+
+Upload the NGINX image. If you're using a custom tag, append `TAG=your-tag` to the command. Replace `<my-docker-registry>` with your private registry's path.
+
+```shell
+make push PREFIX=<my-docker-registry>/nginx-ingress
+```
+
+### For NGINX Plus
+
+Upload the NGINX Plus image. Like with the NGINX image, if you're using a custom tag, add `TAG=your-tag` to the end of the command. Replace `<my-docker-registry>` with your private registry's path.
+
+```shell
+make push PREFIX=<my-docker-registry>/nginx-plus-ingress
+```
+
+---
+
+## Makefile details {#makefile-details}
+
+This section provides comprehensive information on the targets and variables available in the _Makefile_. These targets and variables allow you to customize how you build, tag, and push your NGINX or NGINX Plus images.
+
+### Key Makefile targets {#key-makefile-targets}
+
+{{<tip>}}To view available _Makefile_ targets, run `make` with no target or type `make help`.{{</tip>}}
+
+Key targets include:
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| <div style="width:200px">Target | Description                                                                                                                                                                                                  |
+|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| _build_                       | Creates the NGINX Ingress Controller binary with your local Go environment.                                                                                                                                  |
+| _alpine-image_                | Builds an Alpine-based image with NGINX.                                                                                                                                                                     |
+| _alpine-image-plus_           | Builds an Alpine-based image with NGINX Plus.                                                                                                                                                                |
+| _alpine-image-plus-fips_      | Builds an Alpine-based image with NGINX Plus and FIPS.                                                                                                                                                       |
+| _alpine-image-nap-v5-plus-fips_      | Builds an Alpine-based image with NGINX Plus, the [NGINX App Protect WAF v5](/nginx-app-protect/) module and FIPS.                                                                                                                                                       |
+| _debian-image_                | Builds a Debian-based image with NGINX.                                                                                                                                                                      |
+| _debian-image-plus_           | Builds a Debian-based image with NGINX Plus.                                                                                                                                                                 |
+| _debian-image-nap-plus_       | Builds a Debian-based image with NGINX Plus and the [NGINX App Protect WAF](/nginx-app-protect/) module.                                                                                                     |
+| _debian-image-nap-v5-plus_       | Builds a Debian-based image with NGINX Plus and the [NGINX App Protect WAF v5](/nginx-app-protect/) module.                                                                                                     |
+| _debian-image-dos-plus_       | Builds a Debian-based image with NGINX Plus and the [NGINX App Protect DoS](/nginx-app-protect-dos/) module.                                                                                                 |
+| _debian-image-nap-dos-plus_   | Builds a Debian-based image with NGINX Plus, [NGINX App Protect WAF](/nginx-app-protect/) and [NGINX App Protect DoS](/nginx-app-protect-dos/) modules.                                                      |
+| _ubi-image_                   | Builds a UBI-based image with NGINX for [OpenShift](https://www.openshift.com/) clusters.                                                                                                                    |
+| _ubi-image-plus_              | Builds a UBI-based image with NGINX Plus for [OpenShift](https://www.openshift.com/) clusters.                                                                                                               |
+| _ubi-image-nap-plus_          | Builds a UBI-based image with NGINX Plus and the [NGINX App Protect WAF](/nginx-app-protect/) module for [OpenShift](https://www.openshift.com/) clusters.                                                   |
+| _ubi-image-nap-v5-plus_          | Builds a UBI-based image with NGINX Plus and the [NGINX App Protect WAF v5](/nginx-app-protect/) module for [OpenShift](https://www.openshift.com/) clusters.                                                   |
+| _ubi-image-dos-plus_          | Builds a UBI-based image with NGINX Plus and the [NGINX App Protect DoS](/nginx-app-protect-dos/) module for [OpenShift](https://www.openshift.com/) clusters.                                               |
+| _ubi-image-nap-dos-plus_      | <p>Builds a UBI-based image with NGINX Plus, [NGINX App Protect WAF](/nginx-app-protect/) and the [NGINX App Protect DoS](/nginx-app-protect-dos/) module for [OpenShift](https://www.openshift.com/) clusters.</p> <p> **Important**: Save your RHEL organization and activation keys in a file named _rhel_license_ at the project root.</p> <p> For instance:</p> <pre>RHEL_ORGANIZATION=1111111<br />RHEL_ACTIVATION_KEY=your-key</pre>|
+{{</bootstrap-table>}}
+
+---
+
+### Additional useful targets {#other-makefile-targets}
+
+A few other useful targets:
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| <div style="width:200px">Target</div> | Description   |
+|---------------------------------------|---------------|
+| _push_                              | Pushes the built image to the Docker registry. Configures with `PREFIX` and `TAG`.  |
+| _all_                               | Runs `test`, `lint`, `verify-codegen`, `update-crds`, and `debian-image`. Stops and reports an error if any of these targets fail.  |
+| _test_                              | Runs unit tests.  |
+{{</bootstrap-table>}}
+
+### Makefile variables you can customize {#makefile-variables}
+
+The _Makefile_ includes several key variables. You have the option to either modify these variables directly in the _Makefile_ or override them when you run the `make` command.
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| <div style="width:200px">Variable</div> | Description   |
+|-----------------------------------------|---------------|
+| _ARCH_                                | Defines the architecture for the image and binary. The default is `amd64`, but you can also use `arm64`. |
+| _PREFIX_                              | Gives the image its name. The default is `nginx/nginx-ingress`.  |
+| _TAG_                                 | Adds a tag to the image. This is often the version of NGINX Ingress Controller.   |
+| _DOCKER\_BUILD\_OPTIONS_                | Allows for additional [options](https://docs.docker.com/engine/reference/commandline/build/#options) during the `docker build` process, like `--pull`.  |
+| _TARGET_                              | <p>Determines the build environment. NGINX Ingress Controller compiles locally in a Golang environment by default. Ensure the NGINX Ingress Controller repo resides in your `$GOPATH` if you select this option.</p><p>Alternatively, you can set `TARGET=container` to build using a Docker [Golang](https://hub.docker.com/_/golang/) container. To skip compiling the binary if you're on a specific tag or the latest `main` branch commit, set `TARGET=download`.</p>  |
+{{</bootstrap-table>}}
+
+---
+
+## Alternatives to building your own image {#pre-built-images}
+
+If you prefer not to build your own NGINX Ingress Controller image, you can use pre-built images. Here are your options:
+
+**NGINX Ingress Controller**: Download the image `nginx/nginx-ingress` from [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress) or [GitHub](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress).
+
+**NGINX Plus Ingress Controller**: You have two options for this:
+
+- Download the image using your NGINX Ingress Controller subscription certificate and key. View the [Get NGINX Ingress Controller from the F5 Registry]({{< ref "/nic/installation/nic-images/get-registry-image" >}}) topic.
+- Use your NGINX Ingress Controller subscription JWT token to get the image. View the [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic.
diff --git a/content/nic/installation/create-license-secret.md b/content/nic/installation/create-license-secret.md
new file mode 100644
index 000000000..91be0f9f9
--- /dev/null
+++ b/content/nic/installation/create-license-secret.md
@@ -0,0 +1,155 @@
+---
+title: Create a license Secret 
+toc: true
+weight: 300
+nd-content-type: how-to
+nd-product: NIC
+---
+
+This document explains how to create and use a license secret for F5 NGINX Ingress Controller. 
+
+# Overview
+
+NGINX Plus Ingress Controller requires a valid JSON Web Token (JWT) to download the container image from the F5 registry. From version 4.0.0, this JWT token is also required to run NGINX Plus.
+
+This requirement is part of F5’s broader licensing program and aligns with industry best practices. The JWT will streamline subscription renewals and usage reporting, helping you manage your NGINX Plus subscription more efficiently. The [telemetry](#telemetry) data we collect helps us improve our products and services to better meet your needs.
+
+The JWT is required for validating your subscription and reporting telemetry data. For environments connected to the internet, telemetry is automatically sent to F5’s licensing endpoint.  In offline environments, telemetry is routed through [NGINX Instance Manager]({{< ref "/nim/" >}}). By default usage is reported every hour and also whenever NGINX is reloaded.
+
+{{< note >}} Read the [subscription licenses topic]({{< ref "/solutions/about-subscription-licenses.md#for-internet-connected-environments" >}}) for a list of IPs associated with F5's licensing endpoint (`product.connect.nginx.com`). {{</ note >}}
+
+## Set up your NGINX Plus license 
+
+### Download the JWT
+
+{{< include "/nic/installation/download-jwt.md" >}}
+
+### Create the Secret 
+
+The JWT needs to be configured before deploying NGINX Ingress Controller. The JWT will be stored in a Kubernetes Secret of type `nginx.com/license`, and can be created with the following command.
+
+```shell
+kubectl create secret generic license-token --from-file=license.jwt=<path-to-your-jwt> --type=nginx.com/license -n <Your Namespace> 
+```
+You can now delete the downloaded `.jwt` file.
+
+{{< note >}}
+The Secret needs to be in the same Namespace as the NGINX Ingress Controller Pod(s).
+{{</ note >}}
+
+{{< include "/nic/installation/jwt-password-note.md" >}}
+
+### Use the NGINX Plus license Secret
+
+If using a name other than the default `license-token`, provide the name of this Secret when installing NGINX Ingress Controller:
+
+{{<tabs name="plus-secret-install">}}
+
+{{%tab name="Helm"%}}
+
+Specify the Secret name using the `controller.mgmt.licenseTokenSecretName` Helm value.
+
+For detailed guidance on creating the Management block via Helm, refer to the [Helm configuration documentation]({{< ref "/nic/installation/installing-nic/installation-with-helm/#configuration" >}}).
+
+{{% /tab %}}
+
+{{%tab name="Manifests"%}}
+
+Specify the Secret name in the `license-token-secret-name` Management ConfigMap key.
+
+For detailed guidance on creating the Management ConfigMap, refer to the [Management ConfigMap Resource Documentation]({{< ref "/nic/configuration/global-configuration/mgmt-configmap-resource/" >}}).
+
+{{% /tab %}}
+
+{{</tabs>}}
+
+If you are reporting to the default licensing endpoint, then you can now proceed with [installing NGINX Ingress Controller]({{< ref "nic/installation/installing-nic/" >}}). Otherwise, follow the steps below to configure reporting to NGINX Instance Manager
+
+### Create report for NGINX Instance Manager {#nim}
+
+If you are deploying NGINX Ingress Controller in an "air-gapped" environment you will need to report to [NGINX Instance Manager]({{< ref "/nim/" >}}) instead of the default licensing endpoint.
+
+First, you must specify the endpoint of your NGINX Instance Manager.
+
+{{<tabs name="nim-endpoint">}}
+
+{{%tab name="Helm"%}}
+
+Specify the endpoint using the `controller.mgmt.usageReport.endpoint` helm value.
+
+{{% /tab %}}
+
+{{%tab name="Manifests"%}}
+
+Specify the endpoint in the `usage-report-endpoint` Management ConfigMap key.
+
+{{% /tab %}}
+
+{{</tabs>}}
+
+#### Configure SSL certificates and SSL trusted certificates {#nim-cert}
+
+To configure SSL certificates or SSL trusted certificates, extra steps are necessary.
+
+To use Client Auth with NGINX Instance Manager, first create a Secret of type `kubernetes.io/tls` in the same namespace as the NGINX Ingress Controller pods. 
+
+```shell
+kubectl create secret tls ssl-certificate --cert=<path-to-your-client.pem> --key=<path-to-your-client.key> -n <Your Namespace>
+```
+
+To provide a SSL trusted certificate, and an optional Certificate Revocation List, create a Secret of type `nginx.org/ca` in the Namespace that the NIC Pod(s) are in.
+
+```shell
+kubectl create secret generic ssl-trusted-certificate \
+   --from-file=ca.crt=<path-to-your-ca.crt> \
+   --from-file=ca.crl=<path-to-your-ca.crl> \ # optional
+   --type=nginx.org/ca
+```
+
+Providing an optional CRL (certificate revocation list) will configure the [`ssl_crl`](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directive.
+
+{{<tabs name="nim-secret-install">}}
+
+{{%tab name="Helm"%}}
+
+Specify the SSL certificate Secret name using the `controller.mgmt.sslCertificateSecretName` Helm value. 
+
+Specify the SSL trusted certificate Secret name using the `controller.mgmt.sslTrustedCertificateSecretName` Helm value.
+
+{{% /tab %}}
+
+{{%tab name="Manifests"%}}
+
+Specify the SSL certificate Secret name in the `ssl-certificate-secret-name` management ConfigMap key.
+
+Specify the SSL trusted certificate Secret name in the `ssl-trusted-certificate-secret-name` management ConfigMap key.
+
+{{% /tab %}}
+
+{{</tabs>}}
+
+<br>
+
+Once these Secrets are created and configured, you can now [install NGINX Ingress Controller ]({{< ref "/nic/installation/installing-nic/" >}}).
+
+
+## What’s reported and how it’s protected {#telemetry}
+
+NGINX Plus reports the following data every hour by default:
+
+- **NGINX version and status**: The version of NGINX Plus running on the instance.
+- **Instance UUID**: A unique identifier for each NGINX Plus instance.
+- **Traffic data**:
+  - **Bytes received from and sent to clients**: HTTP and stream traffic volume between clients and NGINX Plus.
+  - **Bytes received from and sent to upstreams**: HTTP and stream traffic volume between NGINX Plus and upstream servers.
+  - **Client connections**: The number of accepted client connections (HTTP and stream traffic).
+  - **Requests handled**: The total number of HTTP requests processed.
+- **NGINX uptime**: The number of reloads and worker connections during uptime.
+- **Usage report timestamps**: Start and end times for each usage report.
+- **Kubernetes node details**: Information about Kubernetes nodes.
+
+### Security and privacy of reported data
+
+All communication between your NGINX Plus instances, NGINX Instance Manager, and F5’s licensing endpoint (`product.connect.nginx.com`) is protected using **SSL/TLS** encryption.
+
+Only **operational metrics** are reported — no **personally identifiable information (PII)** or **sensitive customer data** is transmitted.
diff --git a/content/nic/installation/ingress-nginx.md b/content/nic/installation/ingress-nginx.md
new file mode 100644
index 000000000..cdace0791
--- /dev/null
+++ b/content/nic/installation/ingress-nginx.md
@@ -0,0 +1,546 @@
+---
+docs: DOCS-1469
+doctypes:
+- tutorial
+tags:
+- docs
+title: Migrate from Ingress-NGINX Controller to NGINX Ingress Controller
+toc: true
+weight: 500
+---
+
+This document describes how to migrate from the community-maintained Ingress-NGINX Controller to F5 NGINX Ingress Controller.
+
+## Overview
+
+This page explains two different ways to migrate from the community-maintained [Ingress-NGINX Controller](https://github.com/kubernetes/ingress-nginx) project to NGINX Ingress Controller: using NGINX's Ingress Resources or with Kubernetes's built-in Ingress Resources. This is typically because of implementation differences, and to take advantage of features such as [NGINX Plus integration]({{<ref "/nic/overview/nginx-plus">}}).
+
+The information in this guide is extracted from a free eBook called "_Kubernetes Ingress Controller Deployment and Security with NGINX_", which can be downloaded from the [NGINX Library](https://www.nginx.com/resources/library/kubernetes-ingress-controller-deployment-security-nginx/).
+
+## Before you begin
+
+To complete the instructions in this guide, you need the following:
+
+- A working knowledge of [Ingress Controllers]({{<ref "/nic/glossary.md#ingress-controller-ingress-controller">}}).
+- An [NGINX Ingress Controller installation]({{<ref "/nic/installation/installing-nic">}}) on the same host as an existing Ingress-NGINX Controller.
+
+There are two primary paths for migrating between the community Ingress-NGINX Controller to NGINX Ingress Controller:
+
+- Using NGINX Ingress Resources
+- Using Kubernetes Ingress Resources.
+
+## Migration with NGINX Ingress resources
+This path uses Kubernetes Ingress Resources to set root permissions, then NGINX Ingress Resources for configuration using custom resource definitions (CRDs):
+
+* [VirtualServer and VirtualServerRoute]({{<ref "/nic/configuration/virtualserver-and-virtualserverroute-resources">}})
+* [TransportServer]({{<ref "/nic/configuration/transportserver-resource">}})
+* [GlobalConfiguration]({{<ref "/nic/configuration/global-configuration/globalconfiguration-resource">}})
+* [Policy]({{<ref "/nic/configuration/policy-resource">}})
+
+### Configuring SSL termination and HTTP path-based routing
+The following two code examples correspond to a Kubernetes Ingress Resource and an [NGINX VirtualServer Resource]({{<ref "/nic/configuration/virtualserver-and-virtualserverroute-resources">}}). Although the syntax and indentation is different, they accomplish the same basic Ingress functions, used for SSL termination and Layer 7 path-based routing.
+
+**Kubernetes Ingress Resource**
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nginx-test
+spec:
+  tls:
+    - hosts:
+      - foo.bar.com
+      secretName: tls-secret
+  rules:
+    - host: foo.bar.com
+      http:
+        paths:
+        - path: /login
+          backend:
+            serviceName: login-svc
+            servicePort: 80
+        - path: /billing
+            serviceName: billing-svc
+            servicePort: 80
+```
+
+**NGINX VirtualServer Resource**
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: VirtualServer
+metadata:
+  name: nginx-test
+spec:
+  host: foo.bar.com
+  tls:
+    secret: tls-secret
+  upstreams:
+    - name: login
+      service: login-svc
+      port: 80
+    - name: billing
+      service: billing-svc
+      port: 80
+  routes:
+  - path: /login
+    action:
+      pass: login
+  - path: /billing
+    action:
+      pass: billing
+```
+
+### Configuring TCP/UDP load balancing and TLS passthrough
+NGINX Ingress Controller exposes TCP and UDP services using [TransportServer]({{<ref "/nic/configuration/transportserver-resource">}}) and [GlobalConfiguration]({{<ref "/nic/configuration/global-configuration/globalconfiguration-resource">}}) resources. These resources provide a broad range of options for TCP/UDP and TLS Passthrough load balancing. By contrast, the community Ingress-NGINX Controller exposes TCP/UDP services by using a Kubernetes ConfigMap object.
+
+---
+
+### Convert Ingress-NGINX Controller annotations to NGINX Ingress resources
+Kubernetes deployments often need to extend basic Ingress rules for advanced use cases such as canary and blue-green deployments, traffic throttling, and ingress-egress traffic manipulation. The community Ingress-NGINX Controller implements many of these using Kubernetes annotations with custom Lua extensions.
+
+These custom Lua extensions are intended for specific NGINX Ingress resource definitions and may not be as granular as required for advanced use cases. The following examples show how to convert these annotations into NGINX Ingress Controller Resources.
+
+---
+
+#### Canary deployments
+Canary and blue-green deployments allow you to push code changes to production environments without disrupting existing users. NGINX Ingress Controller runs them on the data plane: to migrate from the community Ingress-NGINX Controller, you must map the latter's annotations to [VirtualServer and VirtualServerRoute resources]({{<ref "/nic/configuration/virtualserver-and-virtualserverroute-resources">}}).
+
+The Ingress-NGINX Controller evaluates canary annotations in the following order:
+
+1. _nginx.ingress.kubernetes.io/canary-by-header_
+1. _nginx.ingress.kubernetes.io/canary-by-cookie_
+1. _nginx.ingress.kubernetes.io/canary-by-weight_
+
+For NGINX Ingress Controller to evalute them the same way, they must appear in the same order in the VirtualServer or VirtualServerRoute Manifest.
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/canary: "true"
+nginx.ingress.kubernetes.io/canary-by-header: "httpHeader"
+```
+
+**NGINX Ingress Controller**
+```yaml
+matches:
+- conditions:
+  - header: httpHeader
+      value: never
+  action:
+    pass: echo
+  - header: httpHeader
+      value: always
+  action:
+    pass: echo-canary
+action:
+  pass: echo
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/canary: "true"
+nginx.ingress.kubernetes.io/canary-by-header: "httpHeader"
+nginx.ingress.kubernetes.io/canary-by-header-value: "my-value"
+```
+
+**NGINX Ingress Controller**
+```yaml
+matches:
+- conditions:
+  - header: httpHeader
+      value: my-value
+  action:
+    pass: echo-canary
+action:
+  pass: echo
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/canary: "true"
+nginx.ingress.kubernetes.io/canary-by-cookie: "cookieName"
+```
+
+**NGINX Ingress Controller**
+```yaml
+matches:
+- conditions:
+  - cookie: cookieName
+      value: never
+  action:
+    pass: echo
+  - cookie: cookieName
+      value: always
+  action:
+    pass: echo-canary
+action:
+  pass: echo
+```
+
+---
+
+#### Traffic control
+Environments using microservices tend to use extensive traffic-control policies to manage ephemeral applications using circuit breaking and rate and connection limiting to prevent error conditions due to unhealthy states or abnormal behavior.
+
+The following examples map Ingress-NGINX Controller annotations to NGINX [VirtualServer and VirtualServerRoute resources]({{<ref "/nic/configuration/virtualserver-and-virtualserverroute-resources">}}) for rate limiting, custom HTTP errors, custom default backend and URI rewriting.
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/custom-http-errors: "code"
+
+nginx.ingress.kubernetes.io/default-backend: "default-svc"
+```
+
+**NGINX Ingress Controller**
+```yaml
+errorPages:
+- codes: [code]
+    redirect:
+      code: 301
+      url: default-svc
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/limit-connections: "number"
+```
+
+**NGINX Ingress Controller**
+```yaml
+http-snippets: |
+    limit_conn_zone $binary_remote_addr zone=zone_name:size;
+routes:
+- path: /path
+    location-snippets: |
+      limit_conn zone_name number;
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/limit-rate: "number"
+nginx.ingress.kubernetes.io/limit-rate-after: "number"
+```
+
+**NGINX Ingress Controller**
+```yaml
+location-snippets: |
+    limit_rate number;
+
+    limit_rate_after number;
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/limit-rpm: "number"
+nginx.ingress.kubernetes.io/limit-burst-multiplier: "multiplier"
+```
+
+**NGINX Ingress Controller**
+```yaml
+rateLimit:
+    rate: numberr/m
+
+    burst: number * multiplier
+    key: ${binary_remote_addr}
+    zoneSize: size
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/limit-rps: "number"
+nginx.ingress.kubernetes.io/limit-burst-multiplier: "multiplier"
+```
+
+**NGINX Ingress Controller**
+```yaml
+rateLimit:
+    rate: numberr/s
+
+    burst: number * multiplier
+    key: ${binary_remote_addr}
+    zoneSize: size
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/limit-whitelist: "CIDR"
+```
+
+**NGINX Ingress Controller**
+```yaml
+http-snippets: |
+server-snippets: |
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/rewrite-target: "URI"
+```
+
+**NGINX Ingress Controller**
+```yaml
+rewritePath: "URI"
+```
+
+There are four Ingress-NGINX Controller annotations without NGINX Ingress resource fields yet: they must be handled using snippets.
+
+- _nginx.ingress.kubernetes.io/limit-connections_
+- _nginx.ingress.kubernetes.io/limit-rate_
+- _nginx.ingress.kubernetes.io/limit-rate-after_
+- _nginx.ingress.kubernetes.io/limit-whitelist_
+
+---
+
+#### Header manipulation
+Manipulating HTTP headers is useful in many cases, as they contain information that is important and relevant to systems involved in HTTP transactions. The community Ingress-NGINX Controller supports enabling and configuring cross-origin resource sharing (CORS) headings used by AJAX applications, where front-end Javascript code interacts with backend applications or web servers.
+
+These code blocks show how the Ingress-NGINX annotations correspond to NGINX Ingress Controller [VirtualServer and VirtualServerRoute resources]({{<ref "/nic/configuration/virtualserver-and-virtualserverroute-resources">}}).
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/enable-cors: "true"
+nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
+
+nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
+
+nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS"
+
+nginx.ingress.kubernetes.io/cors-allow-origin: "*"
+
+nginx.ingress.kubernetes.io/cors-max-age: "seconds"
+```
+
+**NGINX Ingress Controller**
+```yaml
+responseHeaders:
+  add:
+    - name: Access-Control-Allow-Credentials
+      value: "true"
+    - name: Access-Control-Allow-Headers
+      value: "X-Forwarded-For"
+    - name: Access-Control-Allow-Methods
+      value: "PUT, GET, POST, OPTIONS"
+    - name: Access-Control-Allow-Origin
+      value: "*"
+    - name: Access-Control-Max-Age
+      value: "seconds"
+```
+
+---
+
+#### Proxying and load balancing
+NGINX Ingress Controller has multiple proxy and load balancing functionalities you may want to configure based on the use case, such as configuring the load balancing algorithm and the timeout and buffering settings for proxied connections.
+
+This table shows how Ingress-NGINX Controller annotations map to statements in the upstream field for [VirtualServer and VirtualServerRoute resources]({{<ref "/nic/configuration/virtualserver-and-virtualserverroute-resources">}}), covering load balancing, proxy timeout, proxy buffering and connection routing for a services' ClusterIP address and port.
+
+{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
+| Ingress-NGINX Controller | NGINX Ingress Controller |
+| ------------------------ | ------------------------ |
+| _nginx.ingress.kubernetes.io/load-balance_ | _lb-method_ |
+| _nginx.ingress.kubernetes.io/proxy-buffering_ | _buffering_ |
+| _nginx.ingress.kubernetes.io/proxy-buffers-number_ | _buffers_ |
+| _nginx.ingress.kubernetes.io/proxy-buffer-size_ | _buffers_ |
+| _nginx.ingress.kubernetes.io/proxy-connect-timeout_ | _connect-timeout_ |
+| _nginx.ingress.kubernetes.io/proxy-next-upstream_ | _next-upstream_ |
+| _nginx.ingress.kubernetes.io/proxy-next-upstream-timeout_ | _next-upstream-timeout_ |
+| _nginx.ingress.kubernetes.io/proxy-read-timeout_ | _read-timeout_ |
+| _nginx.ingress.kubernetes.io/proxy-send-timeout_ | _send-timeout_ |
+| _nginx.ingress.kubernetes.io/service-upstream_ | _use-cluster-ip_ |
+{{% /bootstrap-table %}}
+
+#### mTLS authentication
+
+mTLS authentication is a way of enforcing mutual authentication on traffic entering and exiting a cluster (north-sourth traffic). This secure form of communication is common within a service mesh, commonly used in strict zero-trust environments.
+
+NGINX Ingress Controller layer can handle mTLS authentication for end systems through the presentation of valid certificates for external connections. It accomplishes this through [Policy]({{<ref "/nic/configuration/policy-resource">}}) resources, which correspond to Ingress-NGINX Controller annotations for [client certificate authentication](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#client-certificate-authentication) and [backend certificate authentication](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-certificate-authentication).
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/auth-tls-secret: secretName
+nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
+nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
+```
+
+**NGINX Ingress Controller**
+```yaml
+ingressMTLS:
+   clientCertSecret: secretName
+   verifyClient: "on"
+
+   verifyDepth: 1
+```
+
+---
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/proxy-ssl-secret: "secretName"
+nginx.ingress.kubernetes.io/proxy-ssl-verify: "on|off"
+nginx.ingress.kubernetes.io/proxy-ssl-verify-depth: "1"
+nginx.ingress.kubernetes.io/proxy-ssl-protocols: "TLSv1.2"
+nginx.ingress.kubernetes.io/proxy-ssl-ciphers: "DEFAULT"
+nginx.ingress.kubernetes.io/proxy-ssl-name: "server-name"
+nginx.ingress.kubernetes.io/proxy-ssl-server-name: "on|off"
+```
+
+**NGINX Ingress Controller**
+```yaml
+egressMTLS:
+   tlsSecret: secretName
+
+   verifyServer: true|false
+
+   verifyDepth: 1
+
+   protocols: TLSv1.2
+
+   ciphers: DEFAULT
+
+   sslName: server-name
+
+   serverName: true|false
+```
+
+---
+
+#### Session persistence with NGINX Plus
+With [NGINX Plus]({{<ref "/nic/overview/nginx-plus">}}), you can use [Policy]({{<ref "/nic/configuration/policy-resource">}}) resources for session persistence, which have corresponding annotations for the community Ingress-NGINX Controller.
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/affinity: "cookie"
+nginx.ingress.kubernetes.io/session-cookie-name: "cookieName"
+nginx.ingress.kubernetes.io/session-cookie-expires: "x"
+nginx.ingress.kubernetes.io/session-cookie-path: "/route"
+nginx.ingress.kubernetes.io/session-cookie-secure: "true"
+```
+
+**NGINX Ingress Controller**
+```yaml
+sessionCookie:
+  enable: true
+
+  name: cookieName
+
+  expires: xh
+
+  path: /route
+
+  secure: true
+```
+
+## Migration with Kubernetes Ingress resources
+The other option for migrating from the community Ingress-NGINX Controller to NGINX Ingress Controller is using only [annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) and [ConfigMaps](https://kubernetes.io/docs/concepts/configuration/configmap/) from standard Kubernetes resources, potentially relying on [mergeable Ingress types](https://github.com/nginx/kubernetes-ingress/tree/main/examples/ingress-resources/mergeable-ingress-types).
+
+This ensures that all configuration is kept in the Ingress object.
+
+{{< warning >}}
+You should avoid altering the `spec` field of the Ingress resource when taking this option. Ingress-NGINX Controller and NGINX Ingress Controller differ slightly in their implementations: changing the Kubernetes Ingress can create incompatibility issues.
+{{< /warning >}}
+
+### Advanced configuration with annotations
+This table maps the Ingress-NGINX Controller annotations to NGINX Ingress Controller's equivalent annotations, and the respective NGINX Directive.
+
+{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
+| Ingress-NGINX Controller | NGINX Ingress Controller | NGINX Directive |
+| ------------------------ | ------------------------ | --------------- |
+| [_nginx.ingress.kubernetes.io/configuration-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet) | [_nginx.org/location-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#snippets-and-custom-templates) | N/A |
+| [_nginx.ingress.kubernetes.io/load-balance_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-nginx-load-balancing) (1) |  [_nginx.org/lb-method_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#backend-services-upstreams) | [_random two least_conn_](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#random) |
+| [_nginx.ingress.kubernetes.io/proxy-buffering_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffering) | [_nginx.org/proxy-buffering_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_buffering_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) |
+| [_nginx.ingress.kubernetes.io/proxy-buffers-number_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffers-number) | [_nginx.org/proxy-buffers_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_buffers_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) |
+| [_nginx.ingress.kubernetes.io/proxy-buffer-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffer-size) | [_nginx.org/proxy-buffer-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_buffer_size_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) |
+| [_nginx.ingress.kubernetes.io/proxy-connect-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-connect-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_connect_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) |
+| [_nginx.ingress.kubernetes.io/proxy-read-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-read-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_read_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) |
+| [_nginx.ingress.kubernetes.io/proxy-send-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-send-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_send_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) |
+| [_nginx.ingress.kubernetes.io/rewrite-target_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rewrite) | [_nginx.org/rewrites_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#request-uriheader-manipulation) | [_rewrite_](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#rewrite) |
+| [_nginx.ingress.kubernetes.io/server-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-snippet)| [_nginx.org/server-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#snippets-and-custom-templates) | N/A |
+| [_nginx.ingress.kubernetes.io/ssl-redirect_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect) | [_ingress.kubernetes.io/ssl-redirect_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#auth-and-ssltls) | N/A (2) |
+{{% /bootstrap-table %}}
+
+1. Ingress-NGINX Controller implements some of its load balancing algorithms with Lua, which may not have an equivalent in NGINX Ingress Controller.
+1. To redirect HTTP (80) traffic to HTTPS (443), NGINX Ingress Controller uses built-in NGINX `if` conditions while Ingress-NGINX Controller uses Lua.
+
+The following two snippets outline Ingress-NGINX Controller annotations that correspond to annotations for NGINX Ingress Controller with NGINX Plus.
+
+**Ingress-NGINX Controller**
+```yaml
+nginx.ingress.kubernetes.io/affinity: "cookie"
+nginx.ingress.kubernetes.io/session-cookie-name: "cookie_name"
+nginx.ingress.kubernetes.io/session-cookie-expires: "seconds"
+nginx.ingress.kubernetes.io/session-cookie-path: "/route"
+```
+
+**NGINX Ingress Controller (with NGINX Plus)**
+```yaml
+nginx.com/sticky-cookie-services: "serviceName=example-svc cookie_name expires=time path=/route"
+```
+
+{{< note >}}
+NGINX Ingress Controller has additional annotations for features using NGINX Plus that have no Ingress-NGINX Controller equivalent, such as active health checks and authentication using JSON Web Tokens (JWTs).
+{{< /note >}}
+
+### Global configuration with ConfigMaps
+
+This table maps the Ingress-NGINX Controller ConfigMap keys to NGINX Ingress Controller's equivalent ConfigMap keys.
+
+<!-- {{< note >}}
+Some of the key names are identical, and each Ingress Controller has ConfigMap keys that the other does not (Which are indicated).
+{{< /note >}} -->
+
+{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
+| Ingress-NGINX Controller | NGINX Ingress Controller |
+| ------------------------ | ------------------------ |
+| [_disable-access-log_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#disable-access-log) | [_access-log-off_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
+| [_error-log-level_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#error-log-level) | [_error-log-level_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
+| [_hsts_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts) | [_hsts_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
+| [_hsts-include-subdomains_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts-include-subdomains) | [_hsts-include-subdomains_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls)       |
+| [_hsts-max-age_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts-max-age) | [_hsts-max-age_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
+| [_http-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#http-snippet) | [_http-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
+| [_keep-alive_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#keep-alive) | [_keepalive-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_keep-alive-requests_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#keep-alive-requests) | [_keepalive-requests_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_load-balance_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#load-balance) | [_lb-method_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#backend-services-upstreams) |
+| [_location-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#location-snippet) | [_location-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
+| [_log-format-escape-json_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-escape-json) | [_log-format-escaping: "json"_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
+| [_log-format-stream_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-stream) | [_stream-log-format_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
+| [_log-format-upstream_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-upstream) | [_log-format_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
+| [_main-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#main-snippet) | [_main-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
+| [_max-worker-connections_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#max-worker-connections) | [_worker-connections_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_max-worker-open-files_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#max-worker-open-files) | [_worker-rlimit-nofile_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-body-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-body-size) | [_client-max-body-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-buffering_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffering) | [_proxy-buffering_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-buffers-number_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffers-number) | [_proxy-buffers: number size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-buffer-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffer-size) | [_proxy-buffers: number size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-connect-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-connect-timeout) | [_proxy-connect-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-read-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-read-timeout) | [_proxy-read-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-send-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-send-timeout) | [_proxy-send-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_server-name-hash-bucket-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-name-hash-bucket-size) | [_server-names-hash-bucket-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_proxy-headers-hash-max-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-headers-hash-max-size) | [_server-names-hash-max-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_server-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-snippet) | [_server-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
+| [_server-tokens _](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-tokens) | [_server-tokens_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_ssl-ciphers_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-ciphers) | [_ssl-ciphers_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
+| [_ssl-dh-param_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-dh-param) | [_ssl-dhparam-file_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
+| [_ssl-protocols_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-protocols) | [_ssl-protocols_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
+| [_ssl-redirect_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-redirect) | [_ssl-redirect_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
+| [_upstream-keepalive-connections_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#upstream-keepalive-connections) | [_keepalive_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#backend-services-upstreams) |
+| [_use-http2_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-http2) | [_http2_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#listeners) |
+| [_use-proxy-protocol_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-proxy-protocol) | [_proxy-protocol_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#listeners) |
+| [_variables-hash-bucket-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#variables-hash-bucket-size)     | [_variables-hash-bucket-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_worker-cpu-affinity_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-cpu-affinity) | [_worker-cpu-affinity_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_worker-processes_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-processes) | [_worker-processes_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_worker-shutdown-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-shutdown-timeout) | [_worker-shutdown-timeole_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+{{% /bootstrap-table %}}
diff --git a/content/nic/installation/installing-nic/_index.md b/content/nic/installation/installing-nic/_index.md
new file mode 100644
index 000000000..ad70f8f42
--- /dev/null
+++ b/content/nic/installation/installing-nic/_index.md
@@ -0,0 +1,5 @@
+---
+title: Install NGINX Ingress Controller
+description:
+weight: 100
+---
diff --git a/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md b/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
new file mode 100644
index 000000000..93cf807fd
--- /dev/null
+++ b/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
@@ -0,0 +1,343 @@
+---
+title: Install NGINX Ingress Controller and NGINX App Protect WAF with Docker and Helm
+toc: true
+weight: 500
+type: how-to
+product: NIC
+---
+
+This document describes how to build a local F5 NGINX App Protect WAF v5 Docker image with NGINX Plus Ingress 
+Controller, which can be used to compile WAF policies.
+
+This is accomplished with the following steps:
+
+- Prepare license secrets to enable a Kubernetes deployment
+- Use a NGINX App Protect WAF Docker image to transform a policy JSON file into a compiled bundle
+- Configure PersistentVolumes so the deployed NGINX App Protect WAF instance can access the compiled bundle
+- Deploy NGINX Plus Ingress Controller with NGINX App Protect
+- Test example services to validate that the WAF policies work
+
+---
+
+## Prepare Secrets and credentials
+
+1. Download your NGINX Ingress Controller subscription's JSON Web Token, SSL Certificate, and Private Key from MyF5. 
+   You can use the same JSON Web Token, Certificate, and Key as NGINX Plus in your MyF5 portal.
+1. Rename the files to the following:
+   - `nginx-repo.crt`
+   - `nginx-repo.key`
+   - `nginx-repo.jwt`
+1. Log in to the Docker registry using the contents of the JSON Web Token file:
+   ```shell
+   docker login private-registry.nginx.com --username=$(cat nginx-repo.jwt) --password=none
+   ```
+
+---
+
+## Compile WAF Policy from JSON to Bundle
+
+Pull the `waf-compiler` image with:
+
+```shell
+docker pull private-registry.nginx.com/nap/waf-compiler:5.6.0
+```
+
+Download the [provided WAF Policy JSON](https://raw.githubusercontent.com/nginx/kubernetes-ingress/main/tests/data/ap-waf-v5/wafv5.json):
+
+```shell
+curl -L https://raw.githubusercontent.com/nginx/kubernetes-ingress/main/tests/data/ap-waf-v5/wafv5.json -o /tmp/wafv5.json
+```
+
+Use your pulled NAP Docker image (`private-registry.nginx.com/nap/waf-compiler:5.6.0`) to compile the policy bundle:
+
+```shell
+# Using your newly created image
+docker run --rm \
+    -v /tmp:/tmp \
+    private-registry.nginx.com/nap/waf-compiler:5.6.0 \
+    -p /tmp/wafv5.json \
+    -o /tmp/compiled_policy.tgz
+```
+
+Move the downloaded JSON and compiled policy to your workspace:
+
+```shell
+mv /tmp/wafv5.json $(pwd)/wafv5.json
+mv /tmp/compiled_policy.tgz $(pwd)/compiled_policy.tgz
+```
+
+After this command, your workspace should contain:
+
+```
+├── nginx-repo.crt
+├── nginx-repo.key
+├── nginx-repo.jwt
+├── wafv5.json
+└── compiled_policy.tgz
+```
+
+---
+
+## Create the persistent volume and claim to store the policy bundle
+
+Save the following configuration data as `pvc.yaml` in the same directory.
+
+```yaml
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: task-pv-volume
+  labels:
+    type: local
+spec:
+  storageClassName: manual
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: "/tmp/"
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: task-pv-claim
+spec:
+  storageClassName: manual
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+```
+
+This sets up a 1Gi disk and attaches a claim to it that you will reference in the deployment chart.
+
+Create these with:
+
+```shell
+kubectl apply -f pvc.yaml
+```
+
+Verify that the persistent volume and claim are created:
+
+```shell
+# For the persistent volume
+kubectl get pv
+
+# For the persistent volume claim
+kubectl get pvc
+```
+
+## Deploy NGINX Plus NIC Controller with NAP Enabled using Helm
+
+Add the official NGINX Helm repository:
+
+```shell
+helm repo add nginx-stable https://helm.nginx.com/stable
+helm repo update
+```
+
+Create Kubernetes Docker and licensing secrets:
+```shell
+kubectl create secret \
+    docker-registry regcred \
+    --docker-server=private-registry.nginx.com \
+    --docker-username=$(cat nginx-repo.jwt) \
+    --docker-password=none
+
+kubectl create secret \
+    generic license-token \
+    --from-file=license.jwt=./nginx-repo.jwt \
+    --type=nginx.com/license
+```
+
+Install the required CRDs for NGINX Ingress Controller:
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v5.0.0/deploy/crds.yaml
+```
+
+Using Helm, install NGINX Ingress Controller
+
+```shell
+helm upgrade --install nic nginx-stable/nginx-ingress \
+   --set controller.image.repository="private-registry.nginx.com/nginx-ic-nap-v5/nginx-plus-ingress" \
+   --set controller.image.tag="5.0.0-alpine-fips" \
+   --set controller.nginxplus=true \
+   --set controller.appprotect.enable=true \
+   --set controller.appprotect.v5=true \
+   --set-json 'controller.appprotect.volumes=[
+      {"name":"app-protect-bd-config","emptyDir":{}},
+      {"name":"app-protect-config","emptyDir":{}},
+      {"name":"app-protect-bundles","persistentVolumeClaim":{"claimName":"task-pv-claim"}}
+   ]' \
+   --set controller.serviceAccount.imagePullSecretName=regcred \
+   --set 'controller.volumeMounts[0].name=app-protect-bundles' \
+   --set 'controller.volumeMounts[0].mountPath=/etc/app_protect/bundles/'
+
+```
+
+Verify deployment success:
+
+```shell
+kubectl get pods
+```
+
+---
+
+## Copy the policy bundle into the running instance
+
+Get the name of the pod from the `kubectl get pods` command above.
+
+Copy the file into the `nginx-ingress` container within the pod:
+
+```shell
+kubectl cp ./compiled_policy.tgz \
+    <pod name>:/etc/app_protect/bundles/compiled_policy.tgz \
+    -c nginx-ingress
+```
+
+Replace `<pod name>` with the actual name of the pod, for example:
+
+```shell
+kubectl cp ./compiled_policy.tgz \
+    nic-nginx-ingress-controller-9bd89589d-j925h:/etc/app_protect/bundles/compiled_policy.tgz \
+    -c nginx-ingress
+```
+
+Confirm that the policy file is in the pod. The following command should list `compiled_policy.tgz`.
+
+```shell
+kubectl exec --stdin --tty \
+    -c nginx-ingress \
+    <pod name> \
+    -- ls -la /etc/app_protect/bundles
+```
+
+## Confirm that the WAF policies work
+
+Save the following kubernetes config file as `webapp.yaml`:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: webapp
+spec:
+  host: webapp.example.com
+  policies:
+  - name: waf-policy
+  upstreams:
+  - name: webapp
+    service: webapp-svc
+    port: 80
+  routes:
+  - path: /
+    action:
+      pass: webapp
+---
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: waf-policy
+spec:
+  waf:
+    enable: true
+    apBundle: "compiled_policy.tgz"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webapp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: webapp
+  template:
+    metadata:
+      labels:
+        app: webapp
+    spec:
+      containers:
+        - name: webapp
+          image: nginxdemos/nginx-hello:plain-text
+          ports:
+            - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: webapp-svc
+spec:
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: webapp
+```
+
+Create the services with
+```shell
+kubectl apply -f webapp.yaml
+```
+
+Confirm that the services have started with
+
+```shell
+kubectl get pods
+```
+
+### Save the public IP and PORT in environment variables
+
+Get the public IP and port of your instance with the following command:
+
+```shell
+kubectl get svc
+```
+
+Save them in the following environment variables:
+
+```shell
+IC_IP=XXX.YYY.ZZZ.III
+IC_HTTP_PORT=<port number>
+```
+
+### Validate that the WAF works
+
+Send a valid request to the deployed application:
+
+```shell
+curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT/
+```
+
+```text
+Server address: 10.92.2.13:8080
+Server name: webapp-7b7dfbff54-dtxzt
+Date: 18/Apr/2025:19:39:18 +0000
+URI: /
+Request ID: 4f378a01fb8a36ae27e2c3059d264527
+```
+
+And send one that should be rejected
+
+```shell
+curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP "http://webapp.example.com:$IC_HTTP_PORT/<script>"
+```
+
+```text
+<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your 
+administrator.<br><br>Your support ID is: 11241918873745059631<br><br>
+<a href='javascript:history.back();'>[Go Back]</a></body></html>
+```
+
+This is mostly the same as the [examples/custom_resources/app-protect-waf-v5](https://github.com/nginx/kubernetes-ingress/tree/main/examples/custom-resources/app-protect-waf-v5)
+deployment in a single file with the policy bundle already set.
+
+You now have a fully operational NGINX Ingress Controller instance with NGINX App Protect deployed in your Kubernetes environment. 
+
+For further details, troubleshooting, or support, refer to the [official NGINX documentation](https://docs.nginx.com) or reach out directly to your F5/NGINX account team.
diff --git a/content/nic/installation/installing-nic/installation-with-helm.md b/content/nic/installation/installing-nic/installation-with-helm.md
new file mode 100644
index 000000000..460b838ac
--- /dev/null
+++ b/content/nic/installation/installing-nic/installation-with-helm.md
@@ -0,0 +1,493 @@
+---
+title: Installation with Helm
+toc: true
+weight: 100
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-602
+---
+
+This document explains how to install F5 NGINX Ingress Controller using [Helm](https://helm.sh/).
+
+## Before you begin
+
+{{< note >}} All documentation should only be used with the latest stable release, indicated on [the releases page]({{< ref "/nic/releases.md" >}}) of the GitHub repository. {{< /note >}}
+
+- A [Kubernetes Version Supported by NGINX Ingress Controller]({{< ref "/nic/technical-specifications.md#supported-kubernetes-versions" >}})
+- Helm 3.0+.
+- If you’d like to use NGINX Plus:
+  - Get the NGINX Ingress Controller JWT and [create a license secret]({{< ref "/nic/installation/create-license-secret.md" >}}).
+  - Download the image using your NGINX Ingress Controller subscription certificate and key. View the [Get NGINX Ingress Controller from the F5 Registry]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic.
+  - The [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic describes how to use your subscription JWT token to get the image.
+  - The [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}) topic explains how to push an image to a private Docker registry.
+  - Update the `controller.image.repository` field of the `values-plus.yaml` accordingly.
+
+## Custom Resource Definitions
+
+NGINX Ingress Controller requires custom resource definitions (CRDs) installed in the cluster, which Helm will install. If the CRDs are not installed, NGINX Ingress Controller pods will not become `Ready`.
+
+If you do not use the custom resources that require those CRDs (which corresponds to `controller.enableCustomResources` set to `false` and `controller.appprotect.enable` set to `false` and `controller.appprotectdos.enable` set to `false`), the installation of the CRDs can be skipped by specifying `--skip-crds` for the helm install command.
+
+### Upgrade the CRDs
+
+{{< note >}} Please make sure to read the steps outlined in [Upgrade to V4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4.md#update-custom-resource-apiversion" >}}) before running the CRD upgrade and perform the steps if applicable.
+{{< /note >}}
+
+To upgrade the CRDs, pull the chart sources as described in [Pull the Chart](#pull-the-chart) and then run:
+
+```shell
+kubectl apply -f crds/
+```
+
+Alternatively, CRDs can be upgraded without pulling the chart by running:
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds.yaml
+```
+
+In the above command, `v{{< nic-version >}}` represents the version of NGINX Ingress Controller release rather than the Helm chart version.
+
+{{< note >}} The following warning is expected and can be ignored: `Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply`.
+
+Check the [release notes](https://www.github.com/nginx/kubernetes-ingress/releases) for a new release for any special upgrade procedures.
+{{< /note >}}
+
+### Uninstall the CRDs
+
+To remove the CRDs, pull the chart sources as described in [Pull the Chart](#pull-the-chart) and then run:
+
+```shell
+kubectl delete -f crds/
+```
+
+{{< warning >}} This command will delete all the corresponding custom resources in your cluster across all namespaces. Please ensure there are no custom resources that you want to keep and there are no other NGINX Ingress Controller instances running in the cluster. {{< /warning >}}
+
+## Manage the chart with OCI Registry
+
+### Install the chart
+
+Run the following commands to install the chart with the release name my-release (my-release is the name that you choose):
+
+- For NGINX:
+
+    ```shell
+    helm install my-release oci://ghcr.io/nginx/charts/nginx-ingress --version {{< nic-helm-version >}}
+    ```
+
+- For NGINX Plus: (This assumes you have pushed NGINX Ingress Controller image `nginx-plus-ingress` to your private registry `myregistry.example.com`)
+
+    ```shell
+    helm install my-release oci://ghcr.io/nginx/charts/nginx-ingress --version {{< nic-helm-version >}} --set controller.image.repository=myregistry.example.com/nginx-plus-ingress --set controller.nginxplus=true
+    ```
+
+These commands install the latest `edge` version of NGINX Ingress Controller from GitHub Container Registry. If you prefer using Docker Hub, you can replace `ghcr.io/nginx/charts/nginx-ingress` with `registry-1.docker.io/nginxcharts/nginx-ingress`.
+
+### Upgrade the chart
+
+Helm does not upgrade the CRDs during a release upgrade. Before you upgrade a release, see [Upgrade the CRDs](#upgrade-the-crds).
+
+To upgrade the release `my-release`:
+
+```shell
+helm upgrade my-release oci://ghcr.io/nginx/charts/nginx-ingress --version {{< nic-helm-version >}}
+```
+
+### Uninstall the chart
+
+To uninstall/delete the release `my-release`:
+
+```shell
+helm uninstall my-release
+```
+
+The command removes all the Kubernetes components associated with the release and deletes the release.
+
+Uninstalling the release does not remove the CRDs. To remove the CRDs, see [Uninstall the CRDs](#uninstall-the-crds).
+
+### Edge version
+
+To test the latest changes in NGINX Ingress Controller before a new release, you can install the `edge` version. This version is built from the `main` branch of the NGINX Ingress Controller repository.
+You can install the `edge` version by specifying the `--version` flag with the value `0.0.0-edge`:
+
+```shell
+helm install my-release oci://ghcr.io/nginx/charts/nginx-ingress --version 0.0.0-edge
+```
+
+{{< warning >}} The `edge` version is not intended for production use. It is intended for testing and development purposes only. {{< /warning >}}
+
+## Manage the chart with Sources
+
+### Pull the chart
+
+This step is required if you're installing the chart using its sources. It also manages the custom resource definitions (CRDs) which NGINX Ingress Controller requires, and for upgrading or deleting the CRDs.
+
+1. Pull the chart sources:
+
+    ```shell
+    helm pull oci://ghcr.io/nginx/charts/nginx-ingress --untar --version {{< nic-helm-version >}}
+    ```
+
+2. Change your working directory to nginx-ingress:
+
+    ```shell
+    cd nginx-ingress
+    ```
+
+### Install the chart
+
+To install the chart with the release name my-release (my-release is the name that you choose):
+
+- For NGINX:
+
+    ```shell
+    helm install my-release .
+    ```
+
+- For NGINX Plus:
+
+    ```shell
+    helm install my-release -f values-plus.yaml .
+    ```
+
+The command deploys the Ingress Controller in your Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.
+
+### Upgrade the chart
+
+Helm does not upgrade the CRDs during a release upgrade. Before you upgrade a release, see [Upgrade the CRDs](#upgrade-the-crds).
+
+To upgrade the release `my-release`:
+
+```shell
+helm upgrade my-release .
+```
+
+### Uninstall the chart
+
+To uninstall/delete the release `my-release`:
+
+```shell
+helm uninstall my-release
+```
+
+The command removes all the Kubernetes components associated with the release and deletes the release.
+
+Uninstalling the release does not remove the CRDs. To remove the CRDs, see [Uninstall the CRDs](#uninstall-the-crds).
+
+## Upgrade without downtime
+
+### Background
+
+In NGINX Ingress Controller version 3.1.0, [changes were introduced](https://github.com/nginx/kubernetes-ingress/pull/3606) to Helm resource names, labels and annotations to fit with Helm best practices.
+When using Helm to upgrade from a version prior to 3.1.0, certain resources like Deployment, DaemonSet and Service will be recreated due to the aforementioned changes, which will result in downtime.
+
+Although the advisory is to update all resources in accordance with new naming convention, to avoid downtime follow the steps listed below.
+
+### Upgrade steps
+
+{{< note >}} The following steps apply to both 2.x and 3.0.x releases.  {{</ note >}}
+
+The steps you should follow depend on the Helm release name:
+
+{{<tabs name="upgrade-helm">}}
+
+{{%tab name="Helm release name is `nginx-ingress`"%}}
+
+1. Use `kubectl describe` on deployment/daemonset to get the `Selector` value:
+
+    ```shell
+    kubectl describe deployments -n <namespace>
+    ```
+
+   Copy the key=value under `Selector`, such as:
+
+    ```shell
+    Selector: app=nginx-ingress-nginx-ingress
+    ```
+
+2. Checkout the latest available tag using `git checkout v{{< nic-version >}}`
+
+3. Navigate to `/kubernetes-ingress/charts/nginx-ingress`
+
+4. Update the `selectorLabels: {}` field in the `values.yaml` file located at `/kubernetes-ingress/charts/nginx-ingress` with the copied `Selector` value.
+    ```shell
+    selectorLabels: {app: nginx-ingress-nginx-ingress}
+    ```
+
+5. Run `helm upgrade` with following arguments set:
+    ```shell
+    --set serviceNameOverride="nginx-ingress-nginx-ingress"
+    --set controller.name=""
+    --set fullnameOverride="nginx-ingress-nginx-ingress"
+    ```
+   It could look as follows:
+
+    ```shell
+    helm upgrade nginx-ingress oci://ghcr.io/nginx/charts/nginx-ingress --version 0.19.0 --set controller.kind=deployment/daemonset --set controller.nginxplus=false/true --set controller.image.pullPolicy=Always --set serviceNameOverride="nginx-ingress-nginx-ingress" --set controller.name="" --set fullnameOverride="nginx-ingress-nginx-ingress" -f values.yaml
+    ```
+
+6. Once the upgrade process has finished, use `kubectl describe` on the deployment to verify the change by reviewing its events:
+    ```shell
+        Type    Reason             Age    From                   Message
+    ----    ------             ----   ----                   -------
+    Normal  ScalingReplicaSet  9m11s  deployment-controller  Scaled up replica set nginx-ingress-nginx-ingress-<old_version> to 1
+    Normal  ScalingReplicaSet  101s   deployment-controller  Scaled up replica set nginx-ingress-nginx-ingress-<new_version> to 1
+    Normal  ScalingReplicaSet  98s    deployment-controller  Scaled down replica set nginx-ingress-nginx-ingress-<old_version> to 0 from 1
+    ```
+{{%/tab%}}
+
+{{%tab name="Helm release name is not `nginx-ingress`"%}}
+
+1. Use `kubectl describe` on deployment/daemonset to get the `Selector` value:
+
+    ```shell
+    kubectl describe deployment/daemonset -n <namespace>
+    ```
+
+   Copy the key=value under ```Selector```, such as:
+
+    ```shell
+    Selector: app=<helm_release_name>-nginx-ingress
+    ```
+
+2. Checkout the latest available tag using `git checkout v{{< nic-version >}}`
+
+3. Navigate to `/kubernetes-ingress/charts/nginx-ingress`
+
+4. Update the `selectorLabels: {}` field in the `values.yaml` file located at `/kubernetes-ingress/charts/nginx-ingress` with the copied `Selector` value.
+
+    ```shell
+    selectorLabels: {app: <helm_release_name>-nginx-ingress}
+    ```
+
+5. Run `helm upgrade` with following arguments set:
+
+    ```shell
+    --set serviceNameOverride="<helm_release_name>-nginx-ingress"
+    --set controller.name=""
+    ```
+
+   It could look as follows:
+
+    ```shell
+    helm upgrade test-release oci://ghcr.io/nginx/charts/nginx-ingress --version 0.19.0 --set controller.kind=deployment/daemonset --set controller.nginxplus=false/true --set controller.image.pullPolicy=Always --set serviceNameOverride="test-release-nginx-ingress" --set controller.name="" -f values.yaml
+    ```
+
+6. Once the upgrade process has finished, use `kubectl describe` on the deployment to verify the change by reviewing its events:
+
+    ```shell
+        Type    Reason             Age    From                   Message
+    ----    ------             ----   ----                   -------
+    Normal  ScalingReplicaSet  9m11s  deployment-controller  Scaled up replica set test-release-nginx-ingress-<old_version> to 1
+    Normal  ScalingReplicaSet  101s   deployment-controller  Scaled up replica set test-release-nginx-ingress-<new_version> to 1
+    Normal  ScalingReplicaSet  98s    deployment-controller  Scaled down replica set test-release-nginx-ingress-<old_version> to 0 from 1
+    ```
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+
+## Run multiple NGINX Ingress Controllers
+
+If you are running NGINX Ingress Controller releases in your cluster with custom resources enabled, the releases will share a single version of the CRDs.
+
+Ensure the NGINX Ingress Controller versions match the version of the CRDs. When uninstalling a release, ensure that you don’t remove the CRDs until there are no other NGINX Ingress Controller releases running in the cluster.
+
+The [Run multiple NGINX Ingress Controllers]({{< ref "/nic/installation/run-multiple-ingress-controllers.md" >}}) topic has more details.
+
+## Configuration
+
+The following tables lists the configurable parameters of the NGINX Ingress Controller chart and their default values.
+
+{{< table >}}
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+|Parameter | Description | Default |
+| --- | --- | --- |
+| **controller.name** | The name of the Ingress Controller daemonset or deployment. | Autogenerated |
+| **controller.kind** | The kind of the Ingress Controller installation - deployment or daemonset. | deployment |
+| **controller.annotations** | Allows for setting of `annotations` for deployment or daemonset. | {} |
+| **controller.nginxplus** | Deploys the Ingress Controller for NGINX Plus. | false |
+| **controller.mgmt.licenseTokenSecretName** | Configures the secret used in the [license_token](https://nginx.org/en/docs/ngx_mgmt_module.html#license_token) directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.com/license` with the base64 encoded JWT in the `license.jwt` key. | license-token |
+| **controller.mgmt.enforceInitialReport** | Configures the [enforce_initial_report](https://nginx.org/en/docs/ngx_mgmt_module.html#enforce_initial_report) directive, which enables or disables the 180-day grace period for sending the initial usage report. | false |
+| **controller.mgmt.usageReport.endpoint** | Configures the endpoint of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This is used to configure the endpoint NGINX uses to send usage reports to NIM. | product.connect.nginx.com |
+| **controller.mgmt.usageReport.interval** | Configures the interval of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This specifies the frequency that usage reports are sent. This field takes an [NGINX time](https://nginx.org/en/docs/syntax.html). | 1h |
+| **controller.mgmt.usageReport.proxyHost** | Configures the host name of the [proxy](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy) directive with optional port. | N/A |
+| **controller.mgmt.usageReport.proxyCredentialsSecretName** | Configures the [proxy_username](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy_username) directive as well as the [proxy_password](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy_password) directive using a Kubernetes Opaque Secret. The Secret must contain `username` and `password` fields. | N/A |
+| **controller.mgmt.sslVerify** | Configures the [ssl_verify](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_verify) directive, which enables or disables verification of the usage reporting endpoint certificate.  | true |
+| **controller.mgmt.resolver.ipv6** | Configures whether the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will look up IPv6 addresses.  | true |
+| **controller.mgmt.resolver.valid** | Configures an [NGINX time](https://nginx.org/en/docs/syntax.html) that the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will override the TTL value of responses from nameservers with.  | N/A |
+| **controller.mgmt.resolver.addresses** | Configures addresses used in the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive. This field takes a list of addresses. | N/A |
+| **controller.mgmt.sslCertificateSecretName** | Configures the secret used to create the `ssl_certificate` and `ssl_certificate_key` directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `kubernetes.io/tls` | N/A |
+| **controller.mgmt.sslTrustedCertificateSecretName** | Configures the secret used to create the file(s) referenced the in [ssl_trusted_certifcate](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_trusted_certificate), and [ssl_crl](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.org/ca`, where the `ca.crt` key contains a base64 encoded trusted cert, and the optional `ca.crl` key can contain a base64 encoded CRL. If the optional `ca.crl` key is supplied, it will configure the NGINX `ssl_crl` directive. | N/A |
+| **controller.mgmt.configMapName** | Allows changing the name of the MGMT config map. The name should not include a namespace| Autogenerated |
+| **controller.nginxReloadTimeout** | The timeout in milliseconds which the Ingress Controller will wait for a successful NGINX reload after a change or at the initial start. | 60000 |
+| **controller.hostNetwork** | Enables the Ingress Controller pods to use the host's network namespace. | false |
+| **controller.dnsPolicy** | DNS policy for the Ingress Controller pods. | ClusterFirst |
+| **controller.nginxDebug** | Enables debugging for NGINX. Uses the `nginx-debug` binary. Requires `error-log-level: debug` in the ConfigMap via `controller.config.entries`. | false |
+| **controller.logLevel** | The log level of the Ingress Controller. | info |
+| **controller.logFormat** | The log format of the Ingress Controller. | glog |
+| **controller.image.digest** | The image digest of the Ingress Controller. | None |
+| **controller.image.repository** | The image repository of the Ingress Controller. | nginx/nginx-ingress |
+| **controller.image.tag** | The tag of the Ingress Controller image. | {{< nic-version >}} |
+| **controller.image.pullPolicy** | The pull policy for the Ingress Controller image. | IfNotPresent |
+| **controller.lifecycle** | The lifecycle of the Ingress Controller pods. | {} |
+| **controller.customConfigMap** | The name of the custom ConfigMap used by the Ingress Controller. If set, then the default config is ignored. | "" |
+| **controller.config.name** | The name of the ConfigMap used by the Ingress Controller. | Autogenerated |
+| **controller.config.annotations** | The annotations of the Ingress Controller configmap. | {} |
+| **controller.config.entries** | The entries of the ConfigMap for customizing NGINX configuration. See [ConfigMap resource docs](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) for the list of supported ConfigMap keys. | {} |
+| **controller.customPorts** | A list of custom ports to expose on the NGINX Ingress Controller pod. Follows the conventional Kubernetes yaml syntax for container ports. | [] |
+| **controller.defaultTLS.cert** | The base64-encoded TLS certificate for the default HTTPS server. **Note:** It is recommended that you specify your own certificate. Alternatively, omitting the default server secret completely will configure NGINX to reject TLS connections to the default server. |
+| **controller.defaultTLS.key** | The base64-encoded TLS key for the default HTTPS server. **Note:** It is recommended that you specify your own key. Alternatively, omitting the default server secret completely will configure NGINX to reject TLS connections to the default server. |
+| **controller.defaultTLS.secret** | The secret with a TLS certificate and key for the default HTTPS server. The value must follow the following format: `<namespace>/<name>`. Used as an alternative to specifying a certificate and key using `controller.defaultTLS.cert` and `controller.defaultTLS.key` parameters. **Note:** Alternatively, omitting the default server secret completely will configure NGINX to reject TLS connections to the default server. | None |
+| **controller.wildcardTLS.cert** | The base64-encoded TLS certificate for every Ingress/VirtualServer host that has TLS enabled but no secret specified. If the parameter is not set, for such Ingress/VirtualServer hosts NGINX will break any attempt to establish a TLS connection. | None |
+| **controller.wildcardTLS.key** | The base64-encoded TLS key for every Ingress/VirtualServer host that has TLS enabled but no secret specified. If the parameter is not set, for such Ingress/VirtualServer hosts NGINX will break any attempt to establish a TLS connection. | None |
+| **controller.wildcardTLS.secret** | The secret with a TLS certificate and key for every Ingress/VirtualServer host that has TLS enabled but no secret specified. The value must follow the following format: `<namespace>/<name>`. Used as an alternative to specifying a certificate and key using `controller.wildcardTLS.cert` and `controller.wildcardTLS.key` parameters. | None |
+| **controller.nodeSelector** | The node selector for pod assignment for the Ingress Controller pods. | {} |
+| **controller.terminationGracePeriodSeconds** | The termination grace period of the Ingress Controller pod. | 30 |
+| **controller.tolerations** | The tolerations of the Ingress Controller pods. | [] |
+| **controller.affinity** | The affinity of the Ingress Controller pods. | {} |
+| **controller.topologySpreadConstraints** | The topology spread constraints of the Ingress controller pods. | {} |
+| **controller.env** | The additional environment variables to be set on the Ingress Controller pods. | [] |
+| **controller.volumes** | The volumes of the Ingress Controller pods. | [] |
+| **controller.volumeMounts** | The volumeMounts of the Ingress Controller pods. | [] |
+| **controller.initContainers** | InitContainers for the Ingress Controller pods. | [] |
+| **controller.extraContainers** | Extra (eg. sidecar) containers for the Ingress Controller pods. | [] |
+| **controller.podSecurityContext**| The SecurityContext for Ingress Controller pods. | "seccompProfile": {"type": "RuntimeDefault"} |
+| **controller.securityContext** | The SecurityContext for Ingress Controller container. | {} |
+| **controller.initContainerSecurityContext** | The SecurityContext for Ingress Controller init container when `readOnlyRootFilesystem` is enabled by either setting `controller.securityContext.readOnlyRootFilesystem` or `controller.readOnlyRootFilesystem`to `true`. | {} |
+| **controller.resources** | The resources of the Ingress Controller pods. | requests: cpu=100m,memory=128Mi |
+| **controller.initContainerResources** | The resources of the init container which is used when `readOnlyRootFilesystem` is enabled by either setting `controller.securityContext.readOnlyRootFilesystem` or `controller.readOnlyRootFilesystem`to `true`. | requests: cpu=100m,memory=128Mi |
+| **controller.replicaCount** | The number of replicas of the Ingress Controller deployment. | 1 |
+| **controller.ingressClass.name** | A class of the Ingress Controller. An IngressClass resource with the name equal to the class must be deployed. Otherwise, the Ingress Controller will fail to start. The Ingress Controller only processes resources that belong to its class - i.e. have the "ingressClassName" field resource equal to the class. The Ingress Controller processes all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the "ingressClassName" field for all versions of Kubernetes. | nginx |
+| **controller.ingressClass.create** | Creates a new IngressClass object with the name `controller.ingressClass.name`. Set to `false` to use an existing ingressClass created using `kubectl` with the same name. If you use `helm upgrade`, do not change the values from the previous release as helm will delete IngressClass objects managed by helm. If you are upgrading from a release earlier than {{< nic-version >}}, do not set the value to false. | true |
+| **controller.ingressClass.setAsDefaultIngress** | New Ingresses without an `"ingressClassName"` field specified will be assigned the class specified in `controller.ingressClass.name`. Requires `controller.ingressClass.create`.  | false |
+| **controller.watchNamespace** | Comma separated list of namespaces the Ingress Controller should watch for resources. By default the Ingress Controller watches all namespaces. Mutually exclusive with `controller.watchNamespaceLabel`. Please note that if configuring multiple namespaces using the Helm cli `--set` option, the string needs to wrapped in double quotes and the commas escaped using a backslash - e.g. `--set controller.watchNamespace="default\,nginx-ingress"`. | "" |
+| **controller.watchNamespaceLabel** | Configures the Ingress Controller to watch only those namespaces with label foo=bar. By default the Ingress Controller watches all namespaces. Mutually exclusive with `controller.watchNamespace`. | "" |
+| **controller.watchSecretNamespace** | Comma separated list of namespaces the Ingress Controller should watch for resources of type Secret. If this arg is not configured, the Ingress Controller watches the same namespaces for all resources, see `controller.watchNamespace` and `controller.watchNamespaceLabel`. All namespaces included with this argument must be part of either `controller.watchNamespace` or  `controller.watchNamespaceLabel`. Please note that if configuring multiple namespaces using the Helm cli `--set` option, the string needs to wrapped in double quotes and the commas escaped using a backslash - e.g. `--set controller.watchSecretNamespace="default\,nginx-ingress"`. | "" |
+| **controller.enableCustomResources** | Enable the custom resources. | true |
+| **controller.enableOIDC** | Enable OIDC policies. | false |
+| **controller.enableTLSPassthrough** | Enable TLS Passthrough on default port 443. Requires `controller.enableCustomResources`. | false |
+| **controller.tlsPassThroughPort** | Set the port for the TLS Passthrough. Requires `controller.enableCustomResources` and `controller.enableTLSPassthrough`.  | 443 |
+| **controller.enableCertManager** | Enable x509 automated certificate management for VirtualServer resources using cert-manager (cert-manager.io). Requires `controller.enableCustomResources`. | false |
+| **controller.enableExternalDNS** | Enable integration with ExternalDNS for configuring public DNS entries for VirtualServer resources using [ExternalDNS](https://github.com/kubernetes-sigs/external-dns). Requires `controller.enableCustomResources`. | false |
+| **controller.globalConfiguration.create** | Creates the GlobalConfiguration custom resource. Requires `controller.enableCustomResources`. | false |
+| **controller.globalConfiguration.spec** | The spec of the GlobalConfiguration for defining the global configuration parameters of the Ingress Controller. | {} |
+| **controller.enableSnippets** | Enable custom NGINX configuration snippets in Ingress, VirtualServer, VirtualServerRoute and TransportServer resources. | false |
+| **controller.healthStatus** | Add a location "/nginx-health" to the default server. The location responds with the 200 status code for any request. Useful for external health-checking of the Ingress Controller. | false |
+| **controller.healthStatusURI** | Sets the URI of health status location in the default server. Requires `controller.healthStatus`. | "/nginx-health" |
+| **controller.nginxStatus.enable** | Enable the NGINX stub_status, or the NGINX Plus API. | true |
+| **controller.nginxStatus.port** | Set the port where the NGINX stub_status or the NGINX Plus API is exposed. | 8080 |
+| **controller.nginxStatus.allowCidrs** | Add IP/CIDR blocks to the allow list for NGINX stub_status or the NGINX Plus API. Separate multiple IP/CIDR by commas. | 127.0.0.1,::1 |
+| **controller.priorityClassName** | The PriorityClass of the Ingress Controller pods. | None |
+| **controller.service.create** | Creates a service to expose the Ingress Controller pods. | true |
+| **controller.service.type** | The type of service to create for the Ingress Controller. | LoadBalancer |
+| **controller.service.externalTrafficPolicy** | The externalTrafficPolicy of the service. The value Local preserves the client source IP. | Local |
+| **controller.service.annotations** | The annotations of the Ingress Controller service. | {} |
+| **controller.service.extraLabels** | The extra labels of the service. | {} |
+| **controller.service.loadBalancerIP** | The static IP address for the load balancer. Requires `controller.service.type` set to `LoadBalancer`. The cloud provider must support this feature. | "" |
+| **controller.service.externalIPs** | The list of external IPs for the Ingress Controller service. | [] |
+| **controller.service.clusterIP** | The clusterIP for the Ingress Controller service, autoassigned if not specified. | "" |
+| **controller.service.loadBalancerSourceRanges** | The IP ranges (CIDR) that are allowed to access the load balancer. Requires `controller.service.type` set to `LoadBalancer`. The cloud provider must support this feature. | [] |
+| **controller.service.name** | The name of the service. | Autogenerated |
+| **controller.service.customPorts** | A list of custom ports to expose through the Ingress Controller service. Follows the conventional Kubernetes yaml syntax for service ports. | [] |
+| **controller.service.httpPort.enable** | Enables the HTTP port for the Ingress Controller service. | true |
+| **controller.service.httpPort.port** | The HTTP port of the Ingress Controller service. | 80 |
+| **controller.service.httpPort.nodePort** | The custom NodePort for the HTTP port. Requires `controller.service.type` set to `NodePort`. | "" |
+| **controller.service.httpPort.targetPort** | The target port of the HTTP port of the Ingress Controller service. | 80 |
+| **controller.service.httpsPort.enable** | Enables the HTTPS port for the Ingress Controller service. | true |
+| **controller.service.httpsPort.port** | The HTTPS port of the Ingress Controller service. | 443 |
+| **controller.service.httpsPort.nodePort** | The custom NodePort for the HTTPS port. Requires `controller.service.type` set to `NodePort`. | "" |
+| **controller.service.httpsPort.targetPort** | The target port of the HTTPS port of the Ingress Controller service. | 443 |
+| **controller.serviceAccount.annotations** | The annotations of the Ingress Controller service account. | {} |
+| **controller.serviceAccount.name** | The name of the service account of the Ingress Controller pods. Used for RBAC. | Autogenerated |
+| **controller.serviceAccount.imagePullSecretName** | The name of the secret containing docker registry credentials. Secret must exist in the same namespace as the helm release. | "" |
+| **controller.serviceAccount.imagePullSecretsNames** | The list of secret names containing docker registry credentials. Secret must exist in the same namespace as the helm release. | [] |
+| **controller.reportIngressStatus.enable** | Updates the address field in the status of Ingress resources with an external address of the Ingress Controller. You must also specify the source of the external address either through an external service via `controller.reportIngressStatus.externalService`, `controller.reportIngressStatus.ingressLink` or the `external-status-address` entry in the ConfigMap via `controller.config.entries`. **Note:** `controller.config.entries.external-status-address` takes precedence over the others. | true |
+| **controller.reportIngressStatus.externalService** | Specifies the name of the service with the type LoadBalancer through which the Ingress Controller is exposed externally. The external address of the service is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources. `controller.reportIngressStatus.enable` must be set to `true`. The default is autogenerated and enabled when `controller.service.create` is set to `true` and `controller.service.type` is set to `LoadBalancer`. | Autogenerated |
+| **controller.reportIngressStatus.ingressLink** | Specifies the name of the IngressLink resource, which exposes the Ingress Controller pods via a BIG-IP system. The IP of the BIG-IP system is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources. `controller.reportIngressStatus.enable` must be set to `true`. | "" |
+| **controller.reportIngressStatus.enableLeaderElection** | Enable Leader election to avoid multiple replicas of the controller reporting the status of Ingress resources. `controller.reportIngressStatus.enable` must be set to `true`. | true |
+| **controller.reportIngressStatus.leaderElectionLockName** | Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election. controller.reportIngressStatus.enableLeaderElection must be set to true. | Autogenerated |
+| **controller.reportIngressStatus.annotations** | The annotations of the leader election configmap. | {} |
+| **controller.pod.annotations** | The annotations of the Ingress Controller pod. | {} |
+| **controller.pod.extraLabels** | The additional extra labels of the Ingress Controller pod. | {} |
+| **controller.appprotect.enable** | Enables the App Protect WAF module in the Ingress Controller. | false |
+| **controller.appprotect.v5** | Enables App Protect WAF v5. | false |
+| **controller.appprotect.volumes** | Volumes for App Protect WAF v5. | [{"name": "app-protect-bd-config", "emptyDir": {}},{"name": "app-protect-config", "emptyDir": {}},{"name": "app-protect-bundles", "emptyDir": {}}] |
+| **controller.appprotect.enforcer.host** | Host that the App Protect WAF v5 Enforcer runs on. | "127.0.0.1" |
+| **controller.appprotect.enforcer.port** | Port that the App Protect WAF v5 Enforcer runs on. | 50000 |
+| **controller.appprotect.enforcer.image.repository** | The image repository of the App Protect WAF v5 Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
+| **controller.appprotect.enforcer.image.tag** | The tag of the App Protect WAF v5 Enforcer. | "5.6.0" |
+| **controller.appprotect.enforcer.image.digest** | The digest of the App Protect WAF v5 Enforcer. Takes precedence over tag if set. | "" |
+| **controller.appprotect.enforcer.image.pullPolicy** | The pull policy for the App Protect WAF v5 Enforcer image. | IfNotPresent |
+| **controller.appprotect.enforcer.securityContext** | The security context for App Protect WAF v5 Enforcer container. | {} |
+| **controller.appprotect.configManager.image.repository** | The image repository of the App Protect WAF v5 Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
+| **controller.appprotect.configManager.image.tag** | The tag of the App Protect WAF v5 Configuration Manager. | "5.6.0" |
+| **controller.appprotect.configManager.image.digest** | The digest of the App Protect WAF v5 Configuration Manager. Takes precedence over tag if set. | "" |
+| **controller.appprotect.configManager.image.pullPolicy** | The pull policy for the App Protect WAF v5 Configuration Manager image. | IfNotPresent |
+| **controller.appprotect.configManager.securityContext** | The security context for App Protect WAF v5 Configuration Manager container. | {"allowPrivilegeEscalation":false,"runAsUser":101,"runAsNonRoot":true,"capabilities":{"drop":["all"]}} |
+| **controller.appprotectdos.enable** | Enables the App Protect DoS module in the Ingress Controller. | false |
+| **controller.appprotectdos.enable** | Enables the App Protect DoS module in the Ingress Controller. | false |
+| **controller.appprotectdos.debug** | Enable debugging for App Protect DoS. | false |
+| **controller.appprotectdos.maxDaemons** | Max number of ADMD instances. | 1 |
+| **controller.appprotectdos.maxWorkers** | Max number of nginx processes to support. | Number of CPU cores in the machine |
+| **controller.appprotectdos.memory** | RAM memory size to consume in MB. | 50% of free RAM in the container or 80MB, the smaller |
+| **controller.readyStatus.enable** | Enables the readiness endpoint `"/nginx-ready"`. The endpoint returns a success code when NGINX has loaded all the config after the startup. This also configures a readiness probe for the Ingress Controller pods that uses the readiness endpoint. | true |
+| **controller.readyStatus.port** | The HTTP port for the readiness endpoint. | 8081 |
+| **controller.readyStatus.initialDelaySeconds** | The number of seconds after the Ingress Controller pod has started before readiness probes are initiated. | 0 |
+| **controller.enableLatencyMetrics** | Enable collection of latency metrics for upstreams. Requires `prometheus.create`. | false |
+| **controller.minReadySeconds** | Specifies the minimum number of seconds for which a newly created Pod should be ready without any of its containers crashing, for it to be considered available. [docs](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#min-ready-seconds) | 0 |
+| **controller.autoscaling.enabled** | Enables HorizontalPodAutoscaling. | false |
+| **controller.autoscaling.annotations** | The annotations of the Ingress Controller HorizontalPodAutoscaler. | {} |
+| **controller.autoscaling.behavior** | Behavior configuration for the HPA. | {} |
+| **controller.autoscaling.minReplicas** | Minimum number of replicas for the HPA. | 1 |
+| **controller.autoscaling.maxReplicas** | Maximum number of replicas for the HPA. | 3 |
+| **controller.autoscaling.targetCPUUtilizationPercentage** | The target CPU utilization percentage. | 50 |
+| **controller.autoscaling.targetMemoryUtilizationPercentage** | The target memory utilization percentage. | 50 |
+| **controller.podDisruptionBudget.enabled** | Enables PodDisruptionBudget. | false |
+| **controller.podDisruptionBudget.annotations** | The annotations of the Ingress Controller pod disruption budget | {} |
+| **controller.podDisruptionBudget.minAvailable** | The number of Ingress Controller pods that should be available. This is a mutually exclusive setting with "maxUnavailable". | 0 |
+| **controller.podDisruptionBudget.maxUnavailable** | The number of Ingress Controller pods that can be unavailable. This is a mutually exclusive setting with "minAvailable". | 0 |
+| **controller.strategy** | Specifies the strategy used to replace old Pods with new ones. Docs for [Deployment update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) and [Daemonset update strategy](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#daemonset-update-strategy) | {} |
+| **controller.disableIPV6** | Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack. | false |
+| **controller.defaultHTTPListenerPort**  | Sets the port for the HTTP `default_server` listener. | 80 |
+| **controller.defaultHTTPSListenerPort**  | Sets the port for the HTTPS `default_server` listener. | 443 |
+| **controller.readOnlyRootFilesystem** | Configure root filesystem as read-only and add volumes for temporary data. Three major releases after 3.5.x this argument will be moved permanently to the `controller.securityContext` section.  | false |
+| **controller.enableSSLDynamicReload** | Enable lazy loading for SSL Certificates. | true |
+| **controller.telemetryReporting.enable** | Enable telemetry reporting. | true |
+| **controller.enableWeightChangesDynamicReload** | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) if there are many two-way splits. Requires `controller.nginxplus` | false |
+| **rbac.create** | Configures RBAC. | true |
+| **rbac.clusterrole.create** | Configures creation of ClusterRole. Creation can be disabled when more fine-grained control over RBAC is required. For example when controller.watchNamespace is used. | true |
+| **prometheus.create** | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
+| **prometheus.port** | Configures the port to scrape the metrics. | 9113 |
+| **prometheus.scheme** | Configures the HTTP scheme to use for connections to the Prometheus endpoint. | http |
+| **prometheus.secret** | The namespace / name of a Kubernetes TLS Secret. If specified, this secret is used to secure the Prometheus endpoint with TLS connections. | "" |
+| **prometheus.service.create** | Create a Headless service to expose prometheus metrics. Requires `prometheus.create`. | false |
+| **prometheus.service.labels** | Kubernetes object labels to attach to the service object. | {service: "nginx-ingress-prometheus-service"} |
+| **prometheus.serviceMonitor.create** | Create a ServiceMonitor custom resource. Requires ServiceMonitor CRD to be installed. For the latest CRD, check the latest release on the [prometheus-operator](https://github.com/prometheus-operator/prometheus-operator) GitHub repo under `example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml` | false |
+| **prometheus.serviceMonitor.labels** | Kubernetes object labels to attach to the serviceMonitor object. | {} |
+| **prometheus.serviceMonitor.selectorMatchLabels** | A set of labels to allow the selection of endpoints for the ServiceMonitor. | {service: "nginx-ingress-prometheus-service"} |
+| **prometheus.serviceMonitor.endpoints** | A list of endpoints allowed as part of this ServiceMonitor. | [port: prometheus] |
+| **serviceInsight.create** | Expose NGINX Plus Service Insight endpoint. | false |
+| **serviceInsight.port** | Configures the port to expose endpoints. | 9114 |
+| **serviceInsight.scheme** | Configures the HTTP scheme to use for connections to the Service Insight endpoint. | http |
+| **serviceInsight.secret** | The namespace / name of a Kubernetes TLS Secret. If specified, this secret is used to secure the Service Insight endpoint with TLS connections. | "" |
+| **serviceNameOverride** | Used to prevent cloud load balancers from being replaced due to service name change during helm upgrades. | "" |
+| **nginxServiceMesh.enable** | Enable integration with NGINX Service Mesh. See the NGINX Service Mesh [docs](https://docs.nginx.com/nginx-service-mesh/tutorials/kic/deploy-with-kic/) for more details. Requires `controller.nginxplus`. | false |
+| **nginxServiceMesh.enableEgress** | Enable NGINX Service Mesh workloads to route egress traffic through the Ingress Controller. See the NGINX Service Mesh [docs](https://docs.nginx.com/nginx-service-mesh/tutorials/kic/deploy-with-kic/#enabling-egress) for more details. Requires `nginxServiceMesh.enable`. | false |
+|**nginxAgent.enable** | Enable NGINX Agent to integrate the Security Monitoring and App Protect WAF modules. Requires `controller.appprotect.enable`. | false |
+|**nginxAgent.instanceGroup** | Set a custom Instance Group name for the deployment, shown when connected to NGINX Instance Manager. `nginx-ingress.controller.fullname` will be used if not set. | "" |
+|**nginxAgent.logLevel** | Log level for NGINX Agent. | "error |
+|**nginxAgent.instanceManager.host** | FQDN or IP for connecting to NGINX Ingress Controller. Required when `nginxAgent.enable` is set to `true` | "" |
+|**nginxAgent.instanceManager.grpcPort** | Port for connecting to NGINX Ingress Controller. | 443 |
+|**nginxAgent.instanceManager.sni** | Server Name Indication for Instance Manager. See the NGINX Agent [docs](https://docs.nginx.com/nginx-agent/configuration/encrypt-communication/) for more details. | "" |
+|**nginxAgent.instanceManager.tls.enable** | Enable TLS for Instance Manager connection. | true |
+|**nginxAgent.instanceManager.tls.skipVerify** | Skip certification verification for Instance Manager connection. | false |
+|**nginxAgent.instanceManager.tls.caSecret** | Name of `nginx.org/ca` secret used for verification of Instance Manager TLS. | "" |
+|**nginxAgent.instanceManager.tls.secret** | Name of `kubernetes.io/tls` secret with a TLS certificate and key for using mTLS between NGINX Agent and Instance Manager. See the NGINX Instance Manager [docs](https://docs.nginx.com/nginx-instance-manager/system-configuration/secure-traffic/#mutual-client-certificate-authentication-setup-mtls) and the NGINX Agent [docs](https://docs.nginx.com/nginx-agent/configuration/encrypt-communication/) for more details. | "" |
+|**nginxAgent.syslog.host** | Address for NGINX Agent to run syslog listener. | 127.0.0.1 |
+|**nginxAgent.syslog.port** | Port for NGINX Agent to run syslog listener. | 1514 |
+|**nginxAgent.napMonitoring.collectorBufferSize** | Buffer size for collector. Will contain log lines and parsed log lines. | 50000 |
+|**nginxAgent.napMonitoring.processorBufferSize** | Buffer size for processor. Will contain log lines and parsed log lines. | 50000 |
+|**nginxAgent.customConfigMap** | The name of a custom ConfigMap to use instead of the one provided by default. | "" |
+{{</bootstrap-table>}}
+{{< /table >}}
diff --git a/content/nic/installation/installing-nic/installation-with-manifests.md b/content/nic/installation/installing-nic/installation-with-manifests.md
new file mode 100644
index 000000000..61f457808
--- /dev/null
+++ b/content/nic/installation/installing-nic/installation-with-manifests.md
@@ -0,0 +1,300 @@
+---
+title: Installation with Manifests
+toc: true
+weight: 200
+type: how-to
+product: NIC
+docs: DOCS-603
+---
+
+This guide explains how to use Manifests to install F5 NGINX Ingress Controller, then create both common and custom resources and set up role-based access control.
+
+## Before you start
+
+If you are using NGINX Plus, get the NGINX Ingress Controller JWT and [create a license secret]({{< ref "/nic/installation/create-license-secret.md" >}}).
+
+### Get the NGINX Controller Image
+
+{{< note >}} Always use the latest stable release listed on the [releases page]({{< ref "/nic/releases.md" >}}). {{< /note >}}
+
+Choose one of the following methods to get the NGINX Ingress Controller image:
+
+- **NGINX Ingress Controller**: Download the image `nginx/nginx-ingress` from [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress).
+- **NGINX Plus Ingress Controller**: You have two options for this, both requiring an NGINX Ingress Controller subscription.
+  - Download the image using your NGINX Ingress Controller subscription certificate and key. View the [Get NGINX Ingress Controller from the F5 Registry]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic.
+  - The [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic describes how to use your subscription JWT token to get the image.
+- **Build your own image**: To build your own image, follow the [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}) topic.
+
+### Clone the repository
+
+Clone the NGINX Ingress Controller repository using the command shown below, and replace `<version_number>` with the specific release you want to use.
+
+```shell
+git clone https://github.com/nginx/kubernetes-ingress.git --branch <version_number>
+```
+
+For example, if you want to use version {{< nic-version >}}, the command would be:
+
+```shell
+git clone https://github.com/nginx/kubernetes-ingress.git --branch v{{< nic-version >}}
+```
+
+This guide assumes you are using the latest release.
+
+Change the active directory.
+
+```shell
+cd kubernetes-ingress
+```
+
+### App Protect DoS
+
+To use App Protect DoS, install the App Protect DoS Arbitrator using the provided manifests in the same namespace as the NGINX Ingress Controller. If you install multiple NGINX Ingress Controllers in the same namespace, they will need to share the same Arbitrator because there can only be one Arbitrator in a single namespace.
+
+---
+
+## Set up role-based access control (RBAC) {#configure-rbac}
+
+{{< include "/nic/rbac/set-up-rbac.md" >}}
+
+---
+
+## Create common resources {#create-common-resources}
+
+{{< include "/nic/installation/create-common-resources.md" >}}
+
+---
+
+## Create core custom resources {#create-custom-resources}
+
+{{< include "/nic/installation/create-custom-resources.md" >}}
+
+### Create optional custom resources
+
+There are optional CRDs that are necessary if you want to use NGINX App Protect WAF or NGINX App Protect DoS.
+
+**NGINX App Protect WAF**:
+- `APPolicy`
+- `APLogConf`
+- `APUserSig`
+
+**NGINX App Protect DoS**:
+- `APDosPolicy`
+- `APDosLogConf`
+- `DosProtectedResource`
+
+{{<tabs name="install-nap-crds">}}
+
+{{%tab name="Install CRDs from single YAML"%}}
+
+
+**NGINX App Protect WAF**
+
+{{<  note >}} This step can be skipped if you are using App Protect WAF module with policy bundles. {{<  /note >}}
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds-nap-waf.yaml
+```
+
+**NGINX App Protect DoS**:
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds-nap-dos.yaml
+```
+
+{{%/tab%}}
+
+{{%tab name="Install CRDs after cloning the repo"%}}
+
+**NGINX App Protect WAF**
+
+{{<  note >}} This step can be skipped if you are using App Protect WAF module with policy bundles. {{<  /note >}}
+
+```shell
+kubectl apply -f config/crd/bases/appprotect.f5.com_aplogconfs.yaml
+kubectl apply -f config/crd/bases/appprotect.f5.com_appolicies.yaml
+kubectl apply -f config/crd/bases/appprotect.f5.com_apusersigs.yaml
+```
+
+**NGINX App Protect DoS**:
+
+```shell
+kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdoslogconfs.yaml
+kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdospolicy.yaml
+kubectl apply -f config/crd/bases/appprotectdos.f5.com_dosprotectedresources.yaml
+```
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+---
+
+## Deploy NGINX Ingress Controller {#deploy-ingress-controller}
+
+You have two options for deploying NGINX Ingress Controller:
+
+- **Deployment**. Choose this method for the flexibility to dynamically change the number of NGINX Ingress Controller replicas.
+- **DaemonSet**. Choose this method if you want NGINX Ingress Controller to run on all nodes or a subset of nodes.
+
+Before you start, update the [command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) for the NGINX Ingress Controller container in the relevant manifest file to meet your specific requirements.
+
+### Using a Deployment
+
+{{< include "/nic/installation/manifests/deployment.md" >}}
+
+### Using a DaemonSet
+
+{{< include "/nic/installation/manifests/daemonset.md" >}}
+
+---
+
+## Confirm NGINX Ingress Controller is running
+
+{{< include "/nic/installation/manifests/verify-pods-are-running.md" >}}
+
+---
+
+## How to access NGINX Ingress Controller
+
+### Using a Deployment
+
+For Deployments, you have two options for accessing NGINX Ingress Controller pods.
+
+#### Option 1: Create a NodePort service
+
+For more information about the  _NodePort_ service, refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport).
+
+1. To create a service of type *NodePort*, run:
+
+    ```shell
+    kubectl create -f deployments/service/nodeport.yaml
+    ```
+
+    Kubernetes automatically allocates two ports on every node in the cluster. You can access NGINX Ingress Controller by combining any node's IP address with these ports.
+
+#### Option 2: Create a LoadBalancer service
+
+For more information about the _LoadBalancer_ service, refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer).
+
+1. To set up a _LoadBalancer_ service, run one of the following commands based on your cloud provider:
+
+    - GCP or Azure:
+
+        ```shell
+        kubectl apply -f deployments/service/loadbalancer.yaml
+        ```
+
+    - AWS:
+
+        ```shell
+        kubectl apply -f deployments/service/loadbalancer-aws-elb.yaml
+        ```
+
+        For more details see service guide [here](https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/#annotations)
+
+2. AWS users: Follow these additional steps to work with ELB in TCP mode.
+
+     - Add the following keys to the `nginx-config.yaml` ConfigMap file, which you created in the [Create common resources](#create-common-resources) section.
+
+         ```yaml
+         proxy-protocol: "True"
+         real-ip-header: "proxy_protocol"
+         set-real-ip-from: "0.0.0.0/0"
+         ```
+
+     - Update the ConfigMap:
+
+         ```shell
+         kubectl apply -f deployments/common/nginx-config.yaml
+         ```
+
+    {{<note>}}AWS users have more customization options for their load balancers. These include choosing the load balancer type and configuring SSL termination. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer) to learn more. {{</note>}}
+
+3. To access NGINX Ingress Controller, get the public IP of your load balancer.
+
+    - For GCP or Azure, run:
+
+        ```shell
+        kubectl get svc nginx-ingress --namespace=nginx-ingress
+        ```
+
+    - For AWS find the DNS name:
+
+        ```shell
+        kubectl describe svc nginx-ingress --namespace=nginx-ingress
+        ```
+
+        Resolve the DNS name into an IP address using `nslookup`:
+
+        ```shell
+        nslookup <dns-name>
+        ```
+
+    You can also find more details about the public IP in the status section of an ingress resource. For more details, refer to the [Reporting Resources Status doc]({{< ref "/nic/configuration/global-configuration/reporting-resources-status.md" >}}).
+
+### Using a DaemonSet
+
+Connect to ports 80 and 443 using the IP address of any node in the cluster where NGINX Ingress Controller is running.
+
+---
+
+## Uninstall NGINX Ingress Controller
+
+{{<warning>}}Proceed with caution when performing these steps, as they will remove NGINX Ingress Controller and all related resources, potentially affecting your running services.{{</warning>}}
+
+1. **Delete the nginx-ingress namespace**: To remove NGINX Ingress Controller and all auxiliary resources, run:
+
+    ```shell
+    kubectl delete namespace nginx-ingress
+    ```
+
+1. **Remove the cluster role and cluster role binding**:
+
+    ```shell
+    kubectl delete clusterrole nginx-ingress
+    kubectl delete clusterrolebinding nginx-ingress
+    ```
+
+1. **Delete the Custom Resource Definitions**:
+
+{{<tabs name="delete-crds">}}
+
+{{%tab name="Deleting CRDs from single YAML"%}}
+
+   1. Delete core custom resource definitions:
+    ```shell
+    kubectl delete -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds.yaml
+    ```
+   2. Delete custom resource definitions for the NGINX App Protect WAF module:
+
+   ```shell
+    kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds-nap-waf.yaml
+    ```
+
+   3. Delete custom resource definitions for the NGINX App Protect DoS module:
+   ```shell
+    kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds-nap-dos.yaml
+    ```
+   {{%/tab%}}
+
+{{%tab name="Deleting CRDs after cloning the repo"%}}
+
+1. Delete core custom resource definitions:
+```shell
+kubectl delete -f config/crd/bases/crds.yaml
+```
+2. Delete custom resource definitions for the NGINX App Protect WAF module:
+
+```shell
+kubectl apply -f config/crd/bases/crds-nap-waf.yaml
+```
+
+3. Delete custom resource definitions for the NGINX App Protect DoS module:
+```shell
+kubectl apply -f config/crd/bases/crds-nap-dos.yaml
+```
+
+{{%/tab%}}
+
+{{</tabs>}}
diff --git a/content/nic/installation/installing-nic/installation-with-operator.md b/content/nic/installation/installing-nic/installation-with-operator.md
new file mode 100644
index 000000000..b3e94f990
--- /dev/null
+++ b/content/nic/installation/installing-nic/installation-with-operator.md
@@ -0,0 +1,72 @@
+---
+title: Installation with NGINX Ingress Operator
+toc: true
+weight: 300
+type: how-to
+product: NIC
+docs: DOCS-604
+---
+
+This document explains how to install F5 NGINX Ingress Controller using NGINX Ingress Operator.
+
+## Before you start
+
+If you're using NGINX Plus, get the NGINX Ingress Controller JWT and [create a license secret]({{< ref "/nic/installation/create-license-secret.md" >}}).
+
+{{< note >}} We recommend the most recent stable version of NGINX Ingress Controller, available on the GitHub repository's [releases page]({{< ref "/nic/releases.md" >}}). {{< /note >}}
+
+1. Make sure you have access to the NGINX Ingress Controller image:
+    - For NGINX Ingress Controller, use the image `nginx/nginx-ingress` from [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress).
+    - For NGINX Plus Ingress Controller, view the [Get the F5 Registry NGINX Ingress Controller image]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic for details on how to pull the image from the F5 Docker registry.
+    - The [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic describes how to use your subscription JWT token to get the image.
+    - The [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}) topic explains how to push an image to a private Docker registry.
+1. Install the NGINX Ingress Operator following the [instructions](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/docs/installation.md).
+1. Create the SecurityContextConstraint as outlined in the ["Getting Started" instructions](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/README.md#getting-started).
+
+{{< note >}} If you're upgrading your operator installation to a later release, navigate [here](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/helm-charts/nginx-ingress) and run `kubectl apply -f crds/` or `oc apply -f crds/` as a prerequisite {{< /note >}}
+
+## Create the NGINX Ingress Controller manifest
+
+Create a manifest `nginx-ingress-controller.yaml` with the following content:
+
+```yaml
+apiVersion: charts.nginx.org/v1alpha1
+kind: NginxIngress
+metadata:
+  name: nginxingress-sample
+  namespace: nginx-ingress
+spec:
+  controller:
+    image:
+      pullPolicy: IfNotPresent
+      repository: nginx/nginx-ingress
+      tag: {{< nic-version >}}-ubi
+    ingressClass:
+      name: nginx
+    kind: deployment
+    nginxplus: false
+    replicaCount: 1
+    serviceAccount:
+      imagePullSecretName: ""
+```
+
+{{< note >}} For NGINX Plus, change the `image.repository` and `image.tag` values and change `nginxPlus` to `True`. If required, set the `serviceAccount.imagePullSecretName` or `serviceAccount.imagePullSecretsNames` to the name of the pre-created docker config secret that should be associated with the ServiceAccount. {{< /note >}}
+
+## Deploy NGINX Ingress Controller
+
+```shell
+kubectl apply -f nginx-ingress-controller.yaml
+```
+
+A new instance of NGINX Ingress Controller will be deployed by the NGINX Ingress Operator in the `default` namespace with default parameters.
+
+To configure other parameters of the NginxIngressController resource, check the [documentation](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/docs/nginx-ingress-controller.md).
+
+## Troubleshooting
+
+If you experience an `OOMkilled` error when deploying the NGINX Ingress Operator in a large cluster, it's likely because the Helm operator is caching all Kubernetes objects and using up too much memory. If you encounter this issue, try the following solutions:
+
+- Set the operator to only watch one namespace.
+- If monitoring multiple namespaces is required, consider manually increasing the memory limit for the operator. Keep in mind that this value might be overwritten after a release update.
+
+We are working with the OpenShift team to resolve this issue.
diff --git a/content/nic/installation/installing-nic/upgrade-to-v4.md b/content/nic/installation/installing-nic/upgrade-to-v4.md
new file mode 100644
index 000000000..23382a540
--- /dev/null
+++ b/content/nic/installation/installing-nic/upgrade-to-v4.md
@@ -0,0 +1,129 @@
+---
+title: Upgrade to NGINX Ingress Controller 4.0.0
+toc: true
+weight: 400
+type: how-to
+product: NIC
+docs: DOCS-000
+---
+
+This document explains how to upgrade F5 NGINX Ingress Controller to 4.0.0.
+
+There are two necessary steps required: updating the `apiVersion` value of custom resources and configuring structured logging.
+
+For NGINX Plus users, there is a third step to create a Secret for your license.
+
+---
+
+## Update custom resource apiVersion
+
+If the Helm chart you have been using is `v2.x`, before upgrading to NGINX Ingress Controller 4.0.0 you must update your GlobalConfiguration, Policy and TransportServer resources from `apiVersion: k8s.nginx.org/v1alpha1` to `apiVersion: k8s.nginx.org/v1`.
+
+If the Helm chart you have been using is `v1.0.2` or earlier (NGINX Ingress Controller `v3.3.2`), upgrade to Helm chart `v1.4.2` (NGINX Ingress Controller `v3.7.2`) before updating your GlobalConfiguration, Policy and TransportServer resources.
+
+The example below shows the change for a Policy resource: you must do the same for all GlobalConfiguration and TransportServer resources.
+
+{{<tabs name="resource-version-update">}}
+
+{{% comment %}} Keep this left aligned. {{% /comment %}}
+{{%tab name="Before"%}}
+
+```yaml
+apiVersion: k8s.nginx.org/v1alpha1
+kind: Policy
+metadata:
+  name: rate-limit-policy
+spec:
+  rateLimit:
+    rate: 1r/s
+    key: ${binary_remote_addr}
+    zoneSize: 10M
+```
+{{% /tab %}}
+
+{{%tab name="After"%}}
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: rate-limit-policy
+spec:
+  rateLimit:
+    rate: 1r/s
+    key: ${binary_remote_addr}
+    zoneSize: 10M
+```
+{{% /tab %}}
+
+{{</tabs>}}
+
+{{< warning >}}
+If a *GlobalConfiguration*, *Policy* or *TransportServer* resource is deployed with `apiVersion: k8s.nginx.org/v1alpha1`, it will be **deleted** during the upgrade process.
+{{</ warning >}}
+
+Once above specified custom resources are moved to `v1` ,please run below `kubectl` commands before upgrading to v4.0.0 Custom Resource Definitions (CRDs) to avoid [this issue](https://github.com/nginx/kubernetes-ingress/issues/7010).
+
+```shell
+kubectl patch customresourcedefinitions transportservers.k8s.nginx.org --subresource='status' --type='merge' -p '{"status":{"storedVersions": ["v1"]}}'
+```
+
+```shell
+kubectl patch customresourcedefinitions globalconfigurations.k8s.nginx.org --subresource='status' --type='merge' -p '{"status":{"storedVersions": ["v1"]}}'
+```
+
+---
+
+## Configure structured logging
+
+To configure structured logging, you must update your log deployment arguments from an integer to a string. The logs themselves can also be rendered in different formats.
+
+{{< note >}} These options apply to NGINX Ingress Controller logs, and do not affect NGINX logs. {{< /note >}}
+
+| **Level arguments** | **Format arguments** |
+|---------------------|----------------------|
+| `trace`             | `json`               |
+| `debug`             | `text`               |
+| `info`              | `glog`               |
+| `warning`           |                      |
+| `error`             |                      |
+| `fatal`             |                      |
+
+{{<tabs name="structured logging">}}
+
+{{%tab name="Helm"%}}
+
+The Helm value of `controller.logLevel` has been changed from an integer to a string.
+
+To change the rendering of the log format, use the `controller.logFormat` key.
+
+```yaml
+controller:
+    logLevel: info
+    logFormat: json
+```
+{{% /tab %}}
+
+{{%tab name="Manifests"%}}
+
+The command line argument `-v` has been replaced with `-log-level`, and takes a string instead of an integer. The argument `-logtostderr` has also been deprecated.
+
+To change the rendering of the log format, use the `-log-format` argument.
+
+```yaml
+args:
+    - -log-level=info
+    - -log-format=json
+```
+{{% /tab %}}
+
+{{</tabs>}}
+
+---
+
+## Create License secret
+
+If you're using [NGINX Plus]({{< ref "/nic/overview/nginx-plus.md" >}}) with NGINX Ingress Controller, you should read the [Create License Secret]({{< ref "/nic/installation/create-license-secret.md" >}}) topic to set up your NGINX Plus license.
+
+The topic also contains guidance for [sending reports to NGINX Instance Manager]({{< ref "/nic/installation/create-license-secret.md#nim">}}), which is necessary for air-gapped environments.
+
+In prior versions, usage reporting with the cluster connector was required: it is no longer necessary, as it is built into NGINX Plus.
diff --git a/content/nic/installation/integrations/_index.md b/content/nic/installation/integrations/_index.md
new file mode 100644
index 000000000..e1c0b2f10
--- /dev/null
+++ b/content/nic/installation/integrations/_index.md
@@ -0,0 +1,5 @@
+---
+title: Integrations
+description:
+weight: 600
+---
diff --git a/content/nic/installation/integrations/app-protect-dos/_index.md b/content/nic/installation/integrations/app-protect-dos/_index.md
new file mode 100644
index 000000000..6f2685996
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-dos/_index.md
@@ -0,0 +1,8 @@
+---
+title: NGINX App Protect DoS
+description: Learn how to use NGINX Ingress Controller for Kubernetes with NGINX App Protect DoS.
+weight: 300
+menu:
+  docs:
+    parent: Integrations
+---
diff --git a/content/nic/installation/integrations/app-protect-dos/configuration.md b/content/nic/installation/integrations/app-protect-dos/configuration.md
new file mode 100644
index 000000000..a63de7f9c
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-dos/configuration.md
@@ -0,0 +1,164 @@
+---
+title: Configuration
+toc: true
+weight: 200
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-580
+---
+
+{{< tip >}}
+
+Check out the complete [NGINX Ingress Controller with App Protect DoS example for VirtualServer](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-dos) and the [NGINX Ingress Controller with App Protect DoS example for Ingress](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-dos).
+
+{{< /tip >}}
+
+## App Protect DoS Configuration
+
+A `DosProtectedResource` is a [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) that holds the configuration of a collection of protected resources.
+An [Ingress]({{< ref "/nic/configuration/ingress-resources/basic-configuration" >}}), [VirtualServer and VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}) can be protected by specifying a reference to the DosProtectedResource.
+
+1. Create an `DosProtectedResource` Custom resource manifest. As an example:
+
+  ```yaml
+apiVersion: appprotectdos.f5.com/v1beta1
+kind: DosProtectedResource
+metadata:
+   name: dos-protected
+spec:
+   enable: true
+   name: "webapp.example.com"
+   apDosMonitor:
+      uri: "webapp.example.com"
+      protocol: "http1"
+      timeout: 5
+  ```
+
+2. Enable App Protect DoS for an Ingress resource by adding an annotation to the Ingress. Set the value of the annotation to the qualified identifier(`namespace/name`) of a DosProtectedResource:
+
+  ```yaml
+   apiVersion: networking.k8s.io/v1
+   kind: Ingress
+   metadata:
+      name: webapp-ingress
+      annotations:
+         appprotectdos.f5.com/app-protect-dos-resource: "default/dos-protected"
+  ```
+
+3. Enable App Protect DoS on a VirtualServer resource by setting the `dos` field value to the qualified identifier(`namespace/name`) of a DosProtectedResource:
+
+  ```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+   name: webapp
+spec:
+   host: webapp.example.com
+   upstreams:
+      - name: webapp
+        service: webapp-svc
+        port: 80
+   routes:
+      - path: /
+        dos: dos-protected
+        action:
+           pass: webapp
+  ```
+
+## DoS Policy Configuration
+
+You can configure the policy for DoS by creating an `APDosPolicy` [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) and specifying the qualified identifier(`namespace/name`) of the `ApDosPolicy` in the `DosProtectedResource`.
+
+For example, say you want to use DoS Policy as shown below:
+
+  ```json
+  {
+   mitigation_mode: "standard",
+   signatures: "on",
+   bad_actors: "on",
+   automation_tools_detection: "on",
+   tls_fingerprint: "on",
+   }
+  ```
+
+Create an `APDosPolicy` resource with the policy defined in the `spec`, as shown below:
+
+  ```yaml
+   apiVersion: appprotectdos.f5.com/v1beta1
+   kind: APDosPolicy
+   metadata:
+      name: dospolicy
+   spec:
+      mitigation_mode: "standard"
+      signatures: "on"
+      bad_actors: "on"
+      automation_tools_detection: "on"
+      tls_fingerprint: "on"
+  ```
+
+Then add a reference in the `DosProtectedResource` to the `ApDosPolicy`:
+
+  ```yaml
+   apiVersion: appprotectdos.f5.com/v1beta1
+   kind: DosProtectedResource
+   metadata:
+      name: dos-protected
+   spec:
+      enable: true
+      name: "my-dos"
+      apDosMonitor:
+         uri: "webapp.example.com"
+      apDosPolicy: "default/dospolicy"
+  ```
+
+## App Protect DoS Logs {#app-protect-dos-logs}
+
+You can set the [App Protect DoS Log configuration]({{< ref "/nap-dos/monitoring/types-of-logs.md" >}}) by creating an `APDosLogConf` [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) and specifying the qualified identifier(`namespace/name`) of the `ApDosLogConf` in the `DosProtectedResource`.
+
+For example, say you want to log state changing requests for your Ingress resources using App Protect DoS. The App Protect DoS log configuration looks like this:
+
+```json
+{
+    "filter": {
+        "traffic-mitigation-stats": "all",
+        "bad-actors": "top 10",
+        "attack-signatures": "top 10"
+    }
+}
+```
+
+You would add that config in the `spec` of your `APDosLogConf` resource as follows:
+
+```yaml
+apiVersion: appprotectdos.f5.com/v1beta1
+kind: APDosLogConf
+metadata:
+   name: doslogconf
+spec:
+   filter:
+      traffic-mitigation-stats: all
+      bad-actors: top 10
+      attack-signatures: top 10
+```
+
+Then add a reference in the `DosProtectedResource` to the `APDosLogConf`:
+
+  ```yaml
+   apiVersion: appprotectdos.f5.com/v1beta1
+   kind: DosProtectedResource
+   metadata:
+      name: dos-protected
+   spec:
+      enable: true
+      name: "my-dos"
+      apDosMonitor:
+         uri: "webapp.example.com"
+      dosSecurityLog:
+         enable: true
+         apDosLogConf: "doslogconf"
+         dosLogDest: "syslog-svc.default.svc.cluster.local:514"
+  ```
+
+## Global Configuration
+
+NGINX Ingress Controller has a set of global configuration parameters that align with those available in the NGINX App Protect DoS module. See [ConfigMap keys]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#modules" >}}) for the complete list. The App Protect parameters use the `app-protect-dos*` prefix.
diff --git a/content/nic/installation/integrations/app-protect-dos/dos-protected.md b/content/nic/installation/integrations/app-protect-dos/dos-protected.md
new file mode 100644
index 000000000..612cf37ad
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-dos/dos-protected.md
@@ -0,0 +1,126 @@
+---
+title: DoS protected resource specification
+toc: true
+weight: 300
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-581
+---
+
+NGINX App Protect DoS protected resource specification
+
+{{< note >}} This feature is only available using the NGINX Plus [NGINX App Protect DoS Module]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}). {{< /note >}}
+
+## DoS Protected resource specification
+
+Below is an example of a DoS protected resource.
+
+```yaml
+apiVersion: appprotectdos.f5.com/v1beta1
+kind: DosProtectedResource
+metadata:
+  name: dos-protected
+spec:
+  enable: true
+  name: "my-dos"
+  apDosMonitor:
+    uri: "webapp.example.com"
+```
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``enable`` | Enables NGINX App Protect DoS, Default value: false. | ``bool`` | No |
+|``name`` | Name of the protected object, max of 63 characters. | ``string`` | Yes |
+|``dosAccessLogDest`` | The log destination for the access log with dos log format. Accepted variables are ``<ip-address \| localhost \| fqdn>:<port>`` or ``stderr``. | ``string`` | No |
+|``apDosMonitor.uri`` | The destination to the desired protected object. [App Protect DoS monitor](#dosprotectedresourceapdosmonitor) Default value: None, URL will be extracted from the first request which arrives and taken from "Host" header or from destination ip+port. | ``string`` | No |
+|``apDosMonitor.protocol`` | Determines if the server listens on http1 / http2 / grpc / websocket. [App Protect DoS monitor](#dosprotectedresourceapdosmonitor) Default value: http1. | ``enum`` | No |
+|``apDosMonitor.timeout`` | Determines how long (in seconds) should NGINX App Protect DoS wait for a response. [App Protect DoS monitor](#dosprotectedresourceapdosmonitor) Default value: 10 seconds for http1/http2 and 5 seconds for grpc. | ``int64`` | No |
+|``apDosPolicy`` | The [App Protect DoS policy](#dosprotectedresourceapdospolicy) of the dos. Accepts an optional namespace. | ``string`` | No |
+|``dosSecurityLog.enable`` | Enables security log. | ``bool`` | No |
+|``dosSecurityLog.apDosLogConf`` | The [App Protect DoS log conf]({{< ref "/nic/installation/integrations/app-protect-dos/configuration.md#app-protect-dos-logs" >}}) resource. Accepts an optional namespace. | ``string`` | No |
+|``dosSecurityLog.dosLogDest`` | The log destination for the security log. Accepted variables are ``<ip-address \| localhost \| fqdn>:<port>`` or ``stderr``. Default is ``127.0.0.1:514``. | ``string`` | No |
+|``allowList`` | List of allowed IP addresses and subnet masks. Each entry is represented by an `IPWithMask` string. | ``[]AllowListEntry`` | No |
+{{% /table %}}
+
+### DosProtectedResource.apDosPolicy
+
+The `apDosPolicy` is a reference (qualified identifier in the format `namespace/name`) to the policy configuration defined as an `ApDosPolicy`.
+
+### DosProtectedResource.apDosMonitor
+
+This is how NGINX App Protect DoS monitors the stress level of the protected object. The monitor requests are sent from localhost (127.0.0.1).
+
+### Invalid DoS Protected resources
+
+NGINX will treat a DoS protected resource as invalid if one of the following conditions is met:
+
+- The DoS protected resource doesn't pass the [comprehensive validation](#comprehensive-validation).
+- The DoS protected resource isn't present in the cluster.
+
+### Validation
+
+Two types of validation are available for the DoS protected resource:
+
+- *Structural validation*, done by `kubectl` and the Kubernetes API server.
+- *Comprehensive validation*, done by NGINX Ingress Controller.
+
+#### Structural validation
+
+The custom resource definition for the DoS protected resource includes a structural OpenAPI schema, which describes the type of every field of the resource.
+
+If you try to create (or update) a resource that violates the structural schema -- for example, the resource uses a string value instead of a bool in the `enable` field -- `kubectl` and the Kubernetes API server will reject the resource.
+
+- Example of `kubectl` validation:
+
+    ```shell
+    kubectl apply -f apdos-protected.yaml
+    ```
+    ```shell
+    error: error validating "examples/app-protect-dos/apdos-protected.yaml": error validating data: ValidationError(DosProtectedResource.spec.enable): invalid type for com.f5.appprotectdos.v1beta1.DosProtectedResource.spec.enable: got "string", expected "boolean"; if you choose to ignore these errors, turn validation off with --validate=false
+    ```
+
+- Example of Kubernetes API server validation:
+
+    ```shell
+    kubectl apply -f access-control-policy-allow.yaml --validate=false
+    ```
+    ```shell
+    The DosProtectedResource "dos-protected" is invalid: spec.enable: Invalid value: "string": spec.enable in body must be of type boolean: "string"
+    ```
+
+If a resource passes structural validation, then NGINX Ingress Controller will start comprehensive validation.
+
+#### Comprehensive validation
+
+NGINX Ingress Controller validates the fields of a DoS protected resource. If a resource is invalid, NGINX Ingress Controller will reject it. The resource will continue to exist in the cluster, but NGINX Ingress Controller will ignore it.
+
+You can use `kubectl` to check if NGINX Ingress Controller successfully applied a DoS protected resource configuration. For our example `dos-protected` DoS protected resource, we can run:
+
+```shell
+kubectl describe dosprotectedresource dos-protected
+```
+```shell
+Events:
+  Type    Reason          Age                From                      Message
+  ----    ------          ----               ----                      -------
+  Normal  AddedOrUpdated  12s (x2 over 18h)  nginx-ingress-controller  Configuration for default/dos-protected was added or updated
+```
+
+Note how the events section includes a Normal event with the AddedOrUpdated reason that informs us that the configuration was successfully applied.
+
+If you create an invalid resource, NGINX Ingress Controller will reject it and emit a Rejected event. For example, if you create a dos protected resource `dos-protected` with an invalid URI `bad` in the `dosSecurityLog/dosLogDest` field, you will get:
+
+```shell
+kubectl describe policy webapp-policy
+```
+```shell
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  2s    nginx-ingress-controller  error validating DosProtectedResource: dos-protected invalid field: dosSecurityLog/dosLogDest err: invalid log destination: bad, must follow format: <ip-address | localhost | dns name>:<port> or stderr
+```
+
+The events section has Warning event with the rejection error in the message.
+
+{{< warning >}} If you invalidate an existing resource, NGINX Ingress Controller will reject it. {{< /warning >}}
diff --git a/content/nic/installation/integrations/app-protect-dos/installation.md b/content/nic/installation/integrations/app-protect-dos/installation.md
new file mode 100644
index 000000000..9471d48c5
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-dos/installation.md
@@ -0,0 +1,230 @@
+---
+title: Build NGINX Ingress Controller with NGINX App Protect DoS
+weight: 100
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-583
+---
+
+This document explains how to build an image for F5 NGINX Ingress Controller with NGINX App Protect DoS from source code.
+
+{{<call-out "tip" "Pre-built image alternatives" >}}If you'd rather not build your own NGINX Ingress Controller image, see the [pre-built image options](#pre-built-images) at the end of this guide.{{</call-out>}}
+
+## Before you start
+
+- To use NGINX App Protect DoS with NGINX Ingress Controller, you must have NGINX Plus.
+
+---
+
+## Prepare the environment {#prepare-environment}
+
+Get your system ready for building and pushing the NGINX Ingress Controller image with NGINX App Protect DoS.
+
+1. Sign in to your private registry. Replace `<my-docker-registry>` with the path to your own private registry.
+
+    ```shell
+    docker login <my-docker-registry>
+    ```
+
+2. Clone the NGINX Ingress Controller GitHub repository. Replace `<version_number>` with the version of NGINX Ingress Controller you want.
+
+    ```shell
+    git clone https://github.com/nginx/kubernetes-ingress.git --branch <version_number>
+    cd kubernetes-ingress
+    ```
+
+    For instance if you want to clone version v{{< nic-version >}}, the commands to run would be:
+
+    ```shell
+    git clone https://github.com/nginx/kubernetes-ingress.git --branch v{{< nic-version >}}
+    cd kubernetes-ingress/deployments
+    ```
+
+---
+
+## Build the image {#build-docker-image}
+
+Follow these steps to build the NGINX Controller Image with NGINX App Protect DoS.
+
+1. Place your NGINX Plus license files (_nginx-repo.crt_ and _nginx-repo.key_) in the project's root folder. To verify they're in place, run:
+
+    ```shell
+    ls nginx-repo.*
+    ```
+
+    You should see:
+
+    ```shell
+    nginx-repo.crt  nginx-repo.key
+    ```
+
+2. Build the image. Replace `<makefile target>` with your chosen build option and `<my-docker-registry>` with your private registry's path. Refer to the [Makefile targets](#makefile-targets) table below for the list of build options.
+
+    ```shell
+    make <makefile target> PREFIX=<my-docker-registry>/nginx-plus-ingress TARGET=download
+    ```
+
+    For example, to build a Debian-based image with NGINX Plus and NGINX App Protect DoS, run:
+
+    ```shell
+    make debian-image-dos-plus PREFIX=<my-docker-registry>/nginx-plus-ingress TARGET=download
+    ```
+
+     **What to expect**: The image is built and tagged with a version number, which is derived from the `VERSION` variable in the [_Makefile_]({{< ref "/nic/installation/build-nginx-ingress-controller.md#makefile-details" >}}). This version number is used for tracking and deployment purposes.
+
+{{<note>}}In the event a patch version of NGINX Plus is released, make sure to rebuild your image to get the latest version. If your system is caching the Docker layers and not updating the packages, add `DOCKER_BUILD_OPTIONS="--pull --no-cache"` to the make command.{{</note>}}
+
+### Makefile targets {#makefile-targets}
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| Makefile Target           | Description                                                       | Compatible Systems  |
+|---------------------------|-------------------------------------------------------------------|---------------------|
+| **debian-image-dos-plus** | Builds a Debian-based image with NGINX Plus and the [NGINX App Protect DoS](/nginx-app-protect-dos/) module. | Debian  |
+| **debian-image-nap-dos-plus** | Builds a Debian-based image with NGINX Plus, [NGINX App Protect DoS](/nginx-app-protect-dos/), and [NGINX App Protect WAF](/nginx-app-protect/). | Debian  |
+| **ubi-image-dos-plus**    | Builds a UBI-based image with NGINX Plus and the [NGINX App Protect DoS](/nginx-app-protect-dos/) module. | OpenShift |
+| **ubi-image-nap-dos-plus** | Builds a UBI-based image with NGINX Plus, [NGINX App Protect DoS](/nginx-app-protect-dos/), and [NGINX App Protect WAF](/nginx-app-protect/). | OpenShift |
+{{</bootstrap-table>}}
+
+<br>
+
+{{< see-also >}} For the complete list of _Makefile_ targets and customizable variables, see the [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md#makefile-details" >}}) topic. {{</ see-also >}}
+
+---
+
+## Push the image to your private registry
+
+Once you've successfully built the NGINX Ingress Controller image with NGINX App Protect DoS, the next step is to upload it to your private Docker registry. This makes the image available for deployment to your Kubernetes cluster.
+
+To upload the image, run the following command. If you're using a custom tag, add `TAG=your-tag` to the end of the command. Replace `<my-docker-registry>` with your private registry's path.
+
+```shell
+make push PREFIX=<my-docker-registry>/nginx-plus-ingress
+```
+
+---
+
+## Set up role-based access control (RBAC) {#set-up-rbac}
+
+{{< include "/nic/rbac/set-up-rbac.md" >}}
+
+---
+
+## Create common resources {#create-common-resources}
+
+{{< include "/nic/installation/create-common-resources.md" >}}
+
+---
+
+## Create custom resources {#create-custom-resources}
+
+{{< include "/nic/installation/create-custom-resources.md" >}}
+
+---
+
+## Create App Protect DoS custom resources
+
+{{<tabs name="install-dos-crds">}}
+
+{{%tab name="Install CRDs from single YAML"%}}
+
+This single YAML file creates CRDs for the following resources:
+
+- `APDosPolicy`
+- `APDosLogConf`
+- `DosProtectedResource`
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds-nap-dos.yaml
+```
+
+{{%/tab%}}
+
+{{%tab name="Install CRDs after cloning the repo"%}}
+
+These YAML files create CRDs for the following resources:
+
+- `APDosPolicy`
+- `APDosLogConf`
+- `DosProtectedResource`
+
+```shell
+kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdoslogconfs.yaml
+kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdospolicy.yaml
+kubectl apply -f config/crd/bases/appprotectdos.f5.com_dosprotectedresources.yaml
+```
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+---
+
+## Deploy NGINX Ingress Controller {#deploy-ingress-controller}
+
+{{< include "/nic/installation/deploy-controller.md" >}}
+
+### Using a Deployment
+
+{{< include "/nic/installation/manifests/deployment.md" >}}
+
+### Using a DaemonSet
+
+{{< include "/nic/installation/manifests/daemonset.md" >}}
+
+---
+
+## Install the App Protect DoS Arbitrator
+
+{{< note >}} If you install multiple NGINX Ingress Controllers in the same namespace, they will need to share the same Arbitrator because there can only be one Arbitrator in a single namespace. {{< /note >}}
+
+### Helm Chart
+
+The App Protect DoS Arbitrator can be installed using the [NGINX App Protect DoS Helm Chart](https://github.com/nginxinc/nap-dos-arbitrator-helm-chart).
+If you have the NGINX Helm Repository already added, you can install the App Protect DoS Arbitrator by running the following command:
+
+```shell
+helm install my-release-dos nginx-stable/nginx-appprotect-dos-arbitrator
+```
+
+### YAML Manifests
+
+Alternatively, you can install the App Protect DoS Arbitrator using the YAML manifests provided in the NGINX Ingress Controller repo.
+
+1. Create the namespace and service account:
+
+    ```shell
+      kubectl apply -f common/ns-and-sa.yaml
+    ```
+
+2. Deploy the NGINX App Protect Arbitrator as a Deployment and service:
+
+    ```shell
+    kubectl apply -f deployment/appprotect-dos-arb.yaml
+    kubectl apply -f service/appprotect-dos-arb-svc.yaml
+    ```
+
+---
+
+## Enable NGINX App Protect DoS module
+
+To enable the NGINX App Protect DoS Module:
+
+- Add the `enable-app-protect-dos` [command-line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-app-protect-dos" >}}) to your Deployment or DaemonSet file.
+
+---
+
+## Confirm NGINX Ingress Controller is running
+
+{{< include "/nic/installation/manifests/verify-pods-are-running.md" >}}
+
+For more information, see the [Configuration guide]({{< ref "/nic/installation/integrations/app-protect-dos/configuration.md" >}}),the [NGINX Ingress Controller with App Protect DoS example for VirtualServer](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-dos) and the [NGINX Ingress Controller with App Protect DoS example for Ingress](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-dos).
+
+---
+
+## Alternatives to building your own image {#pre-built-images}
+
+If you prefer not to build your own NGINX Ingress Controller image, you can use pre-built images. Here are your options:
+
+- Download the image using your NGINX Ingress Controller subscription certificate and key. View the [Get NGINX Ingress Controller from the F5 Registry]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic.
+  - The [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic describes how to use your subscription JWT token to get the image.
diff --git a/content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md b/content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md
new file mode 100644
index 000000000..3b3fd61c5
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md
@@ -0,0 +1,111 @@
+---
+docs: DOCS-1456
+doctypes:
+- ''
+title: Troubleshoot NGINX App Protect DoS
+toc: true
+weight: 400
+---
+
+This document describes how to troubleshoot problems when using NGINX Ingress Controller and the App Protect DoS module.
+
+To troubleshoot other parts of NGINX Ingress Controller, check the [troubleshooting]({{< ref "/nic/troubleshooting/troubleshoot-common.md" >}}) section of the documentation.
+
+## Potential problems
+
+The table below outlines potential problems with NGINX Ingress Controller when the App Protect DoS module is enabled. It suggests how to troubleshoot those problems with methods explained in the next section.
+
+{{% table %}}
+|Problem area | Symptom | Troubleshooting method | Common cause |
+| ---| ---| ---| --- |
+|Start | NGINX Ingress Controller fails to start. | Check the NGINX Ingress Controller logs. | Misconfigured DosProtectedResource, APDosLogConf or APDosPolicy. |
+|DosProtectedResource, APDosLogConf, APDosPolicy or Ingress Resource. | The configuration is not applied. | Check the events of the DosProtectedResource, APDosLogConf, APDosPolicy and Ingress Resource, check the Ingress Controller logs. | DosProtectedResource, APDosLogConf or APDosPolicy is invalid. |
+{{% /table %}}
+
+## Troubleshooting ethods
+
+### Checking NGINX Ingress Controller and App Protect DoS logs
+
+App Protect DoS logs are part of the NGINX Ingress Controller logs when the module is enabled. To check the Ingress Controller logs, follow the steps of [Checking the Ingress Controller Logs]({{< ref "/nic/troubleshooting/troubleshoot-common#checking-nginx-ingress-controller-logs" >}}s) of the Troubleshooting guide.
+
+For App Protect DoS specific logs, look for messages starting with `APP_PROTECT_DOS`, such as:
+
+```shell
+2021/06/14 08:17:50 [notice] 242#242: APP_PROTECT_DOS { "event": "shared_memory_connected", "worker_pid": 242, "mode": "operational", "mode_changed": true }
+```
+
+### Checking Ingress Resource Events
+
+Follow the steps of [Troubleshooting Ingress Resources]({{< ref "/nic/troubleshooting/troubleshoot-ingress" >}}).
+
+### Checking VirtualServer Resource Events
+
+Follow the steps of [Troubleshooting VirtualServer Resources]({{< ref "/nic/troubleshooting/troubleshoot-virtualserver" >}}).
+
+### Checking for DoSProtectedResource Events
+
+After you create or update an DosProtectedResource, you can immediately check if the NGINX configuration was successfully applied by NGINX:
+
+```shell
+kubectl describe dosprotectedresource dos-protected
+Name:         dos-protected
+Namespace:    default
+
+Events:
+  Type     Reason          Age   From                      Message
+  ----     ------          ----  ----                      -------
+  Normal   AddedOrUpdated  2s    nginx-ingress-controller  Configuration for default/dos-protected was added or updated
+```
+
+Note that in the events section, we have a `Normal` event with the `AddedOrUpdated` reason, which informs us that the configuration was successfully applied.
+
+If the DosProtectedResource refers to a missing resource, you should see a message like the following:
+
+```shell
+Events:
+  Type     Reason    Age   From                      Message
+  ----     ------    ----  ----                      -------
+  Warning  Rejected  8s    nginx-ingress-controller  dos protected refers (default/dospolicy) to an invalid DosPolicy: DosPolicy default/dospolicy not found
+```
+
+This can be fixed by adding the missing resource.
+
+### Checking for APDosLogConf Events
+
+After you create or update an APDosLogConf, you can immediately check if the NGINX configuration was successfully applied by NGINX:
+
+```shell
+kubectl describe apdoslogconf logconf
+Name:         logconf
+Namespace:    default
+
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  11s   nginx-ingress-controller  AppProtectDosLogConfig  default/logconf was added or updated
+```
+
+Note that in the events section, we have a `Normal` event with the `AddedOrUpdated` reason, which informs us that the configuration was successfully applied.
+
+### Check events of APDosPolicy
+
+After you create or update an APDosPolicy, you can immediately check if the NGINX configuration was successfully applied by NGINX:
+
+```shell
+kubectl describe apdospolicy dospolicy
+Name:         dospolicy
+Namespace:    default
+. . .
+Events:
+  Type    Reason          Age    From                      Message
+  ----    ------          ----   ----                      -------
+  Normal  AddedOrUpdated  2m25s  nginx-ingress-controller  AppProtectDosPolicy default/dospolicy was added or updated
+```
+
+The events section has a *Normal* event with the *AddedOrUpdated reason*, indicating the policy was successfully accepted.
+
+## Run App Protect DoS in Debug log Mode
+
+When you set the Ingress Controller to use debug log mode, the setting also applies to the App Protect DoS module.  See  [Running NGINX in the Debug Mode](/nginx-ingress-controller/troubleshooting/#running-nginx-in-the-debug-mode) for instructions.
+
+You can enable debug log mode to App Protect DoS module only by setting the `app-protect-dos-debug` [configmap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource#modules).
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/_index.md b/content/nic/installation/integrations/app-protect-waf-v5/_index.md
new file mode 100644
index 000000000..01bf182df
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf-v5/_index.md
@@ -0,0 +1,8 @@
+---
+title: NGINX App Protect WAF v5
+description: Learn how to use NGINX Ingress Controller for Kubernetes with NGINX App Protect version 5.
+weight: 200
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
new file mode 100644
index 000000000..d6abcb83c
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
@@ -0,0 +1,371 @@
+---
+title: Compile NGINX App Protect WAF policies using NGINX Instance Manager
+weight: 300
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-000
+---
+
+## Overview
+
+This guide describes how to use F5 NGINX Instance Manager to compile NGINX App Protect WAF Policies for use with NGINX Ingress Controller.
+
+NGINX App Protect WAF uses policies to configure which security features are set. When these policies are changed, they need to be compiled so that the engine can begin to use them. Compiling policies can take a large amount of time and resources. You can do this with the NGINX Instance Manager. This reduces the impact on a NGINX Ingress Controller deployment.
+
+By using NGINX Instance Manager to compile WAF policies, the policy bundle can also be used immediately by NGINX Ingress Controller without reloading.
+
+The following steps describe how to use the NGINX Instance Manager API to create a new security policy, compile a bundle, then add it to NGINX Ingress Controller.
+
+---
+
+## Before you start
+
+### Requirements
+- A working [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/deploy/) instance.
+- An [NGINX Instance Manager user](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/overview-rbac/) for API requests.
+- A NGINX Ingress Controller [deployment with NGINX App Protect WAF]({{< ref "/nic/installation/integrations/app-protect-waf/installation.md" >}}).
+
+---
+
+## Create a new security policy
+
+{{< tip >}} You can skip this step if you intend to use an existing security policy. {{< /tip >}}
+
+Create a [new security policy](https://docs.nginx.com/nginx-instance-manager/nginx-app-protect/manage-waf-security-policies/#create-security-policy) using the API: this will require the use of a tool such as [`curl`](https://curl.se/) or [Postman](https://www.postman.com/)
+
+Create the file `simple-policy.json` with the contents below:
+
+```json
+{
+  "metadata": {
+    "name": "Nginxbundletest",
+    "displayName": "Nginxbundletest",
+    "description": "Ignore cross-site scripting is a security policy that intentionally ignores cross site scripting."
+  },
+  "content": "ewoJInBvbGljeSI6IHsKCQkibmFtZSI6ICJzaW1wbGUtYmxvY2tpbmctcG9saWN5IiwKCQkic2lnbmF0dXJlcyI6IFsKCQkJewoJCQkJInNpZ25hdHVyZUlkIjogMjAwMDAxODM0LAoJCQkJImVuYWJsZWQiOiBmYWxzZQoJCQl9CgkJXSwKCQkidGVtcGxhdGUiOiB7CgkJCSJuYW1lIjogIlBPTElDWV9URU1QTEFURV9OR0lOWF9CQVNFIgoJCX0sCgkJImFwcGxpY2F0aW9uTGFuZ3VhZ2UiOiAidXRmLTgiLAoJCSJlbmZvcmNlbWVudE1vZGUiOiAiYmxvY2tpbmciCgl9Cn0="
+}
+```
+
+{{< warning >}} The `content` value must be base64 encoded or you will encounter an error. {{< /warning >}}
+
+Upload the policy JSON files with the API, which is the same method to create the bundle later.
+
+In the same directory you created `simple-policy.json`, create a POST request for NGINX Instance Manager using the API.
+
+```shell
+curl -X POST https://{{NMS_FQDN}}/api/platform/v1/security/policies \
+    -H "Authorization: Bearer <access token>" \
+    -d @simple-policy.json
+```
+
+You should receive an API response similar to the following output, indicating the policy has been successfully created.
+
+```json
+{
+    "metadata": {
+        "created": "2024-06-12T20:28:08.152171922Z",
+        "description": "Ignore cross-site scripting is a security policy that intentionally ignores cross site scripting.",
+        "displayName": "Nginxbundletest",
+        "externalId": "",
+        "externalIdType": "",
+        "modified": "2024-06-12T20:28:08.152171922Z",
+        "name": "Nginxbundletest",
+        "revisionTimestamp": "2024-06-12T20:28:08.152171922Z",
+        "uid": "6af9f261-658b-4be1-b07a-cebd83e917a1"
+    },
+    "selfLink": {
+        "rel": "/api/platform/v1/security/policies/6af9f261-658b-4be1-b07a-cebd83e917a1"
+    }
+}
+```
+
+{{< important >}}
+
+Take note of the *uid* field: `"uid": "6af9f261-658b-4be1-b07a-cebd83e917a1"`
+It is one of two unique IDs we will use to download the bundle: it will be referenced as *policy-UID*.
+
+{{< /important >}}
+
+---
+
+## Create a new security bundle
+
+Once you have created (Or selected) a security policy, [create a security bundle](https://docs.nginx.com/nginx-instance-manager/nginx-app-protect/manage-waf-security-policies/#create-security-policy-bundles) using the API. The version in the bundle you create **must** match the WAF compiler version you intend to use.
+
+You can check which version is installed in NGINX Instance Manager by checking the operating system packages. If the wrong version is noted in the JSON payload, you will receive an error similar to below:
+
+```text
+{"code":13018,"message":"Error compiling the security policy set: One or more of the specified compiler versions does not exist. Check the compiler versions, then try again."}
+```
+
+Create the file `security-policy-bundles.json`:
+
+```json
+{
+  "bundles": [
+    {
+      "appProtectWAFVersion": "4.815.0",
+      "policyName": "Nginxbundletest",
+      "policyUID": "",
+      "attackSignatureVersionDateTime": "latest",
+      "threatCampaignVersionDateTime": "latest"
+    }
+  ]
+}
+```
+
+The *policyUID* value is left blank, as it is generated as part of the creating the bundle.
+
+Send a POST request to create the bundle through the API:
+
+```shell
+curl -X POST https://{{NMS_FQDN}}/api/platform/v1/security/policies/bundles \
+    -H "Authorization: Bearer <access token>" \
+    -d @security-policy-bundles.json
+```
+
+You should receive a response similar to the following:
+
+```json
+{
+    "items": [
+        {
+            "compilationStatus": {
+                "message": "",
+                "status": "compiling"
+            },
+            "content": "",
+            "metadata": {
+                "appProtectWAFVersion": "4.815.0",
+                "attackSignatureVersionDateTime": "2024.02.21",
+                "created": "2024-06-12T13:28:20.023775785-07:00",
+                "modified": "2024-06-12T13:28:20.023775785-07:00",
+                "policyName": "Nginxbundletest",
+                "policyUID": "6af9f261-658b-4be1-b07a-cebd83e917a1",
+                "threatCampaignVersionDateTime": "2024.02.25",
+                "uid": "cbdf9577-6d81-43d6-8ce1-2e3d4714e8b5"
+            }
+        }
+    ]
+}
+```
+
+You can use the API to list the security bundles, verifying the new addition:
+
+```shell
+curl --location 'https://127.0.0.1/api/platform/v1/security/policies/bundles' \
+-H "Authorization: Bearer <access_token>"
+```
+```json
+{
+    "items": [
+        {
+            "compilationStatus": {
+                "message": "",
+                "status": "compiled"
+            },
+            "content": "",
+            "metadata": {
+                "appProtectWAFVersion": "4.815.0",
+                "attackSignatureVersionDateTime": "2024.02.21",
+                "created": "2024-06-13T09:09:10.809-07:00",
+                "modified": "2024-06-13T09:09:20-07:00",
+                "policyName": "Nginxbundletest",
+                "policyUID": "ec8681eb-1e25-4b71-93bd-b91f67c5ac99",
+                "threatCampaignVersionDateTime": "2024.02.25",
+                "uid": "de08b324-99d8-4155-b2eb-fe687b21034e"
+            }
+        }
+    ]
+}
+```
+
+{{< important >}}
+
+Take note of the *uid* field: `"uid": "de08b324-99d8-4155-b2eb-fe687b21034e"`
+
+It is one of two unique IDs we will use to download the bundle: it will be referenced as *bundle-UID*.
+
+{{< /important >}}
+
+---
+
+## Download the security bundle
+
+Use a GET request to download the security bundle using the policy and bundle IDs:
+
+```shell
+curl -X GET "https://{NMS_FQDN}/api/platform/v1/security/policies/<policy-UID>/bundles/<bundle-UID>" -H "Authorization: Bearer <access token>" | jq -r '.content' | base64 -d > security-policy-bundle.tgz
+```
+
+This GET request uses the policy and bundle IDs from the previous examples:
+
+```shell
+curl -X GET -k 'https://127.0.0.1/api/platform/v1/security/policies/6af9f261-658b-4be1-b07a-cebd83e917a1/bundles/de08b324-99d8-4155-b2eb-fe687b21034e' \
+    -H "Authorization: Basic <auth token>" \
+     | jq -r '.content' | base64 -d > security-policy-bundle.tgz
+```
+
+---
+
+## Add volumes and volumeMounts
+
+To use WAF security bundles, your NGINX Ingress Controller instance must have *volumes* and *volumeMounts*. Precise paths are used to detect when bundles are uploaded to the cluster.
+
+Here is an example of what to add:
+
+```yaml
+volumes:
+- name: <volume_name>
+persistentVolumeClaim:
+    claimName: <claim_name>
+
+volumeMounts:
+- name: <volume_mount_name>
+    mountPath: /etc/app_protect/bundles
+```
+
+A full example of a deployment file with `volumes` and `volumeMounts` could look like the following:
+
+```yaml
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-ingress
+  namespace: nginx-ingress
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx-ingress
+  template:
+    metadata:
+      labels:
+        app: nginx-ingress
+        app.kubernetes.io/name: nginx-ingress
+     #annotations:
+       #prometheus.io/scrape: "true"
+       #prometheus.io/port: "9113"
+       #prometheus.io/scheme: http
+    spec:
+      serviceAccountName: nginx-ingress
+      automountServiceAccountToken: true
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+      - name: nginx-bundle-mount
+        emptydir: {}
+      containers:
+      - image: <replace>
+        imagePullPolicy: IfNotPresent
+        name: nginx-ingress
+        ports:
+        - name: http
+          containerPort: 80
+        - name: https
+          containerPort: 443
+        - name: readiness-port
+          containerPort: 8081
+        - name: prometheus
+          containerPort: 9113
+        readinessProbe:
+          httpGet:
+            path: /nginx-ready
+            port: readiness-port
+          periodSeconds: 1
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "128Mi"
+         #limits:
+         #  cpu: "1"
+         #  memory: "1Gi"
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsUser: 101 #nginx
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE
+        volumeMounts:
+        -  name: bundle-mount
+           mountPath: /etc/app_protect/bundles
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        args:
+          - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
+          - -report-ingress-status
+          - -external-service=nginx-ingress
+```
+
+---
+
+## Create WAF policy
+
+To process a bundle, you must create a new WAF policy. This policy is added to `/etc/app_protect/bundles`, allowing NGINX Ingress Controller to load it into WAF.
+
+The example below shows the required WAF policy, and the *apBundle* and *apLogConf* fields you must use for the security bundle binary file (A tar ball).
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: <waf-policy-name>
+spec:
+  waf:
+    enable: true
+    apBundle: "<bundle-name>.tgz"
+    securityLogs:
+    - enable: true
+        apLogBundle: "<bundle-name>.tgz"
+        logDest: "<security-log-destination-URL>"
+```
+
+---
+
+## Create VirtualServer resource and apply policy
+
+Once the WAF policy has been created, link it to your *virtualServer resource*.
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: webapp
+spec:
+  host: webapp.example.com
+  policies:
+  - name: <waf-policy-name>
+  upstreams:
+  - name: webapp
+    service: webapp-svc
+    port: 80
+  routes:
+  - path: /
+    action:
+      pass: webapp
+```
+
+---
+
+## Upload the security bundle
+
+To finish adding a security bundle, upload the binary file to the NGINX Ingress Controller pods.
+
+```shell
+kubectl cp /your/local/path/<bundle_name>.tgz  <namespace>/<pod-name>:etc/app_protect/bundles<bundle_name>.tgz -c nginx-plus-ingress
+```
+
+Once the bundle has been uploaded to the cluster, NGINX Ingress Controller will detect and automatically load the new WAF policy.
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/configuration.md b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
new file mode 100644
index 000000000..b1c0c805e
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
@@ -0,0 +1,180 @@
+---
+title: Configure NGINX App Protect with NGINX Ingress Controller
+weight: 200
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-000
+---
+
+## Overview
+
+This document explains how to use F5 NGINX Ingress Controller to configure [NGINX App Protect WAF v5](https://docs.nginx.com/nginx-app-protect-waf/v5/).
+
+{{< note >}} There are complete NGINX Ingress Controller with NGINX App Protect WAF [example resources on GitHub](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5). {{< /note >}}
+
+## Global configuration
+
+NGINX Ingress Controller has global configuration parameters that match those in NGINX App Protect WAF. They are found in the [ConfigMap resource]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#modules" >}}): the NGINX App Protect WAF parameters are prefixed with `app-protect*`.
+
+## Enable NGINX App Protect WAF v5
+
+NGINX App Protect WAF v5 can be enabled and configured for custom resources only(VirtualServer, VirtualServerRoute). You need to create a Policy Custom Resource referencing a policy bundle, then add it to the VirtualServer/VirtualServerRoute definition. Additional detail can be found in the [Policy Resource documentation]({{< ref "/nic/configuration/policy-resource.md#waf" >}}).
+
+---
+
+## NGINX App Protect WAF Bundles
+
+App Protect WAF bundles for VirtualServer custom resources are defined by creating policy bundles and putting them on a mounted volume accessible from NGINX Ingress Controller.
+
+Before applying a policy, a WAF policy bundle must be created, then copied to a volume mounted to `/etc/app_protect/bundles`.
+
+{{< note >}} NGINX Ingress Controller supports `securityLogs` for policy bundles. Log bundles must also be copied to a volume mounted to `/etc/app_protect/bundles`. {{< /note >}}
+
+This example shows how a policy is configured by referencing a generated WAF Policy Bundle:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: <policy_name>
+spec:
+  waf:
+    enable: true
+    apBundle: "<policy_bundle_name>.tgz"
+```
+
+This example shows the same policy as above but with a log bundle used for security log configuration:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: <policy_name>
+spec:
+  waf:
+    enable: true
+    apBundle: "<policy_bundle_name>.tgz"
+    securityLogs:
+    - enable: true
+      apLogBundle: "<log_bundle_name>.tgz"
+      logDest: "syslog:server=syslog-svc.default:514"
+```
+
+---
+
+## Configure NGINX Plus Ingress Controller using Virtual Server resources
+
+This example shows how to deploy NGINX Ingress Controller with NGINX Plus and NGINX App Protect WAF v5, deploy a simple web application, and then configure load balancing and WAF protection for that application using the VirtualServer resource.
+
+{{< note >}} You can find the files for this example on [GitHub](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5).{{< /note >}}
+
+### Prerequisites
+
+1. Follow the installation [instructions]({{< ref "/nic/installation/integrations/app-protect-waf-v5/installation.md" >}}) to deploy NGINX Ingress Controller with NGINX Plus and NGINX App Protect WAF version 5.
+
+2. Save the public IP address of NGINX Ingress Controller into a shell variable:
+
+   ```shell
+    IC_IP=XXX.YYY.ZZZ.III
+   ```
+
+3. Save the HTTP port of NGINX Ingress Controller into a shell variable:
+
+   ```shell
+    IC_HTTP_PORT=<port number>
+   ```
+
+### Deploy a web application
+
+Create the application deployment and service:
+
+  ```shell
+  kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5/webapp.yaml
+  ```
+
+### Create the Syslog service
+
+Create the syslog service and pod for the NGINX App Protect WAF security logs:
+
+
+   ```shell
+   kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5/syslog.yaml
+   ```
+
+### Deploy the WAF Policy
+
+
+{{< note >}} Configuration settings in the Policy resource enable WAF protection by configuring NGINX App Protect WAF with the log configuration created in the previous step. The policy bundle referenced as `your_policy_bundle_name.tgz` need to be created and placed in the `/etc/app_protect/bundles` volume first.{{</ note >}}
+
+Create and deploy the WAF policy.
+
+ ```shell
+  kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5/waf.yaml
+ ```
+
+
+### Configure load balancing
+
+{{< note >}} VirtualServer references the `waf-policy` created in Step 3.{{</ note >}}
+
+1. Create the VirtualServer Resource:
+
+    ```shell
+    kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5/virtual-server.yaml
+    ```
+
+
+### Test the application
+
+To access the application, curl the coffee and the tea services. Use the `--resolve` option to set the Host header of a request with `webapp.example.com`
+
+1. Send a request to the application:
+
+  ```shell
+  curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT/
+  ```
+
+  ```shell
+  Server address: 10.12.0.18:80
+  Server name: webapp-7586895968-r26zn
+  ```
+
+1. Try to send a request with a suspicious URL:
+
+  ```shell
+  curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP "http://webapp.example.com:$IC_HTTP_PORT/<script>"
+  ```
+
+  ```shell
+  <html><head><title>Request Rejected</title></head><body>
+  ```
+
+1.  Check the security logs in the syslog pod:
+
+  ```shell
+  kubectl exec -it <SYSLOG_POD> -- cat /var/log/messages
+  ```
+
+## Example VirtualServer configuration
+
+The GitHub repository has a full [VirtualServer example](https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5/webapp.yaml).
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: webapp
+spec:
+  host: webapp.example.com
+  policies:
+  - name: waf-policy
+  upstreams:
+  - name: webapp
+    service: webapp-svc
+    port: 80
+  routes:
+  - path: /
+    action:
+      pass: webapp
+```
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/installation.md b/content/nic/installation/integrations/app-protect-waf-v5/installation.md
new file mode 100644
index 000000000..40f638f1a
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf-v5/installation.md
@@ -0,0 +1,505 @@
+---
+title: Build NGINX Ingress Controller with NGINX App Protect WAF
+weight: 100
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-000
+---
+
+This document explains how to build a F5 NGINX Ingress Controller image with NGINX App Protect WAF v5 from source code.
+
+{{<call-out "tip" "Pre-built image alternatives" >}} If you'd rather not build your own NGINX Ingress Controller image, see the [pre-built image options](#pre-built-images) at the end of this guide.{{</call-out>}}
+
+## Before you begin
+
+- To use NGINX App Protect WAF with NGINX Ingress Controller, you must have NGINX Plus.
+
+{{< include "/nic/compatibility-tables/nic-nap.md" >}}
+
+---
+
+## Prepare the environment
+
+Get your system ready for building and pushing the NGINX Ingress Controller image with NGINX App Protect WAF v5.
+
+1. Sign in to your private registry. Replace `<my-docker-registry>` with the path to your own private registry.
+
+    ```shell
+    docker login <my-docker-registry>
+    ```
+
+1. Pull the WAF Config Manager image:
+
+    ```shell
+    docker pull private-registry.nginx.com/nap/waf-config-mgr:<image-tag>
+    ```
+
+1. Pull the WAF Enforcer Docker image
+
+    ```shell
+    docker pull private-registry.nginx.com/nap/waf-enforcer:<image-tag>
+    ```
+
+1. Clone the NGINX Ingress Controller repository:
+
+    ```console
+    git clone https://github.com/nginx/kubernetes-ingress.git --branch v{{< nic-version >}}
+    cd kubernetes-ingress
+    ```
+
+---
+
+## Build the image
+
+Follow these steps to build the NGINX Controller Image with NGINX App Protect WAF v5.
+
+1. Place your NGINX Plus license files (_nginx-repo.crt_ and _nginx-repo.key_) in the project's root folder. To verify they're in place, run:
+
+    ```shell
+    ls nginx-repo.*
+    ```
+
+   You should see:
+
+    ```shell
+    nginx-repo.crt  nginx-repo.key
+    ```
+
+2. Build the image. Replace `<makefile target>` with your chosen build option and `<my-docker-registry>` with your private registry's path. Refer to the [Makefile targets](#makefile-targets) table below for the list of build options.
+
+    ```shell
+    make <makefile target> PREFIX=<my-docker-registry>/nginx-plus-ingress TARGET=download
+    ```
+
+   For example, to build a Debian-based image with NGINX Plus and NGINX App Protect WAF v5, run:
+
+    ```shell
+    make debian-image-nap-v5-plus PREFIX=<my-docker-registry>/nginx-plus-ingress TARGET=download
+    ```
+
+   **What to expect**: The image is built and tagged with a version number, which is derived from the `VERSION` variable in the [_Makefile_]({{< ref "/nic/installation/build-nginx-ingress-controller.md#makefile-details" >}}). This version number is used for tracking and deployment purposes.
+
+{{<note>}} In the event a patch of NGINX Plus is released, make sure to rebuild your image to get the latest version. If your system is caching the Docker layers and not updating the packages, add `DOCKER_BUILD_OPTIONS="--pull --no-cache"` to the make command. {{</note>}}
+
+### Makefile targets {#makefile-targets}
+
+Create Docker image for NGINX Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAF v5 and FIPS)
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| Makefile Target           | Description                                                       | Compatible Systems  |
+|---------------------------|-------------------------------------------------------------------|---------------------|
+| **alpine-image-nap-v5-plus-fips** | Builds a Alpine-based image with NGINX Plus and the [NGINX App Protect WAF v5](/nginx-app-protect-waf/v5/) module with FIPS. | Alpine  |
+| **debian-image-nap-v5-plus** | Builds a Debian-based image with NGINX Plus and the [NGINX App Protect WAF v5](/nginx-app-protect-waf/v5/) module. | Debian  |
+| **ubi-image-nap-v5-plus**    | Builds a UBI-based image with NGINX Plus and the [NGINX App Protect WAF v5](/nginx-app-protect-waf/v5/) module. | OpenShift |
+| **ubi-image-nap-dos-v5-plus** | Builds a UBI-based image with NGINX Plus, [NGINX App Protect WAF v5](/nginx-app-protect-waf/v5/), and [NGINX App Protect DoS](/nginx-app-protect-dos/). | OpenShift |
+{{</bootstrap-table>}}
+
+<br>
+
+{{<see-also>}} For the complete list of _Makefile_ targets and customizable variables, see the [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md#makefile-details" >}}) guide. {{</see-also>}}
+
+If you intend to use [external references](/nginx-app-protect-waf/v5/configuration-guide/configuration/#external-references) in NGINX App Protect WAF policies, you may want to provide a custom CA certificate to authenticate with the hosting server.
+
+To do so, place the `*.crt` file in the build folder and uncomment the lines following this comment:
+`#Uncomment the lines below if you want to install a custom CA certificate`
+
+{{<warning>}} External references are deprecated in NGINX Ingress Controller and will not be supported in future releases. {{</warning>}}
+
+---
+
+## Push the images to your private registry
+
+Once you've successfully pulled the WAF v5 manager and enforcer images and built the NGINX Ingress Controller image with NGINX App Protect WAF v5, the next step is to upload them to your private Docker registry. This makes the image available for deployment to your Kubernetes cluster.
+
+To upload the image, run the following command. If you're using a custom tag, add `TAG=your-tag` to the end of the command. Replace `<my-docker-registry>` with your private registry's path.
+
+```shell
+make push PREFIX=<my-docker-registry>/nginx-plus-ingress
+```
+
+To upload the WAF config manager and enforcer images run the following commands:
+
+```shell
+docker push <my-docker-registry>/waf-config-mgr:<your-tag>
+```
+
+```shell
+docker push <my-docker-registry>/waf-enforcer:<your-tag>
+```
+
+---
+
+{{< include "/nic/installation/create-custom-resources.md" >}}
+
+
+## Deploy NGINX Ingress Controller {#deploy-ingress-controller}
+
+{{< important >}} NGINX Ingress Controller with the AppProtect WAF v5 module works only with policy bundles. You need to modify the Deployment or DaemonSet file to include volumes, volume mounts and two WAF 5 docker images: `waf-config-mgr` and `waf-enforcer`.
+
+NGINX Ingress Controller **requires** the volume mount path to be `/etc/app_protect/bundles`. {{< /important >}}
+
+{{<tabs name="deploy-nic">}}
+
+{{%tab name="With Helm"%}}
+
+Below are examples of a `PersistentVolume` and `PersistentVolumeClaim` that you can reference in your Helm values:
+
+```yaml
+...
+volumes:
+- name: <volume_name>
+persistentVolumeClaim:
+    claimName: <claim_name>
+...
+```
+
+Add volume mounts to the `containers` section:
+
+```yaml
+...
+volumeMounts:
+- name: <volume_mount_name>
+    mountPath: /etc/app_protect/bundles
+...
+```
+
+### Enabling WAF v5
+
+Start by setting `controller.appprotect.enable` to `true` in your Helm values. This will the standard App Protect WAF features.
+Afterwords, set `controller.approtect.v5` to `true`.
+This ensures that both the `waf-enforcer` and `waf-config-mgr` containers are deployed alongside the NGINX Ingress Controller containers.
+These two additional containers are required when using App Protect WAF v5.
+
+Your Helm values should look something like this:
+
+```yaml
+controller:
+  ...
+  ## Support for App Protect WAF
+  appprotect:
+    ## Enable the App Protect WAF module in the Ingress Controller.
+    enable: true
+    ## Enables App Protect WAF v5.
+    v5: true
+```
+
+
+### Configuring volumes
+
+Whether you have created a new `PersistentVolume` and `PersistentVolumeClaim`, or you are referencing an existing `PersistentVolumeClaim`, update the `app-protect-bundles` volume to reference your `PersistentVolumeClaim`.
+
+Example helm values:
+
+```yaml
+...
+controller:
+  ...
+  appprotect:
+  ...
+   volumes:
+   - name: app-protect-bundles
+     persistentVolumeClaim:
+        claimName: <my_claim_name>
+...
+```
+
+{{< note >}}
+By default, `emptyDir` mounts are used.
+Bundles that are added to these kind of volume mounts will **NOT** persist across pod restarts.
+
+Example default volumes:
+```yaml
+...
+controller:
+  ...
+  appprotect:
+  ...
+   volumes:
+   - name: app-protect-bundles
+     emptyDir: {}
+...
+```
+{{< /note >}}
+
+### Configuring `readOnlyRootFilesystem`
+
+Create required volumes:
+
+```yaml
+volumes:
+  - name: nginx-etc
+    emptyDir: {}
+  - name: nginx-cache
+    emptyDir: {}
+  - name: nginx-lib
+    emptyDir: {}
+  - name: nginx-log
+    emptyDir: {}
+  - emptyDir: {}
+    name: app-protect-bd-config
+  - emptyDir: {}
+    name: app-protect-config
+  - emptyDir: {}
+    name: app-protect-bundles
+```
+
+Set `controller.securityContext.readOnlyRootFilesystem` to `true`.
+
+Example Helm values:
+
+```yaml
+controller:
+  ...
+  securityContext:
+    readOnlyRootFilesystem: true
+  ...
+```
+
+Set `controller.appprotect.enforcer.securityContext.readOnlyRootFilesystem` to `true`.
+
+Example Helm values:
+
+```yaml
+controller:
+  ...
+  appprotect:
+    ...
+    enforcer:
+      securityContext:
+        readOnlyRootFilesystem: true
+  ...
+```
+
+Set `controller.appprotect.configManager.securityContext.readOnlyRootFilesystem` to `true`.
+
+Example Helm values:
+
+```yaml
+controller:
+  ...
+  appprotect:
+    ...
+    configManager:
+      securityContext:
+        readOnlyRootFilesystem: true
+  ...
+```
+
+{{%/tab%}}
+
+{{%tab name="With Manifest"%}}
+
+You have two options for deploying NGINX Ingress Controller:
+
+- **Deployment**. Choose this method for the flexibility to dynamically change the number of NGINX Ingress Controller replicas.
+- **DaemonSet**. Choose this method if you want NGINX Ingress Controller to run on all nodes or a subset of nodes.
+
+---
+
+### Set up role-based access control (RBAC) {#set-up-rbac}
+
+{{<call-out "important" "Admin access required" >}}To complete these steps you need admin access to your cluster. Refer to to your Kubernetes platform's documentation to set up admin access. For Google Kubernetes Engine (GKE), you can refer to their [Role-Based Access Control guide](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).{{</call-out>}}
+
+1. Create a namespace and a service account:
+
+    ```shell
+    kubectl apply -f deployments/common/ns-and-sa.yaml
+    ```
+
+2. Create a cluster role and binding for the service account:
+
+    ```shell
+    kubectl apply -f deployments/rbac/rbac.yaml
+    ```
+
+---
+
+### Volumes and VolumeMounts
+
+Add a `volumes` section to deployment template spec:
+
+```yaml
+...
+volumes:
+- name: <volume_name>
+persistentVolumeClaim:
+    claimName: <claim_name>
+...
+```
+
+Add volume mounts to the `containers` section:
+
+```yaml
+...
+volumeMounts:
+- name: <volume_mount_name>
+    mountPath: /etc/app_protect/bundles
+...
+```
+
+### WAF Config Manager and WAF Enforcer
+
+Add `waf-config-mgr` image to the `containers` section:
+
+```yaml
+...
+- name: waf-config-mgr
+  image: private-registry.nginx.com/nap/waf-config-mgr:<version-tag>
+  imagePullPolicy: IfNotPresent
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - all
+  volumeMounts:
+    - name: app-protect-bd-config
+      mountPath: /opt/app_protect/bd_config
+    - name: app-protect-config
+      mountPath: /opt/app_protect/config
+    - name: app-protect-bundles
+      mountPath: /etc/app_protect/bundles
+...
+```
+
+Add `waf-enforcer` image to the `containers` section:
+
+```yaml
+...
+- name: waf-enforcer
+  image: private-registry.nginx.com/nap/waf-enforcer:<version-tag>
+  imagePullPolicy: IfNotPresent
+  env:
+    - name: ENFORCER_PORT
+      value: "50000"
+    - name: ENFORCER_CONFIG_TIMEOUT
+      value: "0"
+  volumeMounts:
+    - name: app-protect-bd-config
+      mountPath: /opt/app_protect/bd_config
+...
+```
+
+### Update NIC container in deployment or daemonset
+
+Add `volumeMounts` as below:
+
+```yaml
+...
+- image: <my_docker_registry>:<version_tag>
+  imagePullPolicy: IfNotPresent
+  name: nginx-plus-ingress
+  volumeMounts:
+    - name: app-protect-bd-config
+      mountPath: /opt/app_protect/bd_config
+    - name: app-protect-config
+      mountPath: /opt/app_protect/config
+    - name: app-protect-bundles
+      mountPath: /etc/app_protect/bundles
+...
+```
+
+### Configure `readOnlyRootFilesystem`
+
+Add `readOnlyRootFilesystem` to the NIC container and set valut to `true` as below:
+
+```yaml
+...
+- image: <my_docker_registry>:<version_tag>
+  imagePullPolicy: IfNotPresent
+  name: nginx-plus-ingress
+  ...
+  securityContext:
+    allowPrivilegeEscalation: false
+      capabilities:
+        add:
+        - NET_BIND_SERVICE
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 101
+    readOnlyRootFilesystem: true
+  ...
+  volumeMounts:
+    - mountPath: /etc/nginx
+      name: nginx-etc
+    - mountPath: /var/cache/nginx
+      name: nginx-cache
+    - mountPath: /var/lib/nginx
+      name: nginx-lib
+    - mountPath: /var/log/nginx
+      name: nginx-log
+    - mountPath: /opt/app_protect/bd_config
+      name: app-protect-bd-config
+    - mountPath: /opt/app_protect/config
+      name: app-protect-config
+    - mountPath: /etc/app_protect/bundles
+      name: app-protect-bundles
+...
+```
+
+Add `readOnlyRootFilesystem` to the `waf-config-mgr` container and set value to `true` as below:
+
+```yaml
+...
+- name: waf-config-mgr
+  image: private-registry.nginx.com/nap/waf-config-mgr:<version-tag>
+  imagePullPolicy: IfNotPresent
+  ...
+  securityContext:
+    readOnlyRootFilesystem: true
+    ...
+...
+```
+
+Add `readOnlyRootFilesystem` to the `waf-enforcer` container and set value to `true` as below:
+
+```yaml
+...
+- name: waf-enforcer
+  image: private-registry.nginx.com/nap/waf-enforcer:<version-tag>
+  imagePullPolicy: IfNotPresent
+  ...
+  securityContext:
+    readOnlyRootFilesystem: true
+    ...
+...
+```
+
+### Using a Deployment
+
+{{< include "/nic/installation/manifests/deployment.md" >}}
+
+### Using a DaemonSet
+
+{{< include "/nic/installation/manifests/daemonset.md" >}}
+
+---
+
+### Enable NGINX App Protect WAF module
+
+To enable the NGINX App Protect DoS Module:
+
+- Add the `enable-app-protect` [command-line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-app-protect" >}}) to your Deployment or DaemonSet file.
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+---
+
+## Confirm NGINX Ingress Controller is running
+
+{{< include "/nic/installation/manifests/verify-pods-are-running.md" >}}
+
+For more information, see the [Configuration guide]({{< ref "/nic/installation/integrations/app-protect-waf-v5/configuration.md" >}}) and the NGINX Ingress Controller with App Protect version 5 example resources on GitHub [for VirtualServer resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5).
+
+---
+
+## Alternatives to building your own image {#pre-built-images}
+
+If you prefer not to build your own NGINX Ingress Controller image, you can use pre-built images. Here are your options:
+
+- Download the image using your NGINX Ingress Controller subscription certificate and key. View the [Get NGINX Ingress Controller from the F5 Registry]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic.
+- The [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic describes how to use your subscription JWT token to get the image.
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
new file mode 100644
index 000000000..65a76a872
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
@@ -0,0 +1,136 @@
+---
+title: Troubleshoot NGINX App Protect WAF
+weight: 400
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-000
+---
+
+This document describes how to troubleshoot problems when using NGINX Ingress Controller and the NGINX App Protect WAF module version 5.
+
+For general troubleshooting of NGINX Ingress Controller, check the general [troubleshooting]({{< ref "/nic/troubleshooting/troubleshoot-common" >}}) documentation.
+
+{{< see-also >}} You can find more troubleshooting tips in the NGINX App Protect WAF [troubleshooting guide](https://docs.nginx.com/nginx-app-protect-waf/v5/troubleshooting-guide/troubleshooting/) {{< /see-also >}}.
+
+## Potential problems
+
+The table below categorizes some potential problems with NGINX Ingress Controller when App Protect WAF module is enabled. It suggests how to troubleshoot those problems, using one or more methods from the next section.
+
+{{% table %}}
+|Problem area | Symptom | Troubleshooting method | Common cause |
+| ---| ---| ---| --- |
+|Start. | The Ingress Controller fails to start. | Check the logs. | Misconfigured policy bundle. |
+|Start | The configuration is not applied. | Check if a policy bundle is compiled using version of the compiler running in NGINX Ingress Controller. | Policy bundle is invalid. |
+|Start | The configuration is not applied. | Check if bundle is present in a volume. | Policy bundle is not present in the mounted volume. |
+|APLogConf, Policy or Ingress Resource. | The configuration is not applied. | Check the events of the APLogConf, Policy and Ingress Resource, check the logs, replace the policy bundle. | Policy bundle is invalid. |
+{{% /table %}}
+
+## Troubleshooting methods
+
+### Check NGINX Ingress Controller and App Protect logs
+
+App Protect logs are part of NGINX Ingress Controller logs when the module is enabled. To check NGINX Ingress Controller logs, follow the steps of [Checking the Ingress Controller Logs]({{< ref "/nic/troubleshooting/troubleshoot-common#checking-the-ingress-controller-logs" >}}) of the Troubleshooting guide.
+
+For App Protect specific logs, look for messages starting with `APP_PROTECT`, for example:
+
+```shell
+2020/07/10 11:13:20 [notice] 17#17: APP_PROTECT { "event": "configuration_load_success", "software_version": "2.52.1", "completed_successfully":true,"attack_signatures_package":{"revision_datetime":"2020-06-18T10:11:32Z","version":"2020.06.18"}}
+```
+
+### Check Ingress resource events
+
+Read the topic [Troubleshooting Ingress resources]({{< ref "/nic/troubleshooting/troubleshoot-ingress" >}}).
+
+### Check APLogConf events
+
+After you create or update an APLogConf, you can immediately check if the NGINX configuration was successfully applied by NGINX:
+
+```shell
+kubectl describe aplogconf logconf
+Name:         logconf
+Namespace:    default
+
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  11s   nginx-ingress-controller  AppProtectLogConfig  default/logconf was added or updated
+```
+
+Note that in the events section, we have a `Normal` event with the `AddedOrUpdated` reason, which informs us that the configuration was successfully applied.
+
+### Check APPolicy events
+
+After you create or update an APPolicy, you can immediately check if the NGINX configuration was successfully applied by NGINX:
+
+```shell
+kubectl describe appolicy dataguard-alarm
+Name:         dataguard-alarm
+Namespace:    default
+
+Events:
+  Type    Reason          Age    From                      Message
+  ----    ------          ----   ----                      -------
+  Normal  AddedOrUpdated  2m25s  nginx-ingress-controller  AppProtectPolicy default/dataguard-alarm was added or updated
+```
+
+The events section has a *Normal* event with the *AddedOrUpdated reason*, indicating the policy was successfully accepted.
+
+### Replace the policy
+
+{{< note >}} This method only applies if using [external references](/nginx-app-protect/v4/configuration/#external-references) {{< /note >}}
+
+If items on the external reference change but the spec of the APPolicy remains unchanged (even when re-applying the policy), Kubernetes will not detect the update.
+In this case you can force-replace the resource. This will remove the resource and add it again, triggering a reload. For example:
+
+```shell
+kubectl replace appolicy -f your-policy-manifest.yaml --force
+```
+
+### Check the availability of APPolicy external references
+
+{{< note >}} This method only applies if you're using [external references](/nginx-app-protect/v4/configuration/#external-references) in NGINX App Protect policies. {{< /note >}}
+
+To check which servers host the external references of a policy:
+
+```shell
+kubectl get appolicy mypolicy -o jsonpath='{.items[*].spec.policy.*.link}' | tr ' ' '\n'
+http://192.168.100.100/resources/headersettings.txt
+```
+
+You can check the total time a http request takes, in multiple ways eg. using curl:
+
+```shell
+curl -w '%{time_total}' http://192.168.100.100/resources/headersettings.txt
+```
+
+## Run App Protect in debug mode
+
+When you set NGINX Ingress Controller to use debug mode, the setting also applies to the App Protect WAF module.  See  [Running NGINX in the Debug Mode]({{< ref "/nic/troubleshooting/troubleshoot-common.md#enable-debugging-for-nginx-ingress-controller" >}}) for instructions.
+
+## Known issues
+
+When using NGINX Ingress Controller with the App Protect WAF module, the following issues have been reported. The occurrence of these issues is commonly related to a higher number of Ingress Resources with App Protect being enabled in a cluster.
+
+When you make a change that requires NGINX to apply a new configuration, NGINX Ingress Controller reloads NGINX automatically. Without the App Protect WAF module enabled, usual reload times are around 150ms. If App Protect WAF module is enabled and is being used by any number of Ingress Resources, these reloads might take a few seconds instead.
+
+### NGINX configuration drift
+
+If you are running more than one instance of NGINX Ingress Controller, the extended reload time may cause the NGINX configuration of your instances to be out of sync. This can occur because there is no order imposed on how NGINX Ingress Controller processes the Kubernetes Resources. The configurations will be the same after all instances have completed the reload.
+
+In order to reduce these inconsistencies, we advise that you do not apply changes to multiple resources handled by NGINX Ingress Controller at the same time.
+
+### NGINX fails to start or reload
+
+The first time NGINX Ingress Controller starts, or whenever there is a change that requires reloading NGINX, NGINX Ingress Controller will verify if the reload was successful. The timeout for this verification is normally 4 seconds. When App Protect is enabled, this timeout increases to 20 seconds.
+
+This timeout should be more than enough to verify configurations. However, when numerous Ingress resources with App Protect enabled are handled by NGINX Ingress Controller at the same time, you may find that you need to extend the timeout further. Examples of when this might be necessary include:
+
+- You need to apply a large amount of Ingress Resources at once.
+- You are running NGINX Ingress Controller for the first time in a cluster where the Ingress resources with App Protect enabled are already present.
+
+You can increase this timeout by setting the `nginx-reload-timeout` [cli-argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-nginx-reload-timeout" >}}).
+
+When using the User Defined Signature feature, an update to an `APUserSig` requires more reload time from NGINX Plus compared with the other AppProtect resources. As a consequence, we recommend increasing the `nginx-reload-timeout` to 30 seconds if you're planning to use this feature.
+
+If you are using external references in your NGINX App Protect policies, verify if the servers hosting the referenced resources are available and that their response time is as short as possible (see the Check the Availability of APPolicy External References section). If the references are not available during NGINX Ingress Controller startup, the pod will fail to start. In case the resources are not available during a reload, the reload will fail, and NGINX Plus will use the previous correct configuration.
diff --git a/content/nic/installation/integrations/app-protect-waf/_index.md b/content/nic/installation/integrations/app-protect-waf/_index.md
new file mode 100644
index 000000000..1a1573fec
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf/_index.md
@@ -0,0 +1,9 @@
+---
+title: NGINX App Protect WAF
+description: Learn how to use NGINX Ingress Controller for Kubernetes with NGINX App Protect.
+weight: 100
+aliases: ["/nginx-ingress-controller/app-protect/"]
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/installation/integrations/app-protect-waf/configuration.md b/content/nic/installation/integrations/app-protect-waf/configuration.md
new file mode 100644
index 000000000..50d2c6352
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf/configuration.md
@@ -0,0 +1,563 @@
+---
+title: Configure NGINX App Protect with NGINX Ingress Controller
+weight: 200
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-578
+---
+
+This document explains how to use F5 NGINX Ingress Controller to configure NGINX App Protect WAF.
+
+{{< note >}} Check out the complete NGINX Ingress Controller with NGINX App Protect WAF example resources on GitHub [for VirtualServer resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-waf) and [for Ingress resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf).{{< /note >}}
+
+
+## Global Configuration
+
+NGINX Ingress Controller has global configuration parameters that match those in NGINX App Protect WAF. They are found in the [ConfigMap resource]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#modules" >}}): the NGINX App Protect WAF parameters are prefixed with `app-protect*`.
+
+## Enable NGINX App Protect WAF
+
+NGINX App Protect WAF can be enabled and configured for custom resources (VirtualServer, VirtualServerRoute) or Ingress resources.
+
+- For custom resources, you need to create a Policy Custom Resource referencing the `APPolicy` custom resource or bundle, then add it to the VirtualServer definition. Additional detail can be found in the [Policy Resource documentation]({{< ref "/nic/configuration/policy-resource.md#waf" >}}).
+- For Ingress resources, apply the [`app-protect` annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#app-protect" >}}) to each desired resource.
+
+
+## NGINX App Protect WAF Policies {#waf-policies}
+
+NGINX App Protect WAF Policies can be created for VirtualServer, VirtualServerRoute, or Ingress resources by creating an `APPolicy` [custom resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/). There are some caveats:
+
+- The fields `policy.signature-requirements[].minRevisionDatetime` and `policy.signature-requirements[].maxRevisionDatetime` are not supported.
+- [The Advanced gRPC Protection for Unary Traffic](/nginx-app-protect-waf/v4/configuration-guide/configuration/#grpc-protection-for-unary-traffic) only supports providing an `idl-file` inline. The fields `policy.idl-files[].link`, `policy.idl-files[].$ref`, and
+ `policy.idl-files[].file` are not supported. The IDL file should be provided in field `policy.idl-files[].contents`. The value of this field can be base64 encoded. In this case the field `policy.idl-files[].isBase64` should be set to `true`.
+
+{{<warning>}} External references are deprecated in NGINX Ingress Controller and will not be supported in future releases. {{</warning>}}
+
+To add an [NGINX App Protect WAF policy](/nginx-app-protect-waf/v4/declarative-policy/policy/) to an Ingress resource:
+
+1. Create an `APPolicy` custom resource manifest.
+1. Add the policy to the `spec` field in the `APPolicy` resource.
+
+A resource specification and its Policy JSON **must** match. The fields must be identical in name and nesting level. If the resources are defined with YAML, the policy must also be represented in YAML.
+
+As an example, this is a [DataGuard policy](/nginx-app-protect-waf/v4/declarative-policy/policy/#policy/data-guard):
+
+```json
+{
+    "policy": {
+        "name": "dataguard_blocking",
+        "template": { "name": "POLICY_TEMPLATE_NGINX_BASE" },
+        "applicationLanguage": "utf-8",
+        "enforcementMode": "blocking",
+        "blocking-settings": {
+            "violations": [
+                {
+                    "name": "VIOL_DATA_GUARD",
+                    "alarm": true,
+                    "block": true
+                }
+            ]
+        },
+        "data-guard": {
+            "enabled": true,
+            "maskData": true,
+            "creditCardNumbers": true,
+            "usSocialSecurityNumbers": true,
+            "enforcementMode": "ignore-urls-in-list",
+            "enforcementUrls": []
+        }
+    }
+}
+  ```
+
+This is what its corresponding `APPolicy` resource defined in the `spec` would look like:
+
+```yaml
+apiVersion: appprotect.f5.com/v1beta1
+kind: APPolicy
+metadata:
+  name: dataguard-blocking
+spec:
+  policy:
+    name: dataguard_blocking
+    template:
+      name: POLICY_TEMPLATE_NGINX_BASE
+    applicationLanguage: utf-8
+    enforcementMode: blocking
+    blocking-settings:
+      violations:
+      - name: VIOL_DATA_GUARD
+        alarm: true
+        block: true
+    data-guard:
+      enabled: true
+      maskData: true
+      creditCardNumbers: true
+      usSocialSecurityNumbers: true
+      enforcementMode: ignore-urls-in-list
+      enforcementUrls: []
+```
+
+Notice that the fields match in name and nesting: NGINX Ingress Controller will transform the YAML into a valid JSON WAF policy config.
+
+## NGINX App Protect WAF Logs {#waf-logs}
+
+Configuring
+
+You can set the [NGINX App Protect WAF log configurations](/nginx-app-protect-waf/v4/logging-overview/logs-overview/) by creating an `APLogConf` [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+To add the [log configurations](/nginx-app-protect-waf/v4/logging-overview/security-log/) to a VirtualServer or an Ingress resource:
+
+1. Create an `APLogConf` Custom Resource manifest.
+1. Add the log configuration to the `spec` field in the `APLogConf` resource.
+1. Add a reference to `APLogConf` in the [VirtualServer Policy resource]({{< ref "/nic/configuration/policy-resource.md#waf" >}}) or the [Ingress resource]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#app-protect" >}}) as per the documentation.
+
+{{< note >}}
+
+The fields from the JSON must be presented in the YAML *exactly* the same, in name and level. NGINX Ingress Controller will transform the YAML into a valid JSON WAF log config.
+
+{{< /note >}}
+
+For example, say you want to [log state changing requests](/nginx-app-protect-waf/v4/logging-overview/security-log/#security-log-configuration-file) for your VirtualServer or Ingress resources using NGINX App Protect WAF. The  log configuration looks like this:
+
+```json
+{
+    "filter": {
+        "request_type": "all"
+    },
+    "content": {
+        "format": "default",
+        "max_request_size": "any",
+        "max_message_size": "64k"
+    }
+}
+```
+
+You would define that config in the `spec` of your `APLogConf` resource as follows:
+
+```yaml
+apiVersion: appprotect.f5.com/v1beta1
+kind: APLogConf
+metadata:
+  name: logconf
+spec:
+  filter:
+    request_type: all
+  content:
+    format: default
+    max_request_size: any
+    max_message_size: 64k
+```
+
+## NGINX App Protect WAF User Defined Signatures
+
+You can define NGINX App Protect WAF [User-Defined Signatures](/nginx-app-protect-waf/v4/configuration-guide/configuration/#user-defined-signatures) for your VirtualServer or Ingress resources by creating an `APUserSig` [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
+
+{{< note >}}
+
+The field `revisionDatetime` is not currently supported.
+
+`APUserSig` resources increase the reload time of NGINX Plus compared with `APPolicy` and `APLogConf` resources. Read [NGINX fails to start or reload]({{< ref "/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md#nginx-fails-to-start-or-reload" >}}) for more information.
+
+{{< /note >}}
+
+To add the [User Defined Signatures](/nginx-app-protect-waf/v4/configuration-guide/configuration/#user-defined-signatures) to a VirtualServer or Ingress resource:
+
+1. Create an `APUserSig` Custom resource manifest.
+2. Add the desired User defined signature to the `spec` field in the `APUserSig` resource.
+
+{{< note >}}
+
+The fields from the JSON must be presented in the YAML *exactly* the same, in name and level.
+
+NGINX Ingress Controller will transform the YAML into a valid JSON User-Defined signature. There is no need to reference the user defined signature resource in the Policy or Ingress resources.
+
+{{< /note >}}
+
+For example, say you want to create the following user defined signature:
+
+```json
+{  "softwareVersion": "15.1.0",
+    "tag": "Fruits",
+    "signatures": [
+      {
+      "name": "Apple_medium_acc",
+      "rule": "content:\"apple\"; nocase;",
+      "signatureType": "request",
+      "attackType": {
+         "name": "Brute Force Attack"
+      },
+      "systems": [
+         {"name": "Microsoft Windows"},
+         {"name": "Unix/Linux"}
+                     ],
+      "risk": "medium",
+      "accuracy": "medium",
+      "description": "Medium accuracy user defined signature with tag (Fruits)"
+      }
+   ]
+}
+```
+
+You would add that config in the `spec` of your `APUserSig` resource as follows:
+
+```yaml
+apiVersion: appprotect.f5.com/v1beta1
+kind: APUserSig
+metadata:
+  name: apple
+spec:
+  signatures:
+  - accuracy: medium
+    attackType:
+      name: Brute Force Attack
+    description: Medium accuracy user defined signature with tag (Fruits)
+    name: Apple_medium_acc
+    risk: medium
+    rule: content:"apple"; nocase;
+    signatureType: request
+    systems:
+    - name: Microsoft Windows
+    - name: Unix/Linux
+  softwareVersion: 15.1.0
+  tag: Fruits
+```
+
+## NGINX App Protect WAF Bundles {#waf-bundles}
+
+You can define App Protect WAF bundles for VirtualServer custom resources by creating policy bundles and putting them on a mounted volume accessible from NGINX Ingress Controller.
+
+Before applying a policy, a WAF policy bundle must be created, then copied to a volume mounted to `/etc/nginx/waf/bundles`.
+
+{{< note >}} NGINX Ingress Controller supports `securityLogs` for policy bundles when using `apLogBundle` instead of `apLogConf`. Log bundles must also be copied to a volume mounted to `/etc/nginx/waf/bundles`. {{< /note >}}
+
+This example shows how a policy is configured by referencing a generated WAF Policy Bundle:
+
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: <policy_name>
+spec:
+  waf:
+    enable: true
+    apBundle: "<policy_bundle_name>.tgz"
+```
+
+This example shows the same policy as above but with a log bundle used for security log configuration:
+
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: <policy_name>
+spec:
+  waf:
+    enable: true
+    apBundle: "<policy_bundle_name>.tgz"
+    securityLogs:
+    - enable: true
+      apLogBundle: "<log_bundle_name>.tgz"
+      logDest: "syslog:server=syslog-svc.default:514"
+```
+
+## OpenAPI Specification in NGINX Ingress Controller
+
+The OpenAPI Specification defines the spec file format needed to describe RESTful APIs. The spec file can be written either in JSON or YAML. Using a spec file simplifies the work of implementing API protection. Refer to the [OpenAPI Specification](https://github.com/OAI/OpenAPI-Specification) (formerly called Swagger) for details.
+
+NGINX Ingress Controller supports OpenAPI Specification versions 2.0 and 3.0.
+
+The simplest way to create an API protection policy is using an OpenAPI Specification file to import the details of the APIs. If you use an OpenAPI Specification file, NGINX App Protect WAF will automatically create a policy for the following properties (depending on what's included in the spec file):
+
+- Methods
+- URLs
+- Parameters
+- JSON profiles
+
+An OpenAPI-ready policy template is provided with the NGINX App Protect WAF packages and is located in: `/etc/app_protect/conf/NginxApiSecurityPolicy.json`
+
+It contains violations related to OpenAPI set to blocking (enforced).
+
+### Types of OpenAPI References
+
+There are different ways of referencing OpenAPI Specification files. The configuration is similar to [External References](/nginx-app-protect-waf/v4/configuration-guide/configuration/#external-references).
+
+**Note**: Any update of an OpenAPI Specification file referenced in the policy will not trigger a policy compilation. This action needs to be done actively by reloading the NGINX configuration.
+
+#### URL Reference
+
+URL reference is the method of referencing an external source by providing its full URL.
+
+Make sure to configure certificates prior to using the HTTPS protocol - see the [External References](/nginx-app-protect-waf/v4/configuration-guide/configuration/#types-of-references) for details.
+
+## Configuration in NGINX Ingress Controller
+
+These are the typical steps to deploy an OpenAPI protection Policy in NGINX Ingress Controller:
+
+1. Copy the API security policy `/etc/app_protect/conf/NginxApiSecurityPolicy.json` to a different file so that it can be edited.
+2. Add the reference to the desired OpenAPI file.
+3. Make other custom changes if needed (e.g. enable Data Guard protection).
+4. Use a tool to convert the result to YAML. There are many, for example: [`yq` utility](https://github.com/mikefarah/yq).
+5. Add the YAML properties to create an `APPolicy` Custom Resource putting the policy itself (as in step 4) within the `spec` property of the Custom Resource. Refer to the [NGINX App Protect Policies](#nginx-app-protect-waf-policies) section above.
+6. Create a `Policy` object which references the `APPolicy` Custom Resource as in [this example](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/waf.yaml).
+7. Finally, attach the `Policy` object to a `VirtualServer` resource as in [this example](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/virtual-server.yaml).
+
+{{< note >}} You need to make sure that the server where the resource files are located is available while you are compiling your policy. {{< /note >}}
+
+### Example Configuration
+
+In this example, we are adding an OpenAPI Specification file reference to `/etc/app_protect/conf/NginxApiSecurityPolicy.yaml` using the [link](https://raw.githubusercontent.com/aws-samples/api-gateway-secure-pet-store/master/src/main/resources/swagger.yaml). This will configure allowed data types for `query_int` and `query_str` parameters values.
+
+**Policy configuration:**
+
+```yaml
+---
+apiVersion: appprotect.f5.com/v1beta1
+  kind: APPolicy
+  metadata:
+    name: petstore_api_security_policy
+  spec:
+    policy:
+      name: petstore_api_security_policy
+      description: NGINX App Protect WAF API Security Policy for the Petstore API
+      template:
+        name: POLICY_TEMPLATE_NGINX_BASE
+      open-api-files:
+      - link: https://raw.githubusercontent.com/aws-samples/api-gateway-secure-pet-store/master/src/main/resources/swagger.yaml
+      blocking-settings:
+        violations:
+        - block: true
+          description: Disallowed file upload content detected in body
+          name: VIOL_FILE_UPLOAD_IN_BODY
+        - block: true
+          description: Mandatory request body is missing
+          name: VIOL_MANDATORY_REQUEST_BODY
+        - block: true
+          description: Illegal parameter location
+          name: VIOL_PARAMETER_LOCATION
+        - block: true
+          description: Mandatory parameter is missing
+          name: VIOL_MANDATORY_PARAMETER
+        - block: true
+          description: JSON data does not comply with JSON schema
+          name: VIOL_JSON_SCHEMA
+        - block: true
+          description: Illegal parameter array value
+          name: VIOL_PARAMETER_ARRAY_VALUE
+        - block: true
+          description: Illegal Base64 value
+          name: VIOL_PARAMETER_VALUE_BASE64
+        - block: true
+          description: Disallowed file upload content detected
+          name: VIOL_FILE_UPLOAD
+        - block: true
+          description: Illegal request content type
+          name: VIOL_URL_CONTENT_TYPE
+        - block: true
+          description: Illegal static parameter value
+          name: VIOL_PARAMETER_STATIC_VALUE
+        - block: true
+          description: Illegal parameter value length
+          name: VIOL_PARAMETER_VALUE_LENGTH
+        - block: true
+          description: Illegal parameter data type
+          name: VIOL_PARAMETER_DATA_TYPE
+        - block: true
+          description: Illegal parameter numeric value
+          name: VIOL_PARAMETER_NUMERIC_VALUE
+        - block: true
+          description: Parameter value does not comply with regular expression
+          name: VIOL_PARAMETER_VALUE_REGEXP
+        - block: true
+          description: Illegal URL
+          name: VIOL_URL
+        - block: true
+          description: Illegal parameter
+          name: VIOL_PARAMETER
+        - block: true
+          description: Illegal empty parameter value
+          name: VIOL_PARAMETER_EMPTY_VALUE
+        - block: true
+          description: Illegal repeated parameter name
+          name: VIOL_PARAMETER_REPEATED
+```
+
+Content of the referenced file `myapi.yaml`:
+
+```yaml
+openapi: 3.0.1
+info:
+  title: 'Primitive data types'
+  description: 'Primitive data types.'
+  version: '2.5.0'
+servers:
+  - url: http://localhost
+paths:
+  /query:
+    get:
+      tags:
+        - query_int_str
+      description: query_int_str
+      operationId: query_int_str
+      parameters:
+        - name: query_int
+          in: query
+          required: false
+          allowEmptyValue: false
+          schema:
+            type: integer
+        - name: query_str
+          in: query
+          required: false
+          allowEmptyValue: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+        404:
+          description: NotFound
+```
+
+In this case, the following request will trigger an `Illegal parameter data type` violation, as we expect to have an integer value in the `query_int` parameter:
+
+```none
+http://localhost/query?query_int=abc
+```
+
+The request will be blocked.
+
+The `link` option is also available in the `openApiFileReference` property and is synonymous with the `open-api-files` property as seen in the policy example above.
+
+**Note**: `openApiFileReference` is not an array.
+
+## Configuration in NGINX Plus Ingress Controller using Virtual Server Resource
+
+In this example we deploy NGINX Ingress Controller with NGINX Plus and NGINX App Protect WAF, deploy a simple web application, and then configure load balancing and WAF protection for that application using the VirtualServer resource.
+
+{{< note >}} You can find the example, and the files referenced, on [GitHub](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-waf).{{< /note >}}
+
+## Prerequisites
+
+1. Follow the installation [instructions]({{< ref "/nic/installation/integrations/app-protect-waf/installation.md" >}}) to deploy NGINX Ingress Controller with NGINX Plus and NGINX App Protect WAF.
+2. Save the public IP address of NGINX Ingress Controller into a shell variable:
+
+   ```shell
+    IC_IP=XXX.YYY.ZZZ.III
+   ```
+
+3. Save the HTTP port of NGINX Ingress Controller into a shell variable:
+
+   ```shell
+    IC_HTTP_PORT=<port number>
+   ```
+
+### Step 1. Deploy a Web Application
+
+Create the application deployment and service:
+
+  ```console
+  kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/webapp.yaml
+  ```
+
+### Step 2. Deploy the AP Policy
+
+1. Create the syslog service and pod for the NGINX App Protect WAF security logs:
+
+   ```console
+   kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/syslog.yaml
+   ```
+
+2. Create the User-Defined Signature, WAF policy, and log configuration:
+
+    ```console
+    kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/ap-apple-uds.yaml
+    kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/ap-dataguard-alarm-policy.yaml
+    kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/ap-logconf.yaml
+    ```
+
+### Step 3 - Deploy the WAF Policy
+
+Create the WAF policy
+
+ ```console
+  kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/waf.yaml
+ ```
+
+  Note the NGINX App Protect WAF configuration settings in the Policy resource. They enable WAF protection by configuring NGINX App Protect WAF with the policy and log configuration created in the previous step.
+
+### Step 4 - Configure Load Balancing
+
+1. Create the VirtualServer Resource:
+
+    ```console
+    kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/virtual-server.yaml
+    ```
+
+Note that the VirtualServer references the policy waf-policy created in Step 3.
+
+### Step 5 - Test the Application
+
+To access the application, curl the coffee and the tea services. We'll use the --resolve option to set the Host header of a request with `webapp.example.com`
+
+1. Send a request to the application:
+
+  ```shell
+  curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT/
+  ```
+  ```shell
+  Server address: 10.12.0.18:80
+  Server name: webapp-7586895968-r26zn
+  ```
+
+2. Now, let's try to send a request with a suspicious URL:
+
+  ```shell
+  curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP "http://webapp.example.com:$IC_HTTP_PORT/<script>"
+  ```
+  ```shell
+  <html><head><title>Request Rejected</title></head><body>
+  ```
+
+3. Lastly, let's try to send some suspicious data that matches the user defined signature.
+
+  ```shell
+  curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP -X POST -d "apple" http://webapp.example.com:$IC_HTTP_PORT/
+  ```
+  ```shell
+  <html><head><title>Request Rejected</title></head><body>
+  ```
+
+  As you can see, the suspicious requests were blocked by NGINX App Protect WAF.
+
+4. To check the security logs in the syslog pod:
+
+  ```shell
+  kubectl exec -it <SYSLOG_POD> -- cat /var/log/messages
+  ```
+
+### Configuration Example of Virtual Server
+
+Refer to GitHub repo for [Virtual Server example](https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/custom-resources/app-protect-waf/webapp.yaml).
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: webapp
+spec:
+  host: webapp.example.com
+  policies:
+  - name: waf-policy
+  upstreams:
+  - name: webapp
+    service: webapp-svc
+    port: 80
+  routes:
+  - path: /
+    action:
+      pass: webapp
+```
diff --git a/content/nic/installation/integrations/app-protect-waf/installation.md b/content/nic/installation/integrations/app-protect-waf/installation.md
new file mode 100644
index 000000000..08e7404e9
--- /dev/null
+++ b/content/nic/installation/integrations/app-protect-waf/installation.md
@@ -0,0 +1,221 @@
+---
+title: Build NGINX Ingress Controller with NGINX App Protect WAF
+weight: 100
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-579
+---
+
+This document explains how to build a F5 NGINX Ingress Controller image with F5 NGINX App Protect WAF from source code.
+
+{{<call-out "tip" "Pre-built image alternatives" >}} If you'd rather not build your own NGINX Ingress Controller image, see the [pre-built image options](#pre-built-images) at the end of this guide.{{</call-out>}}
+
+## Before you start
+
+- To use NGINX App Protect WAF with NGINX Ingress Controller, you must have NGINX Plus.
+
+## Prepare the environment
+
+Get your system ready for building and pushing the NGINX Ingress Controller image with NGINX App Protect WAF.
+
+1. Sign in to your private registry. Replace `<my-docker-registry>` with the path to your own private registry.
+
+    ```shell
+    docker login <my-docker-registry>
+    ```
+
+1. Clone the NGINX Ingress Controller repository:
+
+    ```console
+    git clone https://github.com/nginx/kubernetes-ingress.git --branch v{{< nic-version >}}
+    cd kubernetes-ingress
+    ```
+
+---
+
+## Build the image
+
+Follow these steps to build the NGINX Controller Image with NGINX App Protect WAF.
+
+1. Place your NGINX Plus license files (_nginx-repo.crt_ and _nginx-repo.key_) in the project's root folder. To verify they're in place, run:
+
+    ```shell
+    ls nginx-repo.*
+    ```
+
+    You should see:
+
+    ```shell
+    nginx-repo.crt  nginx-repo.key
+    ```
+
+2. Build the image. Replace `<makefile target>` with your chosen build option and `<my-docker-registry>` with your private registry's path. Refer to the [Makefile targets](#makefile-targets) table below for the list of build options.
+
+    ```shell
+    make <makefile target> PREFIX=<my-docker-registry>/nginx-plus-ingress TARGET=download
+    ```
+
+    For example, to build a Debian-based image with NGINX Plus and NGINX App Protect DoS, run:
+
+    ```shell
+    make debian-image-dos-plus PREFIX=<my-docker-registry>/nginx-plus-ingress TARGET=download
+    ```
+
+     **What to expect**: The image is built and tagged with a version number, which is derived from the `VERSION` variable in the [_Makefile_]({{< ref "/nic/installation/build-nginx-ingress-controller.md#makefile-details" >}}). This version number is used for tracking and deployment purposes.
+
+{{<note>}} In the event a patch of NGINX Plus is released, make sure to rebuild your image to get the latest version. If your system is caching the Docker layers and not updating the packages, add `DOCKER_BUILD_OPTIONS="--pull --no-cache"` to the make command. {{</note>}}
+
+### Makefile targets {#makefile-targets}
+
+{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
+| Makefile Target           | Description                                                       | Compatible Systems  |
+|---------------------------|-------------------------------------------------------------------|---------------------|
+| **debian-image-nap-plus** | Builds a Debian-based image with NGINX Plus and the [NGINX App Protect WAF](/nginx-app-protect-waf/) module. | Debian  |
+| **debian-image-nap-dos-plus** | Builds a Debian-based image with NGINX Plus, [NGINX App Protect WAF](/nginx-app-protect-waf/), and [NGINX App Protect DoS](/nginx-app-protect-dos/) | Debian  |
+| **ubi-image-nap-plus**    | Builds a UBI-based image with NGINX Plus and the [NGINX App Protect WAF](/nginx-app-protect-waf/) module. | OpenShift |
+| **ubi-image-nap-dos-plus** | Builds a UBNI-based image with NGINX Plus, [NGINX App Protect WAF](/nginx-app-protect-waf/), and [NGINX App Protect DoS](/nginx-app-protect-dos/). | OpenShift |
+{{</bootstrap-table>}}
+
+<br>
+
+{{< see-also >}} For the complete list of _Makefile_ targets and customizable variables, see the [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md#makefile-details" >}}) topic. {{</ see-also >}}
+
+---
+
+## Push the image to your private registry
+
+Once you've successfully built the NGINX Ingress Controller image with NGINX App Protect WAF, the next step is to upload it to your private Docker registry. This makes the image available for deployment to your Kubernetes cluster.
+
+To upload the image, run the following command. If you're using a custom tag, add `TAG=your-tag` to the end of the command. Replace `<my-docker-registry>` with your private registry's path.
+
+```shell
+make push PREFIX=<my-docker-registry>/nginx-plus-ingress
+```
+
+---
+
+## Set up role-based access control (RBAC) {#set-up-rbac}
+
+{{< include "/nic/rbac/set-up-rbac.md" >}}
+
+---
+
+## Create common resources {#create-common-resources}
+
+{{< include "/nic/installation/create-common-resources.md" >}}
+
+---
+
+## Create core custom resources {#create-custom-resources}
+
+
+{{< include "/nic/installation/create-custom-resources.md" >}}
+
+---
+
+## Create App Protect WAF custom resources
+
+{{< note >}} If you're using NGINX Ingress Controller with the App Protect WAF module and policy bundles, you can skip this section. You will need to create and configure [Persistent Volume and Persistent Volume Claim](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) in your Kubernetes cluster. {{< /note >}}
+
+<br>
+
+{{<tabs name="install-waf-crds">}}
+
+{{%tab name="Install CRDs from single YAML"%}}
+
+This single YAML file creates CRDs for the following resources:
+
+- `APPolicy`
+- `APLogConf`
+- `APUserSig`
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/deploy/crds-nap-waf.yaml
+```
+
+{{%/tab%}}
+
+{{%tab name="Install CRDs after cloning the repo"%}}
+
+{{< note >}} If you are installing the CRDs this way, ensure you have first cloned the repository. {{< /note >}}
+
+These YAML files create CRDs for the following resources:
+
+- `APPolicy`
+- `APLogConf`
+- `APUserSig`
+
+```shell
+kubectl apply -f config/crd/bases/appprotect.f5.com_appolicies.yaml
+kubectl apply -f config/crd/bases/appprotect.f5.com_aplogconfs.yaml
+kubectl apply -f config/crd/bases/appprotect.f5.com_apusersigs.yaml
+```
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+---
+
+## Deploy NGINX Ingress Controller {#deploy-ingress-controller}
+
+{{< include "/nic/installation/deploy-controller.md" >}}
+
+{{< note >}} If you're using NGINX Ingress Controller with the AppProtect WAF module and policy bundles, you will need to modify the Deployment or DaemonSet file to include volumes and volume mounts.
+
+NGINX Ingress Controller **requires** the volume mount path to be `/etc/nginx/waf/bundles`. {{< /note >}}
+
+Add a `volumes` section to deployment template spec:
+
+```yaml
+...
+volumes:
+- name: <volume_name>
+persistentVolumeClaim:
+    claimName: <claim_name>
+...
+```
+
+Add volume mounts to the `containers` section:
+
+```yaml
+...
+volumeMounts:
+- name: <volume_mount_name>
+    mountPath: /etc/nginx/waf/bundles
+...
+```
+
+### Using a Deployment
+
+{{< include "/nic/installation/manifests/deployment.md" >}}
+
+### Using a DaemonSet
+
+{{< include "/nic/installation/manifests/daemonset.md" >}}
+
+---
+
+## Enable NGINX App Protect WAF module
+
+To enable the NGINX App Protect DoS Module:
+
+- Add the `enable-app-protect` [command-line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-enable-app-protect" >}}) to your Deployment or DaemonSet file.
+
+---
+
+## Confirm NGINX Ingress Controller is running
+
+{{< include "/nic/installation/manifests/verify-pods-are-running.md" >}}
+
+For more information, see the [Configuration guide]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md" >}}) and the NGINX Ingress Controller with App Protect example resources on GitHub [for VirtualServer resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-waf) and [for Ingress resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/app-protect-waf).
+
+---
+
+## Alternatives to building your own image {#pre-built-images}
+
+If you prefer not to build your own NGINX Ingress Controller image, you can use pre-built images. Here are your options:
+
+- Download the image using your NGINX Ingress Controller subscription certificate and key. View the [Get NGINX Ingress Controller from the F5 Registry]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic.
+- The [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic describes how to use your subscription JWT token to get the image.
diff --git a/content/nic/installation/integrations/f5-ingresslink.md b/content/nic/installation/integrations/f5-ingresslink.md
new file mode 100644
index 000000000..1e06bbab7
--- /dev/null
+++ b/content/nic/installation/integrations/f5-ingresslink.md
@@ -0,0 +1,95 @@
+---
+docs: DOCS-600
+doctypes:
+- concept
+title: F5 BIG-IP
+toc: true
+weight: 400
+---
+
+Learn how to use F5 IngressLink with NGINX Ingress Controller to configure your F5 BIG-IP device.
+
+F5 IngressLink is an integration between NGINX Ingress Controller and [F5 BIG-IP Container Ingress Services](https://clouddocs.f5.com/containers/latest/) (CIS) that configures an F5 BIG-IP device as a load balancer for NGINX Ingress Controller pods.
+
+## Install NGINX Ingress Controller with the integration enabled
+
+The steps to enable the integration depend on the option chosen to install NGINX Ingress Controller: Using [Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests" >}}) or using the [Helm chart]({{< ref "/nic/installation/installing-nic/installation-with-helm" >}}).
+
+### Installation using manifests
+
+1. Create a service for the Ingress Controller pods for ports 80 and 443. For example:
+
+    ```yaml
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: nginx-ingress-ingresslink
+      namespace: nginx-ingress
+      labels:
+        app: ingresslink
+    spec:
+      ports:
+      - port: 80
+        targetPort: 80
+        protocol: TCP
+        name: http
+      - port: 443
+        targetPort: 443
+        protocol: TCP
+        name: https
+      selector:
+        app: nginx-ingress
+    ```
+
+    Note the label `app: ingresslink`. We will use it in the [Configure CIS](#configure-cis) step.
+
+1. In the [ConfigMap resource]({{< ref "/nic/configuration/global-configuration/configmap-resource" >}}) enable the proxy protocol, which the BIG-IP system will use to pass the client IP and port information to NGINX. For the  `set-real-ip-from` key, use the subnet of the IP which the BIG-IP system uses to send traffic to NGINX:
+
+    ```yaml
+    proxy-protocol: "True"
+    real-ip-header: "proxy_protocol"
+    set-real-ip-from: "0.0.0.0/0"
+    ```
+
+1. Deploy NGINX Ingress Controller with additional [command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}):
+
+    ```yaml
+    args:
+    - -ingresslink=nginx-ingress
+    - -report-ingress-status
+    . . .
+    ```
+
+    where `ingresslink` references the name of the IngressLink resource from step 1, and `report-ingress-status` enables [reporting ingress statuses]({{< ref "/nic/configuration/global-configuration/reporting-resources-status#ingress-resources" >}}).
+
+### Installation using Helm
+
+Install a Helm release with the following values:
+
+```yaml
+controller:
+  config:
+    entries:
+      proxy-protocol: "True"
+      real-ip-header: "proxy_protocol"
+      set-real-ip-from: "0.0.0.0/0"
+  reportIngressStatus:
+    ingressLink: nginx-ingress
+  service:
+    type: ClusterIP
+    externalTrafficPolicy: Cluster
+    extraLabels:
+      app: ingresslink
+```
+
+We will use the `ingressLink` and `extraLabels` parameter values to configure CIS in the next section. For the  `set-real-ip-from` key, use the subnet of the IP which the BIG-IP system uses to send traffic to NGINX.
+
+## Configure CIS
+
+To enable the integration, F5 BIG-IP Container Ingress Services must be deployed in the cluster and configured to support the integration. Follow the instructions on the [CIS documentation portal](https://clouddocs.f5.com/containers/latest/userguide/ingresslink/#configuring-ingresslink).
+
+Make sure that:
+
+- The name of the IngressLink resource is the same as the one used during the installation of NGINX Ingress Controller (`nginx-ingress` in the previous example).
+- The selector in the IngressLink resource is the same as the Service labels configured during Ingress Controller installation (`app: ingresslink` in the previous example).
+- The IngressLink must belong to the same namespace as the Ingress Controller pod (`nginx-ingress` or the namespace used for installing the Helm chart).
diff --git a/content/nic/installation/integrations/nic-n1-console.md b/content/nic/installation/integrations/nic-n1-console.md
new file mode 100644
index 000000000..231c9c329
--- /dev/null
+++ b/content/nic/installation/integrations/nic-n1-console.md
@@ -0,0 +1,130 @@
+---
+title: Connect NGINX Ingress Controller to NGINX One Console
+toc: true
+draft: true
+weight: 1800
+nd-type: how-to
+nd-product: NIC
+---
+
+This document explains how to connect F5 NGINX Ingress Controller to NGINX One Console using NGINX Agent.
+
+Connecting NGINX Ingress Controller to NGINX One Console enables centralized monitoring of all controller instances.
+
+## Deploy NGINX Ingress Controller with NGINX Agent
+
+{{<tabs name="deploy-config-resource">}}
+
+{{%tab name="Helm"%}}
+
+Edit your `values.yaml` file to enable NGINX Agent and configure it to connect to NGINX One Console:
+```yaml
+nginxAgent:
+  enable: true
+  dataplaneKey: "<Your Dataplane Key>"
+```
+
+ The `dataplaneKey` is used to authenticate the agent with NGINX One Console. See the NGINX One Console Docs [here](https://docs.nginx.com/nginx-one/getting-started/#generate-data-plane-key) to generate your dataplane key from the NGINX One Console.
+
+
+Follow the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) instructions to deploy NGINX Ingress Controller.
+
+{{%/tab%}}
+
+{{%tab name="Manifests"%}}
+
+Add the following flag to the deployment/daemonset file of NGINX Ingress Controller:
+
+```yaml
+args:
+- -agent=true
+```
+
+Create a ConfigMap with an `nginx-agent.conf` file:
+
+```yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: nginx-agent-config
+  namespace: <namespace>
+data:
+  nginx-agent.conf: |-
+  log:
+    # set log level (error, info, debug; default "info")
+    level: info
+    # set log path. if empty, don't log to file.
+    path: ""
+
+  allowed_directories:
+    - /etc/nginx
+    - /usr/lib/nginx/modules
+
+  features:
+    - certificates
+    - connection
+    - metrics
+    - file-watcher
+
+  ## command server settings
+  command:
+    server:
+      host: product.connect.nginx.com
+      port: 443
+    auth:
+      token: "<Your Dataplane Key>"
+    tls:
+      skip_verify: false
+```      
+  
+Make sure you set the namespace in the nginx-agent-config to the same namespace as NGINX Ingress Controller.
+
+Mount the ConfigMap to the deployment/daemonset file of NGINX Ingress Controller:
+
+```yaml
+volumeMounts:
+- name: nginx-agent-config
+  mountPath: /etc/nginx-agent/nginx-agent.conf
+  subPath: nginx-agent.conf
+volumes:
+- name: nginx-agent-config
+  configMap:
+    name: nginx-agent-config
+```
+
+Follow the [Installation with Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) instructions to deploy NGINX Ingress Controller.
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+## Verify that NGINX Ingress Controller is connected to NGINX One
+
+After deploying NGINX Ingress Controller with NGINX Agent, you can verify the connection to NGINX One Console.
+
+Log in to your NGINX One Console account and navigate to the Instances dashboard. Your NGINX Ingress Controller instances should appear in the list, where the instance name will be the pod name.
+
+## Troubleshooting
+
+If you encounter issues connecting NGINX Ingress Controller to NGINX One Console, try the following steps based on your image type:
+
+Check the NGINX Agent version:
+
+```shell
+kubectl exec -it -n <namespace> <nginx-ingress-pod-name> -- nginx-agent -v
+```
+  
+If nginx-agent version is v3, continue with the following steps.
+Otherwise, make sure you are using an image that does not include App Protect. 
+
+Check the NGINX Agent configuration:
+
+```shell
+kubectl exec -it -n <namespace> <nginx-ingress-pod-name> -- cat /etc/nginx-agent/nginx-agent.conf
+```
+
+Check NGINX Agent logs:
+
+```shell
+kubectl exec -it -n <namespace> <nginx-ingress-pod-name> -- nginx-agent
+```
diff --git a/content/nic/installation/integrations/opentracing.md b/content/nic/installation/integrations/opentracing.md
new file mode 100644
index 000000000..55c6efd2a
--- /dev/null
+++ b/content/nic/installation/integrations/opentracing.md
@@ -0,0 +1,114 @@
+---
+docs: DOCS-618
+doctypes:
+- ''
+title: OpenTracing (Deprecated in v5.0.0)
+toc: true
+weight: 500
+---
+OpenTracing support has been deprecated from v5.0.0 of F5 NGINX Ingress Controller.
+
+
+Learn how to use OpenTracing with F5 NGINX Ingress Controller.
+
+NGINX Ingress Controller supports [OpenTracing](https://opentracing.io/) with the third-party module [opentracing-contrib/nginx-opentracing](https://github.com/opentracing-contrib/nginx-opentracing).
+
+## Prerequisites
+
+1. Use a NGINX Ingress Controller image that contains OpenTracing.
+
+    - You can find the images that include OpenTracing listed [in the technical specs doc]({{< ref "/nic/technical-specifications.md#supported-docker-images" >}}).
+    - Alternatively, you follow [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}) using `debian-image` (or `alpine-image`) for NGINX or `debian-image-plus` (or `alpine-image-plus`) for NGINX Plus.
+    - [Jaeger](https://github.com/jaegertracing/jaeger-client-cpp), [Zipkin](https://github.com/rnburn/zipkin-cpp-opentracing) and [Datadog](https://github.com/DataDog/dd-opentracing-cpp/) tracers are installed by default.
+
+1. Enable snippets annotations by setting the [`enable-snippets`]({{< ref "/nic/configuration/global-configuration/command-line-arguments#cmdoption-enable-snippets" >}}) command-line argument to true.
+
+1. Load the OpenTracing module.
+
+    You need to load the module with the configuration for the chosen tracer using the following ConfigMap keys:
+
+    - `opentracing-tracer`: sets the path to the vendor tracer binary plugin. This is the path you used in the COPY line of step *ii* above.
+    - `opentracing-tracer-config`: sets the tracer configuration in JSON format.
+
+    The following example shows how to use these two keys to load the module with Jaeger tracer:
+
+    ```yaml
+    opentracing-tracer: "/usr/local/lib/libjaegertracing_plugin.so"
+    opentracing-tracer-config: |
+            {
+                "service_name": "nginx-ingress",
+                "propagation_format": "w3c",
+                "sampler": {
+                    "type": "const",
+                    "param": 1
+                },
+                "reporter": {
+                    "localAgentHostPort": "jaeger-agent.default.svc.cluster.local:6831"
+                }
+            }
+    ```
+
+## Enable OpenTracing globally
+
+To enable OpenTracing globally (for all Ingress, VirtualServer and VirtualServerRoute resources), set the `opentracing` ConfigMap key to `True`:
+
+```yaml
+opentracing: True
+```
+
+## Enable or disable OpenTracing per Ingress resource
+
+You can use annotations to enable or disable OpenTracing for a specific Ingress resource. As mentioned in the prerequisites section, both `opentracing-tracer` and `opentracing-tracer-config` must be configured.
+
+Consider the following two cases:
+
+### OpenTracing is globally disabled
+
+1. To enable OpenTracing for a specific Ingress resource, use the server snippet annotation:
+
+    ```yaml
+    nginx.org/server-snippets: |
+        opentracing on;
+    ```
+
+1. To enable OpenTracing for specific paths:
+
+    - You need to use [Mergeable Ingress resources]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration" >}})
+    - You need to use the location snippets annotation to enable OpenTracing for the paths of a specific Minion Ingress resource:
+
+        ```yaml
+        nginx.org/location-snippets: |
+            opentracing on;
+        ```
+
+### OpenTracing is globally enabled
+
+1. To disable OpenTracing for a specific Ingress resource, use the server snippet annotation:
+
+    ```yaml
+    nginx.org/server-snippets: |
+        opentracing off;
+    ```
+
+1. To disable OpenTracing for specific paths:
+
+    - You need to use [Mergeable Ingress resources]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration" >}})
+    - You need to use the location snippets annotation to disable OpenTracing for the paths of a specific Minion Ingress resource:
+
+        ```yaml
+        nginx.org/location-snippets: |
+            opentracing off;
+        ```
+
+## Customize OpenTracing
+
+You can customize OpenTracing through the supported [OpenTracing module directives](https://github.com/opentracing-contrib/nginx-opentracing/blob/master/doc/Reference.md). Use the location-snippets ConfigMap keys or annotations to insert those directives into the generated NGINX configuration.
+
+For example, to propagate the active span context for upstream requests, you need to set the `opentracing_propagate_context` directive, which you can add to an Ingress resource using the location snippets annotation:
+
+```yaml
+nginx.org/location-snippets: |
+   opentracing_propagate_context;
+```
+
+{{< note >}}The `opentracing_propagate_context` and `opentracing_grpc_propagate_context` directives can be used in `http`, `server` or `location` contexts according to the [module documentation](https://github.com/opentracing-contrib/nginx-opentracing/blob/master/doc/Reference.md#opentracing_propagate_context). However, because of the way the module works and how NGINX Ingress Controller generates the NGINX configuration, it is only possible to use the directive in the `location` context.{{< /note >}}
diff --git a/content/nic/installation/nic-images/_index.md b/content/nic/installation/nic-images/_index.md
new file mode 100644
index 000000000..bcf9d1557
--- /dev/null
+++ b/content/nic/installation/nic-images/_index.md
@@ -0,0 +1,4 @@
+---
+title: NGINX Ingress Controller images
+weight: 200
+---
diff --git a/content/nic/installation/nic-images/get-image-using-jwt.md b/content/nic/installation/nic-images/get-image-using-jwt.md
new file mode 100644
index 000000000..7e1a52f61
--- /dev/null
+++ b/content/nic/installation/nic-images/get-image-using-jwt.md
@@ -0,0 +1,209 @@
+---
+docs: DOCS-1454
+doctypes:
+- ''
+title: Get the NGINX Ingress Controller image with JWT
+toc: true
+weight: 150
+---
+
+This document describes how to pull the F5 NGINX Plus Ingress Controller image from the F5 Docker registry into your Kubernetes cluster using your JWT token.
+
+## Overview
+
+{{< important >}}
+
+An NGINX Plus subscription certificate and key will not work with the F5 Docker registry.
+
+For NGINX Ingress Controller, you must have an NGINX Ingress Controller subscription -- download the NGINX Plus Ingress Controller (per instance) JWT access token from [MyF5](https://my.f5.com).
+
+To list the available image tags using the Docker registry API, you will also need to download the NGINX Plus Ingress Controller (per instance) certificate (`nginx-repo.crt`) and the key (`nginx-repo.key`) from [MyF5](https://my.f5.com).
+
+{{< /important >}}
+
+{{< note >}}
+
+You can also get the image using alternative methods:
+
+* You can use Docker to pull an NGINX Ingress Controller image with NGINX Plus and push it to your private registry by following the [Get NGINX Ingress Controller from the F5 Registry]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic.
+* You can follow the [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}) topic.
+
+If you would like to use an NGINX Ingress Controller image with NGINX open source, we provide the image through [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/).
+
+{{< /note >}}
+
+## Before You Begin
+
+You will need the following information from [MyF5](https://my.f5.com) for these steps:
+
+- A JWT Access Token (per instance) for NGINX Ingress Controller from an active NGINX Ingress Controller subscription.
+- The certificate (`nginx-repo.crt`) and key (`nginx-repo.key`) for each NGINX Ingress Controller instance, used to list the available image tags from the Docker registry API.
+
+## Prepare NGINX Ingress Controller
+
+1. Choose your desired [NGINX Ingress Controller Image](https://docs.nginx.com/nginx-ingress-controller/technical-specifications/#images-with-nginx-plus).
+1. Log into the [MyF5 Portal](https://my.f5.com/), navigate to your subscription details, and download the relevant .cert, .key and .JWT files.
+1. Create a Kubernetes secret using the JWT token. You should use `cat` to view the contents of the JWT token and store the output for use in later steps.
+1. Ensure there are no additional characters or extra whitespace that might have been accidentally added. This will break authorization and prevent the NGINX Ingress Controller image from being downloaded.
+1. Modify your deployment (manifest or Helm) to use the Kubernetes secret created in step 3.
+1. Deploy NGINX Ingress Controller into your Kubernetes cluster and verify that the installation has been successful.
+
+## Using the JWT token in a Docker Config Secret
+
+1. Create a Kubernetes `docker-registry` secret type on the cluster, using the JWT token as the username and `none` for password (as the password is not used).  The name of the docker server is `private-registry.nginx.com`.
+
+    ```shell
+    kubectl create secret docker-registry regcred --docker-server=private-registry.nginx.com --docker-username=<JWT Token> --docker-password=none [-n nginx-ingress]
+    ```
+
+    It is important that the `--docker-username=<JWT Token>` contains the contents of the token and is not pointing to the token itself. Ensure that when you copy the contents of the JWT token, there are no additional characters or extra whitespaces. This can invalidate the token and cause 401 errors when trying to authenticate to the registry.
+
+1. Confirm the details of the created secret by running:
+
+    ```shell
+    kubectl get secret regcred --output=yaml
+    ```
+
+1. You can now use the newly created Kubernetes secret in Helm and manifest deployments.
+
+{{< include "/nic/installation/jwt-password-note.md" >}}
+
+---
+
+## Manifest Deployment
+
+The page ["Installation with Manifests"](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/) explains how to install NGINX Ingress Controller using manifests. The following snippet is an example of a deployment:
+
+```yaml
+spec:
+  serviceAccountName: nginx-ingress
+  imagePullSecrets:
+  - name: regcred
+  automountServiceAccountToken: true
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - image: private-registry.nginx.com/nginx-ic/nginx-plus-ingress:{{< nic-version >}}
+    imagePullPolicy: IfNotPresent
+    name: nginx-plus-ingress
+```
+
+The `imagePullSecrets` and `containers.image` lines represent the Kubernetes secret, as well as the registry and version of NGINX Ingress Controller we are going to deploy.
+
+---
+
+## Helm Deployment
+
+If you are using Helm for deployment, there are two main methods: using *sources* or *charts*.
+
+### Helm Source
+
+The [Installation with Helm ]({{< ref "/nic/installation/installing-nic/installation-with-helm.md#managing-the-chart-via-sources" >}}) documentation has a section describing how to use sources: these are the unique steps for Docker secrets using JWT tokens.
+
+1. Clone the NGINX [`kubernetes-ingress` repository](https://github.com/nginx/kubernetes-ingress).
+1. Navigate to the `charts/nginx-ingress` folder of your local clone.
+1. Open the `values.yaml` file in an editor.
+
+    You must change a few lines NGINX Ingress Controller with NGINX Plus to be deployed.
+
+    1. Change the `nginxplus` argument to `true`.
+    1. Change the `repository` argument to the NGINX Ingress Controller image you intend to use.
+    2. Add an argument to `imagePullSecretName` or `imagePullSecretsNames` to allow Docker to pull the image from the private registry.
+
+    The following code block shows snippets of the parameters you will need to change, and an example of their contents:
+
+    ```yaml
+    ## Deploys the Ingress Controller for NGINX Plus
+    nginxplus: true
+    ## Truncated fields
+    ## ...
+    ## ...
+    image:
+    ## The image repository for the desired NGINX Ingress Controller image
+    repository: private-registry.nginx.com/nginx-ic/nginx-plus-ingress
+
+    ## The version tag
+    tag: {{< nic-version >}}
+
+    serviceAccount:
+        ## The annotations of the service account of the Ingress Controller pods.
+        annotations: {}
+
+    ## Truncated fields
+    ## ...
+    ## ...
+
+        ## The name of the secret containing docker registry credentials.
+        ## Secret must exist in the same namespace as the helm release.
+        ## Note that also imagePullSecretsNames can be used here if multiple secrets need to be set.
+        imagePullSecretName: regcred
+    ```
+
+With the modified `values.yaml` file, you can now use Helm to install NGINX Ingress Controller, for example:
+
+```shell
+helm install nicdev01 -n nginx-ingress --create-namespace -f values.yaml .
+```
+
+The above command will install NGINX Ingress Controller in the `nginx-ingress` namespace.
+
+If the namespace does not exist, `--create-namespace` will create it. Using `-f values.yaml` tells Helm to use the `values.yaml` file that you modified earlier with the settings you want to apply for your NGINX Ingress Controller deployment.
+
+
+### Helm Chart
+
+If you want to install NGINX Ingress Controller using the charts method, the following is an example of using the command line to pass the required arguments using the `set` parameter.
+
+```shell
+helm install my-release -n nginx-ingress oci://ghcr.io/nginx/charts/nginx-ingress --version {{< nic-helm-version >}} --set controller.image.repository=private-registry.nginx.com/nginx-ic/nginx-plus-ingress --set controller.image.tag={{< nic-version >}} --set controller.nginxplus=true --set controller.serviceAccount.imagePullSecretName=regcred
+```
+You can also use the certificate and key from the MyF5 portal and the Docker registry API to list the available image tags for the repositories, for example:
+
+```shell
+   $ curl https://private-registry.nginx.com/v2/nginx-ic/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
+
+   {
+    "name": "nginx-ic/nginx-plus-ingress",
+    "tags": [
+        "{{< nic-version >}}-alpine",
+        "{{< nic-version >}}-alpine-fips",
+        "{{< nic-version >}}-ubi",
+        "{{< nic-version >}}"
+    ]
+    }
+
+   $ curl <https://private-registry.nginx.com/v2/nginx-ic-nap/nginx-plus-ingress/tags/list> --key <path-to-client.key> --cert <path-to-client.cert> | jq
+   {
+    "name": "nginx-ic-nap/nginx-plus-ingress",
+    "tags": [
+        "{{< nic-version >}}-alpine-fips",
+        "{{< nic-version >}}-ubi",
+        "{{< nic-version >}}"
+    ]
+    }
+
+   $ curl <https://private-registry.nginx.com/v2/nginx-ic-dos/nginx-plus-ingress/tags/list> --key <path-to-client.key> --cert <path-to-client.cert> | jq
+   {
+    "name": "nginx-ic-dos/nginx-plus-ingress",
+    "tags": [
+        "{{< nic-version >}}-ubi",
+        "{{< nic-version >}}"
+    ]
+    }
+```
+
+---
+
+## Pulling an Image for Local Use
+
+If you need to pull the image for local use to then push to a different container registry, use this command:
+
+```shell
+docker login private-registry.nginx.com --username=<output_of_jwt_token> --password=none
+```
+
+Replace the contents of `<output_of_jwt_token>` with the contents of the JWT token itself.
+Once you have successfully pulled the image, you can then tag it as needed.
+
+{{< include "/nic/installation/jwt-password-note.md" >}}
diff --git a/content/nic/installation/nic-images/get-registry-image.md b/content/nic/installation/nic-images/get-registry-image.md
new file mode 100644
index 000000000..9fadafa08
--- /dev/null
+++ b/content/nic/installation/nic-images/get-registry-image.md
@@ -0,0 +1,193 @@
+---
+title: Get NGINX Ingress Controller from the F5 Registry
+toc: true
+weight: 100
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-605
+---
+
+Learn how to pull an F5 NGINX Plus Ingress Controller image from the official F5 Docker registry and upload it to your private registry. 
+
+The F5 Registry images include versions with NGINX App Protect WAF and NGINX App Protect DoS.
+
+This guide covers the prerequisites, image tagging, and troubleshooting steps.
+
+## Before you begin
+
+Before you start, you'll need these installed on your machine:
+
+- [Docker v18.09 or higher](https://docs.docker.com/engine/release-notes/18.09/).
+- An NGINX Ingress Controller subscription. Download both the certificate (*nginx-repo.crt*) and key (*nginx-repo.key*) from the [MyF5 Customer Portal](https://my.f5.com). Keep in mind that an NGINX Plus certificate and key won't work for for the steps in this guide.
+
+---
+
+## Set up Docker for F5 Container Registry
+
+Start by setting up Docker to communicate with the F5 Container Registry located at `private-registry.nginx.com`. If you're using Linux, follow these steps to create a directory and add your certificate and key:
+
+```shell
+mkdir -p /etc/docker/certs.d/private-registry.nginx.com
+cp <path-to-your-nginx-repo.crt> /etc/docker/certs.d/private-registry.nginx.com/client.cert
+cp <path-to-your-nginx-repo.key> /etc/docker/certs.d/private-registry.nginx.com/client.key
+```
+
+The steps provided are for Linux. For Mac or Windows, consult the [Docker for Mac](https://docs.docker.com/docker-for-mac/#add-client-certificates) or [Docker for Windows](https://docs.docker.com/docker-for-windows/#how-do-i-add-client-certificates) documentation. For more details on Docker Engine security, you can refer to the [Docker Engine Security documentation](https://docs.docker.com/engine/security/).
+
+## Pull the image
+
+Next, pull the image you need from `private-registry.nginx.com`. To find the correct image, consult the [Tech Specs guide]({{< ref "/nic/technical-specifications.md#images-with-nginx-plus" >}}).
+
+To pull an image, follow these steps. Replace `<version-tag>` with the specific version you need, for example, `{{< nic-version >}}`.
+
+- For NGINX Plus Ingress Controller, run:
+
+  ```shell
+  docker pull private-registry.nginx.com/nginx-ic/nginx-plus-ingress:<version-tag>
+  ```
+
+- For NGINX Plus Ingress Controller with NGINX App Protect WAF, run:
+
+   ```shell
+   docker pull private-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:<version-tag>
+   ```
+
+- For NGINX Plus Ingress Controller with NGINX App Protect WAF v5, run:
+
+   ```shell
+   docker pull private-registry.nginx.com/nginx-ic-nap-v5/nginx-plus-ingress:<version-tag>
+   ```
+
+   ```shell
+   docker pull private-registry.nginx.com/nap/waf-config-mgr:<waf-version-tag>
+   ```
+
+   ```shell
+   docker pull private-registry.nginx.com/nap/waf-enforcer:<waf-version-tag>
+   ```
+
+
+- For NGINX Plus Ingress Controller with NGINX App Protect DoS, run:
+
+   ```shell
+   docker pull private-registry.nginx.com/nginx-ic-dos/nginx-plus-ingress:<version-tag>
+   ```
+
+- For NGINX Plus Ingress Controller with NGINX App Protect WAF and NGINX App Protect DoS, run:
+
+   ```shell
+   docker pull private-registry.nginx.com/nginx-ic-nap-dos/nginx-plus-ingress:<version-tag>
+   ```
+
+You can use the Docker registry API to list the available image tags by running the following commands. Replace `<path-to-client.key>` with the location of your client key and `<path-to-client.cert>` with the location of your client certificate. The `jq` command is used to format the JSON output for easier reading.
+
+```json
+$ curl https://private-registry.nginx.com/v2/nginx-ic/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
+{
+  "name": "nginx-ic/nginx-plus-ingress",
+  "tags": [
+    "{{< nic-version >}}-alpine",
+    "{{< nic-version >}}-alpine-fips",
+    "{{< nic-version >}}-ubi",
+    "{{< nic-version >}}"
+  ]
+}
+
+$ curl https://private-registry.nginx.com/v2/nginx-ic-nap/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
+{
+  "name": "nginx-ic-nap/nginx-plus-ingress",
+  "tags": [
+    "{{< nic-version >}}-alpine-fips",
+    "{{< nic-version >}}-ubi",
+    "{{< nic-version >}}"
+  ]
+}
+
+$ curl https://private-registry.nginx.com/v2/nginx-ic-dos/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
+{
+  "name": "nginx-ic-dos/nginx-plus-ingress",
+  "tags": [
+    "{{< nic-version >}}-ubi",
+    "{{< nic-version >}}"
+  ]
+}
+```
+
+## Push to your private registry
+
+After pulling the image, tag it and upload it to your private registry.
+
+1. Log in to your private registry:
+
+   ```shell
+   docker login <my-docker-registry>
+   ```
+
+1. Tag and push the image. Replace `<my-docker-registry>` with your registry's path and `<version-tag>` with the version you're using, for example `{{< nic-version >}}`:
+
+   - For NGINX Plus Ingress Controller, run:
+
+      ```shell
+      docker tag private-registry.nginx.com/nginx-ic/nginx-plus-ingress:<version-tag> <my-docker-registry>/nginx-ic/nginx-plus-ingress:<version-tag>
+      docker push <my-docker-registry>/nginx-ic/nginx-plus-ingress:<version-tag>
+      ```
+
+   - For NGINX Controller with NGINX App Protect WAF, run:
+
+      ```shell
+      docker tag private-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:<version-tag> <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:<version-tag>
+      docker push <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:<version-tag>
+      ```
+
+      - For NGINX Controller with NGINX App Protect WAF v5, run:
+
+      ```shell
+      docker tag private-registry.nginx.com/nginx-ic-nap-v5/nginx-plus-ingress:<version-tag> <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:<version-tag>
+      docker push <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:<version-tag>
+      ```
+
+      ```shell
+      docker tag private-registry.nginx.com/nap/waf-config-mgr:<waf-version-tag> <my-docker-registry>/nap/waf-config-mgr:<waf-version-tag>
+      docker push <my-docker-registry>/nap/waf-config-mgr:<waf-version-tag>
+      ```
+
+      ```shell
+      docker tag private-registry.nginx.com/nap/waf-enforcer:<waf-version-tag> <my-docker-registry>/nap/waf-enforcer:<waf-version-tag>
+      docker push <my-docker-registry>/nap/waf-enforcer:<waf-version-tag>
+      ```
+
+   - For NGINX Controller with NGINX App Protect DoS, run:
+
+      ```shell
+      docker tag private-registry.nginx.com/nginx-ic-dos/nginx-plus-ingress:<version-tag> <my-docker-registry>/nginx-ic-dos/nginx-plus-ingress:<version-tag>
+      docker push <my-docker-registry>/nginx-ic-dos/nginx-plus-ingress:<version-tag>
+      ```
+
+## Troubleshooting
+
+If you encounter issues while following this guide, here are solutions to common problems:
+
+- **Certificate errors**
+  - **Likely Cause**: Incorrect certificate or key location, or using an NGINX Plus certificate.
+  - **Solution**: Verify you have the correct NGINX Ingress Controller certificate and key. Place them in the correct directory and ensure the certificate has a *.cert* extension.
+
+- **Docker version compatibility**
+  - **Likely Cause**: Outdated Docker version.
+  - **Solution**: Make sure you're running [Docker v18.09 or higher](https://docs.docker.com/engine/release-notes/18.09/). Upgrade if necessary.
+
+- **Can't pull the image**
+  - **Likely Cause**: Mismatched image name or tag.
+  - **Solution**: Double-check the image name and tag against the [Tech Specs guide]({{< ref "/nic/technical-specifications.md#images-with-nginx-plus" >}}).
+
+- **Failed to push to private registry**
+  - **Likely Cause**: Not logged into your private registry or incorrect image tagging.
+  - **Solution**: Verify login status and correct image tagging before pushing. Consult the [Docker documentation](https://docs.docker.com/docker-hub/repos/) for more details.
+
+
+## Alternative installation options
+
+You can also get the NGINX Ingress Controller image using the following alternate methods:
+
+- [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}).
+- [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}) using the source code from the GitHub repository and your NGINX Plus subscription certificate and key.
+- For NGINX Ingress Controller using NGINX OSS, you can pull the [nginx/nginx-ingress image](https://hub.docker.com/r/nginx/nginx-ingress/) from DockerHub.
diff --git a/content/nic/installation/nic-images/use-aws-image.md b/content/nic/installation/nic-images/use-aws-image.md
new file mode 100644
index 000000000..38178778c
--- /dev/null
+++ b/content/nic/installation/nic-images/use-aws-image.md
@@ -0,0 +1,139 @@
+---
+docs: DOCS-607
+doctypes:
+- ''
+title: Use the AWS Marketplace NGINX Ingress Controller image
+toc: true
+weight: 200
+draft: true
+---
+
+This guide walks you through the steps to set up NGINX Ingress Controller using the AWS Marketplace
+
+## Before you begin
+
+Follow this guide to set up NGINX Ingress Controller using AWS Marketplace. This involves some extra steps to make sure everything works as it should.
+
+{{< important >}}This guide focuses on EKS version 1.30. For EKS versions below 1.30, you'll need to adjust security settings in the NGINX Pod to ensure compatibility with marketplace images. Make sure you're using updated versions of `eksctl` and the AWS CLI.{{< /important >}}
+
+{{< note >}}See the `AWS Marketplace Metering Service` section of the [AWS Marketplace documentation](https://docs.aws.amazon.com/general/latest/gr/aws-marketplace.html) for regions where NGINX Ingress Controller is supported.{{</note>}}
+
+## Instructions
+
+1. First, make sure your AWS EKS cluster is operational. If not, set one up using the AWS console or the `eksctl` tool. For step-by-step instructions, follow [this guide](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html).
+
+2. Create a new IAM role that will link to the service account for NGINX Ingress Controller. This role should have a policy that lets you monitor AWS NGINX Ingress Controller usage. Skipping this step will cause AWS NGINX Ingress Controller not to work. For more information, consult [AWS EKS IAM documentation](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) and [AWS Marketplace policy details](https://docs.aws.amazon.com/marketplace/latest/userguide/iam-user-policy-for-aws-marketplace-actions.html).
+
+3. Link this IAM role to your EKS cluster service account. Doing this will annotate your service account Kubernetes object with the IAM role link.
+
+{{< important >}}Associating your AWS EKS cluster with an OIDC provider is a prerequisite for creating your IAM service account.{{< /important >}}
+
+## Use eksctl
+{{< note >}}Make sure you have an operational EKS cluster and that the namespace for your NGINX Ingress Controller is set up. If you don't have an EKS cluster yet, you'll need to create one.{{< /note >}}
+
+{{<tabs name="install-aws">}}
+{{%tab name="manifests"%}}
+
+1. Associate your EKS cluster with an OIDC IAM provider. Use your specific `--cluster <name`> and `--region <region>` values.
+
+    ``` shell
+    eksctl utils associate-iam-oidc-provider --region=us-east-1 --cluster=my-cluster --approve
+    ```
+
+1. Create an IAM role and a service account for your cluster. Replace `--name <name>`, `--namespace <name>`, and `--region <region>` with your values.
+
+    ``` shell
+    eksctl create iamserviceaccount --name nginx-ingress --namespace nginx-ingress --cluster my-cluster --region us-east-1 --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage --approve
+    ```
+
+    This step creates the IAM role with the required policy, creates the service account if it doesn't exist, and adds the annotations needed for your AWS cluster. For additional details, consult the [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/create-service-account-iam-policy-and-role.html). You don't need to apply any service account YAML files because `eksctl` handles that for you.
+
+    ``` yaml
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        EKS.amazonaws.com/role-arn: arn:aws:iam::001234567890:role/eksctl-my-cluster-iamserviceaccount-Role1-IJJ6CF9Y8IPY
+      labels:
+        app.kubernetes.io/managed-by: eksctl
+      name: nginx-ingress
+      namespace: nginx-ingress
+    ```
+
+    <br>
+
+    Ensure the service account name matches the one in your _rbac.yaml_ file for manifest deployment.
+
+    Here's what a sample _rbac.yaml_ file might look like:
+
+    ``` yaml
+    kind: ClusterRoleBinding
+      apiVersion: rbac.authorization.k8s.io/v1
+      metadata:
+        name: nginx-ingress
+      subjects:
+      - kind: ServiceAccount
+        name: nginx-ingress
+        namespace: nginx-ingress
+      roleRef:
+        kind: ClusterRole
+        name: nginx-ingress
+        apiGroup: rbac.authorization.k8s.io
+    ```
+
+1. Sign in to the AWS ECR registry that specified in the instructions on the [AWS Marketplace portal](https://aws.amazon.com/marketplace/pp/prodview-fx3faxl7zqeau?sr=0-1&ref_=beagle&applicationId=AWSMPContessa).
+
+    {{< img title="ECR pull instructions for NGINX Ingress Controller" src="./img/ecr-pull-instructions.png" >}}
+
+1. Update the image in the _nginx-plus-ingress.yaml_ manifest.
+
+{{%/tab%}}
+
+{{%tab name="helm"%}}
+
+1. Associate your EKS cluster with an OIDC IAM provider. Use your specific `--cluster <name`> and `--region <region>` values.
+
+    ``` shell
+    eksctl utils associate-iam-oidc-provider --region=us-east-1 --cluster=my-cluster --approve
+    ```
+
+1. Create an IAM role and a service account for your cluster. Replace `--name <name>`, `--namespace <name>`, `--region <region>`, `--cluster <name>` and `--role-name <name>` with your values.
+
+    ``` shell
+    eksctl create iamserviceaccount --name nginx-ingress --namespace nginx-ingress --cluster my-cluster --region us-east-1 --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage --role-only --role-name my-cluster-sa --approve
+    ```
+
+    This step creates the IAM role with the required policy, which we will later refer to in the helm values. For additional details, consult the [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/create-service-account-iam-policy-and-role.html).
+
+    <br>
+
+    Ensure the service account name matches the one in your _values.yaml_ file for helm deployment.  
+    Ensure the EKS `role-arn` matches the service account annotation in your _values.yaml_ file for helm deployment.  You can use this command to retrieve the `role-arn`
+    ``` shell
+    aws iam list-roles | jq -r --arg role "my-cluster-sa" '.Roles[] | select(.RoleName==$role) | .Arn'
+    ```
+
+    Here's what a sample _values.yaml_ file might look like:
+
+    ``` yaml
+    controller:
+      nginxplus: true
+      image:
+        repository: 709825985650.dkr.ecr.us-east-1.amazonaws.com/nginx/nginx-plus-ingress
+        tag: "{{< nic-version >}}-mktpl"
+      serviceAccount:
+        annotations:
+          eks.amazonaws.com/role-arn: arn:aws:iam::0123456789:role/my-cluster-sa
+        name: nginx-ingress
+    ```
+
+1. Sign in to the AWS ECR registry that specified in the instructions on the [AWS Marketplace portal](https://aws.amazon.com/marketplace/pp/prodview-fx3faxl7zqeau?sr=0-1&ref_=beagle&applicationId=AWSMPContessa).
+
+    {{< img title="ECR pull instructions for NGINX Ingress Controller" src="./img/ecr-pull-instructions.png" >}}
+
+{{%/tab%}}
+{{</tabs>}}
+
+{{< tip >}}For help with credentials, AWS Labs offers a credential helper. Check out [their GitHub repository](https://github.com/awslabs/amazon-ecr-credential-helper) for setup instructions.{{< /tip >}}
+
+For options to customize your resources, see our [Configuration documentation]({{< ref "/nic/configuration/" >}}).
diff --git a/content/nic/installation/nic-images/use-gcp-image.md b/content/nic/installation/nic-images/use-gcp-image.md
new file mode 100644
index 000000000..2c38c8cff
--- /dev/null
+++ b/content/nic/installation/nic-images/use-gcp-image.md
@@ -0,0 +1,118 @@
+---
+docs: DOCS-1455
+doctypes:
+- ''
+title: Use the GCP Marketplace NGINX Ingress Controller image
+toc: true
+weight: 300
+draft: true
+---
+
+Follow these steps to deploy F5 NGINX Ingress Controller through the GCP Marketplace.
+
+## Overview
+
+NGINX Ingress Controller acts as a Kubernetes Ingress Controller for both NGINX and NGINX Plus. It offers:
+
+- Routing based on host headers: For example, _foo.example.com_ routes to one set of services, while _bar.example.com_ routes to another.
+- Path-based routing: Requests beginning with `/serviceA` go to service A; those starting with `/serviceB` go to service B.
+- SSL/TLS termination for individual hostnames, like _foo.example.com_.
+
+## Before you begin
+
+Before installing NGINX Ingress Controller, review our [Installation with Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) guide. This guide shows you how to build a local NGINX Ingress Controller image and set up the required CustomResourceDefinitions (CRDs).
+
+## Installation
+
+Choose one of the following methods to install NGINX Ingress Controller.
+
+### Install NGINX Ingress Controller to an existing GKE cluster
+
+1. Open [Google Cloud Console](https://console.cloud.google.com/) and go to **Kubernetes Engine > Applications**.
+
+2. Select **DEPLOY FROM MARKETPLACE** and search for *NGINX Ingress Controller*.
+
+   {{<note>}}Make sure to choose a _Premium Edition_ image from _NGINX, Inc._, not a third-party one.{{</note>}}
+
+3. Choose the appropriate *NGINX Ingress Controller* image, then select **CONFIGURE**.
+
+4. Choose your cluster:
+
+   Select an existing Kubernetes Cluster from the list. The _default_ namespace is automatically chosen, but you can create a new one if you prefer. The **App instance name** will be a prefix for all resources created by the deployment and needs to be unique within the selected namespace.
+
+   Recommended settings are pre-selected but feel free to adjust them.
+
+   {{< note >}}If you see the **CREATE NEW CLUSTER** button, select **OR SELECT AN EXISTING CLUSTER** . {{</note>}}
+
+5. Select **DEPLOY** to start NGINX Ingress Controller installation process.
+
+   You can find NGINX Ingress Controller application by going back to **Kubernetes Engine > Applications**.
+
+### Install to a new GKE cluster
+
+If you prefer to use a new GKE cluster, follow these steps. Ensure you have enough vCPU for both NGINX Ingress Controller and any other applications you'll deploy.
+
+1. Open [Google Cloud Console](https://console.cloud.google.com/) and go to **Marketplace*.
+2. Search for *NGINX Ingress Controller*.
+
+   {{<note>}}Make sure to choose a _Premium Edition_ image from _NGINX, Inc._, not a third-party one.{{</note>}}
+
+3. Choose the appropriate *NGINX Ingress Controller* image, then select **CONFIGURE**.
+
+4. Configure the new GKE cluster:
+
+   Choose the appropriate zone, network, and subnetwork.
+
+5. Select **CREATE NEW CLUSTER**.
+
+   After a short delay, the cluster will be ready.
+
+6. Finish the installation:
+
+   The _default_ namespace is automatically selected, but you can create a new one if you wish. The **App instance name** will be a prefix for all resources created by the deployment and needs to be unique within the selected namespace. Confirm or adjust the settings and then select **DEPLOY**.
+
+   You can find your NGINX Ingress Controller application by going back to **Kubernetes Engine > Applications**.
+
+## Configuration
+
+When you install NGINX Ingress Controller from the GCP Marketplace, it comes with default settings and an empty *ConfigMap*. The resources have names ending in a suffix that reflects the app instance name you chose during installation. This suffix has the format <app-instance-name>-nginx-ingress.
+
+For example, if you've installed NGINX Ingress Controller in the `nginx-ingress` namespace and used the app instance name `nginx-ingress-plus`, you can check its _ConfigMap_ by running this `kubectl` command:
+
+```bash
+kubectl get configmap -n nginx-ingress nginx-ingress-plus-nginx-ingress -o yaml
+```
+
+``` yaml
+$ kubectl get configmap -n nginx-ingress nginx-ingress-plus-nginx-ingress -o yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  annotations:
+    kubectl.kubernetes.io/last-applied-configuration: |
+      {"apiVersion":"v1","data":null,"kind":"ConfigMap","metadata":{"annotations":{},"labels":{"app.kubernetes.io/instance":"nginx-ingress-plus","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"nginx-ingress-plus-nginx-ingress","helm.sh/chart":"nginx-ingress-0.16.2"},"name":"nginx-ingress-plus-nginx-ingress","namespace":"nginx-ingress","ownerReferences":[{"apiVersion":"app.k8s.io/v1beta1","blockOwnerDeletion":true,"kind":"Application","name":"nginx-ingress-plus","uid":"5cbbebd8-df13-4001-bd65-9467405d9a9d"}]}}
+  creationTimestamp: "2022-08-25T01:03:10Z"
+  labels:
+    app.kubernetes.io/instance: nginx-ingress-plus
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nginx-ingress-plus-nginx-ingress
+    helm.sh/chart: nginx-ingress-0.16.2
+  name: nginx-ingress-plus-nginx-ingress
+  namespace: nginx-ingress
+  ownerReferences:
+  - apiVersion: app.k8s.io/v1beta1
+    blockOwnerDeletion: true
+    kind: Application
+    name: nginx-ingress-plus
+    uid: 5cbbebd8-df13-4001-bd65-9467405d9a9d
+  resourceVersion: "147519"
+  uid: 3fa33891-7a30-4004-91bd-bd5d652e34a9
+```
+
+<br>
+
+For options to customize your resources, see our [Configuration documentation]({{< ref "/nic/configuration/" >}}).
+
+## Basic Usage
+
+To learn how to set up a basic application with NGINX Ingress Controller, refer to our [Basic Configuration Example](https://github.com/nginx/kubernetes-ingress/tree/main/examples/custom-resources/basic-configuration).
diff --git a/content/nic/installation/run-multiple-ingress-controllers.md b/content/nic/installation/run-multiple-ingress-controllers.md
new file mode 100644
index 000000000..3c2bd7116
--- /dev/null
+++ b/content/nic/installation/run-multiple-ingress-controllers.md
@@ -0,0 +1,60 @@
+---
+docs: DOCS-606
+doctypes:
+- ''
+title: Run multiple NGINX Ingress Controllers
+toc: true
+weight: 400
+---
+
+This document describes how to run multiple F5 NGINX Ingress Controller instances.
+
+It explains the following topics:
+
+- Ingress class concept.
+- How to run NGINX Ingress Controller in the same cluster with another Ingress Controller and prevent conflicts between them
+- How to run multiple NGINX Ingress Controllers.
+
+{{< note >}} This document refers to [Ingress]({{< ref "/nic/configuration/ingress-resources/basic-configuration.md" >}}), [VirtualServer]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#virtualserver-specification" >}}), [VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#virtualserverroute-specification" >}}), and [TransportServer]({{< ref "/nic/configuration/transportserver-resource.md" >}}) resources as "configuration resources".{{< /note >}}
+
+---
+
+## Ingress class
+
+The [IngressClass](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) resource allows for multiple Ingress Controller to operate in the same cluster. It also allow developers to select which Ingress Controller implementation to use for their Ingress resource.
+The IngressClass has the following characteristics:
+
+- Every Ingress Controller must only handle Ingress resources for its particular class.
+- Ingress resources need to have the `ingressClassName` field set to the value of the class of the Ingress Controller the user wants to use.
+- VirtualServer, VirtualServerRoute, Policy, and TransportServer resources need to have the `ingressClassName` field set to the value of the class of the Ingress Controller the user wants to use.
+
+### Configuring Ingress class
+
+The default Ingress class of NGINX Ingress Controller is `nginx`, which means that it only handles configuration resources with the Ingress class set to `nginx`. You can customize the class through the `-ingress-class` command-line argument.
+
+{{< note >}}- If the class of an Ingress resource is not set, Kubernetes will set it to the class of the default Ingress Controller. To make the Ingress Controller the default one, the `ingressclass.kubernetes.io/is-default-class` property must be set on the IngressClass resource. To learn more, see Step 3 *Create an IngressClass resource* of the [Create Common Resources]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md#create-common-resources" >}}) section.
+- For VirtualServer, VirtualServerRoute, Policy and TransportServer resources, NGINX Ingress Controller will always handle resources with an empty class.{{< /note >}}
+
+---
+
+## Run NGINX Ingress Controller and another Ingress Controller
+
+It is possible to run NGINX Ingress Controller and an Ingress Controller for another load balancer in the same cluster. This is often the case if you create your cluster through a cloud provider's managed Kubernetes service that by default might include the Ingress Controller for the HTTP load balancer of the cloud provider, and you want to use NGINX Ingress Controller.
+
+To make sure that NGINX Ingress Controller handles specific configuration resources, update those resources with the class set to the value that is configured in NGINX Ingress Controller. By default, this is `nginx`.
+
+---
+
+## Run multiple NGINX Ingress Controllers
+
+When running NGINX Ingress Controller, you have the following options with regards to which configuration resources it handles:
+
+- Cluster-wide Ingress Controller (default): NGINX Ingress Controller handles configuration resources created in any namespace of the cluster. As NGINX is a high-performance load balancer capable of serving many applications at the same time, this option is used by default in our installation manifests and Helm chart.
+- Defined-namespace Ingress Controller: You can configure the Ingress Controller to handle configuration resources only from particular namespaces, which is controlled through the `-watch-namespace` command-line argument. This can be useful if you want to use different NGINX Ingress Controllers for different applications, both in terms of isolation and/or operation.
+- Ingress Controller for Specific Ingress Class: This option works in conjunction with either of the options above. You can further customize which configuration resources are handled by the Ingress Controller by configuring the class of the Ingress Controller and using that class in your configuration resources. The [Configuring Ingress Class](#configuring-ingress-class) section above explains where.
+
+These options allow you to run multiple NGINX Ingress Controllers, each handling a different set of configuration resources.
+
+{{< see-also >}}[Command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}){{< /see-also >}}
+
+{{< note >}}All the mentioned command-line arguments are also available as parameters in the [Helm chart]({{< ref "/nic/installation/installing-nic/installation-with-helm" >}}).{{< /note >}}
diff --git a/content/nic/logging-and-monitoring/_index.md b/content/nic/logging-and-monitoring/_index.md
new file mode 100644
index 000000000..88551ab27
--- /dev/null
+++ b/content/nic/logging-and-monitoring/_index.md
@@ -0,0 +1,8 @@
+---
+title: Logging And Monitoring
+description:
+weight: 1500
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/logging-and-monitoring/logging.md b/content/nic/logging-and-monitoring/logging.md
new file mode 100644
index 000000000..44e7a8fb2
--- /dev/null
+++ b/content/nic/logging-and-monitoring/logging.md
@@ -0,0 +1,35 @@
+---
+docs: DOCS-613
+doctypes:
+- ''
+title: Logging
+toc: true
+weight: 1800
+---
+
+This document gives an overview of logging provided by NGINX Ingress Controller.
+
+NGINX Ingress Controller exposes the logs of the Ingress Controller process (the process that generates NGINX configuration and reloads NGINX to apply it) and NGINX access and error logs. All logs are sent to the standard output and error of the NGINX Ingress Controller process. To view the logs, you can execute the `kubectl logs` command for an Ingress Controller pod. For example:
+
+```shell
+kubectl logs <nginx-ingress-pod> -n nginx-ingress
+```
+
+## NGINX Ingress Controller Process Logs
+
+The NGINX Ingress Controller process logs are configured through the `-log-level` command-line argument of the NGINX Ingress Controller, which sets the log level. The default value is `info`. Other options include: `trace`, `debug`, `info`, `warning`, `error` and `fatal`. The value `debug` is useful for troubleshooting: you will be able to see how NGINX Ingress Controller gets updates from the Kubernetes API, generates NGINX configuration and reloads NGINX.
+
+See also the doc about NGINX Ingress Controller [command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments).
+
+## NGINX Logs
+
+The NGINX includes two logs:
+
+- *Access log*, where NGINX writes information about client requests in the access log right after the request is processed. The access log is configured via the [logging-related](/nginx-ingress-controller/configuration/global-configuration/configmap-resource#logging) ConfigMap keys:
+  - `log-format` for HTTP and HTTPS traffic.
+  - `stream-log-format` for TCP, UDP, and TLS Passthrough traffic.
+
+    Additionally, you can disable access logging with the `access-log-off` ConfigMap key.
+- *Error log*, where NGINX writes information about encountered issues of different severity levels. It is configured via the `error-log-level` [ConfigMap key](/nginx-ingress-controller/configuration/global-configuration/configmap-resource#logging). To enable debug logging, set the level to `debug` and also set the `-nginx-debug` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments), so that NGINX is started with the debug binary `nginx-debug`.
+
+See also the doc about [NGINX logs](https://docs.nginx.com/nginx/admin-guide/monitoring/logging/) from NGINX Admin guide.
diff --git a/content/nic/logging-and-monitoring/prometheus.md b/content/nic/logging-and-monitoring/prometheus.md
new file mode 100644
index 000000000..b8f3d6532
--- /dev/null
+++ b/content/nic/logging-and-monitoring/prometheus.md
@@ -0,0 +1,85 @@
+---
+docs: DOCS-614
+doctypes:
+- concept
+title: Prometheus
+toc: true
+weight: 2000
+---
+
+NGINX Ingress Controller exposes metrics in the [Prometheus](https://prometheus.io/) format. Those include NGINX/NGINX Plus and the Ingress Controller metrics.
+
+## Enabling Metrics
+
+### Using Manifests
+If you're using *Kubernetes manifests* (Deployment or DaemonSet) to install the Ingress Controller, to enable Prometheus metrics:
+
+1. Run the Ingress Controller with the `-enable-prometheus-metrics` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments). As a result, the Ingress Controller will expose NGINX or NGINX Plus metrics in the Prometheus format via the path `/metrics` on port `9113` (customizable via the `-prometheus-metrics-listen-port` command-line argument).
+1. To enable TLS for the Prometheus endpoint, configure the `-prometheus-tls-secret` cli argument with the namespace and name of a TLS Secret.
+1. Add the Prometheus port to the list of the ports of the Ingress Controller container in the template of the Ingress Controller pod:
+
+    ```yaml
+    - name: prometheus
+      containerPort: 9113
+    ```
+
+1. Make Prometheus aware of the Ingress Controller targets by adding the following annotations to the template of the Ingress Controller pod (note: this assumes your Prometheus is configured to discover targets by analyzing the annotations of pods):
+
+    ```yaml
+    annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9113"
+        prometheus.io/scheme: http
+    ```
+
+### Using Helm
+
+If you're using *Helm* to install the Ingress Controller, to enable Prometheus metrics, configure the `prometheus.*` parameters of the Helm chart. See the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) doc.
+
+### Using ServiceMonitor
+
+When deploying with *Helm*, you can deploy a `Service` and `ServiceMonitor` resource using the `prometheus.service.*` and `prometheus.serviceMonitor.*` parameters.
+When these resources are deployed, Prometheus metrics exposed by NGINX Ingress Controller can be captured and enumerated using a `Prometheus` resource alongside a Prometheus Operator deployment.
+
+To view metrics captured this way, the following is required:
+* The latest ServiceMonitor CRD from the [prometheus-operator](https://github.com/prometheus-operator/prometheus-operator) repository:
+```shell
+LATEST=$(curl -s https://api.github.com/repos/prometheus-operator/prometheus-operator/releases/latest | jq -cr .tag_name)
+curl https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/$LATEST/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml | kubectl create -f -
+```
+* A working [Prometheus resource and Prometheus Operator](https://prometheus-operator.dev/docs/getting-started/introduction/)
+
+## Available Metrics
+
+The Ingress Controller exports the following metrics:
+
+- NGINX/NGINX Plus metrics:
+  - Exported by NGINX/NGINX Plus. Refer to the [NGINX Prometheus Exporter developer docs](https://github.com/nginx/nginx-prometheus-exporter#exported-metrics) to find more information about the exported metrics.
+  - There is a Grafana dashboard for NGINX Plus metrics located in the root repo folder.
+  - Calculated by the Ingress Controller:
+    - `controller_upstream_server_response_latency_ms_count`. Bucketed response times from when NGINX establishes a connection to an upstream server to when the last byte of the response body is received by NGINX. **Note**: The metric for the upstream isn't available until traffic is sent to the upstream. The metric isn't enabled by default. To enable the metric, set the `-enable-latency-metrics` command-line argument.
+- Ingress Controller metrics
+  - `controller_nginx_reloads_total`. Number of successful NGINX reloads. This includes the label `reason` with 2 possible values `endpoints` (the reason for the reload was an endpoints update) and `other` (the reload was caused by something other than an endpoint update like an ingress update).
+  - `controller_nginx_reload_errors_total`. Number of unsuccessful NGINX reloads.
+  - `controller_nginx_last_reload_status`. Status of the last NGINX reload, 0 meaning down and 1 up.
+  - `controller_nginx_last_reload_milliseconds`. Duration in milliseconds of the last NGINX reload.
+  - `controller_nginx_worker_processes_total`. Number of NGINX worker processes. This metric includes the constant label `generation` with two possible values `old` (the shutting down processes of the old generations) or `current` (the processes of the current generation).
+  - `controller_ingress_resources_total`. Number of handled Ingress resources. This metric includes the label type, that groups the Ingress resources by their type (regular, [minion or master](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration)). **Note**: The metric doesn't count minions without a master.
+  - `controller_virtualserver_resources_total`. Number of handled VirtualServer resources.
+  - `controller_virtualserverroute_resources_total`. Number of handled VirtualServerRoute resources. **Note**: The metric counts only VirtualServerRoutes that have a reference from a VirtualServer.
+  - `location_zone` (upstream services) metrics:
+    - `location_zone_sent`. Number of bytes sent to clients.
+    - `location_zone_received`. Number of bytes received from clients.
+    - `location_zone_requests`. Total number of client requests.
+    - `location_zone_responses`. Total number of responses sent to clients.
+    - `location_zone_responses_codes`. Total number of responses sent to clients.
+    - `location_zone_sent`. Number of bytes sent to clients.
+  - `controller_transportserver_resources_total`. Number of handled TransportServer resources. This metric includes the label type, that groups the TransportServer resources by their type (passthrough, tcp or udp).
+  - Workqueue metrics. **Note**: the workqueue is a queue used by the Ingress Controller to process changes to the relevant resources in the cluster like Ingress resources. The Ingress Controller uses only one queue. The metrics for that queue will have the label `name="taskQueue"`
+    - `workqueue_depth`. Current depth of the workqueue.
+    - `workqueue_queue_duration_second`. How long in seconds an item stays in the workqueue before being requested.
+    - `workqueue_work_duration_seconds`. How long in seconds processing an item from the workqueue takes.
+
+**Note**: all metrics have the namespace `nginx_ingress`. For example, `nginx_ingress_controller_nginx_reloads_total`.
+
+**Note**: all metrics include the label `class`, which is set to the class of the Ingress Controller. The class is configured via the `-ingress-class` command-line argument.
diff --git a/content/nic/logging-and-monitoring/service-insight.md b/content/nic/logging-and-monitoring/service-insight.md
new file mode 100644
index 000000000..aefeb4d98
--- /dev/null
+++ b/content/nic/logging-and-monitoring/service-insight.md
@@ -0,0 +1,56 @@
+---
+docs: DOCS-1180
+doctypes:
+- ''
+title: Service Insight
+toc: true
+weight: 2100
+---
+
+The Service Insight feature is available only for F5 NGINX Plus. The F5 NGINX Ingress Controller exposes an endpoint which provides host statistics for services exposed using the VirtualServer (VS) and TransportServer (TS) resources.
+
+It exposes data in JSON format and returns HTTP status codes.
+
+The response body holds information about the total, down and the unhealthy number of upstream pods associated with the configured hostname. Returned HTTP codes indicate the health of the service.
+
+The service is indicated as not healthy (HTTP response code different than 200 OK) if all upstreams (pods) are determined unhealthy by NGINX Plus.
+The service is healthy if at least one upstream pod is healthy as determined by NGINX Plus. In this case, the endpoint returns HTTP code 200 OK.
+
+NGINX Plus determination of healthy can be tuned using advanced health checks, and also dynamically relate to pods responses and responsiveness.  See Upstream Healthcheck <https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#upstream>
+
+## Enabling Service Insight Endpoint
+
+If you're using *Kubernetes manifests* (Deployment or DaemonSet) to install the Ingress Controller, to enable the Service Insight endpoint:
+
+1. Run the Ingress Controller with the `-enable-service-insight` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments). This will expose the Ingress Controller endpoint via paths `/probe/{hostname}` for Virtual Servers, and `/probe/ts/{service_name}` for Transport Servers on port `9114` (customizable with the `-service-insight-listen-port` command-line argument). The `service_name` parameter refers to the name of the deployed service (the service specified under `upstreams` in the transport server).
+1. To enable TLS for the Service Insight endpoint, configure the `-service-insight-tls-secret` cli argument with the namespace and name of a TLS Secret.
+1. Add the Service Insight port to the list of the ports of the Ingress Controller container in the template of the Ingress Controller pod:
+
+    ```yaml
+    - name: service-insight
+      containerPort: 9114
+    ```
+
+If you're using *Helm* to install the Ingress Controller, to enable Service Insight endpoint, configure the `serviceInsight.*` parameters of the Helm chart. See the [Installation with Helm](/nginx-ingress-controller/installation/installing-nic/installation-with-helm) doc.
+
+## Available Statistics and HTTP Response Codes
+
+The Service Insight provides the following statistics:
+
+- Total number of VS or TS pods
+- Number of VS or TS pods in 'Up' state
+- Number of VS or TS pods in 'Unhealthy' state
+
+These statistics are returned as JSON:
+
+```json
+{ "Total": <int>, "Up": <int>, "Unhealthy": <int>  }
+```
+
+Response codes:
+
+- HTTP 200 OK - Service is healthy
+- HTTP 404 Not Found - No upstreams/VS/TS found for the requested hostname/name
+- HTTP 418 I'm a teapot - The service is down (All upstreams/VS/TS are "Unhealthy")
+
+**Note**: wildcards in hostnames are not supported at the moment.
diff --git a/content/nic/logging-and-monitoring/status-page.md b/content/nic/logging-and-monitoring/status-page.md
new file mode 100644
index 000000000..246c3a475
--- /dev/null
+++ b/content/nic/logging-and-monitoring/status-page.md
@@ -0,0 +1,64 @@
+---
+docs: DOCS-615
+doctypes:
+- ''
+title: Status Page
+toc: true
+weight: 1900
+---
+
+This document explains how to get access to the stub status in NGINX and the dashboard in NGINX Plus.
+
+NGINX comes with a status page that reports basic metrics about NGINX called the [stub status](https://nginx.org/en/docs/http/ngx_http_stub_status_module.html).
+
+NGINX Plus comes with a [dashboard](https://docs.nginx.com/nginx/admin-guide/monitoring/live-activity-monitoring/) that reports key load-balancing and performance metrics.
+
+NGINX App Protect DoS comes with a [dashboard](https://docs.nginx.com/nginx-app-protect-dos/monitoring/live-activity-monitoring/) that shows the status and information of the protected objects.
+This doc shows how to get access to the stub status/dashboard.
+
+## Accessing Stub Status
+
+Prerequisites:
+
+1. The stub status is enabled by default. Ensure that the `nginx-status` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) is not set to false.
+1. The stub status is available on port 8080 by default. It is customizable by the `nginx-status-port` command-line argument. If yours is not on 8080, modify the kubectl proxy command below.
+
+To access the status:
+
+1. Use the `kubectl port-forward` command to forward connections to port 8080 on your local machine to port 8080 of an NGINX Ingress Controller pod (replace `<nginx-ingress-pod>` with the actual name of a pod):.
+
+    ```
+    kubectl port-forward <nginx-ingress-pod> 8080:8080 --namespace=nginx-ingress
+    ```
+
+1. Open your browser at [http://127.0.0.1:8080/stub_status](http://127.0.0.1:8080/stub_status) to access the status.
+
+If you want to access the stub status externally (without `kubectl port-forward`):
+
+1. Configure `-nginx-status-allow-cidrs` command-line argument with IP/CIDR blocks for which you want to allow access to the status. By default, the access is allowed for `127.0.0.1,::1`.
+1. Use the IP/port through which the Ingress Controller pod/pods are available to connect the stub status at the `/stub_status` path.
+
+## Accessing Live Activity Monitoring Dashboard
+
+Prerequisites:
+
+1. The dashboard is enabled by default. Ensure that the `nginx-status` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments)is not set to false.
+1. The dashboard is available on port 8080 by default. It is customizable by the `nginx-status-port` command-line argument. If yours is not on 8080, modify the kubectl proxy command below.
+
+To access the dashboard:
+
+1. Use the `kubectl port-forward` command to forward connections to port 8080 on your local machine to port 8080 of an NGINX Plus Ingress Controller pod (replace `<nginx-plus-ingress-pod>` with the actual name of a pod):
+
+    ```
+    kubectl port-forward <nginx-plus-ingress-pod> 8080:8080 --namespace=nginx-ingress
+    ```
+
+1. Open your browser at <http://127.0.0.1:8080/dashboard.html> to access the dashboard.
+1. App Protect DoS: Open your browser at <http://127.0.0.1:8080/dashboard-dos.html> to access the dashboard.
+
+If you want to access the dashboard externally (without `kubectl port-forward`):
+
+1. Configure `-nginx-status-allow-cidrs` command-line argument with IP/CIDR blocks for which you want to allow access to the dashboard. By default, the access is allowed for `127.0.0.1,::1`.
+1. Use the IP/port through which the Ingress Controller pod/pods are available to connect the dashboard at the `/dashboard.html` path.
+
+**Note**: The [API](https://nginx.org/en/docs/http/ngx_http_api_module.html), which the dashboard uses to get the metrics, is also accessible: use the `/api` path. For App Protect DoS use the `/api/dos` path. Note that the API is configured in the read-only mode.
diff --git a/content/nic/overview/_index.md b/content/nic/overview/_index.md
new file mode 100644
index 000000000..05b03b934
--- /dev/null
+++ b/content/nic/overview/_index.md
@@ -0,0 +1,8 @@
+---
+title: Overview
+description:
+weight: 100
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/overview/about.md b/content/nic/overview/about.md
new file mode 100644
index 000000000..f6231c24a
--- /dev/null
+++ b/content/nic/overview/about.md
@@ -0,0 +1,17 @@
+---
+title: About
+weight: 100
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-612
+---
+
+This document describes the F5 NGINX Ingress Controller, an Ingress Controller implementation for NGINX and NGINX Plus.
+
+NGINX Ingress Controller is an [Ingress Controller]({{< ref "/nic/glossary.md#ingress-controller">}}) implementation for [NGINX](https://nginx.org) and [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) that can load balance Websocket, gRPC, TCP and UDP applications. NGINX Ingress Controller gives you a way to manage NGINX through the [Kubernetes](https://kubernetes.io/) API, and is built to handle the continuous change that happens in Kubernetes environments. 
+
+It supports standard [Ingress]({{< ref "/nic/glossary.md#ingress">}}) features such as content-based routing and TLS/SSL termination.Several NGINX and NGINX Plus features are available as extensions to Ingress resources through [Annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations">}}) and the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource">}}) resource.
+
+NGINX Ingress Controller supports the [VirtualServer and VirtualServerRoute resources]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources">}}) as alternatives to Ingress, enabling traffic splitting and advanced content-based routing. It also supports TCP, UDP and TLS Passthrough load balancing using [TransportServer resources]({{< ref "/nic/configuration/transportserver-resource">}}).
+
+To learn more about NGINX Ingress Controller, please read the [The design of NGINX Ingress Controller]({{< ref "/nic/overview/design.md">}}) and [Extensibility with NGINX Plus]({{< ref "/nic/overview/nginx-plus.md">}}) topics.
diff --git a/content/nic/overview/controller-comparison.md b/content/nic/overview/controller-comparison.md
new file mode 100644
index 000000000..437e508c4
--- /dev/null
+++ b/content/nic/overview/controller-comparison.md
@@ -0,0 +1,65 @@
+---
+docs: DOCS-610
+doctypes:
+- concept
+draft: true
+title: Which Ingress Controller Do I Need?
+toc: true
+weight: 400
+---
+
+This document describes the key differences between the community Ingress-NGINX Controller and F5 NGINX Ingress Controller.
+
+There are two NGINX-based Ingress Controller implementations out there: the one made by NGINX ([nginx/kubernetes-ingress](https://github.com/nginx/kubernetes-ingress)) and the one made by Kubernetes ([kubernetes/ingress-nginx](https://github.com/kubernetes/ingress-nginx)). In this document, we explain the key differences between those implementations. This information should help you to choose an appropriate implementation for your requirements or move from one implementation to the other.
+
+## Which One Am I Using?
+
+If you are unsure about which implementation you are using, check the container image of the Ingress Controller that is running. For the nginx/kubernetes-ingress Ingress Controller its Docker image is published on [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/) and available as *nginx/nginx-ingress*.
+
+## The Key Differences
+
+The table below summarizes the key difference between nginx/kubernetes-ingress and kubernetes/ingress-nginx Ingress Controllers. Note that the table has two columns for the nginx/kubernetes-ingress Ingress Controller, as it can be used both with NGINX and NGINX Plus. For more information about nginx/kubernetes-ingress with NGINX Plus, read the [NGINX Ingress Controller with NGINX Plus](/nginx-ingress-controller/intro/nginx-plus) documentation.
+
+{{% table %}}
+| Aspect or Feature | kubernetes/ingress-nginx | nginx/kubernetes-ingress with NGINX | nginx/kubernetes-ingress with NGINX Plus |
+| --- | --- | --- | --- |
+| **Fundamental** |
+| Authors | Kubernetes community | NGINX Inc and community |  NGINX Inc and community |
+| NGINX version | [Custom](https://github.com/kubernetes/ingress-nginx/tree/main/images/nginx) NGINX build that includes several third-party modules | NGINX official mainline [build](https://github.com/nginx/docker-nginx) | NGINX Plus |
+| Commercial support | N/A | N/A | Included |
+| **Load balancing configuration via the Ingress resource** |
+| Merging Ingress rules with the same host | Supported | Supported via [Mergeable Ingresses](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/mergeable-ingress-types) | Supported via [Mergeable Ingresses](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/mergeable-ingress-types) |
+| HTTP load balancing extensions - Annotations | See the [supported annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) | See the [supported annotations](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/) | See the [supported annotations](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/)|
+| HTTP load balancing extensions -- ConfigMap | See the [supported ConfigMap keys](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/) | See the [supported ConfigMap keys](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) | See the [supported ConfigMap keys](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) |
+| TCP/UDP | Supported via a ConfigMap | Supported via custom resources | Supported via custom resources |
+| Websocket  | Supported | Supported via an [annotation](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/websocket) | Supported via an [annotation](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/websocket) |
+| TCP SSL Passthrough | Supported via a ConfigMap | Supported via custom resources | Supported via custom resources |
+| JWT validation | Not supported | Not supported | Supported |
+| Session persistence | Supported via a third-party module | Not supported | Supported |
+| Canary testing (by header, cookie, weight) | Supported via annotations | Supported via custom resources | Supported via custom resources |
+| Configuration templates *1 | See the [template](https://github.com/kubernetes/ingress-nginx/blob/main/rootfs/etc/nginx/template/nginx.tmpl) | See the [templates](../internal/configs/version1) | See the [templates](../internal/configs/version1) |
+| **Load balancing configuration via Custom Resources** |
+| HTTP load balancing | Not supported | See [VirtualServer and VirtualServerRoute](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) resources | See [VirtualServer and VirtualServerRoute](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) resources |
+| TCP/UDP load balancing | Not supported | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource |
+| TCP SSL Passthrough load balancing | Not supported | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource |
+| **Deployment** |
+| Command-line arguments *2 | See the [arguments](https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/) | See the [arguments](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/) | See the [arguments](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/) |
+| TLS certificate and key for the default server | Required as a command-line argument/ auto-generated | Required as a command-line argument | Required as a command-line argument |
+| Helm chart | Supported | Supported | Supported |
+| Operator | Not supported | Supported | Supported |
+| **Operational** |
+| Reporting the IP address(es) of the Ingress Controller into Ingress resources | Supported | Supported | Supported |
+| Extended Status | Supported via a third-party module | Not supported | Supported |
+| Prometheus Integration | Supported | Supported | Supported |
+| Dynamic reconfiguration of endpoints (no configuration reloading) | Supported with a third-party Lua module | Not supported | Supported |
+{{% /table %}}
+
+Notes:
+
+*1 -- The configuration templates that are used by the Ingress Controllers to generate NGINX configuration are different. As a result, for the same Ingress resource the generated NGINX configuration files are different from one Ingress Controller to the other, which in turn means that in some cases the behavior of NGINX can be different as well.
+
+*2 -- Because the command-line arguments are different, it is not possible to use the same deployment manifest for deploying the Ingress Controllers.
+
+## How to Swap an Ingress Controller
+
+If you decide to swap an Ingress Controller implementation, be prepared to deal with the differences that were mentioned in the previous section. At minimum, you need to start using a different deployment manifest.
diff --git a/content/nic/overview/design.md b/content/nic/overview/design.md
new file mode 100644
index 000000000..16dcbd967
--- /dev/null
+++ b/content/nic/overview/design.md
@@ -0,0 +1,346 @@
+---
+title: The design of NGINX Ingress Controller
+toc: true
+weight: 200
+nd-content-type: concept
+nd-product: NIC
+nd-docs: DOCS-609
+---
+
+This document explains how the F5 NGINX Ingress Controller is designed, and how it differs when using NGINX or NGINX Plus.
+
+The intended audience for this information is primarily the two following groups:
+
+- _Operators_ who want to know how the software works and understand how it can fail.
+- _Developers_ who want to [contribute](https://github.com/nginx/kubernetes-ingress/blob/main/CONTRIBUTING.md) to the project.
+
+We assume that the reader is familiar with core Kubernetes concepts, such as Pods, Deployments, Services, and Endpoints. For an understanding of how NGINX itself works, you can read the ["Inside NGINX: How We Designed for Performance & Scale"](https://www.nginx.com/blog/inside-nginx-how-we-designed-for-performance-scale/) blog post.
+
+For conciseness in diagrams, NGINX Ingress Controller is often labelled "IC" on this page.
+
+## NGINX Ingress Controller at a high level
+
+This figure depicts an example of NGINX Ingress Controller exposing two web applications within a Kubernetes cluster to clients on the internet:
+
+{{<img src="/nic/ic-high-level.png" alt="">}}
+
+{{<note>}} For simplicity, necessary Kubernetes resources like Deployments and Services aren't shown, which Admin and the users also need to create.{{</note>}}
+
+The figure shows:
+
+- A _Kubernetes cluster_.
+- Cluster users _Admin_, _User A_ and _User B_, which use the cluster via the _Kubernetes API_.
+- _Clients A_ and _Clients B_, which connect to the _Applications A_ and _B_ deployed by the corresponding users.
+- _NGINX Ingress Controller_, deployed in a pod with the namespace _nginx-ingress_ and configured using the _ConfigMap resource_ _nginx-ingress_. A single pod is depicted; at least two pods are typically deployed for redundancy. _NGINX Ingress Controller_ uses the _Kubernetes API_ to get the latest Ingress resources created in the cluster and then configures _NGINX_ according to those resources.
+- _Application A_ with two pods deployed in the _namespace A_ by _User A_. To expose the application to its clients (_Clients A_) via the host `a.example.com`, _User A_ creates _Ingress A_.
+- _Application B_ with one pod deployed in the _namespace B_ by _User B_. To expose the application to its clients (_Clients B_) via the host `b.example.com`, _User B_ creates _VirtualServer B_.
+- _Public Endpoint_, which fronts the _NGINX Ingress Controller_ pod(s). This is typically a standalone TCP load balancer (Cloud, software, or hardware) or a combination of a load balancer with a NodePort service. _Clients A_ and _B_ connect to their applications via the _Public Endpoint_.
+
+The yellow and purple arrows represent connections related to the client traffic, and the black arrows represent access to the Kubernetes API.
+
+---
+
+## The NGINX Ingress Controller pod
+
+The NGINX Ingress Controller pod consists of a single container, which includes the following:
+
+- The _NGINX Ingress Controller process_, which configures NGINX according to Ingress and other resources created in the cluster.
+- The _NGINX master process_, which controls NGINX worker processes.
+- _NGINX worker processes_, which handle the client traffic and load balance the traffic to the backend applications.
+
+The following is an architectural diagram depicting how those processes interact together and with some external entities:
+
+{{<img src="/nic/ic-pod.png" alt="">}}
+
+This table describes each connection, starting with its type:
+
+{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
+| # | Protocols | Description |
+| --- | --- | --- |
+|1|HTTP| _Prometheus_ fetches NGINX Ingress Controller and NGINX metrics with an NGINX Ingress Controller HTTP endpoint (Default `:9113/metrics`). **Note**: *Prometheus* is not required and the endpoint can be turned off. |
+|2|HTTPS| _NGINX Ingress Controller_ reads the _Kubernetes API_ for the latest versions of the resources in the cluster and writes to the API to update the handled resources' statuses and emit events.
+|3|HTTP| _Kubelet_ checks the _NGINX Ingress Controller_ readiness probe (Default `:8081/nginx-ready`) to consider the _NGINX Ingress Controller_ pod [ready](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-conditions).
+|4|File I/O| When _NGINX Ingress Controller_ starts, it reads the _configuration templates_ from the filesystem necessary for configuration generation. The templates are located in the `/` directory of the container and have the `.tmpl` extension
+|5|File I/O| _NGINX Ingress Controller_ writes logs to *stdout* and *stderr*, which are collected by the container runtime.
+|6|File I/O| _NGINX Ingress Controller_ generates NGINX *configuration* based on the resources created in the cluster (See [NGINX Ingress Controller is a Kubernetes Controller](#nginx-ingress-controller-is-a-kubernetes-controller)) and writes it on the filesystem in the `/etc/nginx` folder. The configuration files have a `.conf` extension.
+|7|File I/O| _NGINX Ingress Controller_ writes _TLS certificates_ and _keys_ from any [TLS Secrets](https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets) referenced in the Ingress and other resources to the filesystem.
+|8|HTTP| _NGINX Ingress Controller_ fetches the [NGINX metrics](https://nginx.org/en/docs/http/ngx_http_stub_status_module.html#stub_status) via the `unix:/var/lib/nginx/nginx-status.sock` UNIX socket and converts it to Prometheus format used in #1.
+|9|HTTP| To verify a successful configuration reload, _NGINX Ingress Controller_ ensures at least one _NGINX worker_ has the new configuration. To do that, the *IC* checks a particular endpoint via the `unix:/var/lib/nginx/nginx-config-version.sock` UNIX socket.
+|10|N/A|  To start NGINX, NGINX Ingress Controller runs the `nginx` command, which launches the _NGINX master_.
+|11|Signal| To reload NGINX, the _NGINX Ingress Controller_ runs the `nginx -s reload` command, which validates the configuration and sends the [reload signal](https://nginx.org/en/docs/control.html) to the *NGINX master*.
+|12|Signal| To shutdown NGINX, the _NGINX Ingress Controller_ executes `nginx -s quit` command, which sends the graceful shutdown signal to the *NGINX master*.
+|13|File I/O| The _NGINX master_ sends logs to its _stdout_ and _stderr_, which are collected by the container runtime.
+|14|File I/O| The _NGINX master_ reads the _TLS cert and keys_ referenced in the configuration when it starts or reloads.
+|15|File I/O| The _NGINX master_ reads _configuration files_ when it starts or during a reload.
+|16|Signal| The _NGINX master_ controls the [lifecycle of _NGINX workers_](https://nginx.org/en/docs/control.html#reconfiguration) it creates workers with the new configuration and shutdowns workers with the old configuration.
+|17|File I/O| An _NGINX worker_ writes logs to its _stdout_ and _stderr_, which are collected by the container runtime.
+|18|UDP| An _NGINX worker_ sends the HTTP upstream server response latency logs via the Syslog protocol over the UNIX socket `/var/lib/nginx/nginx-syslog.sock` to _NGINX Ingress Controller_. In turn, _NGINX Ingress Controller_ analyzes and transforms the logs into Prometheus metrics.
+|19|HTTP,HTTPS,TCP,UDP| A _client_ sends traffic to and receives traffic from any of the _NGINX workers_ on ports 80 and 443 and any additional ports exposed by the [GlobalConfiguration resource](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource).
+|20|HTTP,HTTPS,TCP,UDP| An _NGINX worker_ sends traffic to and receives traffic from the _backends_.
+|21|HTTP| _Admin_ can connect to the [NGINX stub_status](http://nginx.org/en/docs/http/ngx_http_stub_status_module.html#stub_status) using port 8080 via an _NGINX worker_. By default, NGINX only allows connections from `localhost`.
+{{% /bootstrap-table %}}
+
+---
+
+### Differences with NGINX Plus
+
+The previous diagram depicts NGINX Ingress Controller using NGINX. NGINX Ingress Controller with NGINX Plus has the following differences:
+
+- To configure NGINX Plus, NGINX Ingress Controller uses [configuration reloads](#reloading-nginx) and the [NGINX Plus API](http://nginx.org/en/docs/http/ngx_http_api_module.html#api). This allows NGINX Ingress Controller to dynamically change the upstream servers.
+- Instead of the stub status metrics, the extended metrics available from the NGINX Plus API are used.
+- In addition to TLS certs and keys, NGINX Ingress Controller writes JWKs from the secrets of the type `nginx.org/jwk`, and NGINX workers read them.
+
+---
+
+## The NGINX Ingress Controller process
+
+This section covers the architecture of the NGINX Ingress Controller process, including:
+
+- How NGINX Ingress Controller processes a new Ingress resource created by a user.
+- A summary of how NGINX Ingress Controller works in relation to others Kubernetes Controllers.
+- The different components of the IC process.
+
+---
+
+### Processing a new Ingress resource
+
+The following diagram depicts how NGINX Ingress Controller processes a new Ingress resource. The the NGINX master and worker processes are represented as a single rectangle, _NGINX_ for simplicity. VirtualServer and VirtualServerRoute resources are indicated similarly.
+
+{{<img src="/nic/ic-process.png" alt="">}}
+
+Processing a new Ingress resource involves the following steps: each step corresponds to the arrow on the diagram with the same number:
+
+1. _User_ creates a new Ingress resource.
+1. The NGINX Ingress Controller process has a _Cache_ of the resources in the cluster. The _Cache_ includes only the resources NGINX Ingress Controller is concerned with such as Ingresses. The _Cache_ stays in sync with the Kubernetes API by [watching for changes to the resources](https://kubernetes.io/docs/reference/using-api/api-concepts/#efficient-detection-of-changes).
+1. Once the _Cache_ has the new Ingress resource, it notifies the _Control Loop_ about the changed resource.
+1. The _Control Loop_ gets the latest version of the Ingress resource from the _Cache_. Since the Ingress resource references other resources, such as TLS Secrets, the _Control loop_ gets the latest versions of those referenced resources as well.
+1. The _Control Loop_ generates TLS certificates and keys from the TLS Secrets and writes them to the filesystem.
+1. The _Control Loop_ generates and writes the NGINX _configuration files_, which correspond to the Ingress resource, and writes them to the filesystem.
+1. The _Control Loop_ reloads _NGINX_ and waits for _NGINX_ to successfully reload. As part of the reload:
+    1. _NGINX_ reads the _TLS certs and keys_.
+    1. _NGINX_ reads the _configuration files_.
+1. The _Control Loop_ emits an event for the Ingress resource and updates its status. If the reload fails, the event includes the error message.
+
+---
+
+### NGINX Ingress Controller is a Kubernetes controller
+
+With the context from the previous sections, we can generalize how NGINX Ingress Controller works:
+
+*NGINX Ingress Controller constantly processes both new resources and changes to the existing resources in the cluster. As a result, the NGINX configuration stays up-to-date with the resources in the cluster.*
+
+NGINX Ingress Controller is an example of a [Kubernetes Controller](https://kubernetes.io/docs/concepts/architecture/controller/): NGINX Ingress Controller runs a control loop that ensures NGINX is configured according to the desired state (Ingresses and other resources).
+
+The desired state is based on the following built-in Kubernetes resources and Custom Resources (CRs):
+
+- Layer 7 Load balancing configuration:
+  - Ingresses
+  - VirtualServers (CR)
+  - VirtualServerRoutes (CR)
+- Layer 7 policies:
+  - Policies (CR)
+- Layer 4 load balancing configuration:
+  - TransportServers (CR)
+- Service discovery:
+  - Services
+  - Endpoints
+  - Pods
+- Secret configuration:
+  - Secrets
+- Global Configuration:
+  - ConfigMap (only one resource)
+  - GlobalConfiguration (CR, only one resource)
+
+NGINX Ingress Controller can watch additional Custom Resources, which are less common and not enabled by default:
+
+- [NGINX App Protect resources]({{< ref "/nic/installation/integrations/app-protect-dos/configuration" >}}) (APPolicies, APLogConfs, APUserSigs)
+- IngressLink resource (only one resource)
+
+---
+
+## NGINX Ingress Controller process components
+
+In this section, we describe the components of the NGINX Ingress Controller process and how they interact, including:
+
+1. How NGINX Ingress Controller watches for resources changes.
+1. The main components of the NGINX Ingress Controller _Control Loop_.
+1. How those components process a resource change.
+1. Additional components that are crucial for processing changes.
+
+NGINX Ingress Controller is written in [Go](https://golang.org/) and relies heavily on the [Go client for Kubernetes](https://github.com/kubernetes/client-go). Where relevant, we include links to the source code on GitHub.
+
+### Resource caches
+
+In an earlier section, [Processing a New Ingress Resource](#processing-a-new-ingress-resource), we mentioned that NGINX Ingress Controller has a cache of the resources in the cluster that stays in sync with the Kubernetes API by watching them for changes.
+
+We also mentioned that once the cache is updated, it notifies the control loop about the changed resources. The cache is actually a collection of *informers*. The following diagram shows how changes to resources are processed by NGINX Ingress Controller.
+
+{{<img src="/nic/ic-process-components.png" alt="">}}
+
+- For every resource type that NGINX Ingress Controller monitors, it creates an [_Informer_](https://pkg.go.dev/k8s.io/client-go@v0.21.0/tools/cache#SharedInformer). The _Informer_ includes a _Store_ that holds the resources of that type. To keep the _Store_ in sync with the latest versions of the resources in the cluster, the _Informer_ calls the Watch and List _Kubernetes APIs_ for that resource type (see the arrow _1. Watch and List_ on the diagram).
+- When a change happens in the cluster (for example, a new resource is created), the _Informer_ updates its _Store_ and invokes [_Handlers_](https://pkg.go.dev/k8s.io/client-go@v0.21.0/tools/cache#ResourceEventHandler) (See the arrow _2. Invoke_) for that _Informer_.
+- NGINX Ingress Controller registers _Handlers_ for every _Informer_. Most of the time, a _Handler_ creates an entry for the affected resource in the _Workqueue_ where a workqueue element includes the type of the resource and its namespace and name (See the arrow _3. Put_).
+- The _Workqueue_ always tries to drain itself: if there is an element at the front, the queue will remove the element and send it to the _Controller_ by calling a callback function (See the arrow _4. Send_).
+- The _Controller_ is the primary component of NGINX Ingress Controller, which represents the _Control Loop_, explained in [The Control Loop](#the-control-loop) section. To process a workqueue element, the _Controller_ component gets the latest version of the resource from the _Store_ (See the arrow _5. Get_), reconfigures _NGINX_ according to the resource (See the arrow _6. Reconfigure*_, updates the resource status, and emits an event via the _Kubernetes API_ (See the arrow  _7. Update status and emit event_).
+
+---
+
+### The control loop
+
+This section discusses the main components of NGINX Ingress Controller, which comprise the control loop:
+
+- [Controller](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/controller.go#L90)
+  - Runs the NGINX Ingress Controller control loop.
+  - Instantiates _Informers_, _Handlers_, the _Workqueue_ and additional helper components.
+  - Includes the sync method), which is called by the _Workqueue_ to process a changed resource.
+  - Passes changed resources to _Configurator_ to re-configure NGINX.
+- [Configurator](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/configs/configurator.go#L95)
+  - Generates NGINX configuration files, TLS and cert keys, and JWKs based on the Kubernetes resource.
+  - Uses _Manager_ to write the generated files and reload NGINX.
+- [Manager](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/nginx/manager.go#L52)
+  - Controls the lifecycle of NGINX (starting, reloading, quitting). See [Reloading NGINX](#reloading-nginx) for more details about reloading.
+  - Manages the configuration files, TLS keys and certs, and JWKs.
+
+The following diagram shows how the three components interact:
+
+{{<img src="/nic/control-loop.png" alt="">}}
+
+---
+
+#### The Controller sync method
+
+The Controller [sync](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/controller.go#L663) method is called by the _Workqueue_ to process a change of a resource. The method determines the _kind_ of the resource and calls the appropriate _sync_ method (Such as _syncIngress_ for Ingress resources).
+
+To explain how the sync methods work, we will examine the most important one: the _syncIngress_ method, and describe how it processes a new Ingress resource.
+
+{{<img src="/nic/controller-sync.png" alt="">}}
+
+1. The _Workqueue_ calls the _sync_ method and passes a workqueue element to it that includes the changed resource _kind_ and _key_ (The key is the resource namespace/name such as “default/cafe-ingress”).
+1. Using the _kind_, the _sync_ method calls the appropriate sync method and passes the resource key. For Ingress resources, the method is _syncIngress_.
+1. _syncIngress_ gets the Ingress resource from the *Ingress Store* using the key. The _Store_ is controlled by the _Ingress Informer_. In the code, we use the helper _storeToIngressLister_ type that wraps the _Store_.
+1. _syncIngress_ calls _AddOrUpdateIngress_ of the _Configuration_, passing the Ingress along. The [Configuration](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/configuration.go#L320) is a component that represents a valid collection of load balancing configuration resources (Ingresses, VirtualServers, VirtualServerRoutes, TransportServers), ready to be converted to the NGINX configuration (see the [Configuration section](#configuration) for more details). _AddOrUpdateIngress_ returns a list of [ResourceChanges](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/configuration.go#L59), which must be reflected in the NGINX config. Typically, for a new Ingress resource, the _Configuration_ returns only a single _ResourceChange_.
+1. _syncIngress_ calls _processChanges_, which processes the single Ingress _ResourceChange_.
+    1. _processChanges_ creates an extended Ingress resource (_IngressEx_) that includes the original Ingress resource and its dependencies, such as Endpoints and Secrets, to generate the NGINX configuration. For simplicity, we don’t show this step on the diagram.
+    1. _processChanges_ calls _AddOrUpdateIngress_ of the _Configurator_ and passes the extended Ingress resource.
+1. _Configurator_ generates an NGINX configuration file based on the extended Ingress resource, then:
+    1. Calls _Manager’s CreateConfig()_ to  update the config for the Ingress resource.
+    1. Calls _Manager’s Reload()_ to reload NGINX.
+1. The reload status is propagated from _Manager_ to _processChanges_, and is either a success or a failure with an error message.
+1. _processChanges_ calls _updateRegularIngressStatusAndEvent_ to update the status of the Ingress resource and emit an event with the status of the reload: both make an API call to the Kubernetes API.
+
+**Additional notes**:
+
+- Many details are not included for conciseness: the source code provides the most granular detail.
+- The _syncVirtualServer_, _syncVirtualServerRoute_, and _syncTransportServer_ methods are similar to _syncIngress_, while other sync methods are different. However, those methods typically find the affected Ingress, VirtualServer, and TransportServer resources and regenerate the configuration for them.
+- The _Workqueue_ has only a single worker thread that calls the sync method synchronously, meaning the _Control Loop_ processes only one change at a time.
+
+---
+
+#### Helper components
+
+There are two additional helper components crucial for processing changes: _Configuration_ and _LocalSecretStore_.
+
+---
+
+##### Configuration
+
+[_Configuration_](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/configuration.go#L320) holds the latest valid state of the NGINX Ingress Controller load balancing configuration resources: Ingresses, VirtualServers, VirtualServerRoutes, TransportServers, and GlobalConfiguration.
+
+The _Configuration_ supports add, update and delete operations on the resources. When you invoke these operations on a resource in the Configuration, it performs the following:
+
+1. Validates the object (For add or update)
+1. Calculates the changes to the affected resources that are necessary to propagate to the NGINX configuration, returning the changes to the caller.
+
+For example, when you add a new Ingress resource, the _Configuration_ returns a change requiring NGINX Ingress Controller to add the configuration for that Ingress to the NGINX configuration files. If you made an existing Ingress resource invalid, the _Configuration_ returns a change requiring NGINX Ingress Controller to remove the configuration for that Ingress from the NGINX configuration files.
+
+Additionally, the _Configuration_ ensures that only one Ingress/VirtualServer/TransportServer (TLS Passthrough) resource holds a particular host (For example, cafe.example.com) and only one TransportServer (TCP/UDP) holds a particular listener (Such as port 53 for UDP). This ensures that no host or listener collisions happen in the NGINX configuration.
+
+Ultimately, NGINX Ingress Controller ensures the NGINX config on the filesystem reflects the state of the objects in the _Configuration_ at any point in time.
+
+---
+
+##### LocalSecretStore
+
+[_LocalSecretStore_](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/secrets/store.go#L32) (of the _SecretStore_ interface) holds the valid Secret resources and keeps the corresponding files on the filesystem in sync with them. Secrets are used to hold TLS certificates and keys (type `kubernetes.io/tls`), CAs (`nginx.org/ca`), JWKs (`nginx.org/jwk`), and client secrets for an OIDC provider (`nginx.org/oidc`).
+
+When _Controller_ processes a change to a configuration resource like Ingress, it creates an extended version of a resource that includes the dependencies (Such as Secrets) necessary to generate the NGINX configuration. _LocalSecretStore_ allows _Controller_ to reference the filesystem for a secret using the secret key (namespace/name).
+
+---
+
+## Reloading NGINX
+
+The following sections describe how NGINX reloads and how NGINX Ingress Controller specifically affects this process.
+
+---
+
+### How NGINX reloads work
+
+Reloading NGINX is necessary to apply new configuration changes and occurs with these steps:
+
+1. The administrator sends a HUP (hangup) signal to the NGINX master process to trigger a reload.
+1. The master process brings down the worker processes with the old configuration and starts worker processes with the new configuration.
+1. The administrator verifies the reload has successfully finished.
+
+The [NGINX documentation](https://nginx.org/en/docs/control.html#reconfiguration) has more details about reloading.
+
+---
+
+#### How to reload NGINX and confirm success
+
+The NGINX binary (`nginx`) supports the reload operation with the `-s reload` option. When you run this option:
+
+1. It validates the new NGINX configuration and exits if it is invalid printing the error messages to the stderr.
+1. It sends a HUP signal to the NGINX master process and exits.
+
+As an alternative, you can send a HUP signal to the NGINX master process directly.
+
+Once the reload operation has been invoked with `nginx -s reload`, there is no wait period for NGINX to finish reloading. This means it is the responsibility of an administator to check it is finished, for which there are a few options:
+
+- Check if the master process created new worker processes. Two ways are by running `ps` or reading the `/proc` file system.
+- Send an HTTP request to NGINX, to see if a new worker process responds. This signifies that NGINX reloaded successfully: this method requires additional NGINX configuration, explained below.
+
+NGINX reloads take roughly 200ms. The factors affecting reload time are configuration size and details, the number of TLS certificates/keys, enabled modules, and available CPU resources.
+
+---
+
+#### Potential problems
+
+Most of the time, if `nginx -s reload` executes, the reload will also succeed. In the rare case a reload fails, the NGINX master process will print the an error message. This is an example:
+
+```shell
+2022/07/09 00:56:42 [emerg] 1353#1353: limit_req "one" uses the "$remote_addr" key while previously it used the "$binary_remote_addr" key
+```
+
+The operation is graceful; reloading doesn't lead to any traffic loss by NGINX. However, frequent reloads can lead to high memory utilization and potential OOM (Out-Of-Memory) errors, resulting in traffic loss. This can most likely happen if you (1) proxy traffic that utilizes long-lived connections (ex: Websockets, gRPC) and (2) reload frequently. In these scenarios, you can end up with multiple generations of NGINX worker processes that are shutting down which will force old workers to shut down after the timeout). Eventually, all those worker processes can exhaust the system's available memory.
+
+Old NGINX workers will not shut down until all connections are terminated either by clients or backends, unless you configure [worker_shutdown_timeout](https://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout). Since both the old and new NGINX worker processes coexist during a reload, reloading can lead to two spikes in memory utilization. With a lack of available memory, the NGINX master process can fail to create new worker processes.
+
+---
+
+### Reloading in NGINX Ingress Controller
+
+NGINX Ingress Controller reloads NGINX to apply configuration changes.
+
+To facilitate reloading, NGINX Ingress Controller configures a server listening on the Unix socket `unix:/var/lib/nginx/nginx-config-version.sock` that responds with the configuration version for `/configVersion` URI. NGINX Ingress Controller writes the configuration to  `/etc/nginx/config-version.conf`.
+
+Reloads occur with this sequence of steps:
+
+1. NGINX Ingress Controller updates generated configuration files, including any secrets.
+1. NGINX Ingress Controller updates the config version in `/etc/nginx/config-version.conf`.
+1. NGINX Ingress Controller runs `nginx -s reload`. If the command fails, NGINX Ingress Controller logs the error and considers the reload failed.
+1. If the command succeeds, NGINX Ingress Controller periodically checks for the config version by sending an HTTP request to the config version server on  `unix:/var/lib/nginx/nginx-config-version.sock`.
+1. Once NGINX Ingress Controller sees the correct config version returned by NGINX, it considers the reload successful. If it doesn't see the correct configuration version after the configurable timeout ( [`-nginx-reload-timeout`]({{<ref "/nic/configuration/global-configuration/command-line-arguments">}})), NGINX Ingress Controller considers the reload failed.
+
+The [NGINX Ingress Controller Control Loop](#the-control-loop) stops during a reload so that it cannot affect configuration files or reload NGINX until the current reload succeeds or fails.
+
+---
+
+### When NGINX Ingress Controller reloads NGINX
+
+NGINX Ingress Controller reloads NGINX every time the Control Loop processes a change that affects the generated NGINX configuration. In general, every time a monitored resource is changed, NGINX Ingress Controller will regenerate the configuration and reload NGINX.
+
+There are three special cases:
+
+- *Start*. When NGINX Ingress Controller starts, it processes all resources in the cluster and only then reloads NGINX. This avoids a "reload storm" by reloading only once.
+- *Batch updates*. When NGINX Ingress Controller receives a number of concurrent requests from the Kubernetes API, it will pause NGINX reloads until the task queue is empty. This reduces the number of reloads to minimize the impact of batch updates and reduce the risk of OOM (Out of Memory) errors.
+- *NGINX Plus*. If NGINX Ingress Controller is using NGINX Plus, it will not reload NGINX Plus for changes to the Endpoints resources. In this case, NGINX Ingress Controller will use the NGINX Plus API to update the corresponding upstreams and skip reloading.
diff --git a/content/nic/overview/nginx-plus.md b/content/nic/overview/nginx-plus.md
new file mode 100644
index 000000000..67adfa515
--- /dev/null
+++ b/content/nic/overview/nginx-plus.md
@@ -0,0 +1,35 @@
+---
+docs: DOCS-611
+doctypes:
+- concept
+title: Extensibility with NGINX Plus
+weight: 300
+---
+
+This document explains how F5 NGINX Plus can extend the functionality of F5 NGINX Ingress Controller.
+
+NGINX Ingress Controller works with [NGINX](https://nginx.org/) as well as [NGINX Plus](https://www.nginx.com/products/nginx/), a commercial closed source version of NGINX which has additional features and support from NGINX Inc. NGINX Ingress Controller can leverage functionality from NGINX Plus to extend its base capabilities.
+
+---
+
+## Additional features
+
+- _Real-time metrics_: Metrics for NGINX Plus and application performance are available through the API or the [NGINX Status Page]({{< ref "/nic/logging-and-monitoring/status-page">}}). These metrics can also be exported to [Prometheus]({{< ref "/nic/logging-and-monitoring/prometheus">}}).
+- _Additional load balancing methods_: The `least_time` and `random two least_time` methods and their derivatives become available. The NGINX [`ngx_http_upstream_module` documentation](https://nginx.org/en/docs/http/ngx_http_upstream_module.html) has the complete list of load balancing methods.
+- _Session persistence_: The *sticky cookie* method becomes available. See the [Ingress Resource](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/session-persistence) and [Custom Resource](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/session-persistence) examples.
+- _Active health checks_:  See the [Ingress Resource](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) and [Custom Resource](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/health-checks) examples.
+- _JWT validation_: See the [Ingress Resource](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/jwt) and [Custom Resource](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/jwt) examples.
+
+For a comprehensive guide of NGINX Plus features available with Ingress resources, see the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource">}}) and [Annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations">}}) documentation.
+
+{{< note >}} NGINX Plus features are configured for Ingress resources using Annotations that start with `nginx.com`. {{< /note >}}
+
+For a comprehensive guide of NGINX Plus features available with custom resources, see the [Policy]({{< ref "/nic/configuration/policy-resource" >}}), [VirtualServer]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources" >}}) and [TransportServer]({{< ref "/nic/configuration/transportserver-resource" >}}) documentation.
+
+---
+
+## Dynamic reconfiguration
+
+NGINX Ingress Controller updates the configuration of the load balancer to reflect changes every time the number of pods exposed through an Ingress resource changes. When using NGINX, the configuration file must be changed then reloaded.
+
+For NGINX Plus, its dynamic reconfiguration is utilized, updating NGINX Plus without reloading. This avoids the increase of memory usage caused by reloads (Particularly with large volumes of client requests) and when load balancing applications with long-lived connections (Such as those using WebSockets or handling file uploads, downloads or streaming).
diff --git a/content/nic/overview/product-telemetry.md b/content/nic/overview/product-telemetry.md
new file mode 100644
index 000000000..f6421b1f1
--- /dev/null
+++ b/content/nic/overview/product-telemetry.md
@@ -0,0 +1,84 @@
+---
+title: Product telemetry
+toc: true
+weight: 500
+---
+
+Learn why, what and how F5 NGINX Ingress Controller collects telemetry.
+
+---
+
+## Overview
+
+NGINX Ingress Controller collects product telemetry data to allow its developers to understand how it's deployed and configured by users. This data is used to triage development work, prioritizing features and functionality that will benefit the most people.
+
+Product telemetry is enabled by default, collected once every 24 hours. It's then sent over HTTPS to a service managed by F5 at `oss.edge.df.f5.com`.
+
+{{< note >}} If you would prefer not to send any telemetry data, you can [opt-out](#opt-out) when installing NGINX Ingress Controller. {{< /note >}}
+
+---
+
+## Data collected
+
+These are the data points collected and reported by NGINX Ingress Controller:
+
+- **Project Name** The name of the software, which will be labelled `NIC`.
+- **Project Version** NGINX Ingress Controller version.
+- **Project Architecture** The architecture of the kubernetes environment. (e.g. amd64, arm64, etc...)
+- **Cluster ID** A unique identifier of the kubernetes cluster that NGINX Ingress Controller is deployed to.
+- **Cluster Version** The version of the Kubernetes cluster.
+- **Cluster Platform** The platform that the kubernetes cluster is operating on. (e.g. eks, aks,  etc...)
+- **Cluster Node Count** The number of nodes in the cluster that NGINX Ingress Controller is deployed to.
+- **Installation ID** Used to identify a unique installation of NGINX Ingress Controller.
+- **VirtualServers** The number of VirtualServer resources managed by NGINX Ingress Controller.
+- **VirtualServerRoutes** The number of VirtualServerRoute resources managed by NGINX Ingress Controller.
+- **TransportServers** The number of TransportServer resources managed by NGINX Ingress Controller.
+- **Replicas** Number of Deployment replicas, or Daemonset instances.
+- **Secrets** Number of Secret resources managed by NGINX Ingress Controller.
+- **ClusterIPServices** Number of ClusterIP Services managed by NGINX Ingress Controller.
+- **NodePortServices** Number of NodePort Services managed by NGINX Ingress Controller.
+- **LoadBalancerServices** Number of LoadBalancer Services managed by NGINX Ingress Controller.
+- **ExternalNameServices** Number of ExternalName Services managed by NGINX Ingress Controller.
+- **RegularIngressCount** The number of Regular Ingress resources managed by NGINX Ingress Controller.
+- **MasterIngressCount** The number of Master Ingress resources managed by NGINX Ingress Controller.
+- **MinionIngressCount** The number of Minion Ingress resources managed by NGINX Ingress Controller.
+- **IngressClasses** Number of Ingress Classes in the cluster.
+- **IngressAnnotations** List of Ingress annotations managed by NGINX Ingress Controller
+- **AccessControlPolicies** Number of AccessControl policies.
+- **RateLimitPolicies** Number of RateLimit policies.
+- **APIKeyPolicies** Number of API Key Auth policies.
+- **JWTAuthPolicies** Number of JWTAuth policies.
+- **BasicAuthPolicies** Number of BasicAuth policies.
+- **IngressMTLSPolicies** Number of IngressMTLS policies.
+- **EgressMTLSPolicies** Number of EgressMTLS policies.
+- **OIDCPolicies** Number of OIDC policies.
+- **WAFPolicies** Number of WAF policies.
+- **GlobalConfiguration** Represents the use of a GlobalConfiguration resource.
+- **AppProtectVersion** The AppProtect version
+- **IsPlus** Represents whether NGINX is Plus or OSS
+- **InstallationFlags** List of command line arguments configured for NGINX Ingress Controller
+- **BuildOS** The base operating system image in which NGINX Ingress Controller is running on.
+- **ConfigMapKeys** List of ConfigMap keys from the main ConfigMap configured for NGINX Ingress Controller.
+- **MGMTConfigMapKeys** List of MGMTConfigMap keys from the mgmt ConfigMap configured for NGINX Ingress Controller.
+
+---
+
+## Opt out
+
+Product telemetry can be disabled when installing NGINX Ingress Controller.
+
+### Helm
+
+When installing or upgrading NGINX Ingress Controller with Helm, set the `controller.telemetryReporting.enable` option to `false`.
+
+This can be set directly in the `values.yaml` file, or using the `--set` option
+
+```shell
+helm upgrade --install ... --set controller.telemetryReporting.enable=false
+```
+
+---
+
+### Manifests
+
+When installing NGINX Ingress Controller with Manifests, set the `-enable-telemetry-reporting` flag to `false`
diff --git a/content/nic/releases.md b/content/nic/releases.md
new file mode 100644
index 000000000..8c8a585da
--- /dev/null
+++ b/content/nic/releases.md
@@ -0,0 +1,2407 @@
+---
+title: Releases
+weight: 2100
+toc: true
+type: reference
+product: NIC
+docs: DOCS-616
+---
+## 5.0.0
+
+16 Apr 2025
+
+Added support for [NGINX Plus R34](https://docs.nginx.com/nginx/releases/#nginxplusrelease-34-r34), users needing to use a forward proxy for license verification are now able to make use of the [`proxy`](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy) directives available in F5 NGINX Plus.
+
+{{< important >}}
+With the removal of the OpenTracing dynamic module from [NGINX Plus R34](https://docs.nginx.com/nginx/releases/#nginxplusrelease-34-r34), NGINX Ingress Controller also removes full OpenTracing support.  This will affect users making use of OpenTracing with the ConfigMap, `server-snippets` & `location-snippets` parameters.  Support for tracing with [OpenTelemetry](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/opentelemetry/) will come in a future release.
+{{< /important >}}
+
+We have extended the rate-limit Policy to allow tiered rate limit groups with JWT claims.  This will also allow users to apply different rate limits to their `VirtualServer` or `VirtualServerRoutes` with the value of a JWT claim.  See [here](https://github.com/nginx/kubernetes-ingress/tree/v5.0.0/examples/custom-resources/rate-limit-tiered-jwt-claim/) for a working example.
+
+We introduced NGINX Plus Zone Sync as a managed service within NGINX Ingress Controller in this release.  In previous releases, we had examples using `stream-snippets` for OIDC support, users can now enable `zone-sync` without the need for `snippets`.  NGINX Plus Zone Sync is available when utilising two or more replicas, it supports OIDC & rate limiting. 
+
+{{< note >}}
+For users who have previously installed OIDC or used the `zone_sync` directive with `stream-snippets`, please see the note in the [Configmap resources]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) topic to use the new `zone-sync` ConfigMap option.
+{{< /note >}}
+
+Open Source NGINX Ingress Controller architectures `armv7`, `s390x` & `ppc64le` are deprecated and will be removed in the next minor release.
+
+### <i class="fa-solid fa-bomb"></i> Breaking Changes
+- [7633](https://github.com/nginx/kubernetes-ingress/pull/7633) & [7567](https://github.com/nginx/kubernetes-ingress/pull/7567) Remove OpenTracing support
+
+### <i class="fa-solid fa-rocket"></i> Features
+- [7054](https://github.com/nginx/kubernetes-ingress/pull/7054) Increase port number range
+- [7175](https://github.com/nginx/kubernetes-ingress/pull/7175) Ratelimit based on JWT claim
+- [7205](https://github.com/nginx/kubernetes-ingress/pull/7205), [7238](https://github.com/nginx/kubernetes-ingress/pull/7238), [7390](https://github.com/nginx/kubernetes-ingress/pull/7390) & [7393](https://github.com/nginx/kubernetes-ingress/pull/7393) Tiered Rate limit groups with JWT claim
+- [7239](https://github.com/nginx/kubernetes-ingress/pull/7239), [7347](https://github.com/nginx/kubernetes-ingress/pull/7347), [7445](https://github.com/nginx/kubernetes-ingress/pull/7445), [7468](https://github.com/nginx/kubernetes-ingress/pull/7468), [7521](https://github.com/nginx/kubernetes-ingress/pull/7521) & [7654](https://github.com/nginx/kubernetes-ingress/pull/7654) Zone Sync support
+- [7560](https://github.com/nginx/kubernetes-ingress/pull/7560) Add forward proxy support for NGINX Plus licensing connectivity
+- [7299](https://github.com/nginx/kubernetes-ingress/pull/7299) & [7597](https://github.com/nginx/kubernetes-ingress/pull/7597) Add support for NGINX OSS 1.27.4, NGINX Plus R34 & App Protect WAF 4.13 & 5.6
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [7121](https://github.com/nginx/kubernetes-ingress/pull/7121) Clean up and fix for NIC Pod failing to bind when NGINX exits unexpectedly
+- [7185](https://github.com/nginx/kubernetes-ingress/pull/7185) Correct typo in helm lease annotations template
+- [7400](https://github.com/nginx/kubernetes-ingress/pull/7400) Add tracking.info and copy into plus images
+- [7519](https://github.com/nginx/kubernetes-ingress/pull/7519) Add NGINX state directory for ReadOnlyRootFilesystem
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+- [7318](https://github.com/nginx/kubernetes-ingress/pull/7318) Allow customization of service http and https port names through helm
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [6964](https://github.com/nginx/kubernetes-ingress/pull/6964), [6970](https://github.com/nginx/kubernetes-ingress/pull/6970), [6978](https://github.com/nginx/kubernetes-ingress/pull/6978), [6992](https://github.com/nginx/kubernetes-ingress/pull/6992), [7017](https://github.com/nginx/kubernetes-ingress/pull/7017), [7052](https://github.com/nginx/kubernetes-ingress/pull/7052), [7105](https://github.com/nginx/kubernetes-ingress/pull/7105), [7131](https://github.com/nginx/kubernetes-ingress/pull/7131), [7122](https://github.com/nginx/kubernetes-ingress/pull/7122), [7138](https://github.com/nginx/kubernetes-ingress/pull/7138), [7149](https://github.com/nginx/kubernetes-ingress/pull/7149), [7162](https://github.com/nginx/kubernetes-ingress/pull/7162), [7225](https://github.com/nginx/kubernetes-ingress/pull/7225), [7240](https://github.com/nginx/kubernetes-ingress/pull/7240), [7262](https://github.com/nginx/kubernetes-ingress/pull/7262), [7290](https://github.com/nginx/kubernetes-ingress/pull/7290), [7312](https://github.com/nginx/kubernetes-ingress/pull/7312), [7345](https://github.com/nginx/kubernetes-ingress/pull/7345), [7362](https://github.com/nginx/kubernetes-ingress/pull/7362), [7375](https://github.com/nginx/kubernetes-ingress/pull/7375), [7385](https://github.com/nginx/kubernetes-ingress/pull/7385), [7415](https://github.com/nginx/kubernetes-ingress/pull/7415), [7403](https://github.com/nginx/kubernetes-ingress/pull/7403), [7435](https://github.com/nginx/kubernetes-ingress/pull/7435), [7459](https://github.com/nginx/kubernetes-ingress/pull/7459), [7472](https://github.com/nginx/kubernetes-ingress/pull/7472), [7483](https://github.com/nginx/kubernetes-ingress/pull/7483), [7505](https://github.com/nginx/kubernetes-ingress/pull/7505), [7501](https://github.com/nginx/kubernetes-ingress/pull/7501), [7522](https://github.com/nginx/kubernetes-ingress/pull/7522), [7543](https://github.com/nginx/kubernetes-ingress/pull/7543), [7594](https://github.com/nginx/kubernetes-ingress/pull/7594), [7619](https://github.com/nginx/kubernetes-ingress/pull/7619), [7635](https://github.com/nginx/kubernetes-ingress/pull/7635) & [7650](https://github.com/nginx/kubernetes-ingress/pull/7650) Bump Go dependencies
+- [7607](https://github.com/nginx/kubernetes-ingress/pull/7607) Bump Go version to 1.24.2
+- [7006](https://github.com/nginx/kubernetes-ingress/pull/7006), [7016](https://github.com/nginx/kubernetes-ingress/pull/7016), [7020](https://github.com/nginx/kubernetes-ingress/pull/7020), [7045](https://github.com/nginx/kubernetes-ingress/pull/7045), [7069](https://github.com/nginx/kubernetes-ingress/pull/7069), [7080](https://github.com/nginx/kubernetes-ingress/pull/7080), [7099](https://github.com/nginx/kubernetes-ingress/pull/7099), [7115](https://github.com/nginx/kubernetes-ingress/pull/7115), [7132](https://github.com/nginx/kubernetes-ingress/pull/7132), [7140](https://github.com/nginx/kubernetes-ingress/pull/7140), [7150](https://github.com/nginx/kubernetes-ingress/pull/7150), [7173](https://github.com/nginx/kubernetes-ingress/pull/7173), [7243](https://github.com/nginx/kubernetes-ingress/pull/7243), [7256](https://github.com/nginx/kubernetes-ingress/pull/7256), [7288](https://github.com/nginx/kubernetes-ingress/pull/7288), [7293](https://github.com/nginx/kubernetes-ingress/pull/7293), [7306](https://github.com/nginx/kubernetes-ingress/pull/7306), [7309](https://github.com/nginx/kubernetes-ingress/pull/7309), [7319](https://github.com/nginx/kubernetes-ingress/pull/7319), [7376](https://github.com/nginx/kubernetes-ingress/pull/7376), [7409](https://github.com/nginx/kubernetes-ingress/pull/7409), [7404](https://github.com/nginx/kubernetes-ingress/pull/7404), [7452](https://github.com/nginx/kubernetes-ingress/pull/7452), [7454](https://github.com/nginx/kubernetes-ingress/pull/7454), [7461](https://github.com/nginx/kubernetes-ingress/pull/7461), [7474](https://github.com/nginx/kubernetes-ingress/pull/7474), [7490](https://github.com/nginx/kubernetes-ingress/pull/7490), [7511](https://github.com/nginx/kubernetes-ingress/pull/7511), [7523](https://github.com/nginx/kubernetes-ingress/pull/7523), [7527](https://github.com/nginx/kubernetes-ingress/pull/7527), [7534](https://github.com/nginx/kubernetes-ingress/pull/7534), [7539](https://github.com/nginx/kubernetes-ingress/pull/7539), [7551](https://github.com/nginx/kubernetes-ingress/pull/7551), [7564](https://github.com/nginx/kubernetes-ingress/pull/7564), [7590](https://github.com/nginx/kubernetes-ingress/pull/7590), [7631](https://github.com/nginx/kubernetes-ingress/pull/7631) & [7467](https://github.com/nginx/kubernetes-ingress/pull/7467) Bump Docker dependencies
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX Open Source, use the 5.0.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=5.0.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 5.0.0 images from the F5 Container registry or build your own image using the 5.0.0 source code
+- For Helm, use version 2.1.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.32.
+
+## 4.0.1
+
+07 Feb 2025
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [7295](https://github.com/nginx/kubernetes-ingress/pull/7295) Clean up and fix for NIC Pod failing to bind when NGINX exits unexpectedly
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+{{< warning >}} From this release onwards, the Helm chart location has changed from `oci://ghcr.io/nginxinc/charts/nginx-ingress` to `oci://ghcr.io/nginx/charts/nginx-ingress`. {{< /warning >}}
+- [7188](https://github.com/nginx/kubernetes-ingress/pull/7188) Correct typo in helm lease annotations template
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [7301](https://github.com/nginx/kubernetes-ingress/pull/7301), [7307](https://github.com/nginx/kubernetes-ingress/pull/7307) & [7310](https://github.com/nginx/kubernetes-ingress/pull/7310) Update to nginx 1.27.4
+- [7163](https://github.com/nginx/kubernetes-ingress/pull/7163) Bump Go version to 1.23.5
+- [7024](https://github.com/nginx/kubernetes-ingress/pull/7024), [7061](https://github.com/nginx/kubernetes-ingress/pull/7061), [7113](https://github.com/nginx/kubernetes-ingress/pull/7113), [7145](https://github.com/nginx/kubernetes-ingress/pull/7145), [7148](https://github.com/nginx/kubernetes-ingress/pull/7148), [7154](https://github.com/nginx/kubernetes-ingress/pull/7154), [7164](https://github.com/nginx/kubernetes-ingress/pull/7164), [7229](https://github.com/nginx/kubernetes-ingress/pull/7229), [7265](https://github.com/nginx/kubernetes-ingress/pull/7265), [7250](https://github.com/nginx/kubernetes-ingress/pull/7250), [7296](https://github.com/nginx/kubernetes-ingress/pull/7296) & [7321](https://github.com/nginx/kubernetes-ingress/pull/7321) Bump Go dependencies
+- [7012](https://github.com/nginx/kubernetes-ingress/pull/7012), [7022](https://github.com/nginx/kubernetes-ingress/pull/7022), [7028](https://github.com/nginx/kubernetes-ingress/pull/7028), [7144](https://github.com/nginx/kubernetes-ingress/pull/7144), [7152](https://github.com/nginx/kubernetes-ingress/pull/7152), [7155](https://github.com/nginx/kubernetes-ingress/pull/7155), [7181](https://github.com/nginx/kubernetes-ingress/pull/7181), [7267](https://github.com/nginx/kubernetes-ingress/pull/7267), [7302](https://github.com/nginx/kubernetes-ingress/pull/7302), [7304](https://github.com/nginx/kubernetes-ingress/pull/7304) & [7320](https://github.com/nginx/kubernetes-ingress/pull/7320) Bump Docker dependencies
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 4.0.1 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=4.0.1),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 4.0.1 images from the F5 Container registry or build your own image using the 4.0.1 source code
+- For Helm, use version 2.0.1 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.32.
+
+## 4.0.0
+
+16 Dec 2024
+
+With added support for [NGINX R33](https://docs.nginx.com/nginx/releases/#nginxplusrelease-33-r33), deployments of F5 NGINX Ingress Controller using NGINX Plus now require a valid JSON Web Token to run.
+Please see the [Upgrading to v4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4#create-license-secret" >}}) for full details on setting up your license `Secret`.
+
+API Version `v1alpha1` of `GlobalConfiguration`, `Policy` and `TransportServer` resources are now deprecated.
+Please see [Update custom resource apiVersion]({{< ref "/nic/installation/installing-nic/upgrade-to-v4#update-custom-resource-apiversion" >}}) for full details on updating your resources.
+
+Updates have been made to our logging library. For a while, F5 NGINX Ingress Controller has been using the [golang/glog](https://github.com/golang/glog). For this release, we have moved to the native golang library [log/slog](https://pkg.go.dev/log/slog).
+This change was made for these reasons:
+1. By using a standard library, we ensure that updates are more consistent, and any known vulnerabilities are more likely to be addressed in a timely manner.
+2. By moving to `log/slog`, we enable support for a wider range of logging formats, as well as allowing log outputs to be displayed in a Structured format, and for faster log parsing.
+
+Layer 4 applications got some love this release, with added support for SNI based routing with our TransportServer resource!
+In scenarios where you have multiple applications hosted on a single node, this feature enables routing to those applications through the host header.
+For more details on what this feature does, and how to configure it yourself, please look to our [examples section in Github](https://github.com/nginx/kubernetes-ingress/tree/v4.0.0/examples/custom-resources/transport-server-sni#transportserver-sni)
+
+### <i class="fa-solid fa-bomb"></i> Breaking Changes
+- [6903](https://github.com/nginx/kubernetes-ingress/pull/6903) & [6921](https://github.com/nginx/kubernetes-ingress/pull/6921) Add support for NGINX Plus R33
+- [6800](https://github.com/nginx/kubernetes-ingress/pull/6800) Deprecate v1alpha1 CRDs for GlobalConfiguration, Policy & TransportServer
+- [6520](https://github.com/nginx/kubernetes-ingress/pull/6520) & [6474](https://github.com/nginx/kubernetes-ingress/pull/6474) Add structured logging
+
+### <i class="fa-solid fa-rocket"></i> Features
+- [6605](https://github.com/nginx/kubernetes-ingress/pull/6605) TransportServer SNI
+- [6819](https://github.com/nginx/kubernetes-ingress/pull/6819) Add events to configmap
+- [6878](https://github.com/nginx/kubernetes-ingress/pull/6878) Add events when special secrets update
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [6583](https://github.com/nginx/kubernetes-ingress/pull/6583) Generate valid yaml for ReadOnly FS
+- [6635](https://github.com/nginx/kubernetes-ingress/pull/6635) UpstreamServer Fields Logs Displayed as Memory Addresses
+- [6661](https://github.com/nginx/kubernetes-ingress/pull/6661) Revert to original main-template without pod downtime
+- [6733](https://github.com/nginx/kubernetes-ingress/pull/6733) Add nil check to apikey suppliedIn
+- [6780](https://github.com/nginx/kubernetes-ingress/pull/6780) Use default VS and TS templates when CfgMap obj is deleted
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+- [6667](https://github.com/nginx/kubernetes-ingress/pull/6667) Helm schema examples
+- [6998](https://github.com/nginx/kubernetes-ingress/pull/6998) Update kubernetes version to v1.32.0 in helm schema
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [6485](https://github.com/nginx/kubernetes-ingress/pull/6485), [6497](https://github.com/nginx/kubernetes-ingress/pull/6497), [6512](https://github.com/nginx/kubernetes-ingress/pull/6512), [6533](https://github.com/nginx/kubernetes-ingress/pull/6533), [6543](https://github.com/nginx/kubernetes-ingress/pull/6543), [6557](https://github.com/nginx/kubernetes-ingress/pull/6557), [6580](https://github.com/nginx/kubernetes-ingress/pull/6580), [6607](https://github.com/nginx/kubernetes-ingress/pull/6607), [6638](https://github.com/nginx/kubernetes-ingress/pull/6638), [6654](https://github.com/nginx/kubernetes-ingress/pull/6654), [6657](https://github.com/nginx/kubernetes-ingress/pull/6657), [6676](https://github.com/nginx/kubernetes-ingress/pull/6676), [6685](https://github.com/nginx/kubernetes-ingress/pull/6685), [6699](https://github.com/nginx/kubernetes-ingress/pull/6699), [6697](https://github.com/nginx/kubernetes-ingress/pull/6697), [6719](https://github.com/nginx/kubernetes-ingress/pull/6719), [6717](https://github.com/nginx/kubernetes-ingress/pull/6717), [6747](https://github.com/nginx/kubernetes-ingress/pull/6747), [6743](https://github.com/nginx/kubernetes-ingress/pull/6743), [6775](https://github.com/nginx/kubernetes-ingress/pull/6775), [6789](https://github.com/nginx/kubernetes-ingress/pull/6789), [6762](https://github.com/nginx/kubernetes-ingress/pull/6762), [6786](https://github.com/nginx/kubernetes-ingress/pull/6786), [6845](https://github.com/nginx/kubernetes-ingress/pull/6845), [6864](https://github.com/nginx/kubernetes-ingress/pull/6864), [6880](https://github.com/nginx/kubernetes-ingress/pull/6880), [6862](https://github.com/nginx/kubernetes-ingress/pull/6862), [6897](https://github.com/nginx/kubernetes-ingress/pull/6897), [6890](https://github.com/nginx/kubernetes-ingress/pull/6890), [6905](https://github.com/nginx/kubernetes-ingress/pull/6905), [6906](https://github.com/nginx/kubernetes-ingress/pull/6906), [6909](https://github.com/nginx/kubernetes-ingress/pull/6909), [6919](https://github.com/nginx/kubernetes-ingress/pull/6919), [6936](https://github.com/nginx/kubernetes-ingress/pull/6936), [6945](https://github.com/nginx/kubernetes-ingress/pull/6945), [6971](https://github.com/nginx/kubernetes-ingress/pull/6971) & [6982](https://github.com/nginx/kubernetes-ingress/pull/6982) Bump the Docker dependencies
+- [6483](https://github.com/nginx/kubernetes-ingress/pull/6483), [6496](https://github.com/nginx/kubernetes-ingress/pull/6496), [6522](https://github.com/nginx/kubernetes-ingress/pull/6522), [6540](https://github.com/nginx/kubernetes-ingress/pull/6540), [6559](https://github.com/nginx/kubernetes-ingress/pull/6559), [6589](https://github.com/nginx/kubernetes-ingress/pull/6589), [6614](https://github.com/nginx/kubernetes-ingress/pull/6614), [6643](https://github.com/nginx/kubernetes-ingress/pull/6643), [6669](https://github.com/nginx/kubernetes-ingress/pull/6669), [6683](https://github.com/nginx/kubernetes-ingress/pull/6683), [6704](https://github.com/nginx/kubernetes-ingress/pull/6704), [6712](https://github.com/nginx/kubernetes-ingress/pull/6712), [6728](https://github.com/nginx/kubernetes-ingress/pull/6728), [6745](https://github.com/nginx/kubernetes-ingress/pull/6745), [6767](https://github.com/nginx/kubernetes-ingress/pull/6767), [6782](https://github.com/nginx/kubernetes-ingress/pull/6782), [6815](https://github.com/nginx/kubernetes-ingress/pull/6815), [6826](https://github.com/nginx/kubernetes-ingress/pull/6826), [6835](https://github.com/nginx/kubernetes-ingress/pull/6835), [6842](https://github.com/nginx/kubernetes-ingress/pull/6842), [6861](https://github.com/nginx/kubernetes-ingress/pull/6861), [6916](https://github.com/nginx/kubernetes-ingress/pull/6916), [6908](https://github.com/nginx/kubernetes-ingress/pull/6908), [6931](https://github.com/nginx/kubernetes-ingress/pull/6931), [6969](https://github.com/nginx/kubernetes-ingress/pull/6969), [6973](https://github.com/nginx/kubernetes-ingress/pull/6973), [6988](https://github.com/nginx/kubernetes-ingress/pull/6988) & [6994](https://github.com/nginx/kubernetes-ingress/pull/6994) Bump the go dependencies
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 4.0.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=4.0.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 4.0.0 images from the F5 Container registry or build your own image using the 4.0.0 source code
+- For Helm, use version 2.0.0 of the chart.
+- [Upgrading to v4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4" >}})
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.32.
+
+
+---
+## 3.7.2
+
+25 Nov 2024
+
+{{< note >}}
+In our next major release, `v4.0.0`, the default log library for NGINX Ingress Controller will be changed from `golang/glog` to `log/slog`.
+This will mean that logs generated by NGINX Ingress Controller will be in a structured format with the option to choose a `string` or `json` output.
+This will not affect logs generated by NGINX.
+To ensure backwards compatibility, we will ensure the existing log format, `glog`, will be maintained through a configuration option for the next 3 releases.
+{{< /note >}}
+
+{{< important >}}
+CRD version removal notice.
+In our next major release, `v4.0.0`, support for the following apiVersions for these listed CRDs will be dropped:
+1. `k8s.nginx.org/v1alpha` for `GlobalConfiguration`
+2. `k8s.nginx.org/v1alpha` for `Policy`
+3. `k8s.nginx.org/v1alpha` for `TransportServer`
+
+Prior to upgrading, **please ensure** that any of these resources deployed as `apiVersion: k8s.nginx.org/v1alpha1` are upgraded to `apiVersion: k8s.nginx.org/v1`
+If a resource of `kind: GlobalConfiguration`, `kind: Policy` or `kind: TransportServer` are deployed as `apiVersion: k8s.nginx.org/v1alpha1`, these resources will be **deleted** when upgrading from, at least, `v3.4.0` to `v4.0.0`
+
+When `v4.0.0` is released, the release notes will contain the required upgrade steps to go from `v3.X.X` to `v4.X.X`
+{{< /important >}}
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [6838](https://github.com/nginx/kubernetes-ingress/pull/6838) Update oidc_template and conf
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [6779](https://github.com/nginx/kubernetes-ingress/pull/6779), [6790](https://github.com/nginx/kubernetes-ingress/pull/6790) & [6851](https://github.com/nginx/kubernetes-ingress/pull/6851) Bump the Docker dependencies
+- [6791](https://github.com/nginx/kubernetes-ingress/pull/6791), [6849](https://github.com/nginx/kubernetes-ingress/pull/6849) & [6839](https://github.com/nginx/kubernetes-ingress/pull/6839) Bump the go dependencies
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.7.2 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.7.2),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.7.2 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.7.2 source code
+- For Helm, use version 1.4.2 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.31.
+
+---
+## 3.7.1
+
+06 Nov 2024
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [6735](https://github.com/nginx/kubernetes-ingress/pull/6735) Add nil check to apikey suppliedIn
+- [6761](https://github.com/nginx/kubernetes-ingress/pull/6761) Add OIDC fix for ID token nonce claim validation
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [6545](https://github.com/nginx/kubernetes-ingress/pull/6545), [6560](https://github.com/nginx/kubernetes-ingress/pull/6560), [6560](https://github.com/nginx/kubernetes-ingress/pull/6560), [6619](https://github.com/nginx/kubernetes-ingress/pull/6619), [6640](https://github.com/nginx/kubernetes-ingress/pull/6640), [6664](https://github.com/nginx/kubernetes-ingress/pull/6664), [6686](https://github.com/nginx/kubernetes-ingress/pull/6686), [6703](https://github.com/nginx/kubernetes-ingress/pull/6703), [6720](https://github.com/nginx/kubernetes-ingress/pull/6720), [6755](https://github.com/nginx/kubernetes-ingress/pull/6755) & [6751](https://github.com/nginx/kubernetes-ingress/pull/6751) Bump the Docker dependencies
+- [6553](https://github.com/nginx/kubernetes-ingress/pull/6553), [6591](https://github.com/nginx/kubernetes-ingress/pull/6591), [6618](https://github.com/nginx/kubernetes-ingress/pull/6618), [6648](https://github.com/nginx/kubernetes-ingress/pull/6648), [6688](https://github.com/nginx/kubernetes-ingress/pull/6688), [6674](https://github.com/nginx/kubernetes-ingress/pull/6674), [6707](https://github.com/nginx/kubernetes-ingress/pull/6707), [6730](https://github.com/nginx/kubernetes-ingress/pull/6730) & [6751](https://github.com/nginx/kubernetes-ingress/pull/6751) Bump the go dependencies
+- [6570](https://github.com/nginx/kubernetes-ingress/pull/6570) & [6549](https://github.com/nginx/kubernetes-ingress/pull/6549) Bump the go version
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.7.1 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.7.1),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.7.1 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.7.1 source code
+- For Helm, use version 1.4.1 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.31.
+
+---
+## 3.7.0
+
+30 Sept 2024
+
+Added support for VirtualServer & TransportServer to listen on a specific IP when configuring a listener, allowing NGINX to bind to a specific interface. This is also useful in for scenarios where pods need to connect to multiple networks i.e. multi-homed.
+Allow an End Session Endpoint to be configured for OIDC providers via Policy. This allows a user to be fully logged out from their idp session. This change also adds support for configuring a post-logout redirect URI, allowing a users to be redirected to a custom logout page.
+
+The `access_log` directive can now be configured to point to a syslog log server. Previously, access logs defaulted to standard out. This change allows for log parsers aggregators to ingest access logs from NGINX.
+
+When installing NGINX Ingress Controller via Helm, a uniquely named lease object will be created automatically. This allows for multiple deployments of NGINX Ingress Controller in the same namespace when leader election is enabled, without requiring a unique name to be specified manually for each deployment.
+
+### <i class="fa-solid fa-rocket"></i> Features
+- [5968](https://github.com/nginx/kubernetes-ingress/pull/5968) Add BUILD_OS to Telemetry
+- [6014](https://github.com/nginx/kubernetes-ingress/pull/6014) Sync oidc repo
+- [6092](https://github.com/nginx/kubernetes-ingress/pull/6092) Support End Session Endpoint for OIDC and allow customizable Post-logout Redirect URI
+- [5648](https://github.com/nginx/kubernetes-ingress/pull/5648) Make access_log in http context configurable
+- [6180](https://github.com/nginx/kubernetes-ingress/pull/6180) Add ip as an option to listeners for VirtualServer
+- [6367](https://github.com/nginx/kubernetes-ingress/pull/6367) Add ip as an option to listeners for TransportServer
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [5786](https://github.com/nginx/kubernetes-ingress/pull/5786) Change log level, to Info and above, before calling prometheus exporter functions
+- [5838](https://github.com/nginx/kubernetes-ingress/pull/5838) Fix api key policy undefined routes
+- [5885](https://github.com/nginx/kubernetes-ingress/pull/5885) Add default telemetry endpoint
+- [5899](https://github.com/nginx/kubernetes-ingress/pull/5899) GRPC healthcheck should not have keepalive time
+- [6125](https://github.com/nginx/kubernetes-ingress/pull/6125) Don't log errors for not implemented grpc metrics
+- [6232](https://github.com/nginx/kubernetes-ingress/pull/6232) Fix panic when creating VirtualServer
+- [6372](https://github.com/nginx/kubernetes-ingress/pull/6372) Create unique lease obj for each NIC installed via Helm
+- [6406](https://github.com/nginx/kubernetes-ingress/pull/6406) Fix udp/http listener validation logic
+- [6446](https://github.com/nginx/kubernetes-ingress/pull/6446) Disable batch reload when batch finishes
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+- [5817](https://github.com/nginx/kubernetes-ingress/pull/5817) Remove include-year and includeYear flag
+- [5335](https://github.com/nginx/kubernetes-ingress/pull/5335) Choose NodePort values for controller.service.type = LoadBalancer
+- [6235](https://github.com/nginx/kubernetes-ingress/pull/6235) Update helm docs by @vepatel
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [5789](https://github.com/nginx/kubernetes-ingress/pull/5789), [5804](https://github.com/nginx/kubernetes-ingress/pull/5804), [5821](https://github.com/nginx/kubernetes-ingress/pull/5821), [5870](https://github.com/nginx/kubernetes-ingress/pull/5870), [5880](https://github.com/nginx/kubernetes-ingress/pull/5880), [5907](https://github.com/nginx/kubernetes-ingress/pull/5907), [5949](https://github.com/nginx/kubernetes-ingress/pull/5949), [5959](https://github.com/nginx/kubernetes-ingress/pull/5959), [5993](https://github.com/nginx/kubernetes-ingress/pull/5993), [6010](https://github.com/nginx/kubernetes-ingress/pull/6010), [6071](https://github.com/nginx/kubernetes-ingress/pull/6071), [6105](https://github.com/nginx/kubernetes-ingress/pull/6105), [6132](https://github.com/nginx/kubernetes-ingress/pull/6132), [6186](https://github.com/nginx/kubernetes-ingress/pull/6186), [6195](https://github.com/nginx/kubernetes-ingress/pull/6195), [6200](https://github.com/nginx/kubernetes-ingress/pull/6200), [6215](https://github.com/nginx/kubernetes-ingress/pull/6215), [6229](https://github.com/nginx/kubernetes-ingress/pull/6229), [6266](https://github.com/nginx/kubernetes-ingress/pull/6266), [6283](https://github.com/nginx/kubernetes-ingress/pull/6283), [6287](https://github.com/nginx/kubernetes-ingress/pull/6287), [6299](https://github.com/nginx/kubernetes-ingress/pull/6299), [6310](https://github.com/nginx/kubernetes-ingress/pull/6310), [6358](https://github.com/nginx/kubernetes-ingress/pull/6358), [6364](https://github.com/nginx/kubernetes-ingress/pull/6364), [6397](https://github.com/nginx/kubernetes-ingress/pull/6397), [6412](https://github.com/nginx/kubernetes-ingress/pull/6412), [6459](https://github.com/nginx/kubernetes-ingress/pull/6459) Bump the go dependencies
+- [5929](https://github.com/nginx/kubernetes-ingress/pull/5929), [6337](https://github.com/nginx/kubernetes-ingress/pull/6337), [6350](https://github.com/nginx/kubernetes-ingress/pull/6350) & [6368](https://github.com/nginx/kubernetes-ingress/pull/6368) Bump the go version
+- [6052](https://github.com/nginx/kubernetes-ingress/pull/6052) Replace promlog with go-kit
+- [6205](https://github.com/nginx/kubernetes-ingress/pull/6205) Update Kubernetes version to v1.31.0
+- [5808](https://github.com/nginx/kubernetes-ingress/pull/5808), [5804](https://github.com/nginx/kubernetes-ingress/pull/5804), [5821](https://github.com/nginx/kubernetes-ingress/pull/5821), [5870](https://github.com/nginx/kubernetes-ingress/pull/5870), [5822](https://github.com/nginx/kubernetes-ingress/pull/5822), [5819](https://github.com/nginx/kubernetes-ingress/pull/5819), [5881](https://github.com/nginx/kubernetes-ingress/pull/5881), [5910](https://github.com/nginx/kubernetes-ingress/pull/5910), [5928](https://github.com/nginx/kubernetes-ingress/pull/5928), [5944](https://github.com/nginx/kubernetes-ingress/pull/5944), [5965](https://github.com/nginx/kubernetes-ingress/pull/5965), [5985](https://github.com/nginx/kubernetes-ingress/pull/5985), [6003](https://github.com/nginx/kubernetes-ingress/pull/6003), [6066](https://github.com/nginx/kubernetes-ingress/pull/6066), [6093](https://github.com/nginx/kubernetes-ingress/pull/6093), [6122](https://github.com/nginx/kubernetes-ingress/pull/6122), [6130](https://github.com/nginx/kubernetes-ingress/pull/6130), [6156](https://github.com/nginx/kubernetes-ingress/pull/6156), [6174](https://github.com/nginx/kubernetes-ingress/pull/6174), [6187](https://github.com/nginx/kubernetes-ingress/pull/6187), [6218](https://github.com/nginx/kubernetes-ingress/pull/6218), [6224](https://github.com/nginx/kubernetes-ingress/pull/6224), [6246](https://github.com/nginx/kubernetes-ingress/pull/6246), [6267](https://github.com/nginx/kubernetes-ingress/pull/6267), [6290](https://github.com/nginx/kubernetes-ingress/pull/6290), [6303](https://github.com/nginx/kubernetes-ingress/pull/6303), [6330](https://github.com/nginx/kubernetes-ingress/pull/6330), [6359](https://github.com/nginx/kubernetes-ingress/pull/6359), [6365](https://github.com/nginx/kubernetes-ingress/pull/6365), [6371](https://github.com/nginx/kubernetes-ingress/pull/6371), [6382](https://github.com/nginx/kubernetes-ingress/pull/6382), [6391](https://github.com/nginx/kubernetes-ingress/pull/6391), [6413](https://github.com/nginx/kubernetes-ingress/pull/6413), [6399](https://github.com/nginx/kubernetes-ingress/pull/6399), [6434](https://github.com/nginx/kubernetes-ingress/pull/6434) Bump the Docker dependencies
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.7.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.7.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.7.0 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.7.0 source code
+- For Helm, use version 1.4.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.31.
+
+---
+## 3.6.2
+
+19 Aug 2024
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [6125](https://github.com/nginx/kubernetes-ingress/pull/6125) Don't log errors for not implemented grpc metrics
+- [6223](https://github.com/nginx/kubernetes-ingress/pull/6223) Re-order mounting debian apt source file
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [5974](https://github.com/nginx/kubernetes-ingress/pull/5974), [6021](https://github.com/nginx/kubernetes-ingress/pull/6021), [5998](https://github.com/nginx/kubernetes-ingress/pull/5998), [6081](https://github.com/nginx/kubernetes-ingress/pull/6081), [6120](https://github.com/nginx/kubernetes-ingress/pull/6120), [6141](https://github.com/nginx/kubernetes-ingress/pull/6141), [6196](https://github.com/nginx/kubernetes-ingress/pull/6196), [6204](https://github.com/nginx/kubernetes-ingress/pull/6204), [6211](https://github.com/nginx/kubernetes-ingress/pull/6211), [6222](https://github.com/nginx/kubernetes-ingress/pull/6204) & [6234](https://github.com/nginx/kubernetes-ingress/pull/6234) Go dependencies
+- [5967](https://github.com/nginx/kubernetes-ingress/pull/5967), [6013](https://github.com/nginx/kubernetes-ingress/pull/6013), [6070](https://github.com/nginx/kubernetes-ingress/pull/6070), [6098](https://github.com/nginx/kubernetes-ingress/pull/6098), [6126](https://github.com/nginx/kubernetes-ingress/pull/6126), [6158](https://github.com/nginx/kubernetes-ingress/pull/6158), [6179](https://github.com/nginx/kubernetes-ingress/pull/6179), [6191](https://github.com/nginx/kubernetes-ingress/pull/6191), [6226](https://github.com/nginx/kubernetes-ingress/pull/6226) & [6233](https://github.com/nginx/kubernetes-ingress/pull/6233) Docker base image updates
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.6.2 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.6.2),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.6.2 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.6.2 source code
+- For Helm, use version 1.3.2 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.31.
+
+---
+## 3.6.1
+
+04 Jul 2024
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [5921](https://github.com/nginx/kubernetes-ingress/pull/5921) GRPC healthcheck should not have keepalive time
+- [5889](https://github.com/nginx/kubernetes-ingress/pull/5889) Add default telemetry endpoint
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [5930](https://github.com/nginx/kubernetes-ingress/pull/5930) Bump Go version to 1.22.5
+- [5947](https://github.com/nginx/kubernetes-ingress/pull/5947), [5923](https://github.com/nginx/kubernetes-ingress/pull/5923), [5943](https://github.com/nginx/kubernetes-ingress/pull/5943), [5939](https://github.com/nginx/kubernetes-ingress/pull/5939) and [5882](https://github.com/nginx/kubernetes-ingress/pull/5882) Docker image updates
+- [5951](https://github.com/nginx/kubernetes-ingress/pull/5951), [5933](https://github.com/nginx/kubernetes-ingress/pull/5933), [5884](https://github.com/nginx/kubernetes-ingress/pull/5884) and [5877](https://github.com/nginx/kubernetes-ingress/pull/5877) Go dependencies update
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.6.1 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.6.1),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.6.1 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking), the [Azure Marketplace](https://azuremarketplace.microsoft.com/en-gb/marketplace/apps/category/containers?page=1&search=f5&subcategories=container-apps)
+or build your own image using the 3.6.1 source code
+- For Helm, use version 1.3.1 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.30.
+
+---
+## 3.6.0
+
+25 Jun 2024
+
+Added support for the latest generation of NGINX App Protect Web Application Firewall, v5. NGINX Ingress Controller will continue to support the NGINX App Protect v4 family to allow customers to implement new Policy Bundle workflow at their own pace.
+NGINX App Protect WAF v5 does not accept the JSON based policies, instead requiring users to compile a Policy Bundle outside of the NGINX Ingress Controller pod. Policy bundles contain a combination of custom Policy, signatures, and campaigns. Bundles can be compiled using either App Protect [compiler](https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/compiler/), or [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/nginx-app-protect/manage-waf-security-policies/#list-security-policy-bundles). Read more in the [NGINX App Protect WAF V5]({{< ref "/nic/installation/integrations/app-protect-waf-v5/" >}})  topic.
+
+With this release, NGINX Ingress Controller is implementing a new image maintenance policy. Container images for subscribed users will be updated on a regular basis in-between releases to reduce the CVE vulnerabilities.
+Customers can observe the 3.6.x tag when listing images in the registry and select the latest image to update to for the current release.
+
+### <i class="fa-solid fa-rocket"></i> Features
+- [5698](https://github.com/nginx/kubernetes-ingress/pull/5698), [5771](https://github.com/nginx/kubernetes-ingress/pull/5771) & [5784](https://github.com/nginx/kubernetes-ingress/pull/5784) Add support for F5 NGINX AppProtect WAF v5
+- [5580](https://github.com/nginx/kubernetes-ingress/pull/5580) & [5752](https://github.com/nginx/kubernetes-ingress/pull/5752) Add APIKey Authentication policy
+- [5205](https://github.com/nginx/kubernetes-ingress/pull/5205) Preserve valid listeners when invalid listeners are present in GlobalConfiguration
+- [5366](https://github.com/nginx/kubernetes-ingress/pull/5366) Add proxy-set-headers annotation for ingress
+- [5406](https://github.com/nginx/kubernetes-ingress/pull/5406), [5408](https://github.com/nginx/kubernetes-ingress/pull/5408), [5418](https://github.com/nginx/kubernetes-ingress/pull/5418), [5404](https://github.com/nginx/kubernetes-ingress/pull/5404) & [5415](https://github.com/nginx/kubernetes-ingress/pull/5415) Add additional telemetry data
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [5350](https://github.com/nginx/kubernetes-ingress/pull/5350) Fix ap-waf flag in error message
+- [5318](https://github.com/nginx/kubernetes-ingress/pull/5318) Don't reload when `use-cluster-ip` endpoints update, and change the ingress `use-cluster-ip` implementation to use the cluster ip instead of the fqdn
+- [5375](https://github.com/nginx/kubernetes-ingress/pull/5375) Fix status for invalid vs and vsr, for weight changes dynamic reload
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+- [5313](https://github.com/nginx/kubernetes-ingress/pull/5313) Update helm flag in docs for enableWeightChangesDynamicReload
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [5693](https://github.com/nginx/kubernetes-ingress/pull/5693) Bump Go version to v1.22.4
+- [5368](https://github.com/nginx/kubernetes-ingress/pull/5368), [5331](https://github.com/nginx/kubernetes-ingress/pull/5331) & [5423](https://github.com/nginx/kubernetes-ingress/pull/5423) Bump the go dependencies
+- [5298](https://github.com/nginx/kubernetes-ingress/pull/5298), [5344](https://github.com/nginx/kubernetes-ingress/pull/5344), [5345](https://github.com/nginx/kubernetes-ingress/pull/5345),[5371](https://github.com/nginx/kubernetes-ingress/pull/5371), [5378](https://github.com/nginx/kubernetes-ingress/pull/5378), [5379](https://github.com/nginx/kubernetes-ingress/pull/5379), [5398](https://github.com/nginx/kubernetes-ingress/pull/5398), [5397](https://github.com/nginx/kubernetes-ingress/pull/5397), [5399](https://github.com/nginx/kubernetes-ingress/pull/5399) & [5400](https://github.com/nginx/kubernetes-ingress/pull/5400) Bump base Docker images
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.6.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.6.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.6.0 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking), the [Azure Marketplace](https://azuremarketplace.microsoft.com/en-gb/marketplace/apps/category/containers?page=1&search=f5&subcategories=container-apps)
+or build your own image using the 3.6.0 source code
+- For Helm, use version 1.3.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.30.
+
+---
+## 3.5.2
+
+31 May 2024
+
+### <i class="fa-solid fa-triangle-exclamation"></i> Important
+
+- Bundles compiled on NAP WAF versions <= v4.8.x are not compatible with NAP WAF versions >= 4.9.x, this release of NIC includes NAP WAF v4.10 so recompilation of policy bundles is required. JSON based [WAF Policies]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-policies" >}}) aren't affected with this change.
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [5654](https://github.com/nginx/kubernetes-ingress/pull/5654) NGINX 1.27.0 and [NGINX Plus R32](https://www.f5.com/company/blog/nginx/nginx-plus-r32-released)
+- [5590](https://github.com/nginx/kubernetes-ingress/pull/5590), [5631](https://github.com/nginx/kubernetes-ingress/pull/5631), [5638](https://github.com/nginx/kubernetes-ingress/pull/5638), [5662](https://github.com/nginx/kubernetes-ingress/pull/5662), [5623](https://github.com/nginx/kubernetes-ingress/pull/5623) Go updates
+- [5579](https://github.com/nginx/kubernetes-ingress/pull/5579), [5642](https://github.com/nginx/kubernetes-ingress/pull/5642), [5573](https://github.com/nginx/kubernetes-ingress/pull/5573), [5630](https://github.com/nginx/kubernetes-ingress/pull/5630), [5665](https://github.com/nginx/kubernetes-ingress/pull/5665), [5673](https://github.com/nginx/kubernetes-ingress/pull/5673) Container base image updates
+
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.5.2 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.5.2),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.5.2 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking), the [Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/nginxinc.nginx_ingress_premium?tab=Overview),
+or build your own image using the 3.5.2 source code
+- For Helm, use version 1.2.2 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.30.
+
+## 3.5.1
+
+08 May 2024
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [5463](https://github.com/nginx/kubernetes-ingress/pull/5463) Don't reload when use-cluster-ip endpoints update
+- [5464](https://github.com/nginx/kubernetes-ingress/pull/5464) Fix status for invalid vs and vsr, for weight changes dynamic reload
+- [5470](https://github.com/nginx/kubernetes-ingress/pull/5470) Add support for named ports in ingresses which use-cluster-ip
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+- [5315](https://github.com/nginx/kubernetes-ingress/pull/5315) Update helm flag in docs for enableWeightChangesDynamicReload
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [5511](https://github.com/nginx/kubernetes-ingress/pull/5511) & [5391](https://github.com/nginx/kubernetes-ingress/pull/5391) Go updates
+- [5490](https://github.com/nginx/kubernetes-ingress/pull/5490) Pin app-protect module version to 4.8.1
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.5.1 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.5.1),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.5.1 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.5.1 source code
+- For Helm, use version 1.2.1 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.23-1.29.
+
+## 3.5.0
+
+26 Mar 2024
+
+NGINX Ingress Controller and NGINX App Protect WAF users can can now view violations through NGINX Instance Manager Security Monitor.  Security Monitor can be used to build Policy bundles, reducing reload time impacts on NGINX Ingress Controller.  Read more information in [NGINX App Protect WAF Bundles]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) and [Security Monitoring](https://docs.nginx.com/nginx-instance-manager/monitoring/security-monitoring/).
+
+When using NGINX Plus for two version [split rollouts]({{ ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#split" }}), you can now control progressive rollouts of a new backend version without reloading NGINX using the [**-weight-changes-dynamic-reload**]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-weight-changes-dynamic-reload" >}}) command line argument.
+
+The [**use-cluster-ip**]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#backend-services-upstreams" >}}) annotation is now available for the Ingress resource.
+**use-cluster-ip** supports service meshes and specific use cases where the backend service should be the target instead of individual backend service pods, bypassing upstream load balancing.
+
+### <i class="fa-solid fa-rocket"></i> Features
+- [5179](https://github.com/nginx/kubernetes-ingress/pull/5179) & [5051](https://github.com/nginx/kubernetes-ingress/pull/5051) Add NIM Security Dashboard integration for App Protect WAF security violations
+- [5212](https://github.com/nginx/kubernetes-ingress/pull/5212) Weight changes Dynamic Reload
+- [4862](https://github.com/nginx/kubernetes-ingress/pull/4862) Add use-cluster-ip annotation for ingress resources
+- [4660](https://github.com/nginx/kubernetes-ingress/pull/4660) Add annotations for controlling request rate limiting
+- [5083](https://github.com/nginx/kubernetes-ingress/pull/5083) Update default values for keepalive-requests and keepalive-timeout
+- [5084](https://github.com/nginx/kubernetes-ingress/pull/5084) Allow securityContext and podSecurityContext to be configurable via helm parameters
+- [5199](https://github.com/nginx/kubernetes-ingress/pull/5199) Update zone size for transportserver resource
+- [4896](https://github.com/nginx/kubernetes-ingress/pull/4896), [5095](https://github.com/nginx/kubernetes-ingress/pull/5095), [5147](https://github.com/nginx/kubernetes-ingress/pull/5147), [5155](https://github.com/nginx/kubernetes-ingress/pull/5155), [5170](https://github.com/nginx/kubernetes-ingress/pull/5170), [5176](https://github.com/nginx/kubernetes-ingress/pull/5176), [5217](https://github.com/nginx/kubernetes-ingress/pull/5217), [5245](https://github.com/nginx/kubernetes-ingress/pull/5245), [5237](https://github.com/nginx/kubernetes-ingress/pull/5237), [5256](https://github.com/nginx/kubernetes-ingress/pull/5256), [5167](https://github.com/nginx/kubernetes-ingress/pull/5167) & [5261](https://github.com/nginx/kubernetes-ingress/pull/5261) Export Telemetry data to XCDF
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [5211](https://github.com/nginx/kubernetes-ingress/pull/5211) Move set above rewrite to fix uninitialized variable
+- [5175](https://github.com/nginx/kubernetes-ingress/pull/5175) Initialize `stopCh` channel for ExternalDNS
+- [5053](https://github.com/nginx/kubernetes-ingress/pull/5053) Ensure `backup` server is removed from upstreams when the Backup Service is deleted
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+- [5159](https://github.com/nginx/kubernetes-ingress/pull/5159) Refactor volumes and volumeMounts to common helpers
+- [5179](https://github.com/nginx/kubernetes-ingress/pull/5179) Move common pod label definitions to helpers
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [4803](https://github.com/nginx/kubernetes-ingress/pull/4803), [4846](https://github.com/nginx/kubernetes-ingress/pull/4846), [4873](https://github.com/nginx/kubernetes-ingress/pull/4873), [4905](https://github.com/nginx/kubernetes-ingress/pull/4905), [5098](https://github.com/nginx/kubernetes-ingress/pull/5098), [5108](https://github.com/nginx/kubernetes-ingress/pull/5108), [5125](https://github.com/nginx/kubernetes-ingress/pull/5125), [5132](https://github.com/nginx/kubernetes-ingress/pull/5132), [5207](https://github.com/nginx/kubernetes-ingress/pull/5207), [5234](https://github.com/nginx/kubernetes-ingress/pull/5234), [5267](https://github.com/nginx/kubernetes-ingress/pull/5267), [5272](https://github.com/nginx/kubernetes-ingress/pull/5272) & [5218](https://github.com/nginx/kubernetes-ingress/pull/5218) Go Dependency updates
+- [5208](https://github.com/nginx/kubernetes-ingress/pull/5208) Bump Go version to 1.22.1
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.5.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.5.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.5.0 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.5.0 source code
+- For Helm, use version 1.2.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.23-1.29.
+
+## 3.4.3
+
+19 Feb 2024
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+- [5008](https://github.com/nginx/kubernetes-ingress/pull/5008) Remove redundant Prometheus variable labels
+- [4744](https://github.com/nginx/kubernetes-ingress/pull/4744) Fixed validation for VSR exact & regex subroutes.  Thanks to [jo-carter](https://github.com/jo-carter).
+- [4832](https://github.com/nginx/kubernetes-ingress/pull/4832) Fix new lines in snippets
+- [5020](https://github.com/nginx/kubernetes-ingress/pull/5020) Fix template file spacing for `ssl_protocols` directive
+- [5041](https://github.com/nginx/kubernetes-ingress/pull/5041) Allow waf users to build without dos repo access
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+- [4953](https://github.com/nginx/kubernetes-ingress/pull/4953) Add docs links to helm NOTES.txt
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+- [5073](https://github.com/nginx/kubernetes-ingress/pull/5073), [5029](https://github.com/nginx/kubernetes-ingress/pull/5029) Bump redhat/ubi8 base image
+- [4992](https://github.com/nginx/kubernetes-ingress/pull/4992) Bump ubi base image
+- [4994](https://github.com/nginx/kubernetes-ingress/pull/4994) Bump redhat/ubi9-minimal base image
+- [5074](https://github.com/nginx/kubernetes-ingress/pull/5074), [4927](https://github.com/nginx/kubernetes-ingress/pull/4927) Bump opentracing/nginx-opentracing
+- [5072](https://github.com/nginx/kubernetes-ingress/pull/5072), [5028](https://github.com/nginx/kubernetes-ingress/pull/5028), [5019](https://github.com/nginx/kubernetes-ingress/pull/5019), [5012](https://github.com/nginx/kubernetes-ingress/pull/5012), [5003](https://github.com/nginx/kubernetes-ingress/pull/5003), [4926](https://github.com/nginx/kubernetes-ingress/pull/4926), [5119](https://github.com/nginx/kubernetes-ingress/pull/5119) Bump nginx image
+- [4925](https://github.com/nginx/kubernetes-ingress/pull/4925) Bump the debian base image
+- [5004](https://github.com/nginx/kubernetes-ingress/pull/5004), [4984](https://github.com/nginx/kubernetes-ingress/pull/4984), [4928](https://github.com/nginx/kubernetes-ingress/pull/4928) Bump golang build image
+- [5033](https://github.com/nginx/kubernetes-ingress/pull/5033) Updates `kindest/node` from v1.29.0 to v1.29.1
+- [4909](https://github.com/nginx/kubernetes-ingress/pull/4909), [4924](https://github.com/nginx/kubernetes-ingress/pull/4924), [4939](https://github.com/nginx/kubernetes-ingress/pull/4939), [4949](https://github.com/nginx/kubernetes-ingress/pull/4949), [4971](https://github.com/nginx/kubernetes-ingress/pull/4971), [5022](https://github.com/nginx/kubernetes-ingress/pull/5022), [5034](https://github.com/nginx/kubernetes-ingress/pull/5034), [5055](https://github.com/nginx/kubernetes-ingress/pull/5055) Bump the go dependencies
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.4.3 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.3),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.4.3 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.4.3 source code
+- For Helm, use version 1.1.3 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.23-1.29.
+
+## 3.4.2
+
+16 Jan 2024
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+[4934](https://github.com/nginx/kubernetes-ingress/pull/4934) GCR & AWS Plus image publishing fix
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.4.2 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.2),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.4.2 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.4.2 source code
+- For Helm, use version 1.1.2 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.23-1.29.
+
+## 3.4.1
+
+15 Jan 2024
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+[4886](https://github.com/nginx/kubernetes-ingress/pull/4886) Update N+ to R31
+[4886](https://github.com/nginx/kubernetes-ingress/pull/4886) Bump Go dependencies.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.4.1 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.1),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.4.1 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.4.1 source code
+- For Helm, use version 1.1.1 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.23-1.29.
+
+## 3.4.0
+
+19 Dec 2023
+
+The default_server listeners for ports 80 and 443 can now be fully customized giving you the flexibility to shift the HTTP and HTTPS default listeners to other ports as your needs require.
+
+Traffic splits now support weights from 0 - 100 giving you the control that you expect when performing canary roll outs of your back end services.
+
+A new capability of "upstream backup" has been introduced for NGINX Plus customers. This gives you the control to set a backup service for any path. This takes advantage of NGINX health checks and will automatically forward traffic to the backup service when all pods of the primary service stop responding.
+
+Dynamic reloading of SSL certificates takes advantage of native NGINX functionality to dynamically load updated certificates when they are requested and thus not require a reload when certificates update.
+
+A number of Helm enhancements have come directly from our community and range from giving greater flexibility for HPA, namespace sharing for custom sidecars, and supporting multiple image pull secrets for greater deployment flexibility.
+
+To make sure NGINX Ingress Controller follows Helm best practices, we've refactored our helm chart location. You can now find our helm charts under `charts\nginx-ingress`.
+
+We’ve added the functionality to define App Protect WAF bundles for VirtualServers by creating policy bundles and putting them on a mounted volume accessible from NGINX Ingress Controller.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [4574](https://github.com/nginx/kubernetes-ingress/pull/4574) Graduate TransportServer and GlobalConfiguration to v1.
+- [4464](https://github.com/nginx/kubernetes-ingress/pull/4464) Allow default_server listeners to be customised.
+- [4526](https://github.com/nginx/kubernetes-ingress/pull/4526) Update use of http2 listen directive to align with deprecation.
+- [4276](https://github.com/nginx/kubernetes-ingress/pull/4276) Use Lease for leader election.
+- [4655](https://github.com/nginx/kubernetes-ingress/pull/4655) Support weights 0 and 100 in traffic splitting.
+- [4653](https://github.com/nginx/kubernetes-ingress/pull/4653) Add support for backup directive for VS and TS.
+- [4788](https://github.com/nginx/kubernetes-ingress/pull/4788) Dynamic reload of SSL certificates
+- [4428](https://github.com/nginx/kubernetes-ingress/pull/4428) Add option for installing CRDs from a single remote yaml.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [4504](https://github.com/nginx/kubernetes-ingress/pull/4504) Delete the DNSEndpoint resource when VS is deleted & Ratelimit requeues on errors.
+- [4575](https://github.com/nginx/kubernetes-ingress/pull/4575) update dockerfile for debian NGINX Plus.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [4306](https://github.com/nginx/kubernetes-ingress/pull/4306) Refactor Helm Chart location.
+- [4391](https://github.com/nginx/kubernetes-ingress/pull/4391) Add HPA Custom Behavior.  Thanks to [saedx1](https://github.com/saedx1).
+- [4559](https://github.com/nginx/kubernetes-ingress/pull/4559) Add process namespace sharing for ingress controller.  Thanks to [panzouh](https://github.com/panzouh).
+- [4651](https://github.com/nginx/kubernetes-ingress/pull/4651) Add initContainerResources Helm configuration.
+- [4656](https://github.com/nginx/kubernetes-ingress/pull/4656) Allows multiple imagePullSecrets in the helm chart.  Thanks to [AlessioCasco](https://github.com/AlessioCasco).
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.4.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.4.0 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.4.0 source code
+- For Helm, use version 1.1.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.22-1.29.
+<hr>
+
+## 3.3.2
+
+1 Nov 2023
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [4578](https://github.com/nginx/kubernetes-ingress/pull/4578) Update Dockerfile to add user creation for NGINX Plus images.
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [4572](https://github.com/nginx/kubernetes-ingress/pull/4572) Update NGINX version to 1.25.3.
+- [4569](https://github.com/nginx/kubernetes-ingress/pull/4569), [4591](https://github.com/nginx/kubernetes-ingress/pull/4591) Bump Go dependencies.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.3.2 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.3.2),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.3.2 images from the F5 Container registry,
+the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
+the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
+or build your own image using the 3.3.2 source code
+- For Helm, use version 1.0.2 of the chart.
+
+<hr>
+
+## 3.3.1
+
+13 Oct 2023
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+This releases updates NGINX Plus to R30 P1 and dependencies to mitigate HTTP/2 Rapid Reset Attack vulnerability [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487).
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [4501](https://github.com/nginx/kubernetes-ingress/pull/4501) Bump Go to 1.21.3
+- [4502](https://github.com/nginx/kubernetes-ingress/pull/4502), [4514](https://github.com/nginx/kubernetes-ingress/pull/4514) Bump Go dependencies.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.3.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.3.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.3.1 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.3.1 source code
+
+<hr>
+
+## 3.3.0
+
+26 Sep 2023
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+With release 3.3, NGINX Ingress Controller continues to advance capabilities for an ever-demanding set of use cases
+that go beyond simple layer 7 routing for services running exclusively in Kubernetes.
+
+When involved in diagnostic operations and viewing the NGINX Plus console or when viewing the enhanced NGINX Plus
+metrics through Prometheus, customers now enjoy the added dimension of the backend service being available to aide in
+identification of issues as well as observing performance.
+
+50% of our users continue to rely heavily on the Ingress resource and its "mergeable Ingress" usage pattern, to enhance
+the experience for these customers we have added the path-regex annotation with support for case sensitive, case
+insensitive, as well as exact regex match patterns.
+
+Prometheus continues to be the most popular metrics platform for Kubernetes users. To further enhance ease of setting up
+integration with Prometheus we have finalized support for the Prometheus serviceMonitor capability. Providing better
+scraping controls for Prometheus admins.
+
+For our most demanding customers performing a blue / green upgrade of the Ingress Controller itself supports the ability
+to provide their business customers an enhanced experience with no loss of session fidelity. Support for this pattern
+and others has been added through Helm chart enhancement that allows two deployments to share a single ingressClass
+resource and duplicate the same configuration.
+
+To accommodate these enhancements, several new values have been added to our Helm chart, as well as modifications to
+existing values. Due to the potential impacts of these changes we have issued a major release to the Helm chart,
+advancing to v1.0.0
+
+To better align with the demands of supporting additional protocols such as MQTT and QUIC, NGINX Ingress Controller
+is changing how listeners are defined for HTTP traffic. You have always had controls over the ports defined for
+TCP/UDP traffic through the GlobalConfiguration and TransportServer objects. That same flexibility has been introduced
+for HTTP/S traffic and the VirtualServer. This area will continue to expand to give customers full control over NGINX
+listeners so they can tailor to their specific needs and policies.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [4023](https://github.com/nginx/kubernetes-ingress/pull/4023) Read Prometheus key/cert from memory.
+- [4080](https://github.com/nginx/kubernetes-ingress/pull/4080) Expose Location Zones metrics.
+- [4127](https://github.com/nginx/kubernetes-ingress/pull/4127), [4200](https://github.com/nginx/kubernetes-ingress/pull/4200), [4223](https://github.com/nginx/kubernetes-ingress/pull/4223) Add path-regex annotation for ingress.
+- [4108](https://github.com/nginx/kubernetes-ingress/pull/4108) Add command line argument for custom TLS Passthrough port.
+- [4271](https://github.com/nginx/kubernetes-ingress/pull/4271) Add custom listener controls to VirtualServer.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [4160](https://github.com/nginx/kubernetes-ingress/pull/4160) Update JWT/JWKS policy validation.
+- [4371](https://github.com/nginx/kubernetes-ingress/pull/4371) Improve runtime batch reloads.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [3977](https://github.com/nginx/kubernetes-ingress/pull/3977) Add support for controller.selectorLabels. Thanks to [Youqing Han](https://github.com/hanyouqing).
+- [4058](https://github.com/nginx/kubernetes-ingress/pull/4058) Add clusterIP to service if specified in values. Thanks to [EutiziStefano](https://github.com/EutiziStefano).
+- [4252](https://github.com/nginx/kubernetes-ingress/pull/4252) Make containerPort and hostPort customizable.
+- [4331](https://github.com/nginx/kubernetes-ingress/pull/4331) Expose Prometheus metrics through a headless Service.
+- [4351](https://github.com/nginx/kubernetes-ingress/pull/4351) Update helm values file to move controller.serviceMonitor to prometheus.serviceMonitor.
+- [4333](https://github.com/nginx/kubernetes-ingress/pull/4333) Allow installing IC without creating a new ingress class.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.3.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.3.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.3.0 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.3.0 source code
+- For Helm, use version 1.0.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.22-1.28.
+
+<hr>
+
+## 3.2.1
+
+17 Aug 2023
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.25.2.
+- Update NGINX Plus version to R30.
+- Update Go to 1.21 and Go dependencies.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.2.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.2.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.2.1 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.2.1 source code
+- For Helm, use version 0.18.1 of the chart.
+
+<hr>
+
+## 3.2.0
+
+27 June 2023
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [3790](https://github.com/nginx/kubernetes-ingress/pull/3790) Gunzip for VS
+- [3863](https://github.com/nginx/kubernetes-ingress/pull/3863) OIDC - relaxed OIDC scope validation
+- [3925](https://github.com/nginx/kubernetes-ingress/pull/3925) Specify runAsNonRoot in daemon-set manifests. Thanks to [Valters Jansons](https://github.com/sigv).
+- [3951](https://github.com/nginx/kubernetes-ingress/pull/3951) Add NGINX Plus images to Google Marketplace.
+- [3954](https://github.com/nginx/kubernetes-ingress/pull/3954) Add utilization tracking for supported (paid) customers.
+- [4001](https://github.com/nginx/kubernetes-ingress/pull/4001) Add support for the SameSite sticky cookie attribute.
+- [4022](https://github.com/nginx/kubernetes-ingress/pull/4022) Add document to tutorial section for configuring the default OIDC implementation.
+- [4031](https://github.com/nginx/kubernetes-ingress/pull/4031) Add NGINX Plus Alpine image with FIPS inside for supported (paid) customers.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [3737](https://github.com/nginx/kubernetes-ingress/pull/3737) Update VirtualServer to ignore CRL for EgressMTLS.
+- [3798](https://github.com/nginx/kubernetes-ingress/pull/3798) Update VirtualServer template to generate an internal jwt auth location per policy applied.
+- [3844](https://github.com/nginx/kubernetes-ingress/pull/3844) Fix gunzip support for VS and add python tests.
+- [3870](https://github.com/nginx/kubernetes-ingress/pull/3870) Add Funcs() method to UpdateVirtualServerTemplate method. Thanks to [Bryan Hendryx](https://github.com/coolbry95).
+- [3933](https://github.com/nginx/kubernetes-ingress/pull/3933) fix --external-service flag when using serviceNameOverride. Thanks to [Tim N](https://github.com/timnee).
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.25.1.
+- Update Debian to 12 for NGINX Plus images (except for images containing the NGINX App Protect modules).
+- Update Alpine to 3.18 for NGINX Plus images.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [3814](https://github.com/nginx/kubernetes-ingress/pull/3814) Remove semverCompare for allocateLoadBalancerNodePorts. Thanks to [Alex Wied](https://github.com/centromere).
+- [3905](https://github.com/nginx/kubernetes-ingress/pull/3905) Reverse order of NAPDOS maxDaemons and maxWorkers in Helm chart.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.2.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.2.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.2.0 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.2.0 source code.
+- For Helm, use version 0.18.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.22-1.27.
+
+<hr>
+
+## 3.1.1
+
+04 May 2023
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+This release reverts the changes made in 3.1.0 to use sysctls to bind to lower level ports without the NET_BIND_SERVICE capability. It also adds support for serviceNameOverride in the Helm chart, that can be used to override the service name for NGINX Ingress Controller. This is useful especially during an upgrade from versions prior to 3.1.0, to avoid downtime due to the service name change. To use this feature, set the `serviceNameOverride` value in the Helm chart to the name of the existing service.
+
+For example, if the existing service name is `my-release-nginx-ingress`, you can use `--set serviceNameOverride=my-release-nginx-ingress` when running the upgrade command.
+Here is an example upgrade command that keeps the existing service name `my-release-nginx-ingress` for a deployment named `my-release`:
+
+```console
+helm upgrade my-release oci://ghcr.io/nginx/charts/nginx-ingress --version 0.17.1 --set serviceNameOverride=my-release-nginx-ingress
+```
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [3737](https://github.com/nginx/kubernetes-ingress/pull/3737) Update VirtualServer to ignore CRL for EgressMTLS.
+- [3722](https://github.com/nginx/kubernetes-ingress/pull/3722) Inherit NET_BIND_SERVICE from IC to Nginx. Thanks to [Valters Jansons](https://github.com/sigv).
+- [3798](https://github.com/nginx/kubernetes-ingress/pull/3798) Update VirtualServer template to generate an internal jwt auth location per policy applied.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [3491](https://github.com/nginx/kubernetes-ingress/pull/3491) Egress via Ingress VirtualServer Resource.
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.23.4.
+- Update NGINX Plus version to R29.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [3602](https://github.com/nginx/kubernetes-ingress/pull/3602) Updated NGINX Service Mesh references in Helm templates. Thanks to [Jared Byers](https://github.com/jbyers19).
+- [3773](https://github.com/nginx/kubernetes-ingress/pull/3773) Swap cpu and memory in HPA template. Thanks to [Bryan Hendryx](https://github.com/coolbry95).
+- [3802](https://github.com/nginx/kubernetes-ingress/pull/3802) Add serviceNameOverride. Thanks to [Tim N](https://github.com/timnee).
+- [3815](https://github.com/nginx/kubernetes-ingress/pull/3815) Fix GlobalConfiguration name in Helm Chart.
+- [3862](https://github.com/nginx/kubernetes-ingress/pull/3862) Add correct indentation to controller-leader-election configmap helm template.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.1.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.1.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.1.1 images from the F5 Container registry or build your own image using the 3.1.1 source code.
+- For Helm, use version 0.17.1 of the chart.
+
+<hr>
+
+## 3.1.0
+
+29 Mar 2023
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+- Beginning with release 3.1.0 the NET_BIND_SERVICE capability is no longer used, and instead relies on net.ipv4.ip_unprivileged_port_start sysctl to allow port binding. Kubernetes 1.22 or later is required for this sysctl to be [classified as safe](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls). **Ensure that you are using the latest updated `deployment` and `daemonset` example yaml files available in the repo.**
+- *The minimum supported version of Kubernetes is now 1.22*. NGINX Ingress Controller now uses `sysctls` to [bind to lower level ports without additional privileges](https://github.com/nginx/kubernetes-ingress/pull/3573/). This removes the need to use `NET_BIND_SERVICE` to bind to these ports. Thanks to [Valters Jansons](https://github.com/sigv) for making this feature possible!
+- Added support for loading pre-compiled [AppProtect Policy Bundles](https://github.com/nginx/kubernetes-ingress/pull/3560) when using the `-enable-app-protect` cli argument. This feature removes the need for the Ingress Controller to compile NGINX App Protect Policy when NGINX App Protect Policy is updated.
+- IngressMTLS policy now supports configuring a Certificate Revocation Lists(CRL). When using this feature requests made using a revoked certificate will be rejected. See [Using a Certificate Revocation List]({{< ref "/nic/configuration/policy-resource.md#using-a-certificate-revocation-list" >}}) for details on configuring this option.
+- NGINX Ingress Controller now supports [running with a Read-only Root Filesystem](https://github.com/nginx/kubernetes-ingress/pull/3548). This improves the security posture of NGINX Ingress Controller by protecting the file system from unknown writes. See [Configure root filesystem as read-only]({{< ref "/nic/configuration/security.md#configure-root-filesystem-as-read-only" >}}) for details on configuring this option with both HELM and Manifest. Thanks to [Valters Jansons](https://github.com/sigv) for making this feature possible!
+- HELM deployments can now set [custom environment variables with controller.env](https://github.com/nginx/kubernetes-ingress/pull/3326). Thanks to [Aaron Shiels](https://github.com/AaronShiels) for making this possible!
+- HELM deployments can now configure a [pod disruption budget](https://github.com/nginx/kubernetes-ingress/pull/3248) allowing deployments to configure either a minimum number or a maximum unavailable number of pods. Thanks to [Bryan Hendryx](https://github.com/coolbry95) for making this possible!
+- NGINX Ingress Controller uses the latest OIDC reference implementation which now supports [forwarding access tokens to upstreams / backends](https://github.com/nginx/kubernetes-ingress/pull/3474). Thanks to [Shawn Kim](https://github.com/shawnhankim) for making this possible!
+- The default TLS secret is now optional. This improves the security posture of NGINX Ingress Controller through enabling [ssl_reject_handshake](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake). This has the impact of immediately terminating the SSL handshake and not revealing TLS or cypher settings to calls that do not match a configured hostname.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [3034](https://github.com/nginx/kubernetes-ingress/pull/3034) Allow extra args to be provided to the OIDC auth endpoint. Thanks to [Alan Wilkie](https://github.com/alanwilkie-finocomp).
+- [3474](https://github.com/nginx/kubernetes-ingress/pull/3474) Add access token support in the OIDC. Thanks to [Shawn Kim](https://github.com/shawnhankim).
+- [3326](https://github.com/nginx/kubernetes-ingress/pull/3326) Add support for custom environment variables on the Nginx Controller container. Thanks to [Aaron Shiels](https://github.com/AaronShiels).
+- [3527](https://github.com/nginx/kubernetes-ingress/pull/3527) Change controller.topologySpreadConstraints schema to array. Thanks to [Marco Londero](https://github.com/marcuz).
+- [3248](https://github.com/nginx/kubernetes-ingress/pull/3248) Add Pod disruption budget option to HELM based installations. Thanks to [Bryan Hendryx](https://github.com/coolbry95).
+- [3462](https://github.com/nginx/kubernetes-ingress/pull/3462) Add initial support for SSL termination for TransportServer.
+- [3451](https://github.com/nginx/kubernetes-ingress/pull/3451) Enable keepalive-time for healthchecks in VS and VSR.
+- [3560](https://github.com/nginx/kubernetes-ingress/pull/3560) Add support for load a pre-compiles AppProtect Policy Bundle.
+- [3632](https://github.com/nginx/kubernetes-ingress/pull/3632) Update nginx.org/ca secret type & crl field to IngressMTLS to support CRL.
+- [3629](https://github.com/nginx/kubernetes-ingress/pull/3629) Use the "runtime default" seccomp profile. Thanks to [Valters Jansons](https://github.com/sigv).
+- [3573](https://github.com/nginx/kubernetes-ingress/pull/3573) Rework port binding logic without privileges. Thanks to [Valters Jansons](https://github.com/sigv).
+- [3646](https://github.com/nginx/kubernetes-ingress/pull/3646) Remove app protect agent.
+- [3507](https://github.com/nginx/kubernetes-ingress/pull/3507) Support empty path for ImplementationSpecific pathType.
+- [3482](https://github.com/nginx/kubernetes-ingress/pull/3482) Use new NSM Spiffe and Cert rotation library.
+- [3442](https://github.com/nginx/kubernetes-ingress/pull/3442) Add websocket protocol option to monitor directive.
+- [3674](https://github.com/nginx/kubernetes-ingress/pull/3674) Move NAP DoS chart to new repo.
+- [3302](https://github.com/nginx/kubernetes-ingress/pull/3302) Make default-server-secret optional.
+- [3586](https://github.com/nginx/kubernetes-ingress/pull/3586) Add new labels and metadata to add version information to pods.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [3463](https://github.com/nginx/kubernetes-ingress/pull/3463) Support non-vs created Challenge Ingress.
+- [3475](https://github.com/nginx/kubernetes-ingress/pull/3475) Ensure leader election is correctly disabled when option is set to `false` in helm template.
+- [3481](https://github.com/nginx/kubernetes-ingress/pull/3481) Add missing OSS internal routes for integration with NSM.
+- [3541](https://github.com/nginx/kubernetes-ingress/pull/3541) Ensure non-ready endpoints are not added to upstreams.
+- [3583](https://github.com/nginx/kubernetes-ingress/pull/3583) Update keyCache path for JWKs to avoid conflict with OIDC.
+- [3607](https://github.com/nginx/kubernetes-ingress/pull/3607) Clear Content-Length headers for requests processed by internal JWKS routes.
+- [3660](https://github.com/nginx/kubernetes-ingress/pull/3660) Remove unwanted chars from label value.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [3581](https://github.com/nginx/kubernetes-ingress/pull/3581) Push edge Helm Chart to OCI registries.
+- [3449](https://github.com/nginx/kubernetes-ingress/pull/3449) Correct values.schema.json nodeSelector.
+- [3448](https://github.com/nginx/kubernetes-ingress/pull/3448) Fix Helm Chart Schema for priorityClassName.
+- [3519](https://github.com/nginx/kubernetes-ingress/pull/3519) Add OnDelete to allowed strategy values.
+- [3537](https://github.com/nginx/kubernetes-ingress/pull/3537) Update schema references to k8s v1.26.1.
+- [3606](https://github.com/nginx/kubernetes-ingress/pull/3606) Fix Helm Chart labels and templates. Move version update to labels.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- Make sure the Kubernetes version is in the supported platforms listed below.
+- For NGINX, use the 3.1.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.1.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.1.0 images from the F5 Container registry or build your own image using the 3.1.0 source code.
+- For Helm, use version 0.17.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.22-1.26.
+
+<hr>
+
+## 3.0.2
+
+13 Feb 2023
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [3519](https://github.com/nginx/kubernetes-ingress/pull/3519) Add OnDelete to allowed strategy values
+- [3541](https://github.com/nginx/kubernetes-ingress/pull/3541) Ensure non-ready endpoints are not added to upstreams
+- [3527](https://github.com/nginx/kubernetes-ingress/pull/3527) Fix controller.topologySpreadConstraints schema, thanks to [Marco Londero](https://github.com/marcuz)
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.0.2 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.0.2), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.0.2 images from the F5 Container registry or build your own image using the 3.0.2 source code.
+- For Helm, use version 0.16.2 of the chart.
+
+<hr>
+
+## 3.0.1
+
+25 Jan 2023
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [3448](https://github.com/nginx/kubernetes-ingress/pull/3448) Fix Helm Chart Schema for priorityClassName
+- [3449](https://github.com/nginx/kubernetes-ingress/pull/3449) Correct nodeSelector in the Helm Chart Schema
+- [3463](https://github.com/nginx/kubernetes-ingress/pull/3463) Support non-VS created Challenge Ingress
+- [3481](https://github.com/nginx/kubernetes-ingress/pull/3481) Add missing OSS internal routes for NGINX Service Mesh
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 3.0.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.0.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.0.1 images from the F5 Container registry or build your own image using the 3.0.1 source code.
+- For Helm, use version 0.16.1 of the chart.
+
+<hr>
+
+## 3.0.0
+
+12 January 2023
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+- Added support for [Deep Service Insight]({{< ref "/nic/logging-and-monitoring.md#service-insight" >}}) for VirtualServer and TransportServer using the [-enable-service-insight]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-enable-service-insight" >}}) cli argument.
+- *The minimum supported version of Kubernetes is now 1.21*. NGINX Ingress Controller 3.0.0 removes support for `k8s.io/v1/Endpoints` API in favor of `discovery.k8s.io/v1/EndpointSlices`. For older Kubernetes versions, use the 2.4.x release of the Ingress Controller.
+- Added support for [EndpointSlices](https://kubernetes.io/docs/concepts/services-networking/endpoint-slices/).
+- Added support to dynamically reconfigure namespace watchers using labels  [-watch-namespace-label]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-watch-namespace-label-string" >}}) and watching secrets using the [-watch-secret-namespace]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-watch-secret-namespace-string" >}}) cli arguments.
+- Allow configuration of NGINX directives `map-hash-bucket-size` and `map-hash-max-size` using the [ConfigMap resource]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}).
+- Added support for [fetching JWKs from a remote URL]({{< ref "/nic/configuration/policy-resource.md#jwt-using-jwks-from-remote-location" >}}) to dynamically validate JWT tokens and optimize performance through caching.
+- Beginning with NGINX Service Mesh release 1.7 it will include support for the free version of NGINX Ingress Controller as well as the paid version.
+- NGINX Ingress Controller + NGINX App Protect Denial of Service is now available through the AWS Marketplace.
+
+### <i class="fa-solid fa-bomb"></i> Breaking Changes
+
+- [3260](https://github.com/nginx/kubernetes-ingress/pull/3260) Added support for EndpointSlices.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [3299](https://github.com/nginx/kubernetes-ingress/pull/3299) Support Dynamic namespaces using Labels.
+- [3261](https://github.com/nginx/kubernetes-ingress/pull/3261) Deep service insight endpoint for VirtualServer CR.
+- [3361](https://github.com/nginx/kubernetes-ingress/pull/3361) Added healthcheck for TransportServer CR.
+- [3347](https://github.com/nginx/kubernetes-ingress/pull/3347) Import JWKS from URL on JWT policy.
+- [3274](https://github.com/nginx/kubernetes-ingress/pull/3274) Allow configuration of map-hash-bucket-size and map-hash-max-size directives.
+- [3376](https://github.com/nginx/kubernetes-ingress/pull/3376) NGINX Service Mesh will support the free version of NGINX Ingress Controller when using NGINX open source.
+- [3170](https://github.com/nginx/kubernetes-ingress/pull/3170) Watch subset of namespaces for secrets. Thanks to [Hans Feldt](https://github.com/hafe).
+- [3341](https://github.com/nginx/kubernetes-ingress/pull/3341) Set value of `$remote_addr` to client IP when TLSPassthrough and Proxy Protocol are enabled.
+- [3131](https://github.com/nginx/kubernetes-ingress/pull/3131) NAP DoS images are now available in the AWS Marketplace.
+- [3231](https://github.com/nginx/kubernetes-ingress/pull/3231) Always print build info and flags used at the start to provide better supportability.
+- [2735](https://github.com/nginx/kubernetes-ingress/pull/2735) Support default client proxy headers to be overwritten in VirtualServer. Thanks to [Alex Wied](https://github.com/centromere).
+- [3133](https://github.com/nginx/kubernetes-ingress/pull/3133) Added caseSensitiveHttpHeaders to APPolicy CRD. Thanks to [Pavel Galitskiy](https://github.com/galitskiy).
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [3139](https://github.com/nginx/kubernetes-ingress/pull/3139) Remove all IPV6 listeners in ingress resources with `-disable-ipv6` command line.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [3113](https://github.com/nginx/kubernetes-ingress/pull/3113) Added JSON Schema.
+- [3143](https://github.com/nginx/kubernetes-ingress/pull/3143) Added annotations for deployment and daemonset.
+- [3136](https://github.com/nginx/kubernetes-ingress/pull/3136) Added controller.dnsPolicy. Thanks to [Dong Wang](https://github.com/wd).
+- [3065](https://github.com/nginx/kubernetes-ingress/pull/3065) Added annotations to the service account. Thanks to [0m1xa](https://github.com/0m1xa).
+- [3276](https://github.com/nginx/kubernetes-ingress/pull/3276) Added horizontalpodautoscaler. Thanks to [Bryan Hendryx](https://github.com/coolbry95).
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- Make sure the Kubernetes version is in the supported platforms listed below.
+- For NGINX, use the 3.0.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.0.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 3.0.0 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 3.0.0 source code.
+- For Helm, use version 0.16.0 of the chart. Helm does not upgrade the CRDs. If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.21-1.26.
+
+<hr>
+
+## 2.4.2
+
+30 Nov 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX Plus version to R28.
+- Update NGINX App Protect WAF version to 4.0.
+- Update NGINX App Protect DoS version to 3.1.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.4.2 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.4.2), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.4.2 images from the F5 Container registry or build your own image using the 2.4.2 source code.
+- For Helm, use version 0.15.2 of the chart.
+
+<hr>
+
+## 2.4.1
+
+19 October 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [3183](https://github.com/nginx/kubernetes-ingress/pull/3183) Update NGINX version to 1.23.2.
+- [3175](https://github.com/nginx/kubernetes-ingress/pull/3175) Update Go dependencies.
+- Update NGINX Plus version to R27 P1.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [3139](https://github.com/nginx/kubernetes-ingress/pull/3139) Remove all IPV6 listeners in ingress resources with -disable-ipv6 command line.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.4.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.4.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.4.1 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.4.1 source code.
+- For Helm, use version 0.15.1 of the chart.
+
+<hr>
+
+## 1.12.5
+
+19 October 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.23.2.
+- Update NGINX Plus version to R27 P1.
+- Update Alpine to 3.16.
+- Update Go to 1.19 and Go dependencies.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.12.5 image from our DockerHub: `nginx/nginx-ingress:1.12.5`, `nginx/nginx-ingress:1.12.5-alpine` or `nginx/nginx-ingress:1.12.5-ubi`
+- For NGINX Plus, please build your own image using the 1.12.5 source code.
+- For Helm, use version 0.10.5 of the chart.
+
+<hr>
+
+## 2.4.0
+
+04 October 2022
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+- Added support for enabling [proxy_protocol](https://github.com/nginx/kubernetes-ingress/tree/v2.4.0/examples/shared-examples/proxy-protocol) when port 443 is being used for both HTTPS traffic and [TLS Passthrough traffic](https://github.com/nginx/kubernetes-ingress/tree/v2.4.0/examples/custom-resources/tls-passthrough).
+- Updates to the TransportServer resource to support using [ExternalName services](https://kubernetes.io/docs/concepts/services-networking/service/#externalname). For examples, see [externalname-services](https://github.com/nginx/kubernetes-ingress/tree/v2.4.0/examples/custom-resources/externalname-services).
+- VirtualServer resource now supports [wildcard hostname](https://kubernetes.io/docs/concepts/services-networking/ingress/#hostname-wildcards).
+- NGINX Ingress Controller images including the combined NGINX AppProtect WAF and NGINX AppProtect DoS solutions are now published to our registry. See [Images with NGINX Plus]({{< ref "/nic/technical-specifications.md#images-with-nginx-plus" >}}) for a detailed list of images in our registry.
+- Added support for watching multiple namespaces using the [-watch-namespace]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-watch-namespace-string" >}}) cli argument. This can configured by passing a comma-separated list of namespaces to the `-watch-namespace` CLI argument (e.g. `-watch-namespace=ns-1,ns-2`).
+- A new cli argument has been added: [-include-year]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-include-year" >}}). This appends the current year to the log output from the Ingress Controller. Example output: `I20220512 09:20:42.345457`.
+- Post-startup configuration reloads have been optimized to reduce traffic impacts. When many resources are modified at the same time, changes are combined to reduce the number of data plane reloads.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [2986](https://github.com/nginx/kubernetes-ingress/pull/2986) Batch reloads at runtime.
+- [2914](https://github.com/nginx/kubernetes-ingress/pull/2914) Support watching multiple namespaces.
+- [2884](https://github.com/nginx/kubernetes-ingress/pull/2884) Include year in logs.
+- [2993](https://github.com/nginx/kubernetes-ingress/pull/2993) Accept proxy protocol when TLS passthrough enabled.
+- [3041](https://github.com/nginx/kubernetes-ingress/pull/3041) Support external name service for TransportServer.
+- [2939](https://github.com/nginx/kubernetes-ingress/pull/2939) Add support for wildcard hostname in VirtualServer.
+- [3040](https://github.com/nginx/kubernetes-ingress/pull/3040) Add command line argument to manually disable IPV6 listeners for unsupported clusters.
+- [3088](https://github.com/nginx/kubernetes-ingress/pull/3088) Filter secrets of type helm.sh/release.v1.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2971](https://github.com/nginx/kubernetes-ingress/pull/2971) fix: Correct error message on missing path in path validation. Thanks to [Zachary Seguin](https://github.com/zachomedia).
+- [3095](https://github.com/nginx/kubernetes-ingress/pull/3095) do not create configmap if customConfigMap is used. Thanks to [Bryan Hendryx](https://github.com/coolbry95).
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [3087](https://github.com/nginx/kubernetes-ingress/pull/3087) Allow omitting the default server secret from Helm installs.
+- [2831](https://github.com/nginx/kubernetes-ingress/pull/2831) Add ServiceMonitor to Helm Chart. Thanks to [araineUnity](https://github.com/araineUnity).
+- [2855](https://github.com/nginx/kubernetes-ingress/pull/2854) Add initialDelaySeconds to helm charts. Thanks to [Daniel Edgar](https://github.com/aknot242).
+- [2979](https://github.com/nginx/kubernetes-ingress/pull/2979) Allow to specify image with digest in helm chart. Thanks to [Hans Feldt](https://github.com/hafe).
+- [3031](https://github.com/nginx/kubernetes-ingress/pull/3031) Adding automountServiceAccountToken to helm chart.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.4.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.4.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.4.0 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.4.0 source code.
+- For Helm, use version 0.15.0 of the chart. If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after you run the `helm upgrade` command, the CRDs will not be upgraded. After running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.19-1.25.
+
+<hr>
+
+## 2.3.1
+
+16 September 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [3048](https://github.com/nginx/kubernetes-ingress/pull/3048) Bump NGINX to 1.23.1
+- [3049](https://github.com/nginx/kubernetes-ingress/pull/3049) Update Go dependencies.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [3031](https://github.com/nginx/kubernetes-ingress/pull/3031) Add automountServiceAccountToken to helm chart
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.3.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.3.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.3.1 images from the F5 Container registry or build your own image using the 2.3.1 source code.
+- For Helm, use version 0.14.1 of the chart.
+
+<hr>
+
+## 2.3.0
+
+12 July 2022
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+- Support making VirtualServer resources discoverable via public DNS servers using [external-dns](https://kubernetes-sigs.github.io/external-dns). Examples for configuring external-dns with NGINX Ingress Controller can be found [here](https://github.com/nginx/kubernetes-ingress/tree/v2.3.0/examples/custom-resources/external-dns).
+- Resolves [CVE-2022-30535](https://support.f5.com/csp/article/K52125139). This vulnerability impacted the visibility of secrets accessible by NGINX Ingress Controller. In some cases, secrets visible to NGINX Ingress Controller could be exposed to any authenticated user with permission to create and update Ingress objects. This vulnerability affected Ingress objects only - our Custom Resources (VirtualServer and TransportServer) were not affected. Customers unable to upgrade should migrate any Ingress resources to VirtualServer resources where possible, and use RBAC to restrict write access for users for Ingress objects.
+- Support using HTTP basic authentication with [VirtualServer](https://github.com/nginx/kubernetes-ingress/tree/v2.3.1/examples/custom-resources/basic-auth) and [Ingress](https://github.com/nginx/kubernetes-ingress/tree/v2.3.0/examples/basic-auth) resources. Special thanks to [Simon Wachter](https://github.com/svvac).
+- Support HTTP01 type ACME Issuers for use with VirtualServer resources with [cert-manager](https://cert-manager.io/docs/).
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [2581](https://github.com/nginx/kubernetes-ingress/pull/2581) Add OpenTracing to all Debian and Alpine based images.
+- [2328](https://github.com/nginx/kubernetes-ingress/pull/2328) Add handling of multiple log destinations.
+- [2691](https://github.com/nginx/kubernetes-ingress/pull/2691) AP: log-conf escaping chars.
+- [2759](https://github.com/nginx/kubernetes-ingress/pull/2759) Add support for HTTP01 Challenges on VirtualServer resources.
+- [2762](https://github.com/nginx/kubernetes-ingress/pull/2762) Add DNSEndpoint CRD for integration with ExternalDNS.
+- [2801](https://github.com/nginx/kubernetes-ingress/pull/2801) Add SBOMs to release.
+- [2269](https://github.com/nginx/kubernetes-ingress/pull/2269) HTTP basic auth support. Thanks to [Simon Wachter](https://github.com/svvac).
+- [2800](https://github.com/nginx/kubernetes-ingress/pull/2800) Integrate external-dns with VirtualServer resources.
+- [2583](https://github.com/nginx/kubernetes-ingress/pull/2583) Add runAsNonRoot in deployments.
+- [2484](https://github.com/nginx/kubernetes-ingress/pull/2484) Add container resource requests.
+- [2627](https://github.com/nginx/kubernetes-ingress/pull/2627) Update InternalRoute server_name.
+- [2742](https://github.com/nginx/kubernetes-ingress/pull/2742) Add additional unit tests to confirm special characters can't be used in the lb-method annotation.
+- [2730](https://github.com/nginx/kubernetes-ingress/pull/2730) Add string sanitisation for proxy-pass-headers & proxy-hide-headers.
+- [2733](https://github.com/nginx/kubernetes-ingress/pull/2733) Add string validation to server-tokens annotation.
+- [2734](https://github.com/nginx/kubernetes-ingress/pull/2734) Validate rewrite annotation.
+- [2754](https://github.com/nginx/kubernetes-ingress/pull/2754) Validate JWT key, realm and login url for ingress resources annotations.
+- [2751](https://github.com/nginx/kubernetes-ingress/pull/2751) Add string validation to sticky-cookie-services annotation.
+- [2775](https://github.com/nginx/kubernetes-ingress/pull/2775) Add validation to Ingress path.
+- [2774](https://github.com/nginx/kubernetes-ingress/pull/2774) Sanitize nginx.com/jwt-token.
+- [2783](https://github.com/nginx/kubernetes-ingress/pull/2783) Update validation regex for path spec.
+- [2781](https://github.com/nginx/kubernetes-ingress/pull/2781) Report Hostname in ExternalEndpoint for VS and VSR resources.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2617](https://github.com/nginx/kubernetes-ingress/pull/2617) Fix Dockerfile for amd64 microarchitectures.
+- [2637](https://github.com/nginx/kubernetes-ingress/pull/2637) Add terminationGracePeriodSeconds to deployment. Thanks to [Maksym Iv](https://github.com/maksym-iv).
+- [2654](https://github.com/nginx/kubernetes-ingress/pull/2654) Sync changes from OIDC repo, add field in policy.
+- [2673](https://github.com/nginx/kubernetes-ingress/pull/2673) Fix status.loadbalancer.hostname deletion on OOMKill. Thanks to [Heiko Voigt](https://github.com/hvoigt).
+- [2718](https://github.com/nginx/kubernetes-ingress/pull/2718) Fix cases where CM enabled but no TLS block specified in VS.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [2418](https://github.com/nginx/kubernetes-ingress/pull/2418) Add support for allocateLoadBalancerNodePorts, ipFamilyPolicy and ipFamilies. Thanks to [centromere](https://github.com/centromere).
+- [2672](https://github.com/nginx/kubernetes-ingress/pull/2672) Add minReadySeconds & strategy support. Thanks to [Ciaran](https://github.com/cmk-pcs).
+- [2625](https://github.com/nginx/kubernetes-ingress/pull/2625) allow configuring topologySpreadConstraints in Helm chart. Thanks to [Kamil Domański](https://github.com/kdomanski).
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.3.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.3.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.3.0 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.3.0 source code.
+- For Helm, use version 0.14.0 of the chart. If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after you run the `helm upgrade` command, the CRDs will not be upgraded. After running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
+- When upgrading using [Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), make sure to update the [ClusterRole](https://github.com/nginx/kubernetes-ingress/blob/v2.3.1/deployments/rbac/rbac.yaml). This is required to enable the ExternalDNS for VirtualServer resources integration.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and which passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.19-1.24.
+
+<hr>
+
+## 2.2.2
+
+23 May 2022
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2627](https://github.com/nginx/kubernetes-ingress/pull/2627) Update InternalRoute server_name.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.2.2 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.2.2), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.2.2 images from the F5 Container registry or build your own image using the 2.2.2 source code.
+- For Helm, use version 0.13.2 of the chart.
+
+<hr>
+
+## 2.2.1
+
+17 May 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+the documentation here
+
+- Update Go dependencies.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2654](https://github.com/nginx/kubernetes-ingress/pull/2654) Sync changes from [nginx-openid-connect](https://github.com/nginxinc/nginx-openid-connect) repo, add zoneSyncLeeway field in policy. For more information on the fixes, see [pull request 52](https://github.com/nginxinc/nginx-openid-connect/pull/52).
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.2.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.2.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.2.1 images from the F5 Container registry or build your own image using the 2.2.1 source code.
+- For Helm, use version 0.13.1 of the chart.
+
+<hr>
+
+## 2.2.0
+
+12 April 2022
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+- Support for automatic provisioning and management of Certificate resources for VirtualServer resources using [cert-manager](https://cert-manager.io/docs/). Examples for configuring cert-manager with NGINX Ingress Controller can be found [here](https://github.com/nginx/kubernetes-ingress/tree/v2.2.0/examples/custom-resources/certmanager). Please note that HTTP01 type ACME Issuers are not yet supported for use with VirtualServer resources.
+
+- Full support for IPv6 using the NGINX Ingress Controller [VirtualServer and VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}) custom resources, and Ingress resources.
+
+- The [-enable-preview-policies]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-enable-preview-policies" >}}) cli argument has been deprecated and is no longer required for the usage of any Policy resource type. This argument will be removed completely in v2.6.0.
+
+- A new [-enable-oidc]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-enable-oidc" >}}) cli argument has been added to enable OIDC policies. Previously, this behaviour was achieved through the usage of the `-enable-preview-policies` cli argument.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [2576](https://github.com/nginx/kubernetes-ingress/pull/2576) Add support for IPv6.
+- [2572](https://github.com/nginx/kubernetes-ingress/pull/2572) Automate provisioning of Certificate resources for VirtualServer resources using cert-manager.
+- [2346](https://github.com/nginx/kubernetes-ingress/pull/2346) Use os.ReadDir for lightweight directory reading. Thanks to [Eng Zer Jun](https://github.com/Juneezee).
+- [2360](https://github.com/nginx/kubernetes-ingress/pull/2360) Add NGINX App Protect reconnect period directive.
+- [2479](https://github.com/nginx/kubernetes-ingress/pull/2479) Add cli argument to configure NGINX App Protect log level.
+- [2455](https://github.com/nginx/kubernetes-ingress/pull/2455) Increase memory available for NGINX App Protect xml parser.
+- [2580](https://github.com/nginx/kubernetes-ingress/pull/2580) Create -enable-oidc command line argument for OIDC policy.
+- [2566](https://github.com/nginx/kubernetes-ingress/pull/2566) Unbind policy from preview policies.
+- [2582](https://github.com/nginx/kubernetes-ingress/pull/2582) Rename Make targets from `openshift` to `ubi`.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2378](https://github.com/nginx/kubernetes-ingress/pull/2378) Fix healthcheck ports.
+- [2404](https://github.com/nginx/kubernetes-ingress/pull/2404) Start nginx with -e stderr parameter.
+- [2414](https://github.com/nginx/kubernetes-ingress/pull/2414) Fix in file nginx-plus.virtualserver.tmpl ApDosMonitor->ApDosMonitorURI.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [2525](https://github.com/nginx/kubernetes-ingress/pull/2525) Extend helm chart to include NGINX Service Mesh fields.
+- [2294](https://github.com/nginx/kubernetes-ingress/pull/2294) Add extra containers to helm chart. Thanks to [Márk Sági-Kazár](https://github.com/sagikazarmark).
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.2.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.2.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.2.0 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.2.0 source code.
+- For Helm, use version 0.13.0 of the chart. If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after you run the `helm upgrade` command, the CRDs will not be upgraded. After running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
+- When upgrading using [Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), make sure to update the [ClusterRole](https://github.com/nginx/kubernetes-ingress/blob/v2.2.0/deployments/rbac/rbac.yaml). This is required to enable the cert-manager for VirtualServer resources integration.
+- The -enable-preview-policies cli argument has been deprecated, and is no longer required for any Policy resources.
+- Enabling OIDC Policies now requires the use of -enable-oidc cli argument instead of the -enable-preview-policies cli argument.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and which passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.19-1.23.
+
+<hr>
+
+## 2.1.2
+
+29 March 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update UBI based images to 8.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.1.2 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.1.2), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.1.2 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.1.2 source code.
+- For Helm, use version 0.12.2 of the chart.
+
+<hr>
+
+## 1.12.4
+
+23 March 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.21.6.
+- Update NGINX Plus version to R26.
+- Update Debian to Bullseye.
+- Update Alpine to 3.15.
+- Update UBI to 8.
+- Update Go to 1.17 and Go dependencies.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- Fix OpenTracing not working with NGINX Plus.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.12.4 image from our DockerHub: `nginx/nginx-ingress:1.12.4`, `nginx/nginx-ingress:1.12.4-alpine` or `nginx/nginx-ingress:1.12.4-ubi`
+- For NGINX Plus, please build your own image using the 1.12.4 source code.
+- For Helm, use version 0.10.4 of the chart.
+
+<hr>
+
+## 2.1.1
+
+17 February 2022
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.21.6.
+- Update NGINX Plus version to R26.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.1.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.1.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.1.1 images from the F5 Container registry or build your own image using the 2.1.1 source code.
+- For Helm, use version 0.12.1 of the chart.
+
+<hr>
+
+## 2.1.0
+
+06 January 2022
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+- Support for NGINX App Protect Denial of Service protection with NGINX Ingress Controller. More information about [NGINX App Protect DoS](https://www.nginx.com/products/nginx-app-protect/denial-of-service/). Examples for configuring NGINX App Protect DoS with NGINX Ingress Controller can be found [here](https://github.com/nginx/kubernetes-ingress/tree/v2.1.1/examples/appprotect-dos).
+
+- Full support for gRPC services using the NGINX Ingress Controller [VirtualServer and VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}) custom resource definitions.  This makes configuring and supporting gRPC services much easier, giving a simple YAML configuration and removing the need for snippets. Resource definition examples for gRPC can be found [here](https://github.com/nginx/kubernetes-ingress/tree/v2.1.1/examples/custom-resources/grpc-upstreams).
+
+- Implementation of NGINX mandatory and persistent health checks in VirtualServer and VirtualServerRoute to further reduce interruptions to your service traffic as configuration changes continuously happen in your dynamic Kubernetes environment(s). Health checks have been extended to include `mandatory` and `persistent` fields. Mandatory health checks ensures that a new upstream server starts receiving traffic only after the health check passes. Mandatory health checks can be marked as persistent, so that the previous state is remembered when the Ingress Controller reloads NGINX Plus configuration. When combined with the slow-start parameter, the mandatory health check give a new upstream server more time to connect to databases and “warm up” before being asked to handle their full share of traffic. See the settings [here]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#upstreamhealthcheck" >}}). More about the [NGINX Plus mandatory and persistent health check features](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#mandatory-health-checks).
+Mandatory health checks can be marked as persistent, so that the previous state is remembered when reloading configuration. When combined with the slow-start parameter, it gives a new service pod more time to connect to databases and “warm up” before being asked to handle their full share of traffic.
+See the settings [here]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#upstreamhealthcheck" >}}).
+More about the [NGINX Plus mandatory and persistent health check features](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#mandatory-health-checks)
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [2251](https://github.com/nginx/kubernetes-ingress/pull/2251) Enable setting mandatory and persistent in upstream healthchecks in VS and VSR.
+- [2241](https://github.com/nginx/kubernetes-ingress/pull/2241) Add support for NGINX App Protect DoS.
+- [2200](https://github.com/nginx/kubernetes-ingress/pull/2200) Add Alpine image with OpenTracing.
+- [2178](https://github.com/nginx/kubernetes-ingress/pull/2178) Support healthchecks in gRPC upstreams.
+- [2110](https://github.com/nginx/kubernetes-ingress/pull/2110) Support gRPC in the Upstreams of the virtual server resources. Particular thanks to [Chiyu Zhong](https://github.com/CatTail) for all their work.
+- [2149](https://github.com/nginx/kubernetes-ingress/pull/2149) Add metric about total number of TransportServers.
+- [2100](https://github.com/nginx/kubernetes-ingress/pull/2100) Add support for initContainers. Thanks to [Gunnar Scherf](https://github.com/g10f).
+- [1827](https://github.com/nginx/kubernetes-ingress/pull/1827) Add support for wildcard cert in VirtualServer resources. Thanks to [Simon Wachter](https://github.com/svvac).
+- [2107](https://github.com/nginx/kubernetes-ingress/pull/2107) Add option to download the NGINX Ingress Controller binary. Introduced a new `TARGET` `download` in the `Makefile` which can be used when building the NGINX Ingress Controller Docker image. With this option the Ingress Controller binary will be downloaded instead of built from source.
+- [2044](https://github.com/nginx/kubernetes-ingress/pull/2044) Upload NGINX Ingress Controller binaries to release.
+- [2094](https://github.com/nginx/kubernetes-ingress/pull/2094) AP: update appolicies crd.
+- [2216](https://github.com/nginx/kubernetes-ingress/pull/2216) Add grpc_status to the logs.
+- [2237](https://github.com/nginx/kubernetes-ingress/pull/2237) Unbind app-protect from -preview-policies.
+- [2273](https://github.com/nginx/kubernetes-ingress/pull/2273) Make the resource comparison more informative in case of an error. Thanks to [Andrey Karpov](https://github.com/ndk).
+- [2124](https://github.com/nginx/kubernetes-ingress/pull/2124) Apply -enable-snippets cli arg to Ingresses. This PR extends the existing -enable-snippets cli argument to apply to Ingress resources. If snippets are not enabled, the Ingress Controller will reject any Ingress resources with snippets annotations. Previously, the argument only applied to VirtualServer, VirtualServerRoute and TransportServer resources. Please Note: this is a breaking change. See the `UPGRADE` instructions below.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2267](https://github.com/nginx/kubernetes-ingress/pull/2267) Fix URI rewrite in VirtualServers and VirtualServerRoutes.
+- [2260](https://github.com/nginx/kubernetes-ingress/pull/2260) Check if refresh token is `undefined` and do not store it in this case. Thanks to [tippexs](https://github.com/tippexs) for the fix.
+- [2215](https://github.com/nginx/kubernetes-ingress/pull/2215) enableSnippets should not depend from enableCustomResources. Thanks to [Alessio Casco](https://github.com/AlessioCasco) for the fix.
+- [1934](https://github.com/nginx/kubernetes-ingress/pull/1934) AP: fix watch-namespace for NAP resources.
+- [2125](https://github.com/nginx/kubernetes-ingress/pull/2125) Allow empty string in server-tokens annotation for NGINX Plus.
+- [2042](https://github.com/nginx/kubernetes-ingress/pull/2042) Use release specific repo for NGINX Plus on Debian.
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [2173](https://github.com/nginx/kubernetes-ingress/pull/2173) Update Debian to Bullseye.
+- Update NGINX Plus version to R25.
+- Update NGINX version to 1.21.5.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.1.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.1.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
+- For NGINX Plus, use the 2.1.0 images from the F5 Container registry or build your own image using the 2.1.0 source code.
+- For Helm, use version 0.12.0 of the chart.
+- We changed the behaviour of snippets in Ingress resources by extending the existing -enable-snippets cli argument to apply to Ingress resources as well as VirtualServer, VirtualServerRoute and TransportServer resources. Because the default value of -enable-snippets is false, if you are using snippets in Ingress resources, you must explicitly set the -enable-snippets to true before upgrading the Ingress Controller, so that the new version of the Ingress Controller doesn't reject Ingresses with snippets annotations.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and which passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.19-1.23.
+
+<hr>
+
+## 2.0.3
+
+28 October 2021
+
+### <i class="fa-solid fa-bomb"></i> Breaking Changes
+
+- [2124](https://github.com/nginx/kubernetes-ingress/pull/2124) Apply -enable-snippets cli arg to Ingresses. This PR extends the existing -enable-snippets cli argument to apply to Ingress resources. If snippets are not enabled, the Ingress Controller will reject any Ingress resources with snippets annotations. Previously, the argument only applied to VirtualServer, VirtualServerRoute and TransportServer resources. Please Note: this is a breaking change. See the `UPGRADE` instructions below.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2132](https://github.com/nginx/kubernetes-ingress/pull/2132) Install libcurl on OpenTracing for NGINX Plus.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.0.3 image from our DockerHub: `nginx/nginx-ingress:2.0.3`, `nginx/nginx-ingress:2.0.3-alpine` or `nginx/nginx-ingress:2.0.3-ubi`
+- For NGINX Plus, please build your own image using the 2.0.3 source code.
+- For Helm, use version 0.11.3 of the chart.
+- We changed the behaviour of snippets in Ingress resources by extending the existing -enable-snippets cli argument to apply to Ingress resources as well as VirtualServer, VirtualServerRoute and TransportServer resources. Because the default value of -enable-snippets is false, if you are using snippets in Ingress resources, you must explicitly set the -enable-snippets to true before upgrading the Ingress Controller, so that the new version of the Ingress Controller doesn't reject Ingresses with snippets annotations.
+
+<hr>
+
+## 1.12.3
+
+28 October 2021
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2133](https://github.com/nginx/kubernetes-ingress/pull/2133) Use release specific repo for the App Protect packages on Debian. This fixes an error when building Debian-based images with NGINX Plus with App Protect: previously, building an image would fail with the error `nginx-plus-module-appprotect : Depends: app-protect-plugin (= 3.639.0-1~buster) but 3.671.0-1~buster is to be installed`. The bug first appeared when NGINX App Protect version 3.6 was released on 13 October 2021.
+- [2134](https://github.com/nginx/kubernetes-ingress/pull/2134) Apply -enable-snippets cli arg to Ingresses. This PR extends the existing -enable-snippets cli argument to apply to Ingress resources. If snippets are not enabled, the Ingress Controller will reject any Ingress resources with snippets annotations. Previously, the argument only applied to VirtualServer, VirtualServerRoute and TransportServer resources. Please Note: this is a breaking change. See the `UPGRADE` instructions below.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.12.3 image from our DockerHub: `nginx/nginx-ingress:1.12.3`, `nginx/nginx-ingress:1.12.3-alpine` or `nginx/nginx-ingress:1.12.3-ubi`
+- For NGINX Plus, please build your own image using the 1.12.3 source code.
+- For Helm, use version 0.10.3 of the chart.
+- We changed the behaviour of snippets in Ingress resources by extending the existing -enable-snippets cli argument to apply to Ingress resources as well as VirtualServer, VirtualServerRoute and TransportServer resources. Because the default value of -enable-snippets is false, if you are using snippets in Ingress resources, you must explicitly set the -enable-snippets to true before upgrading the Ingress Controller, so that the new version of the Ingress Controller doesn't reject Ingresses with snippets annotations.
+
+<hr>
+
+## 2.0.2
+
+13 October 2021
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX App Protect version to 3.6.
+- Update NGINX Plus version to R25 in NGINX App Protect enabled images.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [2074](https://github.com/nginx/kubernetes-ingress/pull/2074) Update JWT library to `golang-jwt/jwt`. Previously, the Ingress Controller used `dgrijalva/jwt-go`, which has a vulnerability [CVE-2020-26160](https://nvd.nist.gov/vuln/detail/CVE-2020-26160). Note that the Ingress Controller wasn’t affected by this vulnerability, and the jwt library was used only in the NGINX Plus images from AWS Marketplace for Containers.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.0.2 image from our DockerHub.
+- For NGINX Plus, use the 2.0.2 from the F5 Container registry or build your own image using the 2.0.2 source code.
+- For Helm, use version 0.11.2 of the chart.
+
+<hr>
+
+## 2.0.1
+
+07 October 2021
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2051](https://github.com/nginx/kubernetes-ingress/pull/2051) Use release specific repo for NGINX Plus on Debian. This fixes an error when building the Debian-based image with NGINX Plus and App Protect: previously, building the image would fail with the error `Package 'nginx-plus-r24' has no installation candidate`.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.0.1 image from our DockerHub.
+- For NGINX Plus, use the 2.0.1 from the F5 Container registry or build your own image using the 2.0.1 source code.
+- For Helm, use version 0.11.1 of the chart.
+
+<hr>
+
+## 1.12.2
+
+7 October 2021
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [2048](https://github.com/nginx/kubernetes-ingress/pull/2048) Use release specific repo for NGINX Plus on Debian. This fixes an error when building Debian-based images with NGINX Plus: previously, building an image would fail with the error `Package 'nginx-plus-r24' has no installation candidate`. The bug first appeared when NGINX Plus R25 was released on 28 September 2021.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.12.2 image from our DockerHub: `nginx/nginx-ingress:1.12.2`, `nginx/nginx-ingress:1.12.2-alpine` or `nginx/nginx-ingress:1.12.2-ubi`
+- For NGINX Plus, please build your own image using the 1.12.2 source code.
+- For Helm, use version 0.10.2 of the chart.
+
+<hr>
+
+## 2.0.0
+
+28 September 2021
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 2.0.0 includes:
+
+- *Support for Ingress networking.k8s.io/v1*. Kubernetes 1.22 removes support for networking.k8s.io/v1beta1. To support Kubernetes 1.22, NGINX Ingress Controller 2.0 is also compatible with only the networking.k8s.io/v1 version of the Ingress and IngressClass resources.  This has the following implications:
+  1. The minimum supported version of Kubernetes is now 1.19. For older Kubernetes versions, use the 1.12.x release of the Ingress Controller.
+  2. For Kubernetes versions 1.19-1.21, you can continue using the `networking.k8s.io/v1beta1` of the Ingress and IngressClass resources.
+  3. For Kubernetes 1.22, you need to migrate your Ingress and IngressClass resources to `networking.k8s.io/v1`.
+  4. If you are using the deprecated `kubernetes.io/ingress.class` annotation in your Ingress resources, it is recommended to switch to the `ingressClassName` field.
+
+     We migrated all our documentation and examples to use `networking.k8s.io/v1` and the `ingressClassName` field of the Ingress resource.
+- *Scalability improvements*. We improved the time for an Ingress Controller pod to become ready and start receiving traffic. This is especially noticeable when you have hundreds of Ingress or other configuration resources like VirtualServers: instead of several minutes or more in rare cases, a pod will become ready within a few minutes.
+- *Documentation improvements* We changed the look and feel of our documentation at <https://docs.nginx.com/nginx-ingress-controller> as well as the underlying publishing technology, which will allow us to bring even more improvements in the next releases.
+- *Upgrade path for k8s.nginx.org/v1alpha1 Policy resource* If you’re running release 1.9.0 and using the k8s.nginx.org/v1alpha1 Policy, the Ingress Controller now supports an upgrade path from v1alpha1 to v1 Policy version without downtime. See UPDATING POLICIES section below.
+
+You will find the complete changelog for release 2.0.0, including bug fixes, improvements, and changes below.
+
+### <i class="fa-solid fa-bomb"></i> Breaking Changes
+
+- [1850](https://github.com/nginx/kubernetes-ingress/pull/1850) Support Ingress and IngressClass v1.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [1908](https://github.com/nginx/kubernetes-ingress/pull/1908) Add NTLM support to VirtualServer and VirtualServerRoute upstreams.
+- [1746](https://github.com/nginx/kubernetes-ingress/pull/1746) Add ingressClassName field to Policy.
+- [1956](https://github.com/nginx/kubernetes-ingress/pull/1956) Add v1alpha1 version back to policy CRD.
+- [1907](https://github.com/nginx/kubernetes-ingress/pull/1907) Remove libs compilation for OpenTracing in Dockerfile; add Zipkin and Datadog in addition to the already supported Jaeger tracer; additionally, for NGINX we now publish a Docker image with the tracers and the OpenTracing module on DockerHub: `nginx-ic/nginx-plus-ingress:1.12.0-ot`. Also thanks to [MatyRi](https://github.com/MatyRi) for upgrading OpenTracing in [1883](https://github.com/nginx/kubernetes-ingress/pull/1883).
+- [1788](https://github.com/nginx/kubernetes-ingress/pull/1788) Reload only once during the start. This significantly reduces the time it takes for an Ingress Controller pod to become ready when hundreds of Ingress or other supported resources are created in the cluster.
+- [1721](https://github.com/nginx/kubernetes-ingress/pull/1721) Increase default reload timeout to 60s: the Ingress Controller will wait for 60s for NGINX to start or reload. Previously, the default was 4 seconds.
+- [2009](https://github.com/nginx/kubernetes-ingress/pull/2009) Increase default upstream zone size for NGINX Plus. See the INCREASED UPSTREAM ZONES section below.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [1926](https://github.com/nginx/kubernetes-ingress/pull/1926) Fix increased IC pod startup time when hundreds of VirtualServerRoutes are used
+- [1712](https://github.com/nginx/kubernetes-ingress/pull/1712) Allow `make` to build image when .git directory is missing.
+
+### <i class="fa-solid fa-file"></i> Documentation
+
+- [1932](https://github.com/nginx/kubernetes-ingress/pull/1932) Add IAM instructions for NGINX Plus AWS Marketplace images.
+- [1927](https://github.com/nginx/kubernetes-ingress/pull/1927) Fix function name comments typo. Thanks to [Sven Nebel](https://github.com/snebel29).
+- [1898](https://github.com/nginx/kubernetes-ingress/pull/1898) Add instructions for configuring MyF5 JWT as a Docker registry secret for the F5 Container registry for NGINX Plus images.
+- [1851](https://github.com/nginx/kubernetes-ingress/pull/1851) Update docs and examples to use networking.k8s.io/v1.
+- [1765](https://github.com/nginx/kubernetes-ingress/pull/1765) Create documentation for pulling NGINX Plus images from the F5 Container registry.
+- [1740](https://github.com/nginx/kubernetes-ingress/pull/1740) Publish docs using Hugo and Netlify.
+- [1702](https://github.com/nginx/kubernetes-ingress/pull/1702) Add security recommendations documentation.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- Add new parameters to the Chart: `controller.pod.extraLabels`. Added in [1884](https://github.com/nginx/kubernetes-ingress/pull/1884).
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [1855](https://github.com/nginx/kubernetes-ingress/pull/1855) Update minimum Kubernetes version to 1.19; remove the `-use-ingress-class-only` command-line argument, which doesn't work with Kubernetes >= 1.19.
+- Update NGINX Plus version to R25. **Note**: images with NGINX App Protect will continue to use R24 until App Protect 3.6 is released.
+- Update NGINX version to 1.21.3.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 2.0.0 image from our DockerHub.
+- For NGINX Plus, use the 2.0.0 from the F5 Container registry or build your own image using the 2.0.0 source code.
+- For Helm, use version 0.11.0 of the chart.
+
+See the complete list of supported images for NGINX and NGINX Plus on the [Technical Specifications]({{< ref "/nic/technical-specifications.md#supported-docker-images" >}}) page.
+
+INCREASED UPSTREAM ZONES
+
+We increased the default size of an upstream zone from 256K to 512K to accommodate a change in NGINX Plus R25. The change makes NGINX Plus allocate more memory for storing upstream server (peer) data, which means upstream server zones will use more memory to account for that new data.
+
+The increase in the zone size is to prevent NGINX Plus configuration reload failures after an upgrade to release 1.13.0. Note that If a zone becomes full, NGINX Plus will fail to reload and fail to add more upstream servers via the API.
+
+The new 512K default value will be able to hold ~270 upstream servers per upstream, similarly to how the old 256K value was able to hold the same number of upstream servers in the previous Ingress Controller releases. You can understand the utilization of the upstream zones via [NGINX Plus API](http://nginx.org/en/docs/http/ngx_http_api_module.html#slabs) and the [NGINX Plus dashboard]({{< ref "/nic/logging-and-monitoring/status-page.md#accessing-live-activity-monitoring-dashboard" >}}) (the shared zones tab).
+
+If you have a large number of upstream in the NGINX Plus configuration of the Ingress Controller, expect that after an upgrade NGINX Plus will consume more memory: +256K per upstream. If you don’t have upstreams with huge number of upstream serves and you’d like to reduce the memory usage of NGINX Plus, you can configure the `upstream-zone-size` [ConfigMap key]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#backend-services-upstreams" >}}) with a lower value. Additionally, the Ingress resource supports `nginx.org/upstream-zone-size` [annotation]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#backend-services-upstreams" >}}) to configure zone sizes for the upstreams of an Ingress resource rather than globally.
+
+UPDATING POLICIES
+
+This section is only relevant if you’re running release 1.9.0 and planning to upgrade to release 2.0.0.
+
+Release 1.10 removed the `k8s.nginx.org/v1alpha1 version` of the Policy resource and introduced the `k8s.nginx.org/v1` version. This means that to upgrade to release 1.10 users had to re-create v1alpha1 Policies with the v1 version, which caused downtime for their applications. Release 2.0.0 brings back the support for the v1alpha1 Policy, which makes it possible to upgrade from 1.9.0 to 2.0.0 release without causing downtime:
+
+- If the Policy is marked as a preview feature in the [documentation]({{< ref "/nic/configuration/policy-resource.md" >}}), make sure the -enable-preview-policies command-line argument is set in 2.0.0 Ingress Controller.
+- During the upgrade, the existing Policies will not be removed.
+- After the upgrade, make sure to update the Policy manifests to k8s.nginx.org/v1 version.
+
+Please also read the [release 1.10 changelog](#1100) for the instructions on how to update Secret resources, which is also necessary since some of the Policies reference Secrets.
+
+Note that 2.1.0 will remove support for the v1alpha1 version of the Policy.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and which passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.19-1.22.
+
+<hr>
+
+## 1.12.1
+
+8 September 2021
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX App Protect version to 3.5.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.12.1 image from our DockerHub: `nginx/nginx-ingress:1.12.1`, `nginx/nginx-ingress:1.12.1-alpine` or `nginx/nginx-ingress:1.12.1-ubi`
+- For NGINX Plus, use the 1.12.1 image from the F5 Container Registry - see [the documentation here]({{< ref "/nic/installation/nic-images/get-registry-image.md">}})
+- Alternatively, you can also build your own image using the 1.12.1 source code.
+- For Helm, use version 0.10.1 of the chart.
+
+<hr>
+
+## 1.12.0
+
+30 June 2021
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 1.12.0 includes:
+
+- The introduction of pre-built containers for advanced capabilities with NGINX Plus through the F5 Container Registry.
+- TransportServer supports TCP/UDP connections through the NGINX streams module adding support for matching specific health check response patterns for granular availability testing of your application, maximum connections to protect your applications from overload, supporting fine tuning of load balancing behavior, and snippets for advanced capability support as soon as you are ready to implement.
+- Availability through the AWS Container marketplace supporting Elastic Kubernetes Service.
+- NGINX App Protect capabilities have been extended to support the latest version and its capabilities.
+
+You will find the complete changelog for release 1.12.0, including bug fixes, improvements, and changes below.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [1633](https://github.com/nginx/kubernetes-ingress/pull/1633) Support match in TransportServer health checks.
+- [1619](https://github.com/nginx/kubernetes-ingress/pull/1619) Add AWS Marketplace Entitlement verification.
+- [1480](https://github.com/nginx/kubernetes-ingress/pull/1480) Add max connections to TransportServer.
+- [1479](https://github.com/nginx/kubernetes-ingress/pull/1479) Add load balancing method to TransportServer.
+- [1466](https://github.com/nginx/kubernetes-ingress/pull/1466) Support snippets in TransportServer.
+- [1578](https://github.com/nginx/kubernetes-ingress/pull/1578) Add support for CSRF protection in APPolicy.
+- [1513](https://github.com/nginx/kubernetes-ingress/pull/1513) Support multiple log security configs in Ingresses.
+- [1481](https://github.com/nginx/kubernetes-ingress/pull/1481) Add support for user defined browsers in APPolicy.
+- [1411](https://github.com/nginx/kubernetes-ingress/pull/1411) Add unary gRPC support in APPolicy.
+- [1671](https://github.com/nginx/kubernetes-ingress/pull/1671) Simplify Dockerfile stages for Debian.
+- [1652](https://github.com/nginx/kubernetes-ingress/pull/1652) Add HTTPS option to Prometheus endpoint.
+- [1646](https://github.com/nginx/kubernetes-ingress/pull/1646) Improve Dockerfile.
+- [1574](https://github.com/nginx/kubernetes-ingress/pull/1574) Add Docker image for Alpine with NGINX Plus.
+- [1512](https://github.com/nginx/kubernetes-ingress/pull/1512) Don't require default server TLS secret.
+- [1500](https://github.com/nginx/kubernetes-ingress/pull/1500) Support ssl_reject_handshake in Ingress and VS.
+- [1494](https://github.com/nginx/kubernetes-ingress/pull/1494) Add logs around NGINX Plus binary/flag mismatch.
+- [1492](https://github.com/nginx/kubernetes-ingress/pull/1492) Update the IC so that GlobalConfiguration is not mandatory when configured.
+- [1500](https://github.com/nginx/kubernetes-ingress/pull/1500) Support ssl_reject_handshake in Ingress and VS. Previously, to handle missing or invalid TLS Secrets in Ingress and VirtualServer resources, the Ingress Controller would configure NGINX to break any attempts for clients to establish TLS connections to the affected hosts using `ssl_ciphers NULL;` in the NGINX configuration. The method didn't work for TLS v1.3. Now the Ingress Controller uses `ssl_reject_handshake on;`, which works for TLS v1.3.
+- Documentation improvements: [1649](https://github.com/nginx/kubernetes-ingress/pull/1649).
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [1658](https://github.com/nginx/kubernetes-ingress/pull/1658) Add missing njs module to the openshift-image-nap-plus image.
+- [1654](https://github.com/nginx/kubernetes-ingress/pull/1654) Fix incorrect configuration and unexpected warnings about Secrets at the IC start.
+- [1501](https://github.com/nginx/kubernetes-ingress/pull/1501) Fix ungraceful shutdown of NGINX.
+- Documentation fixes: [1668](https://github.com/nginx/kubernetes-ingress/pull/1668), [1594](https://github.com/nginx/kubernetes-ingress/pull/1594) thanks to [shaggy245](https://github.com/shaggy245), [1563](https://github.com/nginx/kubernetes-ingress/pull/1563), [1551](https://github.com/nginx/kubernetes-ingress/pull/1551).
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- Add new parameters to the Chart: `prometheus.scheme`, `prometheus.secret`. Added in [1652](https://github.com/nginx/kubernetes-ingress/pull/1652).
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [1604](https://github.com/nginx/kubernetes-ingress/pull/1604) Update NGINX Plus to R24. Previously, the Dockerfile had a fixed NGINX Plus version. Now the Dockerfile has a floating version that corresponds to the latest major NGINX Plus version. In the event of a patch version of NGINX Plus being released, make sure to rebuild your image to get the latest version (previously, we released a new Ingress Controller release in that case). Additionally, the AppProtect related packages are no longer fixed -- the Dockerfile will always install the latest version of the packages that work with the latest NGINX Plus version.
+- Update NGINX version to 1.21.0.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.12.0 image from our DockerHub: `nginx/nginx-ingress:1.12.0`, `nginx/nginx-ingress:1.12.0-alpine` or `nginx-ingress:1.12.0-ubi`
+- For NGINX Plus, please build your own image using the 1.12.0 source code.
+- For Helm, use version 0.10.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and which passes the Kubernetes conformance tests.  This release was fully tested on the following Kubernetes versions: 1.16-1.21.
+
+<hr>
+
+## 1.11.3
+
+25 May 2021
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.21.0.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.11.3 image from our DockerHub: `nginx/nginx-ingress:1.11.3`, `nginx/nginx-ingress:1.11.3-alpine` or `nginx/nginx-ingress:1.11.3-ubi`
+- For NGINX Plus, please build your own image using the 1.11.3 source code.
+- For Helm, use version 0.9.3 of the chart.
+
+<hr>
+
+## 1.11.2
+
+19 May 2021
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX Plus version to R23 P1.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.11.2 image from our DockerHub: `nginx/nginx-ingress:1.11.2`, `nginx/nginx-ingress:1.11.2-alpine` or `nginx/nginx-ingress:1.11.2-ubi`
+- For NGINX Plus, please build your own image using the 1.11.2 source code.
+- For Helm, use version 0.9.2 of the chart.
+
+<hr>
+
+## 1.11.1
+
+7 April 2021
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.19.9.
+- Update the OpenSSL libraries used in the UBI images
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.11.1 image from our DockerHub: `nginx/nginx-ingress:1.11.1`, `nginx/nginx-ingress:1.11.1-alpine` or `nginx/nginx-ingress:1.11.1-ubi`
+- For NGINX Plus, please build your own image using the 1.11.1 source code.
+- For Helm, use version 0.9.1 of the chart.
+
+<hr>
+
+## 1.11.0
+
+31 March 2021
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 1.11.0 includes:
+
+- Native NGINX Ingress Controller App Protect (WAF) policy
+- TransportServer improvements in terms of reliability, added features and operational aspects
+- Integration of NGINX Ingress Controller with Istio service mesh
+
+You will find the complete changelog for release 1.11.0, including bug fixes, improvements, and changes below.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [1317](https://github.com/nginx/kubernetes-ingress/pull/1317) Add status field to Policy resource.
+- [1449](https://github.com/nginx/kubernetes-ingress/pull/1449) Add support for ClusterIP in upstreams in VirtualServers/VirtualServerRoutes.
+- [1413](https://github.com/nginx/kubernetes-ingress/pull/1413) Add serverSnippets to TransportServer.
+- [1425](https://github.com/nginx/kubernetes-ingress/pull/1425) Add status field to TransportServer resource.
+- [1384](https://github.com/nginx/kubernetes-ingress/pull/1384) Add active health checks to TransportServer.
+- [1382](https://github.com/nginx/kubernetes-ingress/pull/1382) Add passive health checks to TransportServer.
+- [1346](https://github.com/nginx/kubernetes-ingress/pull/1346) Add configurable timeouts to TransportServer.
+- [1297](https://github.com/nginx/kubernetes-ingress/pull/1297) Support custom return in the default server. Thanks to [030](https://github.com/030).
+- [1378](https://github.com/nginx/kubernetes-ingress/pull/1378) Add WAF Policy.
+- [1420](https://github.com/nginx/kubernetes-ingress/pull/1420) Support IngressClassName in TransportServer.
+- [1415](https://github.com/nginx/kubernetes-ingress/pull/1415) Handle host and listener collisions for TransportServer resource.
+- [1322](https://github.com/nginx/kubernetes-ingress/pull/1322) Improve VirtualServer/VirtualServerRoute warnings for Policies.
+- [1288](https://github.com/nginx/kubernetes-ingress/pull/1288) Add stricter validation for some ingress annotations.
+- [1241](https://github.com/nginx/kubernetes-ingress/pull/1241) Refactor Dockerfile and Makefile.
+- Documentation improvements: [1320](https://github.com/nginx/kubernetes-ingress/pull/1320), [1326](https://github.com/nginx/kubernetes-ingress/pull/1326), and [1377](https://github.com/nginx/kubernetes-ingress/pull/1377).
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [1457](https://github.com/nginx/kubernetes-ingress/pull/1457) Wait for caches to sync when the Ingress Controller starts.
+- [1444](https://github.com/nginx/kubernetes-ingress/pull/1444) Fix setting host header in action proxy in VirtualServer/VirtualServerRoute.
+- [1396](https://github.com/nginx/kubernetes-ingress/pull/1396) Fix reload timeout calculation for verifying NGINX reloads.
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [1455](https://github.com/nginx/kubernetes-ingress/pull/1455) Update NGINX version to 1.19.8.
+- [1428](https://github.com/nginx/kubernetes-ingress/pull/1428) Update Nginx App Protect version to 3.0. **Note**:  [The Advanced gRPC Protection for Unary Traffic](/nginx-app-protect/configuration/#advanced-grpc-protection-for-unary-traffic) is not currently supported.
+
+### <i class="fa-solid fa-bug"></i> Known Issues
+
+- [1448](https://github.com/nginx/kubernetes-ingress/issues/1448) When an Ingress Controller pod starts, it can report warnings about missing secrets for Ingress and other resources that reference secrets. Those warnings are intermittent - once the Ingress Controller fully processes the resources of the cluster, it will clear the warnings. Only after that, the Ingress Controller will become ready to accept client traffic - its readiness probe will succeed.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.11.0 image from our DockerHub: `nginx/nginx-ingress:1.11.0`, `nginx/nginx-ingress:1.11.0-alpine` or `nginx-ingress:1.11.0-ubi`
+- For NGINX Plus, please build your own image using the 1.11.0 source code.
+- For Helm, use version 0.9.0 of the chart.
+- [1241](https://github.com/nginx/kubernetes-ingress/pull/1241) improved the Makefile. As a result, the commands for building the Ingress Controller image were changed. See the updated commands [here]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}).
+- [1241](https://github.com/nginx/kubernetes-ingress/pull/1241) also consolidated all Dockerfiles into a single Dockerfile. If you customized any of the Dockerfiles, make sure to port the changes to the new Dockerfile.
+- [1288](https://github.com/nginx/kubernetes-ingress/pull/1288) further improved validation of Ingress annotations. See this [document]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#validation" >}}) to learn more about which annotations are validated. Note that the Ingress Controller will reject resources with invalid annotations, which means clients will see `404` responses from NGINX.  Before upgrading, ensure the Ingress resources don't have annotations with invalid values. Otherwise, after the upgrade, the Ingress Controller will reject such resources.
+- [1457](https://github.com/nginx/kubernetes-ingress/pull/1457) fixed the bug when an Ingress Controller pod could become ready before it generated the configuration for all relevant resources in the cluster. The fix also requires that the Ingress Controller can successfully list the relevant resources from the Kubernetes API. For example, if the `-enable-custom-resources` cli argument is `true` (which is the default), the VirtualServer, VirtualServerRoute, TransportServer, and Policy CRDs must be created in the cluster, so that the Ingress Controller can list them. This is similar to other custom resources -- see the list [here]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md#create-custom-resources" >}}). Thus, before upgrading, make sure that the CRDs are created in the cluster. Otherwise, the Ingress Controller pods will not become ready.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and which passes the Kubernetes conformance tests.  This release was fully tested on the following Kubernetes versions: 1.16-1.20.
+
+<hr>
+
+## 1.10.1
+
+16 March 2021
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.19.8.
+- Add Kubernetes 1.20 support.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [1373](https://github.com/nginx/kubernetes-ingress/pull/1373), [1439](https://github.com/nginx/kubernetes-ingress/pull/1439), [1440](https://github.com/nginx/kubernetes-ingress/pull/1440): Fix various issues in the Makefile. In 1.10.0, a bug was introduced that prevented building Ingress Controller images on versions of make < 4.1.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.10.1 image from our DockerHub: `nginx/nginx-ingress:1.10.1`, `nginx/nginx-ingress:1.10.1-alpine` or `nginx/nginx-ingress:1.10.1-ubi`
+- For NGINX Plus, please build your own image using the 1.10.1 source code.
+- For Helm, use version 0.8.1 of the chart.
+
+<hr>
+
+## 1.10.0
+
+26 January 2021
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 1.10.0 includes:
+
+- Open ID Connect authentication policy.
+- Improved handling of Secret resources with extended validation and error reporting.
+- Improved visibility with Prometheus metrics for the configuration workqueue and the ability to annotate NGINX logs with the metadata of Kubernetes resources.
+- NGINX App Protect User-Defined signatures support.
+- Improved validation of Ingress annotations.
+
+You will find the complete changelog for release 1.10.0, including bug fixes, improvements, and changes below.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [1304](https://github.com/nginx/kubernetes-ingress/pull/1304) Add Open ID Connect policy.
+- [1281](https://github.com/nginx/kubernetes-ingress/pull/1281) Add support for App Protect User Defined Signatures.
+- [1266](https://github.com/nginx/kubernetes-ingress/pull/1266) Add workqueue metrics to Prometheus metrics.
+- [1233](https://github.com/nginx/kubernetes-ingress/pull/1233) Annotate tcp metrics with k8s object labels.
+- [1231](https://github.com/nginx/kubernetes-ingress/pull/1231) Support k8s objects variables in log format.
+- [1270](https://github.com/nginx/kubernetes-ingress/pull/1270) and [1277](https://github.com/nginx/kubernetes-ingress/pull/1277) Improve validation of Ingress annotations.
+- [1265](https://github.com/nginx/kubernetes-ingress/pull/1265) Report warnings for misconfigured TLS and JWK secrets.
+- [1262](https://github.com/nginx/kubernetes-ingress/pull/1262) Use setcap(8) only once. [1263](https://github.com/nginx/kubernetes-ingress/pull/1263) Use chown(8) only once. [1264](https://github.com/nginx/kubernetes-ingress/pull/1264) Use mkdir(1) only once. Thanks to [Sergey A. Osokin](https://github.com/osokin).
+- [1256](https://github.com/nginx/kubernetes-ingress/pull/1256) and [1260](https://github.com/nginx/kubernetes-ingress/pull/1260) Improve handling of secret resources.
+- [1240](https://github.com/nginx/kubernetes-ingress/pull/1240) Validate TLS and CA secrets.
+- [1235](https://github.com/nginx/kubernetes-ingress/pull/1235) Use buildkit secret flag for NGINX plus images.
+- [1290](https://github.com/nginx/kubernetes-ingress/pull/1290) Graduate policy resource and accessControl policy to generally available.
+- [1225](https://github.com/nginx/kubernetes-ingress/pull/1225) Require secrets to have types.
+- [1237](https://github.com/nginx/kubernetes-ingress/pull/1237) Deprecate support for helm2 clients.
+- Documentation improvements: [1282](https://github.com/nginx/kubernetes-ingress/pull/1282), [1293](https://github.com/nginx/kubernetes-ingress/pull/1293), [1303](https://github.com/nginx/kubernetes-ingress/pull/1303), [1315](https://github.com/nginx/kubernetes-ingress/pull/1315).
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [1290](https://github.com/nginx/kubernetes-ingress/pull/1290) Add new preview policies parameter to chart. `controller.enablePreviewPolicies` was added.
+- [1232](https://github.com/nginx/kubernetes-ingress/pull/1232) Replace deprecated imagePullSecrets helm setting. `controller.serviceAccount.imagePullSecrets` was removed. `controller.serviceAccount.imagePullSecretName` was added.
+- [1228](https://github.com/nginx/kubernetes-ingress/pull/1228) Fix installation of ingressclass on Kubernetes versions `v1.18.x-*`
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [1299](https://github.com/nginx/kubernetes-ingress/pull/1299) Update NGINX App Protect version to 2.3 and debian distribution to `debian:buster-slim`.
+- [1291](https://github.com/nginx/kubernetes-ingress/pull/1291) Update NGINX OSS to `1.19.6`. Update NGINX Plus to `R23`.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.10.0 image from our DockerHub: `nginx/nginx-ingress:1.10.0`, `nginx/nginx-ingress:1.10.0-alpine` or `nginx-ingress:1.10.0-ubi`
+- For NGINX Plus, please build your own image using the 1.10.0 source code.
+- For Helm, use version 0.8.0 of the chart.
+- As a result of [1270](https://github.com/nginx/kubernetes-ingress/pull/1270) and [1277](https://github.com/nginx/kubernetes-ingress/pull/1277), the Ingress Controller improved validation of Ingress annotations: more annotations are validated and validation errors are reported via events for Ingress resources. Additionally, the default behavior for invalid annotation values was changed: instead of using the default values, the Ingress Controller will reject a resource with an invalid annotation value, which will make clients see `404` responses from NGINX. See this [document]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#validation" >}}) to learn more. Before upgrading, ensure the Ingress resources don't have annotations with invalid values. Otherwise, after the upgrade, the Ingress Controller will reject such resources.
+- In [1232](https://github.com/nginx/kubernetes-ingress/pull/1232) `controller.serviceAccount.imagePullSecrets` was removed. Use the new `controller.serviceAccount.imagePullSecretName` instead.
+- The Policy resource was promoted to `v1`. If you used the `alpha1` version, the policies are needed to be recreated with the `v1` version. Before upgrading the Ingress Controller, run the following command to remove the `alpha1` policies CRD (that will also remove all existing `alpha1` policies):
+
+    ```console
+     kubectl delete crd policies.k8s.nginx.org
+    ```
+
+  As part of the upgrade, make sure to create the `v1` policies CRD. See the corresponding instructions for [Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md#create-custom-resources" >}}) and [Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md#upgrading-the-crds" >}}) installations.
+
+  Also note that all policies except for `accessControl` are still in preview. To enable them, run the Ingress Controller with `- -enable-preview-policies` command-line argument (`controller.enablePreviewPolicies` Helm parameter).
+- It is necessary to update secret resources. See the section UPDATING SECRETS below.
+
+UPDATING SECRETS:
+
+In [1225](https://github.com/nginx/kubernetes-ingress/pull/1225), as part of improving how the Ingress Controller handles secret resources, we added a requirement for secrets to be of one of the following types:
+
+- `kubernetes.io/tls` for TLS secrets.
+- `nginx.org/jwk` for JWK secrets.
+- `nginx.org/ca` for CA secrets.
+
+The Ingress Controller now ignores secrets that are not of a supported type. As a consequence, special upgrade steps are required.
+
+Before upgrading, ensure that the secrets referenced in Ingress, VirtualServer or Policies resources are of a supported type, which is configured via the `type` field. Because that field is immutable, it is necessary to either:
+
+- Recreate the secrets. Note that in this case, the client traffic for the affected resources will be rejected for the period during which a secret doesn't exist in the cluster.
+- Create copies of the secrets and update the affected resources to reference the copies. The copies need to be of a supported type. In contrast with the previous options, this will not make NGINX reject the client traffic.
+
+It is also necessary to update the default server secret and the wildcard secret (if it was configured) in case their type is not `kubernetes.io/tls`. The steps depend on how you installed the Ingress Controller: via manifests or Helm. Performing the steps will not lead to a disruption of the client traffic, as the Ingress Controller retains the default and wildcard secrets if they are removed.
+
+For *manifests installation*:
+
+1. Recreate the default server secret and the wildcard secret with the type `kubernetes.io/tls`.
+1. Upgrade the Ingress Controller.
+
+For *Helm installation*, there two cases:
+
+1. If Helm created the secrets (you configured `controller.defaultTLS.cert` and `controller.defaultTLS.key` for the default secret and `controller.wildcardTLS.cert` and `controller.wildcardTLS.key` for the wildcard secret), then no special upgrade steps are required: during the upgrade, the Helm will remove the existing default and wildcard secrets and create new ones with different names with the type `kubernetes.io/tls`.
+1. If you created the secrets separately from Helm (you configured `controller.defaultTLS.secret` for the default secret and `controller.wildcardTLS.secret` for the wildcard secret):
+    1. Recreate the secrets with the type `kubernetes.io/tls`.
+    1. Upgrade to the new Helm release.
+
+NOTES:
+
+- Helm 2 clients are no longer supported due to reaching End of Life: <https://helm.sh/blog/helm-2-becomes-unsupported/>
+
+<hr>
+
+## 1.9.1
+
+23 November 2020
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update the base ubi images to 8.3.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- Fix deployment of ingressclass resource via helm on some versions of Kubernetes.
+- Renew CA cert for egress-mtls example.
+- Add imagePullSecretName support to helm chart.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.9.1 image from our DockerHub: `nginx/nginx-ingress:1.9.1`, `nginx/nginx-ingress:1.9.1-alpine` or `nginx/nginx-ingress:1.9.1-ubi`
+- For NGINX Plus, please build your own image using the 1.9.1 source code.
+- For Helm, use version 0.7.1 of the chart.
+
+<hr>
+
+## 1.9.0
+
+20 October 2020
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 1.9.0 includes:
+
+- Support for new Prometheus metrics and enhancements of the existing ones, including configuration reload reason, NGINX worker processes count, upstream latency, and more.
+- Support for rate limiting, JWT authentication, ingress(client) and egress(upstream) mutual TLS via the Policy resource.
+- Support for the latest Ingress resource features and the IngressClass resource.
+- Support for NGINX Service Mesh.
+
+You will find the complete changelog for release 1.9.0, including bug fixes, improvements, and changes below.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [1180](https://github.com/nginx/kubernetes-ingress/pull/1180) Add support for EgressMTLS.
+- [1166](https://github.com/nginx/kubernetes-ingress/pull/1166) Add IngressMTLS policy support.
+- [1154](https://github.com/nginx/kubernetes-ingress/pull/1154) Add JWT policy support.
+- [1120](https://github.com/nginx/kubernetes-ingress/pull/1120) Add RateLimit policy support.
+- [1058](https://github.com/nginx/kubernetes-ingress/pull/1058) Support policies in VS routes and VSR subroutes.
+- [1147](https://github.com/nginx/kubernetes-ingress/pull/1147) Add option to specify other log destinations in AppProtect.
+- [1131](https://github.com/nginx/kubernetes-ingress/pull/1131) Update packages and CRDs to AppProtect 2.0. This update includes features such as: [JSON Schema Validation](https://docs.nginx.com/nginx-app-protect/configuration#applying-a-json-schema), [User-Defined URLs](https://docs.nginx.com/nginx-app-protect/configuration/#user-defined-urls) and [User-Defined Parameters](https://docs.nginx.com/nginx-app-protect/configuration/#user-defined-parameters). See the [release notes](https://docs.nginx.com/nginx-app-protect/releases/#release-2-0) for a complete feature list.
+- [1100](https://github.com/nginx/kubernetes-ingress/pull/1100) Add external references to AppProtect.
+- [1085](https://github.com/nginx/kubernetes-ingress/pull/1085) Add installation of threat campaigns package.
+- [1133](https://github.com/nginx/kubernetes-ingress/pull/1133) Add support for IngressClass resources.
+- [1130](https://github.com/nginx/kubernetes-ingress/pull/1130) Add prometheus latency collector.
+- [1076](https://github.com/nginx/kubernetes-ingress/pull/1076) Add prometheus worker process metrics.
+- [1075](https://github.com/nginx/kubernetes-ingress/pull/1075) Add support for NGINX Service Mesh internal routes.
+- [1178](https://github.com/nginx/kubernetes-ingress/pull/1178) Resolve host collisions in VirtualServer and Ingresses.
+- [1158](https://github.com/nginx/kubernetes-ingress/pull/1158) Support variables in action proxy headers.
+- [1137](https://github.com/nginx/kubernetes-ingress/pull/1137) Add pod_owner label to metrics when -spire-agent-address is set.
+- [1107](https://github.com/nginx/kubernetes-ingress/pull/1107) Extend Upstream Servers with pod_name label.
+- [1099](https://github.com/nginx/kubernetes-ingress/pull/1099) Add reason label to total_reload metrics.
+- [1088](https://github.com/nginx/kubernetes-ingress/pull/1088) Extend Upstream Servers and Server Zones metrics, thanks to [Raúl](https://github.com/Rulox).
+- [1080](https://github.com/nginx/kubernetes-ingress/pull/1080) Support pathType field in the Ingress resource.
+- [1078](https://github.com/nginx/kubernetes-ingress/pull/1078) Remove trailing blank lines in vs/vsr snippets.
+- Documentation improvements: [1083](https://github.com/nginx/kubernetes-ingress/pull/1083), [1092](https://github.com/nginx/kubernetes-ingress/pull/1092), [1089](https://github.com/nginx/kubernetes-ingress/pull/1089), [1174](https://github.com/nginx/kubernetes-ingress/pull/1174), [1175](https://github.com/nginx/kubernetes-ingress/pull/1175), [1171](https://github.com/nginx/kubernetes-ingress/pull/1171).
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [1179](https://github.com/nginx/kubernetes-ingress/pull/1179) Fix TransportServers in debian AppProtect image.
+- [1129](https://github.com/nginx/kubernetes-ingress/pull/1129) Support real-ip in default server.
+- [1110](https://github.com/nginx/kubernetes-ingress/pull/1110) Add missing threat campaigns key to AppProtect CRD.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- [1105](https://github.com/nginx/kubernetes-ingress/pull/1105) Fix GlobalConfiguration support in helm chart.
+- Add new parameters to the Chart: `controller.setAsDefaultIngress`, `controller.enableLatencyMetrics`. Added in [1133](https://github.com/nginx/kubernetes-ingress/pull/1133) and [1148](https://github.com/nginx/kubernetes-ingress/pull/1148).
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [1182](https://github.com/nginx/kubernetes-ingress/pull/1182) Update NGINX version to 1.19.3.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.9.0 image from our DockerHub: `nginx/nginx-ingress:1.9.0`, `nginx/nginx-ingress:1.9.0-alpine` or `nginx-ingress:1.9.0-ubi`
+- For NGINX Plus, please build your own image using the 1.9.0 source code.
+- For Helm, use version 0.7.0 of the chart.
+
+For Kubernetes >= 1.18, when upgrading using [Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), make sure to update the [ClusterRole](https://github.com/nginx/kubernetes-ingress/blob/v1.9.0/deployments/rbac/rbac.yaml) and create the [IngressClass resource](https://github.com/nginx/kubernetes-ingress/blob/v1.9.0/deployments/common/ingress-class.yaml), which is required for Kubernetes >= 1.18. Otherwise, the Ingress Controller will fail to start. If you run multiple NGINX Ingress Controllers in the cluster, each Ingress Controller must have its own IngressClass resource. As the `-use-ingress-class-only` argument is now ignored (see NOTES), make sure your Ingress resources have the `ingressClassName` field or the `kubernetes.io/ingress.class` annotation set to the name of the IngressClass resource. Otherwise, the Ingress Controller will ignore them.
+
+#### Helm Upgrade
+
+- If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after you run the `helm upgrade` command, the CRDs will not be upgraded. After running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
+- For Kubernetes >= 1.18, a dedicated IngressClass resource, which is configured by `controller.ingressClass`, is required per helm release. Ensure `controller.ingressClass` is not set to the name of the IngressClass of other releases or Ingress Controllers. As the `controller.useIngressClassOnly` parameter is now ignored (see NOTES), make sure your Ingress resources have the `ingressClassName` field or the `kubernetes.io/ingress.class` annotation set to the value of `controller.ingressClass`. Otherwise, the Ingress Controller will ignore them.
+
+### Notes
+
+- When using Kubernetes >= 1.18, the `-use-ingress-class-only` command-line argument is now ignored, and the Ingress Controller will only process resources that belong to its class. See [IngressClass doc]({{< ref "/nic/installation/run-multiple-ingress-controllers.md#ingress-class" >}}) for more details.
+- For Kubernetes >= 1.18, a dedicated IngressClass resource, which is configured by `controller.ingressClass`, is required per helm release. When upgrading or installing releases, ensure `controller.ingressClass` is not set to the name of the IngressClass of other releases or Ingress Controllers.
+
+<hr>
+
+## 1.8.1
+
+14 August 2020
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.19.2.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.8.1 image from our DockerHub: `nginx/nginx-ingress:1.8.1`, `nginx/nginx-ingress:1.8.1-alpine` or `nginx/nginx-ingress:1.8.1-ubi`
+- For NGINX Plus, please build your own image using the 1.8.1 source code.
+- For Helm, use version 0.6.1 of the chart.
+
+<hr>
+
+## 1.8.0
+
+22 July 2020
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 1.8.0 includes:
+
+- Support for NGINX App Protect Web Application Firewall.
+- Support for configuration snippets and custom template for VirtualServer and VirtualServerRoute resources.
+- Support for request/response header manipulation and request URI rewriting for VirtualServer/VirtualServerRoute.
+- Introducing a new configuration resource - Policy - with the first policy for IP-based access control.
+
+You will find the complete changelog for release 1.8.0, including bug fixes, improvements, and changes below.
+
+FEATURES FOR VIRTUALSERVER AND VIRTUALSERVERROUTE RESOURCES:
+
+- [1036](https://github.com/nginx/kubernetes-ingress/pull/1036): Add VirtualServer custom template support.
+- [1028](https://github.com/nginx/kubernetes-ingress/pull/1028): Add access control policy.
+- [1019](https://github.com/nginx/kubernetes-ingress/pull/1019): Add VirtualServer/VirtualServerRoute snippets support.
+- [1006](https://github.com/nginx/kubernetes-ingress/pull/1006): Add request/response modifiers to VS and VSR.
+- [994](https://github.com/nginx/kubernetes-ingress/pull/994): Support Class Field in VS/VSR.
+- [973](https://github.com/nginx/kubernetes-ingress/pull/973): Add status to VirtualServer and VirtualServerRoute.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [1035](https://github.com/nginx/kubernetes-ingress/pull/1035): Support for App Protect module.
+- [1029](https://github.com/nginx/kubernetes-ingress/pull/1029): Add readiness endpoint.
+- [995](https://github.com/nginx/kubernetes-ingress/pull/995): Emit event for orphaned VirtualServerRoutes.
+- [1029](https://github.com/nginx/kubernetes-ingress/pull/1029): Add readiness endpoint. The Ingress Controller now exposes a readiness endpoint on port `8081` and the path `/nginx-ready`. The endpoint returns a `200` response after the Ingress Controller finishes the initial configuration of NGINX at the start. The pod template was updated to use that endpoint in a readiness probe.
+- [980](https://github.com/nginx/kubernetes-ingress/pull/980): Enable leader election by default.
+- Documentation improvements: [946](https://github.com/nginx/kubernetes-ingress/pull/946) thanks to [谭九鼎](https://github.com/imba-tjd), [948](https://github.com/nginx/kubernetes-ingress/pull/948), [972](https://github.com/nginx/kubernetes-ingress/pull/972), [965](https://github.com/nginx/kubernetes-ingress/pull/965).
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [1030](https://github.com/nginx/kubernetes-ingress/pull/1030): Fix port range validation in cli arguments.
+- [953](https://github.com/nginx/kubernetes-ingress/pull/953): Fix error logging of master/minion ingresses.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- Add new parameters to the Chart: `controller.appprotect.enable`, `controller.globalConfiguration.create`, `controller.globalConfiguration.spec`, `controller.readyStatus.enable`, `controller.readyStatus.port`, `controller.config.annotations`, `controller.reportIngressStatus.annotations`. Added in  [1035](https://github.com/nginx/kubernetes-ingress/pull/1035), [1034](https://github.com/nginx/kubernetes-ingress/pull/1034), [1029](https://github.com/nginx/kubernetes-ingress/pull/1029), [1003](https://github.com/nginx/kubernetes-ingress/pull/1003) thanks to [RubyLangdon](https://github.com/RubyLangdon).
+- [1047](https://github.com/nginx/kubernetes-ingress/pull/1047) and [1009](https://github.com/nginx/kubernetes-ingress/pull/1009): Change how Helm manages the custom resource definitions (CRDs) to support installing multiple Ingress Controller releases. **Note**: If you're using the custom resources (`controller.enableCustomResources` is set to `true`), this is a breaking change. See the HELM UPGRADE section below for the upgrade instructions.
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.19.1.
+- Update NGINX Plus to R22.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.8.0 image from our DockerHub: `nginx/nginx-ingress:1.8.0`, `nginx/nginx-ingress:1.8.0-alpine` or `nginx-ingress:1.8.0-ubi`
+- For NGINX Plus, please build your own image using the 1.8.0 source code.
+- For Helm, use version 0.6.0 of the chart.
+
+#### Helm Upgrade
+
+If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after you run the `helm upgrade` command, the CRDs and the corresponding custom resources will be removed from the cluster. Before upgrading, make sure to back up the custom resources. After running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to re-install the CRDs and then restore the custom resources.
+
+### Notes
+
+- As part of installing a release, Helm will install the CRDs unless that step is disabled (see the [corresponding doc]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}). The installed CRDs include the CRDs for all Ingress Controller features, including the ones disabled by default (like App Protect with `aplogconfs.appprotect.f5.com` and `appolicies.appprotect.f5.com` CRDs).
+
+<hr>
+
+## 1.7.2
+
+23 June 2020
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX Plus version to R22.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.7.2 image from our DockerHub: `nginx/nginx-ingress:1.7.2`, `nginx/nginx-ingress:1.7.2-alpine` or `nginx/nginx-ingress:1.7.2-ubi`
+- For NGINX Plus, please build your own image using the 1.7.2 source code.
+- For Helm, use version 0.5.2 of the chart.
+
+<hr>
+
+## 1.7.1
+
+4 June 2020
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.19.0.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.7.1 image from our DockerHub: `nginx/nginx-ingress:1.7.1`, `nginx/nginx-ingress:1.7.1-alpine` or `nginx/nginx-ingress:1.7.1-ubi`
+- For NGINX Plus, please build your own image using the 1.7.1 source code.
+- For Helm, use version 0.5.1 of the chart.
+
+<hr>
+
+## 1.7.0
+
+30 April 2020
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 1.7.0 includes:
+
+- Support for TCP, UDP, and TLS Passthrough load balancing with the new configuration resources: TransportServer and GlobalConfiguration. The resources allow users to deliver complex, non-HTTP-based applications from Kubernetes using NGINX Ingress Controller.
+- Support for error pages in VirtualServer and VirtualServerRoute resources. A user can now specify custom error responses for errors returned by backend applications or generated by NGINX, such as a 502 response.
+- Improved validation of VirtualServer and VirtualServerRoute resources. kubectl and the Kubernetes API server can now detect violations of the structure of VirtualServer/VirtualServerRoute resources and return an error.
+- Support for an operator which manages the lifecycle of the Ingress Controller on Kubernetes or OpenShift. See the [NGINX Ingress Operator GitHub repo](https://github.com/nginxinc/nginx-ingress-operator).
+
+See the [1.7.0 release announcement blog post](https://www.nginx.com/blog/announcing-nginx-ingress-controller-for-kubernetes-release-1-7-0/), which includes an overview of each feature.
+
+You will find the complete changelog for release 1.7.0, including bug fixes, improvements, and changes below.
+
+FEATURES FOR VIRTUALSERVER AND VIRTUALSERVERROUTE RESOURCES:
+
+- [868](https://github.com/nginx/kubernetes-ingress/pull/868): Add OpenAPI CRD schema validation.
+- [847](https://github.com/nginx/kubernetes-ingress/pull/847): Add support for error pages for VS/VSR.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [902](https://github.com/nginx/kubernetes-ingress/pull/902): Add TransportServer and GlobalConfiguration Resources.
+- [894](https://github.com/nginx/kubernetes-ingress/pull/894): Add Dockerfile for NGINX Open Source for Openshift.
+- [857](https://github.com/nginx/kubernetes-ingress/pull/857): Add Openshift Dockerfile for NGINX Plus.
+- [852](https://github.com/nginx/kubernetes-ingress/pull/852): Add default-server-access-log-off to configmap.
+- [845](https://github.com/nginx/kubernetes-ingress/pull/845): Add log-format-escaping and stream-log-format-escaping configmap keys. Thanks to [Alexey Maslov](https://github.com/alxmsl).
+- [827](https://github.com/nginx/kubernetes-ingress/pull/827): Add ingress class label to all Prometheus metrics.
+- [850](https://github.com/nginx/kubernetes-ingress/pull/850): Extend redirect URI validation with protocol check in VS/VSR.
+- [832](https://github.com/nginx/kubernetes-ingress/pull/832): Update the examples to run the `nginxdemos/nginx-hello:plain-text` image, that doesn't require root user.
+- [825](https://github.com/nginx/kubernetes-ingress/pull/825): Add multi-stage docker builds.
+- [852](https://github.com/nginx/kubernetes-ingress/pull/852): Add default-server-access-log-off to configmap. The access logs for the default server are now enabled by default.
+- [847](https://github.com/nginx/kubernetes-ingress/pull/847): Add support for error pages for VS/VSR. The PR affects how the Ingress Controller generates configuration for VirtualServer and VirtualServerRoutes. See [this comment](https://github.com/nginx/kubernetes-ingress/pull/847) for more details.
+- [827](https://github.com/nginx/kubernetes-ingress/pull/827): Add ingress class label to all Prometheus metrics. Every Prometheus metric exposed by the Ingress Controller now includes the label `class` with the value of the Ingress Controller class (by default `nginx`),
+- [825](https://github.com/nginx/kubernetes-ingress/pull/825): Add multi-stage docker builds. When building the Ingress Controller image in Docker, we now use a multi-stage docker build.
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [828](https://github.com/nginx/kubernetes-ingress/pull/828): Fix error messages for actions of the type return.
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- Add new parameters to the Chart: `controller.enableTLSPassthrough`, `controller.volumes`, `controller.volumeMounts`, `controller.priorityClassName`. Added in [921](https://github.com/nginx/kubernetes-ingress/pull/921), [878](https://github.com/nginx/kubernetes-ingress/pull/878), [807](https://github.com/nginx/kubernetes-ingress/pull/807) thanks to [Greg Snow](https://github.com/gsnegovskiy).
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.17.10.
+- Update NGINX Plus to R21.
+- [854](https://github.com/nginx/kubernetes-ingress/pull/854): Update the Debian base images for NGINX Plus to `debian:buster-slim`.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.7.0 image from our DockerHub: `nginx/nginx-ingress:1.7.0`, `nginx/nginx-ingress:1.7.0-alpine` or `nginx-ingress:1.7.0-ubi`
+- For NGINX Plus, please build your own image using the 1.7.0 source code.
+- For Helm, use version 0.5.0 of the chart.
+
+When upgrading using the [manifests](/nginx-ingress-controller/installation/installation-with-manifests/), make sure to deploy the new TransportServer CRD (`common/ts-definition.yaml`), as it is required by the Ingress Controller. Otherwise, you will get error messages in the Ingress Controller logs.
+
+<hr>
+
+## 1.6.3
+
+6 March 2020
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.17.9.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.6.3 image from our DockerHub: `nginx/nginx-ingress:1.6.3` or `nginx/nginx-ingress:1.6.3-alpine`
+- For NGINX Plus, please build your own image using the 1.6.3 source code.
+- For Helm, use version 0.4.3 of the chart.
+
+<hr>
+
+## 1.6.2
+
+6 February 2020
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.17.8.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.6.2 image from our DockerHub: `nginx/nginx-ingress:1.6.2` or `nginx/nginx-ingress:1.6.2-alpine`
+- For NGINX Plus, please build your own image using the 1.6.2 source code.
+- For Helm, use version 0.4.2 of the chart.
+
+<hr>
+
+## 1.6.1
+
+14 January 2020
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX version to 1.17.7.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.6.1 image from our DockerHub: `nginx/nginx-ingress:1.6.1` or `nginx/nginx-ingress:1.6.1-alpine`
+- For NGINX Plus, please build your own image using the 1.6.1 source code.
+- For Helm, use version 0.4.1 of the chart.
+
+<hr>
+
+## 1.6.0
+
+19 December 2019
+
+### <i class="fa-solid fa-magnifying-glass"></i> Overview
+
+Release 1.6.0 includes:
+
+- Improvements to VirtualServer and VirtualServerRoute resources, adding support for richer load balancing behavior, more sophisticated request routing, redirects, direct responses, and blue-green and circuit breaker patterns. The VirtualServer and VirtualServerRoute resources are enabled by default and are ready for production use.
+- Support for OpenTracing, helping you to monitor and debug complex transactions.
+- An improved security posture, with support to run the Ingress Controller as a non-root user.
+
+The release announcement blog post includes the overview for each feature. See <https://www.nginx.com/blog/announcing-nginx-ingress-controller-for-kubernetes-release-1-6-0/>
+
+You will find the complete changelog for release 1.6.0, including bug fixes, improvements, and changes below.
+
+FEATURES FOR VIRTUALSERVER AND VIRTUALSERVERROUTE RESOURCES:
+
+- [780](https://github.com/nginx/kubernetes-ingress/pull/780): Add support for canned responses to VS/VSR.
+- [778](https://github.com/nginx/kubernetes-ingress/pull/778): Add redirect support in VS/VSR.
+- [766](https://github.com/nginx/kubernetes-ingress/pull/766): Add exact matches and regex support to location paths in VS/VSR.
+- [748](https://github.com/nginx/kubernetes-ingress/pull/748): Add TLS redirect support in Virtualserver.
+- [745](https://github.com/nginx/kubernetes-ingress/pull/745): Improve routing rules in VS/VSR
+- [728](https://github.com/nginx/kubernetes-ingress/pull/728): Add session persistence in VS/VSR.
+- [724](https://github.com/nginx/kubernetes-ingress/pull/724): Add VS/VSR Prometheus metrics.
+- [712](https://github.com/nginx/kubernetes-ingress/pull/712): Add service subselector support in vs/vsr.
+- [707](https://github.com/nginx/kubernetes-ingress/pull/707): Emit warning events in VS/VSR.
+- [701](https://github.com/nginx/kubernetes-ingress/pull/701): Add support queue in upstreams for plus in VS/VSR.
+- [693](https://github.com/nginx/kubernetes-ingress/pull/693): Add ServerStatusZones support in vs/vsr.
+- [670](https://github.com/nginx/kubernetes-ingress/pull/670): Add buffering support for vs/vsr.
+- [660](https://github.com/nginx/kubernetes-ingress/pull/660): Add ClientBodyMaxSize support in vs/vsr.
+- [659](https://github.com/nginx/kubernetes-ingress/pull/659): Support configuring upstream zone sizes in VS/VSR.
+- [655](https://github.com/nginx/kubernetes-ingress/pull/655): Add slow-start support in vs/vsr.
+- [653](https://github.com/nginx/kubernetes-ingress/pull/653): Add websockets support for vs/vsr upstreams.
+- [641](https://github.com/nginx/kubernetes-ingress/pull/641): Add support for ExternalName Services for vs/vsr.
+- [635](https://github.com/nginx/kubernetes-ingress/pull/635): Add HealthChecks support for vs/vsr.
+- [634](https://github.com/nginx/kubernetes-ingress/pull/634): Add Active Connections support to vs/vsr.
+- [628](https://github.com/nginx/kubernetes-ingress/pull/628): Add retries support for vs/vsr.
+- [621](https://github.com/nginx/kubernetes-ingress/pull/621): Add TLS support for vs/vsr upstreams.
+- [617](https://github.com/nginx/kubernetes-ingress/pull/617): Add keepalive support to vs/vsr.
+- [612](https://github.com/nginx/kubernetes-ingress/pull/612): Add timeouts support to vs/vsr.
+- [607](https://github.com/nginx/kubernetes-ingress/pull/607): Add fail-timeout and max-fails support to vs/vsr.
+- [596](https://github.com/nginx/kubernetes-ingress/pull/596): Add lb-method support in vs and vsr.
+
+### <i class="fa-solid fa-rocket"></i> Features
+
+- [750](https://github.com/nginx/kubernetes-ingress/pull/750): Add support for health status uri customisation.
+- [691](https://github.com/nginx/kubernetes-ingress/pull/691): Helper Functions for custom annotations.
+- [631](https://github.com/nginx/kubernetes-ingress/pull/631): Add max_conns support for NGINX plus.
+- [629](https://github.com/nginx/kubernetes-ingress/pull/629): Added upstream zone directive annotation. Thanks to [Victor Regalado](https://github.com/vrrs).
+- [616](https://github.com/nginx/kubernetes-ingress/pull/616): Add proxy-send-timeout to configmap key and annotation.
+- [615](https://github.com/nginx/kubernetes-ingress/pull/615): Add support for Opentracing.
+- [614](https://github.com/nginx/kubernetes-ingress/pull/614): Add max-conns annotation. Thanks to [Victor Regalado](https://github.com/vrrs).
+- [678](https://github.com/nginx/kubernetes-ingress/pull/678): Increase defaults for server-names-hash-max-size and servers-names-hash-bucket-size ConfigMap keys.
+- [694](https://github.com/nginx/kubernetes-ingress/pull/694): Reject VS/VSR resources with enabled plus features for OSS.
+- [799](https://github.com/nginx/kubernetes-ingress/pull/779): Enable CRDs by default. VirtualServer and VirtualServerRoute resources are now enabled by default.
+- [772](https://github.com/nginx/kubernetes-ingress/pull/772): Update VS/VSR version from v1alpha1 to v1. Make sure to update the `apiVersion` of your VirtualServer and VirtualServerRoute resources.
+- [748](https://github.com/nginx/kubernetes-ingress/pull/748): Add TLS redirect support in VirtualServer. The `redirect-to-https` and `ssl-redirect` ConfigMap keys no longer have any effect on generated configs for VirtualServer resources.
+- [745](https://github.com/nginx/kubernetes-ingress/pull/745): Improve routing rules. Update the spec of VirtualServer and VirtualServerRoute accordingly. See YAML examples of the changes [here](https://github.com/nginx/kubernetes-ingress/pull/745).
+- [710](https://github.com/nginx/kubernetes-ingress/pull/710): Run IC as non-root. Make sure to use the updated manifests to install/upgrade the Ingress Controller.
+- [603](https://github.com/nginx/kubernetes-ingress/pull/603): Update apiVersion in Deployments and DaemonSets to apps/v1.
+- Documentation improvements: [713](https://github.com/nginx/kubernetes-ingress/pull/713) thanks to [Matthew Wahner](https://github.com/mattwahner).
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [788](https://github.com/nginx/kubernetes-ingress/pull/788): Fix VSR updates when namespace is set implicitly.
+- [736](https://github.com/nginx/kubernetes-ingress/pull/736): Init Ingress labeled metrics on start.
+- [686](https://github.com/nginx/kubernetes-ingress/pull/686): Check if config map created for leader-election.
+- [664](https://github.com/nginx/kubernetes-ingress/pull/664): Fix reporting events for Ingress minions.
+- [632](https://github.com/nginx/kubernetes-ingress/pull/632): Fix hsts support when not using SSL. Thanks to [Martín Fernández](https://github.com/bilby91).
+
+### <i class="fa-solid fa-box"></i> Helm Chart
+
+- Add new parameters to the Chart: `controller.healthCheckURI`, `controller.resources`, `controller.logLevel`, `controller.customPorts`, `controller.service.customPorts`. Added in [750](https://github.com/nginx/kubernetes-ingress/pull/750), [636](https://github.com/nginx/kubernetes-ingress/pull/636) thanks to [Guilherme Oki](https://github.com/guilhermeoki), [600](https://github.com/nginx/kubernetes-ingress/pull/600), [581](https://github.com/nginx/kubernetes-ingress/pull/581) thanks to [Alex Meijer](https://github.com/ameijer-corsha).
+- [722](https://github.com/nginx/kubernetes-ingress/pull/722): Fix trailing leader election cm when using helm. This change might lead to a failed upgrade. See the helm upgrade instruction below.
+- [573](https://github.com/nginx/kubernetes-ingress/pull/573): Use Controller name value for app selectors.
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- Update NGINX versions to 1.17.6.
+- Update NGINX Plus version to R20.
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 1.6.0 image from our DockerHub: `nginx/nginx-ingress:1.6.0` or `nginx/nginx-ingress:1.6.0-alpine`
+- For NGINX Plus, please build your own image using the 1.6.0 source code.
+- For Helm, use version 0.4.0 of the chart.
+
+#### Helm upgrade
+
+If leader election (the `controller.reportIngressStatus.enableLeaderElection` parameter) is enabled, when upgrading to the new version of the Helm chart:
+
+1. Make sure to specify a new ConfigMap lock name (`controller.reportIngressStatus.leaderElectionLockName`) different from the one that was created by the current version. To find out the current name, check ConfigMap resources in the namespace where the Ingress Controller is running.
+1. After the upgrade, delete the old ConfigMap.
+
+Otherwise, the helm upgrade will not succeed.
+
+<hr>
+
+## Previous Releases
+
+To see the previous releases, see the [Releases page](https://github.com/nginx/kubernetes-ingress/releases) on the Ingress Controller GitHub repo.
diff --git a/content/nic/technical-specifications.md b/content/nic/technical-specifications.md
new file mode 100644
index 000000000..ad9d5b2e4
--- /dev/null
+++ b/content/nic/technical-specifications.md
@@ -0,0 +1,99 @@
+---
+title: Technical specifications
+toc: true
+weight: 200
+doctype: reference
+product: NIC
+docs: DOCS-617
+---
+
+This page describes technical specifications for F5 NGINX Ingress Controller, such as its version compatibility with Kubernetes and other NGINX software.
+
+---
+
+## Supported NGINX Ingress Controller versions
+
+We recommend using the latest release of NGINX Ingress Controller. We provide software updates for the most recent release. We provide technical support for F5 customers who are using the most recent version of NGINX Ingress Controller, and any version released within two years of the current release.
+We test NGINX Ingress Controller on a range of Kubernetes platforms for each release, and list them in the [release notes]({{< ref "/nic/releases.md" >}}). We provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider, and that passes the [Kubernetes conformance tests](https://www.cncf.io/certification/software-conformance/).
+
+{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
+| NIC version | Kubernetes versions tested  | NIC Helm Chart version | NIC Operator version | NGINX / NGINX Plus version |
+| --- | --- | --- | --- | --- |
+| {{< nic-version >}} | 1.25 - 1.32 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.4 / R34 |
+| 4.0.1 | 1.25 - 1.32 | 2.0.1 | 3.0.1 | 1.27.4 / R33 P2 |
+| 3.7.2 | 1.25 - 1.31 | 1.4.2 | 2.4.2 | 1.27.2 / R32 P1 |
+| 3.6.2 | 1.25 - 1.31 | 1.3.2 | 2.3.2 | 1.27.1 / R32 P1 |
+| 3.5.2 | 1.23 - 1.30 | 1.2.2 | 2.2.2 | 1.27.0 / R32 |
+| 3.4.3 | 1.23 - 1.29 | 1.1.3 | 2.1.2 | 1.25.4 / R31 P1 |
+| 3.3.2 | 1.22 - 1.28 | 1.0.2 | 2.0.2 | 1.25.3 / R30 |
+| 3.2.1 | 1.22 - 1.27 | 0.18.1 | 1.5.1 | 1.25.2 / R30 |
+| 3.1.1 | 1.22 - 1.26 | 0.17.1 | 1.4.2 | 1.23.4 / R29 |
+{{% /bootstrap-table %}}
+
+---
+
+## Supported Docker images
+
+We provide the following Docker images, which include NGINX or NGINX Plus bundled with the Ingress Controller binary.
+
+### Images with NGINX
+
+{{< important >}}
+From release `v5.1.0` onwards, NGINX Ingress Controller will no longer provide binaries for the `armv7`, `s390x` & `ppc64le` architectures.
+{{< /important >}}
+
+_All images include NGINX 1.27.4._
+
+{{< bootstrap-table "table table-bordered table-responsive" >}}
+|<div style="width:200px">Name</div> | <div style="width:100px">Base image</div> | DockerHub image | Architectures |
+| ---| --- | --- | --- |
+|Alpine-based image | ``nginx:1.27.4-alpine``,<br>based on on ``alpine:3.21`` | ``nginx/nginx-ingress:{{< nic-version >}}-alpine`` | arm64<br>amd64 |
+|Debian-based image | ``nginx:1.27.4``,<br>based on on ``debian:12-slim`` | ``nginx/nginx-ingress:{{< nic-version >}}`` | arm64<br>amd64 |
+|Ubi-based image | ``redhat/ubi9-minimal`` | ``nginx/nginx-ingress:{{< nic-version >}}-ubi`` | arm64<br>amd64 |
+{{% /bootstrap-table %}}
+
+---
+
+### Images with NGINX Plus
+
+_NGINX Plus images include NGINX Plus R34._
+
+---
+
+#### **F5 Container registry**
+
+NGINX Plus images are available through the F5 Container registry `private-registry.nginx.com`, explained in the [Get the NGINX Ingress Controller image with JWT]({{<ref "/nic/installation/nic-images/get-image-using-jwt.md">}}) and [Get the F5 Registry NGINX Ingress Controller image]({{<ref "/nic/installation/nic-images/get-registry-image.md">}}) topics.
+
+{{< bootstrap-table "table table-striped table-bordered table-responsive" >}}
+|<div style="width:200px">Name</div> | <div style="width:100px">Base image</div> | <div style="width:200px">Additional modules</div> | F5 Container Registry Image | Architectures |
+| ---| ---| --- | --- | --- |
+|Alpine-based image | ``alpine:3.21`` | NJS (NGINX JavaScript)<br>OpenTelemetry  | `nginx-ic/nginx-plus-ingress:{{< nic-version >}}-alpine` | arm64<br>amd64 |
+|Alpine-based image with FIPS inside | ``alpine:3.21`` | NJS (NGINX JavaScript)<br>OpenTelemetry<br>FIPS module and OpenSSL configuration | `nginx-ic/nginx-plus-ingress:{{< nic-version >}}-alpine-fips` | arm64<br>amd64 |
+|Alpine-based image with NGINX App Protect WAF & FIPS inside | ``alpine:3.19`` | NGINX App Protect WAF<br>NJS (NGINX JavaScript)<br>OpenTelemetry<br>FIPS module and OpenSSL configuration | `nginx-ic-nap/nginx-plus-ingress:{{< nic-version >}}-alpine-fips` | amd64 |
+|Alpine-based image with NGINX App Protect WAF v5 & FIPS inside | ``alpine:3.19`` | NGINX App Protect WAF v5<br>NJS (NGINX JavaScript)<br>OpenTelemetry<br>FIPS module and OpenSSL configuration | `nginx-ic-nap-v5/nginx-plus-ingress:{{< nic-version >}}-alpine-fips` | amd64 |
+|Debian-based image | ``debian:12-slim`` | NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic/nginx-plus-ingress:{{< nic-version >}}` | arm64<br>amd64 |
+|Debian-based image with NGINX App Protect WAF | ``debian:12-slim`` | NGINX App Protect WAF<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-nap/nginx-plus-ingress:{{< nic-version >}}` | amd64 |
+|Debian-based image with NGINX App Protect WAF v5 | ``debian:12-slim`` | NGINX App Protect WAF v5<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-nap-v5/nginx-plus-ingress:{{< nic-version >}}` | amd64 |
+|Debian-based image with NGINX App Protect DoS | ``debian:12-slim`` | NGINX App Protect DoS<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-dos/nginx-plus-ingress:{{< nic-version >}}` | amd64 |
+|Debian-based image with NGINX App Protect WAF and DoS | ``debian:12-slim`` | NGINX App Protect WAF and DoS<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-nap-dos/nginx-plus-ingress:{{< nic-version >}}` | amd64 |
+|Ubi-based image | ``redhat/ubi9-minimal`` | NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic/nginx-plus-ingress:{{< nic-version >}}-ubi` | arm64<br>amd64 |
+|Ubi-based image with NGINX App Protect WAF | ``redhat/ubi9`` | NGINX App Protect WAF<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-nap/nginx-plus-ingress:{{< nic-version >}}-ubi` | amd64 |
+|Ubi-based image with NGINX App Protect WAF v5 | ``redhat/ubi9`` | NGINX App Protect WAF v5<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-nap-v5/nginx-plus-ingress:{{< nic-version >}}-ubi` | amd64 |
+|Ubi-based image with NGINX App Protect DoS | ``redhat/ubi8`` | NGINX App Protect DoS<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-dos/nginx-plus-ingress:{{< nic-version >}}-ubi` | amd64 |
+|Ubi-based image with NGINX App Protect WAF and DoS | ``redhat/ubi8`` | NGINX App Protect WAF and DoS<br>NJS (NGINX JavaScript)<br>OpenTelemetry | `nginx-ic-nap-dos/nginx-plus-ingress:{{< nic-version >}}-ubi` | amd64 |
+{{% /bootstrap-table %}}
+
+---
+
+### Custom images
+
+You can customize an existing Dockerfile or use it as a reference to create a new one, which is necessary when:
+
+- Choosing a different base image.
+- Installing additional NGINX modules.
+
+---
+
+## Supported Helm versions
+
+NGINX Ingress Controller can be [installed]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) using Helm 3.0 or later.
diff --git a/content/nic/troubleshooting/_index.md b/content/nic/troubleshooting/_index.md
new file mode 100644
index 000000000..dd82dc52a
--- /dev/null
+++ b/content/nic/troubleshooting/_index.md
@@ -0,0 +1,8 @@
+---
+title: Troubleshooting
+description:
+weight: 1800
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/troubleshooting/troubleshoot-common.md b/content/nic/troubleshooting/troubleshoot-common.md
new file mode 100644
index 000000000..23438408c
--- /dev/null
+++ b/content/nic/troubleshooting/troubleshoot-common.md
@@ -0,0 +1,201 @@
+---
+title: Troubleshooting common issues
+toc: true
+weight: 200
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1459
+---
+
+This page describes how to troubleshoot common issues with NGINX Ingress Controller. Instruction for specific resources is available in the [Troubleshooting]({{< ref "/nic/troubleshooting/" >}}) section.
+
+## Common issues
+
+{{% table %}}
+| Problem Area | Symptom | Troubleshooting Method | Common Cause |
+|-----|-----|-----|-----|
+| Startup | NGINX Ingress Controller fails to start. | Check the logs. | Misconfigured RBAC, a missing default server TLS Secret.|
+| Ingress resource and annotations | The configuration is not applied | Check the events of the Ingress resource, check the logs, check the generated config. | Invalid values of annotations. |
+| VirtualServer and VirtualServerRoute resources | The configuration is not applied. | Check the events of the VirtualServer and VirtualServerRoutes, check the logs, check the generated config. | VirtualServer or VirtualServerRoute is invalid. |
+| Policy resource | The configuration is not applied. | Check the events of the Policy resource as well as the events of the VirtualServers that reference that policy, check the logs, check the generated config. | Policy is invalid. |
+| ConfigMap keys | The configuration is not applied. | Check the events of the ConfigMap, check the logs, check the generated config.  | Invalid values of ConfigMap keys. |
+| NGINX | NGINX responds with unexpected responses. | Check the logs, check the generated config, check the live activity dashboard (NGINX Plus only), run NGINX in the debug mode. | Unhealthy backend pods, a misconfigured backend service. |
+{{% /table %}}
+
+## Troubleshooting Methods
+
+This section explains how to gather additional information for troubleshooting.
+
+The commands examples make the following assumptions:
+
+- That NGINX Ingress Controller is deployed in the namespace `nginx-ingress`.
+- `<nginx-ingress-pod>` is the name of one of the NGINX Ingress Controller pods.
+
+### Check NGINX Ingress Controller logs
+
+To check NGINX Ingress Controller logs, which include both information from NGINX Ingress Controller and NGINX's access and error logs, run the following command:
+
+```shell
+kubectl logs <nginx-ingress-pod> -n nginx-ingress
+```
+
+### Check the generated configuration files
+
+For each Ingress/VirtualServer resource, NGINX Ingress Controller generates a corresponding NGINX configuration file in the `/etc/nginx/conf.d folder`.
+
+ Additionally, NGINX Ingress Controller generates the main configuration file `/etc/nginx/nginx.conf`, which includes all the configurations files from `/etc/nginx/conf.d`. The configuration for a VirtualServerRoute resource is located in the configuration file of the VirtualServer that references the resource.
+
+You can view the content of the main configuration file by running:
+
+```shell
+kubectl exec <nginx-ingress-pod> -n nginx-ingress -- cat /etc/nginx/nginx.conf
+```
+
+Similarly, you can view the content of any generated configuration file in the `/etc/nginx/conf.d` folder.
+
+You can also print all NGINX configuration files together:
+
+```shell
+kubectl exec <nginx-ingress-pod> -n nginx-ingress -- nginx -T
+```
+
+However, this command will fail if any of the configuration files is not valid.
+
+### Check the Live Activity Monitoring Dashboard
+
+The live activity monitoring dashboard shows the real-time information about NGINX Plus and the applications it is load balancing, which is helpful for troubleshooting. To access the dashboard, read the [Status Page]({{< ref "/nic/logging-and-monitoring/status-page.md" >}}) topic.
+
+### Enable debugging for NGINX Ingress Controller
+
+For additional NGINX Ingress Controller debugging, you can enable debug settings to get more verbose logging.
+
+Increasing the debug log levels for NGINX Ingress Controller will also apply to NGINX itself.
+
+There are two places to configure more verbose logging for NGINX Ingress Controller:
+
+1. Command line arguments
+1. Configmap settings
+
+**Command line arguments**
+
+When using `manifest` for deployment, use the command line argument `-nginx-debug` in your deployment or daemonset.
+
+You can add the `-log-level` parameter to increase the verbosity of the NGINX Ingress Controller process.
+
+Here is a small snippet of setting these command line arguments in the `args` section of a deployment:
+
+```yaml
+args:
+  - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
+  - -enable-cert-manager
+  - -nginx-debug
+  - -log-level=debug
+```
+
+**ConfigMap settings**  
+You can configure `error-log-level` in NGINX Ingress Controller `configMap`:
+
+```yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: nginx-config
+  namespace: nginx-ingress
+data:
+  error-log-level: "debug"
+ ```
+
+**Using Helm**
+
+If you are using `helm`, you can adjust these two settings:
+
+```none
+controller.nginxDebug = true or false
+controller.loglevel = fatal, error, warn, info, debug or trace
+```
+
+For example, if using a `values.yaml` file:
+
+```yaml
+  ## Enables debugging for NGINX. Uses the nginx-debug binary. Requires error-log-level: debug in ConfigMap via `controller.config.entries`.
+  nginxDebug: true
+
+  ## The log level of the Ingress Controller.
+  logLevel: debug
+```
+
+This is a more complete example `values.yaml` file:
+
+```yaml
+controller:
+  kind: Deployment
+  nginxDebug: true
+  logLevel: debug
+  annotations:
+    nginx: ingress-prod
+  pod:
+    annotations:
+      prometheus.io/scrape: "true"
+      prometheus.io/port: "9113"
+      prometheus.io/scheme: http
+    extraLabels:
+      env: prod-weset
+  nginxplus: plus
+  image:
+    repository: nginx/nginx-ingress
+    tag: {{< nic-version >}}
+  # NGINX Configmap
+  config:
+    entries:
+      error-log-level: "debug"
+      proxy_connet_timeout: "5s"
+      http-snippets: |
+        underscores_in_headers on;
+  ingressClass: nginx
+```
+
+Enable the `nginx-debug` CLI argument and change the `error-log-level` to `debug` to capture more output for debugging.
+
+{{< note >}} It is recommended to only enable `nginx-debug` CLI and the `error-log-level` when debugging. {{< /note >}}
+
+#### Example debug NGINX Ingress Controller Output
+
+These logs show some of the additional entries when debugging is enabled for NGINX Ingress Controller.
+
+```shell
+I1026 15:39:03.269092       1 manager.go:301] Reloading nginx with configVersion: 1
+I1026 15:39:03.269115       1 utils.go:17] executing /usr/sbin/nginx-debug -s reload -e stderr
+2022/10/26 15:39:03 [notice] 19#19: signal 1 (SIGHUP) received from 42, reconfiguring
+2022/10/26 15:39:03 [debug] 19#19: wake up, sigio 0
+2022/10/26 15:39:03 [notice] 19#19: reconfiguring
+2022/10/26 15:39:03 [debug] 19#19: posix_memalign: 000056362AF0A420:16384 @16
+2022/10/26 15:39:03 [debug] 19#19: add cleanup: 000056362AF0C318
+2022/10/26 15:39:03 [debug] 19#19: posix_memalign: 000056362AF48230:16384 @16
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF00DE0:4096
+2022/10/26 15:39:03 [debug] 19#19: read: 46, 000056362AF00DE0, 3090, 0
+2022/10/26 15:39:03 [debug] 19#19: posix_memalign: 000056362AF58670:16384 @16
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF12440:4280
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF13500:4280
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF145C0:4280
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF5C680:4280
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF5D740:4280
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF5E800:4280
+2022/10/26 15:39:03 [debug] 19#19: posix_memalign: 000056362AF5F8C0:16384 @16
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF41500:4096
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF638D0:8192
+2022/10/26 15:39:03 [debug] 19#19: include /etc/nginx/mime.types
+2022/10/26 15:39:03 [debug] 19#19: include /etc/nginx/mime.types
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF658E0:4096
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF668F0:5349
+2022/10/26 15:39:03 [debug] 19#19: read: 47, 000056362AF658E0, 4096, 0
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF67DE0:4096
+2022/10/26 15:39:03 [debug] 19#19: read: 47, 000056362AF658E1, 1253, 4096
+2022/10/26 15:39:03 [debug] 19#19: posix_memalign: 000056362AF68DF0:16384 @16
+2022/10/26 15:39:03 [debug] 19#19: posix_memalign: 000056362AF6CE00:16384 @16
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AF70E10:524288
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362AFF0E20:524288
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362B070E30:524288
+2022/10/26 15:39:03 [debug] 19#19: malloc: 000056362B0F0E40:400280
+```
+
+Once you have completed your debugging process, you can change the values back to the original values.
diff --git a/content/nic/troubleshooting/troubleshoot-configmap-policy.md b/content/nic/troubleshooting/troubleshoot-configmap-policy.md
new file mode 100644
index 000000000..fa5f44059
--- /dev/null
+++ b/content/nic/troubleshooting/troubleshoot-configmap-policy.md
@@ -0,0 +1,48 @@
+---
+docs: DOCS-1457
+doctypes:
+- ''
+title: Troubleshooting Policy resources
+toc: true
+weight: 300
+---
+
+This page describes how to troubleshoot NGINX Ingress Controller Policy Resources.
+
+## Policy Resources
+
+After you create or update a Policy resource, you can use `kubectl describe` to check whether or not NGINX Ingress Controller accepted the policy:
+
+```shell
+kubectl describe pol webapp-policy
+```
+```shell
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  11s   nginx-ingress-controller  Policy default/webapp-policy was added or updated
+```
+
+The events section has a *Normal* event with the *AddedOrUpdated reason*, indicating the policy was successfully accepted.
+
+However, the fact that a policy was accepted doesn’t guarantee that the NGINX configuration was successfully applied.
+
+To verify the configuration applied, check the events of the [VirtualServer and VirtualServerRoute resources]({{< ref "/nic/troubleshooting/troubleshoot-virtualserver.md" >}}) that reference the policy.
+
+## ConfigMap Resources
+
+After you update the ConfigMap resource, you can immediately check if the configuration was successfully applied by NGINX:
+
+```shell
+kubectl describe configmap nginx-config -n nginx-ingress
+Name:         nginx-config
+Namespace:    nginx-ingress
+Labels:       <none>
+
+Events:
+  Type    Reason   Age                From                      Message
+  ----    ------   ----               ----                      -------
+  Normal  Updated  11s (x2 over 26m)  nginx-ingress-controller  Configuration from nginx-ingress/nginx-config was updated
+```
+
+Similar to *Policies*, the events section has a *Normal* event with the *AddedOrUpdated reason*, indicating the policy was successfully accepted.
diff --git a/content/nic/troubleshooting/troubleshoot-ingress.md b/content/nic/troubleshooting/troubleshoot-ingress.md
new file mode 100644
index 000000000..e970b2548
--- /dev/null
+++ b/content/nic/troubleshooting/troubleshoot-ingress.md
@@ -0,0 +1,29 @@
+---
+docs: DOCS-1458
+doctypes:
+- ''
+title: Troubleshooting Ingress resources
+toc: true
+weight: 300
+---
+
+This page describes how to troubleshoot NGINX Ingress Controller Policy Resources.
+
+## Ingress resources
+
+After you create or update an Ingress resource, you can immediately check if the NGINX configuration for that Ingress resource was successfully applied by NGINX:
+
+```shell
+kubectl describe ing cafe-ingress
+```
+```shell
+Name:             cafe-ingress
+Namespace:        default
+
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  12s   nginx-ingress-controller  Configuration for default/cafe-ingress was added or updated
+```
+
+The events section has a *Normal* event with the *AddedOrUpdated reason*, indicating the policy was successfully accepted.
diff --git a/content/nic/troubleshooting/troubleshoot-support.md b/content/nic/troubleshooting/troubleshoot-support.md
new file mode 100644
index 000000000..37308268b
--- /dev/null
+++ b/content/nic/troubleshooting/troubleshoot-support.md
@@ -0,0 +1,38 @@
+---
+title: Commercial support
+weight: 100
+docs: DOCS-000
+---
+
+F5 NGINX Ingress Controller adheres to the support policy detailed in the following knowledge base article: [K000140156](https://my.f5.com/manage/s/article/K000140156).
+
+After opening a support ticket, F5 staff will request additional information to better understand the problem.
+
+The [nginx-supportpkg-for-k8s](https://github.com/nginxinc/nginx-supportpkg-for-k8s) plugin collects the information needed by F5 Technical Support to assist with troubleshooting your issue.
+
+When used, the plugin will generate a tarball of the collected information which can be shared with the support channels.
+
+
+The plugin uses [krew](https://krew.sigs.k8s.io), the plugin manager for the Kubernetes [kubectl](https://kubernetes.io/docs/reference/kubectl/) command-line tool.
+
+The plugin may collect some or all of the following global and namespace-specific information:
+
+* K8s version, nodes information, and Custom Resources (kubectl describe output)
+* Pods' logs
+* List of Pods, events, ConfigMaps, Services, Deployments, Daemonsets, StatefulSets, ReplicaSets, and Leases
+* K8s metrics
+* Helm deployments
+* `nginx -T` output from NGINX-related pods
+
+This plugin **does not** collect secrets or coredumps.
+
+Visit the [project’s GitHub repository](https://github.com/nginxinc/nginx-supportpkg-for-k8s) for further details.
+
+
+## Support channels
+
+- If you experience issues with NGINX Ingress Controller, please [open an issue](https://github.com/nginx/kubernetes-ingress/issues/new?assignees=&labels=bug%2Cneeds+triage&projects=&template=BUG-REPORT.yml&title=%5BBug%5D%3A+) in GitHub.
+
+- If you have any enhancement requests, please [open a feature request](https://github.com/nginx/kubernetes-ingress/issues/new?assignees=&labels=proposal&projects=&template=feature_request.md&title=) in GitHub.
+
+- If you have any ideas or suggestions to discuss, please [open an idea discussion](https://github.com/nginx/kubernetes-ingress/discussions/categories/ideas) in GitHub.
diff --git a/content/nic/troubleshooting/troubleshoot-transportserver.md b/content/nic/troubleshooting/troubleshoot-transportserver.md
new file mode 100644
index 000000000..4d5fa7112
--- /dev/null
+++ b/content/nic/troubleshooting/troubleshoot-transportserver.md
@@ -0,0 +1,9 @@
+---
+doctypes:
+- ''
+draft: true
+title: Troubleshooting TransportServer Resources
+weight: 500
+---
+
+# Troubleshooting TransportServer Resources
diff --git a/content/nic/troubleshooting/troubleshoot-virtualserver.md b/content/nic/troubleshooting/troubleshoot-virtualserver.md
new file mode 100644
index 000000000..72af8d32c
--- /dev/null
+++ b/content/nic/troubleshooting/troubleshoot-virtualserver.md
@@ -0,0 +1,38 @@
+---
+docs: DOCS-1461
+doctypes:
+- ''
+title: Troubleshooting VirtualServer resources
+toc: true
+weight: 600
+---
+
+This page describes how to troubleshoot VirtualServer and VirtualServer resource events.
+
+## Inspecting VirtualServer and VirtualServerRoute resource events
+
+After creating or updating a VirtualServer resource, you can immediately check if the NGINX configuration for that resource was successfully by using `kubectl describe vs <resource-name>`:
+
+```shell
+kubectl describe vs cafe
+```
+```shell
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  16s   nginx-ingress-controller  Configuration for default/cafe was added or updated
+```
+
+In the above example, we have a `Normal` event with the `AddedOrUpdate` reason, which informs us that the configuration was successfully applied.
+
+Checking the events of a VirtualServerRoute is similar:
+
+```shell
+kubectl describe vsr coffee
+```
+```shell
+Events:
+  Type     Reason                 Age   From                      Message
+  ----     ------                 ----  ----                      -------
+  Normal   AddedOrUpdated         1m    nginx-ingress-controller  Configuration for default/coffee was added or updated
+```
diff --git a/content/nic/tutorials/_index.md b/content/nic/tutorials/_index.md
new file mode 100644
index 000000000..109c994dd
--- /dev/null
+++ b/content/nic/tutorials/_index.md
@@ -0,0 +1,8 @@
+---
+title: Tutorials
+description:
+weight: 1900
+menu:
+  docs:
+    parent: NGINX Ingress Controller
+---
diff --git a/content/nic/tutorials/custom-listen-ports.md b/content/nic/tutorials/custom-listen-ports.md
new file mode 100644
index 000000000..a2ab3347f
--- /dev/null
+++ b/content/nic/tutorials/custom-listen-ports.md
@@ -0,0 +1,159 @@
+---
+docs: DOCS-1449
+doctypes:
+- concept
+title: Customizing NGINX Ingress Controller Ports
+toc: true
+weight: 1800
+---
+
+This document explains how to change the default ports that NGINX Ingress Controller is configured to use, as well as how to add additional `listen` settings. For more information, please read the [NGINX Listen documentation](http://nginx.org/en/docs/http/ngx_http_core_module.html#listen).
+
+## Changing Default Ports
+
+By default, NGINX Ingress Controller listens on ports 80 and 443. These ports can be changed easily, but modifying the `listen` ports for your NGINX Ingress resources will require the editing of `.tmpl` files.
+
+If you are using NGINX Ingress Controller CRDs (VirtualServer):
+
+- `nginx-plus-virtualserver.tmpl` for NGINX Plus
+- `nginx-virtualserver.tmpl` if using NGINX OSS
+
+If you are using `Ingress` resource you will need to modify:
+
+- `nginx-plus-ingress.tmpl` if using NGINX Plus
+- `nginx-ingress.tmpl` if using NGINX OSS
+
+In this example, we will use the `nginx-virtualserver.tmpl` template to change the port from 80 to 85.
+You can find the [nginx-virtualserver template files in our repository](https://github.com/nginx/kubernetes-ingress/tree/main/internal/configs/version2).
+
+We start by modifying `nginx-virtualserver.tmpl` to change the port setting:
+
+```nginx
+server {
+    listen 80{{ if $s.ProxyProtocol }} proxy_protocol{{ end }};
+
+    server_name {{ $s.ServerName }};
+
+    set $resource_type "virtualserver";
+    set $resource_name "{{$s.VSName}}";
+    set $resource_namespace "{{$s.VSNamespace}}";
+```
+
+To change the listen port from `80` to `85`, edit the `listen` line at the start of the server configuration block.
+
+After changing the number, the file looks like this:
+
+```nginx
+server {
+    listen 85{{ if $s.ProxyProtocol }} proxy_protocol{{ end }};
+
+    server_name {{ $s.ServerName }};
+
+    set $resource_type "virtualserver";
+    set $resource_name "{{$s.VSName}}";
+    set $resource_namespace "{{$s.VSNamespace}}";
+```
+
+Modify the file you need (per the example above). In the example, we modified `nginx-plus-virtualserver.tmpl`:
+
+## Rebuild the NGINX Ingress Controller image
+
+You must rebuild the NGINX Ingress Controller image for the new port settings to take effect.
+Once the image is built and pushed, make sure you update your deployment to point to the new image and deploy.
+Once deployed, create a new `VirtualServer` resource and run `nginx -T` to confirm if the port change has taken effect.
+
+Ensure that your `Deployment` and your `Service` match up to the new port you configured in the templates.
+Below is an example of  `Deployment` and `Service` matching to the new port that NGINX Ingress Controller now listens on.
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-ingress
+  namespace: nginx-ingress
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx-ingress
+  template:
+    metadata:
+      labels:
+        app: nginx-ingress
+      annotations:
+       prometheus.io/scrape: "true"
+       prometheus.io/port: "9113"
+       prometheus.io/scheme: http
+    spec:
+      serviceAccountName: nginx-ingress
+      containers:
+      - image: nginx/nginx-ingress:{{< nic-version >}}
+        imagePullPolicy: IfNotPresent
+        name: nginx-ingress
+        ports:
+        - name: http
+          containerPort: 85
+        - name: https
+          containerPort: 443
+        - name: readiness-port
+          containerPort: 8081
+        - name: prometheus
+          containerPort: 9113
+        readinessProbe:
+          httpGet:
+            path: /nginx-ready
+            port: readiness-port
+          periodSeconds: 1
+        securityContext:
+```
+
+Notice that now, the `http` port is set to `85`, which reflects the change we made in the template file.
+
+Here is the `service` file:
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx-ingress
+  namespace: nginx-ingress
+spec:
+  externalTrafficPolicy: Local
+  type: LoadBalancer
+  ports:
+  - port: 80
+    targetPort: 85
+    protocol: TCP
+    name: http
+  - port: 8443
+    targetPort: 8443
+    protocol: TCP
+    name: https
+  selector:
+    app: nginx-ingress
+```
+
+Since NGINX Ingress Controller is now listening on ports 85 and 8443, you must modify the `targetPort` in the NGINX Ingress Controller service to match the change in the deployment to ensure traffic will be sent to the proper port.
+
+The parameter to change above is `targetPort`. Since we have changed NGINX Ingress Controller to listen on port 85, we need to match that in the service: requests will be sent to NGINX Ingress Controller on port 85 instead of the default value, port 80.
+
+If you view the `NGINX` configuration .conf file using `nginx -T`, you should see the port you defined in the .template file is now set on the `listen` line.
+
+Here is an example output of the `NGINX` configuration that has been generated:
+
+```shell
+kubectl exec -it -n nginx-ingress nginx-ingress-54bffd78d9-v7bns -- nginx -T
+```
+
+```nginx
+server {
+    listen 85;
+    listen [::]:85;
+    listen 8011;
+
+    server_name cafe.example.com;
+
+    set $resource_type "virtualserver";
+    set $resource_name "cafe";
+    set $resource_namespace "default";
+```
diff --git a/content/nic/tutorials/ingress-path-regex-annotation.md b/content/nic/tutorials/ingress-path-regex-annotation.md
new file mode 100644
index 000000000..73d151bcc
--- /dev/null
+++ b/content/nic/tutorials/ingress-path-regex-annotation.md
@@ -0,0 +1,456 @@
+---
+docs: DOCS-1451
+doctypes:
+- concept
+title: Ingresses Path Matching Using Path-Regex Annotation
+toc: true
+weight: 1800
+---
+
+This document describes how to customize Ingress and Mergeable Ingress types with path-regex annotations.
+
+## Customizing NGINX Ingress Controller with Path-Regex Annotations
+
+We suggest reading the NGINX [documentation on resolve location priority](https://docs.nginx.com/nginx/admin-guide/web-server/web-server/#nginx-location-priority)
+to gain additional context about NGINX and NGINX Plus before using the ``path-regex`` annotation.
+
+## Ingress Type
+
+In this example, you will use the `nginx.org/path-regex` annotations to add regex modifiers to the location paths.
+
+Start by modifying `cafe-ingress.yaml` metadata to add the annotation section and configure
+the ``nginx.org/path-regex`` annotation.
+
+`cafe-ingress.yaml`:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress
+  annotations:
+    nginx.org/path-regex: "case_sensitive"
+spec:
+  tls:
+  - hosts:
+    - cafe.example.com
+    secretName: cafe-secret
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea/[A-Z0-9]
+        backend:
+          serviceName: tea-svc
+          servicePort: 80
+      - path: /coffee/[A-Z0-9]
+        backend:
+          serviceName: coffee-svc
+          servicePort: 80
+```
+
+After creating the Ingress (`kubectl create -f cafe-ingres.yaml`), all defined paths will be updated. In the generated
+NGINX config file the ``tea`` and ``coffee`` paths will look like in the snippets below:
+
+tea path:
+
+```nginx
+location ~ "^/tea/[A-Z0-9]"
+```
+
+coffee path:
+
+```nginx
+location ~ "^/coffee/[A-Z0-9]"
+```
+
+Note that the regex modifier `case_sensitive` is applied to all paths.
+
+To change regex modifier value from `case_sensitive` to `case_insensitive` update the `nginx.org/path-regex` annotation.
+
+The config `cafe-ingress.yaml` file below shows the change.
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress
+  annotations:
+    nginx.org/path-regex: "case_insensitive"
+spec:
+  tls:
+  - hosts:
+    - cafe.example.com
+    secretName: cafe-secret
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea/[A-Z0-9]
+        backend:
+          serviceName: tea-svc
+          servicePort: 80
+      - path: /coffee/[A-Z0-9]
+        backend:
+          serviceName: coffee-svc
+          servicePort: 80
+```
+
+In the NGINX config file, the ``/tea/[A-Z0-9]`` and ``/coffee/[A-Z0-9]`` paths should look like in the snippets below.
+
+tea path
+
+```nginx
+location ~* "^/tea/[A-Z0-9]"
+```
+
+coffee path
+
+```nginx
+location ~* "^/coffee/[A-Z0-9]"
+```
+
+## Mergeable Ingress Type
+
+This document section explains how to deploy and configure Mergeable Ingress Type.
+
+First, you will deploy a Master Ingress and two Minion Ingresses. Then, you will configure them with `path-regex` annotations.
+
+Create a Master Ingress.
+
+`cafe-master.yaml`
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-master
+  annotations:
+    nginx.org/mergeable-ingress-type: "master"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - cafe.example.com
+    secretName: cafe-secret
+  rules:
+  - host: cafe.example.com
+```
+
+Create the Ingress
+
+```shell
+kubectl create -f cafe-master.yaml
+```
+
+Verify the Master Ingress was created
+
+```shell
+kubectl get ingress cafe-ingress-master
+
+NAME                  CLASS   HOSTS              ADDRESS   PORTS     AGE
+cafe-ingress-master   nginx   cafe.example.com             80, 443   29s
+```
+
+```shell
+kubectl describe ingress cafe-ingress-master
+
+Name:             cafe-ingress-master
+Labels:           <none>
+Namespace:        default
+Address:
+Ingress Class:    nginx
+Default backend:  <default>
+TLS:
+  cafe-secret terminates cafe.example.com
+Rules:
+  Host        Path  Backends
+  ----        ----  --------
+  *           *     <default>
+Annotations:  nginx.org/mergeable-ingress-type: master
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  62s   nginx-ingress-controller  Configuration for default/cafe-ingress-master was added or updated
+```
+
+Create the first Ingress Minion.
+
+`tea-minion.yaml`
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-tea-minion
+  annotations:
+    nginx.org/mergeable-ingress-type: "minion"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea
+        pathType: Prefix
+        backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+```
+
+```shell
+kubectl create -f tea-minion.yaml
+
+ingress.networking.k8s.io/cafe-ingress-tea-minion created
+```
+
+Verify the Minion was created:
+
+```shell
+kubectl get ingress cafe-ingress-tea-minion
+
+NAME                      CLASS   HOSTS              ADDRESS   PORTS   AGE
+cafe-ingress-tea-minion   nginx   cafe.example.com             80      23m
+```
+
+```shell
+kubectl describe ingress cafe-ingress-tea-minion
+
+Name:             cafe-ingress-tea-minion
+Labels:           <none>
+Namespace:        default
+Address:
+Ingress Class:    nginx
+Default backend:  <default>
+Rules:
+  Host              Path  Backends
+  ----              ----  --------
+  cafe.example.com
+                    /tea   tea-svc:80 (10.244.0.6:8080,10.244.0.7:8080,10.244.0.8:8080)
+Annotations:        nginx.org/mergeable-ingress-type: minion
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  24m   nginx-ingress-controller  Configuration for default/cafe-ingress-tea-minion was added or updated
+```
+
+Create the second Ingress Minion.
+
+`tea-minion.yaml`
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-tea-minion
+  annotations:
+    nginx.org/mergeable-ingress-type: "minion"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea
+        pathType: Prefix
+        backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+```
+
+```shell
+kubectl create -f tea-minion.yaml
+
+ingress.networking.k8s.io/cafe-ingress-tea-minion created
+```
+
+Verify the Minion Ingress was created:
+
+```shell
+kubectl get ingress cafe-ingress-tea-minion
+
+NAME                      CLASS   HOSTS              ADDRESS   PORTS   AGE
+cafe-ingress-tea-minion   nginx   cafe.example.com             80      5m21s
+```
+
+```shell
+kubectl describe ingress cafe-ingress-tea-minion
+
+Name:             cafe-ingress-tea-minion
+Labels:           <none>
+Namespace:        default
+Address:
+Ingress Class:    nginx
+Default backend:  <default>
+Rules:
+  Host              Path  Backends
+  ----              ----  --------
+  cafe.example.com
+                    /tea   tea-svc:80 (10.244.0.6:8080,10.244.0.7:8080,10.244.0.8:8080)
+Annotations:        nginx.org/mergeable-ingress-type: minion
+Events:
+  Type    Reason          Age    From                      Message
+  ----    ------          ----   ----                      -------
+  Normal  AddedOrUpdated  5m52s  nginx-ingress-controller  Configuration for default/cafe-ingress-tea-minion was added or updated
+```
+
+You created a Master Ingress and two Minion Ingresses. Minion Ingresses are defined with two paths: `/tea` and `/coffee`.
+
+In the following steps, you will modify the paths by applying regex modifiers.
+
+Update the Minion Ingress `Tea`:
+
+- add `path-regex` annotation with value `case_insensitive`
+- modify path with regex you want to use (in the example below: `/tea/[A-Z0-9]`)
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-tea-minion
+  annotations:
+    nginx.org/mergeable-ingress-type: "minion"
+    nginx.org/path-regex: "case_insensitive"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /tea/[A-Z0-9]
+        pathType: Prefix
+        backend:
+          service:
+            name: tea-svc
+            port:
+              number: 80
+```
+
+Apply the changes:
+
+```shell
+kubectl apply -f tea-minion.yaml
+```
+
+Verify the change:
+
+```shell
+kubectl describe ingress cafe-ingress-tea-minion
+
+Name:             cafe-ingress-tea-minion
+Labels:           <none>
+Namespace:        default
+Address:
+Ingress Class:    nginx
+Default backend:  <default>
+Rules:
+  Host              Path  Backends
+  ----              ----  --------
+  cafe.example.com
+                    /tea/[A-Z0-9]   tea-svc:80 (10.244.0.6:8080,10.244.0.7:8080,10.244.0.8:8080)
+Annotations:        nginx.org/mergeable-ingress-type: minion
+                    nginx.org/path-regex: case_insensitive
+Events:
+  Type    Reason          Age                From                      Message
+  ----    ------          ----               ----                      -------
+  Normal  AddedOrUpdated  47s (x2 over 34m)  nginx-ingress-controller  Configuration for default/cafe-ingress-tea-minion was added or updated
+```
+
+Looking at the updated list of annotations, we can see the new `path-regex` annotation was added.
+
+It updates the path `/tea/[A-Z0-9]` using the `case_insensitive` regex modifier.
+Updated path (location) in the NGINX config file: `location ~* "^/tea/[A-Z0-9]"`.
+
+Note that the `path-regex` annotation applies only to paths defined on the corresponding Minion Ingress.
+The paths defined in the second Minion (`coffee`) are not modified.
+
+Follow the steps below to configure the type `case_sensitive` regex modifier on the Second Minion Ingress.
+
+Modify deployed `coffee-minion.yaml`
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-coffee-minion
+  annotations:
+    nginx.org/mergeable-ingress-type: "minion"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /coffee
+        pathType: Prefix
+        backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+```
+
+Add `path-regex` annotation and modify the path `/coffee`:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cafe-ingress-coffee-minion
+  annotations:
+    nginx.org/mergeable-ingress-type: "minion"
+    nginx.org/path-regex: "case_sensitive"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: cafe.example.com
+    http:
+      paths:
+      - path: /coffee/[A-Za-z0-9]
+        pathType: Prefix
+        backend:
+          service:
+            name: coffee-svc
+            port:
+              number: 80
+```
+
+Apply changes to the Minion Ingress:
+
+```shell
+kubectl apply -f coffee-minion.yaml
+
+ingress.networking.k8s.io/cafe-ingress-coffee-minion created
+```
+
+Verify the applied changes:
+
+```shell
+kubectl describe ingress cafe-ingress-coffee-minion
+
+Name:             cafe-ingress-coffee-minion
+Labels:           <none>
+Namespace:        default
+Address:
+Ingress Class:    nginx
+Default backend:  <default>
+Rules:
+  Host              Path  Backends
+  ----              ----  --------
+  cafe.example.com
+                    /coffee/[A-Za-z0-9]   coffee-svc:80 (10.244.0.10:8080,10.244.0.9:8080)
+Annotations:        nginx.org/mergeable-ingress-type: minion
+                    nginx.org/path-regex: case_sensitive
+Events:
+  Type    Reason          Age   From                      Message
+  ----    ------          ----  ----                      -------
+  Normal  AddedOrUpdated  11m   nginx-ingress-controller  Configuration for default/cafe-ingress-coffee-minion was added or updated
+```
+
+The new annotation `nginx.org/path-regex` was added.
+It updates the path `/coffee/[A-Za-z0-9]` using the `case_sensitive` regex modifier.
+Updated path (location) in the NGINX config file: `location ~ "^/coffee/[A-Za-z0-9]"`.
diff --git a/content/nic/tutorials/nginx-dynamic-module.md b/content/nic/tutorials/nginx-dynamic-module.md
new file mode 100644
index 000000000..bdf5da70d
--- /dev/null
+++ b/content/nic/tutorials/nginx-dynamic-module.md
@@ -0,0 +1,117 @@
+---
+docs: DOCS-1231
+doctypes:
+- concept
+title: Using NGINX Ingress Controller with NGINX Dynamic Modules
+toc: true
+weight: 1800
+---
+
+This document describes how to use NGINX Ingress Controller with NGINX dynamic modules.
+
+## Overview
+
+NGINX Plus has several Dynamic Modules that can add additional features and capabilities to NGINX, which NGINX Ingress Controller can also use. To do this, you must modify your NGINX Ingress Controller image to add a module, then load the updated image.
+
+For more information about Dynamic Modules, you can read [the documentation for NGINX Plus](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/dynamic-modules/).
+
+There are two steps involved:
+
+1. Updating the Dockerfile and building the image with the dynamic module.
+1. Loading the module in NGINX Ingress Controler using a `configmap`
+
+## Updating the Image
+
+To build a custom NGINX Ingress Controller image with specific modules, you must modify the `Dockerfile` located in the `build` directory of the code repository.
+
+First, clone the NGINX Ingress Controller repository:
+
+```shell
+git clone git@github.com:nginx/kubernetes-ingress.git
+```
+
+Once you have cloned the repository, edit the `Dockerfile` located in the `build` directory.
+
+In this example, we add the `Headers-more` dynamic module to the NGINX Ingress Controller image. We choose the `debian-plus` operating system: modify the entry for the system you are using.
+
+```docker
+FROM debian:12-slim AS debian-plus
+ARG IC_VERSION
+ARG NGINX_PLUS_VERSION
+ARG BUILD_OS
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+	--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+	apt-get update \
+	&& apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gnupg curl apt-transport-https libcap2-bin \
+	&& curl -fsSL https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor > /etc/apt/trusted.gpg.d/nginx_signing.gpg \
+	&& curl -fsSL -o /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx \
+	&& DEBIAN_VERSION=$(awk -F '=' '/^VERSION_CODENAME=/ {print $2}' /etc/os-release) \
+	&& printf "%s\n" "Acquire::https::pkgs.nginx.com::User-Agent \"k8s-ic-$IC_VERSION${BUILD_OS##debian-plus}-apt\";" >> /etc/apt/apt.conf.d/90pkgs-nginx \
+	&& printf "%s\n" "deb https://pkgs.nginx.com/plus/${NGINX_PLUS_VERSION^^}/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-plus.list \
+	&& apt-get update \
+	&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs \
+	&& apt-get purge --auto-remove -y apt-transport-https gnupg curl \
+	&& rm -rf /var/lib/apt/lists/*
+```
+
+In the snippet above there is a line similar to the following, which you must modify to add a dynamic module to NGINX Ingress Controller.
+
+```shell
+apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs
+```
+
+For this example, we add the `headers-more` module with the argument `nginx-plus-module-headers-more`. The updated line then looks like this:
+
+```shell
+apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-headers-more
+```
+
+## Loading Modules
+
+Once the new NGINX Ingress module image has built successfully, the next step is to load the module into NGINX Ingress Controller when it is deployed into your Kubernetes cluster.
+
+To do this, modify your NGINX Ingress Controller configuration to add the module into the `main` context, which can be done through both Manifest and Helm deployments.
+
+{{<tabs name="install-methods">}}
+
+{{%tab name="Helm"%}}
+
+```yaml
+config:
+  name: nginx-ingress
+  entries:
+    main-snippets: load_module modules/ngx_http_headers_more_filder_module.so;
+    http-snippets: underscores_in_headers on;
+    lb-method: "least_time last_byte"
+```
+
+{{%/tab%}}
+
+{{%tab name="Manifest"%}}
+
+```yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: nginx-config
+  namespace: nginx-ingress
+data:
+  main-snippets: |
+    load_module modules/ngx_http_headers_more_filter_module.so;
+```
+
+{{%/tab%}}
+
+
+
+{{</tabs>}}
+
+NGINX Ingress Controller will load the `ngx_http_headers_more` module, which can then be verified by running `nginx -T` in the NGINX Ingress Controller pod:
+
+```shell
+kubectl exec -it -n nginx-ingress <nginx_ingress_pod> -- nginx -T
+```
+
+You should see the module in the `nginx -T` output, indicating it is now loaded in NGINX Ingress Controller.
diff --git a/content/nic/tutorials/nginx-ingress-istio.md b/content/nic/tutorials/nginx-ingress-istio.md
new file mode 100644
index 000000000..63ab47ff5
--- /dev/null
+++ b/content/nic/tutorials/nginx-ingress-istio.md
@@ -0,0 +1,262 @@
+---
+docs: DOCS-889
+doctypes:
+- concept
+title: NGINX Ingress Controller and Istio Service Mesh
+toc: true
+weight: 1800
+---
+
+NGINX Ingress Controller can be used as the Ingress Controller for applications running inside an Istio service mesh. This allows you to continue using the advanced capabilities that NGINX IC provides on Istio-based environments without resorting to any workarounds.
+This is accomplished using the special setting [use-cluster-ip](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#upstream) for the backend.
+
+Here is a standard deployment of NGINX Ingress Controller without a sidecar proxy injected into the pod.
+
+{{< img src="./img/nginx_plain.png" alt="NGINX stand alone." >}}
+
+Notice that NGINX Ingress Controller enumerates the pods of the backend service and balances traffic directly to them, granting full control of the backend load balancer and stickiness behavior.
+If your service pods support TLS, then NIC can re-encrypt the traffic to them and provide end-to-end encryption.
+
+But then, if your services could do that, you might not be implementing a Service Mesh.
+
+To begin, Istio needs to be installed into your cluster.
+
+## Install Istio
+
+Link to Istio install guide:
+[Installing Istio](https://istio.io/latest/docs/setup/install/)
+
+It is crucial to make sure you install Istio **BEFORE** installing NGINX Ingress Controller. This ensures that the Istio sidecar is injected correctly into the NGINX Ingress controller pod.
+
+You can install Istio by your preferred method (helm, operator, etc.). In this case, I ran the following command to install Istio into my cluster:
+
+```shell
+istioctl install --set profile=minimal
+```
+
+We need to ensure that Istio injects sidecar proxies into our namespace for testing. To do so, we need to tell Istio what namespaces to inject sidecars into. We can do that with the following command:
+
+```shell
+kubectl label ns <namespace_specified> istio-injection=enabled
+```
+
+Before proceeding, and before installing NGINX Ingress Controller you need to tell Istio that it will be injecting sidecars with the NGINX Ingress controller pods as they are deployed.
+
+```shell
+kubectl label namespace nginx-ingress istio-injection=enabled
+```
+
+Using `kubectl`, we can see that the namespace for our demo (nginx-ingress) now has `istio-injection=enabled` specified:
+
+```shell
+kubectl get namespaces -A --show-labels
+
+
+default                Active   28h   <none>
+istio-system           Active   24h   istio-injection=disabled
+kube-node-lease        Active   28h   <none>
+kube-public            Active   28h   <none>
+kube-system            Active   28h   <none>
+kubernetes-dashboard   Active   16h   <none>
+local-path-storage     Active   28h   <none>
+nginx-ingress          Active   27h   istio-injection=enabled
+```
+
+After we have set up and configured Istio, we can deploy NGINX Plus Ingress and our applications that will be part of the service mesh. Istio will now inject sidecar proxies based upon how we have configured Istio (namespace configuration).
+Now, our deployment will look like the following (with Envoy sidecar proxies).
+
+The image below shows how an NGINX Ingress Controller and Istio deployment looks:
+
+{{< img src="./img/nginx-envoy.png" alt="NGINX with envoy sidecar." >}}
+
+## Install NGINX Ingress Controller
+
+Once Istio is installed, you can install NGINX Ingress Controller.
+
+## Setting up NGINX Plus Ingress controller deployment for Istio
+
+When deploying NGINX Plus Ingress Controller with Istio, you must modify your Deployment file to include the specific annotations required to work with Istio. Those four specific lines are:
+
+```yaml
+traffic.sidecar.istio.io/includeInboundPorts: ""
+traffic.sidecar.istio.io/excludeInboundPorts: "80,443"
+traffic.sidecar.istio.io/excludeOutboundIPRanges: "substitute_for_correct_subnet_range"
+sidecar.istio.io/inject: 'true'
+```
+
+Additional information on the above annotations can be found on Istio's website.
+[Istio Service Mesh Annotations](https://istio.io/latest/docs/reference/config/annotations/)
+
+Your updated `nginx-plus-ingress.yaml` file will look something like this with the added annotations:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-ingress
+  namespace: nginx-ingress
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx-ingress
+  template:
+    metadata:
+      labels:
+        app: nginx-ingress
+      annotations:
+        traffic.sidecar.istio.io/includeInboundPorts: ""
+        traffic.sidecar.istio.io/excludeInboundPorts: "80,443"
+        traffic.sidecar.istio.io/excludeOutboundIPRanges: "10.90.0.0/16,10.45.0.0/16"
+        sidecar.istio.io/inject: 'true'
+```
+
+{{< img src="./img/nginx_istio_small.png" alt="NGINX Ingress pod with envoy sidecar." >}}
+
+We can now see that after configuring Istio, an Istio sidecar proxy has been installed into the same pod as NGINX Ingress Controller. Now, there are two containers in the same pod for NGINX Ingress Controller: the NGINX Ingress controller container and the Istio sidecar proxy container.
+
+```shell
+kubectl get pods -A
+
+NAMESPACE       NAME                                      READY   STATUS    RESTARTS   AGE
+kube-system     coredns-854c77959c-h2vrq                  1/1     Running   0          60m
+kube-system     metrics-server-86cbb8457f-fct86           1/1     Running   0          60m
+kube-system     local-path-provisioner-5ff76fc89d-5hjbl   1/1     Running   0          60m
+istio-system    istiod-7c9c9d46d4-qpgff                   1/1     Running   0          60m
+nginx-ingress   nginx-ingress-5898f94c49-v4jrf            2/2     Running   1          41s
+```
+
+Here is our VirtualServer configuration for Istio service mesh (note `use-cluster-ip` and `requestHeaders`). These settings are required when using Istio service mesh:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+  namespace: nginx-ingress
+spec:
+  host: cafe.example.com
+  tls:
+    secret: cafe-secret
+  upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+    use-cluster-ip: true
+  - name: coffee
+    service: coffee-svc
+    port: 80
+    use-cluster-ip: true
+  routes:
+  - path: /tea
+    action:
+      proxy:
+        upstream: tea
+        requestHeaders:
+          set:
+          - name: Host
+            value: tea-svc.nginx-ingress.svc.cluster.local
+  - path: /coffee
+    action:
+      proxy:
+        upstream: coffee
+        requestHeaders:
+          set:
+          - name: Host
+            value: coffee-svc.nginx-ingress.svc.cluster.local
+```
+
+With our new Host header control in v1.11, when VirtualServer is configured with `requestHeaders`, the value specified will be used and `proxy_set_header $host` will NOT be used.
+The value of `requestHeaders` should be: `<service.namespace.svc.cluster.local>`. Adjust the value for your specific environment.
+
+When `use-cluster-ip` is set to `true`, NGINX forwards requests to the service IP. In our example above, that would be `tea-svc` and `coffee-svc`.
+
+Here is a simple example of what your `upstream` section will look like now in `virtualServer/virtualServerRoute`:
+
+```yaml
+upstreams:
+  - name: tea
+    service: tea-svc
+    port: 80
+    use-cluster-ip: true
+  - name: coffee
+    service: coffee-svc
+    port: 80
+    use-cluster-ip: true
+```
+
+NGINX Ingress `upstreams` will be populated with the `Service/cluster IP`. In the example above, the service/cluster IPs for `tea-svc` and `coffee-svc` will be added to the `upstream` configuration as the `server` addresses.
+
+Now we can test our NGINX Ingress with Istio setup with a simple curl request to our application.
+
+```shell
+curl -kI https://cafe.example.com/coffee
+
+HTTP/1.1 200 OK
+Server: nginx/1.19.5
+Date: Thu, 25 Mar 2021 18:47:21 GMT
+Content-Type: text/plain
+Content-Length: 159
+Connection: keep-alive
+expires: Thu, 25 Mar 2021 18:47:20 GMT
+cache-control: no-cache
+x-envoy-upstream-service-time: 0
+x-envoy-decorator-operation: coffee-svc.nginx-ingress.svc.cluster.local:80/*
+```
+
+We can see in the above output that our curl request is sent and received by NGINX Ingress Controller. We can see that the envoy sidecar proxy sends the request to the service IP to the application (coffee). The full request is complete and correct. Now we have a full working NGINX+ Ingress with Istio as the sidecar proxies are deployed.
+
+## Additional Technical information details
+
+By default, for NGINX Ingress Controller, we populate the upstream server addresses with the endpoint IPs of the pods.
+
+When using the new `use-cluster-ip` feature, we will now populate the upstream with the `service` IP address, instead of the endpoint IP addresses.
+
+In the 1.11 release, NGINX Ingress controller will only send one host header, depending on how you configure Ingress. By default NGINX Ingress Controller will send `proxy_set_header $host`. If Ingress has been configured with `action.proxy.requestHeaders` this ensures that only one set of headers will be sent to the upstream server. In summary, by setting `action.proxy.requestHeaders` in the `VirtualServer` CRD, NGINX Ingress will only send the specified headers that have been defined.
+
+Here is the output of `nginx -T` to show our upstreams and proxy_set_header values.
+The server IP address the upstream is the IP address of the service for that given application.
+
+```nginx
+upstream vs_nginx-ingress_cafe_tea {
+    zone vs_nginx-ingress_cafe_tea 256k;
+    random two least_conn;
+    server 10.96.222.104:80 max_fails=1 fail_timeout=10s max_conns=0;
+}
+
+upstream vs_nginx-ingress_cafe_coffee {
+    zone vs_nginx-ingress_cafe_coffee 256k;
+    random two least_conn;
+    server 10.96.252.249:80 max_fails=1 fail_timeout=10s max_conns=0;
+}
+
+server {
+    listen 80;
+
+    location /tea {
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $vs_connection_header;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_set_header Host "tea-svc.nginx-ingress.svc.cluster.local";
+    }
+
+    location /coffee {
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $vs_connection_header;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_set_header Host "coffee-svc.nginx-ingress.svc.cluster.local";
+    }
+}
+```
diff --git a/content/nic/tutorials/nginx-ingress-linkerd.md b/content/nic/tutorials/nginx-ingress-linkerd.md
new file mode 100644
index 000000000..9910e9ef8
--- /dev/null
+++ b/content/nic/tutorials/nginx-ingress-linkerd.md
@@ -0,0 +1,181 @@
+---
+docs: DOCS-1450
+doctypes:
+- concept
+title: NGINX Ingress Controller and Linkerd
+toc: true
+weight: 1800
+---
+
+This document explains how to integrate NGINX Ingress Controller with Linkerd using Linkerd's sidecar proxy. Linkerd works with both NGINX Ingress Controller open source and NGINX Ingress Controller using NGINX Plus.
+
+---
+
+## Before you Begin
+
+There are two methods provided in this tutorial:
+
+- Adding Linkerd to a new NGINX Ingress Controller Installation
+- Adding Linkerd to an Existing NGINX Ingress Controller Installation
+
+If you are adding Linkerd to an existing installation, these are the requirements:
+
+- A working NGINX Ingress Controller instance.
+- A working [Linkerd installation](https://linkerd.io/2.13/getting-started/).
+
+---
+
+## Integrating Linkerd
+
+Linkerd integrates with NGINX Ingress Controller using its control plane utility through injection.
+
+You can do this through the use of NGINX Ingress Controller's custom resource definitions (CRDs) in a Kubernetes Manifest, or Helm.
+
+---
+
+### During Installation
+
+**Using Manifests**
+
+When installing NGINX Ingress Controller, you can [create a custom resource](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/#3-create-custom-resources) for Linkerd.
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-ingress
+  namespace: nginx-ingress
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx-ingress
+  template:
+    metadata:
+      annotations:
+        linkerd.io/inject: enabled
+      labels:
+        app: nginx-ingress
+        app.kubernetes.io/name: nginx-ingress
+```
+
+**Using Helm**
+
+Add the following annotation to your Helm deployment:
+
+```yaml
+controller:
+  pod:
+    ## The annotations of the Ingress Controller pod.
+    annotations: { linkerd.io/inject: enabled }
+```
+
+This annotation will instruct `helm` to tell `Linkerd` to automatically inject its sidecar during the installation of NGINX Ingress Controller.
+
+---
+
+### With an Existing Installation
+
+To integrate Linkerd with an existing NGINX Ingress Controller installation, you will need to inject the `Linkerd` sidecar, using its `linkerd` control plane utility.
+
+**Using Manifests**
+
+If you want to inject into an existing Manifest-based installation, you can run the following:
+
+```bash
+kubectl get deployment -n nginx-ingress nginx-ingress -o yaml | linkerd inject - | kubectl apply -f -
+```
+
+**Using Helm**
+If you want to inject into an existing `Helm` installation, you can run the following:
+
+```bash
+kubectl get deployment -n <name_of_namespace> <name_of_helm_release> -o yaml | linkerd inject - | kubectl apply -f -
+```
+
+In this example, the `helm` release named `kic01-nginx-ingress-controller` is injected into the `nginx-ingress` namespace:
+
+```bash
+kubectl get deploy -n nginx-ingress kic01-nginx-ingress-controller -o yaml | linkerd inject - | kubectl apply -f -
+```
+
+## Testing the Integration
+
+Once NGINX Ingress Controller has been integrated with Linkerd, we can check the number of pods to confirm that the sidecar has successfully injected.
+
+```bash
+kubectl get pods -n nginx-ingress
+
+NAME                                              READY   STATUS    RESTARTS   AGE
+kic01-nginx-ingress-controller-5f8c9b586d-ng4r8   2/2     Running   0          30m
+```
+
+In the above example, `2/2` displays the number of pods, and confirms the `Linkerd` sidecar has successfully injected into NGINX Ingress Controller.
+
+For additional testing, we can install an example application. In this case, we'll use the `httpbin` image.
+
+```bash
+kubectl create ns httpbin
+curl -sL https://raw.githubusercontent.com/openservicemesh/osm-docs/release-v1.2/manifests/samples/httpbin/httpbin.yaml
+kubectl apply -f httpbin.yaml
+```
+
+Once `httpbin` has been created and applied, we can inject it into an existing deployment with the following command:
+
+```bash
+kubectl get deployment -n httpbin httpbin -o yaml | linkerd inject - | kubectl apply -f -
+```
+
+Like the main installation, you can check the number of pods to confirm that the application has been successfully injected using the `linkerd` sidecar:
+
+```bash
+kubectl get pods -n httpbin
+NAME                       READY   STATUS    RESTARTS   AGE
+httpbin-66df5bfbc9-ffhdp   2/2     Running   0          67s
+```
+
+Next, we are going to create `virtualserver` resource for NGINX Ingress controller.
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: httpbin
+  namespace: httpbin
+spec:
+  host: httpbin.example.com
+  tls:
+    secret: httpbin-secret
+  upstreams:
+  - name: httpbin
+    service: httpbin
+    port: 14001
+    use-cluster-ip: true
+  routes:
+  - path: /
+    action:
+      pass: httpbin
+```
+
+The `use-cluster-ip` is required when using the Linkerd sidecar proxy.
+
+We can now start sending traffic to NGINX Ingress Controller, to verify that `Linkerd` is handling the sidecar traffic connections.
+
+```bash
+curl -k https://httpbin.example.com -I
+
+HTTP/1.1 200 OK
+Server: nginx/1.23.4
+Date: Sat, 20 May 2023 00:08:31 GMT
+Content-Type: text/html; charset=utf-8
+Content-Length: 9593
+Connection: keep-alive
+access-control-allow-credentials: true
+access-control-allow-origin: *
+```
+
+You can additionally view the status of NGINX Ingress Controller and Linkerd by using the Viz dashboard provided by Linkerd.
+
+```bash
+linkerd viz dashboard
+```
diff --git a/content/nic/tutorials/nginx-ingress-osm.md b/content/nic/tutorials/nginx-ingress-osm.md
new file mode 100644
index 000000000..7c5b55b0b
--- /dev/null
+++ b/content/nic/tutorials/nginx-ingress-osm.md
@@ -0,0 +1,459 @@
+---
+docs: DOCS-1181
+doctypes:
+- concept
+title: NGINX Ingress Controller and Open Service Mesh
+toc: true
+weight: 1800
+---
+
+
+This document outlines how to integrate F5 NGINX Ingress Controller with Open Service Mesh (OSM)
+
+Open Service Mesh will work with both versions of [F5 NGINX Ingress controller](https://github.com/nginx/kubernetes-ingress): the free as well as the NGINX Plus versions.
+
+Below is a link to the official F5 NGINX Ingress Controller documentation.
+[F5 NGINX Ingress controller](https://docs.nginx.com/nginx-ingress-controller/)
+
+# Integrating NGINX Ingress Controller with Open Service Mesh
+
+There are two ways to integrate NGINX Ingress Controller with Open Service Mesh (OSM):
+
+1. Injecting an envoy sidecar directly with NGINX Ingress Controller.
+2. Using the Open Service Mesh `ingressBackend` "proxy" feature.
+
+# NGINX Ingress controller and OSM with sidecar proxy injected
+
+Install OSM in the cluster
+
+```shell
+osm install --mesh-name osm-nginx --osm-namespace osm-system
+```
+
+### Mark the F5 NGINX Ingress controller namespace for sidecar injection
+
+*NOTE:* Depending on how you install NGINX Ingress controller, you might need to create the `namespace`. For example, if you are using manifests to install NGINX Ingress controller, you can complete all of the steps on our documentation page, *EXCEPT*, actually deploying NGINX Ingress controller. This is because, when using the sidecar approach, OSM needs to "manage" the namespace so it knows what `namespaces` it needs to inject sidecars into.
+
+Next thing we need to do is install OSM into the `NGINX Ingress controller` namespace so that the `envoy` sidecar will be injected into NGINX Ingress controller.
+First, create the `nginx-ingress` namespace:
+
+```shell
+kubectl create ns nginx-ingress
+```
+
+Then "mark" the `nginx-ingress` namespace for OSM to deploy a sidecar.
+
+```shell
+osm namespace add nginx-ingress --mesh-name osm-nginx
+```
+
+The above command will use the mark the `nginx-ingress` namespace, where OSM will be installed (sidecar)
+
+# Install F5 NGINX Ingress controller
+
+Links to the complete install guides:
+
+[Using Helm to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-helm/)
+[Using Manifests to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
+
+When using the sidecar method, ensure that you add the correct annotations listed below. This ensures proper integration of NGINX Ingress Controller with the envoy sidecar proxy.
+
+## Helm installs
+
+If using `helm`, add the following `annotation` to your `values.yaml` file:
+
+Under `controller.pod.annotations`:
+
+```yaml
+pod:
+  annotations: {
+    openservicemesh.io/inbound-port-exclusion-list: "80, 443"
+    }
+```
+
+You can also use the `set` command available with `helm` to set these at install time.
+
+```shell
+helm install nic01 nginx-stable/nginx-ingress -n nginx-ingress --create-namespace --set controller.pod.annotations.'openservicemesh\.io/inbound\-port\-exclusion\-list=\{ "80"\, "443"\ }'
+```
+
+Change your `release` accordingly to match your environment.
+
+## Manifest installs
+
+For your `manifest` deployments, add the following `annotation`.
+
+```yaml
+annotations:
+  openservicemesh.io/inbound-port-exclusion-list: "80,443"
+```
+
+### Sample deployment file with required annotation
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-ingress
+  namespace: nginx-ingress
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx-ingress
+  template:
+    metadata:
+      labels:
+        app: nginx-ingress
+      annotations:
+        openservicemesh.io/inbound-port-exclusion-list: "80,443"
+```
+
+This annotation is *required* when injecting envoy sidecar into NGINX Ingress controller.
+`InboundPortExclusionList` defines a global list of ports to exclude from inbound traffic interception by the sidecar proxy.
+
+### Install a Test Application
+
+To test the integration, we will use the `httpbin` sample application from the [Ingress With Kubernetes NGINX Ingress Controller](https://release-v1-2.docs.openservicemesh.io/docs/demos/ingress_k8s_nginx/) guide.
+
+The following three commands will create the namespace for the application, add the namespace to OSM for monitoring, then install the application.
+
+```shell
+kubectl create ns httpbin
+osm namespace add httpbin --mesh-name osm-nginx
+kubectl apply -f https://raw.githubusercontent.com/openservicemesh/osm-docs/release-v1.2/manifests/samples/httpbin/httpbin.yaml -n httpbin
+```
+
+### Verify that the envoy sidecar has been *injected* into NGINX Ingress Controller
+
+```shell
+kubectl get pods -n nginx-ingress
+NAME                             READY   STATUS    RESTARTS       AGE
+nginx-ingress-7b9557ddc6-zw7l5   2/2     Running   1 (5m8s ago)   5m19s
+```
+
+2/2 shows we have two containers in the NGINX Ingress controller pod: NGINX Ingress and Envoy
+
+Configure your NGINX VirtualServer yaml to similar below
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: httpbin
+  namespace: httpbin
+spec:
+  host: httpbin.example.com
+  tls:
+    secret: secret01
+  upstreams:
+  - name: httpbin
+    service: httpbin
+    port: 14001
+    use-cluster-ip: true
+  routes:
+  - path: /
+    action:
+      proxy:
+        upstream: httpbin
+        requestHeaders:
+          set:
+          - name: Host
+            value: httpbin.httpbin.svc.cluster.local
+```
+
+Test your configuration:
+
+```shell
+ curl  http://httpbin.example.com/get -v
+*   Trying 172.19.0.2:80...
+* TCP_NODELAY set
+* Connected to httpbin.example.com (172.19.0.2) port 80 (#0)
+> GET /get HTTP/1.1
+> Host: httpbin.example.com
+> User-Agent: curl/7.68.0
+> Accept: */*
+>
+* Mark bundle as not supporting multiuse
+< HTTP/1.1 200 OK
+< Server: nginx/1.23.3
+< Date: Sun, 19 Feb 2023 19:06:47 GMT
+< Content-Type: application/json
+< Content-Length: 454
+< Connection: keep-alive
+< access-control-allow-origin: *
+< access-control-allow-credentials: true
+< x-envoy-upstream-service-time: 2
+<
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Host": "httpbin.httpbin.svc.cluster.local",
+    "Osm-Stats-Kind": "Deployment",
+    "Osm-Stats-Name": "httpbin",
+    "Osm-Stats-Namespace": "httpbin",
+    "Osm-Stats-Pod": "httpbin-78555f5c4b-t6qln",
+    "User-Agent": "curl/7.68.0",
+    "X-Envoy-Internal": "true",
+    "X-Forwarded-Host": "httpbin.example.com"
+  },
+  "origin": "172.19.0.1",
+  "url": "http://httpbin.example.com/get"
+}
+* Connection #0 to host httpbin.example.com left intact
+```
+
+## Using The Open Service Mesh `ingressBackend` "proxy" Feature
+
+Install OSM into the cluster.
+By running the following command, you will install OSM into the cluster with the mesh name `osm-nginx` using the `osm-system` namespace.
+
+```shell
+osm install --mesh-name osm-nginx --osm-namespace osm-system
+```
+
+Once OSM has been installed, this next command will mark NGINX Ingress Controller as part of the OSM mesh, while also disabling sidecar injection.
+*NOTE*: The nginx-ingress name can be created as part of the NGINX Ingress install process, or manually. If you are creating it manually, the namespace must created before you "add" the namespace to Open Service Mesh.
+
+```shell
+osm namespace add nginx-ingress --mesh-name osm-nginx --disable-sidecar-injection
+```
+
+# Install F5 NGINX Ingress controller
+
+Links to the complete install guides:
+
+[Using Helm to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-helm/)
+[Using Manifests to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
+
+*NOTE*: This method does NOT require annotations added to the deployment, compared to the sidecar install method.
+
+### Install a Test Application
+
+To test the integration, we will use the `httpbin` sample application from the [Ingress With Kubernetes NGINX Ingress Controller](https://release-v1-2.docs.openservicemesh.io/docs/demos/ingress_k8s_nginx/) guide.
+
+The following three commands will create the namespace for the application, add the namespace to OSM for monitoring, then install the application.
+
+```shell
+kubectl create ns httpbin
+osm namespace add httpbin --mesh-name osm-nginx
+kubectl apply -f https://raw.githubusercontent.com/openservicemesh/osm-docs/release-v1.2/manifests/samples/httpbin/httpbin.yaml -n httpbin
+```
+
+### mTLS Setup
+
+To enable mTLS for NGINX Ingress Controller and OSM, you need to configure the `IngressBackend` API to use `https` as the backend protocol as and trigger OSM to issue a certificate. NGINX will use this certificate to proxy HTTPS connections to the TLS backends. The client certificate and certificate authority (CA) certificate will be stored in a Kubernetes secret that NGINX will use for authentication."
+
+To begin, edit the `osm-mesh-config` resource:
+
+```shell
+kubectl edit meshconfig osm-mesh-config -n osm-system
+```
+
+You will need to update under `certificate` to look like this:
+
+```yaml
+spec:
+  certificate:
+    ingressGateway:
+      secret:
+        name: osm-nginx-client-cert
+        namespace: osm-system
+      subjectAltNames:
+      - nginx-ingress.nginx-ingress.cluster.local
+      validityDuration: 24h
+```
+
+This will generate a new client certificate (osm-nginx-client-cert) that NGINX Ingress controller will use for mTLS.
+The *SAN*, `subjectAltNames`, is the following form:
+
+```shell
+<service_account>.<namespace>.cluster.local
+```
+
+With the above OSM mesh config changed, that secret will be created in the `osm-system` namespace.
+There will also be the `osm-ca-bundle` secret as well, which is autogenerated by OSM.
+
+```shell
+kubectl get secrets -n osm-system
+NAME                              TYPE                 DATA   AGE
+osm-ca-bundle                     Opaque               2      37m
+osm-nginx-client-cert             kubernetes.io/tls    3      17m
+```
+
+Now, we need to "export" out these certificates in order to use them with NGINX Ingress Controller.
+
+```shell
+kubectl get secret osm-ca-bundle -n osm-system -o yaml > osm-ca-bundle-secret.yaml
+kubectl get secret osm-nginx-client-cert -n osm-system -o yaml > osm-nginx-client-cert.yaml
+```
+
+We need to edit the two exported out .yaml files and change a few parts.
+
+Edit `osm-ca-bundle-secret.yaml`
+Remove the `private.key` section under `data.`
+Change the `namespace` field to your nginx-ingress location
+Change the `type` to `type: nginx.org/ca`
+
+Updated file should look like the following.
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: osm-ca-bundle
+  namespace: nginx-ingress
+type: nginx.org/ca
+data:
+  ca.crt: <ca_cert_data>
+```
+
+Edit `osm-nginx-client-cert.yaml`
+Remove the `ca.crt` in the `data` section
+Change the namespace to the nginx-ingress namespace.
+
+Updated file should look like the following.
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: osm-nginx-client-cert
+  namespace: nginx-ingress
+type: kubernetes.io/tls
+data:
+  tls.crt: <tls_crt_data>
+  tls.key: <tls_key_data>
+```
+
+Then apply these two secrets to the cluster.
+
+```shell
+kubectl apply -f osm-ca-bundle-secret.yaml
+kubectl apply -f osm-nginx-client-cert.yaml
+```
+
+Ensure the secrets exist in the `nginx-ingress` namespace:
+
+```shell
+kubectl get secrets -n nginx-ingress
+NAME                    TYPE                DATA   AGE
+osm-nginx-client-cert   kubernetes.io/tls   2      23m
+osm-ca-bundle           nginx.org/ca        1      23m
+```
+
+We now need to create our CRDs (virtualServer and policy).
+Here is the `policy` resource that holds the mTLS information.
+Make sure you apply the `policy` or the  mTLS connection will not work. (required for virtualServer)
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: osm-mtls
+  namespace: nginx-ingress
+spec:
+  egressMTLS:
+    tlsSecret: osm-nginx-client-cert
+    trustedCertSecret: osm-ca-bundle
+    verifyDepth: 2
+    verifyServer: on
+    sslName: httpbin.httpbin.cluster.local
+```
+
+Here is an example `virtualServer` resource as well as the `ingressBackend`.
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: httpbin
+  namespace: httpbin
+spec:
+  policies:
+    - name: osm-mtls
+      namespace: nginx-ingress
+  host: httpbin.example.com
+  tls:
+    secret: secret01
+  upstreams:
+  - name: httpbin
+    service: httpbin
+    port: 14001
+    tls:
+      enable: true
+  routes:
+  - path: /
+    action:
+      pass: httpbin
+---
+kind: IngressBackend
+apiVersion: policy.openservicemesh.io/v1alpha1
+metadata:
+  name: httpbin
+  namespace: httpbin
+spec:
+  backends:
+  - name: httpbin
+    port:
+      number: 14001 # targetPort of httpbin service
+      protocol: https
+    tls:
+      skipClientCertValidation: false
+  sources:
+  - kind: Service
+    namespace: nginx-ingress
+    name: nginx-ingress
+  - kind: AuthenticatedPrincipal
+    name: nginx-ingress.nginx-ingress.cluster.local
+```
+
+Once these are applied, verify they are valid (virtualServer) and committed (ingressBackend):
+
+```shell
+kubectl get vs,ingressbackend -A
+NAMESPACE   NAME                                  STATE   HOST                  IP    PORTS   AGE
+httpbin     virtualserver.k8s.nginx.org/httpbin   Valid   httpbin.example.com                 26m
+
+NAMESPACE   NAME                                               STATUS
+httpbin     ingressbackend.policy.openservicemesh.io/httpbin   committed
+```
+
+You can now send traffic through NGINX Ingress Controller with open service mesh.
+
+```shell
+curl http://httpbin.example.com/get -v
+*   Trying 172.18.0.2:80...
+* TCP_NODELAY set
+* Connected to httpbin.example.com (172.18.0.2) port 80 (#0)
+> GET /get HTTP/1.1
+> Host: httpbin.example.com
+> User-Agent: curl/7.68.0
+> Accept: */*
+>
+* Mark bundle as not supporting multiuse
+< HTTP/1.1 200 OK
+< Server: nginx/1.23.3
+< Date: Sat, 18 Feb 2023 22:41:27 GMT
+< Content-Type: application/json
+< Content-Length: 280
+< Connection: keep-alive
+< access-control-allow-origin: *
+< access-control-allow-credentials: true
+< x-envoy-upstream-service-time: 1
+<
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Host": "httpbin.example.com",
+    "User-Agent": "curl/7.68.0",
+    "X-Envoy-Internal": "true",
+    "X-Forwarded-Host": "httpbin.example.com"
+  },
+  "origin": "172.18.0.1",
+  "url": "http://httpbin.example.com/get"
+}
+* Connection #0 to host httpbin.example.com left intact
+```
diff --git a/content/nic/tutorials/oidc-custom-configuration.md b/content/nic/tutorials/oidc-custom-configuration.md
new file mode 100644
index 000000000..460f88070
--- /dev/null
+++ b/content/nic/tutorials/oidc-custom-configuration.md
@@ -0,0 +1,214 @@
+---
+title: Customize OIDC Configuration with NGINX Ingress Controller
+weight: 1800
+toc: true
+type: how-to
+product: NIC
+docs: DOCS-000
+---
+
+The F5 NGINX Ingress Controller implements OpenID Connect (OIDC) using the NGINX OpenID Connect Reference implementation: [nginx-openid-connect](https://github.com/nginxinc/nginx-openid-connect).
+
+This guide will walk through how to customize and configure this default implementation.
+
+## Prerequisites
+
+This guide assumes that you have an F5 NGINX Ingress Controller deployed. If not, please follow the installation steps using either the [Manifest]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) or [Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) approach.
+
+To customize the NGINX OpenID Connect Reference implementation, you will need to:
+
+1. Create a ConfigMap containing the contents of the default `oidc.conf` file
+2. Attach a `Volume` and `VolumeMount` to your deployment of the F5 NGINX Ingress Controller
+
+This setup will allow the custom configuration in your ConfigMap to override the contents of the default `oidc.conf` file.
+
+## Step 1 - Creating the ConfigMap
+
+Run the below command to generate a ConfigMap with the contents of the `oidc.conf` file.
+**NOTE** The ConfigMap must be deployed in the same `namespace` as the F5 NGINX Ingress Controller.
+
+```console
+kubectl create configmap oidc-config-map --from-literal=oidc.conf="$(curl -k https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/internal/configs/oidc/oidc.conf)"
+```
+
+Use the `kubectl describe` command to confirm the contents of the ConfigMap are correct.
+
+```shell
+kubectl describe configmap oidc-config-map
+```
+
+```yaml
+Name:         oidc-config-map
+Namespace:    default
+Labels:       <none>
+Annotations:  <none>
+
+Data
+====
+oidc.conf:
+docs: "DOCS-1448"
+----
+    # Advanced configuration START
+    set $internal_error_message "NGINX / OpenID Connect login failure\n";
+    set $pkce_id "";
+    # resolver 8.8.8.8; # For DNS lookup of IdP endpoints;
+    subrequest_output_buffer_size 32k; # To fit a complete tokenset response
+    gunzip on; # Decompress IdP responses if necessary
+    # Advanced configuration END
+
+    ...
+    # Rest of configuration file truncated
+```
+
+## Step 2 - Customizing the default configuration
+
+Once the contents of the `oidc.conf` file has been added to the ConfigMap, you are free to customize the contents of this ConfigMap.
+This example demonstrates adding a comment to the top of the file. The comment will be shown at the top of the `oidc.conf` file.
+This comment will be `# >> Custom Comment for my OIDC file <<`
+
+```shell
+kubectl edit configmap oidc-config-map
+```
+
+Add the custom content:
+
+```yaml
+# Please edit the object below. Lines beginning with a '#' will be ignored,
+# and an empty file will abort the edit. If an error occurs while saving this file will be
+# reopened with the relevant failures.
+#
+apiVersion: v1
+data:
+  oidc.conf: |2-
+        # >> Custom Comment for my OIDC file <<
+        # Advanced configuration START
+        set $internal_error_message "NGINX / OpenID Connect login failure\n";
+        set $pkce_id "";
+        # resolver 8.8.8.8; # For DNS lookup of IdP endpoints;
+        subrequest_output_buffer_size 32k; # To fit a complete tokenset response
+        gunzip on; # Decompress IdP responses if necessary
+        # Advanced configuration END
+
+        ...
+        # Rest of configuration file truncated
+```
+
+{{< important >}}
+
+In the next step, NGINX Ingress Controller will be deployed using this ConfigMap.
+
+Any changes made to this ConfigMap must be made **before** deploying or updating NGINX Ingress Controller. If an update is applied to the ConfigMap after NGINX Ingress Controller is deployed, it will not be applied.
+
+Applying any updates to the data in this ConfigMap will require NGINX Ingress Controller to be re-deployed.
+
+{{< /important >}}
+
+## Step 3 - Add Volume and VolumeMount to the Ingress Controller deployment
+
+In this step we will add a `Volume` and `VolumeMount` to the NGINX Ingress Controller deployment.
+This will allow you to mount the ConfigMap created in Step 1 and overwrite the contents of the `oidc.conf` file.
+
+This document will demonstrate how to add the `Volume` and `VolumeMount` using both Manifest and HELM
+
+### Manifest
+
+The below configuration shows where the `Volume` and `VolumeMount` can be added to your Deployment/Daemonset file.
+
+The `VolumeMount` must be added the `spec.template.spec.containers` section.
+
+The `Volume` must be added the `spec.template.spec` section:
+
+```yaml
+apiVersion: apps/v1
+kind: <Deployment/Daemonset>
+metadata:
+  name: <name>
+  namespace: <ic-namespace>
+spec:
+  ...
+  ...
+  template:
+    ...
+    ...
+    spec:
+      ...
+      ...
+      volumes:
+      - name: oidc-volume
+        configMap:
+          name: <config-map-name> # Must match the name of the ConfigMap
+      containers:
+        ...
+        ...
+        volumeMounts:
+        - name: oidc-volume
+          mountPath: /etc/nginx/oidc/oidc.conf
+          subPath: oidc.conf # Must match the name in the data filed
+          readOnly: true
+```
+
+Once the `Volume` and `VolumeMount` has been added the manifest file, apply the changes to the Ingress Controller deployment.
+
+Confirm the `oidc.conf` file has been updated:
+
+```shell
+kubectl exec -it -n <ic-namespace> <ingess-controller-pod> -- cat /etc/nginx/oidc/oidc.conf
+```
+
+### Helm
+
+Deployments using helm will need to edit their existing
+Edit the NGINX Ingress Controller Deployment/Daemonset yaml to include a `Volume` and `VolumeMount`.
+
+The `Volume` should be within the `spec.template.spec` section.
+
+The `VolumeMount`must be added the `spec.template.spec.containers` section.
+
+For Deployments:
+
+```shell
+kubectl edit deployments <name-of-deployment> -n <ic-namespace>
+```
+
+For Daemonsets:
+
+```shell
+kubectl edit daemonset <name-of-daemonset> -n <ic-namespace>
+```
+
+```yaml
+apiVersion: apps/v1
+kind: <Deployment/Daemonset>
+metadata:
+  name: <name>
+  namespace: <ic-namespace>
+spec:
+  ...
+  ...
+  template:
+    ...
+    ...
+    spec:
+      ...
+      ...
+      volumes:
+      - name: oidc-volume
+        configMap:
+          name: <config-map-name> # Must match the name of the ConfigMap
+      containers:
+        ...
+        ...
+        volumeMounts:
+        - name: oidc-volume
+          mountPath: /etc/nginx/oidc/oidc.conf
+          subPath: oidc.conf # Must match the name in the data filed
+          readOnly: true
+```
+
+Once the Deployment/Daemonset has been edited, save the file and exit.
+
+Confirm the `oidc.conf` file has been updated:
+
+```shell
+kubectl exec -it -n <ic-namespace> <ingess-controller-pod> -- cat /etc/nginx/oidc/oidc.conf
+```
diff --git a/content/nic/tutorials/security-monitoring.md b/content/nic/tutorials/security-monitoring.md
new file mode 100644
index 000000000..a859b7b58
--- /dev/null
+++ b/content/nic/tutorials/security-monitoring.md
@@ -0,0 +1,96 @@
+---
+doctypes:
+- concept
+title: Connect NGINX App Protect WAF to NGINX Security Monitoring
+toc: true
+weight: 1800
+---
+
+This document explains how to use NGINX Ingress Controller to configure NGINX Agent for sending F5 NGINX App Protect WAF metrics to NGINX Security Monitoring.
+
+## Prerequisites
+
+This guide assumes that you have an installation of NGINX Instance Manager with [NGINX Security Monitoring](https://docs.nginx.com/nginx-instance-manager/monitoring/security-monitoring/deploy/install-security-monitoring/) which is reachable from the Kubernetes cluster on which NGINX Ingress Controller is deployed.
+
+If you use custom container images, NGINX Agent must be installed along with NGINX App Protect WAF. See the [Dockerfile](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/build/Dockerfile) for examples of how to install NGINX Agent or the [NGINX Agent installation documentation](https://docs.nginx.com/nginx-agent/installation-upgrade/) for more information.
+
+## Deploying NGINX Ingress Controller with NGINX Agent configuration
+
+{{<tabs name="deploy-config-resource">}}
+
+{{%tab name="Using Helm"%}}
+
+1. Add the below arguments to the `values.yaml` file:
+    ```yaml
+    nginxAgent:
+        enable: true
+        instanceManager:
+            host: "<FQDN or IP address of NGINX Instance Manager>"
+    ```
+
+2. Follow the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) instructions to deploy NGINX Ingress Controller with custom resources enabled, and optionally set other `nginxAgent.*` values if required.
+
+{{%/tab%}}
+
+{{%tab name="Using Manifests"%}}
+
+1. Add the below argument to the manifest file of NGINX Ingress Controller:
+
+    ```yaml
+    args:
+      - -agent=true
+      - -agent-instance-group=<NGINX Ingress Controller deployment name>
+    ```
+
+2. Create a ConfigMap with an `nginx-agent.conf` file which must be mounted to `/etc/nginx-agent/nginx-agent.conf` in the NGINX Ingress Controller pod.
+   ```yaml
+    kind: ConfigMap
+    apiVersion: v1
+    metadata:
+      name: <configmap name>
+      namespace: <namespace where NGINX Ingress Controller will be installed>
+    data:
+      nginx-agent.conf: |-
+        log:
+          level: error
+          path: ""
+        server:
+          host: "<FQDN or IP address of NGINX Instance Manager>"
+          grpcPort: 443
+        features:
+        - registration
+        - nginx-counting
+        - metrics-sender
+        - dataplane-status
+        extensions:
+        - nginx-app-protect
+        - nap-monitoring
+        nginx_app_protect:
+          report_interval: 15s
+          precompiled_publication: true
+        nap_monitoring:
+          collector_buffer_size: 20000
+          processor_buffer_size: 20000
+          syslog_ip: 127.0.0.1
+          syslog_port: 1514
+   ```
+   See the [NGINX Agent Configuration Overview](https://docs.nginx.com/nginx-agent/configuration/configuration-overview/) for more configuration options.
+
+{{< note >}} The `features` list must not contain `nginx-config-async` or `nginx-ssl-config` as these features can cause conflicts with NGINX Ingress Controller.{{< /note >}}
+
+3. Follow the [Installation with Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) instructions to deploy NGINX Ingress Controller with custom resources enabled.
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+Once NGINX Ingress Controller is installed the pods will be visible in the NGINX Instance Monitoring Instances dashboard.
+
+## Configuring NGINX App Protect WAF to send metrics to NGINX Agent
+
+NGINX Agent runs a syslog listener which NGINX App Protect WAF can be configured to send logs to, which will then allow NGINX Agent to send metrics to NGINX Security Monitoring. The following examples show how to configure NGINX App Protect WAF to log to NGINX Agent.
+
+- [Custom Resources example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/security-monitoring)
+- [Ingress Resources example](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/security-monitoring)
+
+{{< note >}} Modifying the APLogConf in the examples may result in the Security Monitoring integration not working, as NGINX Agent expects a specific log format.{{< /note >}}
diff --git a/content/nic/tutorials/virtual-server-with-custom-listener-ports.md b/content/nic/tutorials/virtual-server-with-custom-listener-ports.md
new file mode 100644
index 000000000..e1f2621b1
--- /dev/null
+++ b/content/nic/tutorials/virtual-server-with-custom-listener-ports.md
@@ -0,0 +1,185 @@
+---
+title: Configuring VirtualServer with custom HTTP and HTTPS listener ports
+toc: true
+weight: 1800
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1452
+---
+
+This tutorial outlines how to configure and deploy a VirtualServer resource with custom HTTP and HTTPS listener ports.
+
+## Configuring a VirtualServer with custom HTTP and HTTPS listener ports.
+
+VirtualServer can explicitly define custom HTTP and HTTPS listener ports using the `spec.listener.http` and `spec.listener.https` fields.
+Each field must reference a valid listener defined by in a [GlobalConfiguration]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}) resource.
+
+## Deploy GlobalConfiguration
+
+1. Create a yaml file called `nginx-configuration.yaml` with the below content:
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: GlobalConfiguration
+metadata:
+  name: nginx-configuration
+  namespace: nginx-ingress
+spec:
+  listeners:
+  - name: http-8083
+    port: 8083
+    protocol: HTTP
+  - name: https-8443
+    port: 8443
+    protocol: HTTP
+    ssl: true
+```
+
+2. Deploy `nginx-configuration.yaml` file:
+```shell
+kubectl apply -f nginx-configuration.yaml
+```
+
+## Deploying NGINX Ingress Controller with GlobalConfiguration resource
+
+{{<tabs name="deploy-config-resource">}}
+
+{{%tab name="Using Helm"%}}
+
+1. Add the below arguments to the `values.yaml` file in `controller.globalConfiguration`:
+    ```yaml
+    spec:
+      listeners:
+      - name: http-8083
+        port: 8083
+        protocol: HTTP
+      - name: https-8443
+        port: 8443
+        protocol: HTTP
+        ssl: true
+    ```
+
+1. Follow the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) instructions to deploy the NGINX Ingress Controller with custom resources enabled.
+
+1. Ensure your NodePort or LoadBalancer service is configured to expose the custom listener ports. This is set in the `customPorts` section under `controller.service.customPorts`:
+
+    ```yaml
+    customPorts:
+      - name: http-8083
+        port: 8083
+        protocol: TCP
+        targetPort: 8083
+      - name: https-8443
+        port: 8443
+        protocol: TCP
+        targetPort: 8443
+    ```
+
+{{%/tab%}}
+
+{{%tab name="Using Manifests"%}}
+
+1. Add the below argument to the manifest file of NGINX Ingress Controller:
+
+    ```yaml
+    args:
+      - -$(POD_NAMESPACE)/nginx-configuration
+    ```
+
+2. Follow the [Installation with Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) instructions to deploy NGINX Ingress Controller with custom resources enabled.
+
+3. Ensure your NodePort or LoadBalancer service is configured to expose the custom listener ports. Below is an example yaml configuration using NodePort, which would also apply to a LoadBalancer service:
+
+    ```yaml
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: nginx-ingress
+      namespace: nginx-ingress
+    spec:
+      type: NodePort
+      ports:
+      - port: 8083
+        targetPort: 8083 # Custom HTTP listener port
+        protocol: TCP
+        name: http-8083
+      - port: 8443
+        targetPort: 8443 # Custom HTTPS listener port
+        protocol: TCP
+        name: https-8443
+      selector:
+        app: nginx-ingress
+    ```
+
+{{%/tab%}}
+
+{{</tabs>}}
+
+## Deploying VirtualServer with custom listeners
+Deploy the [custom listeners](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/custom-listeners) resources from the repository examples. It includes all required resources, including VirtualServer.
+
+Below is a snippet of the VirtualServer resource that will be deployed:
+
+```yaml
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: cafe
+spec:
+  listener:
+    http: http-8083
+    https: https-8443
+  host: cafe.example.com
+  tls:
+    secret: cafe-secret
+  upstreams:
+    ...
+```
+
+Below is a snippet of the NGINX configuration for this VirtualServer.
+
+```nginx
+server {
+    listen 8083;
+    listen [::]:8083;
+
+    server_name cafe.example.com;
+
+    set $resource_type "virtualserver";
+    set $resource_name "cafe";
+    set $resource_namespace "default";
+
+    listen 8443 ssl;
+    listen [::]:8443 ssl;
+
+    ssl_certificate /etc/nginx/secrets/default-cafe-secret;
+    ssl_certificate_key /etc/nginx/secrets/default-cafe-secret;
+}
+```
+
+## Testing custom listener ports
+
+You can test that the VirtualServer resource is deployed with non-default port configuration by explicitly defining them when sending requests.
+
+`curl` using port `8443`:
+
+```shell
+curl -k https://cafe.example.com:8443/coffee
+
+Server address: 10.32.0.40:8080
+Server name: coffee-7dd75bc79b-qmhmv
+...
+URI: /coffee
+...
+```
+
+`curl` using port `8083`:
+
+```shell
+curl -k http://cafe.example.com:8083/coffee
+
+Server address: 10.32.0.40:8080
+Server name: coffee-7dd75bc79b-qmhmv
+...
+URI: /coffee
+...
+```
diff --git a/content/nic/usage-reporting.md b/content/nic/usage-reporting.md
new file mode 100644
index 000000000..0690a2679
--- /dev/null
+++ b/content/nic/usage-reporting.md
@@ -0,0 +1,294 @@
+---
+title: Enable Usage Reporting
+toc: true
+weight: 1800
+noindex: true
+headless: true
+type: how-to
+product: NIC
+docs: DOCS-1445
+---
+
+{{< important >}}
+This page is only applicable to NGINX Ingress Controller versions 3.2.0 - 3.7.2.
+
+For more recent versions of NGINX Ingress Controller, view the [Upgrade to NGINX Ingress Controller 4.0.0]({{< ref "/nic/installation/install-nic/upgrade-to-v4.md" >}}) topic.
+
+{{< /important >}}
+
+This page describes how to enable Usage Reporting for F5 NGINX Ingress Controller and how to view usage data through the API.
+
+---
+
+## Overview
+
+Usage Reporting is a Kubernetes controller that connects to the NGINX Instance Manager and reports the number of NGINX Ingress Controller nodes in the cluster. It is installed as a Kubernetes Deployment in the same cluster as NGINX Ingress Controller whose nodes you would like reported.
+
+To use Usage Reporting, you must have access to NGINX Instance Manager. For more information, see [NGINX Instance Manager](https://www.f5.com/products/nginx/instance-manager/). Usage Reporting is a requirement of the new Flexible Consumption Program for NGINX Ingress Controller.
+
+---
+
+## Requirements
+
+To deploy Usage Reporting, you must have the following:
+
+- [NGINX Ingress Controller](https://docs.nginx.com/nginx-ingress-controller) 3.2.0 - 3.7.2
+- [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager) 2.11.0 or later
+
+In addition to the software requirements, you will need:
+
+- Access to an NGINX Instance Manager username and password for basic authentication. You will need the URL of your NGINX Instance Manager system, and a username and password for Usage Reporting. The Usage Reporting user account must have access to the `/api/platform/v1/k8s-usage` endpoint.
+- Access to the Kubernetes cluster where NGINX Ingress Controller is deployed, with the ability to deploy a Kubernetes Deployment and a Kubernetes Secret.
+- Access to public internet to pull the Usage Reporting image. This image is hosted in the NGINX container registry at `docker-registry.nginx.com/cluster-connector`. You can pull the image and push it to a private container registry for deployment.
+
+[//]: # ( TODO: Update the image and tag after publish)
+
+---
+
+## Add a user account to NGINX Instance Manager
+
+Usage Reporting needs a user account to send usage data to NGINX Instance Manager: these are the steps involved.
+
+1. Create a role following the steps in [Create a Role](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/create-roles/#create-roles) section of the NGINX Instance Manager documentation. Select these permissions in step 6 for the role:
+   - Module: Instance Manager
+   - Feature: NGINX Plus Usage
+   - Access: CRUD
+
+1. Create a user account following the steps in [Add Users](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/assign-roles/#assign-roles-to-users-basic-authentication) section of the NGINX Instance Manager documentation. In step 5, assign the user to the role created above. Note that currently only "basic auth" authentication is supported for usage reporting purposes.
+
+---
+
+## Deploy Usage Reporting
+
+### Create a namespace
+
+Create the Kubernetes namespace `nginx-cluster-connector` for Usage Reporting:
+
+  ```shell
+  kubectl create namespace nginx-cluster-connector
+  ```
+
+---
+
+### Pass the credential to the NGINX Instance Manager API
+
+To make the credential available to Usage Reporting, create a Kubernetes secret. The username and password created in the previous section are required to connect the NGINX Instance Manager API.
+
+Both the username and password are stored in the Kubernetes Secret and need to be converted to base64. In this example the username will be `foo` and the password will be `bar`.
+
+To obtain the base64 representation of a string, use the following command:
+
+```shell
+echo -n 'foo' | base64
+# Zm9v
+echo -n 'bar' | base64
+# YmFy
+```
+
+Add the following content to a text editor, and insert the base64 representations of the username and password (Obtained in the previous step) to the `data` parameter:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nms-basic-auth
+  namespace: nginx-cluster-connector
+type: kubernetes.io/basic-auth
+data:
+  username: Zm9v # base64 representation of 'foo'
+  password: YmFy # base64 representation of 'bar'
+```
+
+Save this in a file named `nms-basic-auth.yaml`. In the example, the namespace is `nginx-cluster-connector` (The default namespace) and the secret name is `nms-basic-auth`.
+
+If you are using a different namespace, change the namespace in the `metadata` section of the file above.
+
+{{< note >}} Usage Reporting only supports basic-auth secret type in `data` format, not `stringData`, with the username and password encoded in base64. {{< /note >}}
+
+---
+
+### Deploy the Kubernetes secret to the Kubernetes cluster
+
+```shell
+kubectl apply -f nms-basic-auth.yaml
+```
+
+If you need to update the basic-auth credentials for NGINX Instance Manager in the future, update the `username` and `password` fields, and apply the changes by running the command again. Usage Reporting will automatically detect the changes, using the new username and password without redeployment.
+
+Download and save the deployment file [cluster-connector.yaml](https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{< nic-version >}}/examples/shared-examples/usage-reporting/cluster-connector.yaml). Edit the following under the `args` section and then save the file:
+
+```yaml
+    args:
+    - -nms-server-address=https://nms.example.com/api/platform/v1
+    - -nms-basic-auth-secret=nginx-cluster-connector/nms-basic-auth
+```
+
+- `-nms-server-address` should be the address of the Usage Reporting API, which will be the combination of NGINX Instance Manager server hostname and the URI `api/platform/v1`
+- `nms-basic-auth-secret` should be the namespace/name of the secret created in step 3: `nginx-cluster-connector/nms-basic-auth`.
+
+{{< note >}}  OpenShift requires a SecurityContextConstraints object for NGINX Cluster Connector.
+
+It can be created with the command `oc create -f scc.yaml`, using the file found in `shared-examples/` {{< /note >}}
+
+For more information, read the [Command-line arguments](#command-line-arguments) section of this page.
+
+---
+
+### Finish deployment
+
+To deploy Usage Reporting, run the following command to deploy it to your Kubernetes cluster:
+
+```shell
+kubectl apply -f cluster-connector.yaml
+```
+
+---
+
+## Viewing usage data from the NGINX Instance Manager API
+
+Usage Reporting sends the number of NGINX Ingress Controller instances and nodes in the cluster to NGINX Instance Manager. To view the usage data, query the NGINX Instance Manager API. The usage data is available at the following endpoint:
+
+
+```shell
+curl --user "foo:bar" https://nms.example.com/api/platform/v1/k8s-usage
+```
+```json
+{
+  "items": [
+    {
+      "metadata": {
+        "displayName": "my-cluster",
+        "uid": "d290f1ee-6c54-4b01-90e6-d701748f0851",
+        "createTime": "2023-01-27T09:12:33.001Z",
+        "updateTime": "2023-01-29T10:12:33.001Z",
+        "monthReturned": "May"
+      },
+      "node_count": 4,
+      "max_node_count": 5,
+      "pod_details": {
+        "current_pod_counts": {
+          "pod_count": 15,
+          "waf_count": 5,
+          "dos_count": 0
+        },
+        "max_pod_counts": {
+          "max_pod_count": 25,
+          "max_waf_count": 7,
+          "max_dos_count": 1
+        }
+      }
+    },
+    {
+      "metadata": {
+        "displayName": "my-cluster2",
+        "uid": "12tgb8ug-g8ik-bs7h-gj3j-hjitk672946hb",
+        "createTime": "2023-01-25T09:12:33.001Z",
+        "updateTime": "2023-01-26T10:12:33.001Z",
+        "monthReturned": "May"
+      },
+      "node_count": 3,
+      "max_node_count": 3,
+      "pod_details": {
+        "current_pod_counts": {
+          "pod_count": 5,
+          "waf_count": 5,
+          "dos_count": 0
+        },
+        "max_pod_counts": {
+          "max_pod_count": 15,
+          "max_waf_count": 5,
+          "max_dos_count": 0
+        }
+      }
+    }
+  ]
+}
+```
+
+If you want a friendly name for each cluster in the response, You can specify the `displayName` for the cluster with the `-cluster-display-name` command-line argument when you deploy Usage Reporting. In the response, you can see the cluster `uid` corresponding to the cluster name. For more information, read the [Command-line Arguments](#command-line-arguments) section.
+
+You can query the usage data for a specific cluster by specifying the cluster uid in the endpoint, for example:
+
+```shell
+curl --user "foo:bar" https://nms.example.com/api/platform/v1/k8s-usage/d290f1ee-6c54-4b01-90e6-d701748f0851
+```
+```json
+{
+  "metadata": {
+    "displayName": "my-cluster",
+    "uid": "d290f1ee-6c54-4b01-90e6-d701748f0851",
+    "createTime": "2023-01-27T09:12:33.001Z",
+    "updateTime": "2023-01-29T10:12:33.001Z",
+    "monthReturned": "May"
+  },
+  "node_count": 4,
+  "max_node_count": 5,
+  "pod_details": {
+    "current_pod_counts": {
+      "pod_count": 15,
+      "waf_count": 5,
+      "dos_count": 0
+    },
+    "max_pod_counts": {
+      "max_pod_count": 25,
+      "max_waf_count": 7,
+      "max_dos_count": 1
+    }
+  }
+}
+```
+
+---
+
+## Uninstall Usage Reporting
+
+To remove Usage Reporting from your Kubernetes cluster, run the following command:
+
+```shell
+kubectl delete -f cluster-connector.yaml
+```
+
+---
+
+## Command-line arguments
+
+Usage Reporting supports several command-line arguments, which can be specified in the `args` section of the Kubernetes deployment file.
+
+The following is a list of the supported command-line arguments and their usage:
+
+---
+
+### -nms-server-address `<string>`
+
+The address of the NGINX Instance Manager host. IPv4 addresses and hostnames are supported.
+Default: `http://apigw.nms.svc.cluster.local/api/platform/v1/k8s-usage`.
+
+---
+
+### -nms-basic-auth-secret `<string>`
+
+Secret for basic authentication to the NGINX Instance Manager API. The secret must be in `kubernetes.io/basic-auth` format using base64 encoding.
+Format: `<namespace>/<name>`.
+
+---
+
+### -cluster-display-name `<string>`
+
+The display name of the Kubernetes cluster.
+
+---
+
+### -skip-tls-verify
+
+Skip TLS verification for the NGINX Instance Manager server.
+
+{{< warning >}} This argument is intended for using a self-assigned certificate for testing purposes only. {{< /warning >}}
+
+---
+
+### -min-update-interval `<string>`
+
+The minimum interval between updates to the NGINX Instance Manager.
+Default: `24h`.
+
+{{< warning >}} This argument is intended for testing purposes only. {{< /warning >}}
diff --git a/layouts/shortcodes/call-out.html b/layouts/shortcodes/call-out.html
new file mode 100644
index 000000000..d8e591d83
--- /dev/null
+++ b/layouts/shortcodes/call-out.html
@@ -0,0 +1,3 @@
+<blockquote class="{{ .Get 0 }}">
+  <div><strong>{{ .Get 1 }}</strong><br/>{{ .Inner | markdownify }}</div>
+</blockquote>
diff --git a/layouts/shortcodes/nic-helm-version.html b/layouts/shortcodes/nic-helm-version.html
new file mode 100644
index 000000000..50aea0e7a
--- /dev/null
+++ b/layouts/shortcodes/nic-helm-version.html
@@ -0,0 +1 @@
+2.1.0
\ No newline at end of file
diff --git a/layouts/shortcodes/nic-operator-version.html b/layouts/shortcodes/nic-operator-version.html
new file mode 100644
index 000000000..a0cd9f0cc
--- /dev/null
+++ b/layouts/shortcodes/nic-operator-version.html
@@ -0,0 +1 @@
+3.1.0
\ No newline at end of file
diff --git a/layouts/shortcodes/nic-version.html b/layouts/shortcodes/nic-version.html
new file mode 100644
index 000000000..28cbf7c0a
--- /dev/null
+++ b/layouts/shortcodes/nic-version.html
@@ -0,0 +1 @@
+5.0.0
\ No newline at end of file
diff --git a/static/nic/control-loop.png b/static/nic/control-loop.png
new file mode 100644
index 0000000000000000000000000000000000000000..c70944cb4d45250ed14591efb4c151670a59dfc0
GIT binary patch
literal 5633
zcmds5XHXN)wvQo5vjNgUL=cevr-hF64n}$jRZvRkF%T(6P~;y8D!qsz9i$UV5QqX|
zK!S7#0uhKv?>)f9_deWtAMS@YZ{EziZ)bLP_ILK2J!kjK*>g7jj=8}_Ms7v`0C3UB
zQ1>nXK!XPW&PmYIoFS^rV&P{4=)RVj764G4$V7FcJ)2+mFuZF903d|{fXA@_z~LG6
z_%{FmmjM74T>$`<bO3-OFdGL^J0qOlF}2b=Jw07rU8PVca&mG<M@J0}4M-%?*4DPK
zuTNiJAB{$PdwcKh?q+6Ywzszz7Z*=VOl)jyjE|3h`SN9de?K)f)!Eq@27|p!O0LE>
zEN|_t?H=NAxMuw4*@czff#Kh4TfTmN!OvdZkFa_Ct~UMqTE@Vp|4T@CoguQ`Ft(&6
zFxA4w2mZ2SCb?$;Ro>|plcZ;1?SgpvC=d6dl?21&ruD6Pr|Fous)Uy52NmeK#@%*|
z(uC#chSeHCeAR5=>JO_7)U<Tr85MEZ@5-9;=1@;fV?{k{CC@~yqS6n;6H}Fyl`}Il
z*>7|6^75!uYV5PP4#KzEhNg~=4jp!#%Cn<5=Wb%43wTb;XLvSY2sE@00RT9&{`7N3
z@R;N?kS^57OplIoo{kmBqjBKa2LP}x8tH0Tg^^aW86FLgaF5H%?sx}@HW!rR$^}Uw
z+UdZWVQ9+rMLuHS+VN={rQ+5FcASZh-OHWUK96P=Z9>=Kl)}xR`*df*|JNG+7Q*Q*
z03gu?71&;z)P~SQBus^DCbXB?)|xc*0Cur#`@|ekw!OXls%C<?UeFy0_RDh>HA_jL
z#|NCKwd9USPyd74yh7(WI-!wxR2cbC=$xyDJ~<L1pGCR*7niOh3b7jB^5#ukXY(GK
zwn>0)gpRcHX7boQ$OS<}pl>!?Ug|J$KmBCN0FZ5`cVe;SsA56wFbAti>blM6UMZlF
zBih8Q(m;^;7t&%@Ua#UVcTBZfQTs#B*6S?U*NfZB2>~^)9wGIXAohH=W7wF**J8#9
z1cI{ecoP49yII267&h){VGMZ5=Rh_f&?C7e0}oasb3-K;1sP{t4Nk>`{n;5Q243@m
z<>ghrBS|cPdvR?0<VEpcvafmNG{5t7cRgA39e!k7vu2hp{k-MLT<)RH!0yrB_Q$Zh
zz{lUd1E(`IV_T!!8ePJy6nPLkeNRYt;y6r$3>dPjYHJ_02}PF`lpFoAPr{u+bvh+j
z_~{03n9po(*n=s{f%XSFTD`AC)R1<v$J<s6fSOPA5t{u$4e~k7MCLJvvZzUg5Hj7<
zP4$wk3wyDmrw+i!5;DLvllR3Hvs23Hp+zAesihnTX{EIXgTwB%@RKR$Pnfcvf`Qfi
zIhEUw)jR?UKHAE1gouFMds*$EbW&3shb$1S$$rS)obCZ<H<#qq;*&>hcgB)bMQ#GV
zV&>eQZMN1m)I|pjco12`=5rk~#TJ7$XbO&K;8gV%OTIt@N$6ThR*mpYfE`^kA|Ti*
zJh;!MNo~Fy(QRw;FFcj39+xr=7%``OhyR*?k~b^%m=%-gbpLeMQaK2UCQFO3jUKeE
z@OnpEoEyO?rfVqi`A{Qv_Zje{@Cf0gwK43uiQe4JQMlfdO3@g5g0YTXRLpi8`FWS@
zaXM|$Pq6YS{EwL6Yt$hujpIdNj0rIvR78XNbhAw`P~{4z(-ZtHE!RK>U=ipHqt9jm
zolm<SX#9Vla4#3%M~p@g4{ASb#fkD6WW?joPEzr8_fHZiD#~G!-u&(Tj4|B>weAZb
z4V8y{3+|Z25yABXrqNfzAC>x~YU2kYlgl_7gJ)ETOG+glbjb5KqKk^bDAKEi72<z8
zS)60v@aV`#u>X8z<K-OjD(;Y$D9aFH*68qs(Xr>jH1D07@IF-P?qsL_<|+(Mp}~X$
zH7((*xX%|$N8}u41-i|i2M+`J#iF5T9H-~Hk8RB_h6pK5Pa2Y6Cr`K-SMTNcVAl6e
zSUlT-01xR@Y>F`GxFQjjgWoiXT)@?{&iz=B$Qly<Pcc0aQ54d^(#tJ!kuw8TrFKC8
z;;)_D%0PWMoJ2O`*bi{duWy4K3a?KykEIRm3L1m-$=QYV{E!<mz<GJ>@pBdwvr<vX
zia|2{3%s%!O!K|2D~RarbHscTC>UsNIgu#J%!vxgBt_}Q<LR>p|D8mTC0Ui|eXzL0
zSMLXo4gZ)%R$$^)%#`f+K`b_W&=v5(8Xk{z47F<Aag%#6iqjH28gh=qYd_DC-0fh&
z*5E{;Ow`ut=m7Nb34h`GPY;)E&ExQl<*3T&sB3MrgPomeCus!!eViU}l&&UcSThL5
zXmG<hU6w~IaLl`>@kv<N%EGqQGS<~COx$!uf#FAW=d-uK=&LhX3f9jrFOKq0$5L7*
zk0GZ+ZQH7coA2&zErB;YGx|a#s<shAav#ALVjC-(7yaJgah{APHJ*!KUnKhMh&st4
zVwMCSimrcUH<)6S(6C^VI6gi(iCKOcO}{b!0zchq4r<-M6}wt_G;>7RrRTk*+gxPQ
z@`|%qX!YW3W3Kh89vsWI;O;2zi5bmvmR$VJ7xW|EuiF%aQ6Wr;zV4FucUa)culLEY
z;@te!36BhvIN#6>tu6s3#(JZ*`)lS!#j8E`2r3s;g9hxLCWMWdv{qu&^sSr9Cyg$}
zLh7KvJy@SFC{^8Onlt>MT{MfHs)Np=_v<xNn_@x5X~)iTTNUJ9Gedh>*mD&_(jQz*
zdH34xq3R+$+|Oi<9w`Tm%UfvKw4ei*Zx0up>EQ>dH(h-3*}S2|G0%Y$JZDpzi$*=@
z3@Ue<D6u=Sk)GhI;mzWQ2o7*fuPh!X6jD`&((^~3XN>@xp!|v>+!QsG>iaSiXukpw
z3@@)63h%lx;)wDuEfT9PDwF#CTMTV_saR7`yk3CaLR!(1oaoYlfKqcosrtf}q@K4f
zMUTjueu;jxtyE!+Ta%hnlu8d&^Q=5r)G{j}wL;xGl`#3*qsCc&Kt1sK{hspr9I)c>
zJJob%yB5j6lUg>v?iZ%C9uDRBWPHXL_hSg%_5K<9I8W|Szn**Zcww}G3VJ19siq$u
z%HFW^DJB<b-zMozaDXon8+(IAs+Pmy-q#m#Hgn@$uRe6vvxi-Gr2M+wGtO3SJ|r)9
z;lOw34wk35!ZAv2kv56O3xl-=x;QW$8Iz@L3+v+X9B;q*jWb4UXfeLo?w+`@UWo?R
zXfm4V?O9Q<X24hi3dM!_;#DW<5?=`N|2<^0Q@Qu|`mdBI9%pJ-w1zV;B|FvoN||Dj
zw_~Bchmc&02rFDD?m22lj#JF2l2MHl^oqSnYFhDbI~$j0zG`)0_f9IT_6gA;FI%MQ
zf=97q6{J_OOm@xzI%?n-nqW;|m~&70JJU$DR9QkHXYp>aTgW@?e!J|I{kgUi)fPO*
znptHT?TJ*B6wCf*^Kys?&?L8OYX-)=KgxDZ)v2_sJ7F1(gvv38xyoM_Hb|uPcf1d*
zZD`Rgn0{6|$3H(fuFgjpPW2udw7<1AR&Q!#PPe<BV~^(}vNn2h(-vr3RPJW{WzZ#W
znR`-LSV8_E-rWQQZ+q8!$_#FW@;UjL2Py4nv$#$2UKO47IJ%^c!1;$q?ErfMEl%tY
zY>iO`xJdDJPg#K+!S&9!$j_?mcHL4_(p&bcwAa3kSV-HiLw4B5V~3iu=|9Zd8nMxd
zS$_eVlzZsC+qV0-+uS{r)4RGL8f~W5%tuP~R!SL+$IIDM(fGk=Q-c7IxkJsXgBzqJ
zOmGDri&|EBRJ!@1D0q_}gsSjn^{e@1mzbp`bC-fqK;}EA#V|q>CAZ!<HK@If$NzmR
zF5u?6Eo`O^&;RY-!t9H)i|<Ulg`(t#Eil(@34|h$a)h5kxm}cMe9(ZRIIgf2rhnme
z8O$r7PPd@Q5JqS_oj*tsbp*pQgn{5M8_sNFQZuD5z+yr`@D3A<bu(}hLgZ+?#nXrJ
z*7KbuoU)-FP3Gg4(@8cDlq$ZI@Y*%tEiX+QyB=7Y2kcxq%;M7S<Jd1lDlpq&ijUmK
z6(r`-c1gF)Bh{p3)wkSHbhFnQ)dy)B1a%@?fFk4Ss<EwZJ@U*-_0xI?4F2%xv(|Y}
z2XekIrn1g{DL%Lr54V>@`IyxeX@e!aQdK3Z{3;z<GQI0(7V1qTkzCqoK#@z+=B~=z
zC+?tC3rY7#sx=w?HhAD@kddkv(dKk0_SyrLN4NvNyJVa6>eo6qibmCr_uDsA%!VWg
z+s4wEdG1u>Xu3pnwj}k|fM7SR<e)B@sGwezV6;~)r(WePObVeTYIGj}dwv>BN|h}f
zRQ!D}OwYC1X1I>->92|YAX8Fn8@rOnnVYmtFi1T5arxLqO0buCe<p69`iY+E%sHLb
zoY=ne#tv1YANf<BGm$~Cd8GC>xe$WAKkDzNKEd|d;RpRBliINC#Y$L)*DrjMM7?<M
zMl#-pR!%TSm2T=PO4U98ru?8|%j#ImjVjnvN3q54@@B7Oa<fP)ibzL^sznPdK5dpq
zSxV~2mNs>3%EEzMIlcXQy9RL=$8I+nIL0@^1ItbG9%k{osz|r%(<9WEHSh#^Bd}Pi
zeS79pV+J@$tZA}%M+IjTs2+Rfpq#?Y^<AYGE9*>IQN0c|y)(}UNBzn8i-Wh}Nlf{q
zt1aT*1jT#w<we!Glk~%PCuOckvJEd^LEc$|JH((Ix|4zw+bir_@3`EyV#*Q|s1K%x
z`R9MMLfnp)QD55A^c11~oCnu_RTHdgeK<4<-MHLxJUBH~eG@pkDA??t8=zl2o{|9B
zN8=Z#5?mvK3f(Z=Lq)Xat1|-$O-p(b3h%G<nh$Yhq#8jPxx4c}4#=8;Z0vtvGH08)
zG8Z$~wyz+s<J93?c9E*NnYVW58f2fh2brXn;K42(+<ji#&zg?%9n&=5XXr^-+QTC^
zY^Rl^^pS^^&-jd1{3$n5p@vZbw5|KfQRzRMr*hcNLK6Fa(*ADT_(nKYro)E*!z%X$
z2dzhHWWV!y^{spY;a^A9d`1_(BoHhSI~5TYKL!c1;n$RsqX`;moFMeI1iMk%ROgp<
zrbt)6TG`){>|<Wl;~tw)N|J$tQ=Te!N=w@~ZX(V?gM=z7AcBiv)gi-a4y$vV%q{(;
z<OiBG>fKezyKQ45ZPS2x_U0jC%s0~w`(YAdX%>63sI_MH@kKuWrJ)F;Ya-Oc5^28G
z=tJ*akwjKf`^j<-BI1o&Y}ojkbS=w@Gg+aw)sgoGe7H!JH-K<)Qg(qS+jlo=-msvu
zWk=aBl(M#}gq}r8HgVt-$E|sc*{r6@;((tU`Q*(^*t>GkqP9B4I`kdEiFyGu3A{_^
zQ2~S+FxM1d%k*cB{YMyt=#l*4vBcRUBRpjskLRjwIvsyOm?56gJR!saFiZJE$8XMR
zZP4Tjey`i)7vtn1|G!gl*g&>Z<*xGv${fc+Bk!7?{K-Dw6g;%l)XLZs<#>0}@Qm$G
zBDyS#wUvpOdLn8I0t!|c{Qt~f{|AY9b_mMl(JRu4{z4W$Ad+?86N^ke9ohvOPlKYY
z%QbqP$Xh<x!!K|c&(v2-<vwBTKTD1^Cr4a5Vsl$8gNbSy)$Kbv411YZu~_SOH%k;O
z&~42WA*wl7?rX*&Xz+cw{TppmaH&ru4QT~jN|ejwWufTnHu<0sn3PXEB)T@slM2Nj
z2SCke0nOsW&7JA&&BFo}G)G^pG3@=1$D+1U>;3VE`L+S4twA3n3y8~e4=w^Vl}E9y
z3?IKf@Hb4(Vy1M{PL*UgVzyMwZB%KTh1Qeiiz);avb{#+nE&jBJlhKcHNd6MvhB4o
z(MD~~jUSAcco2zl4&wsd3GuQtD8$1{;ueYEmqjVV6)sR|89et_UDvm_{~fE_e-`7}
z0{>B_2RoE&z*q1#mL)c2iO|s-``sQHQEa1^{1oCgdDKFn31snL5L7*M1^+PQ!-c}j
z=jqgJPGo7#yZYm)EM-Oa+h{(d)LN#5ix^Z~9D686as_Z?%g~tj_E#@CfLxRdPocDN
zDMeiX-(TKOcf|k2XT^UL9=mkH4^lmEZX3fxI%B;Vs%IB^&n?tb#Ut4BYyim0$o?fM
zqbMl@w)#t1MMhRd7A!6!qaq_S6R`#QFAT7Nd){8*|C%95z@+hyaz=XQx)s{4PyPYK
Cq%Q~n

literal 0
HcmV?d00001

diff --git a/static/nic/controller-sync.png b/static/nic/controller-sync.png
new file mode 100644
index 0000000000000000000000000000000000000000..a965a211b1da9546fa13e430af6fb00ed7d43f75
GIT binary patch
literal 34320
zcmeFZXH=6}7buK6ic)nHDWO<F={?d_6jVS&RKQS0I!UBMAfO^LN>h>E#0Z2gH9!&&
zkWPq5Cy;=lh7urz7RncA#@90Q{krSkb<6vMb;y%E`|NYh?&UnYab1^_O@NJsg@yC#
zl}k5SSXhxPEPJl(XFg!DLd`EThu<777+hdsDT-p>wAsu2e9ZRBO#>Ddm?#U&!zU~(
z8_Y)!r&w6LWLa1!)+{Wl@hmL750a~l)R|xGzNe>qiDf4=s=bE!>A-_4W*#god`Vyb
zc3t%fe$9Ny>Uq`RGVAz0*2DV_-@1Nuoe7QQ>ZJ>}d<W;S=*XcfB}$3hZV%H8FJ$H8
z#m2xM+ReHzv<1--dp^aM>=FRHFg*XE=zzwDPnx@@A`kVRQ*1mj_GzT0c`Se91U;kp
zaZ1rq`@52suUsy_uMn5fPvmD#$?~wP?#kh>|FDeseL(K|I(~d;w1+u<c(x0%k2yX(
zyhn$VIkJfD3m5o0UgzLb`Z^}_$vS@>&&gSLe;ps(`+o>Pc$`3)ibjE8T-P30Ixp<d
zo{#54Ecuj{FH-q;Vf&tzUi>(+BKP8shZ0r>NLl0UWc=<vzw~C+e3SWC5pnfu?(4}c
zseLU|Ax7FV%c<O-7;<<w@4&%(FT($Vvd)4Pp$R(tulNyNsWmCn<R}!pwi8UjYP?yE
z9fxnum{GpZUW3M@ONY1QZYSUlYq<51zmP8T^DbAm>Ro~U-dEDC($QfE;&|1`jtGSM
zY1@a7`vWwv*dXWnX^3kxwesQ2`o^bNkB`TWV`V8mv6J&I^r`JRedUEow|?aaOdzBe
zKzLuMM(p1=*tWp}3t_<m#bsXp2Z5J#WrH;>O)WmUTAPc0rDW-RYLA)ib4a3tOJ-w_
z{yx-)!-XKSChjn_9OH*B@+zR*bJk4HZ<kPA*X-X5R}K8c;P|~VHKXIt{atvzlv&;`
zPY5rR+E$jj`V}Du15}Wsey?X`wy)P6dao2`h|@EzL0EyWN8@UdQf=8;BtC*+U@z~}
z#`q_8GBVIFFZnaf1YQXT-$w^ncT*+t@%4u9+ZWC!sZRou&}Igr<kMfYc!I`o#&>29
zbkLjzaPceJQ#`wuiAc<)0*7pm<dn2>K1_xBWY_7aG|w7?E$f#0U~ZeDN?D2>trlsu
z_3q=$S}l@fMs#bc9ovlZT2*yf3pKMT2LKkK#rK9Wr+gJ-1=(sQdce{Sk)*O+KW|{+
z)RLL1Go{sHT017;xqWrTq;gvhwk->1@$6Q@dp`wd%V;<DS49TGh&EQ8t&XMQdTuGU
z7Knb+fmC>6A0UZjzSuelw)}ml0Lq=!$M(=IB^PslS=3!aFNHk2S=undW1$&(^iAXX
z12V%i@2snF#p(H7&J}H9B{n6Mvr8?Bs^k;;kR{dKe;#3p{nfTh=IJ9Dlmr0bpmJOr
zxP6NhBCx;n6x>!j5Wm+P-xpe*d~#pm#v@hDHQ5m9v_yvcl5Lz}zj~r}oMEj7ArNS5
zskC2E2cEm68XekkKsY2?2BiR7YMfAGRBSy!7a2K%0)koi`j`Z&13mE{0wt2hwIOFo
zg^cY_;|g;Ynmw@ddD0?$bpN(CgF8_kR_^q-%D9h)Z?1;|KrQu-^-a%%z+R(1ee!FK
z;ACe_#br;-+UQ?kb)f?P0c&Z5AnN)X`(9d%ve4WjzB+<!)2&153T*B4JsFAsOJ0m*
zGdaXRWFZY)_ZB19+?PiOoI>HY`l!HiBD{U`)Q#;YIFGIiDOU<PI<kCVIG#;Pn@}H(
z?v~<#5vT6n9K*Yb212Kn`1>?d221gt>%Jm|-Ux_6r*F8JG9^7<0LD|<xOEU}+4nj~
zqxMj%i;GLr_$uG+z!y8_ggK}&uuT_L$&s`g$G2>Et~ZD>t0(56n&3vi-J=MFX^y^w
z4c{LATms6Ll*CT31=7bOne6J@qEe8&noC13swC2THI)mK4vb04`8FV_CnOjC2v;X(
zIG_WHn=CXN0DFhpk$(2pjUFC=Zo}}0dN}0i2jbW<>Bj+n>gj<ElDt_xjHcYd*TZX{
z)3R<ifj`I$ndua&ci7xC!82IHYlDa5tnSD7xsjWt)-8(EAu5RzMH88)lwBaIiPGU!
zBy_-r9qnFsbkLo*xZLq4C$XiU-6as-Cf>yB+O*jK>4C%e*R@D|6V+loCNp&+o82JQ
zjRFAnpv`;eB_?HX&LrUFv0LldUDs`H*7<2&<`AA2ZqzX_Thh^Za2xSpC#rhF$W+S?
zU(_aM#hk0X|GnSblGAWv-Oh)wo^jfBL`Q5E{_akji*x<0>`g=oDxU%W9FIA^S~UJV
zmN0ak)`@It+#scNhl6>l1#P=3PEKf+VvQ6Q9=^`xsJYI_bh2uo;y!uX`WyNo7NstG
zfT9@}C^C<fdXoEL3u(C~xLc=lR@ZZ@Kn0XMGv_;q=mx#?R{g*hz0|7K-Z6)Z4?;t6
z^X}AGWIK4k06OmTc+CQkC7V4nIXoG_5WQ7H-G7d`s9DRWFFZvZsAdi85*6&cv~mb{
z>o(k~W~XS)qC~w(r7c%8KmvVY)k)2B{Z?;*g{E;FgMVRFI;}-$gv0^JZJUJaXlz{l
zZR__oxyG%WGh0ZNB!~GGjU%EZLi}xpaWOL!IHbht$<yTHo}APR=GUQXSyv}=90KoK
zK!#9=mf@(B6UiU8y7?_TsB>ReYvQ-AdNBBKDmrZW1ts|~;CG9_gV_4C0%xr*rPbTl
zW90mbb{07Fws~Imf=5J#Q=;}m<MU*)SI|6dr{Vjs4j=gS#V-=qlSbs{pl(5~8k*Y7
zlOsOSU2vU{c$U#MCUV5v`J5;Q3_`IsG(gs?WiC8xq)v=m0D$t8`L)M_@_TV7S1S(#
zck2%!sgug?A{JW}WZb-trYrN{eLgh9mm<`Th2I_-I6PDUj<=6*>Z?pE+EO2%w{>al
z<hg-KCUNdQ^Tc@CtEM35bkLF1{sCj~;G@ZX@pUna$CoY5d$tg{iN2{H-gJWn&B)`N
zNv9d?B>c1Uqm7M#*>lFD(qm82w5%^ahUTf_HNd}Cvjwa*%ob2i)7;1H1HBvQ>NJ*6
zaYkKKYbmX<=}FBfqe|n<He;T;BXdItxUa>0m8w7qOPv@D8ktdO_y4qUI>^bR%hB=D
z^f0LhsjU~t8yF!Saw}a_NK|w=sLp@2!k?71w!Cc0b;`6D)7T@R-ysFxUh&lTs`$M*
zC{Q<MBNir8KxuWU#N?m=-t~xU6JKgM34Iqf!xHOLT;(VW+8K+eLi#Js5Te2ehbYf+
zYT$3L)XLR{zFZdy4n+e`0(X^Vt^!?TIyOW`8U)_gS1FxgtYQZoK0K@YYwHy#&N~Mo
zm(=Hut!LgCjHn_i(@r|)8u2!&9%)N_*g3oa2h{|{MufHiw*z}!X{WHp3uSxGJSmwL
z8vKlUB83u5?7QVbX_M*{xd^r8iV|1%x(x-+F62C?FcGzC)3(j0;s?T2G0&en=$Xn)
zlfso%L4mg9KXFa(ImOhCwrw2;zvAkVu*i{+en&~s?qHv5Ofh^|`1R)_n;|t7MNOkV
zw55Uw0KZqzW^Jh=c%!LxrHbzE6uRD17l53x18;5-1~=mI>E2}usSTej$l6n%$oJNv
z`w*HX#IqjTC46+bo}o|+$!FUKVIt-|)zcmKLvuGC)K?1%R>~}zhGn+MM8Hz(!=!ul
z1a#oWfkCRePcWfX4Qujks(%u3d&+d>9bDh6Gz3UtB6b7~C)srOeOaBay`Ro{uNZgJ
z@YoJu`2eC|Yxo(L5(V3}B%h{zsLE$B5xRypimRFKR&#o6wY51Lv2KxpaT7XQnHgy4
zRkNuxqxFh7x|B0N8EQiJu3t%!+qS@svJq!YGoSzr(kQOFy92m?$wq{LY$}-E>RVLh
zzMES6?!*}OuD~O$_eOZLo;6MH>RmKXuYnLF>deZUS&|PQy=)CjTg-dTs@I<GGSC;a
z6)|-c!6kKN?larR9Y*%!$pWF(fJod1{Q*y@I=9gA(#^TGxDRWdg-urv2h24!7-pj^
z2TS$hY_z!NQ=RY5+iq4uNph%81NxoJcgK*hcjI544nNSHc)bo|_1Qg6;3VK5jyMD0
zXWlHL*ACbO;5B%6UPdH}sE*ql(7vW4bexK%PD9$mD6v_8Ftta0iOS`QT?~^8uND!K
zz43y5`4<LisInB7MgJ_LsG;k_w+5C<T332jY(MXK`OP%hebyjX?~9Qm+jkdeTGC@3
zc=xZ56+X(<KfLa@<0qf|DMq)A^lVioP580L=ihQ=DcQ1@we#_Fuk94)v$?V-FGVX&
z+$L-7rAMlF-9=mV=t}VdT}@bX2g9LVhqdk{IS@F}$_WhVBlBN`Bf^>&-P1IyjcD!1
zaGzo>=*#QCw=gm&N!p1v)vrRE*lyE}uCWJ9Ht}dddgpYog@oW@^Jx%HO}NG<28i|D
zejoRR-t~dx%GQ~^T$AS#tKOT?vX;JGpD`>ji8&4;Oyui2AlH&QajXd8EkiFYb>9)f
zhfd^VC)}-=a(k2bocFb^f$qny(GA1=u8&ZzyO|&71hj0!c)iUHrEjKK0n1akuZ@f3
zS?Q@sV&X_;bj_$*tKa4uCwOQ;`qH(9w0aK2iA_rj%Zi*ZheAqzO0&hw%@>|ClcKGR
zz_iv-E3lE_C>JDg+#R@$yS1c)(~yUkwND(Xa;WlZY;#Mxg_O{4!gW`rG?Fit-zbb-
zDXL~uyJ@^(e>jyJ!CmqYeXvuWy^*||JPilw7pD54Y|AG$5d!q~sKyN!@52s02x6bm
z<6=0;5Zqm=C8H`tIcS>#nhD*c&O8+pjGsLTe(F%W>N{@<)I2j43&jg?kt!Der!m%|
zn?hXFB(uOeL1Jo|D_dH#t_vlOD^io=EH^DPawffSa#eJ*Qr)MoOdWoC>cyz8*l=O1
zBuz`Jo;PqhNj=Y}r&ZD=Kg}nS^)grND)|7rwiC`~6uViFzlw_g!*QAfh~o*Bc(mBz
z!!>M99nDD<w&*Ff>N(l>woVcjZH1~n<MM{S;6{}3sSyp>m;;o3p@8+BhIz~kX!87r
zl3pnsL1mMt3;b@TH{$&*LMR>`3K9_ZQvJ)5RH*uD$N`UwCV}4EK|%AeUh3>RcQ(X;
zGiB%5#`W>EuwdR4a+P12$k^uACgf1C(6*ii2Q3hg%I%yvu1fSK1s4ys8*cSh1RME;
zvff<En|3iVN#+V26oWMPC~I{DmfM$C21Ojj8Io--pcE-r9(c`|D8>*sbu^{4yFx$d
zHJqI0@aabl3Erskf0K6DT8`p{Rl;4m9Dhui`gEb&w_Z!9QZaS6E$Cd5rA@LiG>xV&
zy{;y#7Tq~hfOGcbJrVU8$YY>^a#{CNX&(F7)wYOvuN@!phkwtOb`jyCN5F~HLYk9#
zWJ-P5lL~qM-bKuDV<G$62YWZn9&D;{sv2wHWw;7_BG38ln9BJ+$^Gs0pclUPD(6n$
zM&>E;XAv-0SB(m`Tk{}H#kB4IdNxXtyt<Do4ty!4NN9c6?Xk%s@1T@jr8aoCGnGc3
zd5O$7I!PhfMZ<=p&#ff-y^M`H=N;bXx)>UCMR2cg8U1mCW#>sPzJB%T6Y~Q>^Y}sg
zd3*)r15P{LaF`&=?K=Y)bnfPz2{xitwHrQuQKBW25rMBhc;2*7_IeIVE(CWEQ*f-@
zh!&z7xIoh6H=1m!bPK*gPHRmFmV$a51hey!F9}#BOk_X1NYCz{sJFJ|=4QDccr=`t
zh9I^*Ljv9P5o24y4I_sN4!w5lgFBLz1wE{Si(}Kywi%ekKXZ5JE^EmXxf2s2dRW<c
zm5wa=4DhNyZMJ>ywTe}1M8dV|lqB^+dEsj*ChN6GKmmj|Bsa+}Kr@NAjJ99eQM}kW
zX={QED9g8^|IYd>lbXjtD@UtyG}er^<GUceyis^i*J{It9A8=5aV7G0csu?n_I0^b
zvO%F_M-GZ%5Y)}TreR@;{GD3j*FWx8<qi+<wG_=i6W|hcb`!)~9zt0Iz=B@IqfvTj
zE$m_8T0yuC&Umj*H$W{@ZfU#o-ok#9{nu_GL=P9VzfBAq)KY6Q<d2wlw)e;7IDJXL
zq3t@PP^etjMcEH-E81N4&~8x?vDBkVg+q8#_q}TP{NhTt9wp%%>n*8au9G|NN>V1p
zO_BkH&Fc*L_(#3Kr2t<<pvOhX9bz|6x(IAJ|8c3XEzW(_R#FFE83+d^=H4H(nW~jF
zoVz(#{y-U9{E+Apiwa*Hu&3?!xUHXQ8oQYTekHJEtJwrkSLu*LCAs5eSo3J?2(A*$
zlhX|32VWTUP*+qlGs+<hP^u(FtdBMAs<KPHBHbO#T0OE=QJI~~zGIrImX|B#vm+Q@
z^#yVg;^IyR3lCs!_2j3K;WG%~$+w<jd}`Gcg-NpC$ic>slfx$igN~dy^1(%WOh>b9
z+bh4IcZ4JtUHDYpq8Evxr!(!;fj}V({T!9@wy7uJQCHYrW@t&W&`kOgT4U<EM}^=_
z+4Pe8D*^G?31>Fc`|*wB)_Lnzn|XHH8y$`I8A(1*Gi#c9P1N70GrcKW#KcSVdIcZ-
zH7{5sJW-!Vu(#g+FhD7xIG0NYXE6YeVN6@7XCjP57|7ukQEHD;oGQ@UGGcI;1XeX5
zL9aLGw*rzDq%plwVT<5L486v!n<&kaqC%_8Rjbv7h!F+gI}QWKmHG0Jl4+iO%a$dW
zg@PxtCynCQUhORTHpy!1rW)9MW`n$?)!*~g><8CcU<1!brt#kg+L63`;<-<%KOMl^
zT+-oBotn<fX7^a1#M2mja$A2e;|$gkQ4%#72W(|sRUB+~H^|C4Yk(Y*&3x;xM2Chx
zW_6ct5B{Uox_eVV&ctq_lNx<?3w<phcl};Bed%p54w>S@=%o_1hP-4cwOZnGn42=;
z8xiB{aj=^mds;HvP4c*(4lR|$tgGT`J3r7;leT)jV$Q0ftcqU8F5)ZfnA;!n=k||=
z5(%zJNq<a^k6h){5njE`Sw<su7T)VC%M@x-)xXGdv_HaNpwEwQ6r1R7S6tm9AI%v$
z@xXTT$+3@n<SDiI&|9wKL&_q9?vZ?gt+~Y=79*R7%SN4J7z0z9HyvD~CpRIoYO!YZ
z!N)=+p|F|}X@?na34OWoO@X3fsbc%);*O<{`?uqqUl!`j=?x}T591%nw`~d+T(gAe
zq$K5d?*#*W`Mj2w1W3!Hx;?i>-C~AcWJv=>L1_rhJgB^}A==1L3QxVMANrZAAyuzX
z^37`ExKgIK$%)n1QVO3J1kG)>^;d2N7CkU6YiD!X^mi{0S-7#!P*YJTVh}HJH)3W}
z+J@b1wX18D<LPd+?5_Ts*A=m-Kc;oZm?2G&pLPr?cpO3&U*%RF;~cQbDYmD8fo7;7
zo=Pgbz*mR2x)`i$N5sbn!9aMhO;c5pf6_SJJS6oEF;YDsQlx%<=~dhe{M6GR`@!Ka
z9;-^zoAEfJkhO!umfg+^l1Rw@y$gdcDqb3wJVCQ<`Pt+I+tuwMRr98rsuZL(ehS7K
zgq<H&m8tv6>#EpSUwM7fL6MG?AcQNDR~#oRI$AW#N+F;-VD<nzRNJ1A&;bxk`Xi5@
z93m{O!=d8LgDK$-23Pb&j(ZFKrot)uTHzZ{$2nyJ)v6d^Wf?<cpf&dQuTXixY#X{G
zInC-@en&atkK8*LEE2wP{{{NxYC{`IS?<2s?dtwse74EHPyV<ih(otJ2g0vbl27*R
z$7B0yLdQ7|*&o6@v-}!=a&cW>5?HeKFs>$_zA5%eV$T%T-VdlqsVo=Wp$%RB>y7)%
zbx3BU8P7Vk6+d}SO$#h{MMoxF0G7TQ@Q@hg7g<8<IvV_c%8#gR5gW4=-Yj^osSwMl
z%Nz&y@W5=kKe1ySep|K#d}ccoOlUfP7uU0Vt&AfXdv*8M7<)Re+<A`c>AX6eShwX@
zihHLba!e8*sh5rm$~`m^<A%eoChlI=>5;&l7yimyACS?Zn%GkYyI=@PjQufgu!=5+
zb$5$)n&qoZ7OWBdn!<}e1C6qjv2;V3tHuwBNLU7cvo@&X&>lXorB7LL@6Miw-ok$7
z7)zI${9{+Rs^3(X-sdB4fH{^<`<A{&v{`gg)R(7EJF$HN+%8ny<LB6>a*qXZU3lZa
z=>2#1{!4rRWsU#61q%q_G?~d5?)|t-6x^u(Fu43(B=#ZXaQ<8n2ivq^^Q2t0vT{ID
zwak0v@4|3{?i*#q?fSV!j&c^?STen3{b_Y?Z{~M_T*E^4Ty#^QfVZ@vLTO5bI*vG<
ztp|O?*I!^-%FFOaWz*k<GVd`Lc^9V+4*!Mw#REr-qZ6Lby_UCab&{jhZ%6}i_c;L%
zl2o|o^=vV5p`V}DUxZTp<eb~W0{eQ?nr#%<?~Oxsqx-lc`@C(ten!IT7*I(`H0`2^
zn}ayY2SRvkP^Ms(lH_V04g*;w<`wyM=*-<whIsUP@>9v%H^9&9FWPOW@Oh25rVgtT
z%e>Nj1I*eSz@$FCVcBQwg}winKt%3+LI+$SGBDjU24n>k4kkp>ZpGUxQM}-(2CkJv
zWM#GaeQjiTbfF6RbNOBqixm#ng=rPM7*WXw?H=qi+VNhHZvWoMzc7<`%Ha23PJw+a
zlP$(*rTrPWe=T;Z{hYBSr>7hxjD9415L9}a6;eyQMmXAjuRBG{kpn$ppSZpw=V@rw
zfD|gu*+CGGq*K}R48H57>hozOwGl%d7U&(c7t|%0r?2gLn2}Whw~hwwCA;Iig2~-E
zCcMW70IPC}UQqOsF(@C(o2DH^2NeP6l%7F|>reQJM{JnApmnQG9=9-##h;EkL*Vf1
ze`>3x=xnJ4))@|UmOsR;Oa5GO2yS5-K4>~W<K1CifObC#OJxmINkEacxHTPO{z+Jm
zjPOI;!;9919X=<aPt_e}D{Q+oWGQDo&qH+#M72`Et#LCgGLi<Q5ZcsZAF1-KYh5z8
zy&aaBsoe7<Uely+%K3bTQJ2Ts&gLI8uL>X5-rv61A5nF8lfeXE2~rwl`UA&T3wl#-
zcZ93eu!Gq>MnxF+Tx3$D47ZP9a(!TAk!(?0F__vmuK|hjBX2NQJz!8EZ=tAMYRH>z
zj{(S!i>~6naEDjn^i!3Rj66b133$Jf5?7Fi6QRx=8s(r8JwGWuOF?JS><$j_2;=Ll
z<qbY%ediP_YwILP0IvMNQztCEcN-eVE5)r?GTg9{o!yuqG$c(fQ%mxXUd~uNM7T&z
z>XJgaMN4fJTo&3?RKJE*N6@`T7A4_U*5L2f3tizs*$A(IXlJ|BxJ=RxK@&*re;raw
zq^4XvayWI0vD>BVyOosou{(y)Wg2wRF309f@$_Z2D6_>eXCF=Kaz~-nolhPgj=cTp
z*kvhVqm&GpH1Bs`$|vFmH@XUm?vuHj7x`85NRds-g>#LWKhs^{?|ZPBi1>|(aWv47
zpYB~fK`BJs@%fck|6jA<&ZSs7H*c+O_Kxz{X=KL{O+K&&Ykn87s(u&~C}=`dB8ioX
z7u2yTm8;C3S_;_Sn{K=~l%%yDLolqF^%zL5p+*e-az0~=*Re5f%HW8z(sK$9SxO0I
z$_kn2b0UB;+B79$H}h4d)UJdtqOoaRdVOrep$~ta*AQy=9J18tQvbXburij?TL>uj
z>T=igAML6S-f)Aqu75^O*PfkYR6qL1#L`%V9KtF-pl`8zqH(NVe`v};Pr}DxsZ78;
zDb@s{iJcGXH-GSmhzykkOcc5K9|_f{^0Sr*I-7_I{FIgdGvQnprhX<Qd|8uIuro<;
z6_Bt^a?3U9D|ni+xH7cRie&<;fu;sLa_uH&389N6Dlbj01V%Zn(=I9w83c~@{0nmQ
z%MS8>d+g&*drTpu#ULlBlQ(#k%kL8ER<}^NF_#WV&+CLofVy0j?oz#NV#uBxlYqSg
zNURAo^cSXyZbC2LRqpqDAO46l=8wCR^<hS=uS?HCaQ=+jHogPZJLQ#hR^?3TP0h0D
zO<}wKlct_z!wq>!ow*mcx8BCR(+)JA`hf?(f>W-3K7)QYyjmxnTEXu%g_zg}C0V9S
zZU>|gNI)Gb1DXV&;;U;D2`CyoO44Iza`YWeV!!YR_U?~T@2gAFu4aw?RH<Have?Lj
zGr_S!mSUaP@rad_hm#n#QQrq91rad(Wpu4wY*vUB|B6;G=wJqBB7<XxHsWz-`e*6D
z#4H@v-Y$Q`MUIm3iB-pfw)OzDe&|b}-FO<BxJptkG$7%|2-S1j94n5kH&}r1dZZNx
z{JSjjT6(~{oFw;PxDT)1dw<@)GvQvcZjw(2av(C;$ao%yQB2t3yEAyB$dU;R8r(8b
zdw=uR9hHt?T#Lx7kjY|kZL%K!woGDm&kqJe3poYmGJm}z<-pPnDHnZy(X$fabLFj7
zL43JZPhUtG|1p8_CIt<vuQ$C9u=Q&LNCF>+YN(cQoM^MG<qK|E{s|NomR+8ZKe*sX
zGj-@SWEk}Fmx*v#Dv{maeo6t?bG!*I^Xv~In7h-w9kyOTx6#x?>d6wrg$WC%DinqB
zH}`-^q%7O>pO1V@m)a*w`RFErohvEvw{p#FJD|($7<;vvo%Vdy!KUu;PrFhPK}>Hc
zUc8(%1Aj7bsC0fYF|<TB1gZ0*1Q^mOT;E!qc<<Mm=IL3Y?yq6ru*s%xc;r&y*^zpt
zBm09J3PGT<c%i}q8#v)^%-d0h6Lz_Jw<h0DEB&wQ`@fTC{+6O)BTN6;5N_F{lcN07
znUR%sG$eN-xmVv1X0YpLFQ*%RH|VYlbJMxJAcc2*ZDGZt)S;##`Mocld@V++uh>Qd
zjL#iTOKd+<t|@t`TknvbmdMX=FBW<@*|wKOsNxgF6}r?b-X^uf5Z+-3g1L7_OJ=1~
z`3zeZmHiO?CZ^7C|4)?LPu~|8Y2DrNY_c^0Iw=WD)t7Zf6#!!hS;}*+>mVhi;p&4%
zG7S=&Pkyv=#G)=ksT7Pv0k}H@<eZ{mvW-6M+>I$v7CKZ0sZ=o2THHmrcnN!?Y_sIT
zPn2y+?aVmISC*@bA5s8U3e0JRdaVa)w(UI7fPwzVihJ8gbNy)^Zd+-K!BH*72{1!x
z;y}NxilHmqv0Hr&O$@JEP;x$DsaBq`XwhYp?zc0Lrjcy_lPx9|1rYF>3zJYrlux{+
z3>7p~?qw#x-~6=chKleVAh@3qrVHC$Z`lzIl8LAyza*v%gjXqzpW{}}Ix8beY=E$n
z8Tjq?(O<QYTX60DT%)Mo_@UT8jYUS`NK?sDPW!Nl3+N9d@ZPA{lb^KlCAfN9)mv39
zW!HtE?Ahe2K5eQdUHJ-x2MwtFB@88seR28b$Ip1ypN{Ac)zOyII$!uNwMov?OoF=g
zUS)+6r+yU5f2f8`1-~uHON+e&y?{Lh3!I9`|8A0sMTsrz<Sudzai>O5Wu`1(SC=<G
z0YE>J9<WF4Ccr~JI&S*3&Av|nlOMnPZ~W`O(Zl~+Vy^}=ou>>&Ge2<ZiToXDj#8Kw
z0>Da_**<}|U{0NTl*ok0ITCE-_Cr9d=C=@VF-#&_MDwMSbeupEzwONQ`%q4H++k9^
zz1om%#d6c?{*>YXXW|A<<W9$lA7FDEVWVlIfjes-kWF>*d7kL8`s${(2-TXkW$E+`
zHNx72GOe++^Te9&$kPn&Z((jEvEx>zd2EvtGwzVBczLqDs038z4|DByDf1hOP<2hX
zLlDl?ORo>`dq?uqnm@1%Xd%0G=|!b2=@%>lfRgZU!R$-)qxRzAz@j2~KVC}b%xCNN
zFWCvXuU=)dcbW5f*}_^48k&r!xt4T>8P01XE5J>Ql)-@PmnAne>jnaOubUoBYs{CZ
zs2i#fVn>m??`OWJ+dOhAa5&}D_?EkgAeZN%TSaz(WcV-)Vi<kpp?g>T-&Gr(Pr?XG
z_x-q@cb4u-J-sFYx|2@e)XH&q_OSTpjO?N6grcoIh>qgM;uJMQltCk_L8TLn802hl
zIhwXsoU5;#uan|n5Tiok)HQ{6L)<)*+6u;mK(^=t*{y2X#CvMCsi<nJ;VmxYP*zBY
zkkH)V?Jf3sZy84UgLll>OeLPgm)`fd!5pRpG2M9ccg+6^C0`#EAMeqV;8K9I$sVAj
zr<6D>(Pvn7QVi2sEAF8jqEh|as?(A(=*a<2)j2}piBf3y3BvkGeObyg5X!G<Fve~j
zpvlyVpBSXyN5fqQdgZc(yuAIP-IgpSDS9UIY5u~A^}9vf5Ds<yOlPAj)e7eCCUS7F
zy2h~S;k&bcXoHxEi)Y$5sAE!*;4U>m#(j^X(#TqYWUW`L&8#}$$&m)4@$fD^5hXWJ
zIna3$bE$hNvKCock|41dqjjPisTWk&K{Zun$HSnx%=!yi${<y5{tCnmkMfFqq&?Rr
zu@Q2wi0gF;s><b04`p<$!e%=7YZW##IdU9{Qo7uwcp6~$K)zsNUN53>?5WV4{3llh
ziuf`Y-gUL%rtLW1SSY|*&Kcd`Yu}yzV&cIi(>SWyl3Xmhs4qnJ0eBi=8GEt66+BFd
zio7toeKti8!fqI46!mx*X;Rquowc}6?nNgca+71j_9%yDbeL4|o8QiCh>2Ui53=y~
zJRPzDM&hefm(6E&a7xZ^M~jTO35PHROs!r+Rxh{nb#^uLZAB{J>xIJ;SICv*0CnjK
z_^kgu`n}D`+R41SA0|>ka77H%N`dB==ua^+5d?)^&|W|A$ux#FI(-_w7}1%2oFEOy
zqm8H+qjZEK&oB*w?NY#C*+d6>QzrCo?BmWPutlJs6|%SY;d^VFZq(y)Dz!`Qm=oKV
zPe+;gqc5hpkAY1$q=@GdlaorD65OpkEaNJ?&0nUiz8ezNo;DyF7{}3a8t;GPzCefM
zr%XuGc$Qj$K_=-j7=?y&QL!S;Rf?2I!>$Az5@Z}nv-U__y0>I7OL#1i;xZqnGaT=n
zm^h4-Futz9vo|7vu9yV2S;6~o0uNAjEUOd~t8ZWYJCSv;OKsy&KgUedHHVN<wt1VD
zRUmJI4fl|}6uIf0U$MLv5#8+C7^zkj>>lmE$6KPL_Z(EJB6#5TeLa*j%&{9mctLPi
za3*$c2!WzaPMf?yg-kE_9+lGDlU9^h?ls?c$$owHQEo1}UOo#9s#qkOvBssk)qmdq
zE#amQ^?l(CqAa}?)q3h;mB@6qI3pGMGr%y%up#BP8}G9_>M0%hG_>bwE#0A5x_+!y
zl-JRfa`W1ikSA}Ev*rhei|60lg2pSgCd)^}?51Z&cG6HaW1*!Xh6UZ?GN7P<gpejg
zc?jUT@9*XUQ4ZNp|EAo<M|9120^>H{vmuhae<uy+DHk&3u1@e+e4DuR8au0Ka^Qfd
z`pfURLGqp%I5Vnk)@vvu{YJA|^}behwcw+b%}${IS=P*hTOaypJU@7PO!(DJ$doR3
z-FbGa*u_gJ{UTPFG3%;P7ip2cA?6ma{=EfExEW80Zp&BZ!YK9l6z6xDL7hbwCs*es
zhu$lGJEu>XCV&Uu-_cI81plZQz_4c!rQHm{AD{g<<@vuNBb#LT_G)6C!J{9v`{1(X
zZY6|bNc<0{5f$~ePu3m8*>|=e*WLJ53ds5MwhsBbmTuDRbdjHV0qC+sl(xp_afH+&
zqw91lQ^}3rWjq-%rPRCAm82e!*@RX%8>pUrX&IRlKHj?gB0-vuKDePF)XFCkcb*oy
z=LZ#~-mTVM88fkb3LkRYCOIxLBA1gFV&g1t+z;c*UGl!`(!7b1vl!h@$jjC2!U&IV
z#@*?(Xz)KY-nhgC@rk}o#^g!BG@BDP_}Yh3+Dv_(w)8Zy6Rzlvg}Bvo>Ir=_d)ToZ
z84+?>%9M6}{i@k((FPtfIgK5b3_s6OwYGbaOx^1($Y!f&o9HK>If3xCt>m3uX(c?D
zpxDNi6@*Vzbojx>H7h^sXbvq^4Zenh0$u=i{jiEzSg>9i0U7#Aqa4`N9yrhuTN7#A
zg^S7F60eeVCcE?t?X*mE_(1#SZT)7aAo`=*cNIEP#(P{FW~yqbn%tZDByLoC;PBPZ
zF}t7ez6`apvu{v|fSm^VqE5Z-_49TpCaxa$r+IP_nO2PwE1HhnG>Y)>^xym)Xdbe1
z6o0HWAU~iCuDswkA>ic%3p$r(qcW|_@&mH(i3q*4UL-BkDGx<dAw9dhodvr4(W0l1
z*}VsPP%f%Sh|FnE5B4JkiPv*Ad5yZC8U76ORWb}=WX)!rT&k-WeVW1b&3yAnWsmb-
z!yCtfQ$Ij_aK=ea1lP2|O-AvmarDlZiGD(%FmE+P|6`l&%xsxYu1?L2Eke5eCIc4`
z6CcGUMF<~tY>ml1+m&p==k?xiMk<L*tgO)l71RVeci-@J_O4$H39>dneMmZ`iFd0$
zA2msoiGe(0yb8l1wGrNg3PkU<1;_RZK{Km(_o*mN0WZgM4pQ7YQ9T9DoCr;kQg~2W
z<gTm62Sdx51r~>!4jYhm3?#S=dAbhwPZ9;w1~IE-E<^A(e1MTHw&PTET<Z*Beeo}+
zIP*r7aJbOqOCikUsQrCqgs|`AjUH*Spd&seG-Fd+hvHG|)=HYC$rFZuCtkzA;0#Xa
z`sM4kjao;2&l46v#Jc04A1!PVds#E<adAv=A*5=DEl^#e@R~4X{EnU7o74nMa~lrn
z7Y0S9#v+EqNr05l!HI@5i*@(&<>sm(%?7b?JR+8P4vuT@64v>QpZvt7e(G&_=P#c&
z5_B3>OE^um2;z7N(mRbiesfrlyfFKD$;usV_Vtl+4jVm7<@C>kx0Q2ME$4j&D|gh&
zE{{HUbVU^=!LP>b^rGEcd(%qWX^HPnF3JC3-ZtqbEL_@;fZmXHcM^u~`+=$gUZ1@b
zB75IVt7pQN*)ezI2X#O`fEBTqj{;ebR5QM8jbGXIgVkO-4Oh}})@&XUHQfEv<DPv(
z@0TxpD`@#uzYxjqP6+(CqyKf=|LeB@-{Q9a4^(uOPM=QvTKaX#5uN&@unSej7V7q4
zCZ{GWba%2B<|A0ILp7IXKhX2=?+*T1GM2d-!Uu2(2k%2Uk`AXgDi*Ljl`0&I(6)$g
zS4MyoSMoz%XA_$qXv`>_{j+wA$+-Ma+vDH1>nmgMNLJ$qyF$EVMbZ1pIuZh>*(5So
znT5LJPRh^7uwI9oe^#Kq%k{x{zI6&HZBkVCK+>k4qm&v4_yP1gz2`Kgg955Q)cIzK
z)pRCq+wkKbz;9kZm!n{Y(>uNMn>B)XU1iqJbtW@36zXUIANNh$Gi`}4eD+<K>n6hT
z69l4_4$G7!ME9E%2vgv%B-&y*!-vGFcY>K&L{C$s0e@?D%2{_avpb8&Pn(ohb`A76
z030S<11%tlEqzs}-A+<jz#e9HiDoKYCNpd)B{PPJlc~G?LV_sP{bIeah;ygDXEG5#
z<Pn0Qg_Kpl&vq3<_1#KHK41`QN8fftNz+)p{Cc0tqv;QPJ`cgxE3dw}25y~y^jxuU
zvhPCD)#G1X(wCW*E=xly*-)R3rO&q`48}G4h#M7AJ|j6!Wc_mcww&zI%n@+9?C@nX
zI~RlcvKs`YN`4jRN-(=-g=a&*IuO&t+b_A--43(jHPwRz5No`zlk8^8=ec|IJJ+3!
z{b-teUX3;Tol&RBI`ge?cdc`(nzZy@$Po7*%9GKzGAX%|Xj7ATOdGp2SOt@&8(jup
z<G-2oTVwQk$Bs9~^d#=8@Sr~1*Sf?gMf%->*6Sgor@b@6hrL?alsjJnZ*|zDkPQkf
zRf^3z;M#=8?5&=XZDvT)9rrDiEm~=|DbRvhJ^~96o&S_t>?#oJ9$*(>83A*@KJDFH
z3H6m<*C)mdTXv|6N#|i?oi(RF3TupY7;)>4^R^%|1|dMI(rhP2y1B?ak@~{^ZtCXH
z(iO#P>2rkNj?BF;d^vH78!Q^~wLp@2<iWtDPxd4^On;IRd2G0iU8cEq!=lwjMO>1D
zx4v33X)`(GTtxRi5uv)OPJfBYGuP8U)bYfJ3eVGzq5H2+;D(nhhvqT!Jc0z3?F=J-
znf%=$wXa9dpmNl2(A1mkt_)n^*$L?HrEfk1?Wz#e94bnX?~<e&!WdUdX&+phXKc)V
z-mHBdVDmD?Wnor-7kw1JP`;0EV#=<>a03s}f^ubC+4lI{P;ZqEF0stgxxMHEF|J-}
ztc@C+<3zb(@82(>5NK^m=IohMGUubK7lOESBRm%Y_eiAMef&5Z3$lMni;UEM#&~UR
zm%Q@|CC88s3k2V~lKA*sX#+EJdQSiOF_*eGbJG2@2lcb%hu;q#4q=l$lytP`@<O*=
zx~Y!qdioc%5x}RtUrW|mdAkKbzxhUlaeLCd!?|101FdKhMYsX9T*+~_qUHBt)hnIU
zE}#Uw4(EIf==R<tkQIEETU`L`EX=1QGR(+u)^eJ>emBHoYU`yYfAKZK>grj?zXiiP
zXui?;(W}VM;bFLmYT;JPskp{WfXrcyd~(y~#S-Ngyaj^jq(2Qb`Vm+n*2p1>%{;04
znaTZ4Zm<E>Mh4}6H?K#(wjV7^@wb%p7Z#wb4i;Ke#b!wYqA~?H5X_i{I78hRgU(au
zHghxyH4<a{n<PTfZ@TL58>rwuW(vBN-vg}ZfIRFHv^Ew8EbOyB#eo2WNBgyC-ie{F
zgdhr(N33DS9YH`usvok?F~Z8Z(kUUg*<6HMXpCVkk5WxLiiQ-onyhLAusgRqLlQ9r
z#85a)x|k?3AC<U<9N7Bse*OcITZN=wNw#rFN!x1&0wxRrXF!_vDwvg9Y}>V?;!Dw<
zsl*8OIGwK5-QUSJ#mFIpTFj|DvnlSwHN)Y#py%iNwnBC`Hsq|c);Snx1gjq#I$bkc
z`?{p=R_}c>q&uIsoHvSxmmirD@48HG%jQ)OHOyI#3bhLebihTId`b*Wqdn^78TO#}
zRoq>KbVKw;0Xd+WFqtfJ0eDplSSg~P;N!afs1!>Y?2)DonKS}?D$?x1?VDHYxnErp
z#@{s;2yRjSc7&h1+c<lA@wzu<@~cy%Vk_mU-tIRfuGm=?nHhB4W*4?DlUk_1WoOx~
z2tB<(D(YzS7Is$a2dAhtr-*s#`1G1kCLVzk+xP>Z?+K(dU-K;BS?3zwoimOJUESk0
z@<&m)xqB&T1X-fLGfg(5Y0Q*WRh`pM*#7vc|I?aVl|qx%#i3p_Q>Cths-1oHes33w
z4IJvCS=3X#c75MP68%Jk$s<R5?Z62kvpWmka(>Rk^3Z8*MbQZtEM%{@lfLiL!S8~M
z*ue}qaRyVD;cSQzv`l85qHWrwA>{Qb@5|O~omp>if9b(1#?-m+ME}P)T6DnGYDS$(
znH>HW@^tP--|IC;gTy}C%=ceHed@g}C`pU!`T5rDv`ZEY#j>KS)~5!duh5vR$?=^v
zOQ-jK-dErN|4VQ&b@BN@UlM&tF)Gf|!x!WIyl<h?{x2Qr*aevA?A`;0S@~&1^>P^s
z3&mz;N<J@EdGfw|wB9<6FJOT%-KECh0tEFOgMTCYZ{@o1p83tUOJY$gdRy|9`sGp0
zpwP3L>q|v#Uip3xa!}kRe9{i7TeciiIEQO{2fvnk3x2bkS8t;o`~m|?=RYHLzg|#M
z^<_c1%!JR&OM~gIEj-7T{ZgsUNW`i!uV=WGbH7Ad5GyrMR&KGbLYg7Q#_51(D(O^(
z@!%zCJ};LN%n8)XESK?JD}MIFP1fBIgSZftrABcvtvxCEY9{Xqa%}->o2F)j2Of;_
zPuTh6THiu%-)h~f?V&DD<x0i-8gHo|V7NK?@5j>8ire{DLyVHt@p^|XY4=*&@l;|0
zrf5^NOcZD^scG*u&dw%t90#^s=br$OClRX|4;cRFxvA@2Yd!_8>^(EDkiV406HR7k
z4XVcM$Ddi5)lK-B3gA?QHa>z$Pf5)yACLwb>lvM6<RxOs<D?e2(lGVz1E=aR6+R_K
zLC~}Hz)Mr2ct72xLb36Ifn4{&qp^J%)hG6yO4;Y;7{;u<cl#FU`8o;dSZ|TxQ)!1K
zDo>61(#W%+i(4Cyj66zwAV)ohtpG%t1JR2ue==ks9JXA;mh3~T9vvoc>e+DQ6DoJ$
zpEfR*hmfK~gT((Gd~!mnm2-+)S;gH*V%$^mr{XQ4vGiChpO>l9lSlVX76SBUtayG8
zuL4=sUkx+j)f-LGy4QcrsZVG<W?Ga6H3sqO@X>SsDhBya0kBmyb>i)Cv<`OFXm#|k
zOl(_!Num$Az!BO#XWwmX|2&q$v_otGQEtp2`jKjpLu{I}=c2q0CDzA<?9$nC{$&s1
zsG#_c+sJH>o*^ff1!COLie0x4)+7yWXHl(m-vhn!UJ1S`3h1->GV$eXfgUr~J)S=8
z@A4Z-F3<4EIy0sH5A-lI*0ClJmyBCg7%n(ns$NIFM4)93zJk~9tV)||YEk=>+rxJy
zEJL5F^rcP60oTVsExOQ(`$?fXa6$dXnYu_Up=c5B=;pss^}c(^>d>B7*Mt97s^7}M
zsbN0(z5G}1n&?SKWP8*zCvok|L_U{Ax}2^25=kD%Ws2hS2w9`S#j5y<>7*!Gy9wv%
zh_is5_a?rNXC4`$V{YF8>&*F-&Th`HY7e^!1%e*fYgC)|<jMTpo<ZcLCg!g+A>L1R
z^gLG6%JjGT;-nwm(l%<k^g-EjE!El9qGu3qU&qR$!Ob(n7Hwke0{8K1+-mPAUFWSG
zx0aVC^u%M0LZ>f;w(@IG`_*bXD#UA~N@o_Ram-*{*D)^eSIds;Tlm$#EgD-uUHg4g
z;!$eC9Z!sTeDSPO;hoN3Iz*^ahAUhMX?>vKI6G&>4o>iG=B)6Mw^Eaa7ye4{eB)N)
z(tTzFd-e!xeGc!ug=U)0PPez3WnQ}0(RkIr?3Dj(DW{>m6}=#wH9j#ja1oFr#>mT%
z!9V6@T6yV!eWS^Lr6PXtY9WQbmo2&51YU`r{$&voxRI6T+|9X`Rvl@P&kMdrcmCrG
z!sRqgtu4hRay64n&vbs~`I_JO4^UYOx0uwmQqMmPsJ{_2q3SIr>PGXLGLpPj@@+q~
zEuHq)5Zhxw`gN(*GYiiwEjG&MaaoYmgq5+3=W_A0a=$DR%>@k#T7yPx%#ENPW3=Uj
z@i2~`Pk@m#oNen52vAtNRDVN2V1=#_^rnHO2_gX>fE7g&GV43GiroY%?$<z;b2kDL
z4tavTtazW=RZ)TBjZeg){>iJ|OQ7P}F-qr<o~wb&I;}dDbb0#Dc!zyc>+QQ+pq$lw
zM%7$*<I=8%W?I7idF}Z=Gn1+Q1)CVPJX}RWA{Vo9F;ZM9^B|n<7Y#AaQ0}mASyD{x
zUG|t9f}N>gw)_J{U65lLb^S!MLKWe%Lc(>he9(E^<-0k!;sVM<t57d5r0u?Z;)Y~e
zdB{KtW6mR4L-=skKgp&#fb>|yy#x2LFiT(ykh4jUTBUCWI!@-P)Bs=;KDP1oz4c72
zw;#R)uJz7}=8@xWO>E0X<L*CyMrg?bKO$6<Xu<_ea>u3>zoi_%QDn7m-^<)aa}`l2
zs^F$j_{MwUn#rBX#>!l}E)yzzIMCTP^Zli2rId27;Ir%RnGOPgur56g9!-&H4-nk*
zd&gt-U(PhlXE^nI<^a%^rmD=W^1qR&G!urv?kNPVdNH!=SyxfRzzwfC%QNe#Og|7j
z+G?f!51r;~!sca5S_#NA66s|&vr050fE2HpYKRuyzI%*ht>QYPI@wH6l(2Pxm#kMG
z+_se3cPi=0;qyN;8*^#LXWJr}(bvviUASotv-Hw^B6gPC>opum!6C)0w4ny&d5DGt
zKerVqVtysWjyluu@YKa1@qfr<7XyXsJZg?kgA3tzTFNU6NfCqjNl4j=3NI^E3QU2b
z;sZb@bDqm1<87xg*p-Mce#&5W+D)4pOO7k5oPXyH|HD@@B%k+<_ZvAn5S15QQa~Qu
z%hlV~-SGK4Je#J=)qjEnI-_2S6cfV}^S(Bj4hf}Jo=B{JtU#U5`PW0Vrxr>3P2kE$
zMW>6LCM#VM;ajs>6<*uWf$KI-!!UEytRR;u*UZIe@2)(t+|6Uu>_V_X)83sk{Ytjy
zfsq^QZ~iQB{Etq{;Foj+Xz9#dRvKT$#*m-!y(oqKqOF-FitMV!H<GZ9va9IKjX?Q*
zr}8ZYe`X4k#M<W_e9?57fv)PwaWg}vh;0b_JLmn40Iw<Z*A{lcIs^OYPG0}>8~KJr
zC%bXD;H-~X6Y#@%5j84-u9k|Ax69?uaevLkf5+-YQ*d%rgi@n&jmTZi&S0K^TlPtd
z30thGF7(mdORYYZuAXKiz8BWLxQj-sYI>fP9e7Fv{LnFIJ`vEIY!GLYxH#FV{zsBl
zD}TUt`%q?zoACBXW$`w)@Ti}4_jp5Ap8<RD%=R6zUQs?6^xgN)M7Ni;<89(AU4uth
z@j|G?rGve(6ZeAEawamIRh);SIMupCJtPUDJ8y3UEeF@3yg+jGwmUwAI|$42iIsbk
zCI+R?|9`-?-fFw3fooJw@TjR)Y%GNgk2w!!POTlZjRefzdu}|S8aJEQA}-z4pY0tM
zO$u__m|x1H>q&`R%@mf1?t#=hR(>KD=7zU4n}Hh@-WXaeI(}BxMACKUxFuR@n%j#^
zwN&p9lss>ne?%ky>&}d+16g$yE6)lPm;)^u%Ln6&3l$V_29U)0_qBp*Pf`qk9Zmyy
z3pxfj{EATHjM3l~r7oS2jBss*#5JasD&DqQbe-&QS8(VtgVgVHd0t+Lk<Dt)Z&Q$N
zT(S{OYib<h1dBLq<2to+`?pRxHiaoEy6pbJ(EM6mdu}2?z6t0kP=9+kSuIseS<6Mt
zdqx@K;ZKr{*B<v;5bD{}*B-IRGxlm#tiT$NpsJK_V+pgFV}`^^T6nB~-hlaV)k`>L
z0x~<8@+Mx`+tH_*h;MjO-<q*T)}7}Kx>Kav$;A*zRNBRiK77;aUrXr(J+AX=zsJ}{
zHomG~;+lOqcq2*!Qo+~LvsZ7ts>o;S?5rX2sy{T<{D~D#iIQLepLWe`1&cvPPbY1T
zaA&V8Hj#Gg?Ra=FuUJF|tT!7>;l(Xq_SGZ!99e!@V?}f2>cm!kdqLI12~7n(sv>}1
zZKM9wjsIgql<wXcb%C<NNQRMhDIdLD55NYE^@?y9KblKdWNl?$Q^p$_QZgqZ!o^l|
zBjCIxy<#5fa}WGDeO2d&W?bFA6Z1wZ@r^j7-cr1daHdi@+Ncn45dgGJ?masBg&#2y
zv2|F-pz)SsPgFz|^TMMrpRgWg*?S=rjqAFD&<t1}kLNv}`(T(v`8fESHZ|gh?po%Z
z29}J+?2{pys{Ss%lm20CJxFfc*o^5Svn$PQ(NaOnraN7wN<|S~h<@Td`=!VTICE}!
zPhHfbLBcs2&g3if$;U=ooIhGL%#L51cB|5RiSp4tUFxrAeKl1foGPStaT5#NKFGFr
zP(D95U_ws4>~gF@S@RiBZRRA=El%D&D{$F?D!sOv-Kr)X%O8-e(cH9KcKNhPuZfb*
zBid&&iCjqr%0gN&V3ydUOz1CDx+QqDnsX{}-{F1Rr9$n1lf4^3IYak5?s)k3kN6js
zwC4?fRCdq~tV32dso*Q82|ewh2%{)WZG~+ZtIk}k{vrEoB>>}@-UL?_Nd-vUD+f?E
zw@8qJ_St>WwLchh%(lBIR+TgX=ItO>c5$7iDN@em<n-1y@66}mUML8-R#{EEmvAhA
zvh=yIjJ|;?uU~S@OLVdp0awCd{XXf>XUgGr^;MBk`$P5fPaetCBgDT_qcwvV;vS)1
zJX#~;npBZ2lD_ZbrV{IJr=Mh{l!xZJoQ+UlU8NQyM%Tw4w%$=DV!a)HPv7^1*FWe6
zs6_c1U|=NFPxZ)*pRscLK;w3>VKe%rIoqu(SuIO>rrx~FuSX4G75W88r#I2v%~w&X
zMas3G{7-)G0goa~1iXcSJyR2<2b~%xZfouSSEBkqu%n#YgJ{B!&3?np@vrL+OIC|h
z9+ZB}-?ue)J<mXPnRw-U$Ga`w?|~Da*T#=7&DZuYy$)d9Q==^IU+A<}MXO3NTowMK
zgYdPL({`K69;a*w@)ifB4PXj;SblkL7viZAY5pG^oa(r-9d<{b09pP`^GmN7@L!dI
zwJd)DgOFmHWIcs_`MrOimDx<^6@)(Qa+m`P{QSK)|HBipf0ab>7mxhg29Td68$!=a
zXz%IU%Kyji{P#Y9|K6tXua`Ys8BY%MzbjCu6(qy%)Oena+4}Q?W!!uc)}iJC9#EWH
zTfo%V*{wreD0M?0vfchoi@lx1$g#JwPHss_C{yIxvTBbU_&9R^SAGOCGd;E4<8flJ
zM@Df0muv^4M1rG#wHt<-k&~4QJ?&2|j*QF76r~N;dE2<e@J2w#g~j!V$g_ek9J;&?
z#0=N({#Q&OF5PhZJf%$TB4|X5M|7njwnYLp=A9dHR-ujA`vswyhXfU5_aBMVm|$|)
zKV>#bp3+%78k<SZaUZqSvfFF{_(B>-+7T^Isn?V#Lu-jpszk5J?RHZN74@vP<;Uph
z*X{#|b$3WvxokB-C453USqj~6y!Lv$Ej8tAoR`K9ooCihxbFXJ?@FVZy4tk^h!usl
zR-quIwkmaCk{N_lsnAw|q5{ek6cL$0gfN9uL`#(+S}Kt-(kO#W0!n}Y5fLH?K}j$&
zgfJQikN_cMI2ms2tzQXp*Zp<x`tG{s&tB_fpM7?A_Icm^PS4{>Io0r0MUr~!Dhs5}
z=_;JEV;&#4z)Va=1o#g%n-Ape3;qnAF?i>KXJ@q0<i)=V@U+i`9{f;zy=Z&(X;xF2
z$?)s*FZ#X64aA^7%?zSRWa95F_47}Q*!%}6ox7_Zv_t?UA4nX%TZfyA2r0fg`J&>B
zDxm)9u;8|#^Xs{eQg~8m@T~e16haHT19k4#)lS=IJ0*tt`Z|g2YD+_}=GIi^`&-Yj
z<3=MgOKfrX_tNnNccSiLsZ}in2qznqPA=u@wD`h@mOwS3dQ)EAJ>xSc)inuSm2`*O
z`l%&G*?$smbUOW6=7s`q`TE?keAKv<qNRY+c^Z0fRZWrorBP<!Wgu6d-rMjj@27O9
zhPsF$cl#~S>fZBvrfd6R!!E|o_BENHhBOP>R$GbMXkuY<olRRr#zSgqp-)&xtxrz5
z<)npbL|-bw$RsU6Z>0rwJ$#5g<|gdq+}<WZC#C<EXS%_0<;Ec9gun1^%ML&ZqHKB$
z2w!bjIY?%>RlkIg!P0$eP53I!v-pF5=zWU&@<aCfWc~LJ{AC3&|E_Q{!8h4cXc)dv
zz=D#Jj|pn^O}DLF3a4-}JBiT!;<02<#Ou=M!X>-5B`U8}$6>uWG@5)|edt??8VAo+
zfdE6@w-Q#{o?$+i3nUSTQi${R<_4q+2-H?W1w8!x@M>n;p-w*ec1yORn;jRV!raL)
zG`{kz0!GXcvEd;!e0-c}VKxLPhrr@BQv`Go5&|vcgM~Pd#Uyccxj@}|CY6Ae3`uh8
z9?Xixf~8pk62P>56|v%VMgDc7VbyJPCW)q*7A`4JD$s<JY)cV{nQ0QX1r=z-fm54>
zB&u&xZxNn~;0s!3KT8pyaosQ|4WXnU-t5^80Cgwu@%6!Y<8sjLgTn<Ok3HN&(PO~S
zEce@7b|KJLhK~hA?P;Rvp)yG{w|BNVLv(vqSb^)k3`OMSxX~ojKZT(i000+m#KPeo
zpCAH~(fcr1Q|t8vrIqvFP0v1tCl%obX*6Kohz>Mj?cuNnd^|gK1S*2H`O=%vOkQ(o
zR}nN^+v1O^3~u_1T0;gJ4l5U%s;o9$1-fvuhh@Uhg`?lZNL+1xp+y5*B4&X)V-Z&*
z^7Wk6h|0s4+KAXpCW(Tlw-yzKa1Z?|yya*C#e)lD6!lN6AnWZ`>YO$qUPWhi4i?#J
zRoZElVC$CTMS#UM@(EN#)Pop(e@#iN_7L$2Ucv*ns&jm;A|c0@relkeV=>~(Ts{HG
za!}<6xfBOD9Kh%FqE|oNsj`7g-@{2%&xf~P$FK{pOUgyh^8+%=I3d`@YZS>ju4puX
z3@0R<l`QC0#<DsGTSP%7{w~{;MWmDvI9Jz~^LrQQx@G0ub?AuO9#MS~!~JbR*tee?
z>NnSUJO&wZ77af{!z4>K8i8PTi3?ah331mF6OREEHX<ajZknJ0eaHzAN7K{9oJ@;*
zeNq=7C?4G;5cl3TM+g=#IRir}tGy<lU6R(EFTQ=c9g}AjF5(YR3t8O2=f@}ubO@Sd
z6^#^&`ONHrIqCZE=UOXBI{^YQ7wLeu#_)wx%;XXi9KJj!1WK<6rqV&ZIAH}E23TC{
zQ1`y8u;OUp{esVY_oUb2w?Nz&7fMWJNjz~GKztpz5I*|Ju^dorNd@>L`(6=W0Hx9l
zO>?&<99<dhvAcg(JT<UL5f$>KZ!^fJg}~90dHFEgC3=Zf?zL6bN+*Bx-Lo`D7Y;vw
zAzh%VjUpCX0b*rO(O{=eiz7c!MDt(KXL=WFez($D)wt56H$Z47h_)M6+r%FMx&E)g
znW>AuAVKl*)f^hIhp&3mP=192cxeCjr4`!f`SPNs_pVgW%7-BC7Y7xh&=n)*ibuz~
zL9>G^4e{94r&p%Lf@u=9vJ!l3BN}6lj!|%{^y5b}I!3y#l@)*@rmha7qMP>SVWOi%
zAm-z+EEu#Yp1*{JQjoe(WvM_E6Od?<P(-4N;M^$?1>y(Sa+zb@01F_x_eKH$0$ds+
z;9b(z9!0YIR)mU_AvwpgxpH1cR6MgOyp=~1(QzQGxroJL@}PK<h=RkRiBF(ZMC9pI
z!2lIi0UOk8E|S!NLJpfs4;}6vmWoHze$I5^^in{;3ivp<$0i-b7OC#!6P===fB;1m
z;J6g@%o{wDDv+uIs%BsxtdA(EmnvHly}gbj!k2%+Z3nqn3m0}1&TapMkgMw{;7kle
zc+W+)7q5tX2moVLe4!&yhsR4s1BjBCkX&X{6d-!5-U0~lDcwW_lscbyCfgBs>l*p3
zk2XsS73N2VvYOmQVbZiWSu{P*`b98R@PevUGlb9hY#2TSv-SXC<#rMTAjx!zRmh|3
zmN-fpaNr_`6|K*h8n8s}1kRI*-K-`dk7IMCyLEW>_mc^KWtIOc?$~(QFG*6hf9b5x
z(mU}jXCWS)?t(IzEhl@E9oanH;Q7c6ViAFcep3WxSAt$uFq*Z;pgN}z*A0!21D+Pq
z@lySc1Hp+>al;umBKnH#_+6dVcUyvW-~1HN$R|AmDDmSjA9ubMVBG{yr-4c^e%^?I
z8+-B)h`#ft5q^O=BCb(?Tyi5x?AM0HfvD=3_P2;K=M`a~x(b~}0g$zAtj3Kkrx~Py
z>YrB*DTxn#(_I0?Vw7q`UA-j;mqq3BtpNQ#-UTBjKodA)X^=MpBS}NJtwhkN(Gy5c
zuRs7{@(2mzr(7#Uj9CdZ<aGwSa7Fxu&${M<w_KC#=zy*h3umP#s959i`_gbFvKx+W
zumvP>+^!&AG@N@I%ukedf+8d!p|CsuRh(2gxAtaJVJ<{0n(cyRvJt9QVoG-fKKIDP
z7X2vP_^B0-LS3Vl&@_K}jORmWJP|T{48&8)C(tlvlQ1Xh>F4w&z<~>kul?x}djS$a
z;^K)JEGECj*X4R74iFfNA|!rd&J;6V%pIW8fw;qiw?zC04!*@JH$2R<K@hXHHtr^a
zGS;hX6CweH%}Gd71R-vEMOW_VH?fb)*K`V2AUz^#3;t3s?`y!8o8%u|IUij)tGaSN
zv;)_!8Pt?Lbv0z~Hro8BNrrV7FY=uCfZ^<ZBqaOomywZqxC@85KkaEOZfVxuqAYi*
zuG_ZTknJ`Ho^V*<I`!<nRQu?+Ho0*iGN+Ji%z9qS(IWDmQFj+Jqt#1NrqCCBDW7YI
z&nGI|>-qFO(r|bGL*kDqpQa%OowJv^!qOFFLpK$^eeRcnj~`QtxFA0LxUtF+UT`;>
zVX#!cP&K*GS8IOEXo57;;CS+ho<tK#q*N$yZ?_|*WrgHA5tU$Po7afhdqhq4SI%s-
zdn&|Ey{+7oia+U+nlSOw*$HYEdmtr5Rdc!r>snzypbF!tKX{NSyiuO@R_71nB>XWm
zA8L{j#%)TOtL5JR&;oAC8oZnc{r$m%+^4_l7(T2}j4o2+*5qanrhn~X95N3fh@OF!
zMC!oT!h6H%8TpgNVOm>k8g0DIVgmcuC(YiRhzqD3Zv-sg=rnZnL)4|2R`y0Gy|d>G
zyh^jAa;$8BV5pX1wDmyn$T#z9SgGrH+6*dJZwuWkYY9g^zb45l4dW08`|MDeo#cjK
z!#!}wk?DuI3S5Was<S4Hywt=S5fLnLdw=KEEPvjMiJSTj$`yMrVS6CKo2>HBD7~=2
zhu^9LzNN2Iq=#K=-$e6o)INoCy7rnegbG3-AEBcxuBs4p?qDp6KhcUXWS7<%GWHq-
zmX;MO?WnPS%2zsGJHzp!?W0!3TRkUTG)pVUigQS?D9A#n$7N8YFd%7(7Tw>uU#^~U
z?jG?T<DNSSgJ<*M9lH?i4ZMzhnkl<vjhf+|Dk0>8yT$tQ*@q1(`BjP$>{E5nX5_x5
ztPIPGMvULF{9e1cwl<4FYmCky^W+q@?@hdWO8+0;MZa5wqrn3+o!QBu{riMUcd7yh
zxAU;pb<VF3@durxq!*ltxpXhf`S{;pX4h)`fD^{Oug+^oo=MT8`T`>8kVqwPr&unw
zG7}nT7IjW7?HIva9cT;PQ0|8u%(Q&_rFxXT(E6f2BSU3_O1Q&-#xUIN)QnBzY>n8Q
zw{fE-mlNv#&C#O=<c?@9kANp8xnFT4b!twOCTJuy%)V+c#Ku57q7$)|ZKv!=WHYxH
zIsD%8a+7G(jHdcy-9p83f{m1b<;jw_NRmv7{Tx#fTffih<e98AioDBlV&WS{*lt$#
z)y85EHO|P*eZrhc(az*Btaw*ftJlFx#_scc_WC5z%?Y`H%8}!*=N_^;B%P{pwohtR
zLngO>#f2~I$ULe?^EYAGp)C&0T+m3hwQ2m(Z^+ckeYC^1O<fRwUF4d6_v`KJ^0zJz
zL^fONG#B-O?vG6t6Yb-VQBFmcL@4d4R?0j^F=u4Q7AU0ambBvr=H3+1Bek`1bX6mo
zW_q;K&Z8ozu3w?01!Ts>((-MMq0BQSF9!j)K4GOJE9rP3Hh<qC5VErx`)c-HbAU#z
zeNH8!##U)y=ZN$TY4InY{lc8`EH{7Qa2xNE_3R+T%E)fYOfc`8FD)uLnC>F#@TSh*
zaty&WirRIq?+>uv{=8*bATWq{W&R?$fqW-^{>sb6pg^ZG8@uMBGHJFf>s)1S+!-p<
z)+$gy40N(GWJI8be;DFr)N@V@8zO@=kB7RQ_Oj*-V$FPOYNRH9<PSKtwy3b4pqCVB
zo?&_JE=_pk@Z7Ko!Sz6yP1kgsBCdMm>mB1J86#DZ3Sp4yvO3rkL4@dSjdhpDNU}i%
z&hj852>bJ4RMSPz4dDr;GkcZ?j|$hyvp%uWQ1c}G>@*%z=|<De?P)Gbb~>Wxzo1P6
zF+b$%FkdX<(voqvLgvb```GI-OoVzET#v!{w5-xIFK&~f^&~oyya(`}Jj7!36oJ=H
znC>zeva~LXwe%}$gDa=T==DC|r?f*;mE$@Ss>gVFHU1(>DRsI`E31w(Gj<K4^SVp9
zzapt8x0_UsFqM+V)mPB8c{Phi*^xgWM(z<yh_&~=9CZCVs5W~>kLUO--=)t5nH-pB
zVB9vOen9tjVEyY^dRJJUYyXDy-ayTko^_T7mS(zMAs_jxz}XUWg?-KxoFOC3EYOG%
z>Z)@y>*b7Ppkkwm0qu}x@aAU6@TC}7^Ah3GH&5bc7Ql0hNi$m7lyuG1e)+pT22`^{
zGr_RrT%^tHv&YGvE)$xl=JUOWbR(wQxVy<OLO#c-MG%~=d@clB;o`sRpVNQTTiqCf
zlc!}!m;6@+&0NZQS><Ap(|clTn_qV6PW8>0$^GRL(~#nrY#(CSzLV)-Ivhc4!m2(t
zP?qGJcolI*m6OZe1_fFj9K-6GsX6>p9#WZP=|?8^28FP@it08U--3P|asPN@MXrt_
zaZ&h9+n4IzXX~4(Vq6-;lOeQ?v{<ml)mUdVjm{OZTYoGzRN0#Ma(tk@T2U#<nkQ$G
zK6j6Njy%4<t8OpYb^z1FCk@}2<R$$)Fm4a1d@W^7i*(em5f?Wn>~I@OMT?{(YHnuz
z$y%aDf}xlul`q6QFD>6uJ)0v_<e`W^k{oHo!;I_n@lfvT2YP1<UIvB&?Prn<f|+@o
zZ*FqwMIQ2Sn57xaU-%}(#R)!9-utoxH72$SA~Ua^F<{wPE;uN_(BtdvY?7`OFJi@|
z^Qp{WpuB$Kq-t~P?4()pM*KG6&ao2;bl0e8)4e4|vr-B@z41eaF{~X*NvbSRF<sCc
zPCjstm;$w0G{ZqQ7hJ}FUhtHV1l-_N2X{MyTlPQ@_p+~dUo4!vYlcnt6%JfiNDsnk
zcV9)w&FD}y(FI%cKNLrwC01uAtSjNHop|MB7fn4B;l3@)-6?!ydYt1MpL?ysZx6hT
z88<9<FrJ@(BxEU$W1bd<M%}425Ngy()1IMbiwM(ZvaUf)kfQsj!1z<>G~GFpXUc7n
z7L=Xu_uUYYq~XwUFWT>}b!tB%OUG=7(!AE`%&W|~v-t<h((m#UGt%t?PH({L@eT^6
zzVn+=QU68_iQ^-4knOsqIF1UHTWAwHRh6w2aIfgMYu`;iTOOtVG}*~7x}(CSkOXm-
zMEB37=NnT&#prFqfbXm}c8(;}N2GqSt@6{2xiXnh=PK2zN*`4KDj18>Do9~@?YWMS
zplnECQhylY`)xAGHHjBXH@MwlIOyibFdiN%u{!P%ww}r(v?|2xCY+Sjw`<k}uQ<c4
z8D9GDx{Nn({Wah}>!bf=$^L_N+`c>`;-kOo-^Jg>nxHpzT$cBGjgp1+XN@F=`(d=#
zR5$%68qUA$Ny`1<9zFlu6&coIbl3f}Wb+kXB3%zPo3gF4S&!VF`(30A(Lfo?^l}q3
z-{f1>oX<Z4n^;}h(nN_N)4%hl6fxqtbKTFU7SGYRjnM{P<d^EUe=C`~DNwS5<psRD
z;Wv<)_hj+U)C!s)&6?&MdQ+It>X|@N?-7T!#x&k)`WaX!<%t-Z{F|siLZ9rdU#IuZ
zqW;Bd8TkR_epgAvYAawp=kKxh4rfL6N-Y1&lfN;p%6e1~kNjh-^&x8Sp$*<w)qLFl
z|EBnOn$sHQe)eIU5BM~Y3NcCMCeB$W-T%p-de5OTR)q5Cmu4P(Dg!C$O&V~?{6s1p
z<z%o3H^#u<r4h-?TnvrTbyu^=-7Ygg%bjDW3z#7lBxu>j!ZuA0^W_v^9%KbeUZOns
z6D&n}^ZQ~geGmTd1|H2}aIt_pc!9tjygH#IZY+Wy9e+L2a6%^@zs&~m`TI(|)2z#V
zywn2LRaqFvlA%Nw>2dgq4BFz3#U&>tjQtkDGA#V@uwsfs^g4|FMwzSgKd^qL^yG{(
zKJtJ3lS}r|#r8koV%w!&ZN6rW9QViX51;y9;-O)`-0u9_jo*gIG8_VTsYOzm&?b##
zUs=uuk>HO}(%FKsSCqjzjY+MqI9R>zos?J(a{GrG=ap1N`W;@5S}n!uN2%y^*)-~U
z&hX?s8~EQRDayNUlo?OYzYT!;_>Y053#)v)FICNsw%1x_&|=4K)#DilWFEh$#z`Sm
z_gq~u|2+MXAFs$TSiB4-8x(wMw?%di%hcsZuAqN71U@n?y(5Ckl_88uID*-*M*10+
z|HW~=w0&}Y?Ozvu*}C3l%eybMHl(P%Ywb6y8og_CRQ3GdwWj)B<acf8xhF+yrS0&u
z|IY&mB@e&NI~Z{BE>F4?yDuL-efj*^%Rc7bmwcqnnuB@=^|kekwe?I+>6@AB8Jp{y
s?$^^Z*V9Y?dDmr`8-ha4`(23suWuOLlJi`8!<rwD+J9eu#Oum`08><B-v9sr

literal 0
HcmV?d00001

diff --git a/static/nic/ecr-pull-instructions.png b/static/nic/ecr-pull-instructions.png
new file mode 100644
index 0000000000000000000000000000000000000000..0529237debd88fb80a33443663e8381d5a683b04
GIT binary patch
literal 148462
zcmYhjbzB=k7d9HCIK>^>5Q1xQZIJ*8?ozBR!QH(`f#MLfL5q7RP+VHvp=fZ5J1t(I
za`S%o-uM0XpZ#Tb_RQ>@GjnF1=h?*SXsMDCF%kg)08$tfq6YxrdI12~L<HEFD}rk2
zQ~+$HCKyD)z(4n-%P*IC$m7;xUhehm>25CBSJr)b5CYhv0i%ZLO5t<DGI!7l&CEMo
z?}r-r%ZH3EtksQ5pfGAL03kU8(6e2}T&pANMqKLvb(_3o!S@)S9NYt_`116pzr@O{
zL!j-0grP-Z=uiAm08x};p$-@Ie@_0S_A$R~(F*_nZyhd_>tc=t*8fVh9_fy%{qMFV
zubL_M|9SL376zP@xq1Ir*1wj^ru6@_j5*cOl-B&WXw+6yQF_LIE7s{W`Yh3b?IxNU
z69x#ws_N?eZ^;3g%`B)X1vv$S`R%iJVZyz>C9l-X|66GsdR#E70R+I_`s$7H(IU%_
zy%p&n7~t0|bX1q5j0vAH{_p#3&3m2l@`A7-X%5e1ns`004&cT!T7a*yBaOUc`*qbO
zJKNFf*kL+{|9gk?s@BX58Z02d&OCKd!uM!kx>#R}ITAh&2s5z_G}|eq(wEDr&JyHt
zU<H6+YF7Vimhog$WeouVfB{5)!>*do^tSSaoLbVD4%-|U27t_cEsdcHvHu=roo12a
zl!?CM1*ZUG0spswvHh3&MwTClCPg1hX6G-yczaPgqQ%M##v3ke*&zaib^gQhbl*8N
znOfTU*?tklJGMMF@d?Nc1s46^uk6`cmYxBQjlr6b$d6^oIa^|p${g;e7oiWxJ_6Zc
zv3hLA(Y+_jjk|WPc=`NGYrP3s86-M}zKZ|L{~R#pp2)?EodOP7{Z#5@-|4l{AKSeM
z6v`_+y!+dAawy;bjd@DrU+3*z8oTE4DBT1hS|mEtonF|cUGM)5D~$8AzQ5EliYSRT
z-w)IdhX42#t6y(<D4ojy0V`kw%vWD!yz3l3Ng&rb&OJF*PY~d9ZR>XQ$otZpngp&)
z_`h8E#(ZsbG~Qryd+>AG;xq4)egnVWBsND99|doQ2uBV|0z%27=40k3FXnR?O^syt
z@2l9~PJAvc2ATc0DRHK4FEcXebS;zwVsBKmPmq#Q`T5waQnTy|lLpsEo*Y<_U+Ehv
z4Ne|Cd_(qs9UNtkS9^)|HJ-WRf3X~8o-rC1CMk@4kVN)HD6m3MObsQ!6K4Lc8f~yo
z$NC5h#EHcgJFHacqFO$=uG7>huJbtT|MspT>bZ?FfH`11=|{qom8Wu~z!Z8=IdSkm
zatc6<0Gg8=3kyN?8JWe2os~M-AJ|cbk2V&tG^-b?z%QZvUw?px3~4iZ8jUpJWuf0L
zSN|S7!;9$`G}nm=BT0!=R}_MDCfI_6a6zv{KC~s$U;%(>=4x%$SKp`bEXP}ELFN^^
z|8uh-r!lf274p_KKj}J&Lq$}GT~}*;2l5yTkV>s*^466;L7h{nSK$@iyaFx(v^P@^
zw^h5H7KRn}=#VfB3<bZkzX7WTZuLF4HSZSF`0pHHzG5D-9`-$|E(N^AH~o(sQ9|Ib
zH+WAf7VZgqBPrJH_RC~Ei47fl(7X6H2HIQsGt0Hg%HoKZF+tUmezAa+E^K1B0FVMD
zq67<YLV;K*>6R4vPFrJdcUW%K2F%YBCRTOS^FvX$oIv4R)9T*zC3xdJJ^)NXjs>vP
z$^GvX(<*9Q+HgTVRkJ4!0#LSyxtW+X4YQ8`=+Z@7vP46ETy3WzVLN*y9=qJno}yh{
z+u!;q2dS7`_L5TW%*qKC*;@8<DEkLstucUReE`6s&Z?2DYKxx~6ahmF`}ry$0Cyz0
zq8bvd7*j!)8z0mD8W@(6D!`?T_K^p3m!_|q5&&atOK<^+UT~6F+dl^X>!65gJyQ$E
zTPsTQ%cdwM;a*BGR!Ynf4$bYv+WiLS+dU}V2RsozW4*{f1Ef8pC25`|;KaSi;{w}U
zXz!zFmWZ)s&iEKn&78P_`@kRzbZvEQZ51jLLLd)GxHJGwqc_}4jcjaeEJC`{DX~N~
z$Kb-{+67PO>7igsJ+*=jD_zUye(Rla7oOUZ9+TGfCZVBUj@vO0Bqk<~7*su+m=1Y3
zIyzyFu9}z_uY3)Thx-SSN&_DsA48w(!`X5cw2wtgeRp?N*`N<Iq@<=ZeQj;6{?LKj
z##%{9Svkts?7um|Lkcr+j`V=S0EGywOHmwPNz}Za!R1Xe|BFL^N_zZ$<Q5SihTd}!
z5Kb{2m3>5`0EvE`KtlHK#O?)7SZZo&^4k;Z9(j2+7=*+l_{~-<XFil8jn}Bg-r3$g
z>gU~`a;^N}qssEKva(3>N2I;`1)*=}s|?MWozI<h`uh4_{JWbfO~2fqa&vUd&dt42
z;}#SQ{T`0b!^_Jubbht6v$Hd+EhokjUu)8KktA~#0|BkHxT*F>M@I+!=%}lxfD$P{
z$~Hoec1E85`!%GfmRO%0vPCsaPdlej*cvy?AIA67KX3P&prEClxsL^+EBY>Q>i2_<
zcGuC%8qD+&SDjqV7csD#BF4qK(?q3uM&K7P(3z8i!r|;AdXeMd_?#<>&h<}|!Mhl*
z$B^91*x1-V4>yJ72eQU0g8+H85h*&o?6QE1{@C|V-}(m!n-la%k>R~7)EU0Iiy3aH
zvFPxX`}=GAPG53gPfd_2`hX=trTG107U_LoXg|FY1lCV)onYa&=F{Zk1DQjk{eFF8
zoutQd*UU*8@I6~SluV+2bIjjjU~EW;4&iqZJb8o(UC-uMPnV`_#Q>DMljHeXB3n^A
zT4lZZ0xdQ1<t4<IdHlsrFZ>B7JReyOrJ~^L6-;GQc8tqy@0n&vX0MRZe*-mZ3CX8B
z);yJ|Z`PT<C1#NduL)@?g*MXa=f6PN`c5fpE7^W1n-aaeR>^l6N*EVBc@1BV;;zG8
z4>TNP=w6~T{Lf%<qd`gK&;at?+=^E3*|`S>mkp_qi-m~oRT4sO)_+kk1TnaeE{k|Y
zPk{hdT+rEiSI|f*J0^~SxU}PdlJxAdf%5X(v$dQNIN)P<_uGkVG0c&0=`Z{C_hNnV
zP!b_p&imk7Zxk_|prx$!&G$cN84aQT{tm>`q37l#Q8_L_0!VTYJ<0l~fXn32-`1ez
zuAtl1HZP~+Bl7RxHv77|x&Ys1X0~=iOBts``|RwYVCFH({WdyE$1<yZXp&3Yqw4k;
zFxIT7()Q9Y3naCqWtGp#0W80Eb)1X%#Bb*Bm~mWI=mqvXP2ivU5>|o4%EOUr-X-|n
zemE<Y>g_zn4TbFsBa&>|=zMXCTyec0_j)j+^Vpe3#js$68nZr$jVGQjeh{^y{8?;M
zG-l~70*(F<$>RnE+e>byFz{4!og-3)O#&U^pnNPj15494=64g61g$E_k-y#D2#1<H
zi8_H3>#)CJJz-q8e3&H-H}eq1g{DXWFk)B(GDt;V!$q9Ky#A_CH6J*$L{g45^+mqD
z`E)$cjJ0(Hu{k2@(35)60N{j3NKwR=0(D-RZoM=A_H<GT1k?T59bK4{9jCz#)G^X^
zwv;06|G*+Q|Lg-e)a7{fp4_rA8RtLKL?<Om!A1<{%*91H6(9=t`|O<ki87@AZ5cke
z>+fT?7)U>Tqf5|AvkRH*&#+U;`#YGoMRHOiDH$1#yo1AG$nBc3si}j^W0<L><@$5C
zC%`9Cp13j6GBR2GX5!Ts=SIFu&0Qf6HxEC)JoQ=u?^k2RG`qAkH49j@UzKKAQYt!c
zbpHwY5wtNpJUp2v!(bi#+IhA0nSlY^bRp^)p4GERjkJ;Tze$J>eV^T3^g~*KT5`f?
z8hLUusqUZS$`*J+eH|eX4H2JFjRe*5E$%U2_K#)9(VJvZ>S~I3FjyEPTqUTzxIV#1
z5B<_?9P0zeHe!7fI&KpPvrxB)p^FiVzJVB{?e!QlNNeX=8RBmeAsjAO#^U0Jc>c{s
zxaP%&n~i-`u#w+}wG+G2d3HKVxM;@H7jle4MWflvqm+55o+WAu`?6$VeZ;VVY(~9>
z;-KgnNn|fOyE2F6VPz{+TT5n@1UF>aDSwX&Yg;nl*V2$BV_IUhYnz`sla!*!>#P2x
zAu^IzOEVoCUixh9XHMQXd8Rx^2P8gELtZ}=!a^Tv`A>6;({c~w<Wdy}FL;QMWe;&<
zyu5LLcBC8mwu19m<?}{jyQ!vR{a#U5qgF84M4zx*!13<Q$LO;w`+p<$l#;4|@l%&@
z0C?ESQr}FsrjJBM9LrPV+BNj|-4o8w{<CX-g8Y7Ki%2EGZvSANYE$3iQ}jFokbt4J
z(ti{rM}2XAf*k({+272QNxEu0VsBaX2ziHP43Z?H0Bnn{`&^Z7YFvZYyKKTYe4uSi
zJeci?pd7lP0R&1shX(3})%?s5f@G}%Zr5g;cRM(rB0s$uC#Lx&ZH!GJ_ihH0)~39@
z$MZx~sd4WwPaK+$mzzleE-o%TuY{0l0XK{*4fJokye`%8$*{ln_v2bSFG#Z$ZA-@Z
zAI(*wP^e}puafkX%NJKEdW>alzNgD)XJ?0p7^~V(r94ZDi`nwju)fZes+*aa)oS2T
zSOv9^7oys>Lxu`M{~C-6shcgV`HWo%=Zh^+pg&)I52tIn<p^<FUofAIK|#Q8@LGm~
z9v7S(Fy(#7&DSd9qx;}W|2CA%+(;~Rw|yWZnyn3QHt)UPk3)Lm<_!ZYeP>GgGOEMp
zou>nh3<ajo?f$Gu2y&|^0Kl=WWt@07t{cyGBGGGW=EgM&o;$;5YhAEnhr2{S*K8(0
zDmWHN|0BQw?e!ji>u>wKo0|)(^i)zrLK@49#(ztBU5o8EduBYN>Lb42vtxCVW8^7C
zEt346O07@JNIz##2hU~#cA}@A@}Nu_{_gG0XUlZ_+p7+LM*CFq_f=2*#lkMS&PBWy
zEh%w*LkgTA!F>l8CQp?Fq(IJyag`2c<tab$22Zh}^GrhhjJ287_64kF^v>+QFQ0eI
zO*ucE_x5I1B?kg$e;2wt1e|sbsMEC=Fzi6#ZY2{j0161tGpRfTC1pKikbMr;{n`zm
z-~*OX$??~;plGqDUM|LaH<_;z+K?L8RVzQ%&2<N7_LFfgL>r$FL^FSxgklRLvvcEC
z1Y#E<s~q3J&v3SJ-rusEsL#80`xw@al%!KiDh7HwE~oZ)rgMCwNimA~-mbDXYIup4
zFT=nj8{%1EV^M3{*8g)f2SP(Muv@&K&$I50a<F+683U8Jg#4Hc+Fvzi;Yy3(du@ED
zc9!3`t6KiFDe_(RdHY+6K%UaV!q;$kzt0-WN=u8Vgj2S-Qu_`+R>Cv+IeHwoQd(;i
zc?Jy)lZ30cMN3uHD9xL}cWicfMa#>}CVZJ%<t;8N3v;VA$g=Wd;C^sSj1h;vv2lyz
z^^sjcK=iYlMeAg#Bpd)HMIJBIUOEOvJ<))qrX2r$h1f%%BB=0X7+VB*(jv$S2x2}^
z5a9KE3kyprfk)>vJa2NE3Qt0mfQ2I1eKdWd@n-5NXVa9{$^%YQ*$wfqV4#VgbTm;R
zc!6fhX<!sXcu~sc?998N$G&2#t50YJcA4uj1|L~`dAwr+TJ7{+8-*RaPeE=GeThv>
z*?$z>Uufq_1r*u!lBPFVv;-K|3al}R2w`K-CA?}SASJz2pqR8`v3ix6Q_5r)tOnUH
z=am#%DSC*|6;VHnvUc1X%DU%^Pp1@RiPk<_@%cUn)dLhU@YU8`cu^wfuHfG8-Y?~w
zGX2~-ynQB}Rt5s2;C#Ze(u{pGk;L}UROY2e<zISH!vay4@MjbhKt#IUN3fLotEqUa
zhO9PbOUk((#>A`Zgfb!7@}{zWxFP}eU`Wp^dETnZ+FG7#L<+ndq!gmWX7OO{Fz046
z%?vVwTZK@IU(tL{6IkjINoIwq+SBlliJSC1<8pK3n~mfp#IobQ?Zvb5R~E2Xts%#n
z4Jp(Kdp~x>Glq>vgbfDZ?F<)16H!^f(%1Nf+%#3>r&tZuQe$>rnsnRGGuHBr@-An;
z1A<wtk%uD(2T;*%?Y0OKFaSJcTS{z<+AS?MS)O5rc&rD7XMHKO9UL1j17qW&Z_pDi
zJcp9ZiKM>QTIi|UH1_lCfcYXF^Nb3Au{eo5CsR|bu=JU_JC3yN7jh4)L$qss<P;y+
zPwxguTSVQ0KOalMF5+q{vq|9^?Ppbn)tEG^oh$iFQquqX*YF(IZd1$PzKUQMQT`yG
z|FeN`>e`cRmb2zLb6^F%Y=Fno^}m6`cfS7pBe4;D8HJ#ww{G69v23c^9!LKD`*y6M
z6UyX-M%7kTsg>&GUh*#7oH+Wh;^KSbCqF%NZFg`5<T7}GWhZ*Q^Pfono+(V4PI$uQ
zWZB?psvf1iPl8qA9pzL$OHDuwiy^>;=n?2H#-~CFSaDU=$e86;XZ@|KxpRLTz1D+r
zvjde76e_b3Q4{a1Iit(lA3t@iT3@8@Hwi_LOm2P_%Apl-tNTe9pg=<A*1%axZXzV7
zgz~@za&x!ni|o<P=hEflAXrt$wZ^$#xQx{iDZq0@fUJb%QXuS|tZO!5_)=qdOlOmJ
z+gN;z$%lZ~hf#Kc+pn7qH6fAN4x~?)LVwNKGvcuO5F7F37_%%eD1o^nU1VND>1L>^
z+ca41zJpWu`Tr?t&H})&c9RyMb?%tP^0c=mX6J?WHYRW@c7|t1%kN9mU`0|xM8>*5
z@xG!xO@HC7;EV%Lu=uQxEPIxsN4YD2pZ6saACMyQdY~BRkG_ClZKVJi-7|D%E*1cW
z&J0w({4I963)%)1&q3Dyo_0)XB;=nm*jHNU#i8K$0i?>f+>?p;{i|i`B2HOMe8L+&
zOPV*b>P}~$gA3BYia?N@Nt3%~23Vfkf?LiydoT>X>91Vo5iKwLLUJkL_1}vD3x66<
zB~2nT#$DpfT30UH=A1@t3gJnH_SD4yItDN+ujm_A5X?w#qr2HxKsY^#7eJa<%B%_%
zC9yz@TA)i)^oUsNTV2nVv&CO=t$E?0vsje(E#CT~d>#=J`kOlGFU21G-1+tWC;Z_z
zXuR{>GM^}F3)?mpUVNr8z%(F+ssSjZ3X%T%3jZ<H;kSzREmn_UZH)A?xK527znbj%
z6I1t3+O;1OyLVTIvx+hA@W})$I~R%1vi=3DoDZ8w=V7)Lx88i2+T4*9b#)sJHtK&7
z3XiCqe%vy-wr*mcIrI+vvEDUiTmt|g$@24q_D|Yff#j`!?~mCKF?0o8wY4s%%S|KR
z_is?qb=XC#Gu*J3x{@E_v<L8$n2%f+=LRiUiT{wsmH=F1hLMdSY#wuen#RPPU+OtE
z<l_DWxktr&>E6W<5KT@#RZJ<Nqrum!A36M6{66S-K|%ywcA1GsK@s89)_qSiwwIv6
zl8DL0((6VYy|P|MbFWsfCHTywz6=8GGUqw>6|n=o46q>%WT(HDE|q%jeV8QXJ3@xE
zd`KbInK-tsf$KB7#79ayY7hYYK*O&<Hn7tUjKC_c2%emwX{y{_A-lb7KR#QWD@se!
z&s)K)H`GK|J<;u3zm~ErrKht9_)NOqPON@%hr$OZ^QGsPUP$LrjFT8FOj&fgYZ<1f
zvm!hY$P+1_ErSjF)l_ql_|a;!J%L<fI>^We=(S&-^!&U8!W%mKuJEEv>eS23@%MLH
z4Qv>t#OtFuWFx|%5`UD=x%IV+Qq1m<i4jh_A|;mRo)+0{{@DRzjFuU8NKfi=X4~by
zXeJ{UnAOg;%57z;MOAIj{L5<#pR$L8%Cnw&hm}WGu(jW%>ihG!4ARBr$;_wp^zlpW
z3fpo)p}$Yx&D8f2i*GbICO!B4URbWx&>oc|E{L#rAj?0?YZybXb=QkkuojQ+$nPH}
zolVD<u=`k56rp^2em5VbaIjP43Vv$nF84lrEJOGA5kub<{NJH|dC+^#8G)nlt#&D5
z+NoMHC;5c<{)4|R+E2X9TsvR8bRDet{oMH~I#<_uIM~KIBquRt2NXFRK_DdSU)h+#
zzLBAnP28DYTe3XsDyc!W39LS&)#TV3Dbd#jN&CsRH*UDR?B0#0y*=n*v%?$ozw~KA
zITG3fKqAW<9$Ok4CVYoQ6g+i#Ew83mmqFf-E)S{7Z%+IV)7Sj_R*W)|^W=QmgZzaZ
z(w<ZxJDlf#OUud41l(&(ee>_l4Ez*4nMxDSsP-X!{MC6ORfpB0M9ejM<CE)K3kvwm
zTF}#t_1A_if?wXQZBZgTkb{uli(c9%Pv0cQ8@ZXFkG#0%TlVYa);c{0_;YgJ<Z){G
zktK5SeZ!uwjW_0Z5Y@A`o60?W@+8^Le8OtE!GE`5FO@h?fRIR#+&aN)&|gb*x1`$7
z0siLm@j?A$VQk5FTL+7W84gZ~moS2@=(VQ(wm;>nm2b{ZTLdM_@5x+cW@M01Lj8B)
z`%mwuebM3WYgLI7wH5W+KLXzV8&S~h{<UD1nE`|W22E`}KW=N-P5tzrNo{{&pu5rj
z%F@ioBn^c-*!KC}GVuN|&2zf_y82~eH`P$bJzM=}oWKg#$s!x#ocIsC1c;9n%^W49
z+WqB4h>?KO*TV#QM!Zp5r295e`kTRr*L6u-S=mk&rdR*~jIjORw}W~;5pS<PMs-ON
zBwOxE4yvGGn^Pr8m@m{~z>p&k#U*If<T&3Q@-R3!`1tAbPWR2;__g)*KW;X{s!7bT
z+S+t);VU-_wPtp>c;izv`iI^=KG&)2>Nlq=bjd@0-M_XlDcN?!N)3{Wfw~rKu;drC
zd<K34rf41kxSU%mTmohfx{Kwu<y4bC&(&7%Gf1HIemp%|MKZ=}_49ApB*yO>F#?(2
z)9+`ab`9z6pjwmZqWZ6~03W^K=eabAI2}n>iM~(erVSb!GHq~o#r-EaRN*ro*qZ7_
zlML&=aClA7hIof}m7n>qqbz<*Vv~Os6pV#C)v5C6_)J+EsWEUmtu*zbJv5Myu&ige
z`SkE`WCTLw+8N;R$Rxta^J4gB|K?T;_KjrLodf@|tVo5EuywpV&ne{rL2q+vESyK&
zGk8N}dR;fCgfyjrZ!0?{f2lsi82zF40f$3X=Gjt+x9Y~vodtd;#yB5j!jq-*lkV>H
z*Yxd^r8)Fx`Po``j*LczF|peZerIye?T?@9?`y=2m<*L9ZjLUuDZh#hUX{k4bPyI6
zeeQxqi~cN#B2GD$7I7tl0Ovl)`3FzM<I8ZeOo)n30%=)d9+O^O39f#6ZD>uw2BbWM
zfM~Mb;THt;Cux=;3k$uS?E(Wmg^|%r&3ttpWrKr5Wn1D{x<<c26oiDh!fA2kl#&aL
z4@iW`KY5i|KnMe!<ol6sHW^>$CmQci4$^kMw%%{NTU*LQulF?7t4N0)$&V(IO76E3
z?4!DGWgI2ff_}EqC9BLFTt0Yn=%w{>S~Al!uDFj~pR#jE_NsBDj*OcOb=y7GfRyV+
zW(#IC+a(a=I<Oa66JptZ;-bDNcE{>m8R6Ac<Bm+}&3P}9C<21bq*Vx~X_Qgk3?GIh
z7sTEuNA@uDBQqm4`n7+Az8$J3U?`jVrc+iVH^lbtoi$T4%8eg8MT-NeRzfBB{>iC&
zKi@Yo4wfN`+1ZD(^61`?>3Wi9iN)@#kl?^6e{8pv_KMMDU{o5cpNdeUtZUZ_JR9o|
za>Y-}<h`);_vJxo^qUI1wBg1al%!R{N1KwK|80CXJ3AvJDb>usb^dE^(LIX!X_C4H
zT4%9YMovzQB5g3w=~%;fa?wThxPUO<&<IWPj*1cljPSNF1^|Wd^w%Ep*F8K(*>|EV
zrPx@4@F(51QeWTjfCyyr;)b?&#w4M#RLMzN;MjdRZ`PITFs>Q{;U~%JA~sY209t6l
z&;9|$rZlT3;gcugBrHtBaB|3C(h<;C#Pfw*{y(kf*?gS4D&;Q95KpYMKjXtpQSjkI
zGjyf1DBSGvvoe~D3<hUeWOkA!xNr{l{60_tg9$ISF5X|7>hpM%`di$U>KFk4VHFH3
z_&4d<1H8QZroFabV-E5cnAj>k#xz9+?R?nU^`daL?n#-n@}x7M;G`#Vi~<5TcfliY
z;fK3NcJ7m7qodz0HyT~W8Y0Qd0xDCONS>vQIGcR=tD!pN&F8x}j;uO5k_QUO$!YEc
z;Do2o2qhF27XEp-r9z}rQpm{2kTFYsa$ReO^ORb!x_zy&#|GeX!<8T6qKXk~I8=E<
z$zp~zsBh+o>vAmZnGuL^zS>K`W<#9bV?`)r6#S<C@H0HWj#5ZY=cQ#ox0CFspw|V*
z%sK^kz2o1wJEiFmHft76E%9_g!Cgi9*PcLZh^KRLz~O~dU%f~g)mr%wZd5icf4-SM
zB#A$Kf)XdWL7ex(c0vj^Cd#s=A#A<SQfI1f%pk1%`S_>0oeE`aC1Ud+qRLT4)OV|t
z?a#B3cRr_MnazfbATe?O8-pQvJW0D07c77^qg^H9wb7F7m$FVM`nS#e!0Hnj_n)PW
z6ufhv{U<JNmO*S{3jyE1pLZkD-cL2p3DjvpCi9PC9WZlYmOz2oE*l!-x>9&O87l+E
z^Gq>~4eY$e0`^>D!<zkr<xzq)>c+WDYG6V!4UM5$hIk#`%9@`OdsE7Ko_X42xl;bE
zUaMlfO#1@)8+uPt(*9TsP30!u<SjlG;J2K$ENaVylrdpKJ#*>PD@}C^8=aQ-GLKo#
zVmQh<*%0*_hBn7>nm+1-$*w`0_PABcnXZdMLj@im1ixEr;ps?RX$U`m)ag4NH~Qww
zpwhL1t2Wt_^`HvD5j7sBeL+Vzu4%pPcjZY1Cj|#Df`7V?B%;OW6){=_>6Z4Ci?tj%
zaLEow&e^Kp_kL(9n%}(M@wHba_fUH>i{t`@l-G`d`r7i|8z8{-Lppul&n&|!w`#5n
z29;LfgZBNlgmB)P%1Q_9y<7ZX4my<PS1#Urb^u!Q%ZA{$M<rLkzRANGQyzXl@0%-u
z;%qafjU0LyS+;oFC?k?{*qfdU3{G`_emEeAbfV?6s{hmtX)Ko}`w?<@VlY)-oY<6O
zCdNvE@cN`@F#EZvv>xL;ts7?PU`Md4GFxo+p7I!z<7jVS(Z8!gsx_)Z`>9vXmPjjW
zNX)R**!@=+P!XOW0&mkLO;6<RF`e|F>HPky`O`4E_04O2%>WAZtEaO5Z~T{$aau-V
zf|jc~`i$ZtedT1#GBOw~!4<@4L2NQ6X>&~yAWt$4Q+fa1ozVg-1{`~*xVe=Q8!0^9
z68aAbd;f^{h)y8i%D7}{WF)+i#R7*)_?YlyX@g;#nI5WoueQG$Y_;~a9_Jw`Kk=CV
zxEba8(*vR@QNj*jux7-M2C~z)%LLr~R9D3>=QddD^w$ltsLy9Smhow@cCUH(8a~s&
zl!?ZrZ==+eAdz`8l|J_wWnpQ>aI-`eqWZXiId-5JF&%55pUA;7l0p-uM6!j1fDoU*
z;-`Z3XVeP)^*{Ku9n=hEwCZ)f{q4!ciwlUYXp7Xo>eSiebrh(oH-9gW*LpYEoRfdD
zl1E{L*rTdTZdHVELnN8kKRe7?C(F?$s`#C*9-dl?IXMD}aIyW?1In#Uvr)G<H_snV
z8Wm#{i8J1pCtYw->H_IkTVMATCqI{#lDgYUVo@X*uA2e4Z6>XD`2CohqXuPWW@>3`
zcc3~j^h$Gcv%BO85rVAktn2k#pXSSx-bdOm5#%-AJq<UgVRh@`HBOo1IxF+?_*F_S
zSlD;zW)~U2_|*eIp7LPziB#kMxl6grmyvKR#FyZ|F1PC@@olB5DTXqT6tkUo@~Amp
zT7d$z9EL6Xby9iO?sHj<OaVam;UA0}*b?t|)foe=PJCiN)_5p5SyL=C&@I+%ZhOv7
zdWFITquk-2e0r917DN@K`H@BxqgMrqV7|kbnVPGdD(&|id~^{$UUgqwVQrtCtDK#=
zsr1u=g34sA8L=p!82r*u-L=&v0OJwvNVrPTzh7VdHE5e$m)qOqAep3wP1URvIk}QF
zi5iQpZO3pv>^@@y-B}%d*4hL!^OsRj;HtxrZzMdhqO+>3S(=ZZ*WBD_N}gy4vHwP%
zl0pel?~Kk!cs48Q`O;^Qef|U0Q<jrt@Nk9m%O=<BT)i_%6EoeTcXM9&4{U$_6nh=_
z%|8bzl8Z;}@wc5t?>41R0?=xI4*#Cn&md4XD;UB8TSdo?Kwbm0)zS$wjR^1xz~weC
z_8vLnXWGw_%v2)aT0JjBt-}f*@$A=`G?ww7z#$m^7l{bCy3^O6p8nf&z8tXoYJ}mU
z<yDX+2&B-j;rF@x1*Q4}Bie1Pp_$o5{Xonq!NA#bYjJqkq}PRjiX7DX*zIM#>sYoF
z)@wpVN)&Hr(wJ`?5TR9u8;&|`FN1Lt3d#J!l3JvCXO|qS>sdmLJTE*$O()FtVfah-
z=;Kygz)b0@-Q2_$7yB6&Gk>kDSvd@_^74FZm&x_zEHKUC8&92J!+ZQ@Qag?zj+$m6
zPC|J|XYdkf4jt~W=QpcL?Zkuxt;d&DHcS$=e2>t0jq5)kDtN_z99Bl5++4?xiBo)B
zGnR%FyZwOWHJ*7No?e5^g~s-*{AQPlIA4dG(q%uvfbh(-YB>w5t%a5)d@~_7Zz@9l
zLC93!WsaGtr%JdH@|1*%O3AmKKl{0-#1o)KgCBzaWSU7#UEAzH+=kpo6|4q2GnmlL
z_caOehS!=j&d%O`y`^4)Viz(+>aedGp<nI%!yk}`WVDaOSaI`ODkWgpNytq^PvJA-
zkoow98Vg-3u(Ph2zG+E(f0FffUr2~`?XIRxZVdTweMq7@+N~YclQr3zn?)mKEvHnU
z;Eh?4eWZZBd4>C%QE{|k21yd03?(-|*Nnwr)ML+_Ot#~rfO=bM=lADhg*5<KW45`3
zlAOPXOZ(4Tzq^#G3}>R$T{S=bcBz%1*T8`U=XFzdRRXq(l;bgL5ot+DNoncqf4G2)
zZadU*;0ucSn$HH%!`lZ=PR_=K)QEy7`}_;3dTNJ~lNhd*?5UKnsHEic=aZhV@z@dI
z3*;VB#16Bv8K9r_`Ge{>3-s8Z%s)G`7j4H(78qPc%4u-)y_0IB^Ve|W8<J5?fztgv
z_EMqhm8|j8jknG<E!zeb7W2WRHUf@JyKk{~amk^qrk`qDdq8{lBz8QMi8kKv(o#OM
zri{mN5C0W(QkBQXW`*lc{AREHBbd+pB52RsLQ|O+2R0+Jv}-;kOV&EK=r8OvsXoL}
zzHQ_|-;*atE=GZ9$>iibh=HmBvEk5}`k5Jugm>VH9f)28btJ)T8kNJCGQWYTnFca}
zHx|xe-KO~Fx!~|0&gpM$X<8lN65KU1ef?SF=kE%BKNr^t0OUYBWW6K<<5K3M171|k
z&w|6`o2TndE>)%V&FxiH{esSB!cTYvxF6r)N54-xU7<-96`h+i$apV?_9Zk?kbmnI
zp$Tp%>Ywcw=`Mm&;&A3AX=*M3G7RV0@%)4{*%0((8OB+RAxh_!=kWHZ-|`rZi8Zvh
zNf^Z@8BUx%lG2dHB(H|cTDsq=tVn<$eHH<ZErCoj;B)3_$n?{rza}PXmasokA03U0
zhe+>21zhIF7_0u2bC#!_FM8`4Ma$EY6xTFh!=%=L>>oL{xAh6fY^4XZPS;KYl07E!
za(#U)s4`D2?0~R-5>jTFv}Tvl+7HrxI3OrD-xwZf65*AuNB#`t77Lu^p7#1RK=ptN
z1OR8fLo1xmQVrvC)Y^`rcu<Jt4qk&kw>r=|;ho$QBz3z=EcCXUr7NkWUWna%P$%Me
z5wJx1oqV`Sm|-#!PMZ}rOaLb2O{=FTh*qS0_88bDArw%0xa8L*j!i+k8ovGu4+K`Z
zFz3X^N~LbjXpSU5FzKfUViP!+9VU1`ikLu9fMBV2SuBs(2vPtgxIp8hfop!!w-a6@
zVDv)uXv6^&;uI`<Cb`4QU0Zo!lgbbt)4XdU@cQP^_-7#Z3Q^sS@V|U{B32zWSbyUW
zKLQ0cLINWmik!F(y*gCo<D=eY^Q=f0+`bH&fnYvqvFAwNqp)|kVOWDuNnbn`Is&Lr
zUzoG5@CrX5_ZYe(owQ9fEKTyI=zS?htC>Ol9B%u(0E^zbje(SwBmY`E3NvKKifaJm
zG2s2b_HR!1?FvF~J6A}`V5ubagH~$t>pKtEJj~NRYdT!sf3DFluD&U)^Pjp%DMQLo
zIb}$#@{acQH~RWwO-;=%>a3FcsN*MczT;+8Gz552l5T$6NH01NYbokDN5bX)@9mc<
zNxK-+LlCYt-;?AYD=kwZS+!;@sJ1p!wI%clG2neN^M8i2msg{WspU^U5M@%I7%9c(
zRu73?6hSGNyGx26%8mQM=QKVWzoj7QD(~p1&S|<;Vhlv72o#=_`j}DA$BO&x5K3Y^
zWud>E5KSR>q2UcW3lw35=~2RfxGC$@;?+EjUVNKseQ2Rj-M*ibC`7)#ommy5Xnuy_
z`e7I_oGJFN^@BF4%<9$MALPiUwW^j;W=$1wg!^GHC%@u?iOSMq<Xv2@m(J*4D?MLI
z7&vxSW6<{zmI#Rjky}Io*)GXayS2FGQ>=jIM^{FKh`bR=)Q<3U$3xVta0?%in3CO2
z_4n_ox~re>+a0969lxK{Zx;T&xR{B{F1x$jH+tYZth4NV)1>rX22VSg^tOOsP_V8d
zM<&$Lx=p)vzxS33MlKDqODIV<8q8FjT)llypxcgeGHnLCGLj%Ax;VKR_S*~7#w9a%
zi4<`2HQ85Q?3;^Ei%i2thd?6}yIyau%_aMDc}8gkOL8XRF*>uYsNLwttYNPAVQ)~o
zi%G|^jKh0uU}!9M=c{89Fcb!bn`Lf82WN0p3tprVC(3^%eMd#(kS$T<nN|FeQe+Mr
z#HJ9@d8`Rh^k<unf5L4}V9?TRkof^jNG~z|3Kn3aX;Ycp)*PRmPnr;5Neu%bv}_2F
zX$LaRm!EOk_)}XaW8cRk%ZQEDxY7mM&g9CoiI|PL@+ZG^r!4&`?0h5lCxvtbR084F
zeIx#+{3>u-pEBV6a!n$Qryjr4=4jII-yqI9Hd}ujqA3Ca3$#_6{ar&l=yR0B9D{_n
zZJS=BumfwXhwag72C8LA!8Zka<fJygs|5h}{rbw%Bky4%UL$)x%90GWDV@1XiAR#B
zB*61AB|$_JT{>=(c}f(ZWjBglz8!(Z%?@K_ho)0D6fYAK3ljVC8el|5%--P)JpYc6
zM9xP3J!isn`4u{yv~Q8=GyniWYBt3|?m=L?+Y}2w69y~E5Rr%tlzWvRg<4r(Uw<C@
zcZ7;lR5MLa7&7F+!^3-ge2m#kZ=e6dh=sNdtBvO87Ca}*t?R9al6<_q0RYfs!HW$M
z#{mD0>wsG2w!7+MNsOjWJxf3?@T$U={%(qXzg#=-==fB*A4BMts%P2qRim1H2jXb(
z$)1dt%m&?_)mBspk@V%%fVVt`JiIN)q7-v48F<cS$O|Rd#=7k@XMB3Ns$2>-gd57O
zKNc5r>ZmcQrULYcdP2%J_Gf`MnhBa6n$P=k)}BoWiRq&y$C?$?V!u!LOkWD7&g1}S
zHH1fedW`ip*4OEmLYr^BRSOtElhfyWBS3bn*{1RDn|&5k;=FDa4Ze?`thCj+eZCw<
z9?g^{;<eHd!EpKbl!>_8IQPiCW+mN>G7=$qA~b;uq5zCik5a+t#ZJR053eA<Z6nAn
z;!JZHm)9)#_SB`PlZg?Lo_ZHY;%PCWo|Cn%vp}DiaOLfDlk_-2xoA6W<XF6>VgdfC
z!DWp!!>g$HkDOh{y=wcA>U+*Dbgh|Ki{7OyHWmP*)O-F#8|?$tbq*dc`s86b?ms1H
zfQ<!Ia_`~>hwuO4u+e%Ph-kBU{<&y8YGKMrb@+xF8Ve+TnU)t@T+Yy-9$Z34$_)4b
zmd~89v`rMU{He`4{Lp^Y8;OIpN6ib3m2!#(V<ew=l#Qbw?f>q{ERV^d1&1A^*i0g3
zX!Q1))y9n6#G4X<6k>P;5hdi<^0xD_V6b~njlH9lRExnfc8Z54nn5aQn_%3`iFjF?
zlKo@(>nI^L+S)c7-6q?%uR@%WqHOf(%^1+Jy(T4Xe*;@j4d|wWMNQ3Ga@FaEki7%!
zdt19Q7fGB9i;U24@$$6la9wI;dY>`w<DIlciliH!X%YiGXYKC)<nFJ(*}4C|dS^-U
zHa3ilb$=Vl#0h#J7`C+S^}3dl$gcQg)|rm$EzsKKmqXET^1#^d#m33BOwCnbto3TI
zifHL6hK%cp-x7#QNv(usE1nPP+kYB0E4|R~=={j@8~MUGmUn<=hta@@uJu_SS*m*K
zVR%TNV8&f9(@`ePSy#?ObM$3jT-S28`FA~Kz5C$qCZ~m~>zlnkV**y}@UK2-s~6J3
zl-l5;=>sZl+1K>Zc6+15<xNiL1@wG?#|*dK1y69)nWlJDI>E=|`#2h24BISsnGU|#
z!oq0%m;eBe({`VpSKk`=1Z|9sjrnMgPflb*?yoS2cu6|y7?V8P1#Dc@8vTW=8cvtm
zj2Eg{*$FqpET@H9TweY9_Vw$zh=+`30xJb<C^JwO=7A_k<Sc*Cx@pRo<lb&;D|Zjj
zs`gL&vf9u2&~BP9;=RNCt|Uc(Q7qBR3{NFF@rp%;s@Zv@fl8SYn>7DSD)8#WMD5bJ
zMZn$-rBQB%H>gGOI8WNQs><7=DOn)Jh~R_8#xAVjB!Tyb&)&pKc95+VB51@sOJjD3
zfryi)!1oh%*PZPGDy7SD-?l0sN(Ef%ZLwzOsab5WJkz^7|CV|tO(G@+%)FA3pOtND
zuujg0a>(uQ-}x2ap_N2->rFOU=|l`?uDt6NODv3A-n%2dC;PGH6$t+rT2hZHQpjo^
zS8m8`J|%u1|L$*3rN3uIG26?Q)?Pm5u3;Uu5r)e<4KS}%-e+eCcxrkDA`Lc>=AgKD
znL{EUV{Yx)wZmOqb1`*oq{T+pykbUW>d$Rsv<-aq^@nPVjUEQ9jiyXVrRRJ-@CJrG
zr?EEo%}03wFB6T$h2;BG17(eLrEf=te-dt}=oIenJdOzqi<zmnI22>u$L0|zssT_y
zB}l-Y&MOVh+(-$c&N9U_Wo~Q$bQ8Y1Dqss)_qCFGr)u;G$QrhJ>jY*t7H%vm>xFeJ
zCFWuD<<?7zMRpBi*DsAsM|!c+^^Jt>CP#@0xlVp`)_+UO08W`2bUhxcjO%q&JG_%q
zTzJmWaO3c!R#}VE3St@%XQ+l@)w5P}8x$d_deF6}uSlX?hTafX5v8!joY%|~ahH3C
zd7es_*IXp`{eGRA;wFrRAlI|bc3_mpVEzsryU(>!$+^<BIP_^h9^N_tF!F*zck;b^
z`Mp2vrPN@BRCnP_rBsIONrr%+lfnx;1Fm&<0cu@<JY+pPhL}n}oK?NBHNyNIuM6?I
zBJ~r2Uwvk+waDb#Zhy~)q3<unKhncPK21*TiuFjLedO#IfP*H|X-E;jGfbe9^nLST
z0nl4#x=iKC-2Q#|;bw0yq)7$1I0s1W7Zw#UxpjJsW%A#-Q|Efkii&9}L89%m%ck}(
zZ)mRHwxi7S^&11P9e=PTdZB$VAn+^GOowdVOhGp%mup!J1J7SqVS*74zx}eYe|fsp
zXy@n{=am$b;5EB%y<DBOF)W3a+?SORqZS}GoJ3-@q+I3Y`Vl&_Vt6soB%!11Y$x8|
z(3@|F5d01m%1oCIMFO-BGb^&pA=lcqntsQ8J9|)S%5~#VnP^rN6#z>y&x&%|n{cW=
zZ>v8{S5I(aR0U(Z(jRUn>EmoazQu5iW;!a|6pr~T>n~Z}O!gzG@}A+}o%pGss3*I~
zPr`;<%MP>A{pLJyMzpBrHc9EnR{@&!8{aWVc3`>rAOmQrGJ!wkIA7{<7$Dpsdr&N~
zF?bye=B=#YBD(Kklzm$iDvWG)9`a=#8wFF%#wHL0cBGq6TT#5>htXd?SAm=v&6Pl)
zP3a`eHQ+ZAtJc<{&cz}6cdPfIqiB<Ml<EAkiNzb?LydyfFF)pf8Vok`t<<}$jKWi6
z7rmDiLO<0M370e)c-y~n9_1LMZ$BR?EJR3pgxc6B4^Nfi!p&zzHD`%BC=gDvEAn-X
zI@^r1qGzX@aS1lJ)GCu=lVYgXJ>Y_KcTE>$q15@vW=~<{PC~f%OmSDpHg=*rOgW%Z
zo9IwEVpcR7B6S-Wjp@OCFrgHiLip(D)+>206`5pjRXv6=U*?tiS`BH60<E^0j_6!3
zw>gWWoUCV|lFZ+HQhGg{N88S@JnQi3$AVIOq!5o%ECL3)9&bkd(9#vGttE8Oa{Ro1
zh1`rhUd%jQ%*@c@*ot*NaED`Rn|e$u_$7jo?nVmTIv60p+Hk@@a@mqvb}a3Mp;dMR
zJ>}98I3J-!^O@q-xiCeR+9tBerMAs46$xmm_vbf@LIyi!jIGDbXpwHdM(u|g^E7Yu
z{b~=x^9xCYA;3fUOy-r=6>So>@I*D0()dQK#%!0)<;+Um_{s)dBezsUdiIykomJy?
z3ZNMo;e2l_2BjcJZ-0AP!j~T#nq^BwVEvNlR+Puvd@Ld{&9Pf`Uvpc&_-7Mz1h{`V
zV5ODRap<R=k_q*_1?zgeJYUB)d#$MBcn8Gn8bPT55+v|2;+uS$>5A?qy7*Re9I)G$
zH<iiPUe0Qe;W-ntF2SSZ=JTREu!9D)+-zZN?Dy}_Z3oKCLO(6^T`xJy%6hBEcCM6{
zIhvoJ|9U6wSTa#l^XdJ!_xJbrc=-5fBPG<mLK6)Q4GYc9MLNSC7J#1(T@Pm++vlyQ
z<Kp6C)G^AeMT<b!$VgmPmd|UDcF@Gd<<tjlvES|rgN-aMns8CSY;k1)7#JERCMVnR
z>jGj-jEsE$++U-%TNO35v|eUD0w}5td5Bv0xjbZ8;frd>2un*-#xB}|8Tq|Jz7v7I
zk#upLlqV&<?V%U4l9U#={dh`=o;a#%_`4~>W{v1sPwV)-Ig|Qn1S)9+dY%XEur0H9
zc1~bDBxgw^NhTT6kfUVbJ*PUb<-izbX2=L1UNnKJaB{<nY=8ACKVJ&)l^4c+!V?b}
z65RtwKR#Oya+KVyGc_@bOG8wolpt+QJ-(iv{D{?(<vEOI7gGr*qynUPAQ_*sFvO|=
zMnTi<l=v>ZR17Q(NpU*5KHfEPBcJ0LIXNjAp2Tu!S`92Nei&gPiNq0}U!!ATN+f9#
zH_R56l9rUEooc0g7YKK*S;Ws~j>j}rm6Mg4fr;2uzV}k+o2XT6vfuS%=JlI26kAhM
zhB8O0b$R(9XztVILMaWEov-T;Und^*cW={*W#m>@SYn+9G|Td(yxga{i{I50wex+S
zZPU<7yt+*+8-K}t(!XdwF5n%(4k~+((MaE`w5twc1cK#O!Z^yCDP*w4LkOQMjo{+N
zjSnfDn#SQUJbZf!f~Pf)PXEO%j=|G1af?g3<hb<fr_-G{*^2x6bjQ;d5)(7tX>@4p
zyGjd7%L-=_($1?46)~1s%#~OV3>E8d&(<%(L!-$2J(Pm1*_BnJ->c5NHD!rSLaL0i
zCP8B~qDPe)$~&C2y;~m)Tx{wQNcuA-BnA@w@@e?}2%?aCj`G|@lyRaz_0S;L-!;U-
z#n4^)2~&KM3DvnvGW)(bT0+#|E>TA(O|FYY=Iwe=Q9DZb#144k{YF;WqA74}d5=<p
z7ULL(9Fl0ZY5O);$w_B%Uil;jv&FPN#I(1avQ4aMAOHJ9KC$Q0(z49+tJ9d^K%_JW
zy(Xa_%)`j<huwuoMvJU{^x$>)!b0j}qQ~~P_0Z7Uk?f<YPa~zDsM4$n`Ai$$Zm+&!
zh=pL7nQe1SAjM%Hv>sftvlX+kvGw7KP1~1Fj3~>c#3m&rKvcK19N;yRS4^Hf($d1R
z!qGyEEY(8HpKBAWH6d)%=arSiuPkh!U=CHbv`lY3!mp|A2PPgbzj?#G{rwlk^Rf>X
zKe!7&W-Loc_>VcHAtq$3XFTLZ?tUE{3=cy=o5_%&-fWpZ+W``&ib}Mq3P|?wc>(id
z#t#->2Exo4YVt(tDhKP{#{*|y(8sDo2Wd$xP&@es2itoKTgyDg!)Zd)>#2U4I~YFr
z`IBqWX1e|vjM7^!Piu%{2!yP3NgnJN{WDHrfSz(deFps}6#8a(Vv|(EJ#eig3Gyt~
zItu8|P<3@g$CV?~J)5xiNHOAg5*aCRN_<3YLIOmkj4xDERC+KWT`5}yBhc`Ni&B2$
z1zB51Z}^5w)r)X;+!q_@rPk|F6~`vTJC?tS+L{1<N#OaH=5==a@aOH9@=Bu4w3uf`
z_UQI+FLVn1=f7ulUzJL9Jgx&M2-n~jFfIQx_@{-s!?mC{!ctgtEAX0)J}MO;eCMD|
zb`pwm%ZevK<k2<80uTr%!$)IJKKQ9xd?djlRG^ew`VtiM&vGtU<c%yV5JWlCm6&5}
z#0PD2h|Ute52(`se)+i>-1#Sf_(iH7HU=^AO3HuDdMvUX$OBb7G(|EGRo2zj)zn<6
zoi~iOTkOV_oh*ngCCjQCH#0?jI8Pt>vdukirxKCXA-S)BYfh!#htm~e?P|K+TgLMx
z-v_1O+NzIZ5z+_C5*g$*qZOkq1_EHKUw7=?(BIRK2be~r99Wfr-y-I{_UG>jM4>l+
zw}~31O{vjQE*a8T=+*O{@a}LA9=Df^<_--t`*e=&BI_GVPhrIH)e1+`MFXPQVjQ_Y
z2+@Pm#8WSxU@+#JNly!{+uYN{eimEmmPt3>`GZc)7Zf8}q&@{tlB{(#t<^(H$s*m$
z+qJJWQglsMR`r-bsvxD*^X@b|wq_&C*~J;1h@|h?3BG<enl>rJK98_GXGK$(jSn{4
zA9?YJeHUgpJY@MWEU$don<*?}r+pzUys$PegP=@bdn4}jKrlCMVM3>t<ekf`Vat{Q
zz{oIX6*DG?U-rf#!t?VH)Iew|Ai)doK(N}$rHasBhA^+=6#$BBo)-JJQLY&FzL4(O
zq)3yHJc&_DGdeP*SnQd1vzsXYwAog_lqz;(O?PcQ&(}!Y^cx6zWS#z3HB)wWRm2Qp
zSXa7!U4LymN!M~?PR}ed33u?MvRl84ic+3{)gmiPoZq#2ULR+u1JwMa%E{S<Yk?VQ
zVIP?rdj;1v{*nHU%iNgKbCM$9V@+FA+c-H2GHBoMPh-j-4+<}->n?3-s~Scg$gD}&
z5_0nq8HkVP8QTzWQ1#`>vBBt|?Ura(C2(z#%Uds`m2KI5hcp{^aYJQWz4Ulgs}AF?
zin8a&<172rtT{2U`3$C+N71f4%RW`1+4#qdIZQmicP1NdMT_WVf~x#xuA{2W_UG|S
zj%$P10MVjytMg*1xVWs5;EVBKl}|PGwY9y1<*I=}(Sv+^E~bkwQN<}AkF`q5{eZ%x
zo9%aAj=>3F_qDvU<71}$&)8xvm&a<}i8J+3ZL~ad9OJ&I@q5kmow6bpmUj+tU?h2J
z3bJSB4V#$wVRSX)%j_}ISmgPc2o9A1+1!+=&UO|Gf*Om>pX{y&-}5Zfiqjydzj|jL
z{WxGiHjg(9M%B_d@4Ypu2$y@lIxChs^P%NLXoH3;>bTA|Z^eY_Rc{=bueUNk;KDId
z<MyG|$?Rj+eDg%*1(nxeP~d&B2Z7O4jujmcw6mIbbauw1O%OffVLqeegTaq8L_M3!
zUoe)-&v)KkE2MlCQ%k(|Cev7sRBTO6abjfKtFw1-;d(YgGYm^0%a>w;J&YZ_%sEn8
zrT9u8yXbB_<i5&P>EhtXw_rhd(2u9(tIE<<fvPVpgm^_|=W=5}xvXZ%rDi!%QBiSm
zS`xg*x@HDmQTLuZwVI!FQCo&yhRZdbpWNHN0`}vdVk`dD_>rG(ZHPY_oo4-@lGJKR
zUdK@AP7wpPR{@Kie<^=zYFYnD*kqI-h_dfNH3>^1#x}M~bDiYsBEd8jD*2ea9`n%*
zJ7~xQXg3%A+l&e@<l#Id)dCu*cGfalYUVFpZTC6eo5+#-@4p*-_<v}7?{~P`u8(^n
zf+*3VB%%`$HA;v!qIW^GXc0t2??f3Az4u;1g6Pq^(QBBfqlD3G7z{=kGw;6c=enQg
z{R7_jHynq(XZBv_I#>Cw&-v2X83`0ET#r^>LJ|4oJu>WU@EA{HfKy=34op>_r13o4
z=u7kqj)Q5-ssu@KR@h#di!@u35GJrry-!tLuKh4DrpnV<2}vIylXWp;XkJxh&E|X|
zG@v7|X+Ds~xy(S7!S_hX{FP0)83laagg`zbDZ+;CT{7CskjPSUoX@0b*&7j%u!z~K
zjG<fPV|c#bzP|k@_ZR~sW_PrZm2s4z*`f<H4K&`4TlrOg>Eko>{%n^ui36pz+@dGN
zuKUt}j;URt&P{O>@9x^KH)a?I*oe?|_>LlB=0WOm=p9of<2&0O{*84_Hff!$U+Ym>
zBI=3)vkRY7F3VLw%h$sw*hq1Q3eR|KQnY#8gI`%f-U+#o5}1^z$;_zp2g?J{IKvOR
z%5YxsG>eZeRqyDyBZ(+b0h|KuRwp-7b@znh%*@-`|8z*0olf4Lew$X69Uy3CFoHsj
zH)_$IcD0~3c-b>R?`6D!F|KSfw&!AEkc(bst;flXjEu#0Ta50+n)=_@@Sj#aG0d)&
zOQW6bN!rqz3b=`UiBAUWx0Gn2fB1m#ZDUFd1O6qW&U@w00K!45iUQQ-VZq;pY<YJp
z=$2X%=p0k{qH=X1rv5moDv0S00$R=S)11F!D75v&ZTS0?zP`RmlhYj#YsmS-ck2HF
z1x$O1Sp8)X2Th3O`T5;SyFn5>MjpnZ=2}x5J$L*Bg?^=@;4MDC0qwtWITVuw??{ab
zD2LrK^5X)(RqEJZ;@xsPRP4?>=0@RVx$mxbYU+;~q&6{_rYod((n-TQtcAFXrbU1{
zFVTrWWYI5WK6dU26V*&TJz(B9Q6<FP{LLFRT`exEs&x%*?Is{rO-pO7D!2X@t<m3q
z^aw}GZ#qQpZU%QJI;HJ`8L3uj=mSZN{tHPug<DI|hWBSZE~DoYy}6OMRwalYxn+&4
zrxHxH3wF@a8GZik8DQzUzqMzx`M#zpb)*OhW}6h@OI6d<(n?E7(*kmcMl)lbRSB)<
zWeQHoKY)>P{--B*@bc*5DddO>_CE<_)&oWBs<;S_2_um=uV1H#S(b|z{EOsBe~i3H
z_ZA*kFYUn(eUe(_!v{=<6W?kNVA#jAK{_sevM#hoUqr52-w#>&m7su6H$duNq{t$F
zfAXcK{XJ2K3L~lNW}O5Nm7nugA!B{Q(!c=eUfEN#sdqJVKzCG%i7?1ToHs<JShs)m
z==8LHy;VQ!eb#%4-1E-`;Zad4BN~9PS^9wUyuw_;I^*$^^@jhU1@zmj``-3Fo<&KL
zZh>{*^Yo{#mAy7dAbT9lugcca?r`|0Fid)aTG=W$xl~m)_BOR_`Z}Sw$@mcH4iT%3
z{tq|B;daqf5|85f$zz#T%tN7p;*ydFR)9Vau-^6KtgNiz(o&D7oZoqgLwi<Tc$oz5
zhKrin#%T7xYpqH*d`(JDMw6a$@umBfPNMBXEu*anmFi<EbA^}x&e8X8t_+v;@O`o6
zZPv|Fb1iBHcou|sY_dvo1aPM+lZKzocF2oTt7Kco#MK|v-J1$WJR!I63KO)tNO}1(
z+p63wL#z9!8u|XJJDYj3E?1V@Wfj{M6%_%qjZE=`@~n%EK#u7|F9Su8oD}VU@>=BK
z2IiXtDURM%xQ~l!x;vNv<v||e(4dGqLj$t^`A|_7ZttIz%hja{8F5#!7&g_OtPByc
zu>W0nd%1)?i&o1*$K>wh?A_Uj5!|Npv5O2P3JRjS!@~bG-_NYSaNw=zts=8%RzI3!
zj}C?zB-+rx;FHOX+xYb-KfckEOMec|yTLIJTA5;%c*@KCi+53%kGZ(0hdH)Q;UcT8
zx<qVLx@_-QC|n*X->Lc+)8V72!d)cQ^tx|xvwO<$@+a*_E1rJ)?T4Ag>>%a$cL^!C
z>BMHPMzrag{zg2?)X-#^vfO&yU6-Rpq~H|`{p3D&(pcE~bxWOugy@n-MBheO;lA8`
z8k)P@e2WBZ3KdmVT1C2wii*W{YHYFY+%~|E63Lbkx+80A@2c$L90}FcZ`HIH_K>_D
zdcecOlMD>5nCqkebsCrx-4A6W%sMBkuKg`aDXE0=O0stF^WCkoTHnfoh1=^T=-B*v
zGm?l^2QMCcd=@#%-?#U93<Y>{sh@wYO0k2#uYRjD!)tAJt3y060`!(X%q}Y-zDi30
zU<LrS0%6_TvN}&VB30B_Lkjlgh>$?VAbmkv?_cJGE9DMe3ia2uvz07egO$p5xdaZ*
zw~0)1Z`wY&+Kr-m1w0>zhd8o-1gXe^Qf6Ln>=ip(>Wmie+0eYN0j;XslCAE!LCU=+
zVigFKFi&_aP~TN&K>e~ivBxI8x<l>X#SL}%mEkm&C0oi1JahnM!;~TX{4SOL`+2`N
z&M#!<Z{D5msJzE}6z-l2D*Bme_xz$v%#hDnz{zdcb-3R_;S9b%+nVFwv6N7-!u_h5
z{LB9=&Cs<}-6vHi@5{y7bffHJ?e&alg7R)Ysv0lmxZHH^45tskG>r9vj3~>D%w!;*
zmw03?oQ}M|t(^Jkp8iM=m?-?$IGX9{vX!|5{&CZ&k*5s0Q&e%?r`dZ30KCR~fbd1_
zxr?6TS6+69@IUbSuX}1MOLLbq2CrPo>6rePf3%kBR?tmMd`@JbbBo3>%HG1**TtI3
zdZA(OORA%yC;r>Ji_t%@kC$cB4b*%K^qW^sV#~7rbuig58Xd`Mk>_8NjG_z&1)^&|
zJGhW|gxKFD1ktbYEMd@^1umsC*=BVAE-tYYo^qFI2eso?HyV{_9uhV;>qqk@*7`FQ
zru46m_|8~-)b+Q<)`-nhnikIV|1q*PzR!+}W@cukuZi8J;#XH!0fjF-spM)w9}oai
z%~u4@C+HUIa*sBKQjktC9}(W}R?lCPZovx%fjE*?6;1>5gVE<7B$&J(5mE-oSacyF
zjBi{*RXM0~>;s|IM_(Nm(`@d1dFhNh8{H=El*>-kf13N4`%8Cvi_w1!z_ix~>!YWq
zM@>y#`ns&6V@YJ}g9uQ|7<wTfAb>t6(ton7`^3hRjIGEzhK%%H;1$XuBP;8v0FUP*
zF?!O#4SDAF>o~~>6{2o>RDB4Vi*mOW>t}H#uX<vEJ7z9Q$;V>oo{o%SVHUWCb@A3J
zzZZV-Ey3O0&R95vQOe^<a!t^O&8SVt={1y@lmK=8@OD=W=7H6`p+dy6xuxz%4=}a~
zI_mKOfrP>$QcUayUZ6LWEh$3@VUl!-?s>>4|Ch{{8zpH17T7^3PLWkXrdu0=Md2<6
z#Gq&SxcTY1w~LL%c676R(4q|Q-|B)w5__miwW#O^RuM*XN}5xq@Z5>pmkV3v8#7Zh
z?>@Rs)*h6VJxv0%*5Ip?{Ci|%0Z0fo+s!0rGdizBUEtz_67E0F!F6UeAQXr+jMGE`
zjnC4O8Ne}ETpXp(7PgH`(vNC-tY&P+*dFy`{~_FT@NzC3jOj$T`?<Y4IWEb&8m-1?
zYI>gSrSeGMtOQ3~f`Lv3M+bt;3`X*lT>B^4J+grFrohGD7hK@0iN@JR4++s+6&4|G
z8}q9B#R9*e3GJ~%diIy@usX)vd{)pAN!)#=oWv5tV9d*2!Fm!c+n5JotJ0lhy&0nU
zJ$swfm~kYod-1RxbsOnd?QN~ZATZl2T!s&NxQ)B4bS5K@$DqLeGm<A=H)t-ZV@yk^
zA_@1UVyg(0$$56!;6HZyw5X<rl2TboY3;b#l74J#Y}Mr=^?jjNwNCr9AF6Zuz2!cS
zRJfz%SfMb0(RFj7EQ2|M1)iS@!>Y_%P7;-w9UVTHb~<o_G&Hni&VC6qh&g=tQJ$<z
zWhye%R-zwxnw-x;9q9}~OLB7d3rA(=<oH_-Mkm&M(6`wfID;Fe7=pTfA04TO-)m@S
z$dj3RCh;(HYPQvXz82`|15^<E)<&<hy*sFF>WOnYi)oQDkzex4aT#GXA7@6QYEKy3
zyyD`ur{Ob8ZYa$#%elrnTvu@3^0LQcJsq7+8x&c8za`w$;!gw53i*Zq7WOt_LQRo+
zT7`KF70{>oBL79;ug`>MD16RXQ#@%%SV9`Rk?dGmdF+Fki%gDa#<qHrY{3XYi;Ydt
zi?#Vfr+k?AO{*ucS!+w3d9WqUb$B~FNHl)hEIU8<^+O+6)Vp*?>Xi%(4kA0Y^Gfo3
zi;G%(=aV==zrlh(-QkB#OP(d$?sLE|_OLu3DIGmCPgEKo)CY6C&ZVWs4Lz^MJ@+2Z
zk#vTR36jESC@4c+ybqVBCMN8ze$DV0@?{|If!5cl{mu^@^ChdRq0sVchvp~kuDw@b
zSD!!`85ur-gK-~3-sqUSF10qCd3ru=P5j5_RhhRt*Ax~OPE6>qhFH?qRp~YVs;F{U
zx*tWNGqT4wW)A_VCHt-Xly<GaO6>8%prE+xSw1n}cUCSRcH(gu7;fDHH=}1j7cGaB
zUZ9HXixxO+_Z^J|UTWOB&(?j|Ol5U74hB6*wSGGDXZrMS-D2SJjujNWh(qKwHcr`&
z`(Fy+_Qn^TauG6+PZH-%7B}H{4h~3Yf018c7R~3dbrzU41oXV&q_&n>=3-?xE)EU7
zmX5giLjuFC41$;2?er9VjfFBXd*GX?i@v__Wn8BM+wqig;CM?|1o-9>=8arN*+NbR
z6)td{sHKUCp&Rt_7Z9O^#Az=fGv*q4nH`GS&X@AtQ@6m@!nU&|ZMBqbw~vN~qBchb
zW<^G8JF%5GA<dgc6DP|U<a`qnu<n~SD7L&YZ5D!qRU;SbY!7o@lzNQ(KFe<UGd(e%
zsqz?L9T5<O(F&M~NC};UTVPMhQhC&)dI1KH@hk#!V~A|qX3{nWO0*c@t|!H@44=DK
zg1->r_MCC!NVJ&9w6}+slM%EN^47)Q|BuL6WaMy7(lgLSytBW%h|tv$IV3@&2)oXJ
z@Nrs19k_27O_m~YN6JuasrHiRHe<lejm2dfuFmc9M6}#cwGatlktET7u_O66nG|c)
zI4p9o&?@%qtRvuN)kP=3ESF>Le~^J|d-#+kB_*&t=}~$hKFZF>*xB8+v$xl~_YiP$
zA5G0iDP&nFj`Cz+QrCZmc7_&2?M(+OtI9@9COyrnD@&ib$GM~r)c&oBjC}hf!(w@z
zk4LVL8FQhW_~Fz7d(51bokc(xE_1evxTwZmj_2csnXfhSVIt0ppGJYF0D9{oBJ?oQ
zf9D1%KpgtqY3``T;xaY4M9X=(nf1{<n0+=X&%1+%;>g()a-%GBJp7`v5{<al0@2ey
z^4XfVMWFM%=|ZEiE8dW%=4N`3`CR9XH}o{T#;BsOum_0}6%*^&U-s)=J-QakY(sV+
zyMn)vEG$B?2hQPg1=Rs(NcE^_LPEeeJcdkGM0jFqYELG^7Fy9zbVp!5veBfmbH4*A
z8MtO`qP}mXEp<HZ-M$W&Ia38?<mB-3@!cE<_#f`nta~GTxBU<|AW)9X6eV%!Y^5=(
z$`4^|YU;4)WuxfZ{9|Zz9*Opo{@Z$J2t9|Trlwk4qQE?S+`v{I{Pu_>|3*XE&{q8Z
z)d_RJ@RZMH5vME_=w9dPBs%b@7ks@AZbh9h3TOT@#GWIuH~SXQ<1hxfg0EHk46_!v
zWkM!Ukgxj|<~aYx*TdmgZH1#i`w<d%+AvdYK+LMUD*}3A{0{;$s+<xj`HVLD?DSMT
zZfarS&6_tP^wCP+BIYJ1g{;Ot%N-lYa+llFvMM~G$81AzXk;Mnx@uobOEcgo0NG}_
zKH%|~ujtp{iv(SXIQPtfXVyRLvMAV)Z<Q2cY82R9PcI@Foag@hnZ^g5oq38mEMO*A
zdqG_fnjG5-3e45mxIY)X<<zGQm8+s?t-217S!@JQc*7}aX#{wIhD1w(pMzzstiEg~
z?x3$b_I9%xy%C-HGAAT>zdd8!3LXn(Y5<Xx_#>^NDH(uhRcvc6`3ZAzjX>okt-WJa
z2nYyh{;@+frqJghu{8I42YqSEO7Zi@kD*3JQ1f-%BIM+#7jX1wggXpSt$?~*P1#1!
z*(p?seCEwvdI6vnajnkqP>Q?&fkchG-JOdY#AWVe5*6H2z90cz`pZ%>4klv8+U^Cc
z;lhH>z}~Af&<g5u`7+L1>KcPu>X23}DAbTxnqAn-HGloO4?wO^p|-}C+FhrZar600
zt!G=_%kJ9hddY5g0EHWIzkU?@X0v5qOjK0gzyMFy-oAXlwb2ne8PQ4H&+tXp0L~jD
zJX-72ak<roY~`Vhhh<I~=$OYvEX$Soo8spqP4Bx2ypdnc7d{~+z;j<%XdTbH145cj
zv?O@w-XD0glJkYj3aG5q@(v^fsd78QBop1WwKkY@^Ijdtk#Ga)+#Y)ozCtW&FyH?K
ziCtv|qj$9ha=?)7Jn1&{-!ZtbcU9V0a&QS#2dy={vePu)S0;FSPpR+0?I2j-)s)yD
z7htvoj3tC%xZoC$rS#4VMQ%<I4FQ6^@U=v)MNZfqOF@lZSp_^<kml5TkB>4Z_*OBS
zV0jRT)if6M*(F*<VUpS*B2yy_B)$#IrYNplEJ88SbmsoY$6R@s8EwecZDar}9DEeq
zBOCEQ(X3fW@2X-n?dJB=n3~yHgYlNDk9zH*I#IZ+P}bXp=f0>k-Zwrsp8HREo=QFF
z5{-TKTt?;|NG>98*&LQj?siU%JZ;}PmQ`Q_a#>{abrqf0U!SAZaJ|y|lr2?~jPZnD
zx-U@+-pF}LnP;~^HAW8Tyroz&GV{FFs%;yBZPU@aR09C(W84?(jlA$J`H)5NZu?ML
zbY=$Wv$%xX8mp|VniV1A7l)I?adF=H(hckw9oOVWjg@u_8`G~JC$}8El=^nB{il<u
zRgOA$^6<t<kvatD9k@-BfBh#}TUuINkb(%`boEVID)LcvPli0vgX}y4(4uQtSa>8+
z1Rhq_%<-VA!>{A$u+hq|TR5o8vo3hO<D<`_5zILsv9##7wxJ485pDApX^9C;va-zv
z&s*=4WOcm&7&M+s*#H~C8G9n&)Vdm$55D?gTc>O9MFTuq*E8J<VtNp1@2gt1<Fw7P
zT4Tz)Yzkh9EF^{k8<{p$4#jd2I~P7cDF@`N{nR;(@#xyH(&+Mr`G$x>ElNF(QPRn#
z!b5@#)X*RrFLgDC4!r0^%N%t9TmE34|5~YS-hAz4SdT-K)BMRW01wQ^9Uz$fFp)qF
zM&t1pQpkQC^fHfd`K({yW|a<iL{7(V<Z?32J>Edxfx7{%v^sH6xthTxrD>xzHT&BU
zX7E_0Z+SAAQT-lOG)zs7l8}*$3vo85KR>bkW^J7(-VmU0;k9!FNHJKe6_b;b&AU9b
zU&h48YinxSWu4c=`|prLF(vuel{jYrPM4fa-OJ7%Y3-&YP&By<G#8sRXZ!kq!L46t
zbB>2Kyug!l_P>Tc8svUTd?4xKvL1E@WCk+%)dA+$@qs7FLvwS*Wcxf%pDM9aR<r7=
zX->^n8KZ^-nC^gLQ9#I}@NFW-25|WSSMb0y0qm7?=aD2-()lpQND4b|fjg_6oCF+o
zAd(P_83m$~%L5d`6DheK*=Nm50J1l%?)2QBh2HEL!Y#a)PCfjQodL{OUDv&<E*20R
z&{|L3XI^YnR#JY@iwzED23S`Jq;l660mfEKRI&dKP&6t2FI|*QvF%NoB?ZXplL{~s
zVvTS1zLI3AtClvF$4sEm{nA3>y64GOhPFEXk30T3s$zDMp`-7H%6-R4-7Y;(r~s6Z
z%t<gguW>uQTPI{$ih&Y*(TPq?OF2C~(>F-Lb<;tRktKN_oj&3Rk+&l|R$at%hgsH?
zWlmpOJ4i603-4@IG8e<p^N5SH*nK#1q0QFqozNrxEW|Ps5dlD^={zU52sk|+1hNpo
zx_q|}ni@pJZp-TFtylZ6QEzT;nvXRud+13dAMY8z(LI?Uhs>D>cnnrHZQYSIw%Z*9
zpClF!C?R1cPMyAPABicQp_{aewfEXRB80ImF#q?LNkzq$cwN#+A3vQRL?Dq^)-^%|
z4x7r8cDrlfY#(}##%%-X+sJplrX{!06PwWvS;o-Z7N6Cgc>k5#ii)h7Q%uds&c-wY
zq>qlygfbXYaEaP_7*^xb{kc~;jx;`Ix!D)Bh-@A8^F7bBxSp|)Iydrgc$BE0k`BT2
zGCMii4SRwEv32=&KdKpG6=;9u<A8V~;Ih_c*;veZUe^?mI`o|H`V@9Hj+evy5NG`3
zzRud!RrVm4#o5Y81w4?NS`==FJP<cA$P9Kpv370V(Z*fGKR1O)|D!JnII&^|8aO9q
z3$HA2z&fk{{+)w@sIj3jcXx+E&i~>Ib2AV|tguN2{fCfzJW60r@Jdj%`OW*GsHXcD
z{Q`l<V^zI2!61XDwcZ@Y<~mK^`#kV#qT?^x!(J-Hky28~s&T7OvB-0L#t=V(u}8Dg
z@}s%%V9{z+f~Wqg?d%+PAF#=Jshb_X2)=cf`woptvHPX<{+A&U1thEj&Ui~GMQcp~
zm!SW;?z>c<*&rvL905xxMNfm7p$fNYdIV4~PUAC?LAStKs;(aoFyzjVx~+EeIPv)w
z9n&v=K4vi2N#)nTM75^WjyC+qs4t4Prt-0;eSIO@N;|$tKP)cB*FNVN5=IV$x8@8B
zoNKS3MJo{oZXU{p^=1MV2Ja%$UGwE*-R}W<c@67|7@oVvznRO3FGSrKUq;B{<A)60
zJWSU$lKYg!l^>eY^@7~xr`f8S9KLE-=GL}#TNS9-eY{ARHePcv?)Dp3K~p<7)_&6H
ztdx+LY|^CC-R>A0>YYDN?uMy}zE@3GaX;ug&J#Xf=xRSHWGU!wPK}J`&{Z`Qe4lnn
zN;bsF#>Tz5S)F-I`_h*@&RB*DPfB$-gKi_}Sz7ef3ZH%wP%_*VUiUzzV1`~=FHe;U
zZoKU@t$ujfpkdyU$IDw$u+8tYdfcN&F|nA<V{w3a37W2VkOmN{We0cepX}}4iBRr)
zFm}9`1LMm7`t#nUM!R-L*apKsW9G!n@@@i&W}-mhPc?Heo%y}$g(@CU?ExnnOmD)z
zC)AVYuO(=RYy7!F0MCEw1L;fxtu&j(y326;Zjr}4KT>LS+r8?`ZOTQ*U%>;qgTNnl
zvWj;(1T5>4wAPHY5y!)GDeDq)#B89A7&;n##}B!6KO-dZ0HAX2bQfAHHf2VjxsE@>
z6*k|^5j?DjTqzw4UmXZV(c+7$2SpY_j&}6)uqL#;A5*LZ&Q6&b<NF`M6R9X3h%wl2
z|Cuz>?^D^@Ag6SR8{SQ%`}9eYI*l^~|80!>MuR7blk*c2*RWQm)9Yc|E76!(awPME
z1MTm8a2hK50=u*d2Zs;GyK>FdPw4NlnLCsdDom49`I(dZ2sra&0@6mGnP|S3wowwT
z|6E55e)=dpU0gA{azS{&Wwk|M(JIul(}<D3q(->)lM*$to_WS%%xGeI#H+8J{E3(S
ztvdgy?cM?TxaLWvi~)thLbG@0n6%H&tRtxY0qQ>Z63xvMmk|+r$dq{$I!bFmV|d|z
zEB3CKwBYm8Nfj7%(y3xJT?QL_qVVIPhq2mU<R8K_?r)!POgDSvY^Xe%>U*&r6C~{R
z=huqImJuS7ZZKTw*|e@fQ}dJ8-|c&{BxL5i3-`svZhOO1cQ`mel)Do7^amHanTM7q
zu+oni)cnM*E@rku&twRwf?UTb9<YvnA85+mL1w9h_i`S1irR!(1~CB4JP8SmKRLnH
z^Vjw-2Ic>^;jwC0BF88yug7gu)U0c&KQdx+l+wY@-!ML6F?oVLLyeLeth@+U-+#Cm
zeU3HUzSte!y^Q7jLmBgIKvaGz_OBnw)7J(uuH&AXgt2~#cvb+U_Pw&C)z-=E46=g%
z?$$TSp9`EeisVev{?<=wON*P|SaC$!5pWVT<{mIT-(v=1uL6tY?dSR*&kam&30eP{
zR`mE(_M;Yi0H_);Ip0%so8`vKpOg#6ftRKIAM2Ru@2&qY8o!<DMB<}CWKl}$8nN3<
zAHlC!AKsV)x0*gvR60xKXHHf85YzHfCx<<$=ZPa656HjbE68$y<gB;1cWG`D30XYH
zW0R+7)bSepte-vV(?k2B8cZdJA2qrV)yozBPDfQV=5}ztu`>IYlBD45*)a?H=}-#c
zSrr>+H~hiwtOZ{*?+0GD$p^dr!yq=h0%HqPQ>Qqk<a?=C0!ttN`-Cf2Y(W3<T!!J@
zd#TA}rz@e@WZ+|Py1Wk~bNil>&d_+%6Laf<EvPEx#B@g#pXJu4-@iTG9Pi48#Efbb
zLfk%&>@R+Koa9&Yij_z<=pkF8%eXcN=cUKeZxQ8Y{Etw>e{Thprbk5EmUAP9qA4OW
zaMUYNcM9`38RX*T*YUgPISw>LYz$}bUy3K|nkwbh?Q}T&^7-$7${o{gW$7E3PBquF
z*F?IGCJvE}Jpp=Udtv7UrT48>(yTZgnS@#f+}i$MB!2rudtGBz<)}C>sU>0Y99IWc
zPLS=N-!VbKuHmWOEkAautvG`??ivb_J<wC)`tPmQvbKOx22x8Yw>^mV>3nBYgM0Qu
z?@MqJUyhH&GjSSU?zFFBeI0QiiUd~G=D%YB|3tI@S%dvE!wn@B6dTi3<DK=;bF4lO
z?Sn~z(;koMl-KpC7lTSlgS%uzXgLMb^<r&mJ7wb1G`0UdHvldKf8!vlaDVvNDcdk@
z28Pm61G-q*H(ZanZOsl9>Uh7f6~e9UsX|`%@}gdfB-Sn&GDg4px35$1%JhzDz(`bt
z0)N_74CFJ%tt5))g~fJRDGIXlbNf_5*B<hNsL$!_Ru6;M#c5x?d`H#ip(!?3e!3wK
zO6obi^D#<YXq{cYkz|M?m#4=*^n~i4gz-P$tBR~j$VM?Jt2msL{VVK5;5)-Z3e=sb
zB8}p;yJLb6SXj2R5J#Cpt{;CkExwc35+!>kZ4@?Z&Gwu>mO>eD#n&F+<`Qn$rTvtP
zRn{+_-lt$o`dR<GePr(;y<e5Bi^fOA*5YT@K{?ONrsP`(QUMM8e>*jgn?KDOQ-Zz*
zJ9)I@j45mIa|MVgU$*Y#o9G+wSDWfAAFI?~N7fBojU<7R?RZ{@JdmbjWN@btQNR<3
z2xa-*kfb=%naq9z^Slt7O{H=7FtulUHuFqkI<r=EdMq>UbGrGr&`=Zawklpe=hhm#
zweCY|um?4e7BhSa4k7@m5L{e-LIaa~Q9{%(Nyk|Y+r{nwI|8HKv-wjBO#*(BR<U<;
zxpM~pTp8U1@z45~Jw=|uUA4aIO7YA~epkQe1EKdODYev2wp!1<XYu16EqNMHY@w_N
zKF{{UIpYs^Uo3$4#2%=ue!mma+aSj0$eksH$`$5*xm{RH-7-1DPg`%MX4&Rs9{DWc
z-UV$VFQj_n*vJsgzAoP%R`ra9TPSW!ZJV#6RDlD}%@p4Gfy2kGXutiI>)QVrX89f5
zhBkHsh_p84CN*EItw|nIfzS`K;v$B=Co{z<w!KpguP=P1YOm_r0uy}om~ZqY-&ecK
zGlPgHxu<U(D!9_>Bf>GO14&70&<DRW_KjQ(vsx{`(kU{UT9)8nc`S)TfRr8VImw?H
zR$%qAh<=@8((BU)H-Ev*af+-ksD$YoX5tIuMoaF+$Hm#C!5oyT0A5_q=U6N!#O4K+
zKdDvCT&&pg#Xc0fU$y^nLH~QyzaM`2QRh*pfQE)fM)B|qxJaz~_zPRWwTo{@4AIN~
zx+15MVD2bwFfdIu)vR;h_+%u^Fa4`1g(^rzXbE97KlkcZ0;(ZdcL85!3du!vN4+E>
zVmEkeWT5zSpTeZ;9hVLTdDc1tc054%TYB%3J(MD-IFs{J<GmKO+X?r(FrB}17Tzwt
z5Z#`Keuw`|fRQW2QPf#SOTE1a*%y}+9N--V_>?t9G49xrR_*_>+qHDk@fP9-#Xh~w
zSt&F*)e+|Wl~P=KZnnNxdqUJ-xB|xo5>;C1s(bpuoUVDa-%w=c!ZNwORUF(A6gp~l
zS?>kuPcQxdZwKKWx%v)VYvkSSr&804|F#AH>GFl@8vNJsgvuSi`QPs3KfdVy!_!%S
zsO!I;01(AT{r`8<H9lg>yQ~pAV^u?=>>&vXAeN&0a;D?lNjsC=?qiTUGd}ZD)xN+$
z7e)F`h(mQ}qUR?b*M8?8qs&L}=gVEmx}EbhEwn74?LD6(9-!F8`@z}k&i!gSeA#Wt
zl(3iRT|0%194ONZb#6*ZN&(>xG$$nT^zxH=Ai1zY^H<N%I~`G5uq<2F>cZ6x8^0n}
zHn!H<+etxl4liia&fXB{TO!APK*fsqF;nWhoTz)_3n;qB%|{Q-x;tBc9)!{~8*vJB
z)0EOss<KtTc5d$|lxV-D!Y!~gX-v4BT6DB}^y!aGb+H;qH;+M@sLPF<L{)Z!^O*k$
z(OvuvPI(2dW1bk01cZbPgqJ{d!6|7%Aqc8ImcwH+Eer<U_QKZ3tdBhAlsf?kx}*2-
z9k=5xiuL4Vgx?WY$Ib18>=tuwdaLRWdtNoW#fGrg5;tGMnPdX@?t}hHUrfqFFGBZQ
z(}%|FM{AO~Ag6Wt#%Z3GFU=c!zkNes5y<{`Qy><L!y88#7&G?NcGp9~qUk|<R2Y=0
z_GvaMHC11Ms2TUW0CIia1i6^XH?OGZUR`yDApL4~#Z8r}$G`qWzn_K-+@xv)4<@5w
zTR_9ba)f8b@WJR61c3{5hJf#r#`h4n7p|^ux*QE9BEhE=rq=Cdk0XZMX;!LTB08U$
zw&Fr5B+vg|raSwiG7lsl!9(G*40PX)xIOxv^9>2{T*BTQG7I<^3F40j`4Lirf`o^-
z+Uob{Grb_Ff*qG%`@`@Svh-U$qeD+YD@2zA?!|x->R5eD-?~l$xwtnIcum!9g7mvq
zV~?a?`+YP73BX+g_}-)>k#WdoFLPO0g@2vBcgy#w-SrY}0pn(hsz2qf3crkI<C(C#
zJ?Fmm237u-dfycW0*|Nl6bn|!_Qif(Of!VUt>;Kh>FDX-1<A9smq@l9cAn`<{I(yR
zyXY&88*g)J>Bk4EkNDe|Ogi%f-Q`vr5)enyF#Di(`$6O4icp2pat9?NGk9jgb#P4V
z(zfko$UYXzj6I6Wb}B2c977Lqy5aZHc^zbB<oIu!c>}C^!){@Lc0tPMC2zQyVIS{q
z=KU)I0;YhgOfq|T<8x8pN>p6Fxck<{a5A!e9~h%vAKsXt=0XH69=OamisQ)!0ktCt
z28uJU^S{h(a<~)ZC}}Pgcy&66zyZ3S{F(~qz->tyn@wa3Iv13nR)jq>L3D0cNp3gP
zO9A}+V0mTy$f(K5MW@!%hSJ^koV$%3&FjC9sY|V?D4UjDdOgbxZx)+6JKhbik?qfJ
zF3!wPq3Q;iaD9Z!7LV@vrTWfvc${twr>dvRb<aRfS{x<O2a47Yt%^7~O`bcx5rN*g
zxuLX}BNepsWXP%yx?A0moyz%v3nHX=wT|1xn%RxZKQHySJQa_bzJHt8(GJ881vo=Y
z&hC(FS2OrsT{8#l?KU9-P2|m_+j9c0^;c3){zMD3#;r>~@;Y3CFCoxXP0%Hg7#^eF
zo9uV#dnPRR)#GEigml+e)SjT~pv~p)UZy72?wa^n3FM4%@D>PT4zkt6nl2G2aPK!)
zOPAmDP9M*3S7B?DAoNM*%LM=pS|Za{y5Z^A6JugGD>+(j&cTY^h&+b2*R}I@+2$z*
z5xJ@do?VtMF5KQX@dq8XftgKa-gbK1Ol;l<ymggy)kB+5Q@HVA5u++=NJ906C+)g~
zJog{Nz%6~1g%J%+ZG<1(%>7N4a9aNh0UkcjN6Kn=EJzhVnAJL6`}g(Zu?Hjo(FNYF
z?WuViG+Ik<)mpXKIQ9Z&L`xa^`6Wn&BUvs&mSv^r^rxeV8X%!+2Lo547xu`Fpc>|&
zymR}Ov&=zj6;B9E<W?6=kEhv`;7KyoK!#z5_0vspEfxwv4@S_V!C|8`ib=uKAOy0t
zYP}U}>Y8T5T4+hHa9^7P#B!fl=+~#uw}Ptd^iyeoFO{9~4DQJ|I3vPDieGD%K5Wga
zzHSO9<5o2E)>ibLx8|iiy%yC}FPf_25x4D@?eZIAKDzcWBLwvdo`@c|vZZP<v@#8C
z@)pJPuV)przUxB5#L_^zyQlNZGUIc7)32XUtmK3Pv-~z}iT63=TeNNmy?*K_*@!^q
zKdYYfTtcFJeHR)XjT;ks1Y?2_0^eh_G(5a=8O>@r?i2eO8WSa|JbqwR@K#WawBq&S
zZ?1>JnuDHge%F(kr+pjNK>v}S8f4TM8l+UU<MH^LJ)o1T+JBs+syWqOvntM?XdT0u
zG`!|QPf@b&nxqRqd&~0b5&x{GGy?Nl;y@he+h|VV19H)I@f?)L<1Z1xvOyLsm7x^F
zuZbx;%7MO*HUtc+huM`s5rCmT4%D_@UtJLr4h{@PM@Nf}%LfOg2<54$6!w@m@bcsi
zXN0YyuVFlZaMt@^aT|Sk&Mf0G8Y{NbYOb$yd}I|LtF86?;^tUk?RU+(yNSu*02d&T
z(em_&QDPe-Bhz+9U@_yl=%oN}@%s<6bFBa7gq@mVJI|JI2fIi_t(~5uzKujKH~+oc
zT^~4v7{S^>HbR*NiIix}rbbJf>;}(Y@q0kP<~TTvkThQdOro_aMTnm0!-6jiQ*-Q^
zzkA&fALt<=6L8u$?CifSiG<>?qC9Ea0#%NS!b+Y4we7ZYPv}KFmXK&_N~;X563U6T
zW9s4W`>nuxZxawo1EhwJlM{7;E}byHjfaB<yuspfNSSw3E@W+OEjo@EJ|oJPr-F~c
zVu(D<fEit6QDm{*EhyN^xN-dh<_{woXxMs^hHVAC-!e$VM$F2)cn=@%;db2qV-f<v
zjjis$DL}M$lKGg@I4u=Ia1|f}4785!9UcgiS?Tz-?V@~_veil)7XgxDr|DQI#Xqp;
z=bFi^YTThIaqAgjb{R?%sa~P>S?|v+cUm)JHi-@4XR<6o5s}ulsK3VYaITVf-EUbQ
z-Gje2*m92g>n;u#;V!aS%o>>5B?aM=5L}YBhks9*<XK=4jI^HgR1{1YBXesCLvwIT
zNn7f`Gf+rmSsAhG%eO8ccxO#-G2^;-Ucd4GpxNA_z@Q!(#lrP9E&|1n9o5uG_*n0x
zI*$q0=6E7-Sn<{;Z#hHduHk3CA0k~+{h>s6O&;@|?9-p;`VnzBX8u%Jf3>$=#bWYm
z$QtyPq}Gf$^B1LcO9+u_HffwCv-*P2K|*&;AFMrE9Yn3Vs`i9T@C*Ab4!%-%jrqwm
zis@(8LZe00?B|KB<+eRER8QrlY(~FpCb3w*`~5a)<!`h5SMZd1X;bPx4ePQ&6`aQY
z@>n?Ue$v-D7-<|Ztf#8R^7Xr>#Go!N+u09DCk@le6^vOIjw2&u)|;t73H!l?Yi!Kl
z47YyEXI>~MJ?u`f@Kg7B(BA3ej&7-}Or_bp{1PvH^K1DFA-wX<ylbPMgTMdO8GOlW
zN)y;@$-!51*1Tb|=;Z)(&-pn73#%3|Yu|~>b|wgd+-x;%H8ymv$4Pb`=OPL4u*0QB
zcCN>M%f2v_q&K647vMG*va-;B+_ha@=luHpcIImGrA~&@AxN};ai$6fZWV_`EH*kA
z*EsBc0YknwRckjF78D#FnmAWh{O}3f9$&g9$8^)l#7Fp%Gx>X6pTmH*O#iA2Hnf#u
zZD*JoV0s_!{C&#JkByBFnBGP^BkF9C!M7XN)mWLDw;3ZY5May%(*H_qWOT%owev*V
zqU~&e0bXT#{QFyc-ob8zqu<NxcE7{sscqp72S&KG&&Cf+dXlZN>%%W#RgUBaeSP*s
z6^@4;`)MZdYLhA7#_Nfa{Jfkj;_zsv4p((#S6618EdY&@X!ASl*dKo@c(DRwuHofL
z9<F%PiCJz#$|+=;RLI>KHE8wogJAoTm;DdNO`MJE{C$N|uU31(2Z#HWrB$?52`BBG
z{4nGn-?eFOGdOM+j74>}A)j({4;#%^-CQdvu}j|s0B#3-jztR(cp(uu%($5@@ziMt
za@lYHqy5PXpHM%uri1=m!uUt7W`kaT2$zrJ7P9tm0Y_ZN)+dDIxcZiw)nLEnRrDp~
z;z&DONhyRvotDpkJJ<W1j8y9UZ(X8_$bI6a*3AJR@?_`I+Q|YMCs)pB=#67}ngDuB
zHeUMd*L>$P>}I6eWt@GY26~eYxvaDRc9?Z?>8qW&ix8eZvi)kP-BdASn>X~QJ-lpl
z^qk3m*ARTNx?Tc%B<?>~TcLP>T6RZvNCyNY*6f5e*gvpZ1RArQeqwl;VZMWWCUgx=
z`MZBHv*=C;YD-f(;3n~dhm*<vZKO}QSn~NpahYeAb%Xiz^i0zkv(rWp#NzVo6dWDR
zl}{!2kG4VE)2826=8T)0)7Al*$PVlL$w-L<qN`<}rB=m*gI$gH+npV~i7L((i1x-8
z%s_8JL{oBR;&@INRy@Vc)(!+=X}m_Se0W-_{5CEk$vdutxqv3C`_W4AepR+)No8#z
z#>3E1-fXFB<*lQqzNWs7wuObS@BFb|30*x5@OE!MG`H6~^e1t~)U@1b@lE^DI|u}e
z0aqyKc{w1}3AK4p{KAUq7ri8UfK}|B`CNk^towGOjqrd|oA2mZIb7=aPvaNmI9}tQ
zZ$%z5GBFyrxos{wL(Pbed&bQcy$(t7@jOLmdU78;2y$m4CIHk({fY&}VPOhS&o1g<
zycV@8@YD3TN4{>0C|xSHKW^(}_68N8Ao;;K=?2Ga$NAv5E6L1PUyEH?IoR?frjB!&
z!9I(cVot4xt+q|hV3!RQiQLkviuUbs$-R#sv6l>piYGkzd3kH5*T1;Ht_2<S_227T
zYYSaCkaKn3*N0|AZ|S$pnjFmLmIKSatwRDYzVR`LwKv-$Zll`+=GXf3io9{^;Y@*;
znlZQqVtz^b*|QdpV>WzxrdWl+L1*Y?F%VTt#9dD}Ix1`D{A4Vts6QPyX>1e~1K;$J
z*tWJtMMs4xvoi<6+C(+|F6iRpG&P7=o#uW9jt<0LcGGG<_C_Kg>tSTO8e8$$J)V7d
zRV)`3Fa`S+fg2_d*y-DyS~UNYsAh}Z%E#GkPI96<4;%r9@~6hH$!5Ob?NRYqwgIoP
z8xSxL<^?u3wA7STBhRy)_I70a8cUqJ+kMTJmP$Q7&P37Fl+LM$WDS1@A9b~5F+4;w
z`rB=H29$a%)E;C%cWkwr8psD9_Z=sfkoJl%E~4}N5HDn8u#<`37^>UuQRe%c&-V_-
zle{b{>i0%`vRAjVLUeUO15qYoj?2?v@%xc+Gw|v5ZLHsyK!|0NUx6tT<h;d-OS@P&
zlapi%iaKngJkH#<5cfF!VY8T;N`vg&&O4c$Otu}DYB;!@JFPFa^Iop?1Z+>iShSBq
zjsOUvX|f<tKfz_n2IiaBW}Xu*^PxQ4Z`YzEEbL2{-w<cN!DxGb*KH)t)SwasDNjNV
zGCm!BC~Q@+=Yc=E3z7wC=V}GGYdb6?5e$-7-$Ov96!2kQ-?6}-o^tleV4&o$!T!9*
zzZ3h|^D790aMJX+)q)FcusM3@c*8I+_o8d>Xu0#(+g}|;(jfd?of3g9%+*yAp+Shy
zy_?Z!J(zb<a-*rP6?XW*rvI@Y0!Iof7m6m8l6lAFa7m7Stz~i|ke`>KHVngXOq$#I
z-z@1{1O$FG)E-FFwf$R;{PE*1N<dm-R%|uU@p@WbnHuK>nK`f9jp1?rfEwhxN@q+4
zZs8f%V0ob4l=3`%57!Q)F2cKQv{&delN-H5<yqPQf3s(Rh{`^q{G~DFvvI<6@W};t
zd2@x4Jlmj6zoz|cwH=SJjv8!{?^-lsh(c8j&zcv<$HwV$TZmDTX(9KG3rt$<wbeq=
zpQ{s$F$d=@l-4LV5$MLS19e|rye;_tC-t9+te>E??<Ln!rpx9|<^w*7p$f~AAGnKt
zRUdWwt42hm*&O)o7L7!?0p~gf1ej^Y4!oeOv}ijYH*uP;@q>NS1_uC(^kA+|EKkLM
zmn5GMh{QR8*`+*4|M&~^qd7njofXxA>+~xxFUv!;>;py*y~%`q$boE!gFj(1Z4vGW
zNmaEK|Cy7`c;K{|?q208i?%K6!3R@<fV$@BLKt>_dKPd+%`8lY5QAPXg);^GO=iXf
z4ZIlDWD_9e>!Po7SaiNZ_`=Q7Y;MlL0SCW_li}5GIy_c;0Ad|pP)VaS4!FucmjJj^
z0lPaB*<uKnzZ=||>pbcFzQAri@!=E=#=QVtELPv3y1yxlRhYT2`p2=h#-Yw7505ej
z*tMlDdk)R^;g!CpnI+M^s|ZZ0_N}hhyp7hYpU3NLO|l;%T(@&Uf-h*UfgN9p{#3be
zq8c*=cUo>AZth}LhS%5INME3oXRFQXj$8LzTm7);ZbG{8Z1msrgWK}*&>M#Q^XmX|
znG+RnXWR<`<w8k-;qZv*?iHYe!v%tNc9Gh)LN-N3&d{6lx{eOqRjjiT*JGjG({-2(
zI#b)fy|!@8HXeKoc-p|z0A%irzT5m-Xwy>t9T1b>Ri>@E&#G`frq3398411^g<k#Q
zl39LbK@LJ(jC;$!#H9!Blf>;~d!aZ)9u^BkH`YS4`Iti_NLDJ*sPTi2hlA-l<_6gc
zHc{qItVtbBV|?LS*w*B%Wj_i;XeJLC?Cr~-SOiW_&-kpI`BFtH6Ek9nv%E~=EVg^B
zTiTeGCfVo&>=`%x$=X=#HrT?%j7FQ|gida%zOF->T>50FL<Un3dT^la<cEboFe^yx
zmaWDV2lsYk<8q6qy)y&{^}k^-dG7F|x*YX7IAN_jANPyqqzMc#TN`mm$PF|fvqs0<
zjKiXr{gBi!>Fa%FoR6zcVpFGuT1();!miKSulXu%fXNn913bW8jpFu-zX#rbCOpso
zLId{~fr6UMl>fy9;P-b2{`rE^t|uk&GP5$aakeZpc~X)-E)$sZwBlkwY3}1R7|k$S
zCF;@9P}+iWK&O#006AQ>NsEM|?NvAdyux&1X3BkWOzc)yS}a50=~Vs=9NmeK@gDy(
zJDXKjhA|@p0dWTKIzyLR^479EBgbP{sC7qdqG^5k-C>Rh>`t<_1@u#Fv7N!dLanPj
zpf(AX5C5nB)_HTjsO{+`RddjSUh+ena7M@HNqJ&6hDn6e=gm_eT9Isx&tFfzWZjsa
zo<lQZccs1m)L1Sp+zyZTM{<GfK7M!`6M*C*?>LxUd|nOZe=f~<N*KaJ+Dre435&?b
zY@BB|I+#OlfU1!fauFw)e-mSu1@^xvi3g+p4uX#Yb5T1+r|d{yZ)0O_(-qzly9GcL
zjg=1%p(uFk0&GdP*H=te{Q@#)1>}4V`RI*CM?}C;H{#~6Ex-}5S>){JgdCaVqpRZ3
zr?O!=$7lAle**R^<E73v#yhS9k;3`h{QTJdDQ)P{S{1PU9s=-aIQAz0>WGkGe~;OJ
zgARASP6$D|LwAM8Ruh4x?3e}i=BK=YGGo3rwq6;6uM&OOj#D9+5=GRuq5kU}xF&v%
zyWtQJ@OxL9WY_!!-z-9<XXabHHr2Q{g#{dNUj+P_KoaA50l*F(cp;56u660Ilk~!D
zY(qa(RFe>3tf<$;oJ=9GT<<Fl)JCRoa1bu9?NA}8`eqy6Htyx8oejan<HTKdT-@cY
z?A1|c_HdT9f^UON0ehvJ(R3ZiPT&}Xbs(idcN{o^j*K8+D~+l8+sbiLP<ym9cBEvl
z%s%kwNFIE(3zNAX*4}B=Qi%0D^ImdOx8}WqU^fv21cckL-0Y@%zG82!{V~Iiuz=$_
zsIj3*vdUvm&BYGfN+LCv49*_<F>4FWgc(kT$#^3c5$98bOl_W{X)~kg-d_1PNM_83
zW6Y&*9T!_ORi`_PIqiy_GJmBg-RlR}SCgpnQ#oVBdAZez<l)t3dzZP1+!m{sg4RNK
zAQlDxzt($ggzLD=!?M(~PUc5yQl1iwLi6*_wgvLCF8VxI<15I(@XV{R@PV`$hKIf2
zfRAhP<-Pf>GLJMPr~nZrJKgbTR{BSj!Ox~&EJLMETgEtX7nqIsdxMaZn$|tGgM9N0
zO#baD@(Q9GSn%%c+nM>0!h0Z@>*OK0cYkMd11abW0d|*h6Lge_j13I%{#%ZIja_xL
zu?Td)6vV?*FN}MVm`(Lg!<*7>b!{`p`3GqKMIv-A&%6yG7{YH5ANBbG12E`2<4GCn
zK)R*`_8oe*ytlxHH33Hl9w*iy1AZ7-smKDCz_c*THKDa2?#>#(x%O)h*FXN}aE3pm
z@LwGV2lnb_+!d=G+Tf-D=jOFEn|@Lb7vU9QkuZ+G8Ut>_L?I$>LJzVjf+HA$zuxnD
zBU0JQ$@|&TgM)<yeHjoo5ESBQ!<+44(X}F!T!Vw0k4tF9vH7i3m$ePr&Mt}C&o{U6
zs1n@`Z)0{@ZEi!Xy0|<FmmFNBko(QiM;+0&IPknJ+q3C-_pt2hW<oOAIQUDi``OLW
z-Hs*B>WUI`c)4K+9u-HOabYd2<P|7^^gW}2w7KFnCx|ywLt+bcL3H~q>CbU%iqf^S
z;rr199p+T{eG$CZ)}bIdmc3sRI%mH3iDOuGoF}dJ&Mt{ml<HJ$G9%whKXz&|k+D7L
zrDxHxo!$?on%VZewgyI`SKFRHm~8~n0B7aS`1+f_q*%AIvMCG+4-E|qd8Ov~yqvby
z+i840DvBI@EhQjXZedwa97!P1<G~T(`u@`!4G$5kzYdC_YSUwjO?qk!*;)8H_#k2y
zP{ilo(64WCtG&I1<PxrB;xD+n9fX)AK6#uTS+X`#fapa%hLZHl5AFfwR}%AsT{dvh
z^asI>%~PR=q)J~{``)8`1L)bmnM3Uc@6B^H)z|yj<eOI`^%5Y>I~RS=tnM+rNXpKw
zgzv}aOE?Pdz#ac^5H&9y0>FacyysxSw-bqp1RZg@AD?I6xy2JD<gn7Ex#-P%g^9+7
zhIR-|au>zu8gqu|#=QCvaj-J+jVx9(Nh^tCVjZQLE6Sr;(ztjq<LSxg=xG1kfu(Hn
z_uS5j&v;5M<1`dH_TC0Gd>olNBf6~?OJP&dYbRbr&nl<#K}E&VJdcIwuB$6;bpNKC
zK76)JfltD7#Ct=<N>9&9orLv!^!p<2UD`UE^+w0CvgabAmLWEZ6CtPz{}f&0G=_%^
zp1OaoG_zmppZT<>&dl7tJ~OL*w@H{E_$DJA&IPte4hK=lbs?<)y%#+*9nAyR_6v{q
zpB7dN3rUJK?d%*Y?LYjSudo+$NZ=UW^=fKp;wht|rb$JV(^&xrCAMn^E+?h(2u)31
zp?9qsjGhz`QCR&|nTSm3>-+Q9L2ma)fqdiPA7g#9a=5C}H&$-em%=<VyJt^}K(Y_0
z1)Urn%S)^C#q1krpM{Y<YIeQ$8ptRsOA*S4Dc=mlzCr5ir&6q)eIg^c&C0<mQZFc=
z-6hT{v;6M)Xw=_xpNH8G_a8olJIt+|`RqM>NW{vbx{@DxDCtj6U$NL+I<{<XY-Xmf
zmz<LDDj~VfW2Vfjt)sQ-yk~bxePlc>Puj%Hq!;8SR0m?=dvQ6tU$xZXjYuq9U-UZ2
z6Y=^RBoi9^UYDCvu_oE1-AVo{AtMQ^rkx1=sfpL&=_lYw?8*hMyJ{-0t-sH_D@s{#
zcz&=oA2sqLA_DWrJf`MX{q&*5t=7{=Iuw+*N9Ho?Y@SEkT&%n-E4#O&*X-3BR;X8^
zq4cfafl1VXsA&3q16v6GEisYjoyXmT>q>F-q7F}N{$7;oed=&R#W4~UgcU30YtKI9
z2e%ml3*>a;tL}Zpwxz%eqr}1O*x0C%@u4RYu0ov8o{33DzmoVk^t)2hTYqMHM`7aK
zbMixkz*h(xbnfvt9lw%H(t(VjCtoI1xEnIYLMTDvI;J_<sku1`L-Y(UJdRea2KV+D
zICP>SqejNYsT4~aJ3AXYW%~AzUHrE8CMJes#J7s3zrwlt26WXpRqNmI%H+pCEB+Dk
zZ0qb2n0iQDAJn5tK5_q~qeOUi(B=+XPO7b|c{cG$_2FDoH6kxlAtdzH?Vb-GR3eIr
zo()vIuY0b=-rMVaxVY^iexOyt5@nvRUB~oVzcAJtKjKy|5hI_(G8Y)k`aJE~^N%~f
zAsyG|0ao9--zIQybG}H_eHxiGY(1@^%FU`mfhW&C{eC|=9cn!@0_5d^0oO*qwvy_K
zq6!@l9VSKfoi#eu0Ice{gjv<z!a{Kxt)k8&t&-kdQgRZjdMgV?ONS-yCjI!VrD=}U
zoDaDgvH~n)D@>Qyf_QI9@4fa@H`(yyT55_R>TpybvLU@iMS&M&wwY(i9Ts@^|Do(H
z!=n1W_u-+39;Aj8kVaZSIs~KyiJ`k2L`qsfascTLX@>3+L0Y=ILAsRg|M`6DcReqk
zdBY6XoH={%v)5jAuX~{n7<(clJ8}re#&xqLrARLu-lK2wyldv3m{D_5D`uuiS)G+4
zlTJem4&cstREbV-+md6(=3di|%u%!CTdM<SP6xmSI^PAlC-pqCX6JUMw;m=`NASz&
zF`Si@d6X%Cw1?Ue>+@LPe8<WI;XSY3jg^Vf6FtAkbU>DJe_p#UjB^i0X&llRkcNX&
zm}#WuN3cfGZnhJ+VtJa}tB$r+DD-(?EQ)x<bV}L<FMC<fU-b)8jyR>ShFN~8(|Ptx
zS~UkDCL}6w=eqZKfYHe@<sHV4%ebIB)--*M8hZ0B^Pb&-E2j#{KW*Mj2gJmC!Iu*c
zt>hP<d?z%L+YE^FHh{bKm-jG@Xz&Y_j3lMRW+s~3zOKG<Z7s;5Vb_T9i5|#Yv{Tv>
z6#S!!uJCSrq}Ii}{hppGPwDH|Jg?O(7w!U&N^4$Zdc??tuXp-8mYcRXoQjsoKE={B
z1Ereo0?Wd_kcbXB#b1}a<*IF7OnTCiYUF^WTdj9?Hc?)8IrdZcqk<4(#c%_6crTII
zPPS$s0LfVLz3)W<6M#o+Lrn*mq&DAt{#DbqE<8hKGGxzVAY!MfwjucO1*)9zr0iWT
zJ}99YIJQcAynyI0P*+!1S06*gO=<QLtbJEkGW=AxTl3ORfGiIr2SHV^G4b>B(q#pq
z9zJ56AAQ{F4v(v~qEhag6YC-~BNEb|K=-po3gCv^D_3}BoN@QoQ6dFE=;Q+je;a-`
z$LwSlq*bMrPA~XvaV6wZw(BZi(zQn^<QzZ)PIv~dqA`~0@2<}C-r4q3XD>kvfRO8H
zOZRj99;Dt#MUzlHxg4d@KHSBSiDe*%LCu1pX21z8@@ZR1S(8x}lY!_(@I4z>TI`VE
zlL08OVTEarBU@a&+ZIOrd+ADV3N|@O@(K-(7F_o}L9Oy-&=ZtyOKXv<H-Lsu(B^vW
zr$NK8wTgv~pVOZ{#yoBoT0;g_ln{vN;}^-`dX=7lSQ;?0g==Sus$gnrECE6CNZV;g
zY~BICqob{D7MEq+j7pXGcg8pxFj{kSpEBTyY{O~5%{ucy%WO~pHwmg_(r?9`k*JvP
zlHxLY1Y#QT%lf<N<9%Bw9&x6Kj=q}LML}{{uAELEkAr}(lrR~*1c7i6-m7q-@vn-O
zvb%^D_BlYSytj_`ET=+dEHu=?8&{^yBSNv107*c&Xv}$1D{q%i>U`>D^8XGf$f$0Z
znTb+2syc<i!K)s-&Mu~=?y^EC?&sa%GcyfyDbUs~RZZ1ulY`6i1oP5*v%KhO`>faQ
zL*3P8N#%yM=D!DwhglhUT&^BbKJ!RfCGRfe3ZVMVf?owRm>q2v3`(oY!6UKxPbc}+
z<>Ta7rh6&5&~XC3IsMV>12Grq>dj8gQoNIGqrZS=s4o28M72<g%P;QlZwWz{QI%HB
z#{rqh$AM|vcz7q()aow(vQSk<A1js_R&olm{JCZ0z-P5+<gK~qkQXs@N?sOQYjl{@
zAWAIO)tPG)CX&fPNGB0Xjx}`Cz|oe*KXdMz=8|Q^A`nnB1!fB(wC2NuE!}FpBh}vT
zhL!XYy3SHyDH<9ju%sVy!%?KzQ|Hm2`~rG)hqXJlqt;eW3ph(e1h*wv^{HVar=GDJ
z%1aidr7z;Y`tuF&AYU8kdL0!cN8}bi{H0MitEsK6t;tX>3XmE0&u5O%GVrM$ww;ax
zfqEr6cYjCbO5p<Rla|4Chbg?qE8iZBEI=TS7+i`(%lo_Aq<#14a<05E(9QIw#QS0P
zR!uC|V_(cnLTRei*TSy+<4-GmS&QE>gOR@FkP=wX5XzE;K{JJiqCW>n5_J@H4v7qo
z5usSnVD=aBz(J7WvMxz9U}6yNPH?7;+Oghp0&$5VeliiUM3LajapZupo>HqFS;<F#
zV&oxC9IY}S2^+JzbS&QsHA{Gw$kl;NBH<uf<JPsJ*1BTJdu@B=u%bUzY^-we1LZA(
zQcgk+)%(vlO5Xu7X6<dfw+A(ghgqI-#bUd|*`rJ7h-LhDKJNy5Hbha}lC%BlH>@I7
zaKC|v%i^VIpMu?TpmGs^wun!0{ufLrcQ-TIc!2I;%!!y9i#okRzg4A3)sttCij}6_
zmHkRpdGY56FX!3g<<pDf4KJ8g$0edGGzQiRMW&CiwVVDG#Dvh-AhJFvc>r#>s6NAr
zVl7UjbeAZLD7`<ODGwc7fJt^D`ZiHy_apF$GDWag`>>lY2@)X4l2+j~?TXeCVUYTg
z0tOC7uk9`QJr<Te<&2yJTDYz40Yu8;_wV`(T%>v?hyXhSn%Ppj$9jIX855k0ikJXN
za%9FdH@9YTQtbL%J+db*G4?ZLU~pui&BLg5nd8n!&*LaMJiI}N9W=JGvU2R~DUuam
z6zP2*i>V|G^k*uVxxCygieQQ%6R<g)JFR-}@B>Ogm6#OwcjfK#o}ONMCPt8irff*x
zK`NKm`PPR`SzM|G-$|dM^9NE8jj8_P*w@4?v8%vTTFry%O{O|!D~~w>DURfWv2imU
z8=FZ+rG6!qlN2y*esM%D0!#~H9Tbx-8McjzisDWmitmli6mir)`A(ThU%<$8BI=s6
zyq=SwsR6U`-bH!PwR3Ns{Pv!_DF%fdjV8iW!ITa?BP&kGV(A()?=8l`5V_cVD7VY&
zOh5`!_)YEsXCar4PD2VJh1?r~Xwv79Eg3fsi;h4I?u{Ym1FkYb!AMgoOq!YLZn_qn
zEMj2jelFrg1VTl!>-C=U?=0i5KG1tFfq7%TSA*n>#h{9Viy0msO;W}6VJM}9knx<Q
zA7H+C*`Mdp+O_`YMi!5Z$76daV&67&vSczmEon}evoRO3-@Rvwv<cXG+yl=DHy$n)
z+@e&~9lNC7nC0d*9xm<uxm`HA%)GlSEGi5%sy$li4rB%jSN%~kKQdHaut~{#T3ef&
zOIyqBZUGNDh9W&ZanFem9psHi4Udj!aXns|pDZ%savPW<coCtfc!U@F(^yVLUZ>GU
zU0OSZ8T^5p8$N#IeYthH&k+8spbi0W)7DI^yYko9%?R+@hB$)&Jz-YnZ}M&0)bFkf
zUvVVM?RDlwR1}|^n=ToP1vubVoH8c|kplv(+umN@f`a(I=*(B{_MY0>q<nw%$HDUQ
z3IOTfOCdKbGkrDphREb6yibr$D6es7G;#T2mC5<ow?LYF2Bt<~O5w|6Vwn$5>o3^L
z%WvAeEb<EhcMI5(z0k!><zZz(kyqyfH)o>>iN2S=U4q~HDRaimE;i;EZ=`Sodjt0{
zYyUkp^RoZ7+y@&LRF)wyQh}1NtG0J7@z!>d7A$MZtEa*MKGA*cslXz&>gggeMv6<6
z@dC7EX_d(=W}s?-3wKzo*DIRr>y^Iq;UVGbgwhgGlaLTnv4cD5{V^U%vc0Lu+z2HP
zGytXedpc33NW}zxMJ2R#@r%sHCXF<k!|<*ZOeUAb-EeZc4yg8bWC9!vEb_DfN7*Ur
zOB(_yD8#JH!|)hz%+gwfg2!eITJ1Fzl{6A^nLpzTe4ZBpQNDJmTXw`~=gV2%JNImR
z5rUH?a1e-CNbB9+9y)iG?D%qX^DjB@(>M3j_R-Inw~qkhr@yisn)<U@%gfs$+;z%~
z11dJk{9e~SthhG95cT$8%ThpankKn{IW1naD48eVAT)%sGP(Wr;TUC&-R;(zc~=9^
z=x0_=*{brPJhei|jIibjY%VTO8L6w6_n7cvU>C<sw`upqVeJcLc*ijVD^fa=R(+`(
zUj4G7N7lu)MhJna^D$5gmS0Zmk5BeB9|QFx)=L3=?B)-0a%#oFAm^`Vu3Iq`UHvTT
zp~<GGMdZKD>VIG`g&GNTlbCk1qJbcgzpQ1;io!K-<Y<*TtmPs;e2Ojo4r54YtL@7o
zV6ma*gzVEpL%Re=ucOL<CiaCIs_4j<e2J9e>P!rH;oMjwfAiiR^gQx15`|!b3u<DL
zvsvx3VO%u7hc5p{6fXIFaDk~7bY%$ePqGFU3+Mr8m9Al#z8C?Dw@TE@Y%@5~`|NC5
zRN~Wf-g1un>rpV=<3O&dr9&(gm4?>`6w4297D_1+PM7XIF#|xd8jOYAKiVc)FOxM}
zYO&ADn)l1PlK5Y7e!J+d$>ZznAlt+;D}Uy|xzJ#F_KlE5KD@-MZQOdoq?|}@ifmXm
z6NDo%mj1FOe`(!!1GSs^8>>kG$jn&)2)!>;FFOsLmT~nQsB0v8A{0j(7-E!>K)W`M
z<7jZ_^ySBy(8zPIOayZ-{qm<xTu{!lCtV~nX&AxU#zf6Ky+#5BCC1GRn@M_AN>Te=
ztHB>W_su&YI8f_a?K+e+aKXa&PzaCDsd3Td&0jsIUlFD}<b6?;g2hIw9kK-Q57~i%
z7wHX3<f5`glLQJ@?=o8e!%1t^?=37bxanF)y~r5uz4QBcq4DGwsnNjjF@v!^cY2^o
z;KYwN7==cF89GZ!LB;1f7U19Z<R@jXq%9Xl1CGd*i%W=4Z1y=?5acaPe`nb{7p$5`
zsl1anDuRLom)-2CwPIjmtfA?H)|r_Eqx&r|n<1p6RYhFScNarrm=WZpRH9~o&4JL6
z{oG$ZyDZQ3p451zchusJdkC0Jk@EJ=wlSPYhMOE`elN9j#y>IP>sWi0^Ug}!35TK2
z^6%u)biuR1dOP4a4G$=wXE1UfU)qajY-p$#efT>Fgk{j%Br7Kg+PehanUV1uuUQQy
zi~m_VJF_$}egy>!UVVnuS`7~Lr||eKVLbOQdqxND4Eq@*8v`W>%Zg2F_;eTTA%1%e
zSb5KReYyvo+7i<e@^8f76HS})<5F=MuNP(iHn$i~6+7}EHN4)Nu!s?RfGb%0D4h?n
z#E)ufI?UC4LBhtxO!fY$1cFXgu5NH9iCqrW))uK8#AoA!7JQa%tLeLYs5pfD6n{>G
zXyhl#SmKibVu*fq6|-Q|+`NkBbG2TYwULn{cmHNf2j4fMB*6r4(BHn56*8diEk+>7
zN=iOjDjC(d^i06y06!vKVAir;Q&S7$2bJp{I*7*DWTi}JP_xo+KQWo%Wqu*O5toI6
zM1%61j!Fz_cA>{nQp1eb?n(-3aSaM&#jxyAQrp_$R3W$NS&A9^xd4KJf&M1X%a`me
z%j-Y@!(|~D6V5%Xz$-}m^WcnH+|9N>0O>|hu=Vnog4Y!a3jPudJx9+TP0z|G>nV4#
zzV<pJiJ6V$iVlxxaas8uU<{^>|K&Q!H|x`EIozot{z6(NKo*DW*>ehP5Zg@UYO@C?
za+Ppqvc9K@tE+~@iwW1kg#7%^zIQ(^M_MsIRGWM=p^6+$K#v%O<|Q<XW-T2a%A3go
z(e~s60Y@ce1)S=I77YTaU5!7fZ?n9}L9TJHEINZfym$+euy;LY_-I+V`rQJE*8qr4
z>>cZw52T~14;M-0dLD;gU0c#Ce<*a!9sQXrn@O)|*<U^JKm9eqxikDD=UerkX^$0J
zRsxw1Lt*PL(D60F--1B_3jIKteLNvy?ZjmL#c06RLQ6Hj6!2k3Df_W!fVenMOW(X!
z7hu5y@2yA1&AdU*dwrdzTG&<wNJ#FeSUfR<$g9Je=8yEM8X8}2lh@9LmWO`DCs$s0
ztflO-Z4YCY!O@DIFA<~6>Vh0-nb|~rXA(--X3LFgObh1i(}X{INo#Any?b}s$TdvF
z?@Z+>4b*7R1Q$j>f4YfC1i;z#y5%H5NQo^P%5yzgU?lc<_%V67RW6SHOK}7c=b9|4
zZoX;jc}^%L_2$j?aGC`d)Lf@fl9(9sSj*Y|{qgT03P<3Q<7l#-=Ir#WnIu%uTuw^g
zUQNp9joGH%$@fy`2-V8xqCVGEk|<V6X-$5Ug%|1kX2CVQyc}6TT9^q3mE()yxpKLr
z6zdmfLO)YkbLG0@sGD(4M+d#C{Mh%5#;${>UlX`g8L28)wM(53!p2DX8*x;4Eo2pN
zAfTZkK2m{x55I9JDIK07cLcQF+r~2Ab+x;y(S1=|Xm<>A_ouu`D#0@g=cn$lM)yWv
zpMC<<4o-b2pV;8}AKIOJ54+F;vNutI@@n;N`aSL1Z^?=!XA`);RIy<!q%Chve5tSL
zl!A8-cfBb*=ee2cz<LhBTDS<1eh8rNN{rlpYY9D0hj8-@zy4E?`1uPxTY+6j8rnVI
zP1d~K_rvj~rvG9ogBdPC3pAX@s}XEFFI3rQK-zHFAmn{fZyxj|R$k>f(LYffGN64M
z{=)>%JrlGm*VBEG$tcrxUrBZ->=4HOtL-iBLA>?neP6bAk$oKeMw&z#f}6vm!tW)u
zw;?1>x(&0*ydEpYcS)QxT3_B}35iIa2wq;)EN2}ylU~`~dj0MtbeI9N6%v{3+sD87
z82T>rtMkSgCtkR(6+W)u_fM5y<2G5?u*gK%^8Ah_Hpa+!L!|ei-#{JAa_GMg_bv3M
z0(E$6_A2;F?daZ)rc-*`@5MPdu#k?Dn|BeB1z%1ICp%Ug3HZ8;yRWs?7tF_VQW6yq
zx*kt1&N!4urE>e4zhu|_J1;i*RcF#=h~qhCQ&N|lgGlqI-?SEMO&@glvnLfHTq?`4
z1r&o7*P9QVqR#1M#X@`H);)k;87*?xHm42lu&stDu+SoL_SWP=anWU9ZHAn*(v`Cq
zOKjdE)H<p|jPd;5K#ZGd5c(~E%@E|=yc~gu2s9p}kglF=9Ga;8{oLnvFEHI{qU`M}
zJyI>J$^%dia|GZL%BZUI28w>Ld(2}{okF&A9FtMaPY^QT2>x2=z3VFEpuBl;b1r1i
zp&P=z?b^&-kjqSt8}jiA$>%ZOTnD`!05YR}e>u3&8)DqJO&#-A6&63v9Fe=-wP4Oe
zAmtht%*`0wBI+3QlO{a3?_ipL10|rWpSltsY1g$S;K?F+F^YR8;}vSMR@cGBt$C06
zD{$aiyu~oFOCJZG`~*VEjvQVsS&8q62Rgm+i9qNMS(Ycgs*m9QO0TNN4a^d1k~baz
z+@nd9+JQG@-1<Fidh^0IT^?EajIVtWDRcx0Ig`oxEezJ!*9Dyv`GC<nWd;8vVyFY-
z>LrQCG<(U0W%lxYo2Zw;EJmVelLZR0tEYiLdbN>>rjYP4KFweaFzSN~A^CmXQlU)C
zp8a@>%GpTB#DS|<`xokhsh#+XTjgeNUoj*z`8ejh8kMB`qg-Z$!Uz>e0z6Kc_aazH
z)+{;Z!LL+z`_i+HE6o##533S6Gz>#|$)gsA1Jn-#j6VaxOT<s(_Zoa$b-<`UGjlYi
zLrl4L`2=u&#xY0G4Mya$g1>RBOh2?$r_Z`ojxyb$zDyZrlnO&UYcmXm#98R5!iLA2
z`DM9!7jnQEOCZUj*QkRzf{(`&w#(jM%9suIk?t}0QSTE8rChy4_kD`rNaRbX%t-CK
zwRC8)!e9o}_*{kY^g-j${ul34btf@ea<{h(h=Prg0vYf<RZr+Xo!Y%kvXGEl^#2`i
z5&Ts-4jM4IXAVNo!~=z!hT?zg5Y}OH%PGCub$iffy7F@K^8FzHt4}d`#s6wqYK&rH
z^I{+(kf0`I_%n4y+cX+H%8%*q=Whg_F>dG11NuB?2&w@_S%_^noh<mXLh7<2CK^(Z
zOsE^3%XP7;6rF6E?#%HwMyj}A<#+QNjKNZ21cR)+3fjWiSLxp?TFn`a!F*WA$dv<>
zh6ut~olx^m_%lt+vl2h8LsoTW-aRhlubAp`eS9d^XAm7Uc~B{}BC^YEv9ffUIF1AR
z2s16{E2iDmdxAG9^1z$3_n84W&ydm4F_AzPWBarnG(+^B#H_~oq{3yZdP~6*9EP*0
zmzglyp;DgGM*%CL^K|o{foMSU6R$Qy2&yVky?{v{((k|=9c|Z|T_o_2HRm6~?Wufh
z3aQqLRDw1E<!$zT4SA;0_6hGsH8}H>Y8Y{{Ua>}h^1%s@qsPjn$(@7Kn`i;a9|yf4
zwwKLLDe|Tfi%yUL0(Dw?hpq0<1c9vT^x#~2x-EXj0%<BSO@qZ<`@diCM<Wo$35QWu
z3gkWn;qsc99mNf~fe`gD7D1-@hJx?;98zT;QYS(f_lfb1;dSrWsTeWfXe9UbAF$;T
z=;Z-vr+WygZH7!9_6w`+&J~_#wmX}^Tb<-Oph2q(z|4R~0s-_9Y69MZdE;}xjkAwQ
zcz*Wvpq~D6k=L2mN^jiSImfD=e>K_<3Lw~bOk|Q*Gmf5K7BD`o^jsr1TQWHSD83|;
z<!Sd>fS8J;Jet$-GZ|IIcSVzKtLMb}q@UFkcWj?w{KX=9!?fqBR+Nt_2?npeKo6qL
znMRG<S8F+bM<{WU9fCfq27-TZ&IAWS?ya2lG6n~Ych#ytH}#GjF+`X;M}NKzj%Faw
z!yNflc90SK%Q`sc8QSP$Yok4lQZlmpI9VX3<D?S;)}}n$7HS5M>aA$bK8OHQ1gZgt
z3fAokt*e+y33h+`S-B!K$X|$B>56<;42xbB2gd=pYl0I&UZ1QulhS)9oR$&+==tX|
zlyXY_Uj{BXGifb$?^o$1t_)2MOMGP{ArDtUzcGItbEqX3Eo6Sp>a}#XK%ceENex81
z=7_^+Hw>&qS;j{?zdpvIzW&*Xfw#8L!6hXZY3lJ>7N3IJha;o#)Z-~?cSX;Ok{qyA
z&3S3`8t-r<x|x@zN|cdrgDw|ICng1zKQp(`L=EP4B{`<1yUkI$PSVf?^{irWA%o;!
z7d7lj=bv#t+YiR;kyk(Mgl7iVp|S|3DHDegTL?1g)fL!@cZ2EfJ3X|EuCXbaDt}u;
zM(083*uU1DM=1PWJXeI!bi|E3BPStA9=DqMno#&c7(Yo^CWw|^=-Hwjo9%MkyeW4&
z>c+(YLIF)r!&WWqs{4m843d=uF_B<3Szxq~)i9IRC^oKSb@~ftES<LR(D-w!kyusL
zo$tKh_1Ck2^A-PqC0<O;?FgmtyyH7%tXQtRoo=Mujr<HHy~R`mjDe}JA-MI{-!xOx
zF6q1ZNjG=8{jWs@xn)xI(jkjD9bi>oyik19eOnt_TMu4Ui4G_Y{KM6oU6yC?^>LDd
zf|{0*E>xuAmuz#-Y~CEtgy@2H#~tP>Q5zR)O%7&Kc2mgW8G}~o01TY#XO)uI;uJx5
zSF?vA{^)*$RChb1e+5+8De-nf&(d{j)qFXM78Rj?ymZWGI@aCT+E<#!O*2xG^<Tfv
z``vLoU2fGGMW<%L$LjC7irQu!-Y@sczk1(!?vyN?fDus)%JJ0as4QcCMaR%?)b=oT
zSxK%EN`|(<5Yk;1xMG8D`c4UNzJ5Dj*yAs1EcpvF`#X0hC%Kd~s3ifjU?T>YHitFX
z@;pND7M9xTY-$NrUqV2$4Cg9M?qVG%(&)<P7FP~mk>dS|<bEdgOie0M#ldKkErx5i
zs<vm3&?1qpo2YTHhiK*|bFdiec5F)Q6Q8%r$qhnm3XaL!b1@P=IuwTaXBy-aqh9Xk
z*D3YJv3)(HBin~N6JSd6(-FF#I&0((?OMO@z9)Ib77Q&=Z3}@bHKdXmOPgDc?23nk
zOqmv{nGaG4(gNIp6+I<f<Hop=F<dk>Sd(9hNR(43&Eyn#A{SysOzl_3V(EvJL?Vc$
zz5APryAcZ{MFYXsdgf9IXsQYwDH9&o-Kc`Bzv%BY)TIYHKB!~c+mK)q3}}Dd1P3Ew
z7k-80@rj5CkLMTj$g+;h5aUsh>cC*L8>XiEj;1bB!NhEarpizeTP0Vwc=bfO_-9=;
z>J$sHGW5YcmlWJeaPHzdvq_n^`*0q6C03{jR%Mxu`!zGqoIP@9tj!leL7meBL$E0h
zm_hDr<xUYBnEz|a3iS`KDMv=ToFr?JjT62U5ckq-oUss@NE6w@S)d8s=9Ma{EIf?n
z#Dx*a$g<&x{u%``^%C>&J<(UOw>~urAX;=&b6FEgHH&P8&#FHs1e0>r&~wPmym6JJ
zB1TKqh|f(@zf`AqwndP?FNM+!X=KL~M{l55Ep&Z++Z%>ZsC##gMNlR`@5?KV181#K
z(Ig7tDxQL*E-=w5N+@0YVwINd;gv~(k;E<vB$bF&N~u<Td5)X|4<O1)ph_G9t6Eg{
zF|h@p{-nIb=Iiu8qlL7av|<C#6PO!b=*J&_7stv#5*N+HAwrk*w86z2?gL<xU<fj+
z_tImK?ntI)R~YcG&lI4S%ml#!=MZcNOr#=O4xF;@#wN)E0-50`&cW*Z`+mk*sw=dA
zXf}ag58r%EDjS^TgGs~Y%ddq319JPpX2B`@AJ_s~PU?_B5)!caO<1^WXr}wucXa<9
zO4m)|Y5I7Xkd1)B)A8+Tx}(RB@sDL3CM`F~5>VAIIyLBU`MpS2^gKi3OsYFy^_rhd
zQduAON(!EE7Ykp#%~_c5uj|tMO5ygeiTyLbb}>KRwCPGLbZx6TD1>VvuiX{zzjr%p
zN1H8sRD@n++mHTxDS#^;cWy3PQa1nh0~xDW`n4PX_whN_Y}r4n_V2~p3GL)#`|pR)
zuA6Vp!x8^kR^X2x^Z%bq@A;Ln3KJeD=<eycdILF`3jlfm=uvp|-6Qk=-EX$b=}qm#
zd6bcE#PjT@G97M`YkcS=@_jDd$N!EhgL-Wy;D1+yp1oO5BmVD{0TF)RWC>LF{P)Y^
zL=`$8Mm{nZL?E&%mEZeOgJ~mjPeuLybNy<kQ&$k$PI~}=lwh5xK!OA?M}WT>DNswv
zNwochVh83J@b-df7s{w;>A{`&1ZptYK#Fo4vIkc$^ojKcjWr*Q!UX3G`YMKuD)KNr
zSSqLO2Wf(u6d2{JGy!cl6q`O0qK5e`0Sox44yZaNQZK!H;Mz*yR~m4WUNQ~v%{n`F
zNf?aG>}O^McOimRN{;9zGWuUjJfeb^?VQm_6C6kkHzJXeOP&`j&`|gETMBn_R)cc~
zzyBoDGh*N!f=8W@miE`|_uth&Mh8so;IxoDzRAnXR^==qLErtUrn$M3L^;xW5?Y{U
z8reT05cG&836_6s$V>3^HgMZD%Ou`DZUfWOKiGzV{<V%7XVeusnW5I?G8VAu#gle?
z91YmFgos?vgD8RC-d^;@9-CUj;px_f`~V2n<CY4`^y8FfTOAh;=q||Sc&+~QbJNfX
z<8vfqIGI@>&EcZI@zshbkO25b`z;6qmy*Z&D~Y0J0<2UkTLf12j8BZ;efxY5pdB`d
zAgp?W4K5qLuD|<?9Xxj6)CM!sy6R}Vq6-Go<}y33HlJPjHysr0WW9U$ZhT;+favqo
z{Va|ds$T&zZGI2d3?vY{xCe_!oEfbfiaUj4W<Pv;VKtJV|M535N#t*RnHxe(xj?Rv
zk#G-$vlquOHR%<QXsnhP#vo;HQf(1Xci#EnEmHa8@dREsg>5+`0WLReJnoW-{OjTZ
zByafYnVP<NC%heOJUpCd7)+{Pq{2RK5(NNI)g^oLq=qm1N7Fz4M6;~@wD<RSDBg2w
zKGUt>4`zD0x?*}Yb@lZZ0BdlA?#t5I3Q=9xrJXZb8QFK~Jc0~@f@3oE4X=I9ccU{~
z)6&zqd%HsL$V6SXFd|9#`1n>`AKduU-wn2vG~aZ^kSt2sCl94taY2z`f2evP|K9l{
zS0Q$qJG2Xwb<G98Gd)%Z<y1!dhjN0$a`T@dXY!#&b!0RR=Bw8ZA5g!(R)IrY(-H2f
zqY$Ylue0HvY##tW7`L$rfVRZ$uQ%-~zyA%ftNaNCLZIS5R+_kZMCj;vd?u6F$;kE$
zUX>oRN=sC&-NBKhs$4G82>W7I{YOPVbCD`#i&X)ngDEL%H5hMkI2fhmAVSn=j(&<!
zzHe;%{g-Wk*x!O%pGwyE^#wb=%pJV}wAHVkF`cf-?<97Y+}@A3SY5rdMVH!5^l$T<
z?;$mM?adDYf^tnwuWRR*d~x^F)y6acR(pU`bwe?i8E<#hX$DRPuLk(Nsb0G}pLTrK
zNlkt3d;crRVUe7ioC!{$r)dZ@eLguK7>J|a>(Mg2**fDa(^S;AKP(*9%gfDEi;I7-
zC6)q<>EHipU-c?&YZGN;>^=BXSKk;##^-X>a#3J4YUsDe@UP`>YkP<+FzW5;8_MJx
zw0`v%LV_dsuVdt%WIb*AQ>0;~fZot#k#d{&&*vZs7)+ALS8VldwolFRK_zz%?HhC>
z|BGqH_`OXPalKl<hbei&*)lzGllvw%jy8?EmZyutcPgTHhjjoVSW_cGOXHHIUq$iV
zVvVo2o!!BgkCsM4{y%8Im5&D(z8H9ORF`94#{kk!lhY0)P?g)=rA(xFMQJ5l|6u!F
z1)7zD!m81=iI4u0;;1+f+N~Ep1h_Y^n6f{)caMG3(MgRY@fUGFFHX+(S5A<Q>7%g!
zSzPkms6xN_e2_C!S?eV5{-C0Tm6q0IGl^YA^z1Nd)~M0$iaL0VFh*2?WqK;5YHX~y
z7_Uc3&tM*a=TSJdyPe?*z@H0WW{-;Lsp$%Nc65k(Up3U#4`;glv`E%>*_bLRt!!N%
zS#)aMm{3giYrb#$g6-7uC?vHvIof`j+)AR9Ep&0&dhF7?RM~bN2=s{_BFCo|I={R-
z0h&ek_4FEe4D(S4I4yXrbp&0lq$kJMn&14r64UnFte@T9-V%A5P`tRf@CsVbYQO(9
zz0Ze%|2&D_=Js%&bU4!+pn{|nb3Z@wSgizje+LHs*@QrLtzEn2d>Nl)Bt__A?iXPq
zY#K0;W1^y#e|#)zTNXPAB-1i<*YWng8?0>iJMZU4Kiv3q#*yJBnVk44cq}&W?Q_4w
zlg(au^Jaryqy4J;Y7qYNU2?lpI*&zH;c%q*Lw-q#;ENZV4HQmtii(T=r)%ENUzU|2
z2KJ^8lF}WO<P|0s+JKW`r1go2in#ft<MBg$(f8}aTFYAbq~Gj|4Q;ijLA4fER!W&(
z)5OUKt}PQaHM780t;>JK$bXqcQNh_iieJWn6*%VD=rrHpa6iZG-ntpdplCImLO?~#
z=YPC3yXsS0(k#f%H+}S>Px`IED?Vg^N?9F<<+l0XL`qf~U5{_{hlQz#>zZ>xmmEDh
z_Eqf0-n@<ee%agprmP`3%bQ=64+et;R}UWH#ekg}7lYWOiF!^?tH!>*SB+E76nj{E
z;h!$(dz+YSRLHlXB8L1Qxrq5wIyXOh!$Jd`L#}IMKY{JHee!g_6KmE7=~z5zdm1|9
z1hU|kR#v{J>u+O3|ET;E4AX0H(7XNZQaVjeMn+b3^7m7l_vLY^lXV8~8FKu1mFrCe
zum+LaL$UOG1zLtImBq&JX#qZEsDR^f2DaV7fsxk*41i#sj;*&Zc^f$xET@bEy;$=I
zIx0k4Gn98=$wt(qgl4bE&GO7FmC`M%Qv{qALm=dWrq_SsnV#R=ZHD4MpFVI!50V@-
zI1@d+nJ55CeFP%sMSSMQh}pE3ug1E9fn!${X7I4RcyeuSq@ciq%6<ru(tu4@)Cay2
z5O^-;QrFx}23lA=YV|m=ad2qf+PD#`yaGgnX|RTlt;Z@tPfrgiXW5aHo$X_bex58G
zjE#A7ea4yPcYNa@>~8pJz93C7l?FV_&OX|9t|l+P_r3XJC?1*p*ufpi<$ROPM^#k<
zko{a$bzxzlmix>L|0nMczf!TSMyUmTUeo5Qm^kH)=gb~(X7E~dkI@!bSe^K;(Za_Z
z8kbxf4i7(ae(#6Y3TN~H$}ur{G((8}CH)pqom5&@_8kz;HnG)O&hK*zGneZdJ&H*j
z6k_(fUuvz$&RZnpgZ_AmSPc#Wumq%zJy()!mJdP(%0*|7q0il4XJ{Gt=~R{}0ksJ-
zzuWLdtht~7M|EL*kxJY309%5awjY4LAm|FIZ(NLjM(FhYxCNl*mC*##$}mM+6<E;(
z%&z*C?p}X@!AO@LiU3n1-Kj<O@>90g@y&J;37oq?gIDJzJKLS@X73HD!7KBzoHh)+
zgoFfSiB+*L7r3|=7r0C++3rFHlZ8svi&Pd?qngtiin%F?iI^b3^02ja{IT<h;eNct
zVr<Wo8i=i}?*mvK8>N-sbE|SXOsj)KLPF;3bql*sCh5kIz<{R!%|q<($M^KeFsYyl
zq5ntM#$eBujp#wma+zN>)=>+(AD+g(03H-x(b*XT(4>OwKDqV8?{vlc?Cc|O!tY#q
z(#r!-cY$TkuE<d_Ubl(-4o8wU<+m(U!d_Fr-VDK~vgILr8x7@m7}%l>!r<d??2ib9
z+_sB9e&}D5^z|a$+S%6B(jt^fs?`6*{ID2=|FQ`vEpq(9LQkJxP!PpULPcDFK+GP%
zVAH16+T}BaNtT()SLfo?+58p*ztoEyZy%1%I9u;Ke!f{arcxy$mYHw%Zd9&peaiAC
zS@OFB_LfS9klU8FDuDh~=%3co|8uXdvh1}PH8yM>eLX(GovM`Pje;bpq%^c8AKx28
zm7X4-#~d+v)QQYb78OVXQQ+>C&5MORGp!Z9?|9&=uXh5dB^(5nUpo$^NR%t&LW#-d
z0rZh;OK%iee0K6;W7So_;{)Dv(S6ru1fujU&hxCexMu)-)wwB6PnS_8<NeoUfe-iB
zr&Z4J<DNGsezWaH?ZbMFni`tX6ugW;W7roj9<)_ey}euK?K=axOqQBh;u)i<M0Fv-
z1YMy~6ud&5jij{Qd#-?yg)9M>i-wNJQ@`TfgbXC2FlmhKxuDXLQ<wcVn$CeV(lRpq
z{Cq43p^vxcL-6zIgW1`c*%%5@Ayyuq7wkv<v3Y!a^$Xjt+6=`#M(m3QQ?ruX=NZ}~
z!T49VKDo>*J`cE!%RZAC^R?s@>0G_S?#Boxd%(<fme%%kcdu*%f-X~2*06locEgcy
zXJ_Z_#U8K4z!s$R;;cXsiAIoxg;SuhuFU=}I@2rjI4*L>yKTim*dr++0cUqroR$L*
zC=0y)rpS?HWT5_W*62~_AomlX2N@G=*<3(tf4so708!RIWd#;8m@`~_53F+p3^e(y
z``6WG;+}Wq-p4;E0uM$0eI`5mNjLGWeTt+3<ArYS4^}pvT{YTx07fSjhm~B|uqi)E
zz_6(W{L_-7L>Q7a21yBm+_|XGcW(BaP>LBSNgy*zcn|*?P`$kFc^ccEn2=;?Wtjv^
zI5_u0ADda>*mF&j&*J|Q6%#qR=h_!dic7_#J?RYaHy<1vOscCP(Xg`a|MWgV3Lq}k
z6bJORirC$fx6`9u<t&gsVFoOyZp%qccDffYm<u?H6l(=0zuUhNsK>hZI|`&~#ZVv$
zlVid4<TVDx(PKi>hZ#?WEyE(CqQWCs*;&FP!_m+aR2?LHEo((RSA78s2k1VMB=g+=
zJ{gdt+bLj!C|&O#R3@_<9XktI4QJ4XZ*0bh+#h%10|d*rdpp^yzO#XQ>V-VUP%~8`
zP{*EgSnf4Y7MV+r)G@R-$skV`Y}<ls28Zyyze!L-SAqlsr;s@pdHe1D!RqQwXo-5^
z{Y?eh&x%WA3u&-?To`wQ_De95MK@q99uy=4=Je*5NRsx)Z9S*&w-LGh&~H82{*0ys
zkf9X*VQVgQR`pnm;P+qkutEO#<3#*$wAM*laA(N7^vmN_i~x>I@m0%Ov~FuhN5fV>
zUvtmv9mQlMz<mM4V&%hPIX5>q%H5T?%Q@7dPRre0*2_y<dv3;IF+D9U1fK#hh!w~H
zNW#r#rpM!-5n%zR<;z2CPLYelk7zeHs<E-bkn;Dkd3#eOlY{{9ib%Xlb<CUx?H()3
z&Z8G1b<^Cu+_(coiT;TN+-o}z?|(<5&7VE6(3y$$e1`VZv>NAd)#)lr6xf$|xR`=~
z0SkFfN<i=#NX6$1`e0|dn!??LGPjlAK~Ux6kY{t572;e05_UHuUpJuka=3jrH}tu0
z+4tN)wS`Kj><c6Rhd)Kx!x>`Bn;)1M7~iG7`UA+y>Zg;S;^N||t*wFmeGgI&ctixb
zfIAMYIpA-7;I8IRCpOD}1}h>&Q9d1FRJT<a*snkMu~5Y=%=Yo(_JSm`K&!G0=ohqi
zaZ9c81BlQ=dU7}WxO;(Z$IVS(Rwj=J`dI)Gu0Vrxf2%{ZY-^AIdBDJX-;0BeBDD(`
zi4AoP(Uja9sia1SlSL{nYIGJjW=k_GewX$)C)=YGJl1RF9*^t5IE&t;irAliB`($S
zzwC+YKMkWr!MOGL5fqANB;s)#@Z;gp<)p22wk(t9L!4oeldbK7$Eoq^O554lU#^^Q
zZ$kdr4?urEQODYO9MESh{IGIZlVQ=-jSoNq!TfSp)c$nsj@s`U&^C_E>$jr7`7%9i
z#N(eeZasC5p-N<-Q&CYN_TleV#j-b~Gmg2wv2k{0X33}P;^xyQEnsQ4%k@HWD6dZh
zR>}EHyAv=84IBkjVWrc^e&r};Z~{P2ig^Ki4ZP}=$<nGg;KJEG80<(-yBJ|BX}AK|
zPleAmTwCZmJ0(BbBEQ$y_i6YpBF=eo9lj~e007UGlkIknmpA*Ok7kQT*(%$kxqlq*
zm%`ECtageSIV~`Un`Q^DfI6UhKWyuVEwS<O&EU@fa1eMV?Dmr7aI$qR^J*1<SvCu{
z0pMr=t^Vm#9J8uI3^B1xaOj=SkFYSgO#1L#8mvGXtR5?c70;ccZ$apznY`&I|A}Lr
zsdw;|o&iN92s>K<2;HF64V^r=Xk2v}T%~^M>xy~IM2d`zdN_N2f($Aegz4$+{PAkd
zU%T+4C`E`+<AYvPMz`F09W6NivuvMySC%p|?!SKr4iYsjqt%6(nW?Em_hzfnj89v0
z)%c{GhAlpyEM<F*o?JbEKX0y9uV#c#M9v%E;-Ux94K_Cm#)w@@m`VkX?%Wx#=WZui
zhIAZUY+nrAOa`I}Wh#H%9){j6fByvd9)P1&rd&ygwtgkBO8Jk*JT9(ua&BE-R$QJ~
z&{b9aH0jXZ7dSRH=6vu@Kt@(}YG%55$q{62=Tzxr{ndgDq`SBPAclR!jC}MDQ&eBH
zYc~KQCBh@px#!xle0*W#<aska`*?X8wAlx5-i=cvz28$gX}>6(H$?))^wm25$qfpP
zF%5pUv02f6YYXZh9i@0>+>skYB7VPy!WjQ+&z0lxd{Vtgr4(Vylge?o+!IHyoXzul
zp48}m)9CReiNdMr5>e{dbi9C1>VMx;V*&jpiGp#?{?fI183<+QGPLSfEVKw6wbTRc
zFe;+eTC7%ARKy-|Oy~#ymJ2LHNk}gLmR17vPKy2>A3DVSEM;XY4-YGUtN>~bK+r-9
z9FC3*vrn2yjU27*HDGS{*B{<s;QtyK_<o#Ly6XEB1Sk|rBsjI;2ENBq$+U<R^Q%{`
zmuRH+b4@mb4M)ISLlDLP45Y0Y7|5+q^58UZ+@w1-tp~-3EwuPzki0kXdo=LB4(hR$
zgbvo+R|>2?WB4;e;Y2BFOHXTlbX)1zeh_o={pk_VuHF__CP+ZHC`46`1SGgK@SfE0
z)2E?+)dfa2q|MPE+Af7#IL}bCXVWth&illd$jF~{LMLZfC)I&o0XtcMUv`#CnnfxT
zivVzOs?Apywhj*LLZAMQ`nQo{H<i~r+}4#`-QTFxySV`=QHexYA~vb7G-j%>75}Q$
zzhj&`MIccCW71xS^F%hxxSyP~(Z@8WiwP7sq*3V_3yU4i1*&Mk(0UgZ7J8#8Jo=6r
zOA)v1MF+O=X32}bTf5`eO-%_~TWdu?j@N3C4J4_rWUsIP5;QeEo6XKSIx>KTkBu!h
zhbXAO*sV4LL=mtwfQ@>Adtp;jLa@G043JJv^Z8<Xrz;f>Ab{6?Sif_d^6Ju3TynY{
z*KQ_<7SMIGb(xx)Br7Y46^z{5R9;?Q*f6u_lKQUj`ue(R?0xwZFhRh2kI02a^#(UJ
zot~a@^i&H|0!<yLD+Tx&83kFwxo0L8ytb9(Z53PqirM!iNVKp0Hh_jN<{c0komfJ`
zXG4r<^MC)=O(g*OA#OsgwJSC?%duV;0FBkvy}CMD)T*4Eo}SeLn)a0?&85u!jfhCu
zwa!+la4J4Y%%n1{CC(O{92<LWy#^Y-gsbVQ>*=YhD>9EGv`Q=d+izwjIe%2y?!^tA
z<0#k|`1-oJ)hk#lxoUXnl7spq)b#ZaonLQmn5xIc!(i;f-VG(qWM-746u@)W&@wVI
zG>lD6B_N<S1b!7}kQtjr4ZPP^n*d&oRbvMiNtvPtm!4Ag4H<@QB8Deuq=v6NMh=A?
zTlqYx3JV*6*NlCG^xL;E4UOJj>AvpngiO)Ju{kj4ABb{!VJ^bL!UFI=kV&3B+t}EA
z7MKjuTU;0z7%-P%=^ve4;3(4KOrO@()6#Np_)fz)YYWsgDhvz&wkk;5UP(#KG?x*D
zcB{YIOh_KMXd*+DHNxfel%UOUw#dV&oCuJ(hr3GvD&pSy0BFSGV&?Kvki?reZyXFV
zRgx~eeD&?^T{ULUh9Oer4h}$vKF3B3?AIKO{H&}s`9P&s`MZNQ1VUC;+T6mDnw@px
z;9@>C6@ehh76ckk5)zY<&DH#~mouKwNM34>O-$tKw1%b82GdyYgjrv5rm4y%6Ix$$
z{u86O(`=^~kF~rw5_A_s*~fUt?G0bqd^b$yu_H`{@z>AWbpZM(W8|>Ra01}lfe@_)
zn`W6#Z9`Snm065P?p5Wzk9XPg$AOhb|ED&5vGb93BNaJ0F#WZiI>iqg&ZR4bZ;Ize
z-?je99qb680%;I&iY4+>pAc(ha-rwKr7TVm*C94DB_MSADcrT`Q^#wFVr1^}tf8y{
z<s=#g-qQFZ?vHQ?RxvDrr@a<Vt(?^(T5$Oe8AYN>1pYZmQNrcOW-Sc~{D_L;HX$Q3
z{#{dI=Y<!_dOeY?-GOF>Zf0ugCm>2?gGbz&K<Y7ApvazCs_ow#$R<J~k<9#Xduj04
zvy;{svt|@{+=J;@vgUq5Cy_ien}z-t*YP1b1l@Q!4%ZRPo}#JxvX~qwd;UywtykN{
zhJGC978B@pLi`h#+*v*l6u78NnA11)pA3l~QIn;c*o*VJxd~sFaL6;SG)KB%WOU1)
z)qy8hO<9wh_ZR7m_0ShjK226XT02(hRIZAC&Kf9Ou~&N$*>s<p7?m4NGyJCRk<F}M
za$?asoeTgO<f3M*`9^xKwh^sn$;Fh%fW`z~?z;V|Q0(VOTrD74m3i8uF6=85*K%8Z
z$@*Wf8adnce&+S_a=KBJz~uM;P2fBQ-E)@dxMiKwov)sZ8N+QcX@l!<>5Kc?q{PX<
zw34@EXPZ7+O;Ke3`I)EJJ8hOdP-E3NdV&|h0jjx(2!+Si9yEG6S@~{gSZ*<qyijb3
zn9hTZ7Hf)8<{L2Ybm^QO&|KVz`hQs?Kbef#G-5Lvxm?rAmn<d4b{~I9kEPNPPVlIk
zMdhen`<3EAO;pZOMP&-2@JP}Z1-kY{d=U!SOGRAsSm#9(AA!>QiSWRUKak++!-hs!
zCQ?8)$J_s<(awyVA8j?^pP9Me{ysKnjnSI70C4fD$R^5^nF-beL|Ai9q)@KE2UW!8
zaGqVyV$nBXg68$phRo1(U+7ShtGAn({P?<hKSg}H`J{~%i%ENU&URcBx+9N5s<;E#
zs{?GZfX0xvQy(zOiv{PVC!gBR!??<Fmd1UaLQKac?^NAGkJ2dmzZ{^SMMfnsUAd_e
z2bs6{lq@#A>%V;eepEAix#refGJ?Y@gKVmih-raiA_+l7;vNVf=qXYw<CRP6d5$8P
zfQkc->^Cr4S*xetib)q?m8ope8_pG!e4b4IdAlIJq(%t|GY~ATN%o8ZlQ;L82su}o
z2!af}0Sq_=<l=~!_b>O*5Cg0-+7PZhX;}DnG&z@40O&^lXgCVDyk`C&K1xnPD2U?~
z3Fya;7sbCHGq9F7HiF`OY`q{LHM{yArg|{l7fmUa>*T^rhZO`Kn+Xal-QQY&=u;p+
ztl^+%EX^^>KD>tHRqX91O}CC}yM!=#4MuCd@+_gHbs7uvOXc6PwsB0Zrh)X#uV^d!
zphgmWsLn;=l|Vk5A%4D4eWFqOGPo!|MR&k1F-(=zAZ5ny{Gi@$BqdZ|<dbpWm#n4R
z`F-Bk9;XS|=wZT|70U)D)IvNJm;K{H8A5(8;?33vD>a%iv!z_V=2DtZKhgNT|BN`?
z+4`Wfl`gb2D3K;5W;(beP@#f)cm2yy|8K9<e(<x^1cA+ZjvSrr)ZN1WRMRqk9^gR&
zKngjN@rXQcffIJkH*q|*xLJjWuGWT|{*>yVNdgo}3EZOSiImg1rn#Arw253o`I2y(
ztT#qS%t>fSe94Z6x<e3T1!5TPuWXl_xmQ-d_ox=}>r*z>3A<ujzYTmduHEK=n7~n1
zPzXAq9&=D+5}5_(t*?tY*in&q$>v&llcm^EQ38=!+xvebHbcu|&1&q|O-#yhhaHLH
z5~xiZr1yXJXqEm~j5CaAcPcH>f*~@D#$$?5vnM)yG}V|)Vk^6SN_x|^s_MKNDZPls
zO6}(M!ou%A6K#m0v>K#9nN#nYoYTc6F5A9>hD>b1u3-??(jp!VbNv_EmsFEyHXOpL
z8oEXCuG$y%Gl{dF?DHtMQ4|Y{Gw!En40?9I8nb+{L11R$4eYl#?_#D*dYPr8TdkXV
zXiR^qx9mN@`g|N5UX}U#W#tvr7rqM{Im&!)BSp->H1DsF^1nRy{rx}k0Rl=n30}k~
zKnp+}Ac%#Wgjmez&Iev~eK_u&kJvalm4#`KW9957_D?9NDxZ)j=Iys!!#*gN?8Q3f
zUifced<}(=s(iSiyzFm#@A*HxtTGaqf99w(oG|&)tL!~kQB#r@8?i7z0mBWDc*9&)
zV(Ez$Z69YVi}Ymqsc$^=bjH%L7GJmkjKSHbw%l$iWS9T0ZM*U*CwqqqY5~n2E=eTX
zr*w*RQLH#=0;JBs05qh}mZWk>Cc#L|-*5oT!|`j?6z-5$Y(MY}LP{c3RDnup*q={r
zhLyQgW(A@rr%y#P`*nrEASg{Y=o|I@4S^K1MId;jaAKK4;5mm=K_F`I`(BBU+;aqb
z8C10YCyc}{z%~VcM$qY5ODicsU1q2kYIo#p+5rE(ZbnN3=Iu5Ei9~C)8=Yx}zSnvq
zQ?FQ+#!eC+tyXxm{6<pV=BaC^B5;bb7ge<?I7C6r+f1=Eau=1ZR71TG6o4eV=H851
z(7ov#Yy2BbD*;C8M2@3+H=P*uRfEfU==x9BM>G0E4`h5$KuRuiz*lEKev<zV?IX4G
z4_y>G8Xi8G9inr`niF9?4@)iec|&-~2H^`HS(VI;%p?t6kMEv+`)Mf1e_DJR<}&K)
znBy0em}#+S7Ybj>hO@Fs^_ge^UMghobzZWnLRbVdZ6NJS+869)+lPNd2ianbSz9e4
zhC7%i4{&8`$!3!rb#)rmL3D#~<3t{I_Tf@tQ~2j%-g&9v{OzruQS~y0-nDv+ngh%h
zvhm~QJl}33mMIS4GYR<`RHj?WrLg~r|0M5DsU;ei76JL_voa^YZlz3|EKv8!oOL(%
zMSPspSMoSP=L~CM_nNwKnf$8Y$7Zy)IH?pZ0{G17DcE%Sg)t5$x}vs5uz3QiF-|zT
zo?MtQcUT7$Mb)Y1OK^m2Z1E6LBDX!9j!I-&sl0@xp(S^c9fuaN_I2)ir=KBnHLtpo
zizTA@Ltm_Asbr24m+l)nI#)(aB-04iV5W2OS92eCmEt><SlTx2nFha;pr~0`hW{EF
zPX1QcGx+iwi72DC)onp((*H!s743iSij-U*Uhxz15xwzY<4T?e3=>5{8zO^*!qp2_
zt*>XM4~wG#!ORnF{lk&fi4!5{VFaBZT6UH~s=dhS0EijQE)HW*aP?a0%EexU@6j!s
zg)}<C0*jDdwHpi+iEz<lra)v=B@?7oB@i!56F$3xl4(r4p$x(ALm)8XY!ybh&1g7+
zCzrpmE}BYw9SElbDK4T>z4HIa{Z60h{|EYt_K)r}g9CN)NVE>=K7A{f9Szsimwg{!
zKZQSio)^qRNNEfU(15N(v0fmQG@gc|*Sj=&iu(OL2p`*>`?LvzKbql~ymYme?qAmR
zy)|dYi>Xq`uii4xQ;Zr>jv``)A%)S!N0$)<yxo)2gPF^qOMJ#PfEU+Du>g0KWhr=N
z>|TsuRfQ2l0qlvY{}06f^!Mx4s3)Z1fl7Y2hra<rpAfG-cy|e9V(=bXIzT4x^-3d@
zDgPF;5-Y9$YD3542qR@-czlU$bB&LCEGOtmi-%?rB4h!-_vbmPJkhZH-_|?h{VV=W
z=fRZ*75+Yx{lo6m{3pCd6^lUgDjDfuIi+v+N=E<v?v6iNh0X&rSk^9>?-e<%F&rWT
z0~_hx)^|bgelSiw$t0YG808-><Q_lSXFfsvmM(9Nj&J@IOZ4$*vb@Oa2tz<%d)EiT
zbC5?7>(++4gMcsVF+6(HYRC5VbHoZZYqyJU{37KNCY)mK+Hw+1;V5*ztGiE`P;o~B
zKbDrkC&Cg@@v5l6aW5O1`jcsh!N&h%=_<pb`o8X+p@tq11f(UTQ&J=a1*DXgZX~6o
zgdqe31VjWS1Vmc8rG}7{?jA&?yZb%<-ap@X7-sI=d(J+4uf5jVR~P=riz6&D&h^+&
z&bJHLYSo&1FHMCPo?u-l{6}*Muxx(bY^W*FTq$rX`ESUje;a%8HT#ro&%$RC5;*e#
z?>v38;@9hsy~no&7%f1H@ve8n{5C_9;P~X|Z&%4o%g&kOt^>Uh&MVah6BlFSS4lT7
z-bniGq=FKts;X$SSzTp4yM;6GWl(+l<>{)Be=udyHPAs<7x&-km5F3c7zQ9y`T*Xw
zQ<eYIgoRW?oCQOy=9~$ce~~MICcsa|F?Aau-?h2BA>-=WTkUjy#AxUE91iK|^!9%)
z$}iHPP)sQ#lc!L`zv!k0;zHz?f`Tu3bIb128<}6q-L{)9!Kn6WH5Fjf&~n2iorh7%
z!y8~Aw4zSa)s_#PjE&9uhu&os;9}?Hed8+0i=%w~L<KSA25RKQKMLWockkY{3(gM(
zng`%t^n>&(5}CpBv49KwnkIE9+yM&J{E^(5=@}gz&$?NFDz*VVmGbi45U#HdQ`QDe
z>jQzOD@z)c0){chzn-X2DuV5$`k>e2x+P?DbMv1@quGK|ZJN)+C5q3$?j`&Uc9a}q
zb=?0xHlm-635)pwTPX5N-t(kiC;rkv<gh*Mx%(#xuk{}r3t$D=*4E|zeCu13<QaaR
z_MdQN#tg4Paaw)krKkhLFlyYt9IY52m$x#|l_VU`9&H)>VlBt%<ZLhf^a=1Ss`3?g
z-7!<Jw3H1fBB;EpQ<bG&iN(N?4WNlT>Yq2_6=Smrx59(u52;Po$%AYNwmMpfu_1<%
zm%ze0rN()#)_#Ah(GLLY0v*QndDHn(xGz7C1E>(N91bQ0c}HS0VS|dSMYr&oBZsRr
zr&$aV@tHTh&aL%~f%}^rl$T$0-*@9<qKjq<d7#Mi%LuzH*>i%WBX9Losa21<;B%?$
z(NzxynHR0=hd4^kW&&O`zR_i}V>oWB!^HibT!DN+FXb^sUp$=aWAuobVOsTK20-=D
z1Hc%?JL(`hq!MZ%m=km-MiY|sy2`&vywthmrLC2oQ1-ob^>5cnkOBrBU<)Nbad+Q;
zI&eQQr}C~8&tr;E!7Qaq=PM~K3RC~XDnQn{be@-jm_qGxC9xkSNTw%HmQD`Y&=S9W
zYszD+Yvg7FwC$w8!ZDi)EaT%t%mdKqacR1YIj9^3{v9O~>-(oy{u9PNK6TM$7&;ih
z$c|-<?8@{(&(SX_xc2_%AL#*-py|1?Vke)^fk09S>i467?0oCaEBo63rN6E}ZkjL&
z;JnNF0I6Lu<#_j2JwkzV(}X!F*QUat1dJPepe(6p6^Oz34w9G6Y%=l~dbEj5gocJb
zia+2j8n+xb?isdR{XW`okPi14VB5(>QmAsr=$fRAJ+Csviv33_3ut_?G-RoG?S0^K
zUu7nHE!cs*HsHI=W!v1#z@7e?OlD@tOz0D<^2WSU%VL#Gy>`?Wj(Ao|dYRp;*4Hjq
z>!uJ>@7_6MfX8k_-H?{n+`UW=f}mjs{G0UrzKb6wq>T^E!D?c!ZN;)bqLv<n1*a(2
zuM8`J1)OC3>hPmh7I2%I*|dRx&FSS}OGp*e(&{kmRrdy2KIQm@gIpf|Nl2wWf+A0e
zxpuLBOrT@(c@?1WLE*7<|14b<BqV|kU7IHjMIx_!p`B)v29t&Bxt9yMQ8(Xw$@`$L
z+6**|*IUhjr_1ShR$C^;?qif3IF^Qd#$hQ(UTbAf(`e(<QWRF6Y%rZx{qoqp1C`ot
z&;Jr;^O2B1XQ;m7yL9tWRo%xro~K1-^foUf@c)ZW{j>lxVECeDD(W=l3%WR@^FG{M
zLIp)2+dBgO5~MeIxwyIA>y01AGSqJ-rYtS}I@$uJ9GzZT34n2t{23T9j9>kUq|DFf
z1d46$NJ-EW-`MyTV+9ic))7&8zt_0=N=jT1kI4YJ<kj!VA<&fj)R%)!kYwRKY-+x$
zVv-?+uKWk?yEGop3t#)gnJfLaKLfVRv&VlW+-*94wDVl7WVJnvO;-DRUB7(=`fZtI
zbyLglX>YBiJTnAj8geo+XVDbkOS6;gxgJY*A5cvs{QmwdEgd|*$ww#brtJ$<q;#OQ
z-`@S6%GBds?;pcz3q>DA>-5(7r+3uIvE@>L>)WV*solHYrK@G(frI{mbV;9bj>!Ku
z$1|^-%1S1&m#rr+eA5^#8~g_THFT*x&g`G&e9g_paX=(I;T1_^1&7Kv<L0L7;wC13
zm$l!@$=$ku)L9_n0Lx&KDQRj7So_@#R3fab?T%#-`kau;#@Z&0Phw<xc$oX1-(Dzw
za9}Y$M7^Z&ki=!aT!+nSBTozK>=;mV^omW4ji0_xO!jR#Sd~mGo^u8Y*r*meM>{)5
zXXmYnl9E1)xj+nRWb>Aw<75U53ov8i`IB<9b5bRZH(VugN$K)NR!QikH$3VdlF&-J
zqM?$Bnpev)pnuj~9{>LReTR<6@?C&x=P#XJ5I<rY$-;8`uaQ8nO~vg{z&vgA-82ko
z$q-u!ZvI6WT<Uds2D)K|k!LG1SAtf9nC=^QK$itHBslmumDN=m%sPmors!sAk2hv&
zT&}OY>hDW%+V^}_2JNJ0H7+kDjDb45of@2AdEhh(TnI2N)+d29WR8tg+<M+l7~=uu
z+h@R=*_f^n6T1D6)B*mHdMUD}XUt)Inm)!{AuO6supz$=D7(`{Q;NRl<P<j*|98*3
z@kkiXz(I8@C3!1wWieAB{PAZ2W_I=-I{~}G8=##zUw@4nGOJx_l>p@};BJB&pQs7w
zZ79L4hfWK14nv*kpttA8=xeu;H}sx8T2I^hG*SofQ2Kiwr3*SGgNYY8SAZb{d_L3f
zzL0-naof@n3<iIz_O`;d-$OD@wdta~xJjCu#eF)V+qZFkX*b}YyAv>2Vxryx&a)}c
zGf|&b0E^d>${5aqW`&N!_`&vs%f)0_&{f<-;e@b;6xq$2Yi@O>{(n9^WW4Ug+isv|
zxEY2V{+>5v_E9{*-%Ix<2;!iLT;q98(qT3py$VqL=~f`*pQ+yF;FEBl+78H_SO-hy
z)yBy#;0qJxXaLy%Uckl4RHRB_pYIN)1uR^E-{N`{^z;;ntdEO`iV@RG)oPe$dbKk^
z`n=;i0LQNZKm4Xu1?A-h8s>|m-8W!6RH{je4<G(R-gR}@I_?;GET+Z}55JVrUwN7U
z%%ORt`L_BO7L*Vz;Mw|ngUQ9*k#5%tq`A4-#(sx73B!QxxiMeEf0xw??2c|_<)D7|
zoUc~vN1KLZNcqC?V!>N#OG>fQen%T;#I!Th)3_vb0yd+Mph~~v&wmpWLCZh#i@wLj
z$<UWCs(%L-{w?^`y|ac~b*h0zS9J^jhVk&4&B-7nXn7VF6ntMR?=3?$8`bSO`uI4P
zq!QZnBauo7dTHN-!V<C2*WuRIRsfCvnJh8#yecd-)Xu5$d0#SUnE~QZ4DJ1b%zXR(
zL|%P#tn}3h;K?}Zt^@MTlP6Eci>{ydZy11;Mkna+t@4B%+K}-s-Ecg8U15U{x0w||
zfT)^k>gs^rPh834z;zt>{0c(eA}6P!iV`FtC1nW>(^v4dwoQrdc>Aon;bg6FXlTeQ
ze5u<uz3^KBm{-r=w6_KhG0tvIct@<v>2L6{5DFPg21gxKRszChw#K%6pYOxo!iI9U
zxe40JH0ou?bZwDRmN%LOuRKkvEq)Z1G{2)x9~_;%=*o(fpo_`tdZhAc%BsI_)w)`L
zJn-=FhK7u1PUTNWQ9tX29NuRI1<xT&Rp8}$RJQ8K$df2_y1=a;RGitSPLn57@oYpW
zWV!3m!}Fu<hlsiBu7&>8f7|@RVzvC3Dj-ie1}Q{M1hyz})8Z556J(Y{2QwjnnK3AP
z(5=D)&85zBdQhq3>E6V=H;a%EaIcX*oORa`5gD9Hg0d(euEGLf|F;A-SxjVvel-~Q
zHE=&SUndZZjjy2mW1gAm05};Rz)W<>H0PRg@azEl8iod(wv)pSwKw?qfQioEu(#HP
zg(t}sj)e5D$Mmkf_v}9)3x5<8e4TR+{9V@RwK+vgMO$;VP7L1mMQB{_X29lx%f@uo
z9YJOW=(G3QDhN32Y;2s7X9xQOdfK|=@}{Q~&0gD6DG3RW@O@6onzv<KnK(I>k9@AL
zem@0y*U}*v#Qo{<--w7Ev3Z}DW62_jOzYmH<{H<`ZmY){YR{V7{+u)NVWXDrs7vj1
zv21$P_dUPw^DBX;H%Lbg7fDG8h@Kpg%J^>pVS^-mzkB)fweLvI$CW%lwY|Ty!(viG
z73`mvkeGNobjf0Ay!iU;P;4F>MVwN@V^ICLaHjE`l*j1co%$VvB2h&hOA8CYfX0T=
zzU^S?jQQ{(?QL|#iGO!_lIb}Wl*+{yu)(M?nb!aDV_wqrVaX*PsYF_TlF2L2^Zv9q
z_`8ByLjz4azra0Ikatvi|3(w=m8fq}D$>kU`nW4vv&pZ#tyu_Iz9jv2Gm7<1IZyrU
z7U;U|lnR8HTpth)Fp7I~fShx9RiI<)6AiN{t^CSvpmf!%<^F?%Q9x;FJUeS{+0KIq
zy-(M4dK394wl0AD0IZ{3-&cXJFhO9~wRg0CGpYXzh&#vK<po^)jYoz$Y9i1ieGG7+
zR?_hlfdIXwVmt7JIs03$MV3Zl%Clr09g!3@FmOFB^2^qI1s)`A`hDYdk}2?_GATLE
ze8_mu|98Z=OS;dMVxzjPz>2k^O|(|eH{JFAxq8OHJ$oScRvuO@X*&ATqqAyn4|cTw
zYE@u&x&N<&)j+AkgW|b*&v-s>t?aLr2cPj6?ChSG8#qa)Kh}mL?B~@75|dmO>TW=(
zd=sGEY^bZ7`0?Y(DwQdCCcwNRL=lkJS8c(g?S7-o$Y*k~N~QXk{r!+x2A6U~l!lrz
z{^+xaKAXGLLFHfD+e1&hLkH^_{ddOex5HkCiHeCWT<^5ms;FXJb~*|*?jGH%Ki<MY
z0SBj=d7qN}vivXQdqK_j4HqT>OV4ll@_4~}-wC_aXMKDiiD$@hlZ0MkZ|j^9LSKd8
zF~0i6h(}5<N_}9sl^_UBHdxOrUHk8iu8uHQ$K{MC=6?3O8eD9nv0v@gEAm~RJBG|A
zKF@)uM+%C;F9%0{+kA!>g5YaPSGXTLLnps0G?Ge;K79NLhLM2NIAX_@2l0i2?arO>
zurN^O?3LZQssk@<G;tA3X*Md`>;1zG2=rqh6_fHf5s;72>>1<wSGEjb{)rrt>m$q+
z!e=kTWq6*I{R&ZxIy>NO01OkL(BMxM@#{M)0Y0sw4u2m*-sg?SIU1kbR=4?ZQH90L
zi<rf>_jevgL`PGLc|A5!CxK>POfZ6T@BK)jUg_A|f`Zx#x!#p`EO>{E$XmDI0rgaJ
z$PJQCKpP1kv)DcJH#avAJY8a(nb|DVEvYl>IPjq|K|mumegD`t3Ci!s0}gdeN>Uw)
z8_1ytT94J#4P4K+0q<$fT#QBy5Q=ri_?s^Fe%PjW_jc0=dGFjOmC}D==zCsNBYpZ)
z7?A-Em+#-t7V)-bzQ6Kwe>$>6Dq|&-vSeXtdVWl+XZoTJxKIv9?CdP`rPrK{3=}v0
z+5?4F&CJsNsnT2OVgp6M$CU<DHynW_a9@gRH})i`ep*Fe2DAi&2+@~zU-i7F_=EP0
zVui)nbHDn_H=PVs21OybB>FqR=ig__8gQ?VYmEViy|UYC8uUqnLhuxopXh*c>3Ni2
znV=vLrhFFg;(;8e%l{mF5>~(^9gj{n;+w#WqKc)FSOWr=VIji`=U2O*;*aP3S)`==
zTWen=nZ7z)%<2TJlH08;K-nS%NTG`g;l&2cO{NR2@7ltT*Jo@eKHvXC`9T4%Qz`Ue
z^esXEoea5Ge#i6GmbT97{os*=6Eiey6_ykh6av<T>8n2<3~zcK9-foZrAm7in7DKe
z^wG+I3)9vCsv^%w!K118Y(c>x(uF`q=)r?fMrmK|3cYsfLax<?8kgp#OG87$;<_~z
zXtLaCrX?i&v)@_ww`d|j8}I(0=QP>ibC$pf<A1)-|NT*6=t=ElVDq6U1gx^_Qq|SS
z3&$)frhrM$a)0vS(4BN6pVjQ$-CYQCcv>zb%>P+TqhtbB%CA?9jp9!#LEz(`?i&+A
z8D(WYb9$!6FAsGV!Dys#QrdgIccE|kjb|sjH}s5OOid1DrKBV~H!b2qan@6ILa)QZ
z#z)7C4X(#{#byOO_gHyf_DlxfljPANrI&C6Y<k+_Mz52>OmM&@bC<wTS)Gwbn+qjX
zin_jk3Hh6io;{<YqEh7)p;4PK_8be3l4-gef2Ki|{?2-VZGYKm>U$N4QTwqsQyzD;
zVBua|70dL05-HTv)%CDSP#?CpWR>Jn$sK{oKK3~1T5PjbPiLTR2r_3wfCH$UXZ_GO
z>c{NpsAJ7N5J9c>zT!`t)h!3%$y{yhM;}CMB=Mw)2V4+Om}DtBK6e(SCR%TvFLj^j
zzvohKy_V4J>FEiyCZ}iI{JFU~N9!ZY@0zb0zkiqH0iaX6*Z$$ejAJ!sR_64=J!;H%
z;rddserkGL=`vjv<jX^L?bI%_4RuA0|CX=tEutZ<cP@?R^FU)le)FcJoorwcB|vnW
zY!{k9%9kQ(y*H0_?$U7euN*nVlehOZoNnJ;0#J+3{#!9fR?+$oU<npC?L~sD7Y{W<
zHCuJ^USs=u{o4MykCD+V&PZ;N@%0#3fl)Dx6YGam#^UGQwx25uivTre0Nw$3Fo2=I
z_hX+gGBUEDuw+8TT<8-Zu)@%eqMaS>U}Tgh8QG#CXJzaI-6#n`=EdWhSqsrmKv%Wu
z@nYA3zloaMBI?aspRFHBV0zNDhRpeGu{+DxR~}+eWpxd}8Au>d6j<Gbqd&z9)pWYA
z{@C}7SJ%=}rXVCFpwOv1i{yqdAmOvOx7RarQwD?v$jGakjZo%dCuYW(w<OQbrDnl<
z6Lj$9o5J<T|3S7F>=>X|iV!VBD!$lje*^Y(Q9;2OrcE)h_FRK-A)t5BEx%yRt)5b`
zg<4ERw8*I9Y+a33QR`b#At5pG7#%q<YSGbA)OxI}obQr{*Ib>G{Y|YT#QpBdA#S7e
z2}!ng$;3digfK7LpOWK+!0rnl5IIBuDC+6Sty=`b1N}|x(6}MH1mMv^5jz2h<Q$O+
z!^jlimjD!@)}iFlFH{|(3JO4q7FkdLNchb1T>u)<1`fNFIy!oU@d+P3RhcjS&H0-n
zbG2ZK&j!jxUXj;A>}Rj~YO1QRWE~tFfc>}41QiwVmntYoR%3VifkK{5#q;Zy7_)Fk
zc5ae<tn}38ftWx<C@5A}Q!6tl3XS{y`}a<1X=G0%c;ohV?DyRd5cs5|dSmWeG?j!M
zA3-4}t*t7_S(?PaJUTwV<@Vk8m=C&U$Skk01q`Itwl;8p83BtleSKwRWqH7&GK=QS
zR!>r;P|Rw1gaG7O-!zg;l14oMT*ct=*hE!Nb^P&Cjeo$2h5AP$tnf<XZPzt5l_@n1
zblL=t*bbj*D;sqpzl@HJ{aOBFzXzQ9y{72oIS;+1%E1@_1M(l!-=_yPpFMXI0xtR$
z+1c4?67IM;kB7$Tkn$j#HUQZKHA`%#LxlnC?s+-Mx=JXL8JnYWW;0=Uyt;bjBefP%
zTjwo;bYk5z;R)Ct6RSYe;RZ-L-<M(oJ?e}|k{m8p1VfS0rRupO1%~mga<b8aNxh2r
zFC^30-z&d2p!jiih6`ItHJM6=zHs=?Zq+RK1%gxnka0ig=vY3C{gO~O=iHY;LfAUB
z=cc2x{py7I3wcs6B_$b+>jM}Bu!?Kf-A=Y_Yro@dRW;=|v9Z^V-NOf?ci(sCaj4kX
z=<3_q0d|wF5^gpH=zC!EV5jmyvK}6HPx^R5xD5*LI|;{5tP>LxI@QcHGPrC9&l{>9
za&9#G_DP11EV@Y&`cc_^W&lxxBNFi4FG*!mrLB7a6C9S2Q>?BtmYePez<6M`*Af5q
zDTU%4Wq=JtsTunCD4LtY0JG~0;j{)KK;{OdX>4q4suwtse*G9>@8F`Lp=KSOANjmY
zzsiOZhvyC4^5>Sv6Qz`t6iZ9X5Sc;oG<EqmbBh8gkCT&<XH6tRpTL#?h4dBPQOE-P
zlc1=3N3<WK_u#6>)?5w03_q3SqV|hj^wlLcSTKMcC7CulILV=6Va80){FT>)?1TPK
zFlS&m`y&^#XiA@>kYLC3%#5mvD&xrv3wSci`#&B$>@J_3oRxCIKx)%~Q>R8o;LlUL
zbX;?J-dFS2#9ujmz7fR0@4vsY#!e`3>fpB^@*^z<*A?XDE2SlTT2I901J=Pcya6~1
za9k=s3Hzt|mbm^GD8NocuoV7?PkHaY+YlAdj4AH;YZLWD9x(*i{!S(leWE}&0YWX_
zwY|*Pn8@@NnUl1hZ#9oFFTJlM*IoVQVSg(cqA(1Y(SfU=Ua}E%dA{J$b_mwOB1oA4
zQCr*UcV+(5N)c{ewUU8{h<6XPZs1!!z8rZ0A+g`V0PY*ibg@`Hv*+f{+_isx!1+`f
zlv7b-LjMYV1TkS$Y*gUEVtCeVmhWBPoN7V;V&4#kz?K_iH!-AEy4U_WaB+5u>gTA1
zeZ?2Fw5NQ&Njy?saA*i9bdS96D}|J0W@c6u-Io^ax4JtvI^JFWZDe)B%a6%H4hg@P
z&yg)3u4a5EmP9v7F?ZxcVq(lKL8HR((32CuUH{`&_tOSURP?K#`<#%_6)f8Bz&0#8
zg?H~_VtfT#4jJrkZx;(-fR4UrH~G$1(!{RlX>Yh+x5e5$^=p2_fqX*oV=yib#E+^5
zI+8oX6sj_Y21uqxbv#Jxot9U91;B+k1&7x6b#-*q=w$c?v2D4zuC4}vj_wyDAcS51
zt{4Dl1ssB90R!~cn=3APECyg7pQ;Y_eCe~Mu}p>l^rs=$0{Cy=eppAR@$yqWU>5kJ
zNX^`w71;CfhXwv9R`y*fsmEHQ04p0!py0juq9F~$LC0T?=XG=rJ7xk(3b;Dx!?Equ
z7;n(>Di13h&*$d<g1zl(CZH0_Fl~;NK7DX>8b(YLjEszloG$gLC@6?${h+4}G_>IO
zLj-5k$vs5WNo}F!IXd*UC{`K_ae#WmfahkB!9?I?)yxvjU`dII%i#I}TQ(ck*&z<<
z*DqnMp?4s@fZLsrXg{+C$!aA4xoHX*sp<A35>y31J;D7Y>kGDA?Kx>+*CP$QzFIvb
z34`=krw1GHp1?tH_tO(-P?;Rklt&3}jwqvrA3k{SK;FL<$UVpz7#OJIgE<8L9!muw
z$G_S}lRp<s!AfChxy}v~w5ifZ%7gqYx@<3U?`O0J#KFl6#4LEw?~=s%)6;xTPDY-y
zJfIB#2sIvRa`NMFdCZl8feu@*o40rE#(sC?mpWtohW5&S1%%uqDx=4nO-K0Mc0xeq
zIDb8H9TgKfj@$Hw3#foMrrgvF!vkMYTJl7E5w+Pi*$J<wx>yVfXY@JP?OgD^^i<SR
z<gqgr8^jVhCB|(_c=LYV?;5MHPtt8t)9I7p@T$kc+F01X&U&*1faB-g3TnOotc?M5
z;{h9hEg6LDG>sg;4J=2!iJULBf8T9)OWLE0E$L#bVnDhx*sMbT*^FUl^er$~1wY%A
z=Nw>=S35(NYH!tQ7W{<|z8X|jSNTXWZ2AJQ4M3E8E~HYRBq~r_$7cpoe(4fYh_C*4
ze2JK|@5)f;KYh{*%MPArO-2+C8ci0)$0c7)-%T02#mLwUCQXEfwhys9Jn?VxYBp@8
z2B))U{Tyzi`NoPCf797obp8kuE^BuZ#|&<~u<he!vn@ryG}gFYdZDr!`eLbRzI5?W
zY=Qc&Sw`DpM05n*JsWK^AzRT;JU4p*H9eM5OjJT*%DKjYwhcmWc^GbNLIMtde-0$_
z?VdG=7LMKNy*xWmR#qSHi2*_tQI~}>%U_|pBe{>~{miZjOB$x{iMbqp_XOe@4P|8-
zX~(YV!*w7ztONZomzlb!@vJI{?8@wH#S}>}c%bWwB@B?MXPrq;bSP5#L_yO)L;9Ky
zdj0w}J9~R9wW!Bb<ez^K91!;Dl^9QOb2|*8U_d`swCR*QnNXIPsLN|D|H#21g{L<f
z{B~2#QXAji$zjCpYXZ=hocT*Pn&2TeC+mc{xC*|0<6#k@gr@09z^2Ck>sDv@?3rLk
zg{|?<j%8rr>ez&vyIZy69B4>mFOO<NsL_Okfu@sR6>O?|?(XNu>q(yz&sw=l)ak@*
zI*aE3-gcw&EmreZ5cHFM<SHawTjiKh3bWr`&SPtB!)IFMyZA5)MA4TU)7cykbgfhR
zZdp|Efkp~=cA%jC`Nz#Xa|y{+GBGha42PcH(eT-NO?7?vH$`G<YSYV4&g8R6iHnmH
zaq+Vv+m4QQpp9%gzG}U~I<wBnt(n>6<>duBS8AY=nb~dvg1BfwKAsIHk(4>-fey74
zD661=i#P4}*Y@P(WFTeVGLDnUaB2P-9ldPgZ@;lJRDS!}&qPo)etgWXCWfZg_$0M^
zg!7VgWkSz=LCj~kUB_WU`m9|hoRq%Y?QkvN6+uNsg$N<~rL?}d`&s2LVcQ;VZjr|O
zgZG2Y6B6}wi}kCxB)JMepZs!ymhY2{=~K}h_0N@7Q$lhSbY9CrZQ<7*6T!$7r=G8G
zK(mv}j7P=7xx@tALmiPZz=vK<OMiK6dd<b%qmyJT>iavw*3|#SbOL9zP^j5(D1PLZ
zyEWCgu@0MOtp*j0J{x6vSBJj-j*j}?`pwd>h<w{3bqa-rg<q8q%sbmgzootB)i-^3
z4Fs34OFWRD2@Yw2du8WjPn=4&46+xJq;Z1iGE!;7)TESq0UOjig)3m6J13n3smwr6
z*DVpZ6Huec=vQ{Fx{ZyFf;b-t^rx8>s*O_>eBJ=e#3iN{&j<|cnEc_sEWP_vxTN9A
zSKj}k{7-M^TLwVF{)D8uez9r`WUIh4U}JpqUS(f^b4`8YT)$-fhl%gN1$OZJ3M$~$
zMA7xyA3ak>3AftL&41$h(fkUV$AP<J6CfThEm<CK%4AF-f!1U^@g{Wgye$mmnOzYG
z109ec|5G~JgS*|N|J_mcIzZaM*~vjcZu!Jm!18RHuh{~Px=LnScIR)TBVz~v0vGsy
ztwxsrT8;K_(0sZ1{#1YH1-1ath1R*-V4+M(noq-MrHvZA_s4l(om2FGk{GcNa+<52
zTRQxj^L5Q59uOj!tgNjZ7wX;%dY?3%gA@X*5O!<&zyZ|vjpe`=0caR}>Lln#?5;@;
zf#b(u(=H+P0)UqM>)c)sEZ6@kS7ph%UE?^Xg0HHo`a@q9VeJ0n1Ar74JNi<95}QHN
z>d{m8_le)sbL-7IqCw&covf!{9h{b1-+Q^u9!f+vXgY!&PfqS!dz4%nH#j+|55_^W
zv|b+#Dx~wDT3m*esNpWP<1d92vfaIV08}NN*4%n@61oYWKTA9OjsDuss)l)yr37Yl
z!O@<2rT{}L^_=mF?R@_}%}MkVe27h};cpMO^tpxd)Kmpa7_r~VykAn0ewlr5VoL~a
zU$Y$_bkNW5{TmFh4BYE3zVGL2ZN0e=h&B@tK-IbbeE`(4XhkZMk4VOnY*C+I?LdMM
zyuJ@Ks1KDCohK{bXo2R_Nkl|Mv&>%Co%Fz~!?3qtyC=W&%jy<?)dRHGR*=BjAyt19
z6FWODBrh-jufdCC<VUp5O1OhH0WpEz4Y=9UVQdxM9z&@T?C<RXXd!0g-Ulpd_V)Mw
z_I(0ce3;qKu6MB9HSiQW+8<z{<K#ksM5Y9ki{<y|mO5fU9TuLUBMyCh)$%yJ4K%(%
z3qKhoqzk6kF5Tt)z^#l^g7Xx#l5*Jc`gnj2W80+E?9ZAGL#!>Js5gR2S@DyQkDI0Y
zNK0Ed9x0u7-v_<KghXapn~GE5NMTy%dzi`c5Hvl-{Z|IjDh41;of5Wz&|t}LpEo!2
zJgc(+(x2P6Zv*Y_4T}o3bV(7-8gPURjf(=ow?BBdjk#u-+g!Kr-19s7`H8c;8*-gU
zd&y&3^&Is2*x#3BFa?5W3Bb=kg}QGUMAphx1Cl;`!iT^%=P1dW^)m~!(ze<T4sO1G
zfVq<%Q0=pRQx4e~O_zT>)AZac`qL_n!Kc+#`+T7COeg~gVD8oK$wS7#a`UB**7-*M
zrj^@Hw*8mK^ZQ_KZ#@{4C2GA#Uo(Hpf^f+9^|(^YEp=_}QJ`Us1!|=YeJ!92HGVlS
z?faW!a|r19ZUQf3pLN}k7S{#SD<N0eK&bYthub2{63hsL5e+|is>VL@gQ^cmdg~<q
zso5~ehwFgPf^|H*4-5i;-uY_+F@v}!G8A;141{xD1_m9h&n&;gW7KbY?x}3QTAB&!
z4EcXsfOqC!lW_THO~k2(Ld714ShGlF4t@-?P3uRch?7}LdG1;D=`lk@^iq>|xS>Jr
zd*=Wz*#oZB)LB4Li0_}Z`V{zmcuv?~2`Ig#3z*>*1Av0pd5m#pW_37YZ8H-;f2}%#
zxh<UN9cx-OEpSZ*)25_d2TVbpT+q;P5xgqQ_fdi#VppSHuyI*<i9xZx0j>p8WnY${
zxTF;Bh%c;Z=Vc@D07)}7d|oiFn3eTq`*c6ONx$0hQqS~LbPkBjaP&d`Q;?JG=@i~K
z0ir)8Cu3gdfRAJFtlGpyTvz+ItN5PVK3@~qd`42+w{c4WI{_f}CI$vz$>9Hf1STk`
z_Yd?&y?yg0>aBIOwXO9n;*PBk|4h147w)cPhBKUHTb~SIZ!3$ZBPb$INw-Fuf*tP3
z0#Z*Iy1Ndo|Lob!<cp=P+Dos#;6LGnvKJlpFd)8isauMfFb&{jW@cuZiCsaj-BD4i
zKUsVe*h%3_lw-hX&$Y1b(o_W)9%9#r(=U^9Rg;@*@BQ6olRZZBbouT~%)Sm_N)}*a
zV~dsE9l&`xJ6}_($@Tz!@-Ru@M86Kxj<sxX_|bAFUvr^xKG^crjfMMFE(E8WoSGf3
z%enPO8$N$espiin9FpHzB@Nt{iDP*ELOcx&E)<q*+#R36C8l#7Ih?qjFaW|uUN9h)
z@%!=o>})Edo;PS_F@jm;a;mDpMrT3_%l_e*efVQLo1NshjYkZK`G-4EDt)JFt^bS{
zDvNMnq_7~~yUG2y0Cgasz9A3iyLlIn{H>arlUIFpVN-oYBotXda8)5Lq9YK8b7Bk}
z>#0-oS(T^70(c*W#xX@AP(n)DB22Po6Vec1xOF3q=r(oovNJeT%(n65BZQQ&T7r*m
z*(2o<VBnt|vXZ8hy}6(uh-;12MDq<id+>K=0=bHuFh#rmOzP2A>uX@7VOO$(Q?tPE
zNUbnj)<Dv&U4Ny4oVv^Kz0pWvOW?;6(G;Sa&-PD;{shE|g`_CxjG?8Ts7h%1?*#rB
zl>hu5&vNZJg>kk;8&oVs5^&<t#(B8%>G7OLWeK~otU2;tYJ^89g`yT4_GwZVM|P;D
zGC7%ikTlU%k!D)Kj|E|@+xFx~lS%MTpJ)1Bmtja1Xl_U*@ztK&lU)O=2#1NHbnyU3
zxd7>G?RIM9+Pqhbf`)L?<~(=sy6*bqbb5<~mwggi7BM^eWaK;Sh;#=-KnlG0diWIT
zv;1z5g9#W9&bP9Z88$+`vW#TBluwHJ`nDdkEoZ1VdY1zvw48)o@DoY~FoXbDx@_EY
z#UvLNS57$w#ZVxHYUA&H7whO+$VX&Gd){Z0(3jugFUAdQea{M*iEG&tCM=;`k>tRu
z#${_3qd(_P8XXan`5>P)GCBF|7k7!{Y=iYqM$okV>hxy~3Xex(|D^?_C&^>{-2)Xi
zhm8g5iGPII*g!ij=&cx_Olpno_4J&b`N|=mK79&c`hi~cUi>gYU5{U(1IxVweImEs
zCZuZ~+{h?cTV#27=xZDhAbk<doyZWI`xQ(FbfrEBOHDONrfS(viO8X2;O5%%ZfNwQ
zS~>Kcml2l{x!@h8Z?gGuI`yv^B|IH_cI+zx{?^ALuzY@7<%yE-_rHE>A<YQ`en@$s
z=*9|kyHS!3SB|gTw1Oa+rH?|N9)t5Jc>98i#V~4^jh<vV_phF{NZ;axMhlQF(}c!#
zE&(nZY$SiX_2rax%PN^uHyPAaBHw$uNxp+TQ6+Sf&U(vzQ4yOTL-rPVX3nVMeP{7P
ziYb%`R{;d}*z#RKVZNXO8ht6&9quOU-o!iU{%)JoRmrr@|KML&@nyl))m5>1@1<>E
z8&f#e^MRXWc{v<>ojb{fB7s*Izy`%-SH9&xJ=AhTW+mul`fYLY^9LSH*&h1d2g<nA
zbeduV7$l%VV>ka5Ob=VDS%G&*GGODZ(w$8xp;N{eu8wNL!f?~nsl??z{QFG0exK;S
zu6so_^T|>^d#|ZX@=hx*vtR#my$Tm^P7>0mYGS62Ct`muCy$1pxD4TsJU1(}_?6>Z
ztb`&E)bY{aFW4Orp7RxUYd})Ge^UF}`g)Di3_Ak;Kat5Pquh*c5l7E=&vkg98@R%^
z`#yaH%v!_vkDe+b1(e>%+fB&oXB5ZJrS$(AZMhWsnV{*iv<OB)(f-aG{psy~o=?C*
zH!BnL!EsXGW>dt?EO}JF!DX8!UgoPyIb|=``3v1?8Ya16{0Ca2#pH0NP(>|yG^;ZC
zkL`oqH^^W6rvV8gq5pF}(j7G707cQs=gwjf(;53uCH8HI9^l`5uCX~EQ2K5aJ0s!A
zP=b*E8pa#OA)rJ9#3f{{k920%0sSDN=`rG6##&d9!jDbCy2cw{9D}ol)^Xs}Ru4U`
zbspTN#AdI*)mu1P89>A$OKsT>Okv|}6ekxcVgyz4kEBOplp(W(CmoRHLo-=wl%Ud^
z9@h7x{%#Xn1o;bbSAvr1GcSu-_0jW*kxy-VlBe$z^TzCa#D);5o9Dc)>(BpNB3F2e
z1eD?Xs{e_PAnK26&z%pa2nc+Ce9DV8d-VwMrF<gyw$`0Dh`e8i$ZujStd9W1YSB(%
z`s`^%$gL%J-|SGV?7zYIZ@!q27ErAoO5$S)$m$QT##Q&K9Qq*01pu@Eww7&NX+c+{
ze3`n-pfZ9Qn0}ii>6z<~(h^C+A_}~9A_Z?p^4wru^^nwJZK}=*3+u2coSU~1jiM*H
zL#^-yQ_MGAbzIwqOi8435Yja$#cP`R#CP$d=f8FPug~F_+MG<u6bilh`!V5XtI1+}
z7P*qPZQE8AcW)c62JOtfgs}~i#$r~-$q!jsC@mGaxZed>=dlytb#%)-J=0KeYtHTl
zzG`WAC5<7c7JR7kH9IZ}$Ia%v{IY-L8+B%WapqWVlxmD{eoRizU#}mj_pA;wJW^`P
z9Iu<&{uD{$ir>w4J&2gMnA`Py7ONs?&-|^ix_Zd+F`b}IT-jgr{I8qAX?~)kQ$k_U
zoAh@CTH{#r)vRq*l7Ea2DG;`Leq-Zd6}d+WAtjr|y8dUr0pK3N{$+egEY{%M;@@Cs
z&G|9C)RUncxa7-FZaA1W<U`K<Q(G~8_ND9ggD5L?hI{Tu7lgUd91#=wq0F*_`?ty9
z*jzDubnc4>WfG!(2KUvr?gjL3?Apuke~On3-netTSwb#sW90US?frh&R9iUr{dm^f
zC9%nt1f7r5h3jgDObk56-x~>(n))Jy?z~MEa&Sx6hjCaEVLvvC@v5J=$!L31P)kRJ
zGkdlp_W!s3F&M6S|FZM#Gq4wu_Fwiz3U(mj*+uy|qd^=Wm_)g?<b!PQdrtwyWqbsg
zeDGIb*T6(TE%|zlJVX%p3p491yLo!v$a>%RLF9W9=Bz0uvuLT!P2Npsibbyb-($Ns
z8PW@j#$GScz!bEtYSlWmvwpA=a9Qdj*`kr;Y-#GPT+GohCN)hcnk-~{nKtgft0KXJ
zIIu2=O(STqj^?VV!9Lw?JuNg~4kgq1$d<L;W&SC1v@n>1oF7Y;8b6pRQlET)UYSzA
zhoJmqJ*SN+R7=y9SHQBeEguLp$XlUG$~%y3G_x!k!4^s_j7RiVxvYR868Tg|9)fKq
z5E49sp&&u96}ufN9B5}A*;Hzg<LuU-;eurGA150IMWYw9%6q=s=^>cfBft>I*t&n_
z%<e!cx-4EZ%>uv4HatJAZ#sc-`!Fi*j|_$(<=dA%>!eg_6`>u*8*~@Mc(APYrBXj-
zY^G?dl94}JEQize92^;5Zy;usy!o5A$Sj`6{rEVV`e<m`)t5Eo(fz@9QqX!t7X-{r
zBP$xK8vDpC&<L1(1jhr$cggYkFLv5Lhp6a23C$`iC>Da%z9jhn^Wz%dsl4=8==$qE
zC+F;aFF1Aq0nYCChq+4a(+`}Cf!*|lY`-m-M+>L($l%Y;s9`<q;hXcc>HItXH9Db7
zGlUd@2wNGodNH%B(3#bWYa0;(lSh24<|JeZrB)n28ST39P-9Dy`d*a)yWo8JCi-gW
z#o{Ygd_hLD>nD=(SJ&WWTCUz(sGxa;hc!i<*{Fl@ym^*iBV+<<FD!zxg>p0%Jf8Sk
z9A>^sY3Ay?CB-hIZbpGb;>bTC2)})~`>V$iZ$PxV(t4Q`0`9Ql3uL2xVM*YszowRi
zY}FX>sr|0HV{}P=FhNpnjxCQq!9{OnlYX<8)Z*`)df<%gTD;)M2xstJNlILlQ9zu!
zc;GAP$d@r;`uT|pxVUh5RN%<gI1V!?hl@Y~w992FT1%OpKhz|X2O6SKGL`}r1i1$}
zt~|vDCM|L@9egu6bRNq$FXDteiqgSdSsjWGLZPKV8*8J@Mu8s;v`z_m*rg~kd9*h0
zKyHm=vdBmvm*=nyeWDbxv0uPt@8rTLWBx1n-nORBVTwA;CYm`^JzaXPP>)}W0vNY2
zBloWHAPUr}@h7`nEBvbzj+L4Rgy;+N?{_FK5O{1PR}Q~5M8%z%3^q;2dF8N~AZn-q
zy30Yxi?)W|L&Z2~sM5XZTZ(rO4-W)kh}<y4Y`Ow1=K5mHA?w(l#n~7EYzXhi4>^%&
z*rOU1%d`sIz+iF|fdB%di+TuCxln#}FYnon1AQ&nA{hjWgLohksLEZW-1%3g%NBLz
zjOX#U`c49M<gxZZODhvZ58>{-Qb>l(aFH-0C}=1{kssTe0)va{=pSJxVuEo%R9Mll
z6L(FQ)hClEf!iojj4}!rmFxH1dc`OYqL9Vbgt228!Cm=fjWt;AGU=D5QlPP!V3jY`
zE6(-Ly@Jmd12^8!;mI>Sq)1>|pIyw%)gP=AU!hfU2E<b=1Y`q+U+3e<!gfy64IzI>
z2!bLYb_fr`5`gPN)F@K)>8pZA2=Z^8T5XbgWCwT0;X|4G++wbCuQCqBy{r09S!Hq1
zQTKJ!OSKVb><lPRu8#{sqV7Q!&=&EUqH%JLDnB{wc1X__&JN7`;t&k?gPi2D9@oEt
zHm-7pA|ND;4%*5{$%M#JwCF$0EU-z4H86(wiVzD$jDjjXwxkxJ+o(Bya$Er{>Pt2^
znD}LoCj_R^V0ITq!HXXR1|P}^g~Bya<Dbu%k4X2|VZK<i_^yPqqUdzkqd|VoBQb0b
z^{>5l!Jp?TuPLWBz`zpYqs4GW-v;R{xxh{;;yS_aGfJV=-@C7#r&reyu<USbM78zL
z>gSsVX9}n@T2l7wRiJSQZ&p@Tg5*~Y`9O;T^t-TurL#T~`zyWFtsPgd{<<k21De$I
z#D9rc91}=-j6H-{R}OANmK3t>^y@PE!?a*=3nJO*Js!vhPridd#6JA;6$jranB(-R
zY%mA@)!0|Gh$RGa0#>Nm;5PYJci1})W$3Z{YK&r<oK^IbD$C`Yc4ZuvkC1FUD{RUX
z0Yoojh`y_H2Alr+nrnvbo8$LnZu#uKx@o0p!d5r#oxDDA7MKZC`z_b>7ClOWqXh#Q
z2b2ZZF`!@#CvySceThccrqHA5{_fPbJkmYtmF5Co*lYY4vWX->ot~c@ZroNr#$7Ap
zb%O#(cV41;GV;A#Ph3hGF^@w^n%Qoy(e0(Utv;c{btQ!0-o?+JLr7c!ax(%nc>FLg
zkIy}XP@?lbq9_1<L(bi{Pe8xgEU4;C5JoLIk(+pHm9DH)1$pVyBBm|A#`)_pN)8IV
zlG`u+e9n51U~`-~m(AOBf0x11Gq>|IQr3@m7S~l6T?9RY380rC22?X#07ZuyfSKTU
z(?BpIY*!KVHWUwCVIxU0AZ@G*tc<2-zZM=O-Nt6!xWZi@)@WL_ruLV~@bE18v{jNU
zyL=Z~ssA(oibohF2K$UHj!Xzn%*t_xqaUN>QQ=TmO;fQYY#yf+Y!L!kNpvoB4K{{8
zq=}G))Ul+92eFZ`9Y2&b1ZfiPV9QdX7%<OK_z(e#5W|MDgp^RKFeP{>B!F6ms<9vt
zTdwgmvCZIS&^}BG!hv2w58x2m8ASzafY?#AkP^fJZ9@D|D()j(Zw5538J+;dgRPH%
zphn0U=Mk1B><BIe0~46AE*LP_C>k`O03!-wh4DaLa7`EqOlr=6k|;ox@G5!q+*4xI
ziOw^Ba_d!AZ~d=_uVDhXP7H1%xx|!3Dz(Z?R~pQ>!*a;WU7IZ(!*<h!zeGzmEl0MU
z$^jdQ4>|V_UH50ZweQao#ZY+AZzOFStuPh6ebwffOXTO>C5g8&b<SwXvr~IMvK@4U
zMS~lMhs4Fe#1VsV0b~YA27xTzAZZ3&1__!d4$l>if)n8hz_ej>TNi7cPzdY`qyme)
zXufF=O+g3@6Y2&NeFi-fVFo$IBaXoWP7Rsu49qz|(-12v2zm#xL7lK)Fg~ahW`wJW
zwc}aia?~Q+>WJcj>SauMv*0Kz6c<E;#@EExT-1=eF^oVGV_=h{7!noJ^R!;L07MPD
z4XwdQ;1CL*36BXE1*gNyg8*3^tTiQ+B&rdjHbcm=qOi=wWMQ(|&ANoJNLVuT7<vV6
zX)Wvtv<D($IAjPe#{;5aBA3N0rDvir6F?ClaWnjD(xr=d$e=Qa59Nq@3jKi$APL9`
z@`J1bpAmr%PlY1zCb7)$#7QuF8f0#;Vc0YT-WKwJUPEu8H;^t$1+|oxOVSN3f)9b1
z$e4OeJwsp?kP+kuqm!#DGS-LAV4+Ydwm23O{44A$Yy~QSVovnf&#_pcN-R3;E}Ru&
z4DJa%ngpd1_$1kFnAVH}t%4##ZS|Wr+1sQN4dP|sgUdd;V+UU$MZz`VuEUITkO0I)
zmvPg~bg*3;qQ=oA(j-O_58}x};&4qYGx#GMSNK;*{Bmqqks2OH6i1i=r-SSc@glHR
zurQDvxR=6^4!C3}j>HT%1AKi7jDT$KOHJBJNDImb--H5%05>EJf(B`s`mPfP-8Qh|
zur*0tA+TV<nZhAUfM!PNL!`3eve>fpXf24635V$h`rk{a(RfH=Bsi}3m!3j4C~XJ_
z1EJ_q;ERVrq3~2}jx8PmoKomFmOo5@*o+&3O~PGiWbew}mt{ohqWlB1iLobfz#XAQ
z!%#^O5yY8h+r1FOkijoYC@X}5T#*@M5cC8l1RgOl6n;UVAuWrGqQ!{I63gEHH{dK4
z*A=TBMt9KsjR<-O<B;Wt$TARU#2_9MJcABH4Z$ODO5vKQ$0#iD|F0o?$oh(MgU_x?
z5|Sl#1w$af2T`NFQQoMx5a0EV3%0;{y%8^p5(Ry2y{>pUZmv6PgmwLP)^B3YjOu00
zFA7f2y!!g5xy3FE-<uAfynM;86ItK(3z+z9P1vw6Fe>m>;Hs(;GXC6NT>O-lqO2bO
z{;|4SJo7D&F6j3R^A|-Q*SyCZB=bS}8Le!CxO`Z!*cMM$s#F$R+k(ZLwfM!a&0XQC
zxRkCqvoKq^+Yj2Z;z;#cid=7pG83AF+S1oWg|C|v8xb1pV5bsox4sh~?+=A$5jAb6
zNWv5h9|xAzzQ*fa0lZ=?rl&{yUXCu}!+Wjb5n=mGu+O2~i!VBVCg5yl5K_oBe2ePh
zN=GqkA__BP97AJ}p$0KxW>j{hYyx=lW^x1vq5ArGy~&P8V#KjI+SsAiyGNf4(u5j3
z11>GAuE#$8`2*vgF5J{NcYpC>>eZ1;Z%;PEk!uBQD&pqda3@!8Biz@n_dJ3p7Ky##
zXD!A83?w0mW{*bldIY^2$t2~NQ(-P`u>u5qp|=M!5d|3hkA#vJ%)H!wslK$8VPi<V
zv_+GTq&2ecc|pP$9FErkNWu^^-V4}wj}-iSd)6&wuJLqybXcSc_^AYUT9i0KGIuB+
zqcWK=s<jk`=m(F&LKg3M<KN}X+)Q@kqr*0p=c){sSyZzlwq$0AXS&s)z-ENcn@Lw-
z21|t=%1gJm2-T9@Y_S|9Yzlj^!%P&4hj~OzkR&hYjj^g_>{;}U2&>X0S;y!;3f75(
z4;|)ou&7NjaM|x&GaUp!GiPs?m8c9OG#CDjMtWoaTC}kvEi_|FC3?k7921gmCCGsH
zj0wNG<tY+%2cw}+>Xd;eg)RKs7w#$*jd~A>---!)ig6XE*<*r<%D>GLb&A^ceS{;E
zN}wUjM@Nt*8#KN{;LlB1jlA0x?i`0jDS++9ys#LG^*C4=G8zdj3%(tG@1>jwPdEcI
zfqlU^4x7^TmOqK9ywoi2DiWn5&}mLT2fxIa?6kZ^;!>&y*UN^VGcj_RXVcl<vxacn
zC`*YgFxcKiqO#9wY2l?ezsn&y<X(#7ngm-edV6b#CVIL)b84%SBi3TZ#xj>mMX(K0
zF}#)*fcL+%+#=@)u2@7&LYs^Cys2VPPtAo`(Kfa8DrW4J!9hE4e^QnV#*c#}?5+C(
zP;m$&69Nkzyo$ubGMARZy)}#5mqDQ(ZfhR)GYS`%j#zOAE=9U&M$D7=o@~bI#yUPH
z5_Pmg_tC8DN1}@Ttwj#TzQq#j?q5%`t4?|Rapmk_mWwYY5#b89$U%~(@Fa7JRQ5}v
z&44}JDI&{E<P~9Vn@ugvnS9_NMpqx^fYI#=d(suUut-czK-D4@5$3-_nuPYXBbF$o
zfMS0JJGsvj5u7kl2E4vPlFl)au(!3i5<9-;9mJ`I2I-Yr9bDnjVcTeM@x-%WgwxY^
zt*)?y7AuLY19C?kjAt#e1v8$mgmV)Cg8(xmQA$LRO|`D;ZKB)hM$M{ccO!#JTbAa6
zgc6CBzaxlkcHbYLWzo2l37hwK^oLCiyMe$o!t7GSP52-qxj92B;fI~5Z|mOFBsUY#
zE}F!=88@V$Y)yjg7Mz{0+VVHT(4Lyu>zQH{T|D|`XdhQxDFiJ>PM^qp5~}!0!id+Y
z00ZuG-bB-AV$AF3`rns%xn;GGnueA%i2}Tiq||NX-wP5>d2x<6JgJiIqZ|zA%_c(%
za0C?RPj3uko{Fo2`Pae4Oc`Q7!>U|w&+;(7DEKKS0Pldi3PlIexKdug`C%FIcS<p0
zCkE2iu~1l>oGbqCmPad)q5$H1%O@s`cP(9i7``i&k<LBBcX^JvwRGa7(yvLG7)-(~
zG2G%e=0h}?XncFboZtEz>!5YLiBbOI<nvx9zrw9Qz7>F>T3q=r5VVUjLX&>3$e&?D
zJ4_e2vP5(^g%~*llJquwH?Kf4)*vd9;1Xs;QtNGR_}!1ta!Z?8tCBZ1IApBarZC}x
zt}pKM^W>(zsjS~fInqAU6TpjKeBsR)0LO@V6Q8w0;-uBB<^phRYE5F;qY!Qk*$LS&
z#+sVYMUI9iR0HNsiQBVSqGn}`lNSabTzoW1@Dhf>sqk`Qz{_`KgOXZ&T(KH>9X8#l
zu@+i0H3@34GTI1Mu-7q)G_mftP2Zg#Bn!!wEz@_%G0YO7s|NAluH+s;6`64LpndaO
zM6W-)@+CZK=227^^9be607-J+6JmxSmPHomW~)QY(DSs&dfdM~_<Ko<bl!-56w-(U
z%^Qc6WAvtqumPG6f4)LWDxYde{#B5;3|}^=;Rebd3X@Ox#zXIhp|gK~9OQuU;|M`E
zz*6L3GCZ$qVBUzZw&R@-4er!Nqyq{f32n=zBqYI|7_UkALv%Kh@G|3GDiNAe0DP#Y
zp&#8WVL-6|33*J&9W&nFy?li?X7Tzmu|k=NxFK(f{*Y@q27i)XIyR=YqU%tHYeU3)
zGhC>o6@TZhKhK0h461k0ni?i;@DNSC0<)DR<3N%YX5Pa#BdiShiwtA+rcqLmsU;U}
zb*&{0K;16IsD32w-VtcPVGJfcdz8|{`8=$0YrN-PY+K7ttw&)!!luQtJmw38=+V{1
z&n_P#4y|X#sqRUW@1oowqUODKiX9PVk>4>R8{&O}y%lyR)6n^DU$BfBwh@8*B6aOk
z=cUTG#oFR{(g~tF>6*B21n87n=QN3A&{YEP=NWage22V5!BOTobhtI}I8qrD+zCVN
zP023L&f3Pb)5;-E;fy15L14^`uhimNYvA0^^S=1iDJIC9BdKFdN8nlF@5VSj!dcY5
zIgb$*ceY~VO%v>=H_dLP;*p|_9);k?;pfUx7-0n%RP-yI)sPK$D?J_3Q4H#uha2l0
zbxC6ZIfPN~8j7X-mb-{YumwV1iU&tcve+NjR^gc)zIz7w=a60uoi}Zc<dObMEMf-i
zbfc^1#AQ40>4t8(!CF2))1jZ4t#2c!Yb~X0HIvhOgnB6Zfm@G@HJD^olc2LzP!r3%
zmN9s^{5gwllSp2u!Jr~Z$loB`Y|XzPb88;rCm&SoJ?d;_GQw$;3sG~8owavrULKbd
zsSL??B_TqoL?mwa>n&QWrU?<7pn5U9CpV>oI9(Y$Uh|wF%9#m$(bpL?tY}t=@@uS^
z_$NgnP~IS=O$g)NN!)->FX|uN>v{c-+WSVZ>$_R`OCD|25=ETyOq%E*7A7J|R(Yzf
z*F_mEzIC_qyPncahcM;@;VKF+N(SLd{th8YwjA-n?i;Gl!-NPtMinm7pU}*QWi9HT
zp4^Bdq5mpbmAG`?<SIq&W{>d3;R}7asOOCZ40wN`y<F;Orcv;^ojmQ<GrmA#3kOA2
zZ-eLd(g!#<eA|fX+N^G+682?q{|q9}|1FD*d3Sy{lId1_2E7!Ki5=cLG{{U9`hP^d
zby!qU*Z)m748qW@(k<O3pmYtLBAwFRp{Rg@fHbJY(A_x_f`roD-QDop-uL~y@A=2;
znz<a0XYal0to8X?z8hi<C#zf}GiV5Ix80Jn9dc$VCvkhNTrJSS41o-<=~9>Bab$}b
z6NvgOF&=g@E@BeXA}M3U>X05He+a*@z-UI}q{k=?vwa)tGrSgxoVJDxF)ftG8I=}C
zDp`WQjbbTeKBtVu7WK&{f_I=&qDhCV5#mEa$qbd+hRcfwVu#5L+uz0G)B0e;EoeQW
z!n3K9+66a}@=iO^*E{StvBMXUeNggxWe21B8Hhs`%-Lpf$KnaNI|2@s%&bsJ<;0Ml
zEm<GRiYLlaH{<9bdU(LoV;!b7jezkWADfeSMDna6xOuSHIv|Y0bV&$>VRKsOOYh-l
z`nWi+!}Mx@(kF%^^B$T_p)qwb9}>+%A`h8<M|%v@<BP{5zxx|G6y`Ln#rBR(pi0*M
z6UM!tB^n8yFe#gP4F5EzVm>?^1vv$~PFk-J``h=L^=NMfioZ+3J~((-GSst}CriXg
zDwi+SkbWQ(d8k{%h0Iy2BV@@@ULxT|I~@vq|J8MFLl4PJd}Rh9Ykz(y!_bUQ5|5MB
z{^Am&HTnRlH%vVz%h*T9iq^Am%<In&nP<0555L3Lk;sQ}F*?V}wFD1s^`8!~H6^&9
zil*b*$l~e8qdG0B8?1Y-%bcS%hAFyFd^a|}e*+Gl^y6hiS1PncgSXK#gsAN1?9>p_
z;*cxX$3EZR982C}AQlaIETX8DbY%pZ8Kb{+x%ng#?ASvnEVo4jFBvHKu|l~PcE&WY
zT;!0TzSIeK>jWXl{q6A^#;{(Q?|0cwPm3|>N!aM|Oy4H(<vp?@Bhd3P5hYa!_?Xv;
zA?=LN_^wDuh<Q~0h%1WW5Us#9AwBArkf{Ty9@RN~s+@9Kc_Tf}f*~CPrx^v({>Z#t
zwik_9>$U0M9N8E$#*Hn9)ja5oY0Pi#={RVIo_Q$dcsR0I->zeX8a+Mb?O&2@h&~#v
z4@Rx*3xY7!L*XP1j^Wk&10PlxrDFnBjCf^IO$HYZ_SSsWb3@6x5R3%sdlPwjbAe_C
z7gFh9a!eP5lCWy5$$AIdCe}n4hD$FcUMNOzJBr3?%-6Mei{wcPA!^KQd5=8f!Ix?A
zPbX~PYgjWL5m^}6t`y=(K^o?d0yv_-qZ2Y?8hIK<Jl0d|{QLRCX1K|lyiw$(g1ooS
zj4El+Y24{PeQ*hPS<|%k%|_T%?kl~%d^?gXp<#;YEp0@OInjBr7!6r7{mI6XnEy<n
zTC?}Zizb#^LWp-K84p!d|Cy70et{CR#H#doE&qJHh0=FTC$e7K-pD!zT7F?vf>0N8
zF1!#+^PKA7?mn8psME#Dy-?O+?AQp_XM;GG@|l#41bs`mzB<1}eZ@__)AdGZy@*m=
z3`~JMSu!7{hwMkzy0Xq<)OF$>3Q#{0LLZ1g<WQ(Yv%2y+M*gaNk@m~|;S~cxAA=fK
z<KuzBrwtV&nfE}HZ4nt#97))WAq8Go^UboW)`YC={(RkoP5OxOow2Rfdsh$iUZ~T6
zIL^E$N0P3ze+sI!V!`LYE+T!D_A3pfFRmy$?UYEm?cRsP9AQ57knxTu{L&1GFQ2fj
zy4DM0Cxu`zce?4LI)Hc*XF*hVZ&#ECyWQGX_^Ae-6(J{|a}`YR{3BtQu3JYHU!pKx
zW_)$o?&nkCSYKmQMpuI32%IbJReamJSbM@l{Nm(5$BJ1SdAXU5b2JB~PTV>)e$OFM
z^2Yl5(XN_e0`cZ}?0ySWylC6Qun<;Pu>f=<3s!OTg-$<P0+DiLUD5Tbz1AyrVO&21
zT|CRT42YgImQHUnE^BXvz%l+QGd0Af{eTB2fDkod5xR+%z<~ZN2dj^P5~E$T_e(V9
zWCZxY9J@FgchPqft7VC{H+;ZVQXJDM=c~#z^V)@o3JOiYVkG+UEP7hJIJyP9G4hUi
zg7M=S6eoIomAB#Z<v4CKkv`-|k>y&YI4B8A6qjglb9`egx)AIu9<srxfq0bYj+5+A
zb%H?XCB=S(r8zHNc;a;UG0|nK7pKb`<C!AS+K-K-y6yBSoI>J`QLL`OLj<=!B4l*Z
zY|=_X_|;>WhDr{TN+O}ZqL#DIviyUvX0HylaEmtL_sQmlcGwq$J=Zt#Kjp)}mKIAv
zH6Y}i2&k3)nqH2HA&p)frqr<4N;EA)Rp9ZV(UpabaBdiz)UzD*0f$+d3))GqL66fK
z&AjNNk3!aIs1FJ5)EA~ml7@1GuuNh>`aHuiE!e2h3(HBLF__k3)nrzXg*@Lx;#(3D
zCaaaEq{bkoN77!TP9f+T){BjjaI@X?WU1X2cAU;53@Xl;Rp{|V|K7pU8~KEuz@s7D
zRv=LtWwq0q9Gxy4@+@1L;F_}#TQgSnJQSNZ9xXB+^7XImF!i#XR?urloLh{1X~h)A
zAp}b@lNl*qq&E$7aCNlyBBnkPQ#zg=QarAZ+&d3q*pd%RxLX7L!<TPpY->TySPP=1
zX`vyOt5Y6<OF@S+l#Y=Bz42yIo2X2V@jY4JWxP``spyfR`gr-W%s#kDvMwx9R6mw!
z@bVG-!c<D;$R9p=WrU#gM)oh-y$JCtf24BR#b8gsA3j!&5gWyFD2Ig6F4(Xhz~qP~
zzyAtFywX11@cY=v;~82>T9r$adjpJx4iUG`HRDS>l}#j*)hqlBge76rnJW}8GJqWQ
zOF8Z5B@vd$q3kD{<(i@pmk1?c>gGc#APmIM5}E+w04%2B=ubRUN{i1~;!mEPhuILN
zv(Nn@3qh~zNaI0iK4kyixl~RIx4?_A5QHM=T(NazsMA?UwqCyoPc|>TH4mr5`1Mto
zE@IKt2aPt`s2#$4ET4duj5y%IJvL`4MnnD@4{7TFC8}{*evU-kR}(T^w^%soxE4Ni
zA@0&;f!hjllO#Tl7xgzmY?;mD3tVFk24ee)T+oYQ9FVp}fVAxeR)fMRo-sCeI~|X<
zn#5pK7Y`ktK0(o15(BP+9357l6$MPK*(qFX@v$&%*dZ%N^h4(l*Kfu|2AB@^!M}gf
zMsr4CF3FOkIb>5em!s20R4wWhgbtar{!Uhu<Oq2fmE^zm7Dnmrm^&m)$GniC5Xa#|
zu7{LHVgBfEy<4;v@tE8t$4YAV>!H|`Rig!1U<GOK-Y?qlvQF5c`0ofi4GcDF6g@d4
z(<lm8+7Bo+*6o-`93fq96s~M|pTb3uhuWuH#V(hu8o~owW=TpqT;lO;WO+HFwp86a
z>Nd8D%)g{#;v*gw#eJY0`gph&ytBB;ovtYmWI~N61G30<os5TOERj9t7(ZpWbd;`y
zdb!)N4Ez$ZxsCBp7S(MbDAS!^2+`daJry-k*;LSJ)IxD{ppqd{*;KO_4dwc!lr>)v
z1CfVpNC)j753$72<Ugk0v?(by5%1=kqM>&qi1eT6p^|n6x{9V_;4XP$b%@u~sfF{I
zlX8T7)F9|`6%fa<T$I4-_~BOLj^Y?T=JtF?#hdnbxVt&BI7V{k0R1APNMEozZE~ds
z7j>b=Q#~Y{@65~^D+NaxmdOvVe8>hPzwnS~b%a^FivDc3_aTKZs@0>=Vj{P-zhWt^
zd#3TYOh|^`F<fYgNEn5*Py2os_MT9~NTlD&k!s0Q7%~_}>4T};Z|_9#gU8HzA?zg&
zxna9#3eJG}BP1gWjKn@hTjEzsFRn<6^S|dCX!j}h@)0>l+WHt$9&&dG>th?4W9z%s
zsZbY3+|a8U`Z2mTRmZN&)>Jz(heF1~2u`dHgfQHebjx2GL|WC%<4zz@d9d^3OeHi)
zgh@p~G{h0-<byvLrFKYnNoS1j-JzAjc$fbEdzL-2W4xgbdJ#<#e@wdUHj7Y-e7d<5
z209lqvRN-;fRh~EMw;Z7EC_uOe~MbX{E>4A&L%cRc00li`&1+arO-8zzq<6xeut?r
z?kfiM{g<ew5p3j`qQ#L^Ke!iO2vgWES~j%3;hW`X!>mVl4tw<?0#BI8LmzXZkK{m)
z0c%2*&@{RX`Ry0?$hc17dQ|HU<A#-f)5Oxyv?WbpTqfb^CX7Nte3W}svUWsvyN*73
zR!E38JuOp*tliGj-UbnLEovJ>CP9zgpg<B`B!UBScb}e=v96`GHm;a+mJqg$u3ZS`
zPU<V1`}HXV7Z+D~a4@S+R?nLcO-LLLH-$S%R(qFP<#wrgcH|hciC?~aq!!rTezS7F
zpB#39?hy?c<8>u9=CaAVfW{y!BnTwKXDpl(=;}C&jOfvwr`)yn!Y9=Ny?$k(<#%lP
z`<$FgMoZxBp+h>a&RU_(F3VrWu@0X)hAUq9etl^B*2@?<u_&tFQn&WzjUCD$H#%mx
zOx6%HT1;mW&I)`8hv-{1!4_?>egRGh<J*hEDnazmxueW+s_Gwf_u6kLz&)AV3(N`>
zp%Qf+<#@|qzhnI?_v`b9dP?jWntW6p<-5Ksho=Fn>ixWE)tKzOu1rtEaWa;k^gOi<
ze*`CB_GCWKO<--INZ(=u4T{l}n@A(8b<bcF3Z7`XYu}6c9Het+Z=HT2<$gl>z!8j1
z;d>`Lvi5aQspVB6ooUfsF<*$*%~Zy>(VJt(r)=nWFCs?Ps%^b}S~4RB4P(C-jkT7R
zQKcr58hD6lKFu!}jM!eCrofIBP#8OU5pIirXP-r)xuDFG>msY5yr)DK8&Fs&nohaq
zsHztF1pYU>;E`2cPNh9az>%~VuuVN|GYpJEcP1{m3e5)3c5;I(%SP<e?H3)b@Vj?E
zRJBgx!>MbsN`e)?_=j#MGuN=^^5Q!Zss`z?<^J^)ZN$JW>3H_tD`)IedBw9bI{HfC
z<^+NUwU|*gXtbZ=bNd)lfyv38A_q$W{WcMnXKFT0r1+7ubGAEeN?r!fKgt`KReZW8
z{Z(dA<`y|yV%Rq0(OOP9TJW|VU$97YqUkxZZBn)w@6)ZG+3mlSBU5*ma=K~IyYHEA
z-u<zETK@ihzZn9AVlOE9HPeOUo%C`uPUr9yV9Ws-NM3QK_{urBNK)<MJ-CG(SX2oe
ztW_r_77#BzInn2c<U{wpP&XQpogSCu_GH36{lD+N!_0a`y(yu>TJST=0=ib#M}m<i
zc`)qvpu_PnqFQQa6ES!)vq&G59CJkW-04s)e0k59yh(5Z5gvOYoBooY_lu}dN!0#9
zr8QNv*+ZeMKF(JSq#?xmbeu3k=!f+7aN_NLr59yl@CL8YTH}`1SYdtJLYQL-OEl(M
zUS5WxzGAb9S6mavQr`3W6Y}l;h6E(lKe-q#f-NvX@=BSB7>pf<x?HDR9DyX=@Qa;h
zf#U99fgKYKBgD>72|tU1<y`0fru%EAy+bwLXzv(1juh7ve{dLs@h2+Xrj%27D46=C
zF6z0HXl9i3uk<X-7mTXTKM3FO%UlxQCkBr%<X5+8VP)+(QKYJg1Z-WNv=`>Js0jqL
z)>*l}nIcX};-T^#vyZufvH!P9+OR9ZAH9LtSE~?uR8#9dXvQ<YUB9zic8lv-0m<#<
zTX-<b7QU_bs*KsG>?vHK*;_t-AXSBV`M!XIm0RejDK<W*edxrxKY&O>2>Di!ep%B{
zy30)qT|F@F-A5Q5gL~)VQbm|td%pSqudAl|q_Lp){)Pqb|6To|@5C^`?Xmy+v_I$y
zod*<;z?GZ<U<Lo*H}~&)R^EO5Si{kuQRDWX-x6^x=TOG_l#~?J<hHhaT()AUOAtYL
z)BjXmS9ct=S2!Cal{Q5u0+<`Ps0jhjH{$KPcNAh?9NBjJ1|eKr4{SFrRzHL%eT88o
zo+cBXuunsGM$3E4gU&s+2D%;|rvP|3lOq@HDtvqK)Z@SRfAtXBVlDt+ZD2CtYu=Wj
zF8G;eHz#3Hxh(W5h;lTR7`XkmSAtbfU*g{TVte~+pSxQT-0@@z)(i}~zby@=DR~-D
z#^vJXx!E_y2ld4ybFpZ<E(@Y4VsegTKlxQa50Q5OOV=~i5u%x_!j_ovQ4#?lbJD*(
zRkbkz)TDkAs|Vcd)qyenCX;~wJY8@D!5Xj{o1siSQ{T0(Hkn(~I$T`-k#}R2M6!Rd
z^ootdy*pB!f|SPsdB5&m<Lyit^P$7n&$i*YSp9&7mbd)wEJCo<q`8^jt38``U_>jo
zrF+?|)igQa@E5}9l06KrsLjFWXqfF6K$&MjP72>YgLm?%<oJoF!r8F;`5pPx&U^$^
zv~3%sC<rKIM_L+7**c$nD7TwdNY35XovJKrGov2ai~n|=7maGswQ^GS_4e*}^DcuT
zUE<mw2~+tFtmv=~!t8>^o^R|*2}u+%7`mwU{%s$7*<z;k((=CxNbflpyS<re+RaM(
zLYO*1JYV^0fAq%>CkW*%m%)V|Y_x!uL4zL_aTkfs2xD0K`0~ZemxuZaQ{&Cexoi@G
z@|YIab<VT34g7@kE>lXMEpvHpWh59l8I*YM<iQ}yOQo2LN5!*-8hbBQK5E0?<Fef`
zpbn(Pr++3~dz9B^>+pq?s!ZpLPGN<e-7mlLfSsgDO6~WmDlgUEYH@03V_Dd}ESYBJ
zHcYRp%~sTfzba4~%Tq;1HdC9y%VI<M0Tem~qP9P(zKzp@c8*!eGk(b<xx__Z_Nw{c
z5`sS-SZ?yIA|DfW;$a|SxEVyAG+BLC*ZXZwZ_W_L*l#mr{Ml^pXe$Tls|g0dR;pID
zuZihb*2zkbpf`p+gKuVZU5aY4%D%2aPIu;-eU?_caxV-l{q24f1>e3-t-D~bgzRzZ
zs^42E1zqs=)E529sIV=1w^dfGJJJ*@Uhf@M>$!fBz?SCyqI8Pr_ckAY-z?9~&@9ms
zY#{sdti$23^FXr#IeHGun-VbrBVqTM?toz3_XVz7jm^2KtLJ-KXNP(6RU4(Ox-ItY
z+<!$+x5q>a?MHH@Hb^cuXDG@!yz%?G{_nD)d-YIV3}xu-Oc<}#%UTxcX9{lP5^3>0
zNgsEbe$A}!+km@KjPF6^>$5<rX+(B^G!nM;Za|HCx+>WB7sMSkgMea=`w1I0{9W1Y
zbsSt!t{bmUlOf0FY}*RGOCU7mvlgGoFDe$U6U-0GS`yzZo1U6^s6>ZD4wAnn>DSo*
z-H<Ao*Pj=8GE(F(9z!}4IQi%otERkru!&)&;B`Ghv@1#V;eO^v|3uxdeOgA8q+COs
zqXDt?&EVCIwP-O9mbvBz;q=jbSfysFSg`!d6B$K(C%P89!J)P?Q@!-5nS2M+IId<2
zFVYLQM+Z!@SpMuKO@8MOWC)&At?)cM90sWTRq*PXOKM*3Bo(c9l=er}k)IOY{r`JF
z9rtzyIrMl-A6>@%CmBT0XO8O}jaz)yqc};T@eYhljBWF3oyIukilQoKYE*t@nCa`6
zynarQN!Uq*5_+euuP~V~F3#tC71JEn_ft05x+%65zWkZfH?-1K)~iamOp!M%jZ8ID
z)7iHGhn*Hy5mBy^(`8fbIKv^}2rVtfGL&)Hs?O4jaW%+UctL;`LFANglcV^f#)afg
z@qT>y_;;sM<ah6(*psMnsIGozo%1>O&KFlJ1A0O-LDe~;Ms7*gCnUDHzOM|DPKHbf
zs52&`ZJyIsNPQ#`iACK1nr|J0TE5gw3|zgv$m?&OsOWFdtq5mhbSYPG4G_y73{Alg
z(l(!nwidO0g?}$#`7PF`iE+|Qjs3F{v6UCR!a=*?zeau3qD{in1c(?6=MuS1ds6ru
zS}0x&l}=Z_l6!aPD`Cw;j*}JxPYE^emA%;9CI2&}cU}<;&vS?&Isd-#nz`KS4u1Qp
zMYTz{P}BatZ+1XeYsdN>t!Crm(98F@5_?Ua4rvr+mWHyL8qz6C8uU;>O_+Q^YlQU_
zXQff~wy5hW!`)2JR|aJmiL}1#NnV{Z6&agp6Nk5QL(-fmUpK04Bb@pB#wx$^kn@83
zX7>KpA2?$~`!j^X2(C<t>eFaXg^F{}3=8iJ)_{M5s&l>SgG(+?KZ_nsdgI{YmQe+3
z&#w=B5*v&^i!5|EIY{~0cyw@VVAHxCkltGH*Ons+<6!ivrsC#oWcsC!m&gR0S9HZ6
z^N-I<Gup-*4u0CD2&DA%4!8;j>|Gw=l5)ysZqJxEL?XKT%UZmSNc38d&S!ehit=`h
zXgVkpSGgUOSJg5e<3!2=&crI2S&)^DJM&t35F%=)d!d?_8{)HD_|S6GfqB;D`d?=#
zVm`&3^ypj|rRy7oeA-0mv<6865s*G|a;Pih-C`}Qc&VF~xTZ|Tp+s8ps+PmhU}a!4
zna0832i8b+gfudgu`fS$21l@D9{PopIDzoXw5V9nujaMT(fPYHW?knKj`YUFK};Lw
zu2;^i+(p1zGcxA683~g=(<IbSvNL2!wU2!9dr-~DRNt7=ag2+TNn;HXfhP}x&Y+==
z=)C%DSgUL#;jkaJxm)_=8Iex^X<l9L;c9XsOvvF2bg!%wj{>Q)vUpE@kGj872WHY>
zKgQ`j%Nn5p?c(_W#`}fL0?}(XhAHN0&BiI-wp||gJ4}@N?=D4$Y;SMBFRRaWIgk{Z
zbCoFf`Sm%P*8jHSW<QPBVZHlfnse(>RQKa|v%ISA`?psD0zn%Cq846mbBo83uEiVt
zcT-@1omE0$?NnR+WAT;nM?`PdNBJgVU#}~NkriG}W$iILFcjdAxa^?|a{YO@)Q*Ug
z(lj)@?nS*oO%rr#+}rmD2)dv@R~x7&q#QoSTQ>VmH~YoEe?Lgv%r>K+fJWreiWT&Y
z%#m7EDkD1U->GNdCu~!#%U;7%NeLpIff}@&LaeRE2T>u;eqh7yv3qD|QdX0!>{8E1
zxTVx@*Cqh*EYHB2=_AMPD60j6-&6I*y>C=8)2DOgDCETlbz$q@DGBQ0IYA^<>`oPQ
zcI7&IH@;~?ZKr+g4eWY;9_rCvd*Cr(0Hs5K7PU2lE*|+jUfRhAq+|*2``gr1N^=8e
zXZqoC$)^7vX6h8++eu{g3mV~Q{U;~2&ODp~Oh3kkktK|LIBR?-9wEM5DeJ2B6Sw}{
z?Raui9b1c+bNz~l2$q#c&!PM$LG)r@r`8owyd@xUeYTScP5ztfxt?n8R!O9j1t{35
z>6CNge3Cd8d1thff!AScQV&|ArM|`rN$c7XVM1KI9dFOEpzN=iyf>vr4V!JpW~Gvi
z;M@&P$(N4uQ%4`!`n7V2-KJ}eztjoVz}_bc&+&)(8NWvkm%~jiPL=Ynk$yj5pPZDm
zc+~w<0aN0<?>RAs+r4yl_d(myw8Qo3K7bn0kdRm{loi9-SXsej*Fa?@(g;6b>;aOM
zon7J3j_S*o$WZyMzd!o(%>o*%_ols^X1I)-g<VdPQYjxUcgnP(R`X%#c@}v;^7#Av
zsx!W^!QmVuP+1*aU4Sk7aC-XI#xUq!7r`&vVIE*?{Q5^xb#ZZS?qg9=rY92kEUc_Y
zR{<3j6|!%E7+%5VCJ^Q8ukP#Xe`RSID7lbyduz@^PDPxSl(cP}4yFa!*tm3|j1rs!
zl^h5jAQ&wp^LF{~Uw}X~OLXZ^y47HTQV}O4B_-AQp8T~^Hmb7+AgENZ2f=bm^XO}6
zWW(*P6{31pcvY*4i+}H&!E|)>lfERS+8gK^_%;we<`fv?LZng#%UFcw!V7=>0ygDL
zxwW|1ctYSN|2PImUK2nJLpyT;gc|-&h&B;gHh~L;k^*(^{HM&!OiZGQdbV&w6Ky{K
z!P#PKgAtnn(E_u!$;rvm3^56*r8V$Z!HhIxe^QxA9TyYR^{xBhAAYC7*@ir;TIaFj
zB(Z()NLp6Ljl>&UOR_aQ)Bh|~`Cr&%`2pEH$*WU7AYJJ_>*hYm1BSAlI_&N3!Tls8
zBzz*3_x1HP@b%Tv(XozdsfoL+7oO45g8s-ZFNecLMMc>pI8`S+{r}{B|L(Dr+x70<
zyQzV+p6+fGtXdLMG?Y*P6#e=0c_`K;YL2V^L^Zh0;^JbKtfAOuuvUFLO*gSKZf<U*
z9LASGSAp^APr9JZoFpqiL(<iS_4M@o$osCJ1k*C4q@tptA+a*+>FK%(kVNqGv9m3|
z0xM}|XYlVbHZ}%|iGZbr56ZxBcxh}*%s+ZepyvF|eybQ1Z{2DBRj?bEpy2q*SyFN`
z87aw+r_73mp%&y<Ms+w0&-kAGgN?%<3B<mOtvzF)CP>!PdCJ7(ca9&d_n-WXEV-rY
zUIeNE<<NdNv@5*4IrtajQIZ`{#?HyF-4A>|BN>~f@HXW<Ja+55e$*q-BLBUb%10$y
z2B(vslO6iFa3m$6=@o^7Dht!M{y#PzJ^Xl29CM%6NZLBi+}Fy*|5dM0K@k0Uq9$xw
z@w=QsheY`@)te%I#4|f1w;UuSm6r1I<WZkz;SYry5Pn2XIYq5TM0xJWGy(M=1$vbc
zp3Wt6mR*OL;OF*ssn&n1PuQV}K#h_sLlh9Nr{q*3QrcYq09R;evI3#%F7F8EZrSVv
zL$W(AjfI{?x>Q0=+cWtWYstp1sFY2_Je6Lm8J4?h0`qG<^wocpA^LZk6mZaaq#~SP
zsep2;4A{Wh`2zs5E_oF}Z0dVfv&Cma8#I}toWx<$W`X#{oawV~V1p6fp=TN#xLnp|
z^*w)Wbu|KkK_79sR<|H|dzqji>}W9lrsspi+4lrmpHoef5jx++``eN$8$f|g`4&qZ
ze0K)si<_3#jhx%g*1^^Rg039oI5kcq>v>eA>Mzx5$t*zZkmYmzb-+k)V)T-`?Q$7V
zz~iLuPHV8a!L+&4uc5ZZN_OWqyMUJlTZ&mh@FK%1>w*1-mGg=D06rn_u60hMyrGo)
zUR20y>(`RUKZ&nqYISvW2`G8YXV;P^bSBdM21OKUgPvPib#2!;Xnp?df4*7!Mtgo+
zz+tA^?rt&ozN#jBu`Aisw8?@dEFo5EKVl`eXr(TXrLV+$ZmiX$>1e_PclKg29I)#i
z8g5Eiwewrg_WfaFW2~&dlFi&+#yQVPUT&_uYrEgRxB-~AvWDdt(-yz!tIBVNHTGiw
zr9yi<)G{Rg(D~P@AM;eoc5{(|yXAU%*7qb<c(;7YeI3Zsx?RQ0_5sXneSPHnWIPIC
zz$f_V>kB}qTXR*(xx+0pUWK(rD7?HSMl~n^vJcF#msjoGPES_Q`I^vzk2tOT(k|bi
z@axqVFj&4?*8Mh>3l2kA&f+65j&x380~DIc^PFT<Z?BR8m8iM<KwV9x+4uHiiD50j
zs`kX$ySCfoor5+2S)aR1i^BU4xT5uL-@ondD0*UL%;T){WRObmb?-p}lf=!kax{%w
zZ&};J{Uie7xi?GU-=6?~`jp9IXBswf_UD^I%hkR=P_dQ>sJ=XX&)xd4q=?{$!9-4~
zM<7%Z*WE_Wdm~K~o-5rYhBe#ixZI7mmCD@08|hOg>k^lT-_#|}Us%D$0F;{?3k@nS
zvi6fWPU<}6Lh9P5`?rC?SBgk^`Hf6ZU0>g+>_OBfuYJ7J{V`>%B?y{_iCLrL6ks0<
z`)-f+^~C_FsMBG4Xcr?Rcgt-bSO`wrh1$K0x_MxxSueP77<R|nz7*-sd0ouKNu6r+
z5YVIxZ2l*QUv|r`2sYFelm+?8hua3kR{tBL`Rao`@~4WOj%|#^uD#U{MCYD+%--27
zIGtG04)WHNd9D}*%y6p+m14s*1>lA_7*t01IW3|q+T>=R>%a<23-51>$||eUsFn^t
zMbnk;Tz^xS6mgY)*y;W_Q*MD^)H4~Y_1w{X5{((o0MpJ2*!@#Ksqe2Ti}fipbG}fn
z#}}6@-J|memyBET>^m`PXgk<X-vEoldB$&dlGjU@UlkK5JOiGGL4F3Qzs2qiUEt|`
zG+l=O_}4bo)YGxL1&NbYViQr%)XS5hg!^=ADyk}rkvyBs;G@~9A#w1WH@Nj(_b$`?
z&UOXP3%)TmU)!@l4VygxGlnyn!=#i2Ji`V%iY=OH@A{qAo6@FjIIkj&RjM@$RMy$y
z>OTJ+yKd?2@=9EYeXy#k=YV2XV6Dg0agH3uP>Mv8XFq9%sAu!#F?(slaUTLARt@|%
z7uSBK*nWNE<~2h&MuulMMSIJI6d@JW%{Y4*5}8R**Fo^T?`lpoka5_bYorbQxdd!o
z<Kk!K9$L>;D>Ac6R_=r16K)oE?lcMi^Te%@pocBRcGG^iSr$OyOO{Qv0$);@oNwxP
zR+A~=_fP9w8U`Et{6o3z@_GmO&u4s3R#w!d0`J$bi8KAxdM!!t5c>5#Zw^db{5=ll
z^VJXJl}Q1In3;hg$2~t5my}EN_z*EsY~+2#2<m>&GX08NFiDRd8430zlk3sdMjP1g
z-V5Glar<*o1hnZO|Cak!n|6{Ufk0}%MaRwb-|Awf^Igpjx|4j^E@I9MYSaeO^LBO@
zQm2O$`5At|?s6Km?nWI6)j5y(tsaI)62kM4|0$ZZ-(#AHIaAN*MGSk+@ehosOZ@0Q
zFe|rR0#XmiDj*IXYP&wJh^F11uh|hh2tHiEq`Tg(QU^P_4}cHOw*t?;=m`g+3&7Yp
z*!(WSA>fPg5+gHkG_T_|-zReguIzbtn|aS|YCZ|RySsRhyc`Y*zovOJnFDr<BYAfx
zqw-9R6NtdWaEBzkJHjGq#HwB9o39Ku%v}2~sW8syc)ah!db0esdl3+2HKpnFwyV$Y
zxr7VM%uGi5`}(EsZ>xYJPQ7BCGeArK{@tqqa#7e9aJ={7{oGCKQB<wh=QACsn5`E}
z(csh`w45=y&UcZir|~{vX3h_i>vx{N?NjEe(F-xDlm3rmPe%QE7vKkbGrYJreL?9{
zeZGJn1xxh%HTv;GBQj-DHSd!5>?AD8LCQG-0nps0wT@S_S0@M{ni>}N`SWMuSc$>P
zV!)oI5%-uJrQi$8Dd+C<)>vqL`R?5#v5xuh(Y6N}BSDub0Lrr<HxcvR`rB|)IXkQB
z>zkVAeK0<!)+vY))?t3KJ^&(9e8dYirEw1$ec*euOj{Z~wqK`OAI!H%(8iVS6zP_n
z`$;HLd!^W=2Krs>&zJ1bB`}@s&dZHd<5LN7>DO;gR#<Wr-<B99bD52oC?}65u3E-Q
zUZ0e;`L4cWcGoL@8yib{tltUF)5hx!WA71Fx}e*4Rw-cbfIG_+v~099(9Tn(d*-8I
z?RWhsn&x~dKkFYq9QZ^O;I9}E1=wi2;W)s>8=9Kl-$q~q+ShdyK9y2`pN=YV(pav1
ztOa>cFufSFn1H~5q?0(4DCj?_Hd|<wX!LG!zP-GVyyRhHQ-Z;6gfVS?DXJv*R${nL
z|6<-K?QH=DAx|ZZl#EQsa@;ZE^0aCwD~rcsu-SLbYVG{Z{7gR|;pKi0onEo=)$Dt2
zK%!dic}L7%1Q(|bTns@j8V8EZUM9xIj%r?BbzCN7+$KqBO|r1jc?mzmB+tpsKakmr
zEP}lm^-R&T*rtOFUUyRSammMje^pcPiF$7OXtV`IS$q&VE=bu-0XBWD)VQ!<o0U0}
z94E5TduzJLW(Y($5s0WfyF3e|9y<Ts&MxKqn_;;To59)rGiJX1i<^(-k8mPYM$*Mx
zOb=*V8ol@IQ@X$AXV_y`_zh6@R~oLqz5x0vJ+Vv;dwmBN+(RZ6j#q97e&@EUbu}8%
z->G7CzPjTbh^W*&5&NHS)6>&mCNM)N_zQ9?D+>y2mvSTXv;33{<b5qP|7;5sVM1uD
zgYK@)>3J;Ii#N>twwmZ#A(yCDYilTf;8sO|PPCoM6+!NQs`=2evtRt-LsszJUabE<
zNd3R;A4PQL%uDzS^!HVA6v6s+8}k6xV5~?FGpr*SRMsPt%}QCyW-A%9rirP%EMF=q
zi5|a2tgNhfH@yQZ`tRB`+ucYS3;keccyxq4VeGj!=RJErDF^wHpFe|{{x!-X?g0-m
z%s-Y{UUmcq#JJDplhrbEb8{sxFIUd@rU6s<eD_b_pXII*o8PummGXXuY_V^?=d#q6
z<nA=uIbBd_ucny7V5?j9sd=eMJgOsJsn78FsBwPe<yAY6UFVwx6&Ay{ryJY>_6|e{
z`A+EQh-d=zZj+!Z`HhSswm#wqe?Oq4RV$LuqI6U1bkMw)6dp~GA!<1d%ry-`bR3PC
z_0i`aK+1bEJy{62D=4gG`?!Bl?8dR5|H1tM)nU980Fh&IH&gR=8aV@Ay^{4hSqA{F
z37~g>x%p>p%_=o75@BI70fXU3cSc!kHahzkN6O};@9z5V*RL$*Agq6Xz3W|3kC4rY
zQd>gQa+1g&`L%d;$5FVSg6L(9-{rnD0y`mJRrzh)1iwU)fi6fMk?(F6Ja3%fc?vNe
zAOTjGB<FVx$z_p?#uMo5PH#Ag$kvOa1(FiL_y2mKKJ>eHbG~Hew?P#tm*HrYqPJP%
z(0!-YiS@vs#LjP<tbk{H>??B+scQDz3d9b-Dxb<o>5~zDmHttF)d_wJYy{7)=rcUI
z34Zws)j$$q5Ehitc*E@Nr{8n8-S)e*F|5Q<*XO@f89~yK7r>Llvf$Q=?6hcGFjIVr
z-~pk?g6|He_d?K(lhE8~o0(L9rFf&Weo{FHc#XrrVR3~Tn#5`N^y$<4+ZmS*jRNnX
zOkim4*Jln?M#zWjvZNL#Kz8)xoA1dw_?$NQ&J%D@b2L~uw5#9O!HSZ|%zT#IAN>2C
z4S<kdWrClch~ANWl7WO#P_WjZ%9@pxHQCssBj+20SG8$xSHu58=f6gsEE%iRsz%Dv
zK-aTofnRlI*DmSHShH`{h2%XLIU(aT6}OtM)_kI1+vtp~T<AnQDc4==G|lfazYA(l
zb|Z~24-bzSU_tx)nD4LuQT!)+MikY)#nx9;%zfp=qaH0g0Ks?uP&%u5-|1G)KhA>p
z_M|5462xZ_gl!L38+~I%5J?|$p4Y?KWv%xZy@P}MBSjNHUcg}G;$nZSs<=5o+jJhl
z=>D<G09A;DUH5U@NKFs|BWuX}?@>=2t#9w`74B`QG}zwFk_!n#;v+3a0B$*2S$T|~
zCKxO1Gl@T8+{75X0~nXhv=CW9%me)j2D%U7*P!@78@T$3Im5N{&_d2KH&?YEzOq<%
zXPD{^!i*e^&F{pqQjVhqBJLX)D4}1gtjkQRFrv?v|41~j>jJ}I)zARaxR1y3$o+2a
zAl-R0)kOwUdNBGQcv)@{YM$*0$Un5+v%i?r<G+605_ejD@6t-+zWOOY%MDN~&Ahf>
zGRM-mp9(Dm=Cf3T|NF1O`@;nF>1zAEGe7^c-3qrcI7O8Wgia7T%<nWl+weY_lbwsz
zp!)T%JXK##_sT+V<II!i$4i(Hqq?9w?zX!;_;ycLp!HYl{8$=M&)v<lZI{-YSh$_G
zjfz>b$JU_*!ovg-jR?(N;Q0VVq|Ubgtn?{!13{Pfq}*@d=`;-{GJwKrR{#14_-M4|
z<8CUTsJAy$gBy)d+8bH5lCh+;wt{`JOU=;$Ygq)JZn7C#{=7^VlxmB8bXK=ON<spm
z5Pkt03q>XH+X#nfYiU(hRyKO?oS)y&{RB!Vwx8w-Eqj2(l9|pZC@=aSzhm~=o$OdS
zqSpY}1$j+SP_Z8P3dAwsVPRnnCmUoWWOYs>hFGBmHP5MWqCHIx=1Yux4W@FUsok!B
zF~^ZhinH=QlE;pe6A&1yeFchMtT9^pI{y?<0J>P~0N3q*FVirgHz$(pWd7I;m1*Eu
zoW~kD`!4;!-Z1w0lnW;VbS3a?Kuu{k5@RF$T$j#d0tBW14xpFqf~jWW=H}+P(~NUp
z|ISQ)oP-nIl}gfyzX8r>DgjW+c(u~q3=~^97+JR#E#!b!hy$<-bq?MjQd{u3*~<z_
zB_|>AJi!+_-Ts5RIn$&EYDBsU3a?~kCk8W=m6T#>__|k)BEmW@ByVlc(?uFf@pl&<
zE-m989VgW92s!#}<V1s4;v-txr9e~(q$)62oaFJ_p3H!4uz19>pn3!pX1xC_Gt!n_
zO!6uMSNLM28f4f@Q)Fi8ybj}lO6a}^(~~$l9oaB;wP1nTCynhk7WD`?ByEX*p7*5;
z&1GpUb?WQ)zn<E-MGjU`+2s`a7zb)YOKZvMqW71;4^8#NqS|BxO$S0GJ-Qn<z^+Y6
z;xy9lL<zbFK)KlmX%^`Ac+E~Bb5{D7FTO{SWa1CY%0JfDOy}HZ-}I#WPTSSWE#@^h
z&(6;Fb2SbNKIp(Cd^U#xE%y}wV>!*#?#)(MvQY0&R-nd%Bbtz~a&dzRp?ocs)+Bxr
z{f_u9G-POpVzTX_i_BPBf=s~13M9m9wQ0`()Nf1!S3X`wM1VB3#6Xvn<zm7A0GHTQ
z@}&7h0QjoPevH!t2ml&hj!n$Jjr(ZU>eh8><UA%&A{R}tk>Os;hrQ7=5`|CWW_J|H
zt&(yG2x{M%n5A47g2fvZ-$u3Rm-N~Qs8(@u_gDIP90bk5^jaSN^Z-<=jMl5pxw?h%
zMo)J0&1{)}@K#_BLA4EJxNK~F005lNVsGp?3o_y3zYb+>C-;~veI4PLX2Anv=Nm<j
zYlMTBI;EKIDDW^OOb<ROQoreY$qZa2Y(|p_UOTrfwvwoQD{zm?)%vr#7=Ru?g(NK@
zW3JU{#wIIxsUn(=(tY)jIw<dh7c*leMiVZr4?!Rg2fkO;IrV=V|AwJY;$pU{&T3NN
z{6gWP7V4iVN+<O(AY^R5z%q6HoR|Yt#qc6n*x9K>>_^8|x}Cf=XJD)6$zj`g#hgG{
z6E!t&+C~AlVos>6<EWIdljlQk61h?5+d}KqJi^UJYrS~R&sGL`R`P1u1ZXIER#P^w
z9kj?1JYgN#Ju63j3ADSD(5tQ)*U90ty-+6?F2E`6{z}$g8P*YRM@bvk!wfmNw^;rO
z-Y=bwk(rgpp#TH5<Vv0h*xtS29p=M4AAmZk7-!pp3+Ub00dPVuhw4D|z0Va^wf!Bj
zeB?M^qYC{`S+clYPS)RZHQge-=U=L+xpCn~A{1Dl9~^)F<>z!HU()C$dMwJurWN8f
z4wXN<Zf<P0(`z|FC`k)bkMj@Ao39t^+WeXsijrlxao7Lke!gR#nuj#^#xH_1YG}iq
z4cNR;Y3Yfx7gM0z(~-S@ME{%zN>p>Qtbx7sp@(aag`zUnPuO9kkiqkq7ALaVw5&>H
zcfiGKvE0IE`vol?ifJ5p8sKz3f2PU@CBW?mclB8S!Q;rRAchpn{bp+00#g^-#b4qo
z{Mrn3w#jQs(9VtHdnbJP*A3J9%X7lSCU`-9gx_SsDcG~eW8O<W=IzeMyTqBIrdxE-
z)^<lKuSt2^9t(%7@yTf>W{}&(<O)Yuc@~%TZjOjFms)<8@4gsJYb>2mAEkKLQ?&wA
zFn0Lc)3N0h4|r&CaBz}2jIM#fOMf$6*l3xieP;vq@#`1(&lMHLf<LZK7(Dyr2D((H
zEh-YfB*lts7p$&6oxyPLqx%&WxbSV~tmvD}5oNVohL*@mq2*-3M=G6<5`R<3L5!}R
zU!D;Ad_HAxG_G0APRJS|<VAPrBksBTTNGuKRbO@Fm8F-hPezJ>>ibgW@AE#N#x)_T
z+5%4g49|~YX5#;=E29#EcBiZ0xV>k3T876fLsE2py#<y%AFd`o@6WgRU+mA>_2&NX
z9psxgBH6B-MRyc4S$jxRu!RQgd__7RBrJ^ZhiRN3nu{0zO=(-+?oI9nRnB%<xhxs#
z-tdWCoX(iNxz7CWn`CO+$x>>6BhZA5`U%x}GBCva0uHMGE-h!{Ki?7e_xE4aKL6ht
zd!UEIy>`a;Zcl~|M)K7&4xB*Xe=GK{cj>K@E(sKB9B|Ynb$|ISusjni=f4%bA1G_P
zzXlyil6R*g`B_1J8Q;Eu>ij*rald^q;(j*4E)@cl+JzPZMh^81K)&|xIv0x|L`O$o
z>4`g-u5lR3l=zpOCkInZR8C9%8X5|IxVzYk<D;f$*8i7zfCi_<$&tb|A(#8p5p|%@
zXh*IPp2Z0&(pS;0HqXx0fwKkc&adh|!1li!A8p13UBAhz<Zfd=skdvby|bqH+{hU6
ze<c9oi9FD6^Pirq_cKNROK`xybL&u_^lzX3-_^fh^-x#*)9YN}uPT8Z-Qt8k|NeBs
z|9$(uUvlt1NH9Cs&qGyH8ms@A>dpe678Eu@qB7#B^f~VlKL>1N)Nef{*Pa$)F><LG
z@xMN+skTR9-Cm|MmIU5LweR~gUj^3|L*+@L+Nz70USr8$JeTkJ=_3$Pjur!F2_Z}(
zjDfSwltH^pXSM9_N?Fb`8GZHc&GU0u&cfJY;DiJ^x@bpT3jWaD8&A550g0UJ(e`N(
zDK*wX$=hLu0dWDDkx!`XIxrYTdGjCI3vrzPZNxciW>hS1+ok17n<+C+_E7lOF?3~{
zA;ZQWoqxp}_f_piY@RQWN_G*iX?EtsTjXxHlE)DdV5rDnTzSZ2$&U!gljoT8IO52U
zwP-ft6r`47gKP~A9~z;-uU<V=#GazSLXKmE0y}x`uQO7uGxtqD3eJx1z!cav>c7d_
zQ~RTS)+N`!P73@cB1-xZ${f|+kx!uPCM8SFU^-#akIlw5dhhd93aZn=Z;<_@{TctR
zDRNq#4vC4tEO|_1>%BBemc`PreX)80x9p|!^d|Z6yUEr#97^)0D&9r9cC`TQuSb8v
z`aV-C7q+xXV_nxAe%vG47$cE?Q^EmS1lvI)3U<!b=x}!p?z(gC(A#gKPua)5kO=(T
zffuk&l?SAKoqEPBpnwZ4Gt#tuUG0<x<ub@H`_N;flbjeWUN~S_-K#QOB7KyH&nPqY
z4Xt0PsQU5)DQ6n<Hi{}fjHGyIfEz-Tmi{#%<53ZNPM?zlt^*O#E7Tt|@NY)1i>}^J
zBvC4i{w-`v=I^(gdpx4u;wkSOWDrt+x|?Lcsu}acR^iS3^+2RR>tq32TS3);5=&z;
zT);O{NnwT*ww8v&rfv9?wcKXDo2|h7evekF`6iC#EOCD!;Ar=Vq1fcJ*POx4d{bMH
z+Lvirwn~+F%jE9u&Oy6y`TWpzAB|q~!OjX7xLf>dVhZE?j87wKXhp=<StWTUeU^|v
z=}X>4RJKZw_MU8-3uKDH?5DX-mO)dWafP=sUQ^5N^G;EI!P?RV_i0wRd1%4h%W0=^
zT_RQI*w})KDr_;5C%JrsyFxxyYBx1MoH(X2(BHmrxG2??=-`OH9jt!5mOY`yt~H3G
z|52~*vF8lyRjb^{*=p8L!SAN2x`LK+<u0*9M4iMGPAoc@CDFm0122a$Yhnq~e5x~k
zt}ZYCeR{6m-{-}q3sWUoGVeX@w)yeH#$YL4rd~MsYSpeIr$^8wX_IrR`StPcb_b^@
z)3~FNuxF)Ik$=8QR+}xN8b&1wp^@MhtM(jA|3%ee(pVEKz&0^tR#TciR1n_e^M2xY
z`ZND3iUgwkl0lP-Qq_eeMC04a<}2;>_oL%44clj)J$V9e%w;pDw1*kIw6d>-wfK%F
z7E;M#Z~a+<u}?tHX$9;36{h|g1phX1V6^_xvjvkEP%0++ssxB@jkEyw&wa}5d61>a
z?{eN<A}~O#iS|nUL)?8(oJ$-MS41QaSt3*0-=AicJ?Bt=uNNiz><5F5lVeMv+7=|g
zKj%(g+{lStl0P58C=?X?RXC;5!G<sKN~R!({61Fepc02N@paZKJfwxt@wYMK$!%Ml
zr5!yN241<?O=Gk7*32U*<f<;*f}Uu#4xAWj(RT6dd?YV<iRxvpzDzr*+7)24|K+kT
zFQ#msGQauH^4V%kWAwv2s%=>~H!}Dv@P9k9yz72E+cY^gO&f*C*QiLtKc~x{b;%eL
zy6+6d_T0y<UrWo)rDQjM%VHukUIjdbnf1TEIQa-pi58QEocpWy>vxSonkq`V?_*6G
zy?ZrC=BS8^HgROLH(OKml@(bU_s1+P-KQ_MCi*rOo^9>8Byk%o6v?xfmC7?(dG3z4
znSB1#=DNI5l?1d@+1?CvlE7X*fzVAcs!mmI*12qO8-o;$tZbs_GS|q1dRC-A-}X=D
z>U<;>vvdD$a4$oNCF+jNZ8@CH>GUYtQx%KjcCDz;LGZ$M&!EEbhg8c0?~_I*1IG7x
z>ts60>bA%%v;xhZGvoGVhCS<?sa;M+m2c*fVrsvB%%q!qy_+**PL9DXcLn+won!`4
z%)xxXqhZR@Q1W4!NcvgKD^=1Jm)0z`aDAVaBZggP3mF%3)B)*GvqcA<hpuE>OKeuR
z>6@o1ES&6OuOA!ZykCoF!Bh)7M{<mUSOm7%?n(K#GaOc1a)1C(7#1}OX8Ev5t0ReX
zNLb3rO+%MlqoCHf&8QCalw9G)myb^8C>o~2&Z5388Wh+UNb9ivIvU3CNI|8O9#|N@
zoeQ*2j-$rG31HUyoH2O}2~VI$=3t44vyd5iT5)!(v57n+;Ow$14i8q$a?*5(cvoJZ
z^PE!{OD*#3P!x@lOeNeXn{ksctl@B84Wam!Kiz22rYG_FYQB#!m~#$`q735;5)+fK
zz-uO$S%nv3|8XUS3Ujb?r{nkMJmCn#si$$}SPjCF3J*yze@cGHsDjdtxgkx5)!y^>
zmXHTaEz~vzolcrCB;1_idncQZcI;(bNP=_-hWsH<qAW)`u0%GDWXRRC@O*>@Ydam%
z(+(3t2+H!Jz@;jV7wIWFZcubtI{=~x^T<R8_+Y`?QS$*708CTk5-kR#VB9T=5xPD}
z#|@p9--{&9mij5n+l<dnwKel#h3GCF7j$L1tyb69jZu<sFUB#9d(gZ_98;QfL0NE;
zvYB418f*lgUi@{x?luFzuT3&h@Al?O>|b|J2xE0YV(eX%jdw8%*JNVTQ*V2jA3>+(
z<PmlTGjX4h`YX|JWK(26o^6xg(_`CVx5BK}#zL&%w4h}X75RxMqkuwD0T<VW4$O|#
zX@uAkJ!f>c_%ad{rS6nI@I)~4GBWZGlATk%x)F&0Ez14J$+{TWx&wDtMOSa74ZeOZ
zH6U4AlVPt2^lDZdd9LGF9Sx_sE6ue_YOAz$2zpbIa(1#2^QZuht$+1nYbv;@b@#rK
zks9wn8tmEqz5JN$?xPK^1k!kd@I`^%NPR3>g9J-kzw+*aB(?{kl?t=@{7!iu)VwgJ
zCl5E0Nvio35xdA)*j*Z&E^L3HDxnZ*X{mau@pk@#u%!55jq3BP409~;IgQ+w9L8Bp
zUL<HZdiav0KA1LnLV6mZ>&pDI!`ugtD+&n@nK)>6;G%)X2`TKab-|M~6IH|#X>a6L
z^RS15t#&gXuvrrY?(cA$q^D)QeV}lwk~!S>Y4Oz(KTqY>)Vd}cA|7HTXO#T0IBcJ`
zOT?oU4inAK+Ubbmg?~LH{)rHY$A}ZKXi@HcDC#(fXFJx$`w*roE!Vis!P2x^WsVkr
zH)CI>Nb*v<M<F~s8xKPU`xfH>)m)l-7M&Pbm`d&6P_lD4%O$pRH1#EtVJD3%-S5zQ
zSKMYabXSq52<>=`<c_EMST?fH#E~#gqXG9o2dg(|m-cP6dN%4UrgM~WJyKLVZamIJ
z2u7RiGrTa&Z0cMK5+uob;?Ik?8sFu=cOn&pO)!wyuihyy5&Ga(F15Le6^C1t6I^#V
zULp;KJvvO_@I|gTB!AuhoF(*fnz1bbennQEAAPG)UB*#}E%QN-6QW-wgw}(vygM~(
zV`$4ZDfuPlcqC?fVSF@w_z4%Mn)^fvh{_3W%B;}y9+Ae7CZ}hnq<$*Z1+TtO#&N1p
zJ1f!Pxoo<VJerRc*Y%_9aO5ZC<$YoL?_%DeASc<S$o}CM(9ztlODw1-FB@`5(iulX
zP)MSXkOV2ek2z-0fT}!kB+nz9iTg&#k_u;m3r!cjEjTR=^ndEx4z*W#^~{JLR#MCX
zNm#BaF1KKft@79TlG=Cs@keH@gn!*f$OO3|J&->RYtH>$>%WfrTBaa^r{EAQg~%{Y
zZHI{~`uBDxq|*qaC9X-7IvE=gqbm{p#ZPw!6t2{>$W-Ryr|8I8oy@U!3^Av*L(y~=
zRn2sm+z4tP3bl|59$K}qpmG8~SrKt$hb10i%%HHUML~U>IvI7ICAmu?Q3T`gquS1d
zcuc)^dMpIh;S-N2sPtfdEC!8rhl2)+kQ@^L(8uGIb*RTuXvlNbPU7NjxiSPGxr_xl
z^&o^d@lk?8;^>iv<Q^gI<sezh2-)JIyHXXn^7-UY`^hk<goS4d6o=+#lMhD!iN|6*
zeEd7&k*nbEaIRtMplED!Y4v)H&lbF|m8PH~<y0tX*@Vz~O5OIov!r)WVf=1cYL&43
zB^6<a_#tKh!BD8;zJ0m3OmT=^EcvTNj1-iM30i&qa-wx49^9Y^H692XP1PSkQ(-cN
za16dhk^(ezwJ^SHXp$UrJt>g|p*Xf;J8wCLp)C6)YGx!$J(~3|neQK4=5}Ps(M5lU
zOl0G!g+40BHk5sKOQ1PS^=ip3g}`!&<B}vwmOlXV>+qxHMfnuGyG7~-m5V1TA%m{?
ztFnByxcy6S3c#u6td2D9jjE}sqMIVIW;Y@{UbI14Z(kZlC6!UHhq{^bH6tlAV3&rs
zmLoN5pkBy0Y;u0A<8>AFvEUTPOj}|RrV0wniN`T(ztI}vd>fU#Byfqkyoj8Fe}MSv
zig#&FD!w@>X;bu^=tKB^cKgo%BkQb#stUV!edt3Y-Q8W%jUX-EjdXW+DJm&a(%sz+
zA_xM~T}n!K!+rg}@6Ozr%P_+q%-(08z2A4$UcYCZ;L!Gc`bA`JhA)CS;DY!ul=cRu
zE7~<4rMb`2g~q|P<Wop<4pwZG1qpGbkoN_QB`2O0Bp!xAlJ^GaXwi*th*#m@g!(_l
zqjUpngclSIQv;A4xh~}2fZu`5irRMJ`HDK%8(2e#5rt3#=sF}hXunNiMNqd?>12oz
zQ^E=GCDjjA`a?wK5w}!fW=_f<_84_By5U^tJ5aLW;?aux&<HWEhcC;mTtt3`vSWSr
z8lokHaRqBifkc=*Hqxdf!bTTfk*q812PfM1UXdI0#U9rhV!uA~y#g1~i!c)^a)k{{
zs9^fM<S*2*XglbLO@0s3x!L<^fOm|IjJ70qUq|zS=aYD`DUaj9g%+K?iO&i*7KP!$
z=aBS%5rq?XEL3S8THP-t7rJAL*bt&!13xQCVFOdY?rMY1-%tN89HRz{Pa@a`vAc&Q
zr~mR7!EaL{5zPG!TgFh%1~?88gmZ~V#SNQz$V=0iRjSrzE`$l=LT44tW>)9S>?SQ@
zRDPsSoozMSzw3f)KnKjfc4-9P)(<+k{z<<@v~wt(>p2QNKj6j@zl+0QH|nwp)gm-X
z)WL?{C{eNI`ZY-Ow&9^xQmfTD`9@X`<nSREQF**+d3%0FhZ>U)yZ>cJrr6tlf_1{e
z<EL)>+iliP0i*Gem0jiI`Kq+J`L_}MR8w_qFR5^62q^3;0h!SysKl}Sg70vWkHetL
zJTT)T)#a1Po8j2Q_!TjR!*MO1Vjt#o83g`qomAr~Y!pgd8J_T^*$PIrskUavv{LPR
z<(UiIYQt{xl_Fl5B^(X;7z+Y7cg_tjxyWWy0i_5AO7s|0+Rr`2KKM#4D2sh7rhV2q
z642Pl`VH|KL~;nKN+gC0ze9-LrFvYHSUi*&R|2L3oxe{=fP6JteJI4o2jjs7eHnou
z9656xl@Q5(<3&k?Mh?R=qWii!w2#Y8>H=PXPz3>X66RgxD+qg3f(yT9&x#A`GVH`J
z4D#qo7rd{iIE8bqE<W4yaAB)hNG8Iva#wN}DsoZ#ROm+t938MfutG8@k&PpnTSz<r
z5-P%(5~-<&W<At72i_@~)dwM}SEmN8D@?tGoINrvM*_(Cjl)7+FqI+;0k{jrS@JcZ
znm^j#aK0MskT3D*)kD6ge5&Y{s(?H7-i0e-9YKI>HJo-AlVG^=YK+JmXENsl>B_bg
z%G>@V(^;>vT4}GOeND@nva3_<7h_=-W+Kx);VyV0u;FIFr7CWy+fa?(!<Wuv0@F)z
z5y`Njcp_ooqmY$tChyB0t>%KM*}vj~vrILzqo<3U(#Hf2MQZLt;3V^q3pd$#*@CAM
z&0>nPjA-5WmNB|`>tjziCjxUW&I8Q21fNn!!U@|l+yHRQKeYeQo>_k@i;Fg1k5)02
zVt>^eyn%3oJQiKP!Q29)-<P}|{@N4)qK1WOMhMH_7g&Sk6!F|AlOu)kGunGyw}rSX
z((ScL0#wX56P~^yqJBdqmBvVZpK#|-Z^%?G|1!$HDNO+Vr<l2Q)l{fXZ($9tTMia^
z82>ucO+M9<ZRh9Q-aR^N7?fYRJPx4{v@ir!bn8A&0g^;h*otVT6Re*hB)J@4X)Za5
zSmh#F){SmRg(P5>(J}krZxG;l;V489?J3dO!>TyR{3L;4R-1(5d~pP%<t)3HuSc+P
z>Mq2>rAiVtRIa!%#RPDILa}YojrWp~enw08AdQ%@;z~m`<&Y>IAQl^TH^_*+bE*gu
zk*u9CZnDzh5K`E1m>aC12uMZbA4+(t8cG8cUsTr5O9I_qpRek%P)D{{)j2rVc?nUB
zeUQ3f5FT7`Kf<p&-k{gPL_hBs3Xp`I;BQK%@z%`sY&6<GP^M}vRbZcWo^wCITK5^b
zpleD9eeSRSg+Si}-=fwww20`Xm<oF=&EbRb1mG~HEoAilZa2tTuy|SFJnK|)5sWR!
z%o}Ec<DPsUBmGUu455zKxookpSh`_<bLij`Ub6gS;Auujw5xCZu6sQ%&c?FT&LPCd
z#Z}Z&QZZk15i#3&=XsP`Xl~^}JTKm2u4pSM6A*nQS~*|#3X|G2?dG?+Xy_yxotByr
z;>G?d`)b{ABwc{(sd2g0$hNtO%5j%yJ1vn}T{{K^QKQGe-6hF;`<eDPbFsD&aBA{`
zl?FxM{AwboS>Z$rm9s;&6z2#W=5bR#Pc-ffnXSsO@Hyz}<oNuq)4(;mTf8D8J!3P<
z=x*htsn;8<;tKW2wp%di=kDL2eDAo}Aa@oO4r8Wg_9A6LsMteeh+?r`t4Jz2Km)&5
zTQ2;VibA$W=NCy=i0&?;jwBUs-!Uh#7@YW5sH+QHMTo#Itav~49U@0VNWd-=(r+Fr
z*1+Av)=A8D`&0lyqr0j8no6L`$lo7;G$=(}QiI$Dp+s)$CE&#V-GiEGDnyD|+^@tK
z<+&bxZW`smg?$De32>aO2<tCfD0rd$%tJ_~cpu?0BQ}?ch&)o-Uu=hAm~n0rX<xZ%
zb6<q{o1!{|I)e}uA*=?4wIs~3Mm}pxmGzndI!`&k5|vDugT`F&VMTqHu9-^ahek%Z
zDLa%g1m#x_!Ogl>NrZ0={#T78;}dx#6=D7R(kd6Wx4i)^dR0po2^L{vlyA`&zo=6T
z#l!v#fp~;u^uUR==nm`A?AYVA+H6N-xX@ih5x0=XkUEJZ#2XXBn8?wb1h$}=n+dRn
z{DAxn>8hJ&yFJj>^Z1AEm`q2R6@yia&OJe3g<D5&K^4J@keY{uZIa@uK!EZ6rPh=J
ztBWKd<`7m%X-eY(kEbndO^BeTiq52pVwQ>o%WOun8;{IZh~AC&Wm;?mW0#%(c&3LG
zDowl$C5lJm?=uuIv|4j=djAVXsNX&wsYgUGj*=3MTmW}__>il*k0hSv+?<1EUeVg~
zF13aiqFH)kS%Vy#wB+N!QSGCLP;LeZfTfX)+>VD~$%U7d!eXW*dZ-~*3DrzxFcM;e
zh9j5$q6ou6ci$4DD^JKZ;k`(VdAlEi^14s*7e!a-phRdw4LJrPT*ogA6e@h<aFkSx
zeaqEDhuIzlLYS>O#K$@|=mKfb7yl||Gi0=ITNmg9vfLwPKW9l)GfXOifgQgRmE$`0
zAQ>t~IO84)A!^ZAN{KJY09gPKx0{lQ6=FE_l1yLWi8p_^)$90IC49*WJon}738{7A
zsR&JW5jVu}?xP?2%%=+?bXQJdKKa*2S}yFGl0qUVDLph;sQ5~e%^PxivF#{Xh;T{*
zFODKC>u6qDE;ZlpP_n}0D52;v?em-K`{x*@=QI@(L`j?B1fZMUz{~bPZm?N(5n;<r
z;T&LLGN>TPs%*zgMz5364AHdeK8!{8nhMZznK5ZXY7p<>I7y%4NBnrqRHgs6@vGu#
zBFuO_Yj{1lKkfbgpPi7A)KyTj+YilOw2z6QW}Sk9&K*l;Kg0H}{5CYz2-^rW{bsEQ
ztd}z}VOgmwzCOoRW#VsBb0y}n)AOi5r#7&|MK!&{K$4afAmxkf(Zs25|7bU*p%r0C
z{I7KY#aDeXRwOT<2qUT=zbuTdA@!p%QnP@Z1}hCATGY^ihs%ef^fF3T8d3}rN$EF7
z0l!MJ+RW36Y;&2l0R$$Z3_3Dt-i9Ws837lXV>VxI`ps*XpRv9{uKvp7xmZBfv&=B>
z_61_Uf~u)d!H{<%{oqtWoc(~1SL=<0gn=A{;%A8MFCvvFO2Qg=O~%OQ9`n{avq3%N
zsDSs(Zg~W@CzOMX#5a^sW8WKf0KN0pMJLI@jt!IEP)>!NaY0#ziVs(!Ud78rE2M2P
zw>p^r;EAkUj1FIF2us>p-5;&N&!aTz(sQ)!%o&0@3J;Tu>(!MqHO3)p+d2EjEqfp~
zjW#V&zG#x*5fmgV749}Xuicz{rTSgfn$}K19(M={PN>H`70J4n?iU{GyF`Bm4_#Do
zA#$BwROws_cuGtw2{hIaMY5%z9XXOby1RsT5Z4-LRap22F?5z4#Ynpok-Sw}DVao^
z_nqsqgA2WGGLcRpLL)-oFGKwaKJpVe1l0ob{kjq@qHt>Wf?37Bcq*Du$As8$3sY2h
zDupKcw>TOFO-teko7q;KSuNsduy{>FkD3PShBla(f>#eEzeqezdWzSh8C%)SeoQc9
z3`$kAO0@epf=M-{F4A_+;`TfIl;>KA&!HOYQiRCPJ&ZPRC_lr{bEHY+knp-fwSHkZ
zg~QGxmQMccB2tO|V2UfUKhIh$h4>Z5G9Gcs)PROBnYwwI6p;;*ieXQQcHF<?wj#jV
z9*ahZMywPqPKATkdO7Acog%8<Jg4|3Tw_DGWo?6lU_zogKl2GfAj#(u{tO!nCumX7
zUCv%fUzq!mvGI{JE>hmD${N)sp3>WwZiM(}_$hbd5+%A_fkxiSAM_~y4TXix>M%(c
z0$h2MDRZWuuU)tsqLbrM=YH5wgh9Ub9G*Z~Bb?U}TZoQAAn-k?B<nnca6;1($gHp&
zfMO}}S{GrU&an%fL7HS9s)mJRNlA$}Otu4II_smE=}(;1VQTQKa9rfi&z0pX!HOUo
zsZ3DODqs2Tx;!{>;!2vHO*PltEah&C_{XNHZ5k==YujXj>>&xfGB8H=*)N6$ET1hw
zG1wu3=xXlOn2$E@OxEWY8zF%@YPeEVig7XDd10T3MX}JPH4R>x@gm4*^+4|*pCo#Y
zt9fC~6xCj8!QiseXyRZTz0+2UAgU@wmYJ+c!n`Yo%bEAi?3>3li-I$||AGaJTWgWS
zCiO(zUq|X}@&W^Bl7z(ggYiaArMT_d$rr-c#m#sPA&R-s096czzNz@%sR=V1=yH(+
z>-xGd$u+RX$uDGkk0(P{iv%OK+6UwNJff2}yaeF1``^}3q9*2`#YUhohE%zEX@pak
z08Y|{X>l^VcwgKJ^eaZa8PPIbbO?ojLt?TE?*n7X3g3vCWkJZO-;*5AX45A*w~=)W
zA5!gb45k`{roQ(lChsC?wnB`{$?CO^7t;(g_c>{M2?gL4HXH=hk6gJ)GYrs9der42
z)J||VCF&RNQ(#r0dv1~kZ(7irdILBq$pdnFs0pEQL&enElDN96aN}wzIr&nd>Ng1A
zB@>prCrD?19Qc@WlOpr?ZE<%?3c6xU_qYk5bcJw!jPz7RAK8GFi<YwC*m{96SSII-
zB3Qy4TFQwrZ1w^w7cDXrS<Cq%%mvl~wwp9;NjJ7%j{2~$H$xyw)w<uq2b+7V)JFS|
z9v_ioQ<@MXI)xH{aeB%660u|BMk8s2wR}UT1s}iHp#@ef{AI}WDmEeN6cx&%q6w2m
zRm0C{#T=r|eqCrU;;yc+hUXn&d-QMu4$%T9QHLtx8-R+0H|dj(eXXgBIkG`EIO<NN
zK<+z-%6cM6CxWhbg7E-5wN+P)FtX9Hn5cUhL&oHl(D2qF0E5OCwgd5XFMkbMB59tT
zD#ob`VE{52r8IL0GL@j@3E(p(<sz|0?k>JAG*Ca)Ohq8*c^S_^(#7<t4Z($m6y7}t
zp<wo^cwi!)<{2~0W6uNqb3cjz!BL2=0N%DVT|=a!DtdH}nhOQg28L_WDK47UHqQ|4
zaNSLiB4Roz87qv2Qj7gZQ}pP1biSE@A*!SeQ!~{<B=D+lrO|OExJl_o7l~Zh(E#q;
zR4#IBJscw*6_FIl)y;bWUx0)>3{3#0%ahUUTZ<k2BW;GHa4K?k&mWgq4`W9RElz~*
z65b2%3;VDas%S*RH#mLJqKliiT8NMx-oT)Rf8oRr8GKtKMArB?q(F#qEJ4@cKE1tK
zWboy<F>OnHTYJz~t6%Ef;j@JCu_LmP;T6f1^+=3<RP3Lowm&Cs%2N?$Hm3{Wn4+4B
z3aV(icEl*KEVKcFqOznfV&%{N6$3|!YV)Sww}v)+-Qy*t#Fm1>=+4H*<+GHPp=`7O
z%_F+iPPHisRnw=0zbA_Fi7Ms>rlO>%1Yxj}K7>^fDO7+{MRV)G-GNbiBC-to9BE(%
z51ogv?k5&Jt^ScV<aI*$S(5kj2vTvsbv%IP)2*lMgnNhD_^3M}DKw3svihJ^h0?(2
zVmkL=2^eBbnM8@Xl#(W@Kwyxuka|WqF^m(Xvl$?R)kB^n3<`()kO!piy}_I9zU(5X
znEjtl%19-;joVG}<UY?`J=)|XWT4PWifHz0`Viqu5krhmB+5Q3M8o@D)MPelm?HR)
zc6nXp&64hY!wVsxM4JmmNRFpWDHaQlJz<ZK=wSh6@t)cfm;lsc;R;pZ<NS@6g4jmz
zaXlKG7*5F+vDhudc~p|bI&XRyT-XC(xm=LZlKOk+HnduZj1w%DpF?5Rq)mMAz5v)^
zSZ6$nK$Kqy;t#hM2ShFKPKlFMq0hajF6GlPlp@Fy4W!|+i|>>_cEnZ%@~9!kCir(A
z?A<o0LYQBLB9_M9p25q7P>P_Y^kC`2i0w7$m@FK)#d@K|u7xJJuq|U&_rjftoZ6l+
zi@-Ja`qyA%o0a2o5b@rS3-#fsB6FQUBPhobm<&n}vU(F)zKi$!{=(#wknkg4rRS#!
zgt6bGd2xOa>>~Q{i_>?^es505YS?W&j9NT||A%Mg`x<!GR9ODr7bhNvIIPqH`z5{D
z_0<|ZG?^{N(Wf=g)ezxzM@~w#H+?8RYUF}7tEVrPG*2YZ3{fk4LiRWb9ym#yBKtRB
z-nsJ{;Dw#=EJM79lkq8NrEx35uGfv{(aL*vd}@MZ;lK6baiX7Djx((zx8SUP8QFFY
zLxwYJaM*Jm%4f}rB-vzFXm?*l>0ejTMTwJSebpaqif0J>-tE&hf-VdST6nl*w1AI_
zADK8p@i6<GlOD`2s>RmX7`_iWJZlL5I=uja`MRYplDtdg&lbezaFMj?(-Za^Q>FmJ
zY9)A&=u*f<)Q1g)RC?=QvB~G=<NdTZXx~RvwjFgbe#FySzvGoltQOH~Qf_Z|S#5yZ
zuS3cLa}WG$AnB4+5P2*Xx{nFRu{wY<s7Sm~WQf1&KOg?_{Ep5;?%aWyC&*;$+Kv&W
zjdaq77va~;_k7R@v_SUR|ESg4d8Ec(X$lvE#9}<(hCGh`XN}prArk$Z-L}^{6{-TP
z#6C&KFw|*@Uy|t}u%vXqSn7STP5**b^#4)KK$reyRHZppL>?oHPSwG5X;RgGl$t-v
zVvr+)6!&H*%%NHN^4c<XSwVF$H*Ft%w1q4pZ!}g#0!~$BF06v2gw8w)T|BH{jx^Dx
z;1v@LY+erDE8#1iifE5{M$y<s3G$EO_$Q3K(aLTglOd%wt6Zq5C<{5#Ob%hVHW<VX
z;UaPor0=3oS}hn*c?GX+tMP1VUMRo}eGZ2cuEgE*J!b8clclC9#>X1G!bHa#Vxtx`
z?bB}+n!~osf#MD&6raLY=3pyOA=%~3tCi8^NTKTW$^SyM%fS_i$DD{q*x$Se=4s^_
zjin-LlCRI5ubnD=DZ(60=@qLl!Cj(?c<c6w1!YkR_r@&WgUX(2T;-?t4Ht^uf!bt3
zDXI1kYCCjf${g5PY2sJ?^n&}@a3~H@+wri*x6}0Vh_%1)HRmb4Js{+}@Kl6QnhiTu
zN}O3KSX#wv@wnwbJ4h0dUna4bLn|lqY>W(G62X{=5gMe#Lf8TcQiqB_9z1hX9^H7@
z(;66F8>HI0lX6N3+g2=we^|FV{Tyjsj%J&%Q|TeuU(Kesav`72<~-gdn>TzO^EAkn
zK$#_FUT0>EjHbj1h-V0tT$1K>NOrOsQ<9N(pQjw%ewWxB#@Jf=GXlki=F_IudNo_6
zGVxo*&PDjB>FmnM+;TL1>BIx|GO|i+-9z0O*QQ=tIS*VJ3&(oA&r+?1t#+sxx%%X@
z=EBlW@xn#=lGG9FW<G>gLt9<MHdKMRbHf^<=3BM!EN>mZ2n^d{EyEMYfBF>eu}4-W
zY49#7qhi?mE{%pvzn^b`=XD>gv|^3vCx?UgzhFgFVM$22<^%IPJDi2FisaVzY&a#N
z@l-JcCr{WDg)a^w4xB{JT9h#g!Vxko8SpVjsSv~5?Cm4G&IG0|AvV7ZulNu!Mu_C1
z9iVen-fv$|;AKU8pu+rJ=pE9z{25U%XXKoRMKY8x9xbv)4c|(!wQeWU$_*|Vqw=l)
zcog-mYvmWWd@J0yl2n?~JVR0Dt$`k>4e;F!b(53|UyNZJ5`?V|VbM-GEV}Q;Mb3X-
zuljQkqTK~7tz0YG{d8Yl^Rrru=n@nQmYZLyQu+|Vc-d|_!^3}*Eha`oV~k@izU<|>
z;yIW6`SVSHnDUf|(HyVx6i}}M(IBs~+Cl67VbXR&>3N&`E`WvgG*&nq?C$gBMI9gQ
zY0?lpM_FE`l=8sZI7sBoW|=;XETgBn%pASD@D5t>UH@*wS?^D~9Srr425+bkk3K5~
zUoOyaA9E*mt4f}7V&O~kE@K7{A)j?q{^&AP7Pj8WyNYkxrEI~<syOVs!`x~M5>alg
zACbEfxJ*(t!@`x|`iiu&t}WPG+m5|xpXx2)Bz;upA5o;4{X6ygw%Ar-<PP;z;JIPW
z;W!%B$LdYN<(!S5)V=H*^|iV>cquI2ioqww#{f0Y4jotWnyOMwgi1vu24gN-d95b<
zUqMm!daV!k2Xm_-?UMbY*4>VpUQH1l_@9;sPc<^Tnt}-L7ZV9$E^x}@ruHQS%)N#+
zDD%$*V(IObXbZhW#tQb83SXPsn0t9W#a1LObYr=1wlTqcUi2+CUJ<O`N0MDs;}8zg
z`YXDmi~n_EmV$Q<*`!<OueHYXh*2gXu|ojOIyKe_PlpZ%HZe0+G417m`}XOv4$h}n
zOS(ArHR*q+bXx_JGz#}8TI11|))7*vMuCOg7n&5(@K%3KwXbL_o{Q+&5=8rHPnXQh
zOVG!WQ{%F*&KqKkI8j4P?m@cq%ar}EoXxXcN`QR}QOp)h$QZqL@zwsT`ERTTugI+t
z2UMhIU-XnQXocqqS=uOtWFoElHVCUR_?w?p$?B_y2a2KFPN=jE8(kF&PZ-+~NLf%_
z!)PMlns@vajV@mG)Gg~|Zlu|VopBX04L7R(@IevBl?{L%YcuAQTQzoM>XPQ<A3YQA
zPCICy(OzO#^fvruFxp8dvaWew-H*t#bdgFDaL<Qt+MKu2`p{lcfk@%Zx|q4V_CEeV
z<;a0~qw0J3VO`a8q}}3*jkn^c7kO@HS`gpQDzX+8_a#fgXJyNIUl9P@*~%<}){mG9
z6Kw~fWb-{8jJcbc%+qzFjje$hN-u|2<ul5Hi{Gz!;{0(qu)@K)Lk;ydK5jpdPS4X3
z?tVfQJy~;}^G9y%`gFLc4sdN4{{Vjs?+<dlU0w5pilU7!OXAf1`-0ZUHx6+aWB>3!
zsk~=u?5^7WC#80i_zl2w_q0d5-wGuS2j&H<UN*MB^IOxIZ$JIl3)=D!{9V*$>i^=l
zz~8Ooe@Fa3Kfwgx1OH3$ab2jsiSE|=1A4|dfkY@6`<6BQzx|sdp|YEBz2K;4`hWib
z+Rn*J1O9%_4&&q1FaJCH)|$i=@4fl29LX_p(7O6Wwp<T$EggYXT3QNvR{?zBgLH2E
z+`i{r_5b=>{iSl_vCJ=aCjbs14-0gif`csob;3%k;Zj9d>RD(0lcC?bkBc_j&6IVr
zeg5CIh{ulakO+Gnz+sBSXJrAnUs+p~Jh(LG`+Cd9<KxwjayBN=i5qcY-Kj1ui)z)q
zwxH3Mb05h?h4}gTv7iq;g8%CnUSI&d%`7bTJs~jQ22|;Ra=FgDGaHLcZ#fg}l_h_R
z(3fOerY15=y%<ZTqC8z#4K*bhwMgoSlagKKeTKti7OGdxPAg#a_0=28p8wtkON#!N
z<)CR7|324}uBV*IfMs+%W%|`#jM<@Ms8?UC<x77(1xk1*6)Qj%Dne1skVn38<1(_L
z-z-K|!IvW|>Rg?M6xp`DuKsVQEh&^S1_<iywOd;b*si2UP*i)cKTqp2as6ZQ)y7pB
zzO*_OIR0=riyuSHR=u*Zw%loVd<?6p<vITI#y+)Z@5`$3x7iK)ru27B&;3#_dz^mU
z9@k*TOuu3sapS)`c6A7xC-AEeF4lNNEp6%S{4f&q1N3^rl!cj1G`C*=!cg0i%sosB
z)Oq{zM^}x>$rb94I#!^(r&8+Y{f~w~OB?@XOCy15Mm!l+gc)f4mXQrAvaQoF7{TZ^
zAnP<EjLDmKm1VzDjsW4+-@ESI^Mu-TGs3Yw>2@n`>i#ankQZNRCW7lVpJAJPl;{4g
zOl}0P6~%lGcr_MS{P4WBZBlG`$UZi9!tvVtdNM(5mdHBuNC#?`TJ(CZ+51=uf)Z2o
zlC!3X3_SwND*=qO=R@mk!Z@yDSYQ$Gk6M{Tn&QQi(aJb8UkZE@Z1m{jdX{1q4*oWa
z6X>1yi0XXONnQ^cvj@9oIF4PFB!6L1{dxXiNmpP=$Euk6r6z)t%}l?q20pAtW-5~e
zNECfUyf&2&?w<Sn7lXd30A5SLQHO7?i_iQos#90jc9I$KPkD^bixRZl+T}^V#|Fcq
z%#^aZ>NSdEiT3uMD*}Qst?{2m)gMuLjYJHhoAGcfbZgyq<9mgjS-sZrSafEmZ|*OS
z8lxjtUM3`Ru(234__#g?J(`=FU-{iG71nz0&wB3j111BHkkFlp+=cV@qF(p@Y&8cX
zD=84l9LcH|3kv`F=+Q0w^cmJ(c%~9@?os5DyWP3XUr?s3s>&Fs@9(`1xhJP+j&r`>
z?0lpcsVf@)I@6{#a<Dym?X&rU4lPp3eP`5uB2Pxe>x!Mn9tSN7aHAFg5odFA6A|tq
z66I;9Ev$3(2QV+<=Gpt{*8(wT&sP-a&r5Vonc9ZxXT$r>6}qjHVxzFBd=}p~OEnVC
zGo#ER&}q2E^^J_qN3YkM7eG4|#?prJ6dFmC8DZ00k|?Ty_1vtt_>+MDks;M9Pvuc}
zj;@<U1Ltv*7C_S(ewtCC!xq3!w$=0cc?Djl$9rbQ0IU`db%<^H#tFs(wHZK`lNDnL
zZ#Gi^LHQKmGk`Yk8PhheqrMH7N0G%5ShLrgUdBpO4KiiVLl2Rt#Y&kd0e1rgBknq{
zm@R#eVmP{<K<BPptOFHHx46ro=rv$2&9hVAgR~%uCKvJCelEw1@C)5R19dXtkM*lf
z;uk)zBh=~s;<i7&s}xlH!u|*p3UHwzmU{mLT+jJ&<>lp>)H1)<62RA-WB0Q5P5**-
zTPmsap3Tf6Qk6lt=MJ3&z+V2;)p55gef6!-XayV~Xszi+-_lVV3nAL<gqQV?j3OeG
zNVNW&-KlZoubjEYdoM+9)n1G5&%LwMi<+JnihD(?2f!SF-$EY&+V~Ggo7arh_4QSC
zZveaG)fsl{{8J7qeti?lLa?ktT~Mt6st9&vz1gDp!d$P*Jntw#q^v%l&>+ajfJY=n
zWsOV{wf8fU=L|8!fY!>IEwzXUBl=LGfpx#0qg(%NGwxJHe&GvSn#_;&;<feS7PALL
z^;QeDj~C}0aUxH^Y=b%QxF|Br`uKlh%}Z%^7CrY@fgtWv#@WFuhNrW0Aj@Cq)}EX0
zxZBPEyob8r#X8H8rQ=QlC?cLr8n5r!Ift@OP~V72;C<za3-t>WDow3SVdtlE=dN3z
z(dsz85(ad!d$>>_oXg3n;iML?G2O^>?tTVfBK{JGE9|rt>7#<5``&(0X1bRiLG5k|
zmnGF~a%<gM<vP!2_s2l1Uu5gF(sbB`M6O?BlVF?vPj6)B+3J<&^^mNk)&2BzpWbMn
zSy|x($2)pgD(wEE6@w%yo@>5u?YajJFaYW=8L;bO2|W{e_GxwAAUV)I+)RxFQ3YCm
zNkzrOaX;ppEbbZJQ3*;_2Id`mUTR$#nE}9)YjwN)ONK`!%uf|ztN)MX@ia(5BP#od
zQK0gyYNYX>ZQ<3?3sa6f@a_PSM)?PZEk8fiD@v??OKGmsATGb3*A5en+9*cte&rC5
zQ0txzw2>&i_<;jz0_2CAr`P0cY;29rLC=5U)`FfzClh4nJmaeD(}8FUP-*`O=1dtk
zPkkb=V0o3#ciXD=ua?t9A5E<Jjt;%o?g4qo!TMCseS2BxDQd~Nt5i?>%VT+_0&NXh
zGM1Evmavubl!I+1)xHQ`YrbtdTgaiy@6&_$QSyY{wxd&@0*+yfTgNoGpx~pJ<g&bZ
zwHf)5vCP3grP;5SDhK|&TORvRWZNWnNs%UEISkaVm>mKeTdn8YRD;sM-1u)b&h?u~
zCz#JSVkJ=V@X!D$-M_5|T;YGVUbZ$+z8|VsjHfJ7%W$`dw#ve<zR0b5-68gMz)9RZ
zwWzGjeS7rzZ-z6F(Q9f|mX_+(y3tX>zeu1yJsv75^0gyquNQf#wQ^g~NMB30Yz$Q`
z#`?PnEh(!qZVr;>#H}0omNqDqynpToto&_2T3TAd*~f20Ouhz$+2h6ge)<Xu3T|$l
zlN$R5m6w<GL7z&>$`n6&G8fm2j102?z(P4=%;5g$&!LZJw@sVQfu~zK4hSFQ+NIOT
zsuWc4>Ygu#u5`O~zao&opIzWQ%s$v>te#^}`q<C_s9{EPoj^Ml;c4W)-ACjbKFWse
zUV#5L>3Tl7gmD-w#*yJ+>cr{yqhp!{Nv>B6P0y>}vV*fOc5sE80OjoB!b3|7U@+$P
zKWR3wekU8Kqro0g$K9&*UiIC&<X?T>l@^`=96{0R$%wyY%%+cb=yR(APv_NLb-{PH
zb8D+X$D%T7tG>_SfL4>+k=IewX4l&%17HbbAM;Nx+{ah0*QLvKssU5Lu-?fC#7ba6
z1A>6n)b^+sXFEfhi05CD;||~_Y@jk~9t;25e{EIe|Ji@TM~kIwD)*9FGh3}JV$Wyg
zK+P&#d2!JYapR*r1s<12r*?`x1M&Ok6-+T!W_GWpx;AvxslUZXKV>!-^Y>K()d77@
zRFsOUcQ#vYNXUFzUZp(g>+3mQ$3b5Wsd@XT@vf7wyfUwZqT)h2dRm)wd@?d4hO#01
z=>;B}^z`Jky-PoD&4`2L2(0uXcEg67B#y2ce>DF={Y;F4py!jt3}?h}n0xdtQ6-!h
zuHW9owhCTy?X3%y&Rb>4FN4HmF?bU5<ru1Gj=BsDF?5&tYSzGbxBS<iSlO8ZkMrXI
zRsm4#xTq$w{#^KV2CJl<4d|GFcQBH0NMD1;1Ocqc_hIi@OIv%@Z7}on^t8J3f?6uz
z^paov@$5sD?ao)<?H-uNW~ZgA15}QGN02Qx$9>&R2at=j1U*g7i)<tcW)>EJz5!b3
z;NKh3887V-1D>beobQZxKc(A);2^AbJv>g#YiQ^N4TjiFJ1_=EgW0@VWG~Hc-Vah>
zJ_xw}?i={v+;T-6cl6K5g5&(2JFjI`pf}=IW5QxFd4cOZ232c?Mt*PP=+NaDsUlYW
zU&K=@W69vwgy2fPl1%s5GnKZbmP6W$h*+f(4ZZM78EJGpzqd#_hw7dNUIJ$mN3nb`
zIwm&dwX?93X01Losm@_?dT}BUeENI$1<mh28G+62bEWmx$tVLgxzg!_gVIpvwa)v;
zsujAz!ii5b0R8o40WcynoU7JaHZ~7#7F%?}Vd3<?fZaSXNBE^eccRF1ALDQl2Etxo
zC=_t9TYN6g%*c9kw{*;1UoS01+{tAY7A_0-cjYTHGfVeU>;BQ>J?UVh{nYkWu5>&l
zt9~6XZGoDknwpbSRd@ATxy7J>u;9XjM1y|if&&bsrLBz_7sVi-5f_EP+WP&gGfvUK
zwNSWF7#K`)F;*59MJI5g-tZSvX#JFuAz0*MeixgiQ;Gy^58Lg>7k9+(H51d)BC&`?
z-ClWU;zpdz9xk<C9kDU7efaPx(DSEF(nN#L?b!>CZc?%t0U93n(L40&PN6E-SFaY6
z%U{QmWeDAl;@QteMMrIm4Rf$EUR++LaXNj?4-cP@&6}TdUVR9fbILTPAi#MXe)od8
z@a*9Bym&0@^6H|)|G7({l$77k!$tL1*W<nS;X*hTvCvsE6$d(s<20~UF*^uQNk6Oa
z*TUZ5o<T8DNnW}|WM~_JIN|X~^vJ0SfWJVt#WgWuA=^!zGR$6B`2I`Pd`U?&L-*~U
zP&n{!=Z>rN8~kSFSjkTJ>DbKn3qMi$1R|m|(vesa5RNjVz`8v5h6DIOS49UaJH6G-
zuUr)sl_u=>cw@SiLY?GNx~jSjZindrCsAOiFthJ@xYV@2){H5i*eLraWi7z{{)((r
zll$<HNxgL1yjG4jF=lwUai1S;cS=}DXwkees9`;c3J&S}z<@sM7vS=r%!do(<7EK@
z2Ui&m@=E&KQKz_z$XvUBT$X6t(q=RkHH0#v`Dpp}>OK<>Z;NcPiDbUJ+mPL$<!$MQ
z5B0{y<G~k<v;qRmWv9vZb09W}jE?NQy?Yf#sgfz?zPp=19Ns%R<Js5Z3iI@Y)~~6f
z1CybL4f!NX<F~qqq{q(4x(rk<`C)^#6I?XWnBHD)55NK0rUx0S_HZgmNd*`icga?Y
zd7t*3<Vq)D<GguzI1dev7RWlD&V3B&3Z#ngzdkH4o28N*8Xn8y+j7M8_J;HnPEYs0
zjvM{TWyGH3`22T&`Qc%K;%5$%-FefYTPrIg=dWSiH%|e7!P=G?kOAngV{i{4IUw}d
zClfweZl7Zm@ab!*b*ic&;d6cgZ%m!A+7_r-s2)clOwUQ#qiv+OAV|{WkagaRMBFIE
z!?M40+(mIYJR}kP%(m2I(iQ-QoC5fUP?NKXnx0uLHzY*#{tD<>1q6jn+P$QuG^%4s
zNXUs%sFVP1f8V(~S;2BNo$p8R#qOs$<8qQ|h{NOGa(4oDxx&fz>*H7w(RAukeT%~c
zi@{h@VJhe{uu=No2H_xe?ru$im!9&rwhkWCH(VBPFO6fNRIq(#XJ=nK9tN@l>YV;W
z*=3IXn5fl>J1VtJVPR%TW}XSZhz6WKY@e=zhUxwl(Zk{7pw4?p1O~a-a;@||KfMwJ
zqRWcE#Hu%ajX@#WbUpa^L0s>b2vsO0bb?hwUH|vq9#!o*8$6^$lezN4NVRV!5n7b;
zQqx-SNzX{X#d7MzQ&5me(Br2C^H8iJYb!{^_c#)Q7x>y*MxB;RSN@ns?X9hGftIi2
z^5YlI#fXJ&3g>rs_48d13HCEyIxdz<-?vh5*d)ZeFtI5YYAa{+9fED@A2dH$r!?-g
z;(z_u7UyYwqu<0~F#?{~W0PeCFzzQ?lX}j*k5(0x+XME;GU;n;ox8YR!210Cxgh--
zV~!B5N`Fos$3&xCbE;^Zk&*SmVUL@_`IzXqYkzAC83LBiYK`ytQWE{`%?$)HTV+x`
zVIzw{;&py?2=?QcuKmYP?}IFFTq30sGBVnori%8aifkJfmpeMN_Gd>kUye-lN-n$0
z@D^=}`!zWAf4Ap%0#*p16Z>XnF4gV+K7}IzZ4DW3`l-cW*-Y8Xef|zUCkGc*EUDcQ
zaHSb+)o%!cw-y^S+pqs#wiV32&zJpJgWeELL`1^pNH1sJS0Hajm5XB%h$oeroYZc4
zp8_Oj@1U5$kB!L0jrv#-*%)ME0S6_osEN2;RMq!i8IVxH6Mn&Ci`Yv`TMM{1lGiJZ
zD2m1)TBhf6oy+R{7v7F=KSrYkTHe$=1>P;Uxmyoj3y-i2FEu+}Plh~kr?Fn1ZGp=H
z*o~$)PE#GeeQlQ{7k>R87u<R6Mxz?-UkO&PwA6a9#W^ec_4lu2{%N_);1?DWi1qQ^
zO{?Fzdb~&)a5$RI?N@|D($vy9UhZ64_;D-g*ETy~xm=>d=d|Q?KW0>_dAHc&TFW(I
zxdqsE5C~dSI=JCa+m%biNYM%X#<A~X%4YYPoSrAO%Gs(bz=Og#IS;-cmFG@7h#S-7
zOeMf@sP{A55QwGy@xHpt?`rvWM5kH`>YG*1jRsjCs<p_j)?aA@xr^*a0r#heyh6pm
zj!u8CL;92-uRBCMzWX1;Lb_HO_j_`sr|7%?W$APyDWdGGpA`zVKO_fCUK?P+e;D|^
zzJ4+p0>hkK=X|{CZat3A&;o(*^EbN_a9CMc!a>N3in9g1+4<<Lt}*ZV9G7O>U&n<$
z-UW60kAJT;fPwhl-ts%Im7RZOV($vrVy-!NVy-TkuXoN?sV14PHt~6N^PSCLyx8z7
z_w6Wv?glq`lo}Uz`#(P|-%{M)-gR)91q9Ulu=KMUv~nM-J$=O#gI-|%Tf|8}-dd&#
zUmpny3e&(Giu<U3KI!Sre#@Pf+jKQG{-xyQU*CG`H05o}>}rVD3t~2W#aBKz8P#tB
ze23N_0p&~FH7u`$Wv*(a%iS8#II7?H91b_y`(HmY&bIo<*B2=ZH#v{He%+O@HZfuy
zc>!O+MF^|{J=A7-cOuaL^2u+|8~9aC=HxI+xq?Z+E2~(l$+h1Z`_1xj^CO8ZgFl<s
zHBXb?pgjl<vc5fPK*4bbEbvLA&LAMR{(Lx*Mna1IJ(<X}GX?{xGHmy{T5d%p(11XS
z$G%pTl&CT%TaST7xZVq>vJ4+dGTfLh!D%57Xs%6dhu5F&ut-#zzCQYoB;L;({el#u
zNRZFTDHP(a+-<IZn4G&77#V#40?4mZtW`N<ex4BX&G_E23V{Dj&P|Iby(wm7X5a?_
zsJN$#hfiQ1ymY16U4<S5^2HK>+_a3<xPEV?FnlEQKRMa>{8^EXuCRQr(s@eAb@t-g
z!rUAJ2@828ob||WG~q(4BFa-=r;;T!Qz4%ukHa7&AW*SVlklenSctv)9e5;!PO%^<
zr>Fck_#Av`N__WaKDk{*^fW9V%m|Zyc-#TT*22SL`5(X^YVlpVsyHBp^c?t7i29_8
z-6bb<`dv(y%;YhkNn+uD*!p|957KN1Bx`4i-K1)A4+6<(auN<Y+fl3jsARX&R@SEP
zaEeo`;ymBs3qpwMPyU|!Iwplit>#G-5D1Li_|QKD;10$ih!<zU-R=UYB8bc7-K9bE
zF&YWC&vJ<xxcj2+SIfZbt_7Ws(hSBv2Hc@RB<NGF_ouEqZKvWxv@49^Aiws?>fPLe
zi2jHiZ|!k8>|&WVf0HrMIDe|p>+O|vw;uH~)UC1I$A?H*d0ov3d)@f>WA3hD!k#=<
z8O5QZAYzgd;$!>m?oMd!ckM28-j9SM9WT~<-_MzR*t>o>2`?{i3SR4Cwp>Y<uPnF!
zyVdaVBU)`-V7GnBf<v7yE4a$pk{JLqNJ&oC(Y!cbDz-ITz8lRrKc}c=y`Lz~R>c+c
zo@Grh5;M9Wf>4Um{CODo%vXt1tdvzzUHZb&iI1W<Jw08~Hf6wB;x0WM7!EEp_syHr
z?D4G3tJzJi>W^;j?r@OJ&22!vniba_<G07=w>+bj!`kO}goV6)Yc=-hBN;GdMPnQU
zEZg0<^;nMII2}|1_^F4-N1DF=;_h>mq!xh~YE%>y&%1P;!H?R^ngC`A2f@Y14+P=Z
zNzE@z>!A3Aw8qPF=Y!W=5ho`T7RaON^o=SXp{U|PXVwr2&9?>mm2JNFO_Wd&M<2{o
zk_?^;3bu-j?`&>^I7DK~<3mIQ*m_y*F1>HLf4t>h(q}zoa=rVx(2@#(L;CM3nHI6&
zH;A0(-?S?&oo_tEjar>Y^N9bl;RR$v3tc{8{+;PG9sm<i3VQU6DVlR$hKK0ZAAN|4
ziP4)XzTRIkVArW(^}k$f93ED1-CS+)EYB%{LR`)Pw+HE}*=`~)I9tq`!|(=BopQrX
z(gn==Qr3bp-1ZXZud$@w1Cp-XyXzB|Y;aG>SK3g*OgV|&&(E+8nn>rXk1_ABvqimO
zAe1RT?l1SwpBikTA%)r1z@+p?p=mSY!rfhFa^EU5FublUh>gW)y}d0S&qRXkUfey3
zlc8at_<`Md(0ZOn^7<16&-U!0Fe-i^B7`$tDMfwiCw~3Bue$owD>4aqD%#w=eSW9!
zvac~oxHose_c~m|gsj8oDh|f-tOhbLGP-Oe(s7rva)=)<4}5??So#m1%uMoSd%cfW
zfV@Ymz3IpCn+(70<=YkU1Gr0nnY(*{EuBfq+dZ}Tu0$$sTon%onc|rQk6pHt`|P3>
z_>x07NWkr3Gg2IB8n5f`kgmrs)yA1g8K?)V_Nu&^up#idS|i)X-8_xHQhmiA#L59R
z`&X5brl!T4H{)-_(o?3HxkP!~K{0`BsX60n)?jBWd+od*)9Qoe#&5bGj)_*IspMpM
zTgUrz#X203Ag9|M;aT;cyE-|&ylnLau(Aw(7|6`b%zf}36E*dLl)^A@NB7rzkKex`
z-(!-C1YWT!YwWNa-rQd7&9WJI*~~fZ&#j60oVbjA+>=H`pSGE19kH^qN>`%K+96=m
z3%Y)KM79`|m5~kLv<Aru2JO50o$(#f;b7aIp3)?S>~@!p^$nWtSst#`XH3)4zmbu&
z^5MBnmgf;Lk9Spu_1|r{6E3^(0U*&nA)eDl;`!SbHsfH=haVcnL{XpYmQ(Xehu*!5
zUpMVE4&MH`Q1DH=s;X-APevNstU<Grpr8=D@r|vjDwdC1A@}$>uX1#BqylZ?$**5E
z@mQsrU>*!SRhN9yyP6Z!6!m{zB+EYK>%s22%ldk+n5duE@nWITQd2nMh4{&oBqT(W
zS%dlWZ<c5f%jr9s;K$@Ou(SV>jdNP7VjHX@U^iBBT3H;K;t?w2l9}Xp0)gg6SakdS
zx6?m=KnY<=sJ5-_&Rjv^n%!vHPHTxz9+QW=+*7DjlQ}_-F>!aU_zeKa8wZIEx`G@E
zB%%kOGWb6zDztm-mQ0iwG&}fmy~LaEyb9>(Txw9cxH^k*TAl|HIfpof6k~#%ext+Q
zpF=V{q8F1TYHF?tojqn$RHviq`jy(y{jb-r9FT3&waYch78@_mFO}uqdAoVAa&Ry}
z<<zDDR1l2+d6<Z%@H$*ZhEV3xeIj`c7CsW<4WRa_8#=ijY|4A<%uUd|=8KC9KEHeq
zmO{YAjqCGj=M)dmPb+sTtJz<@;m0f898f7)EA5oAOvV^>M%+=H-;V)-`T2QauyClT
z`|$V~XPe{V_xHDPM3)KyQ}o9jqFZ;LNbvCRxJ#$k#yR-t=@~g)Hc!l~>bD*Sa6wT3
zliwSuu}t3K>xX(C807RKJd|57qDVfGP~6J_oWQyBR94S+A@Tzg@h5$$Dfvol5Uu_B
zZ4N#a^+QYn_j}5dWV~ek%BH}jw-AZvuE5oFUgUXO8nDD=1_r<{sDy-34q4W%=j2!^
zr^6%OFwlP6_Yk7Z0V$zxTYDUdXqny={hz^)V?W2buGd3<y!A6wRn;^!)YX04sBfE|
zC|_t^1<vo7!3WZqAM*0FGPAS93d6%rfHQko`J+<5VRy1LzrG%4q%Q9@og`MCMTV{-
zbE873>aIr{Dic988u2tAQ>n7Kx#pkmxH41`AQi^LC&nix#$G?(IXVj3T6~#5p{uJ2
zKGRTDcc|_l;SYm|sHk~feqd)O$x9TK_5dPCj#_yh@oPVSe|}r+oxQCMKu6vGgF}x0
zcY9l3RTE03<gh?3R94$wZhsyT(f8Zjl@er&CQ;;rKME#c0`J4_7T6%`fF=Afd2hKE
z)IX$^G(G%eqh{>1$~8fWqCX1bJsPG?spiqq5wNe0YfY6&NmC%T2C&*+m5Mu?1+)M5
zh}%KLkGFYDLfj%9zz+i)yK3p@--oad59WD!pz@TFkwQSYzQ)UbwEBny>Kjq|7IW;G
zmv_WqX?1n_zkL6RjN1lFYG_y&WD05kj=o&<DJjWfiO<n#rPYF$xKQ2JK}pF*PEOU-
zRBEayQs&J^vY0&H%l>Ri`DA@MAxx4_vYr2`HDoI-To4KNr1!35jEN{1C^0b(q_~8s
zSZfus)y?{quj8^$E>DRbhll80YY!8X8pqhL{PkKunkgXMYS*atiA30jm%d(*lhSlo
zF&y0JyQ{;>>QYJQznI7}b&O2djyJu?wN|Iv1TR^1$uBFZ_ze;~Jbub&cmzc9=UZAS
zIr=1-*Dt$*{(Mm>RvaHXm?|ca>={Hr0Pa|`RMX7N3|>;nFYtHCMt?WJfq_iD^658f
z{Q}zG&JhTt@w>jaH-FYnw(;#b$$W4-4CJkq^;)NQwezttabuf|)I)yXARQeY2C=eS
zzHBWQ7pRw=DyM7jdx(sWY@QAOwUflcPJelMeQu$rl0Pwj*P&keS%DS;dH-s%{&gJi
zs8M`&9=|t#)cmSBso@MZF?oX-2SWM}{n}XY)(i~dCgP0>WE2#~+uPq=ze=$mPnKGo
zN8A{T`uX_!;p5{=K@A!m{&|t@zl+pVxj8i<c_jcgnWltKj7^M7$k-)}C8bZ`2x1!c
zq5=p+oxSkx?yf;jPQYasJh=6e7yTK0j%VNPs|yQ?{$BXKf0d_JK7c|CmCDy%$~c3D
z)#z5Pw0YTP&X-x-H!1)Ajq*Ve0;x>rC)iR_QDA0c(O|{{nM4~%i$?1BomRnD%M|ty
z0Fe(trQ(MO9}xMy^3heWD`PWgH6$m;R+#coQc?=(&eo(h(<_p0_j=D}(DX(HB#Kof
z6`Q_K;LRi(&Tp`n@~LSyxfd=;_(L<T5Fl81PbW1seDd=8)+u0li;ROQ9CnTD#^hOc
zjr80i%QIU3H$!S~-o(xC+JMRcD2t^`vY(5*necFxe-HK<NQGwXJi!CPE^Tmq<&(c|
zTC1iT>ps=y<*;_tH-KBK=-=Yc`@!Dr<Rn41R}w6``@0*&o7<v-BIZpLs2RXk3VHt}
zBznP~{OgW5eB!OsLWi%Z1Z2>iyH$xk1rHzJxYf(?clkfhB4qasDo(Km7mXneAtfVC
z|2A-YdlwNEadUU~<@1*(r{V!qW78V`^$%z=2{UbfQ;;yl0=Eyqv<a#TgHiQ-{)Ttg
zFc4_i`p(YCIe_Zz_>xPQ*6I%wmdwnwf#7qc#S@ik^YD;todOcXBT}1eh9&j8`}Zr!
zi;m;z+Wt4u7<(RV_H)(U!k#fI#nyzgBU3n#5UjJyQ%ha^Y2{L62o*$vIe|BoWnLr_
z0uk!W`g3c+@TRDsP>&Vggo4A`y7=tOjpGd_1k%rm{XW7h4M0Kx4gB<8)E^2Zc`Yko
z!@ISG2Tu!FYGBX`uG_%M{k6NhdthLI$nr|HQMa0=VTbL~tbV>4R>U{$%8-??Ge9;4
zMUyXIlI@HP&nU!WKH-hBdKz0(=OJ2h)Qq~5NthbIg<w%L!9pmf*}7$+ROK@YeI~R0
zhHU|YjFgnj+;v9?ALAV-9nNn+Jz;s-P(E?fcXeVytx$byXQx?3X}Q+kTh_|TR&QZb
z-q~TH>+$D8Jt*%{i;zyYb3XnKc5cpsfv9R39qw%)L)Lv)2M04Kp_wX}rba*6WB=Hs
zgG^+`j|>vBr3--!*3!x^G_}v}d8mx3C`5+s_<qtq+}+jHHlA&9Ew~A#pnBV+D;HCz
zU#SwS0&vQU4*)`5{l;OA-WMcaZmr9!mG5_MN0*w43kp$S!Hdy{n|{oJmw0(6B7-mB
zBWNp1O0Y6je6!~4jO4;V?OmtZ$fVVaZSb7A&}|HfhZdVjhak70O6^sOB9uxJ3$zDf
zzyCHhrQy+@2L?j4*_s<|VZo1|duFj=fl?n!zmJd4J9MgK1!O4EmzQZj^#lbeI1FuS
zb)it2{yvp#(RQ<Q?N&p2%8m1Z4{Z4EPx*t{?8dB6DaXoMi*_$_dnw3(8r*><4Ln2!
zn{@DSvHg0e_78Dm`X67_=Hwd=i(dNT&S%;P(1x&R!^^JMwLGj_sa<4iNGhY2hhV_^
zd7j!F$&}E(vUh#|kS*)_@{}w6BkSOTA9SRSuN_5s%C)u@)LePlTs>S4)|!vE%5{v4
z8bY6*u=V>mwPPyoz53lqW#Zu_3GL88%Ys4ogE|&GOTUNBTx^kT){e|29@RIR++GbC
z2~V+}u#f^?WeM=*fU7g*&H%*=Gzg)n+uQcdw`$iAuXD|a_#RYRnR5|Pyk)Ao+Vqv2
zmdReGJxR%AbC{*7b*7ZeVNBfd&Hn+OW|za3LU?Zo{4_0JYyqR{@$HxNFIK#1UVyFm
zT%4_Bg)>+;=d^4yTOhA){(IYT>3F$)(A6*`ySq5rT20<nQq8QM-c=z|Dxl@^??S%L
zIC-n@Ef~I3r(bcbk_k(Ni$x8iTB-?V4ZICp_9|mPvok7xzinyI>p0JhH8Wr{Q%l->
zIKnXy?Q4^d^-15+l5h!IIctY0hC59eWGZd8`?GrIVrN%pet#N~pSprX#*^Tgpi(Pm
zS$BgNG9Ww##Ut)C3elhr(+%qS0W_F*P}KUASDIqV^hr|eNN*6087OI)692Rq`3DQQ
z9i+-uZbu5S6b_gpV1Xd?zJvj*Z?;lDQ^d0j^bx#dV{26=Nu*_AVd)eR`9|XF>!(1M
zSO#Xr1`%PXmtLg#i%m8WHeKc)fczjjmYj|<eq<A+)v$W5Sy5&6d8!w9vg}TmS}<+`
z0{Jil#>mwB+`5JLLSP(b>Iwt1@XPTalre1EdTYk-Xys!He&X|t)LD<2v;-b!4VX`~
zwZPxphu*!edX!w;8p&vKjD~>ry;L^*FyJWjjM==@GF7f`{ttC;85Py`{{bIxKvD;!
zMVL{PkZz<$8j+B0lnxP4x}+o|Bt=TPMY>Bsqy(h9K}urinrHj_-+Ny^Z=P3=>n>e)
zEnp7k?6ddx`>C%(Yp!B^@Xe^7cP0yCyF1cY$1CinKH`^D+K)MZ8!ugaA!U0|S7{2z
zhCpU5zx|aT82A&G@XP)6CN4DZ%6|Fs@01B^8ykGN*UFac{K@0mBK^&e%-`#?V@&rf
ztm8Hg@o&+{O6@j4SVep^NG#FmnReCr?QH`cjS!mmQUUWm58TCY(aqSSMTXjl05a*v
zatJ^aT5Jrv%sM%|A-+kB1D%|n<`^`J*#0*5L;Oq?292=3L8XwJ8*5wl3b#XRX=I7A
z`qB?A*~luh9}d$?ekicf=BryL^-fSUkiviQDv<`*;j*%a+a<*w0A|X_`@C2U85tI0
zLiN3`j}O58FAeG?@HlexUprI0fbc*%C#fzr^rNpo_jeEptL>0*aab5C9Td4s^KY-&
z;eRo#_Xgd9f4XL|CKg0S5EvPGyqjS3l8zn|b|J#}LC#eYf+`eWI-ysKWpN^}A8p=*
zUO77w;O%<sq_|91=$;dhJ@&GlZ89**oT_pFDBxlBEcRg#U((yajMUQa25=atG{~r2
zHx3d(CHBaY*WC+Ti}LyD2^Qok870SX$YUy}_U3#R&yN#*c^r`<D71aKu1Mispu%Lk
z5iWR}ViPGSxV!eu;*EP_rhi-G`Ej^RW@Kb!Qeoj}$I8@>3oh&o{4{{U*`1$F)qJ${
z5jTQ-rS@6hnxs@w(2~7A`sP+X!J5$1pDGjv2kc1$W;gw5ZXwsOYmJBL+Oh~c>wBV`
z*C7Z-6_m~75JH0d^XnEB)vL4VQ@?L0P%B(tUkC4K_`SQ*(v;)1NAe7$l5iC2aXh<z
zUP=D?Y_)w)K*0QGL}u64k^v<}B12ccy>jZ^24?GGwS4uwxw=kGeA*sq8L6%D+VWBD
zLbZaIbG4mL4M34ArLB!#-Gec-pEXBC-z_fJ8If+Sx^oZmY-nKBw6WIJ1+xb_^w1X^
zw`Hi69t4@lNB8#rG}pO-ou^qyPS64RO#re$5J>pG3uTdp)F&nR`?p=(TpQO-TRUY>
zc{EY?_T9U8kqKkn*@_)T9XCgK?~_#X_`MmF#Y=K7)-0r_B(t5Zvg=z*la-OW`09iC
z)9CTmfCzuED1Fe9hR6+)0Pu)f$a1-|SgDc1jqPu!;PgA~FG8dimo`0^+1^MrH^C(J
z8)7#W{vZ>&5QDFH?v|$U+DtB=73;}H($n*szVa+L2SW<buaCisy9fC)Fi*1Y!`RY=
z{vHDk4uelqM1%li7av!A9%7Ku8toFA!Ae2c#tFkB3=1pPe5f>}Sy-vupX%j)1h~UH
zpzKvtcoN%XTD5VOZ66gtb=EQ0e?0IZ^ZD^ZHa7A%>$s2glJA6)@Ats{Ro*i%F0B5^
z8DT#=dEwEBGwkviR51VoIqD0!g#|UVa2VEI988q&DJ6Xuu&G)NJ3K$4w<Nty2nD~#
z6W>GU>s8zLdt$u&5P}hf`CNj6mU7Vt=tBo5r{dA|4H_I2B$0b`hr;t{0wBQAx{SZb
z%=nYAz)KJ07~hTINxh@Na1`)|KP=qv!yTC#zfZb8W&iXDeOPKEW-9K-6zT^7nidd7
z5%j`GK#MX{W7SjE5k?iyM@0ma1iZ|~!6SU>YkNAf5|Hnc2Tm?7F+FB!o(CkZ6n+R!
zqD(awkgizh9L*4?u(IU$4U`kbSDrdc!9TptZ*EPO>%~r5S1M$y?L8yO8!8NxX$6q2
zBtVjj3%<~dSi>NMAk**R#Bz!-=?5{{hPAzf4b=%+S4*-%y4U&%VUo+D-D|M)w>^*S
z=mT+3dyl&SZLsFanF$JV&=n<%*;I8{6B7`D8zSny*bY{rnBG?inqS-kom<WFkn*-u
zxkoDrZRf<JayCnNp3gCJoI<$n5Ci+45w6Vb`Y1N)el$(^HI!u^=ub)YlwIHGt2*p$
z3%l5+7FMy-P*G_cs+xHCLJ(CD{tW`%gS}3G0X&v%`o-{oAHmsT%im+h&9xY)9WK%@
z8xSZgEKD!x%ETzJHp6U>1<}&dW@Kh;rD;8CG$dNMH#=s^O-%pjH9*Vhz4q77l#>2V
zmPqJ=qrQC6^+Nz&Vm4DxtGvT;X*C?MI$>NQwvi<kO~e4>()u69W%3b>S=>Ww$i2!`
zy(inmw|&Q6Ss7{>Xa%EW%FWNVCL(U!IHng%24aN256TIBu&ZBTs$=`4H|dtqZIM^=
zb%&euqV5ba-P);12a`7MN6wCfcUV6P2t0T+nWOU;eI6c$Ai)T*h%2>O`LWv9!$9$9
zJ+j|p@6v!i(!)cBNO4;)2ani{^(6}{v&5O2nJc9Vl7O~n!gVdRapx%pahH{WgQGbk
z<69H!gYw#n3U$xyeD#8K4&pOFy8oGOd>Gel%DtXPau1w+&WGRo*2~R7+rdH}D)69*
ze>por^NYc4ItpAY6{gr2qqHArPkAeR2tp2nVL$@2-u0h9zZxksgM2@J%nLX%=P~cQ
zaf5)=b#`pZ;vnzC=c^a5^q)*eq|CADm$eVJ?m0-BfL;pn{Z$4iEQU}m4UJ-zA8#A4
zd0pnNkZ{~I*gsw4G4FRCsRI)g9YiqQ!3z)+VWy~{D8$vo)(PPLU~fsV>B33ry#y^L
z&v%-SR+lw;5~#y-be|bmn#Xjh>*#c#J=5q!cf?%<kC$-%eEG6YP3?dE29Xund$@JX
zxI38l<8#!79jB1}##zjLaeNo)FYQ%XaX|U@VPOGiyC4WI0fVFR0C|4=XD&(1qpCV#
zY`fk?Hk=BK5rLxsW5CgT8jlDDyvgg$U)l2dv=E}eVd<Gg|Ifr@)sj?Es`z}MXw2uT
z07C`4M>f+utH$TX1n%*aTU5U^F-e~gs$C%`U+h#5P;qms?XU*#_3digCBgWWnj8lQ
zEG#S_e(^ftTta7uNnWm5hh{<e5|_XD8V$ivEHfi~@DTM9eu7y<pZHu-bKiBg9lQrq
zcLMmW+tCf`cgfG`P(PlR#wH|$m4<-(W``Bn)2-0=pj;-Cn%i<9s83IAh&_pI^+Q`w
zAg^^+As4Gb=_1(p+EA!b5WGE8?_x&aCM_M9UZt6@e&e=?DZ0we%xr~@jt<l!-1%e>
z=U1QRj-G@@ai^S^7@kfiFOQ@5V8Epg9URqI_omr>`z+RF_KlO1K#~#wsvo&*Y3mwl
zzQ`jP0z20z71497hb%0hFT8W-&f~|ZQM++Cn3$T9^h{Obetcs_2I!f9n8S}jOy^*t
z6TRBKae1u+IdK<><mX=vubw5q!~3e6IR5cB0J}C0-7{;y90F<+OhY}1`;?KV71Y=O
zghE2}UJM`P=*&$U#Jn4%?gIH;LD9`Pq~ZODz?K$?02Ox`8PLXCFy@AahGu-r5Tft>
zD}5L(+b8(qUFf?Xx(_Z7z|%`f{04w9Q!$43lwNr^y^swrC@RX@6i)%E8~cpc>(fd~
zk_tBubjok(RWKDYjg1ZOHoV$A+FoMxiSNz=JlCTNr3dn5Sy}2^{f`=(%9`w{!oPzC
zIY4EHPV{H8IA%3AzqFKVVxso*)Af^%nF@LR7z2-E@BN8IfTDqxI*Ev)u(GBi)@(wP
zO)t6emG@#&%(ZLRwBy6VL;ehv=OXaP<jvQXQ=6l>eg3?|Lk{MQF|fa!=#G1Qop}H7
zkoX4CnF;3Vuuv=Hp4s*pF(3~=d?5MDavt9~VHV{vco4U7zz3?X+qb@l9h0vuf*GB?
zJ^gx>&fBx}KI+UG?u{>jJl`Z8305nZc><^fGpdL3QMbN_zYwabXh>!V0lbQ5v(0g6
zwxS)b9YCKFa1YMs+k{9=Ot3jz-Q6PY9EP?U!|hm~v&F^54e?%rNjT=_D+8pVW)seK
zlMwXj`}Z$XHGt~475(+QG3W4TaQ~z7E{3DGV7Fz{EjwtuY5qu9*y*n{=@_UV_2$At
zLLWIE{C+<{@4WeonF;Z=qN4XmhN&<w4;;N7hu>?)$CJ0f%u1HjwUp%K3$IJf5`!`R
zTBW(!M*T`%1Wh+nfm7$xoxWtD&-O<2_Vy5{RJ>l!H41o*+S=QffH(U6ZBbp8IO`OH
z29ZXwWQ+qqq5zLkRP^41o7NL7wC%y%q0M$iJKNU>F2XJr7HhFuu}QrT;sKU&>3;l)
z-%AFNa*&UYuf$F&*n|E~edOg(RyLf!rB}5z@Fk^BEOW%Vu~7sJj+A_Nv<;^I>VN|+
zEZwMhXwMJAqTT=X8JyTF%PTD83ZHUt4|nJR6u0_WotclO4-5dZXgGffASvY(VH-25
zXa>TtP$}_<-+6g27@zi@T6*`tH1KfValZT>UOng5IWyCyZL>9+?Ib6cxpTb5bz8|i
z?EYO55hkXAuED{c9-F~mW&n2tTDqs|Z`u>g(+ou|dQ*o=l<h%$d%!>s2eDz<^V5ps
zS(ia;EQy(VXJV`2ysWEm8F+i?Ek>}xBI4vhwK{pfI^C+SCQG|ytloM_hUiY+i?N?T
zn*avffNt<`YZhok%0dbBh^KO3RJ|Cz`RQ6Gj1{#v{Z)RSwf8lcZ)`vZuD6%9-5Oly
z+}JAoP`u_DCkkp|tV%@TT`08Y<d)cdefDZbvz1?&y!B-QzHijiT${0`%VmK%GV!=e
znJV}<FiUXCW#_wqU4dpHjwA#$hK}uHos9esa3K|aHAiN?5!=#sDQRh0>5v3a+h-Xz
z6-7NfJNhFHm(tW6joTa(ig0oQ<Lak_)@ovhhrvF)IHcnlm)h()IMJ2wV45{(+2Fda
zX8YtlD5kfy_If75^{Q9B8jR7Do6|Eh()j3o`fS4{B7`Lk<?Tr(sV8ngLIjvL0JR3e
zuIE~qJ8ulM9tG~~Ep^`f#RGOlX!Av9wuPyFvqQ|1puPPL1^%8wc3D}$hMKiCm>QIj
zYq1t_2MYq&G@t|}Ab?0$*v>W-)SXQpZUU_PJ}G{{E`T5X7)Uqoh!nl&<2!Vm&6HKk
zXW+hj_W?_{W||)&x!IMAL%dn_)mK2O_Lzp>y9b1HPTH1vX(b%c{QgKGnKWN`Sb1c>
zxlQnXXy`+&5-=aRUQqacduJFr2yBjpV<n7?_nFBEV!C3TSFGhSjX~D~R+@~!%dM4_
z{GrW=w3Aw!grBFUk$`cn3Aegh>eSJh*p8lxV$d-#@Z#dDEGT1P<*krL!}Kz94Vr#s
zxcQZrJIPzE1KnVBj4qH3VMCy^BO#$<CrJL}tdp%K%@<LTP!4`il!Ahil9INZrDu5#
z{9B{=RgF#mY{*h4B^gCseQl+E66+@~sv!A#$NK^t98EerTE#~|17H^uZOW}<XSdy<
zn14U}z9iOLKtq$lOn7OYsSSN<{|=<8j<gBxr)A(Vrj_iRhB1TbRp72Ma}ADlt^v6g
zu7A2TdbOXH1|~V(;FVO$4Y)5X==Ahd$n6v$&VX+DMALQ}M)|Oi<?-!6UghBGNCGB9
zZLr2Lt!?papPX0|qTTZW+31+qYs#I{>{@E2pR8FJ2+zsMHd|T#MK;1-8(v?3K7n2X
z%CPG<X;m~eo&PLKr!Gw~RQ~+&gNT@zq*1%Xu-O}Pbxm3Mri*|;VVr!hJubw=&fet8
zJYvf)BqYRGWxKGoWqbU?500Jk)MsI_gT<gyEj`$Nw0Ew52Q)8qfBujxEHohW6_iHm
zY69K`VnI*Sgx9v$scA@~F~0``W61(hBow5&hN`nwN=X;8kw8{BSt<WOZV?pp)QO4y
zxI}Quw(&O3-dZ$esG_2!?k@)Z2dumY-}{ni`x$v{zy&e0HDcx^K_^$W@&ufBK>E5T
z0%#$2R$j8dA_2Crj>$4<G_C;+^jF~etE>#bMuWUwryCle_S3x}ARq+dnNN%iOymSH
z6P{P!IslLJMVGA~4MdCOPEJ;zLh-;j1IoXT3&kE85`hb4S(uWMCsf!c+4^L@@9hP0
zy8?}Z-Q9ux{m|V36;P=I?O@56hnstq-H;4>LfRvz2Q72rKzIa%WfX<kX6RMOcPlyh
z+qaB%O*ZCGFcux?`I!Ut4PS63i@G?UM&G~T{6H+T>owPknvQfWRci^DNe(zcP_X{`
zwJBi#=Fd2o|5Tb58z0wYx}T%8NP~kDaxeR9-tX470}6b6AQbzFrCieNcxe6Pbwz!W
zo~E-iK$q1vM{m#&qnP;E!j}Ry**=9S?sJ!y{SmFP=l(>lAdM<_O-iZy(*GC_tHuK}
z>;G<DvrvOQrrLH;e{;)m^;>Q9qT1d)Jb5)R(2hIt$!R1VBV*-kg_(`J`RIN}nC%g<
zYL;TY)kJMA+!qK-%$1V#o81)Q0Vg?1SkT0TP$VJYRF!-kkd@8UAG2x#DVQrdz!jSm
z)OE~O`K)a+GC@2<h3ZVG$Ec?lp5TR*@_Y?Jz_<ZAVN-7EJ9kn5obbxQq0~n`C&vIV
zsG(qfEgqq=d?Oh(3374>K*gI&OSedAFMba$p_wVk9i_D`E#0Ku)Slm!kN&$dva*<#
zLnHp8Zwh;&cu-zmk*8Dl@R*@j<%@IY=d}fI>YUa%hDS$(f`WoCsiCNpB#)JDjX>0F
z5pbk|nUqhTsQ*}bZYv=P2cHFmx<BUn0o(*ARY(F=ZVvcgO7<KHJfOfRC@5Td{+yR4
zJgziV)I*GkiBpgX4;v2wl-zZ$%#{Uo3Ynt}?E>X?FxIQ2#JD%7-5P*yDx_co(s>dp
zIDCGGqltupR9^qd`*Fq+{l@QKi*nz26vnej`=`2|f;JQ!=>yp>7(>(@_t&0PR#xKg
z_0fsC)6Ny;$Hd%fD`QSzUs(~iPKDD`(|sA*<j}9t&MwsaLC*Gxv8J}x;EBB3L5&1U
zI$++IXUC3kcZLdc8y9|9a;J*=AnP1ns7eOH0o7xupfof#EGR5|zshpq_itA~G<|M)
zbjricV?SGGV8e@h9p}OQ2c$5Et@e<bk5o5r-Yk6$1m!g0b#_Un*RO|nJg<$7rywI+
z-q|FCYF=@5OiVCy-^IS@`N(Ys2BpSX(o_b9P-d=$Jtg2bAQS0%am)X733Rk>>2i2D
z?W2ma@F>6Fl~#I^;}T2FJCn+(2g095c77RGnbNzTkNvvfYfrfBB&5XhHShmu@~k?w
z={&8w>TRCSZZD5drH|4TGxZfhIpI%a?6J#=Rn+|H3MKsRmLt5m9kaU>S?@Dmz0_kz
ztoh-RFA*b3DfR*1a#v@$f8+wKe<<vC`Ski#W}3Zsf;b-?Mt2WG=A-!XIpUV8qNmNI
z@a(MNj#A25ZYmF^*1}IzdF&{yj-wyF<HhL&DmgG8_eke*Ex_kzGR74{GIyu`XiL=V
zXp0do?&$1DI(Gf4vA=OHr}bGWme2AZpM(IPW&CSbUukwlIF6eyN6<#sY&1V&XvS~v
zmRv(hB)__P8|M=9=9RxW#Q-lW8)sU{{rZ3b8VC+sRCvk&VL{p$MhOXtHw6i<r1;=}
z5%YF5G%#OC0&1?|lYm?qJ_>TZo0A?Mu$}GC^JXgwM&MziAfz1J)a$dgYUV9U@!@O|
zm`XEkhGfv)jOz5fj}sV{CQ5p9Q&yd(<fR&ELa{1l&Lg3)Z{ua8w_47^C2z+DR!n(R
zytRd+u#gVS#oO<dkd!^a@I{=r1x6~!M?n*#TEW#4cvuiVHb19mh`6L5bSMpfIHakK
zx4<)}@!Ui@P=|GrWAn#mpd^HMSnD8SuUGhBG~KnBDOX!&%Gx8nso{u+Wsl{YRtjk+
zB>v2Jv5UygO9meBiN;?oA9h%HvHeggR)_V+(A|ljA_l5eIi-i+aoJ{}b6C}q#q8dg
z%v)ENspDWH>ubm+Z=55J8C)ooVe^bCfI)Ix!DLel4(>o+!g2!EA*+1qZ)139b(MXf
z1>My5OgpLZH;{2y-QMdrqBDux55G!g4$t9X`Pwe+jp@Qh>uV<|>iy3ohY@<`skVf5
zh*f)|@mzaT41$!STG^`5@LacS=XM4qbx#>k>APLjKv?kG<cAx-2Z_b#CbFzK+f}@L
z-{C6BhzNDlh~RJc2Xl|(hIx^X$Opq+S(MLNR&lUKI#o!}3$C+boc>DYeh4vFj3^@`
z<F2}Ex&;vz^n-D8`ifbXQ3QqEKV^NjZZWgt{ARDID#+V?OMIqqTQ3<Q&t>trcp*kQ
zE!)DpN!+f$=~C>?5%KlyZ!gBzm=RK<6ZUSYlsLsU5oaVbpCd;^d2m`s+1u^KOj6-V
z2v~g!XVo`;R}DT-4+880pOVY67NT_AYqCYX7Ge@xN#jj)H1GA#tHr+(pEBMqZOyaY
zwecU5^(U}WX=^^>Z#TY5^R?6TxuaVC$h+s8N6)#N<Sjx=8j9slH#WNxGVcF`f2HMi
zfFuy<p93I~$RZIq9Kp=Qhy{bN7<Pa3V!=p=-}=JwNnmpGI5Bb6uSBG=33h2aooKH^
zzckbt8LQmRFY{@8_=5L#cLJ6KGrIs(#-J?3YI1e?N~GT@Im_FO=P$_t@P|rnqH9<x
z;?zO6(c)OBysE1BEGFqo+&-#aG`K|Yj$y8qqkV)J_5y@S0(^sf16oX%hxR|-rGW5I
z7p6+d67Eea-fYj^+To`9zPzI$^Geg%v^HO;Er$boyGIoA_}^CCUfdC@njUmueP>Di
z{_w6S({7<2>Z(4Sse7So*X$z($rPRSDweSqgMgy|(@xp8(mZf+v-ZU$Ga`W4nXlcL
z^CJfTtNG!vKjJeM3wycw?(o-DZWm3a7Z7PwWCE+2bd6lgO8xi3Z2fx{^72i5gsP28
z3_pXLqgyoyq8=D);5&^#^-_g?a!22;4PA0C&npeI{A7cJF?^g<7fN@)zgK2|_tdvg
z%UK`o=8-U#FHXQ{$Wg({&uIY<VU-14HIxM1p3A;=d=TzK1e33JQwyx2!IBM2F7%ZK
z>8T71FTFwrf_bW2dP(hSP?%=J?;-GEawm3@oK!@(|NER?aoo|Ot4DcaR{`W$pI{U>
zRLI~kgoFfQd7i;a`Ie5x#S*Cv{yimU6!S!phWwcVBq5il)tOrAPK1qzRJt2<?deZa
zADpObZ!zbnw<iDo+>gz7Xq#7rBzzJ0;>1j>RkOqR$-XQs9}8Ff!tP~5pTD;|ITk48
z6@}1<jN+fsu#aKizTP!?KJbM!7zWAx(!(csIPOUIRkNv=i4%_f_LWvluq-?KYejLZ
zqKE5u-|pV*zy|mKpI-t)HEw>Wj|aidx^)q&x<M=45^z%Xm%rlaU^r2&Evd@Y+Bgzw
zrcOTHN|NpBdj0x^jrqtpq9{4|!<GTaN{7Pfq^e6^Nkt^<zOU?$j<^T`J+(hcKks6p
z$bQQNTDBNH`*O9lxJvnki}(L-8WAo!4cA7q9|z_8IpiZkhw7cwJ5hWbW;{WdfdPZ)
zowvS_B#Igbfw+ZQ85Duw127mA1xMmfJVK?mTw`XQ{#juvA#qDWLMphVcPypaQ3N{}
z!iKxvfP5hY5}AwT>gY6NwANoB-<&dQT}j}FNa(?l<kVy3&OZ>~N0gcHC&@>*tB!H~
za|1Z|!HMH0iHCqpdDZ1V`voyTepH=)z6AK{is^pX5LN)Vo@^M4m0XPP11zk!T`e<g
zYXroeGRT;h*iApPXt3$9KocFLfUiCfW&L^U!o;A<k{2LDoJ9WcMZu?VSn68GH7;P}
zq3sN@fTLtGOMwUId1<g7#iaMjhQKYoYLhl#$b%rE+FJj2#LeF52YGX!2I7^yQV<bK
zR6z@F-W%sb0(LV;(<ATyF7Lmq@1n5v)5x5^FBIwPo4Pwuo<b&xhxeRDol-iA;eVI-
z{LgKPn&yg-d&ph6;S`wOVl(1B0)ooQ%C(9NpQ-BLBeR$krf(>VNZ^GC*FPh>pZXSV
zzP8${w;S@Y_ev|2L0T{V<Q62+t0KaT=jSC>MV!JM8ZF0=QAq&io&R$gZVRomz8ESz
ztbD(hw`5}Ahyd*yI)V%KA?nBt5ru4S&K9G5_4v4ixmu60!9gxYfqq-=4gnhqYLXj}
z>n`WzuNB_ZrCXo)oSdD{fE}{uA&cf0o!caIqnUcu^#J~D@))z_ck^&_u^iK6iOaCS
zmsM4llw3$euL(xjPd#AfL`ditz1cs=Pfnf={>m9M7{K@N-*=PnX6pV`3?kqOQ9&t~
zQdM^0C5#molv%dF4@8Nd`f?f?8i3<TPD$|=OpHf(6HE|iV`uB?_W>h~Cqc6m+8vtQ
zpdS!rSi+OkXC5XEhsB%O&o&+Y-pizUybXLKO>^b9At)^yA=)dKh8~pd=;%0&+!r^j
zVG?G%j;e9K3<4r3t@YPH$LyiMOT|(4?Vm^2uxp$&B2I*bl^1z_e5_rxk<O%0toc|@
zE?ccqVFW0Ojp)+=OBj*D$%PrbhuzY<RRr|l=O?aCw6dzhKp@(D`lnuJXpT`ndhIlw
zqfu&z7iyX5<GasiH$IOflOGpmM1gv!{^$ZuOLj6_VFmdL<USE~`jZUQhN)iXt9_|6
zRZ65ioCzfc7CJ{etW^KKm^+{Z<6y-@I<&_5!UI&Y)f_}h#%>Q=S9V!i57iwGB;YE0
zVZ5}owogi5fI`3E%?NF0Tzo>kRVA4;z+W!<B6j3Lhc|72$kMg`H`$R(S6^Sbc5g}Z
zCBJm^O`cy<RaP-+X&f<KpZKi4p+(p}2nq_mqCLJDOaH(96g;|94nMv^N(#L6nihN%
z9&%YQ;%-+R5A=)oa^vIRy?2cb=kL7ey?K3he(qR?QotmcwN%LBQj&!2TN%s6KMwNp
zJ8zB|t(mS#;NeIj<iQ{|+?FVXYzP8Ec7fvo;8kLom1fp5T`|=w9?e+H7>I&HU~JR#
zX+qWeZRckHZo!6fyN|$C#G8Tn$gqIFL}NaQGJ&7UvuD@vwbk{3Xcyl>Cl-|sL6(*5
zk5c}OciqyNm=Nj2_fs)2(9qS4PfF6$(<8(JT7O^}zzLLA2*ie79bE_onE*93c<U>N
zhbxk&r^A?;ff>>yJv|+XR1`P*5dF!0e>ngA<{v_AY>3sUaszlHCA@y4{#nyRtI~@&
z)jCL+E7q>h=2><#NkFRLR~%Ey0S@G(9R_Qvbq6^asGpnyT$^TU`I(t7lCl`M-Up!4
zfw6DCV1&RAxcltJW*dQV7Thgl`hBG&UN@_GUw|t8K0E`Y=hH;q^_GRUb?U^vPrT#;
z9UHTin{kC>z<l(`WO{s|%}@;Bzb#jnz@H=wZ*P74?)`(9q(XiX5n5<>T^7x6J5dLW
zG%r(xkJm?f#yW39pVe4axT#yr|9dUN@REgH{)n@+?X->AYn}rZRZd>pc7DvLV4DQF
zL%}klquO@qjJX362oW#{?kf4ZqHxMPVGSq1HFeD`bwv<?NHI*9uDY}-Q6_!y^dhrt
z4EbFflbhZ0f3KGt|FfJY`2_{h3fYU_QyJu=8RX#sHLAHa?kN3XXsZdcxK6yvv0L&n
z1+)*4oYjeT=bbJIqU%@LnVE*=q#CRNutCfF2rPVTQrMmZ-1Y4mLSkg(y%vs*%Z&Y6
zxL|6o94XY|Kr1~2hXUaJXqfyrcP|ak&%v7|uBntRSLAKifYridAb9G!6RicNu*T>s
z0<Qr91t0>d0=1v7F3z?tx`7kH^Xge#$bY-JQ^VI!<Q!1YV`}oPlxQD^A3H|83|y%~
z*mzjM5UDRhf&sw*F+lCt-rhsb7k>Qecmvv%-Ex7W>Sn*(|E^4_Jo(;0S+B9ZL{OO?
z6K&!pcGNsc#&aIq-+OUWF8sfbQQpV4)`UZv66^$vBdZG0CkZr#QUlNUA9~nJyal%y
z_7>dYH9;uq%j7321kPc-@xN~b=SLrWj?X~RDS<b@u<P&{4q?piNV%$&lftx1bR;Ex
zMQ*|ZT<LacjfG%Q659BcTXXt||CTL=nIq?a->Z$O<igsNB<6dlUZR7Pln{yh`(1n3
zi!d167^h_^c;&y^syUKUvm6`q(q@F`t@Cwd%=N45iUI%qCgNB-Wd9w8#+?0xqecH#
zG*m>ZZmpll|J~I5TSYju%m3YcLEX8AW25=+r+{Ll!MKm$-`%IxIF+(U=fB?>)XRSV
z9Vp<JaWnjC9{BGi{D1pU6-))>gNL^u&i2jcnjTj=as5&q8j~0B--WFvUf5fLv9Hf3
zN8zZW>u?l^{QOO+p#X<K3nvA~Lq;<g4Hx{g=s~fY+dB06-~0W~m7Z23@ca;Xi(LKa
zs-?N_@ubN1sg>RO>XUm2@G?~=Qed$C5W6Cn1P+Ye*Mx;rMbk88|L%*WL~*p^|NW?s
z7^^FR1}rWN{a2UQ4D$Oo4b2qskqkce)RSq4*#Yn?2l=ab;VZ`fefPob(~G@c3_I69
z58_Jn0zD+w>qFyl+wZcQ{rts(j?ZM;#XXnP%64LJ6yC&p@{Db4NJU#;#9@CK*a$7C
zf|hF7MLoO(eZ-)a*?Ir1EK;6j!7sASS3CX5z%Trxn})~a+qY~*p$HFM2n!k3aW*Qv
z({TBx{(sgyNqDM`jH(D%3;-q%evkP8$88n*`E%2Eu5l+Z+wZrH`zVbXME2v#_8rf8
zk3#I+uGAzJLXx+4Mi8Z58pDbw?bM}YY2H;ekH=mDffnR@uQT$PPH-1MvWq2tUg@bL
zkBCE=tME|20a6X@d3sHbaoY^gJTS4&oF54TG4K$%O^@soH(=KxdGWnSx4ug9cDm7e
z8u148zh&Eb3;*APW$9>puGwSfCW!S>sBO?GHwU)8064o*?Z!s<rru~tLXW8*0uCEQ
zEPvka&n1>vq&;5DR-D^9`7^lG3IF!?@;sbQNUgVBj5^@!sHJ|5>)u{WF6|v&Y!qPJ
zmpa335~jaXq+J`IV5f@rQdemyOLh(GEn*cHH`>k8)utR-l6M1@U<&OW2%-qP56TQ+
z2+g&aUA#2qwvv=Y21G5n1w>hPxz)YTa9u2si4l4zTwhm5GZ9Em5_y~K$Z9I~BM89C
zoM6~ssp36Km|D}J$J!6U7E3uvI8c7zf0Vn?e+@vGiU47jiVHH+$?R%(phX2|Fd4fv
zUo<p~&AFdfY8h>h<sS2d>KJJ~_do{h@1q+<M7Qm;#>Py|EI`ebgn0hoNaq7X2%KAw
z6<B#engQ|T@AYVY!7G7r=%4aE6(5NDB-%r^@`o%|J$ajLIwM5u-VCk385wyb31nqx
z;HELM$x~|d6sl0Y=U|?U`Te0)Wpitb;YvqE+p<(wL&3}q4BX8Ik{NQwp$r;LP0c1?
zuZF&XForZ?ACsl{;#ot(nY!1^930i!#fGV=M}OSR%M)|f7dURJGQ}GC)W2x`7APh*
z`$ae5;-V87?nh1_?I16&q!bRA9%;B*h!jg)=veoP<5Vf}V>>(G$QZGXlgkpDHRMk0
z6$54#04m@8AYuUgJ8>)ID`e7&45WSt2n9zKj_B%Y8rl@SaejTUyZhBZO&3r^8q(3G
zzRlv&(T=sr4Dxs;W@Z{zI{E(o{?!QygO;B9Di9KU@v8yLBBGe2q|Np9w=i{0Lpoa8
zC!-G`U_k-t9@UzKd`W$PdZ7siye}uw-`f!<*UiEbg|IZxuh3-!J*F`e2Zw+jD?#nI
zwl)J~!eczZ^qZ)bB6f8t6M*c-#l_`%I4&x0XdNiR7%JMQdY+}LKv4HX7Vy-WqyJuk
z<Linzxw{{JtT?KQTP4Mk(a~(Itl%Jr*I!F_+;3>9x2|N#<_30mKz@Nz2w=N`LA>D9
z1{BceykOsfu`w-VLRjs}>WWVBC=je9K6#LCbw2q(UM*ckyD0vzSvLyE=oIqFJWznD
zGI8L-O3!`wPA2m$oZqtOTgF}gR?zufUS2>@;=}}*{MqT*-2ggDvH{-hrER-PU7oVC
zX?=s4nQ0m(?|*h(jG%V8I~IvWa!2-k^B5uK{KFRSODVff+fvWNzUu0o*|?q+9`WS!
z?ytb0e7o9hvkJWTgADixPnV71i0!F9qZ%f*ZO61!Q6PVajg1SZdSrU=;{$1kRIg^X
zW?$mzTj0L}>b=1to#Vi#T5V-p4LE7Eq7M5%uDn16=!b~Ps`-uoNJxl?hEpY5oq~eg
zr`pLv$87?XU_p_d_g5}}7D3mu$@*~c7GstD^!)b9VTDn$S2`TE$^TNsXCY(a`Imey
zqTf>%8_Qk1N|{E@3hFq|IE)OxzWQKjbc>cuTVH>1dm9G}Y|%;8c2h3%jCkn*Ii1aq
zUP`2i!6YwS=UeK+litf@0u5(Oq!{pJ(RL1!hCI#n*i3PGIo(wGdI5z^TE6BJo0isJ
zrmt?gq`cbyuq2O4@U=GJ>Z9+1yXrkzua&8JF96{imcWJq8i-h)+#ZD<Lpr_!voMOM
zH*PRnSpj7h5ctJw#2Pg@^07ZSDp#hgsjYiC-f-I9^^CT2!^RqL@0i(&eDm_tFr_5t
zor&9k9avcK-Z+?uT<xXf{fw#H982)La?{YLoOr%I{$=KT=Se+gcOiNu4LHy6LV(`(
ziJMcj*9iXM$bQ?^wVmFNdzV^9e0HP)9)B998$`lJCQH4}L8JBZbpN3r!uw*qWiN(N
zpakRhqV|-KQjDF+m^#O5D2Ki;u~;*|%IEMfr&v$JI=nuqaM04$SQ3S&%HVd;-j(8U
zY;J1mygt5{!u$+~hHuj4aOgBO)MT|kFa0aJY)dR>@|$;SU8O&n`DtL}b9|>Cjoo>;
zIc4#!u;gc|KuJx_@}`|$F+~rMMCXre+&lMa00b5W`FO4W5;&}ugd#H2hByB`RCT`E
z^brQ<8B{1KSjP;X4fRt*Chktg+fC8uSO5ne(%;CMjCSkKY8CJSFFbw+xQwZqH=9`@
zC3h|yjGjCh4pK@IiWsV^vE<!YUd|%6(R8sLbKWak0i<JwG9@IDuL6h<LO&H<UH9Dq
zWU=N{x|gsdeDV47I_C|LJ%W|z#Q7Neu6#yW*+%(&#WkP0-K0BnI49@t-UX4s78X{R
zpN5TCSB`cB=B&>dJi3R6QY+LfjAx&zc3S&<1>&MGWfetFUbCH79%SU3&IE-AO-`<a
zQ7XB6WvH_(2>u)#-21V&WFuhfneT%E(z3vyAofeo4*!FL-lDDhX(hXRdxpTGnS9f{
zroO(ER#C!|KPkbpY0<>}45(>6UT@d^ZQp;D?KEBNpO-WP|MuwMi%xRK+WL2Tc6N51
z&fAo|DGw96BpSWJV+0$3ykC@DHcMQ$WM(4Yi|^yAnSdIs(B1Z{bpoEk1H|P5SZ7#}
zoo@Bj^TUEP?~`=B1on54^o3u(JZ<zm4GT|_A)@EUwB6*h4lj?1QOh?j8eMs)l^<Jh
z>ET?WUA8<>`U1EeM0`LY7x&P<QE0u8EvfF!p9`Cjyr>?7N?l;vA!JSff~2_;<uv=M
zmu_ym^WRBGfD5}yn-%;$anPYlX|dLk=41HmS-C}Lb)mRXs`Kf7U>GHOA5F=jH(Mbe
zW0uCYHJmOQu)AKchJ$26%(o@-Fe)XVT&9YO(+NUI{VGQ@rDBs~7va$o9VZ~620=HL
zw7iS%Y<LU)?`~4E>XOaW?Ctl9*~~RvQYKYpWo5m;!>3R(MoCG&wz?KWrUTkpeKk+?
z&y-dCy_6}JuR>1G|8GTJc>Jws;0{meso-C?$^$7mvJDj!^=h5_J}h-6cvS(eQ29ZO
zE)|@NDsRw|-KZW2$bo;rb!ioZsl5;FX8CL7c+1cwfq{UW2XLm%XXdgm4ZUBh#|kE_
zxTPZGQw+s1LxG@)29Z^-okp;s@8Q(paMJJ>0Vzoo9C)CF0*axnJgvz}C1(equ2&Dn
z8W4)OHFgmk;=}e53#gmBzD7mSAJGr2zX5EhT<GHFJq-~wi^G0OQi74X{<K)F9m-P#
zYSGy2{z}x3USFqX?TMf|Dg$sykH68QSG&f*PAu^`qs(z3m;@wHNB~c#Zt)e^*?{gv
zE9mCtboyi9Mg(6Zt!gt`@-7O<p+My^Rc%u^HuidZ-0Jsyg6;F*;uf?>rvn}o0E<{_
zY-}{pPZph-u?k@jVeRef>+7GpiTZ)Y4j333LW8gk;HX(ySy2m7H+sRu%EGV53KEm-
z$!N)L-SS#o?pMpN_?lIdQKq)JxIgjB48T(*L*Sr%vpsw|zIV&WcKU!*$ZhxYTjgT{
zhvEe7ZGbsSdwLeGvN><h=xJ*Y<ZA6i$+Z4?NhiWlV{HH&V1)&R^dheFV5FAkh;`<m
zB`=MW6PhaM!w&|#XkA%pnY#h83TFOa*B5E30Kd%}5j;>=!>U)BQPI$lRaB&_)mOGv
zM*fgZQ&HMYTGheCR{y;#7V7uWOub`m(X-AQAZdoSKc)T^^8WTdfR41|mHL0={n8S!
z`Nb>1u><n3lB&VNcgKO9EDiYm-(h?e2+(`!?`<<LjGMi$ogeCL(t}Wo(Xa%y^P`O}
z2a%$i(;&OR6}Yh~y~Uaq78b+|4XrCbndqpLq=Hg`@C7)lKO0&h<;#j1Y_D<&!OJpM
zqDy}37MpqY(0VULSVBUAQobJySdBKfM3x$lJ-r$_V*a*Oz?K)y=<$v{0FqV(NB3*O
zET(R6q|%!=hhT#qBy|TFEZNy+RRa`Nu^9@|Llsi{imA^niTwwS>xIE$lmC<>6u~o0
z0~Bxve0&Vj@=P>HDT%zHO}m80a-6KUsp*_|TH8R20<5Nvfqn>iY?KkbQD~M}qCkmN
zjCNRuf@<ubDR8NgNnZvD1)5M{A>)@|l3%r1|LV)z&<#%>JY-={J(@jttZlG3ehHQ|
z?5{g2LoVV)9|b5ch8b|M2FZw#S@&NX8zUqTLd?ts4q44<b7Okd`gNYCXpKUS?Ck9m
z$9g;RTiAFIqQr<vniST?nVL%XFrK{@Y?(l(YVLiqkn_eyo|FJ(z#vl^$`ndKh;Ks0
zUuxC^gvP)zx~%=vl>6-&-dkl#_~><p3SDYo{(BaSdT<?5gHcn#B_y6tEJ_3C_Q3if
zgZwWt9As?I3PliC;(N$<a#FW&1o-tUbQ7{hi<MJE!S-^#x_L`EO~_-Tw|2VW0_l&d
zMi!TlP%@e)ouK|tH|m2wp1B&hG9Gd(W;V6Vdb=*pW;FTa)B;#p?oi9C#)g$EYMLJ%
zl{7awU&@?UZR7d5>Z{Dpe|~_U(a=B(NvHyg!ep(@@tAPaOsSKW<*Qega`#krjI{Li
zxjkkto>}|^A#I|)KeVeIhFaTXd(F{{D`_{WxEb#8+!{`jg&>jsa#{->XD*^^$Sf<}
zyB|EyFMs~eFqpL~(ocx3q)JeG0n8fWX<}_?KmW`npd|q@4-E2Zy~U%Jy}jLl2S3`|
zui}0mXVUK0C{z5iySpjMQNCDB{(ki4n0>OS4;CZ=hoP8w85md@mQO-rKwUR|bvRb*
zR*Q#>H%nq<0BJ5>6~?Xc+eTjukELImnwm;U0Y%BHSGxt3;EN~9tTw9--V-H0(aanZ
zu>18lYRRzK;RVRLv95ds9-eF@VXrx8461T+WJ&}i@U-Kl{UlV?ujvu=qgi`G6_|U<
zK<5b$?aa_1Mz(Vj$&&(wKhV4g2@BzzoF?@>h%gh1ASA>m-aRxbbwB(v<MA{_NO3TB
z!uDwY;Jx*<AftdX+|`1TG36<cYTl$5Jz9F37V8+OTg+aPmlt*p96b^&ad!i%d@lJo
z@bHl36B+7E&)BoQtDP9zI6=4t#dm8ns!H8r^?dI~uYUt05jW9L_Oo2z`*wdEURY>T
z`P70x=@Y-z-I%VUZSmd1h@B()ll-zWQW5IMC?av!lkrlZ;{|?4{bJ2`?*grOH-f(o
z00Cs-$l}&k-q^_RLq3Aq<ea?W9<7(t4I_8OW+z%5I*;r5?dO`@rkwp-2eO~ZhGx|{
zuX}Q>L_aOLxqA%6Pfr_@zoR`t<^)iI%y}QDP?xX$e*I|I^g!<4wFxiMY4i<tQnIkH
zcx<=bmF6Snuu+kaySCqvCM_!~pZyDj8Xnv{0O2xg=f^wX%Gh;I@<*Oe059CnnR<``
zCLc`(OU+sTG&xD{ErN)Xqhvc72Zv|xEtGa~Av-hk-qAkD%pHy2o@&0lI)5x1`NNd^
zdN|l24f0jS+kN2$Bi3AUDZlS9K0OAyR=(wI$>TpWV5`^|Da-}NBv>oZI=l4Kk;%_C
zc_d`y$=@<u(mpzx5#}$Ci>yAbf0j!|PVQB^q-W33KkqA{y5tVBnIOr@xE>J6FjN0#
z#qA0N4lK@)pw#kByO+D{Vy0+CUY{(q9RO{xtnBs7uHh!T{b`+Ys`%4|PI?f5x#n|{
zUQ!a-+&tGXQI4YFn>=5NwCGQhg$8(6HZ};5TcBzeewH)c<lzER=sF|s2(QMG<o2iP
zf!7ZR^rVGT%gbXFvfb<0fPykCj1b%)>Dro_;L?3l?tD$4%LBN6?UU7wjcx~hkgrvv
znh8{N&Rf&e)N~6OBcFO#!A1pA!+xz>N2G}4t1~f$-j(-51Rv)pZI5R6T%~zWezii!
z6>6EOF-x`p-T0N~p|w_VPnmR>l%1wJ8uw`X_FTn!pkjhH(3`F3YO%?y-nj9pqEIWL
zMAtx7mCJ5l4?y=0TwEMCY1CEJU+?akM3~Ke6kN#0x&~yGwGQZ<*kMJ@hf7P_jiw8z
zPdPp(d$Ni8KpDj3!|k1^&pz}>ST^V#y_h>I$N~ZZPiF@kA@EOEf9k<`C+xhqTo-<u
z!>I9j)yHesu<Ks`G383KpQ~Nk-frALujm#Z<@&!v!g|Eci{x!tAq0?}_V)|0KLA_U
zeX!q$l{;Bx$}}~JfeyZ_YeK1z-2d^vC7YtJ)7sC=T(c8Q*yRRdcljxJ<$((4O0Qb;
zI<nDluF7soVAj=tNzfy+eXggTzPACayBv<u344KnQ`xV&#lW7Ft%mQ%2|7-vwSIf;
z@<%{)c%8QMFUqxgliRF2wxECoB(iw_1^_%+^E1+bno@<C+0-}n3Rh(-tKuwtt3IR+
zKR2XT*X^9Q`={)MAJX9gmUrWI9RTOTI_?&@DVNY#|ModtuKKE+>v=X|D$McyljT>e
zKSP~wEH-Xo@(WXIW=hB|*1JnnJk3{?wYKbSOH6%6?0amD*s%L!7*1<G8*c{@^PSP8
zQqq}cHS@lbaMk|!JO1<ubt?N)e;QYFX76HD>V(hMLv*5mdtIte@ptc~(SEY?u`eC}
zht{16_yR5}(J0BCU(o(MMgk8S0O3MF@dW}H=^HKteqvrK>}?M442j>XK5O^cC}4bf
z{168d9s^MK$b^HjFK64fCXM&fN+Ol#QbhrI=nqj{?ax2G^Jwz*O!I@bG?tFEf+y!O
zK2lZUQxwfp-T%T6tN^dR@DnuIp38Od=lSSEkgq=Z#cs;kZYtF0D#(oJAGjLbzu%m$
z6G9kuWyK8MQJ)lYR0ARygB8%ugR#nQ=QAMoOMP+0+`i%rK@B0d{tpoEZBE1x_Z76}
zlyVRe^FBOC8uz|ZRy<4#3x9h`7))q~v10zG)#Plx7E$*v(+g1V|KDNk|F6J4>T(GC
zA5hl#svL2!g@#|bth5*#TK<Reqwn5BNL+;C-bX;lmJM=TbhYolY`{lKYHaKS)^hTI
z<^l&3&X3Iy5Q4mflftp#q~lFj-&)Zke@j70_}|h@#FMih7uk*$k&oUL$I!xe0GTX#
z5wmIDA-Oll%neA-^5mcVcFp=P%t=r!IfjyuE9_C=4_QV_Q(ml63j{8D`U3Nj=5BpI
zFJ@s(jKNAs37KjlxUlo{HuAvc<u4x|zukacII46~r4g@+#|L22E&PO1$`qUH=;oy2
z#){^Y6XlsrE4k<jgOmQB&oPED$&>KKah5e{mVF-@yoEH420Jj(#j|8?Ug&y<4=Sq}
zaSio*j1F5FbJlx(awx%f&f}{wC&mhnZDjc6gR0aRrx3R9gN>)8aI)XE1_CxQ{>!SV
zYK9QQpIpG1>@C`8!bxHHn})V{_;PU9g_3n(T4$`RV3fp*uBbeiO`M9nFXq5@cN)*|
z<hE!6QgV=2`bw+!sG0w<`|8EKxWm5k{i~&4SNR?j_o~h!4C)C83Fdq(Cf9i^Kw6{c
zX1D<DojV;}@gH$fmgndM8_AUGL6>glZp%Cz6`1l?u9H6e-$VEtbwxAzxK`~1p1S+u
zYC=_e0}_+CIJQyq>xx_U$DK~z=G{hxbw)i$>qfV`cTGnwU#=qp0y{c-G>eii&e~gm
z4h3%8e5Fh8dX}53IQcnu;s(&S0`<fY$m#(&+^(O*=*@S{$A-#UvD++I$Y{hbb|WFj
zt&=4CC&P6$7lE_q2VF)smglYe2ji#Vg;&8u&4VMD6ZCQ<V~g>X4Fcva!*nK<4?!!H
zBEAq(BIc`HznNB9VqB4b^1-htsHFOvacU%`ZaE5yhS{?!0xJT0US8#HfYdrQ8TD=Q
zJY3ruCmd+^Ao-d4x2Q{dpw@FuzruMbo?D=Z3nAoGG@@csE`!Tz1R`F$K-e7Ki?$z=
zwhf6ZE6$$fwc5k56#gU&rKo1^h2TPXKB@vR2pV+wEnuz)BnxSx_NlH<RMjgD#a|BR
znLNhjAwqY24+qd4yycHUeUr$^{Sc{doV@^e0*}O0h&^9pv1Tw+orN4_iFupmE%K`6
z8}|nil9J{}vm+Wk=!^7BS#ZD`s_Lw7Z;P(<$$NWyL%uuCe<qJcv=rh(&2(G@ssri!
zU7X&qv9lYNdp|Zef57&E$jeHlgiaI@Akx2cWipq3PgXD@JUk>((7Pei|FN0INWj>f
zu~0+?Q)9Y$cb0(1@fOx!d9!}C$r8w{MM%Eho?eeLX=4fn9|NKgy-PH0w1f8c_s?uw
zJ0l_@0LufQrW$W_PCzu#@3Cs1IWgrz>*sGko^0}m)EocP*gGB5^^_ewd$c!CJ&ADr
z*1EVJx!B*ZyAD&P7cW0e&5yYH4w6<jK*XfC&jy)`%W*DaJ5VNr5VV;}3oziR2jEhv
zP3t9QSGTz_B={KPpUp`a`i8Ng=DQB^)!Y4N>)+{FX9hDn2?+@SEYNCieRbpmGTVUj
zKl~2gMxqOrGmW%ATEKp$$$fhg0C|#l`R?T#_H%y|kbTrucK^gyTYb8Ec5EGGGUKEI
z^bEl51wwf%wTtJ+HrE7(bBU7#(0;q$1Mr(aoLKek;&WYTV|;Rm@X|p>^WT7&gT(S@
zbKZqc?`{zP0s()3+1ftwwg6#8LiC=1>6V1Qi=Y*9-Zyn{ke85X$--aq_w$oNmoUi#
zx5=l&O`yrni+UJDO#KVI7Z$_!aM5$vNaN=!`EPw}j3ydMWu89fdKLJa*0s3B`YVAw
z!=r}TNs>ZMuu<$TT5IA-hL&lXW+f~4uv%Cp2ISyLYN_h0jWT6?xMs2fqRQm(uq3ei
z(G3s+7WLUGT0*4lTIgMTY>>n0YKXAJ=e4*vn31-TK+}mPSz3o{!Vr?GQZtS$Z`WM0
z@RR2$DCTq*mFurt!?2=Asc{73Wuvm>v9a6Hv>d}B*YTp`;V_sSTs!_2+!w~2Zuz#H
z+c!fVMjf=`Gx%AsaKe&XPv?q5E97a3QKPfL#!3$oiL_UC7eyf8NGTD%9egXYhL<A>
zh7!EefH!J9ZoU5WX$0g8(!cfVlKDYy!h4ya+^_^hfJ``5lfz~e(0kA~9MefZBTQgL
z%0K_r9s=6K@dmH+f|VYCMT+Y*ETcyX#Zm>7?KzW$TwVg;C^^Mow8*IW1l^y&uFn+H
zMJMV#{l#v-_js-Z1TW!8ZZ3Xvm`*-Li%w5da_D|cj5|E-9sz9>P-BC*zo}Y}e(<x0
ztw$Pg2!R_<z+(0KgP1PcN?Yyn$*!*2QA_pi706dNbFVFO_5AGgi_Tsx0?)lM6@e!S
z2V}{??@7B2y%-?Oib4Rb4k94FL^lP)<a3ogAuWABES^2nszABK@aRxe&!(uTAi67y
zR~lH#LD0ipRUp{9VW^{l19x<E<fbC3kjfa_v<m%YU0Kz0=<ZedG*=zCW^^68I~??_
zbf`NWz(uoUmsM41-u(cQivbA+g6r_o5qQ8Yjs$!tHzWbH^ZM)wJu9@G<O#96B0In5
z!JplO*g;Ef4Rv)n%aC{V!VHLhw7Zv5aVZ5fzqOpD2DVq$PB6M}R|JGhFLUd-%bfXN
z2PQBcSIJi+)>fZz4`bBh&9r<<n+obChlVn1vJR|rB~zYS<Q0RKsjEvqQ}Y@G!bjXB
zjj6xemj18j$^ood;uC^E)aD{KWK5L<zSFw$7w`6;Rhj6l30rm+b_%b*AulL)t-=w=
z7r0JiCW;0vlWFgC5E55bg8YeGkb?+_wnTLnP5baxK-2qwZyg*2IiiVu=D__2`F5F>
zalg;>zxJ2jUDh52kx3<ES{ho<$g)SQfuJVuc7)uMXMhWY2aHNTjFHDefe1dL9zY%C
zYp_7R6Sn+GeK2`oUk9Qxa2vgp!n;fXx29W6h_%Vm`Mfmwk;f|NQY=G(**3#!(vn-J
zSW^}>ap5vgUhpP@u?=S6>eJ_ieu8|0&Q95EK<zy-=V{}FApcg0=&Yo|htjI#adD)d
zMlE?E-|hmIMD+r7mX0rup!=?px0{}s2BQqJN#%<Ne{dJY#AIrRKhIRx)ObkdSgZfD
zG&wWV|6P5(6w7`2U#8q4^ms&-KtNVoTNlj$?3l=yuJ*fH>Y6Oej)AB>Dd~|>N0I)r
z_Y<b7Oypps79R3bP8>ntiAa9Imw5T?MU6)(5gAr-Y9M3B!2!Rmj3#`tYfyDdk-se=
zGNJnSs0}Ao`zn88AFon<ZCxm{TPm1O^%yUI#M(Csl^+28e(heVtD&o#qs9ynyY?&P
zp$c$mt{Q+W04rSn1NcOOKtHpI#b{D2r0n(U;6HFTThL&&0z&Z8b7f;RgiR<F@Bvjj
z%g?LRcwACP`$qmQq#76`5pDX?a27B`XNP~b7yevzd{^qx{Bq{m^*luCZceo}D|mxm
zXge=loPwMJ{RYokg?u^dnX@taeyUy{3M?ovfQjoB1;w^!2amR5*dR6%5<xKpB&i(=
z5K{BpV`2!{)+7B}J~rfiB1gfL^m+h>5vTJl&+GA0#=Q&ul^@ppP5}g**wT-`>lgEI
z(fY+o<*W5rG2lh<XvEzvB9+zR0|8o}bm+Q=X)5)<CD|0vQEH*F?M4$s*ejyc;&icC
zEBPpbRs>;k`Kat@MFc4v>2!GDONxy$<<pEGMqDorS`8nmG^hBWQ0cFL>qZAB3n^ON
zDA0ZQ4tz&`tfIUz->CZVFsZc`UqLaa_GhW|*vWiRm?UYt(T(>=yl(}SHvOr>_T0Da
zr+I<=!TnG2gs#O}Zlf1?a}#oNT|F1q(!4wyfS}DSLKs9^oP&uil(z^WSGQe7a4g*c
zQMQ-o$9jDBB)9J1Kp#&w3OD&}Y4`Ry8x1*P{_-nv3goxR-|YRmAJetG^}FVxyuW>_
zQt|0zHHI<X%#2${<4v48OTF7>yjnH^{ta9RxWwPBQ-h%qy1xGpb7vV9RoK4!nPHF-
zkdg*v2&F|q=?*FB21yAC>28n~kVZO1Qo0+YOC+U{?(RB|zVBJ<d_Vtn*7?R77-rAx
zy`Q<C`@XK<m8R>RHb0<M9sXD#HRg-Dipp12`jnL97%4G;^8oQRei2|-L>l(h$OsVL
zAa@WO_5{ZjDI3Y2z;Y8nmdjJ_E%_-A@$N7i+i>{nXLQgiQbk2Wg+ipHrCD^OZnmR8
zQ@2r5wNdZ#*LW=~WB{h10{)ZNNN2#-J&Y}IaMjim6qGa#{`e6k_cKYlVxFz7-Fz~)
z!+whoFpDQ1EWXvXD(=nC@7@pUv1)iGTcW6_1W1TlA|HT>uRRcJXSQ4%lt@Hm>~oD?
zX~-acJ~!aoHk!H`0UiIxM1(&&MVnvf!(>K48T4@O%S-q5h+B^<Fkg{P=5+7=32g91
zvn2<>aR^{9ACj_%sl}yez)etk@IFx%;H;ZX?MyWikcge=XkD^9GX;f%oDb7rdPW@J
zU~j7q&>&{9W?S*P+6^%<h{brJ=^ECfajUt^;yjIp>mxtofu}ObbY@97!cj=1-^iS&
zG()6&`BHtzVaPqcUJG^rq+0~o`kwcSJnwU4J=vZ;T?NB7z~~_(dw5e*Qj(iX*QB8o
zk_|o+V8fnsx!PfuEGnL_sWqKeE$GOfn5Zz1=XE$--kzBOQC}d5qm0RIX>|bL28g-b
z&q2q{>v|(ynF<;~{K`PRetDUU!>aMBwI7Ug`ucl&`-U(~@mbwE?Q7pQt$t$p#m364
z$|!_mXEHcSW;S=Hx7tc^W;&Wbq*lc5^}^_CH4HdD?N&XOm)AKjW7P;*w2X6$R@6^V
z?k{yDe4kVV#oJWFO<zbadV(^y!=cvVqCS{-G+G}-0cx$(*XXCR0OG*yeBKRo#X6)f
z*9T{LK0oG@wfHSXm2pTxw7jws=CTqCPDt>*MesxwH8m%|)J@Ob|M;8Y-uYF**d}QC
z29ypa@zpC>Tfa754S8h_I*K1*Fo##%v}oUem#N8mBXe95T>5K`SHK&6AowkOhppVs
z*3Op4(c<pX?|%K+t@ZVCPs+Ue4U+Gs{o+W#`D_*tS&)9{=;*t1_4URVYd|ux_a+S&
z7x&rMCxGh#Y5UBdytKFFws(6&U_P;Va=Flw9ui_Jhdp#*C(z(|WUS*k*W&5nwENp`
zy?YoaBtUb$zprm=th@_!>zZyI#lcXNr)dV@Su6cN#rG$%@jPXas`zD1P8;9HVfovY
zf5o70b>N7C4@hNL9+3Ym*8)gSROPj^^YIENpeE+?+*XIQRFJS4WM$GeA6$aAxXv5N
z7m05GvR9UvL$*lq_ce`aVw3F+_d6rkv&~w=j*vf@e}eY+K|eV`<9F6;EWl8P6vS%O
z8p~{sF*eQdXEt392ihTN0zQ+zvfq~$NaJR+J?~>q<N!lUNf$AHB;o_!L)u3E7mPe^
zKpX_dFYiM<jee8>cWu#y!3{u_kOXY}{J!I7vlPdqE2}UHnxE|=A{@oKK)s#EW<n+^
z_fVjhNw>}~Cl|~w3=NF{aVr%Y9W(jj_R1hJb+*0;^h+(+K>?(o&_B@Ee74Y97t84T
z(HFE(>i}E;TVS^<kzjS++t1IIv^Q6G?g|Ej`=OIY!OypD|MqSm`<bAwhDO~BC=2=X
zM@n^NKHEh&=9}+3b)-@*6c5=-*7ta>$@54^M~qpzKpUlfDNzi~jk~vCPnRn>it>TQ
zs`20u!*^rvQR-}stL3N4vYW#dyo@sCU!AZmn*YT8tdwKx;#nJ<aVa$63J<I>*8?c@
zFM3WYW3w@hM0PYnDV@jn8R{d;?%t}%CsX7x_S65ouNdZKc(hEYPYOE-_;oeGqT5Hu
zegMnce?OD0;r^zia{o_{9fzPGhJg8CSl6oe`7>=YbK=vzyoYf{|9r4XIKI3?03EBS
zty1LR=xJ<V)2XDSWVbwd0KK`&Q^`-Bc?%ItPfO#pLSXK5jFR>fN`J%JsrI@F>r}{6
zrbB;B1PCaa%yExr>nXTh?K?JKF>AdPa9Qm?AI=(OAjto$XUwhzbk1|%Wx(u>5Kakf
z%eU=;x;v8!nwoK=+&2Fhkqs)J2n!}WhQWy7tFVT;`j3MKBm%H}dE9Q>rXFkoMl(o{
zN<CbqL1ZX1Jix}7u3bZGlm#aqFs9Hk9>~ZI;lL|^lYV=98>r90><dikCGbQ6(G{?t
z!3H%ZCeGesUjMiox8v*AmogWZ=RqrG`1pUL3Ig;2n+k_jb!)9a)y>7FP`A9-kX<hA
z71{kiW%PhHWi{7OX*N3rl7_-bxype2#DW!oyMYZZQ85Fbb_-BMfa1pus0#q^4Wwtt
zxSY*`P%29h)q}Qy4g9qkRfI6TN=+!Fk6$ZWH4hO5$`@aGI{eHF1SCCzaoN@dZ1>dW
z-QD!|EP+EoGb=Ka?y3fr@RJd^c?XsrzWz+E|1v>`gy*|b;HjqCMD={~@}KR$m`BgH
zgmM$`(VTA2)>{s20;_n64yfJtd#*os$~y1#4J5ry)+V(_@kJtsFnn7Mui12~m%73M
z(hCLB0QOV>02cHqIKwm%8B{%&41n@r*=@2tnK~UHdxF<9^O<P-YC|w7d%RW1XG`@v
zh!6qGRQv1CB<zOol?|6$Jp>?-)9vZC_4Uaj^NDGvU62uB)A6fAW+`#|QhyJO_{0Om
zfwU#q&+_rS#r5Qi-&|Zvx?a>Q0s_2D7C-hEZ=0GR-nA57*E@qL7^?$-t^?`?RiJ$W
zp8--&R`z>Rf!1r)@yyR_cg_o7lQI@w+yp<V!u7)u!g=*7U`Vall$@m0^@5eLU7qG*
zB%@v65%+b+rV1bqg9yHaX6wbl;$}kNalSlDd+yi|zOTV1@6Xnb)+@7<%dn)s89~)*
za>GNXfj3u4v_BYQrL@C<vk9PS8(7_mA$rSSN@-<Nfb6Hi;Di(nZ2;_3%`gL;O!{${
zqwyt!DHSE6mYpp@)c|G&Kk}47fkX^KSGOK^3P{L-MJ+fMm=d<e%fv8BKR@DfZ0j2-
zP{>+nxOOiXBPAf=%JuSsv_#-i4<++m_3kf9s}&;lu_tScWk8%BSa=O>Yn?GdG9iUZ
zWIB&|Cx?e^?&Q##Z+E8wL`K%_s_3uOv;1qHz3Xf`^d{*?r|;!Hvq2g-Ns7T1ASV?7
z2>^mntS_!gS~iDHDtAH>AH5b(gZ3J26W(-|Z4;4ke7H3DQ2tb=kg&j;G+-PIQycvK
z;sg=2jqE}U(I2ih3qT?P`OoS-fG<qpwlf~7t88j&N~*HBx#%YWJ*p#^q=H%HWgl}=
ztW-yg(|lNHkn_%%4O1WZTn&J28AP1`xb$SR2?wO*J*&~$vU|1LS!o(pjalWZdnm%W
zx@p`Ky2Im!6p@*&f;b-6oVWMmp$A+&&-+1!g46EgFd(>vh9e+!OiX}E4e9`c07}X*
z5Dau!_`<LC`b;o)@J#NloZj@J6t8o**gY^IA<}s>fDUp@3V&PV=HVJbEeCB$Z7@G0
zp`fLajc0e-Xl`2lSn?)o`Z5<2#M3o7kVO6pmyE=xk7Qg9_(g?}H#O7u_DfP~Qj!`D
zF8<=9VVWObPD?Zw31=!QKWBA{^s0!2nJne#hofiaa4s1Gxk^&~=lF+`k}*<Gn7=|`
zG)30RF{&{Wmlv<A4!;jJ#4BCW@v+bpe*Lzwy3=Qx(3yUYMLC$hF#Z)FdER@#VA*)J
z!YV3>x*M5cp^Eif(#}w!^D}o5DoIw(=lftP2*X48?w_6EJ(~7>fLL725~q&>!@Wnj
zX(E#v)kqm>9AU6VF1g%}r_=-GA5$M5oD#Bsez26=sZcts0KP)sRz3qd9;Pk@8hY6!
z{)=rkpaoiN4+t3)$a)<PE*2bbX;V`my-fO9sNp`6Gcuo0WitQSX?N!2^wgO6o?!RU
z^^&hIkfw-oSSH7(?d`5=YU<3X<6PfdtFq`mi<Ed{d<5EDRh}0sv=jq?UT*7OsG9~9
zJ57M%n|6A848FZPz?BC4%8Ch?FzeNs+FA^L(~-JYk_shrJ5WkE6n`x|(*m@I0Y~Iv
zXR{QJpXOKe2lplA<j{a6T|q&E3s~JjNJBU|f9RUaFbiX;5o6fvb{q1cgO@TU#zp`K
zJYVO*!$%#x#8uvLxPGwYc18i(D+2>#KraV48i|Rd!G7UZ<3D<aBaJj@5J5;m4@~oE
zXqPQWFmH5oyt6-uTJH=)d$3+?>oD8!p}r}n)2y;nRIH<;GcI0j`ELZ)((5>V;s6k8
z26{E;n_*=0J2UjLy+9;0M%>WYI9+Yk?B3A}2(94Wgh9+6-1CzM^2v`Mm)Zldhmv`^
zo-@ge>`YgMnUM$MQ1t|~X8t(rT{)a-XyCi@jFDL1WJpoWz%w82=t!VJgfC^YCIkl7
zi&8Ce${shsAmAlImyqdh_}xFHE&xfHA-d#l8<wt8Fo@i@^T&42cdvqi_H%4xIK#Kb
z8oR>xoB)D{lZ&fo<#1s^?=Q|-l`fVX<SS}0)*IirCMatvYOb#4qe5Pqk1uzEY^q8C
z6{(bwb&ZJpJ`Ch*iJg&=zTSWzb=8{8#jI6<GqF_4Bt2qp>{!)fxH(-wBrL%YiS+yR
z{jH?b8%#{Z0_QI1d0;)_(o|Odf#IuJ<Y;fdz$yD(9>8BizABjm_59xpnTejh(PM2l
zN(=)Efdl)pkk2je5ZJmEjmKuLPfbm=W&Q!u?<a`1;Z{nTn#f^8n4`@yT<B-+m}XJj
z5@&*PjxrrdfeMZv_MBU__`D|=l!v;k5QHyDL>a2DjwXzV=(zUeV8hYw9r9YSCRA!N
zOGb@xYrD9tXjwJ*;Mh7kVqu~G;T&{iL4aPCEEecfhm&^!4v_y_)5_<*$bRRwl*c!h
zXFDTXE0iK|Kd{s!N5=ZYm)94bTlT+CUDMXqh70L&fm|$2V0AMzmReENijlpV16Xn-
z0x#IGdqD_f>;)sRL5!iCciLTe3K+0pQ2Om!T7o>lhj1N1hj?dKS1BXb@FiubuQj&Y
zzyZOW#Bp|VLI9_H`EuD^3LOte7|2~xcpMZN2x?tijEo3KWro4Lnk&4VwI49?9D91e
zo#kb684BoWSnJbWU0vTmj>-`sQ&3nq$;)&KAsiq8o)S19Ro}xEW|z6oTPY|V`t||z
z-2MRXtKvm(iM~N($DVk@EQ*qST@L*vM`|_biI5_ok`O#`=MKHw_J)#=m@payIW6+O
zn6Pi|CrWRe^!GrvPFL_e`tk6=L6IiA)nkecvBch9bVf6%81Uap^N|7WvE>L;@4Q$D
zr_Y*3f_Rn$1uYFExR*Lp!y>mHkAXLd)@kz>d#OsFpK)m`RzvKfdR!n}umL&hRWBAw
zQ2R1OM#?h!3(g8XEe@msA|#`suR&1kcxK}uPe1xhv$93~!K=z3Bs}~HIoXpc%h@`O
zH|YhTD|hU=CLx(~u15nPEa21cKf9~9r`a5Uh@M7rE`1$RTs#b_(!WwU*>DgiXvM-p
zg8+SnKlT|F6>sw7gD|vpNI9)r8)^Zf8jqCp&-wz$ssM@=S-~&KF<|5VQ-S(*q2`r8
zr$3&v{w*y=*y|+_H6%|DB9MKNhKlrXK#a^6!@zbri;BX7c&iqqaNdr|38V^`{xL`Q
zZ=0A7%-H~Af`XX*<?L**2c{VHY5{^i#)5phzouWNcDm(5a7w}2=i34pRnqT+(>}9w
z*??V^tBXrqTpWmHVol)uW&vVf{wynNYHsdq^gMqfX7rWrjlNAOX!nUymHJ1#4kB{C
z-Jp+Grn>*&eouFA{tIG+FAiVOo2Sw0UxC!FkS-)MS^I5611})b3*5YKs;}pP!B`Lr
zJ$gofyEup@H-m+slmHFLA64meAxm7fZ~3o2k^l-V9Ua59;c#YK8&!gG?@=-mK?6pw
za0oXSx2p@_tUJF+xHcZiu`wCaRc~}m5zg4RcA`aevxaJZb+y`z0bLL99tIORhV*g?
z#9}3A@FigoROkVW1-Y0&u_q=GMT7V=p2CyHto>U0y%UF%FVzRFY-{pB96)xb6nfjP
zw5BPE<BN1JH6007`UZ$(U=D@{ENwzKpszPmW7N0IF^9kaYzLoA)6^xftOx}i*+vzP
zu#4GI!GhLYKvLDGkkx1BUuYzNu|jJ<;MpT?ohI8S)Qls;!=)dRmcf9jQD9fvEJXrG
z)Z)!?V7YPU>n?ImXY0PI9rB@19kfXN2qbqyune_pQ!s1L6RJ(41((!JItAiVd*2pn
zKhgHN&w*GV*#u}gVGtw~3c+j-VW$cQ=0;y{V65EYiQO-BCETGkcoahM3gJt~!0?On
zedz0V`U;Wn$?IcWf4^sU+89*;F_n760YKD2<r4l8LgnY|vxF-2=B}T81+L{rDTE^`
zq6$KDK*Lw(8w>rjr$~G)p%T8|NbkRd>_{5nAbn7g!Te|q9D+#j;6fu6>V9Y6fF9yK
z=%lHi|BmV}wD_vnYMZ<+LZ<`UN^`8TRB{qWph8Q@F*dU>et#Af`B0R5hk^j(-v(a3
z*|)QEDTj_0Z|t)c7HZ2)p8Vjrx;V}Qy8}mi>vQW>G`>2=fx!XolKt|-Z{%;ukl|e>
zw|)Q<0Gyq}v=|`gULcuE>G<JOgfMxVPU_>%Da{mF7IqmSp~wPrk)-Efkc9$^6CX3q
z=w({)@B!ReI+pwabV`V1R8+*z?h;{b2?0RtMH(_;zN>`P7H455$Pgm!>|?SN8Q)bt
zmro|a@zZ;iSV*2tM}vf<w`lfbqCo_C&Dj&_0%)JS9iFulXZsY&OG9ZAC!epI5E4bB
zH}Lc!HXR-k3m2|msZOlwy_zX4An*s5#+eZ<1yw@O4<hIt)%_lZ@ZwYKD8_wEdO4iT
zr81@h^y@<tMBXM^?LY3%4}BX{XIk}abo<m1)wfclMQb@(2YAdA?^!*LW}N`UO4a;j
zf`$fD9|#orE7h(vp51z=qrwnF-Zxig_YJ@ae)nulRg%G>V9?P1oPzn>Z>9G0nkQXs
z&l}@%#f;}k%pjyG)Qmh&vA}cEE4@yWh=k-mq{ek8u|6<R^XpWl+tAq7#6;2C`=Byf
z1j$5v^-fCku@fL=ME<2%6qqhAp|;Ks6<-f$rPMoBn~jC!Y=Foqz>T@soVE(YepF{N
z-(;5ZjGcYlpcKTbQ9k9CdKM3&EWzO79tXOktv%?L=~UZ*CC&uI#ca=3TV2<b;)|tl
zxs6+t+5^;I-^kXLc0I@_WG3tb)Tm`!5{RH67=;WZvAOje4w-mxI<1s_&E%3zZq_Us
z*LFK~+#P+vO7*L?RY7<J<?<8-5)&84&BF!4ba<@y^%M;lSy+lgdZiLGaUeK&nOehx
zd~Q*A4*_VND_m}<dwsZQ3qa{Wa$7cDUPe__Sy`Fe#CL#_RhsiCF3Y$5Q4;^5sI#oF
zx|*n+_2%*z3IPKy9&XOL8kdpY=KyVLpza7<+4y3K1FPbwr~vgC9EzaewW#Sa1hubm
zd2LzQufBFRDk`RYo8^%d=okv*dBVUIHo1hwZ&nb2D5b{d*-s2<S$rqnp}QlZIW5ja
zwAO^#o}HZoz=!(X=|ZOQ#U<plu~L0~jB)Nw2J&~FJJU}wU~)KyAV90$>wFPF>vpE9
zz{DCGPRGl%ZKEH#BO>Ur%uPkhab_db3O0)<kU>x)9`Op(J$>3~!A`+#Yq*`O0BlRZ
zVPFjsUyG|O?m?E<*6M3&Fdtnjf;M<18Al-2<1!G+065$Mf&ONriL-8Ai2b8Acxq-Y
z2!-iW``+NNCc6|ARP3}39Ajt4$IC7mtzC%eQX~Qn#TEW0oAQ|TeMIAw1<zAtg*p?k
zjJ3>Loy}1gyfeVO*A84E>D~}Mlk$8vy5F%eNJQ3fjdjm2jlE_skeWwOpvIz66M+l@
z^ujMOU+C^VHMM4uz%l;x`}gqh$cWuqDjz_l0+l^*yAOwvanukAHj7S*z%nKB%ks@O
zLSn&QpU>g)7>u|DQUr9jmD%Y+db|7I40R(+N7q5B3Vk9L_`zbB>r;n8B?usa3-P`I
z{hdYdO#xbqHp4H#nXAdp7P)d%2&3+jaR(V=#a6{S9y=l(ql})X+7j0kePzslmg2!<
zd$%7WUWb8%rgrtB2=5>?1ZBQ#^uh7LDSHw#Ae-KUj1ptg_<>p<h%eWrSu~j9M8v}Z
zVV+bb2XqYG+}r>WIIdOC`Ag*B^EX|mJ0GyEuD+eOA0KNu?Vj$8DH#)O{CJxB+u-83
zyaS|JW?`@80-^t3hR~a*BfAu*z&b#mtw1fHJMWOh-pH}C143}SWK+K!wH}-BegI1!
zI*#|a&*6})N?k#o9?|_Pi#tnTp61wZGgE~{buW`v2GB9H(2q~l@o*}_10g<0qy*5m
z|6mOjlz-WQ2#poX4xs^B;x1k^`IoR!0S`Tobzn}Glwv?z!7k2z+oZLHGfp!TTQFEm
z&(4dhIjw{Lf(<(PCoh^tOwdOS)xm6HQc`Lk0fo~r)V@N)g~JgCuyZ-ia3Brgo#Er1
z`CyVtI7vwJ0VJPmb31^sqyZ8Q(gL!DnYBs{e#PYZB59sfk@DLkp!#90`#{P9`ZV}r
zGR_X$ASoAy_&Y!VA?8gdgFFx@ns^|{uC{h^5^!2<TU-Jp*O}LHUx10W6vVrtQgDQY
zU0w7i$V^vb@a}Eqr|`JtaQ5{N_GmYmRsOaB-#zO4!wua*){vHCr#bCX;{h_O<_Az~
zN5@nSlep+;B@mlFzc*#{oYXYY5>PeP)m{rDKKl9sE(aK1#G_$7{*^mco+Ed5a0tfc
zU2>^2Wgo~s!?8KeKCcZP*gK&?8aNz!%VHV3ns2$`C31UpzjZ*%r?RpW2y<jT%nyMO
z{B<bFNR7=qz^@$s8b*VNGkWwYu_Mj%uyeWRh|rzYbDLP}4s^*uBFF<%{2A^SHiuiq
zA7*b?<|xjh;lsdDl(5&#;kt}qY;O=SCxn!!omrw>omG2ma3l?Y$oI3u<Kwd<GJeDT
zsS~pA^L1mzPApE?P7rVKHC|^RW-3V{g!@j{<q0cQ8;Btd?LQryw(=;oS!&5(q4uNt
z8_>yC1mXk!=4uKUz6WtEV2gtnoIU>j+I=M-tg|6G^X^LyYHDh6D|PmpFW(IY{u?q0
zfK=`Kd<2bCo)6Wdhn=^Vhh$|3LG=fmj|O|tkD9Nnp2hac-&nR)#mJFIXXlECk#gBC
z<uIEJrC7x$7b-Krp|e12F;!{qnqmnegUvv1m^uIiQyN~@?^#?N7CcC*2EI5hHj}!V
z8o;TYBEymJ#ep}uxVwX<L*pg(`;^I$B~Fm;mAYmcVwMmQ5fwMiN!9kd=RW1a#v(2b
z5Z~0;-Q9wnEi2~I_BOB4FPcOuY;x}PmBq&kYiDyY)gaH1-FAl4U--pE*hIbkw!DHu
zlXZ_GA_723uYZ@{N8sWi4mG|~BOsv4AW~8UyvRVu4?6|B@$aJWaeQ%PUCa-A$IM@c
zKO!O^p^ulk51TTP7$r;JyhrbcFIn`q{@F{KZ0T>ZVbs(>ralW6i7H96o9BEUhd+YZ
z{d;d26hm)hZ~(=x&UPSiF{?}Tm1Uta-9mJmKy4!n-V=>dSD82V_8^uAtORHL=L_ox
z4}qVWfQPKF3>4@KsQzyccFuT4Mn)cyKUy0|WzN{>4nhEb8Y%`+k#?nRKO?okjm1HU
zLe|yk?#|Lu7$_HwZ*pV++6dAD=2w-bvzocpGa>oZ&@@UsxOcWhfId*#Cr757-1a9>
zhLK7>!K;1y3<1NBhY5qeGo4v)l9eYYtN&g(kTzjb8Mm#X<IqqUttwWgrS<ifc9+Mb
z9~aAw`WP7VB@$gf%y4>nH5WT>r_-0cyE+}RC<fNztgg=vX7jQY4xh$pUqHp8z(~jA
z@Ypm=>ecND2WL27J-TxqeIy)6qTsd9wGpie47>tk=A(<mv8>L|-z5INsp%(ozZe0s
zjK8?be*IBigU<U|k8)K?T#8o?0t#^ayBh~NRInV1`}|i}?eRly*lQKt56Qg9V5QA%
zw<z>=^fxUl!_1JFPrvIU#*>p@%ewq7w?ZET4c4k~WmT|;C~Eg7Uu3$hg$FO+d=$_g
zBy^8Pa|)7I@3Z=v!s(#<tInkUsgUMYyVCq^a?xS1#cWPqd{mz-pWWi%yU*hv>%lzU
z=<8#i)Sak^QT`VJ^*1B8jGs+`q_X~;V6Mjc+9FjvX>cbKh2X71?``{;`kL|1B~5L7
z3cu&(CUvIdH!PW(WW=1o%S41fBi$Q5n}ZzLq)CC=Nc;oxA&lHX8ws46HZoc{-dvJ{
z&FN{?ej{R4std;6_#M0R5n1mCQNc>N-$aT*WT{P97&B0*5Zq*e8NLUWaXASkO{A1*
z2q55qz4{Nk<aIlLoTwf{d@&pHt`a7^2xW#+W-}sqt3f4|5P<cZGR~s<F&UQ=3kvhH
zAYkofyh9Hoa2`mptH)KchAM-Nq%V;C84<%lkZ9%ng?J1ho*y$NN7oUAa+<l{m`zea
zG5E*o{im9_qDrx``e66lb(H<#D^FMOGrPa}&CG-t-txjD?2`S)<u&JiIi{t;7ShW-
zm%o$1L8~=S64q*v1iaJmr6D*uxwCH%9+Mre@XP5y>=72I2#<hpNjL(=iV4E6pc%|D
zRg;BqA%G<|al}j|lK1F_DoDWaXe9S}t*X@Dhv4xwi53ee>smECT9m4Dr7Cr={GlQo
zZU!EjVa7KMkwLB4!~yym<4qYZsnw|dYn-y7tW*f!9*dl<C6}NnBH_$>z1gA<0LoI$
z8rpIcby;7+WNuDhn$b~0XW;s&qYb#hp3&|QHuII+|8XtqQJOzEJxzY)QCGyZ?FQ?z
zc|hLJMA+xXX3`=0>al=hAu(6hcVW0sRjeisU6dhlCwo)j-?28MYH?3*&xOHQuWR*~
z?&fmB8SChH(_L#n!1Rh^kr`KNilK>JDF%I|mQ>sZFwH=Sf>m`GePWJU@f8&tkK1C`
z5mXqj{-EQCxBdB_b|DM?1N91ZP+5QDN!6xU!iC^VPGNcGSx4auXx-<<MqaO8?XkRV
zsBu3q_$o}<`_788aO)2LNvxEZ%MVLx(54TJoutat%WVI4^ALznrXdw7P0U_bn|S5{
zOPt|r_YohkE55nmODeJ^-~(AQ-Jj`e%ixn)6oT2dSm<C(f|vs?6MO+l>sh13n6(f!
zr^$5#d##=JANuOK#W%VG4aV>jZfu<cwy*(j7M+u6wkMdY2@SdIj0kvKG-u#zj=UGT
z19Z=tZ20f;ArVMA-u9KISz!^8$7*w)_7~mp@ld#5KlO8_m)&A*aixW027gGfAP~qO
z;!neV>QE@0&IFsq!P0Ya$3v^w?TNjV^^v_Q{&LQvsgw*s)o79zgaINrRN*g@WO&=5
z2zdAlVAqlrguuMj3x5B2&f8_HI1%ylC+kg$7VYU=Ce2HOLe}E!?~SCC;}+~%#JdSn
z*)6QevHEE@OBCPZ=ST7^dVaX9jYyL9hammf)e`Qlk!2SqHT`@*(01>|t|+j<<s9xG
zSG;+fchax;(=qYQEJ;XaTHQqX*UF?Qfam^nN*OZMqC>g)t}40X30+m6WRyF%deF>w
z`<NSl$3K#Q1IGFxiJ~uCai7uuX3SSUX0wNCx~y_7AzHhh3a9E-!l`f+O<q1r;(+Bl
zr?K+SMy&J@#VctbIQNe#*H`kixVSUuEh*6VMJmgw6xX!vBpAG0S36}kn*Vu{$v<4Z
zV}wlGresY3SrM94u|eT>ReMCI7oVg*Lm+D3wfnlej}K4lobEi0jEt(kYeONwF5CD=
zc1_G#56WR6?`Hygd*Up?!N99nIxi29LLR54R)g=^#5da9juk^iLi9goen5@NQGLFF
zfa=Rc(u6m!`D>dKWZpsLUQwLKhMRcpSOqBq0n1SW8|c4PzFsO_>H>MqjFu5&3xp3Y
zn;Ur-G_VW4Nt*~j(q68=ijirE^W5|~o#sRTc+n*YP^ZgG8~FLW*DZ8e-tx`dgaF$F
z!;v-LqWN}zzb#J%G%llwRLWsE!ar;(?Bx4S2l;F7CgxI5dmO$x8Qe9M&$!tYd$4Si
z30a$#)!K9P%w^}C1`mfa4MjgDPbHpq{rPbYe=&}lm*w>1^=4`N3sq->POQAIs!r04
zxg2FlJQ6S(r~z|2x=OA`-^w$Si)(8(3=LFo8OKNn!n1i@kEYCWj@QM?`1EFtYmG;#
zoH4B56&K$%unSF$REGC@#*UBZoAHD}K}cgX8rBX;kcB~8Q)#>S&y$IWhOTs{;{_4b
z2Qe^P)iEshMd=(zhbJel)(u`3LpnQ)Z8HIdnBiD)>^aYjKE7JPJPoDb!pm=E&|o?Z
zf8-{AavDp+)n@H{H;neSvf1zH2_M?y3){T4Ke4qZlah~AuEbAABg%Yk0>dlw`8d)D
zsOYfXyxILtT)0BS=X4vy+G)v*P3hs$csG4_*=#>=SI%og@TueP#?kX|xqE;A?mFI!
zi;Lg0Pm`5m|1D&H@9tak^#b#e2VqDDaK|?tPHjDW`0(zQrJ0MD_j)mH%h=_Y^ZAe9
zRv+m4n@@Ep0$YUW9j;jin_E_NPwtWgE~1M)P6}ECXxUB`mMP*5yuEH?Qw8p%hO{jo
zygMtta(JnShMVz|TV4?f!{IUsb(o8e;6_x4B5j|tb>dRpCkW8=8TvDdBk{;DBa=xc
z?1>-_1EK<7aNIEAfE9uAq*ZIH;U~22r3~{r9XieAOWBlBePXHjoP<g^YY>(HT(;yY
zG+5rWC`J^CGzoptnSovbi?90AzcLoWlLalRR74#ZI5A0cTb;kDzvHJkJ+h%N?wtI-
zOg+HANpM$8Bzq|Io`+k7KVz+KVuqsFx3s?PLMxsI6+*x7Sw!BQ1^xZVu30yQn#wu4
zQ^O>}rXHOv)9I<Dk*N2Vc{G;?Eyh#NbbWr_#;+?ETR$~5auGwv4`L6K`SncjjmFe>
zTm3(;r7i+T6FH^x8riHR3+7ztAelpVnBF@KL=x=gMy21hykb5OR{!B-qwpFK?40cS
zBXT<zIYfd25scw@z;#tJ<dEdMQ0?}87lv6s$~U_n-m~^f=v&!Eio03oF0G>X@}g&`
zhr#ZdAu2?x)^x40I?={YxO@7>d@Wpl=G+EN!E(0##Ord>;VLHu>Uc9Z^Nb^u&QFxe
ztDy4d(H7M$s(-0m{b$C-nWD8i#?}D04U%`Evsb&*vA*Dk7oEiKw!;?<JBa`DbA3lo
z$lu4nFC0Hb6a44F&>ccr#{WD>Jk2bt`tMnxFRHYX3;+8xi)v1d|2}Qf(x%MdKYvj=
z`{)1uACJyjw$KIzS=M3u;|Qlag<H-M;|eT3&4_^Y@OatvSq563u>SWb&SI`OG%_$n
zm`hXMOl9;Wsg^6qQ8Ey`a(qG<BZTZBy~3p$61T$jl_3SNV&$LvjE8tsR8+VOMZ<=>
z(dLAI-|VEx8_x`fYOU5?jx&=oVbS;xgKxFpb5h3sf)%~!6mij$FK#*+;V2urJ3R`N
zmfV&{qSMn)H?Y@}9AlowR#vC%GKmh~L{jhF$MLSalUNSM@j*cRTdu=XuxSrdpUZom
z{OS|nqu@WgYJL%X;+Nern97%d0}&LRbKB#?#qqW-8apA}c&>=JzW95w6JJ$Y#~3)Z
z+<YlS2&NAu+QknJTy$H#ZEk{!P^0)nG(P2hi{%Tk$06(k*4uKLCqg~F{^dmGU2gZx
zpdrHeW>64JF7wEN|D!MwdI-5>5!^Y6ChvqsS$_0Ab3jIgMpU+JfIr<&Si`_CnsRRm
zI0GHr2kWZ_M%(kB5;}1ID8H8j$!K|*@{y7wp%N002wwU+nf|KCUtaaP7*9A1X5p=(
zH7j~`PUiFPLdyEXNatuW^SKAzr$KEca_FveZ_7Y`=NS9;fQkPqZ0)HO%rAw<4)y1U
zL0$KoM#fL3FB{f=F7kQM`5M&XnB`?BHCvyyRj%M;h&%+$$DN6B7g3*|Up)4TUMa*D
zeXV>d3YNvk<V^YYJH2jfRbJgXjTOW7casNv9kGli&tzFD=tz@!t*y&+wP-7~YA*-<
z3kovdVnq2#+-KgJkWHIqqTqk7aNphI;QA|SBBy&U%k!|<-{nedeKJ~)zYtSkvLw5B
zF^46s%{klDS>2WLT{pJ;yS649H*Sj_NX!|UCgy0YCOc`weKk!a`6N7j*?ZDKpj)`v
zIa*NMz?CGWuQ_32!oiv_*m!ohQJ}oL#VoEDD$?(@B8We5VP}=vR6}1tO^s6Hc<^;%
z@Vl|_k8%(-Kb4o~@KawIhmmN`b@9aRfp(Gq?-dTOi_PDtOj~0ZR!!%Z9jfxr%<4<)
zBBAI{NRNo*Qqscs%uo+DW1Z%crdp_q-nw7JMzhH%(8tqoMd_E~Abiu6H#X=Q{08Mk
z|J}K#kq4hgw;wtPoN72A=ZF=jo9J=6Lvl@qG9F@w`x(QDn!WTZH_i}wm2rxf<EyTi
zXtd#ctU4u<2Gy%?q4!DR7(K4SACo*dUep1^?;6fZ*LBKA1bwl=)SvlyiBT;V*P3fW
zAIf<hY-I73d2WPJ+#Sz+js5s_14GT`8e_<PQG$R>$<jr?_o4Tw0ysVh6%IovRfw<Q
z>7R=yFAh$=J*L3Yj-q*ue|Z|7)=YS|$LH!!Bf+j!K>pt~rk-}T*+aEj#E+X!6l#=*
zlE<wATzyH|_6tWtkM?S>+vaZsysolF${*m>sI-3$g2ZN5=zJDae`Y=}6?O*C#X#Lj
zaVm0cUr+UUys|XeyD4b39@TmIdL(yKQ04Mvd3u)M@{R2BjcNuaQqCKHLQ5lKTvs*5
zIDr~&t6|I++4qa4=Q>5;zl&cf_8MD6p<~Rsh$v)_57HK9yX`HEfTInk1~whD+@0%s
zoZuw8tgQ4oJVH$6|JY4=p+gX&KQ%eoFG~NbtdRp|i$nNn%Hq2vH!eYpRiPy@2|>Y%
zMB=4pd*5?;JvI@#=f%+X$?}?+90^ZETS|!Y4DFa5sW3%?ArRR8Ao&fXys!Dx^S@`-
zLv#|gMgn<7Gdq+8rdT*V#x}k?_I`rw(s)}497uPLjRC^P0<Vj(q>|IY^LrkKzu^dB
z@0f2+!!K?KI(#Hiz;1IkHZ!f+xfPpYZeGpTpHo&*oUWnA*QY(OOPAMe^Oee8*X4@z
zKn4o!Jy*B)cavjmR*jjP)JBPE8Zz4vrJ2pDBPPX74*3<z{wwB;c{?&?ZRb8HWAQ9a
zxA#KN?s*H{{kWYgQOEf`vvQO_$Mc-EMHl{`Z;08X-7Q0ZiSc_L(Op<Vl2F_T{}Oi3
z<&t8Cy&&W^kMp*?u3oSi8rGv{@v(wNqy<M9ujB4fxE!t<wvr}wksNw+=a03G&m0F3
zyYAO6p}E4W(5b~gtGE*2X7=f=uRk1mO*Ew2=s6I$gzdGseyjh!W)Us*S`h?T^q;u!
zJhxuY&}5=Yig`-m&N?2y7C+$|d9d_ZMXijgqjeue*R{@m@mK!|m+mG71&v5YYZh&|
zP6KyyS-zV%8g8Vy`hPxu2~oKAjWWfdxY;dp(v9nW(){)6tYv%gYBKd@B^4^}=5xh}
zoCI13EW=muqok5_kg!;Wt)zvZf5xeXfuOiTIy|b{G>UjaCshscmiHzrZ2;?Tj>6Lh
zlI+ATQ|``JAdiuh!=A<~mhSr;GX^r%l&XS{8r5Joh~g`wgu#mN6_hq%GnbU;kD7E9
z&4U%;G_Ywf%7z}%WykzVpphvXtE^m0b=#G@JC-Y|l$xE$`|@wCUfMVDIyE69BU8Y?
zPZ^^qjG+IzE+|R~x1e~^-4k--x_ee&C(0_xhJp`+LRzP@jkxcQbH@7R5pc3<%uK;<
z&9Imth=N60+KLP*058AXGF|nHpu>r@7-t=wBZE*)GO^R+KpdYsQ~Jtiom3Pk2qSBl
zOrO|XDa7DHseG$77^NG|L?f_8?Vk?dS*4&r@|4TRSUV-?gM$Q4|6Lu`F}n0c#l<{p
zRb?ZymiYBUvwJ=0kSg0D=35u)hqE;{1#&58qfXnu=lRkZQcLQq5l)s~Baf=zw~Yss
z6+|Zn9Tt0EuRYx3b3P6dW`NN`8_pE)wd);sK;9RvY_j#>%Ee~ZqX&O)qSC8b)u782
z7O#Yyycj$y+rAx=>98Tevdb^)iu2a~b*eR&hO_5>4?lR^#wu=^o6ld?H<J+)6O)iY
zZ>jYD9&J5=sQX%qljrpk1<#r<a^YpiE<{$9g3u+pmgkbB;UG(j_HE>uKCw=N^<weu
zW^vQ)NwL87e!CFPwlgM9YdA|d&xGN>L#d~y7#w;3Qpe+Dj7ZnLbol-IB7L_Vhe74-
zhiyHZ?N_4w0T-MtNoiU2F#`{To!4R%kB*MKZYI2TlCz3rtOTA#bYZZ9|HRd!HkM{v
z&EvsAls3trYSU-qO;J)s&@3`p92Py+_-8e!(m{?^<$iZO@l!lu`87&@@#V%nEDbHU
zrGHi13OQ|oT<z}2L`q~;{`Jb;fR+6Oq<^p0sHV<kDD=jaQ)8C#@Q`4Z;I8UdjGZh}
zm{tQf5^VXg7aHdooT&Y}@9HW=&eOj$fn(Wbqit?znl93-x3weOY$BYJQsuF<+L&W)
zKJMK!v^e|wzp4zzR0*dp>BSI>ja}ad8L^R70-IHjRR0y3rC746XFghvS`Gurlj9#M
zW78cisw&Z*br15tPA=SSdb9+o-u2rlFM>ntiwxIz1S%}X%+BW8i|X<@-~PScxnxz-
z9C>8ti{GeT@D@B0fm#i!RZk1Nqqt97;3jeQzGe3fs@6LY8~pvy?OL@A4;Ew@Uubzt
z3yQ+i-#>abM|Rbo7VHK&*bR+^3;Iug(|l1S4PIEG#sl*}H69<9j>D=eRl~NE&v(J#
z)%_ty&8FsW70jvOkw5FcTNh0*GwR~dS4K!NW708cX<b%FtEWcNvin<gmg0&R%!Q!~
zhj&)p(yGqQDm8yl@>Q+>714*Ew(4imPtEIQ&l`8Ye=8b|`HZsNWYV>h<kYS4X$KD+
zJCP*|0Ro~mcIS5%fsG1B(pSR>{#EPSDAr|{%2yISn{i7hR`GenSL)zp)n>}3Hy!7Z
zKUKb_1PLMzQxC78`>LNb4$jd2*1tWQN*}~;4A<+-rf|O>Qe;(UDm$sgt|yi?y;E~K
z?kKs!1uxk>uxQqmX89%$&%i`LrD<wx9Hol8_}ttVe9&79h7R+SHVLC1)OS|=r28My
zpt}gQ(0_-DZ>c+J#`vDnpo!bM$$M<vNr*?+B~9R7eH=j(*}&g=cUKG+8Sj5nu@x?I
z;V>9(nY;VJl1tUPt25N&Ex1Os_H$x=GuZa6%#(_+c6V32r#GZ~AMq^zyIw!^VEmZf
zQ7zHF@UF$<vE1%fZb<?640ubaA32!G8{Qd=g_m}e+?XU;Rwv~-nBYJcx}G<0Elpwn
z=Z!bn91#o-fRBo6)2a)F%c%78@J({zp^pu$diEn?(qZZQd8~pD1WGrrC+>b36j4Rt
z!-FOy4VUYjzuap+L^{KKAVEIxy>8oiGO(g(FBv*C*BR;5&Hl)r<_js+uJei}5Ei25
zl$s5zb5`(P?}iXQ$&O>1^|uy-_`E)jad>4x_9N<^IpxuG0P1b8du3(f^W_yNw4xJ&
zEVWOvKavy@wYK*d(WeW<Sf~=<gE{~3g*#m}(9p!e4Y3LjM#!4fqxeXj^{D^8`ev$e
z`!3n65{+$js3Lj6B<;@a8`YroA|9T-l0q!y$iK0&Db2>|nE^db8i6Pu^VNJ#1XH9|
zU_OW{ZkNMpmkHIg8?LD-y(@OD`l+e*@zaZx-YdpWbN;qvp$k0qFbKrQ8xb=#Vd63G
zor?IWct$LMUvnaNyp#UqkSDn1A&y@C3ka#cO~)XYO^q(0Hxtx=Cm9K|p9(-^ZmkHe
zt>~SZ|2V}kr^wvV+7*QR1&ud*Jn@hG)10fvX1>Slg@Br^&FSVysbKke!+&n*^>aiZ
zY}!+R-#b!|^A*e6ioo#RZy4`)!Uo`TlmBj0N}IAe-JSK2hT2ZsGu;cm7Jf>whoka_
z01|3rNiemFHWd{#M<3Xeuu^`0?9{bt`GG`2q?n{45aSA)f^?Xrvprd_%)CdVP!KPr
zGJniEqx%q>MIe?bOP3)PZGtcuv2+3&>?b;bFIofwhAfZC%*||ep8Xl*?o3Sf;1DKq
z9|p~x4SStR$dR%;rs$1_7{wwR6xy6p89iEq`Szdpe~b~v*iVhY8<bydrIyI%%y@!<
z=7*s1lYrCVMzlB!N6zPr`l8CiV8JeIg<nIx5pdyjc?|1tUMfy0J_J-#AL;FWRXXW0
zgX)J@DJrgvnXLwcDhOsPd}?Slq)|=bdu8%@;&>7EGU_zz@H$R|3bM9s5PeSwK`-Tl
z$c6|~W~9qgMtmFfIdL*g|9hRtF+YCbtXt=jf3Y*jYQk_DTqhSDON&@Wd3X6Mv~hft
zHYCEOrpdrVg^%AmEWw=--<MsjJZ)gw2nEHXRcVPKMNY@G*W_$NXP>B;#w6vkO@|M8
z;}-wx!q?ML9RkIbxF05S)W^k^CRAIPI!T5ZAs~>{Q2ko=PwL`ABvb)e$D1VcReh{N
z*@+n^khble&&`3d?UScA%(vKfhk02-l?jcN>sxUW!4H>OGxBi+=b%#kiK{25v?%%y
ztG~$S<);!W5!~lLGBGYY<G5eJ$^JMwckx#USM{d!lZLAG&Qmd32JfcX;pO|;ezmpB
zv&zT!1?CS`yHOh3DrQb{sx|p}akoF~8O=78>#06)_PKifG0<FCO5&Z@p@A!NyAQug
zP|9P3zyylv_FS#OGY(1r!^j>zxzSy5Di|fDdEJC@ITvF<NX=qKGSQ2Q-QzcoHqmtW
zv`^b?p3f(-CdJKhPjFM@n|!`!(9uw9m_#TToVB!AijIKTf`pb9u;Is#u$YQB*)e!6
zB+18~BTj9d%Bc0Xu1qtfXrhREM{t!ro7RJl%Zlwm@G5j8_JLb==FhrMTQ7O@-Mr(%
zbU$Q3yV=VqbZj0zT%4%n;Yw-D{=tU(Oy@=UQa;1_RHlpWLWVvcZcTaLcUM6Sh&YnQ
zIBAtOo^?2jf(#$4MDTXT{!mJrm-}%{n8%V-nb7dw1O0-PLCb}5w07F7<5BzTsWFS=
z)`k7_MAP3T0?yfL$8;8W;SchgASP?&Y9?=XBsir?er0>Y_Fpzyv@Nbnzgujbyk3st
zQW>7ly-@p}L)74E(0pwEyDz>hRlKcx<m$-Lnu?PX@7O;G?uW$v)n9BF1%E2z)CAQP
zAok3gPicy3;w?^{CUUolm}`h=;srD_c^y43E9(+uV!>}|rJS?KHt5n^L$WO6$&c(q
z=A+H1N1MTZ2UfBPTRxY6C~F=0ZaN6Ac*GrwA$w4GZ~yfl+d2)*$7F<6`rnCj(Q$pf
zj2KelE_*(fRVFrhJW&d454?AM{HofEiC4Xiv?T{83q{C_hHx!f?R#S6l8=1}xyU^_
zoEH>_>l>p4<?86EBweoP8G<!h9bA9+UuFmITZWMQOWWbKRy;p?A{jzZUcJ?^GrzZ;
zQ@h$x%5RSa_Z5xsHIB0=NDo&lEzWuRsiMqG`!hfJc`f$`n!)!D=`d;L=HJ#Qg8cFX
zI~USX#%kM%igJ6yUH6uUp(NS6+uS>kFj9#l1I0fMowbdjR^O+Cy7t<ZsfEULWISF}
zl0wCb6H^ebr8_$dj`D8h_b6d->$BB;08HP4hzOV{zpiv&aN>*-ZkC6wsL(c@Wo@4f
zG1*VI5CeO80wpJA5b{T`5}C0utPf&{$>E~Fo(e%FM7OmP3s+rvFByaK;%zLo3YSK}
z%Pjo#;>_^lo;lyi5!z3wiQ$RNJdc(>Mz?<SI9v}R#S*1UpR;9Sp5(|y6P}r%&9fx3
zaBGTIE-5oB<^m^+f4mqA8{SU(DATm&lT0#sOuN_%)e#}%H8%2sOu|XsNVfti!R<W-
zakH{-NUUQi)4W9}Zg$Nu#aOChKnxd*`Si4>$s0rS?+s!>+t4#>iF<`vD{xf^fk0Vt
zqHi{rpKzp|kEsxy1Vp31{l<<0qlvR<Z?YcdhVAJ&3rgU-x$VbqSr)C2%q<A%f79A6
z{HCdLk}rE=mmc@^d5dpLKOTKqDr<{W&^jG;t{7}H#$Hnx-l<d{!0COoaKBq=_2<KZ
z0h3~89$K;Wx1myyom@94WKe0f6$R;iAlRv!BBw?~cjQelRtz*--oh15o_(q0FeKGd
zE3O2b>N!>}Td=w56SteX4?s|AhDYbu9~G~z`kpyb5Nzz@=w96(TCgtl;Kme`Wlj-r
z!WAu`6?D?iu@DOP_YnzCkX|nANomwu&=50uAp^*BFKq<ePI|-qXpmk3p7v{SEF5=A
zZvQ+(LWfPjWytT<&8XjFjMmw(&G3Ia6f~P41E<-Wq(Yoze>0Wc`#Z<(q#QqnQFf$H
zd8Kg#<@|aJ)+jIoUUG}ehzzz%G`D>^^^hKW!DW1NT*f!+i*_24uB1MMGA@i;e7+KT
zPwER7(qH9xVr%ZSFY{o}k`p%%y~SZ0oeNQ>B>5T9(Bg|%WPJI_l;c2e16%yy&&oLk
z;Z(<ss7YTD83Kt*E-3U4CuF#Ey}AokLkg1%Djl;&j+=4Q+_0Wj^CD4prFlB2=uWT6
zM;IC~m->QJ=dwCbdCB!UZQcp4j`_91n9~0t!LV7~<U5iVie>m0AFn>?ZisBry@+tl
zbkq<lB!n~7T`+y2GhoY^d<QL2kC3`Vam!i@$UYqHr9-vflJKJwqsJj5`)$tVxgfux
zyN9dx?N4*<JsKQTbiam_$IpKX!?HE`?5NHM`fqo7&QFXkc-&&yMX#BA!G1<$Nfxtn
zl6I|0Mil}P&BGJF+@B_TlU2N*wBkq<Rz6yxN4`sj^>i?4uVL*H#UAV4<w>ch22%m$
z1a~E+*Im$hk6*zzHOg~MNjfA75)#@mEaZ@$+T>1It1eiy{Bdd1j(XPwV?*Fa*}{zb
zQvoOWIB!-FnfT%$jOE-^pC=Jgn4<f0mB%~|CoK`gEbaYo4tE|bk~)q^i9<w-LRn!*
zGvgSCIwJ!So7b-Lsq4|ja$R>uVxkhrWf8QB{n7qzi@lbf0(|xdxZah@96NCqv%!!~
z`PqjO<P5=Qgd=-jRW+(375}6wE7D%>XvHtB<}>-s?<*h6GxRJqp6*~A7?6N6Vf5X@
z{6r@cuH2K{hXor+M9~-dbS}-w!x1N$x%?AWa<WgPKT*N)e0X{BwwZ%GP3M|o3dcrK
z+6^iYN_HF7NiZ$Tc7&YZ_nVNI&ZzxwIdAUtYhReGJ~BJp(%fatdiuR?@L&6Nm*9NB
z%JaywdQr`8aQ3a-QM=H~-Cv1EVh*{Xf=HT|WV@QMcYI~}$WOB?ubM3-rCv-?i-*u5
z#@YKD2(HkKeveeD)IS?*O+=)Z&pm@mJr7ROIbtLci<}WiH<Rc~a&#Rb3(n$m&4l~v
zIkZ1>DXmuXgPZngo3*AwHH6-G?)K&veB|WJ?9Hn$*~EMDno0r@$WVrMeL<kRrG_%6
zJGDQSPx_!0Z-ALcE9y!L5gy0BZU2$UpcX7*(xJ0s_b|_Tb$&nlC<{U7d9eO)qpoqa
zWAQOAve06ZfaR&1C{*8Jb}*WAiq>NLSy5eGS4N`s{V~^3L5ShTR7i@nehs?GvxGl$
ze<tp=a3|`PmoroSFw@vAzCX*wg!Ezca_C^zT4zKL^YfX}B3!<{u1on41#W;2Lm5?q
zq7OBUWOEEQ_M&+|wAF1&@gF`ZBqQF6725p%Qm;n$6hm{;T5ap)i^7uK@2@=WO=?A>
zF$kl~Se6?7-L}WoY;wQbj<%bpWrX-iP;yF5wIcjl1O<(IaMN2Pe1y{nxs@TvC-+iR
zieUaBbT-rV;s|-YTtP}_-_Z!vpLinozZ7e&KyYG2AH;AYA^60>r<>}E;16IlBwRj`
zFd;o&1Z1fPhL5i)O^A$ouU*f^Adk51l+w`GiJTEJ3x)^4LaC*v^ZDt5N$D$*H1{Ne
zQL#BRS9r*12yv!ax@t}_>CE#|BcF9cWiY@cWxOs;n<)b2^cB>P5UBt7V@LgnT-cwq
z)pZ}TKz{=Hd4e;~k6;jZ3ooU_Bc_jl<e>ydd}yR{TWT>55Ug@Cn60Y(I|?hs4hF+7
z@WypN-|NS%VD<fuK0Bw-SGh(V`Av1aiGn9OvGB=A!cq*0l-2j$um#gKl(4V;t6u%_
zM~$Tv5Tu;U#N00~v$|6h{VhiwH54dRlcds$c*;!03~_j08Qf}XJwizDy@t#W9~y?e
zch&6srbk`4v<4y&1qHvir1?*fG0xVyH3AShj_{r^lX=gIrO-b+ENE2%@aoj5sxv_j
z3cv4aF%;^e-q_AM;8gwHJm-UsRh`PSsmn?;anjn0K`l#&_Q6Kn=eiX>t$|5LuQR*Z
z3L~dJo2#8iLk@k}rIo*TbQI2Z$Ocd#kk6c4cv#qAV*{f`{h2UfU;oaw?`GzEYxRd;
z16RK<x6t@m{=NqBJEvh2DveUz&oSyTJDxN{9aR5bo4B4&R&~27=+oZczX3gy#eEvt
z{~Xr;`;p=Q>@0HAl4C(6QgLqQ>A!w2m=S)kN&Ej{GWtLJHvjKuxp9Yc^E>SS`$PIh
z_J7QbA3x~+&t>xNe|*5~P>h67rPt45I<hQPcbPzOy$JpuLYmay^H%-|QnFPgDv!tK
zbK+Os9B>K`@=hUsinG98UC%NIpL3<%G1+rHN83MUtlIDtqxgBq(=u;=ZaHB~<t<y_
zm>kJ7GK!52g#~joR}?jKXKLM!J%m(wiPj$6Lesyql{wsvKXwFdz?2pl?B*0~yI%qe
z@(-bl-#u?P_>o!^<TXlr?YbWY5j1$-2ZlF+m&%qK{7JKC%e3ZQ>=gU^*c)n|l>d(Q
z75FEKf_kg;&Aci>r6=Zj%ybGEew6YY+GRN2IO@1xxYKa`q$Cc5LH|MOefkevDBTlS
z`ebB`x;z~;IcqX<Z(9_d30;C&<GrrK#-IrQf{87@y08SlHCb@=UD2b`+!oC;iXG&Q
zYYBPg=G#~3qI>Q~?987l1oz%y!-VX$-!s6SSWZZh-qg-c^tE#(aGvsN+Vux3A5rwh
zq?>R2@eCxhs`)7+U>Gn(>BoZTq1;ygEB_k+<O6|NRA4Mw#F9ph;E7U88FenT5laf4
z^J#t$fspN8xesbI79==NhHiVwj@u9Www40~3I$Q>Kf;09zH=;U)Ckb|6c9ov5j>^0
zZ_-_qd3tX-tp%bKidrCRfk<8ZE8^A=OB(a<3h$|9$pheyljuPRjPiRtC9dmqbUhpi
z66aI@p$`jUNkZEBVquIi#u#w2y7LG?3z%!T`KEnzC=vp!r_Id&aJqhREgLAvz13j2
zs2=JMcU-bafVh>t-SiVZ;i#r-t8rcF{UxcvFRsN4AP?4b1hlph&yjwhDw>V-<fd&A
zmW%pmRTU8&fE3VZrKg*?r&sq%umlodX)T^3dALUho?QEi9lK)^0Z^R17vtexr9C(R
zf$dHb06;)QK%%-KDKHQy09+@wVcuWl?0YM&zbEJw;0Oo^0I|~@K?EKM07a+Ugu4E@
z#czKg5%|utK&MFn0N%cSHC-hLB}$;!QdA00R8>I&5jX-wkN}PV!JnH?OeuVzhz;XC
zV4zSEc<(nomJ}eO=z89+V?qQd@8Gq$MBL2m-=E(&(jQg>nK_aOLLhYd8(*GldZ6E!
zEN^7g)i9LSzP)4$m2h7H<5u=w410QY1+m#oPsgygC+JZSC+0%K5A}sT#=O0lEg6Uc
zwYMi2QIN-PH0JGPTdGETHCO<YkhHSXP1@5N^hmHCVEgF<075`x&oy1S6pUy{9SE`W
z<N`rveF|8Th@E5Ge%l}f<Y(4ws@49Ia4vs`0Ok+ude3ZSvmNglL@=4Xu#_%aB%n$$
zc%Vls>n^QZRS5Qkka?hXU(St3<-c`6{;Ka_*A@W?0PEp}*=A!i1C9Ip3y%*Kj`Rjv
zV&>?Uy+dTo$wjki$q|%_!LgbuNwAqYwU{j#(1F@l(_@iHWAo-hwqhX))&8DfNVZQa
z81vSmS+_(07UhB7U~hz}1Hc<c^2TxQbo@F`Adr&m%>?&VR7n7bE5;aOEXVV#?zB9N
zWZwU9y8aKBHy2u_FOt_9*_rv+63o@j%k!<0#vQ*>69NKVTiE>WrPj$c7ih7v-1zQX
z8Y3$2PhDC6)^xJ$Fp~bA>H6z+pTy}uUu~X`sg=3emP<Y4SFT#p+GhOi_tswCbc84Y
zy~%#?{@OoY&zgvl6tz(HhO(*=38ciL79}nELSgIi_pYT)L@BWr2n_&;)ll|^vaA45
z^nyFNm@bhR3{gm|2BM@zEfi&i`9<!}r<&6a6k;I|y`k(4M3i451860BLe&?F0D%C@
zfymn+yN>`ss6}t6dIJ$65P?#nqD4uIS|GMIMnnKg92sLz%{5+Fu_;jsqN0T$0K{@2
zA_PYeX;G5UNbI`DYC!WV$-8ymQxqj7Tr>XZs_QSRFz@r}v<Cr{#FEBRAbT|4(GL%T
zBj_)xZ|tp1mh~6MiVqG%lV!EHswXPyclKAF9xJuXw(D<CAQY^u#Xq^U@tq~>5lx!@
z{A%-JhDAlw3(ar8-#BL=l(4wk{NeR1^X|2o=IiUWVf;#L)(o}Blp;!#egDG7w`S5*
zfG3Q|y*;z>4;SJE4@zJ)6uqJB2~Z;tU{PZvMQ=exnfb-F=EVd;iKRe9`CkLk8_JqS
z2@oo=veJAz5rZKrfdwt9T2um2(<l%l^6$>IUfpm~VyHw<D0@R$QkX|CDX|u+zEG3|
z5J03wPp1t4Km<Z!(n?;u*1DXKv+kYQ#*6D-TKoF7#_1+S0z6<bkbR-7X;gVWM=S=i
zHxyNkC5?CTXQ%u{l@$K*k=h?W(*MQD%6!xQ&AIjOPu1(0R|0SD)k8!dC*Qvk&sy@%
zot<m^e91WSZ%j8|U3U%R7h|((K%4BvnZ{ciu3`L2%dDIBP+>sCB>llu>#CvD`j+#S
z@*~hbLHRLJD*sLp1$pBT^%YeVC;xOUS^p5@6&YiUvCj_fv%1p|!Fd`es67>Z>U!&1
z-3*u1M(Tw^1VDj91+}jl?D!d203@lIO66nYDqc^oj)V^nMK4^n%g$@#Ez16g=3De2
znyXGfHX!R8t;;U>Z;$sJaBea4mfB<6h`<STu##O`O|O;Yfe_9ux8{RzzeXWwYQFK>
znoS6MD$$oG!fZV`-*BmO*D3gN0c(K>C9EyAzPkyJPZs-H@wex*H3vg|#ix73OS6sF
zSKRr{?7~p#ac#c4P6LXT5?`rBPY(nI#8Myvi6+ZlyAof`h=e>bS~^}9(!0y^%{SIe
zs)A=GihD8r!Ifm*LaiKqVK}TI<=tNj=>3_^H#aQ?!J{LEV`Z_l)Ob6EBGFpvMHD<W
z67?ZjA{6@BgHhFG-y^zSF8$XBqP6+W@6MPnk4HL9zkekg7%D$q^{-!Tw8~*1pn!B`
zq4mS-NhY!@&B9X!cWN;?lcxV?96mBqJ|@y1O{Lc}s#Kz{j_dkba=t<2vsG36`bba_
zWbf3tvb>XUId)g;1`%RQ^~?!@j%YcyE#r4y<02NUIkia-ju)@Cva4xus2m+G)~D<K
z>qR?j)nv)6q~t?dh^c>|IBC-VZxfz9-t&A9uE(zKzz_%o0wBb`a$w@t%bUS(_2Siq
zblyOrq9UMHBmM4Ny5UHL!INW!1Iqk-DpP^K7UQ9+>J5YvDAV-sr?ZK%(u2yrG}F4A
zKv)Q$84Hr-`j4(BOTyJRq7yZ_vXQQU5XQzTcxt>@K?pS#q)_Nj%{1R_x{PqVzwqQh
zP(oT>kH5E=tT}ODtny6RpPp`<X*v-GPmB~M!}hx!0eWhMFCXrCIx>Ir=JH!Dj|D6Q
zq9A|}(PS^o#Ft_!m%^t<3!@55mc4j2zLH^INreuNO%#TqJ!tlmmiJkuo|Y3U5T6<?
zK0R9e=}hy@>&>;y|Iy)UB!wlyosYuaQux(_)nkgzPOX1y-K<pndmHrdL$%+j;(F|w
zAmWYIJ5BNYiQ1RTxSqI%1KXJ&MToUx@Rfs=V+al)v1HQh<@w}lLQyezdbBVu{nh2h
z$raN=ad4>gWKCwNd11DB*~(Gr0v!aO{E=adF~&YcxX<b?K!n8kjnoS%R$BJVLOff~
zyg*Mxp86t5u(O1P0NB_}XLRv52Q_$edDE3^!5G<VE!s?MR)~&8u$s7)hN%Z?RExf9
zcu1!I`PAxn=Cc-|?wn_VU=3CKiigp>vu4)g^vzB2`LO`4_W;#m@VSxV7l(s*t$DIR
zXv~`nX&OaO4eI<7YJIKskJr+u8V;M}pRSvp-oi7(VQZ!FN=qE9s%j_?4ir9Dm02r&
zZ_^L<MNjps#l_ZZ>y89^51t65n&>M$Jzjb^u)mm3Vo!_9%^xoNL&K#f27&=$etI>5
zYT+v*p=!o2EZaaL5eS5<*EfG!$44hh4+Qqbna1S|eUiPs?gx9LM{9C<t#zvIBbj#z
zQa!aRsc$(-j9+QF4E)u_WY$tE$zHymOw}D)`}T^<5Ej?dsT2lFdOVVSweX2SJyZ@R
zB2g=bPYgwqnEh-nHO27DlZCL}d|}m_Bs;lebhYq!uMCj<9h|O100bCFs00`(ENW2>
zWLb-f7GY;J-HnY2q{Mo|EIQmfQhr!u?`$}&<!Fd&O}n1B6(Jw$lWPrI&)iZ*qa_)H
z`tb_AbbjsszTCQMAd=hmhEjiSP)%J=S2OeWnj7woMl>Z3v{pw33tyWk^knJlizY@t
zwG>ZT`S4IQrYI$pS^AHcn`=QZq3GSY=8P)*#-2h?lDxcR3)OHu6hl4H<AY(<+S6-B
zMZsgk#ep>br`gmAAWuZ#3HqwxlcS}l`sCbV^Gu4+X#LY{qN{~3jTH_CbYU@m*T^sJ
zEg$sh3kzw(W4l{Mh<LO0UrsIkkFPBMBvw!MD<B{b7BB?+%PY+()L$Aa^qb^|(@7%f
zotfr2ryd(EjQZ^Ka@M%xg)UM@|2*CNyZ6`sk9Sw!TS@-lK;;X2N>j_p3$sl}w;mAa
zJT;APq;4VcfyAH?e7+Z6eSht*FSn*M2n5Me`1!K`>HBN{=}POGfr8vNc+YuiX1<>J
zwTzJLE7y{ZAbfVLFp#A`UpA|o$s4PF?@0OCKJng6>uP3C&DPID@XUBLtiZT?a<Up@
zj4^iiaG%wkh5*(>f2bbp4_{0zc|?hMon=HI56Al>g}Afe0=WyTrrKYsY2Sl1y`FCL
zM#n0Rw>Gm8G_I$3#3rY*?48sPR-zJuj>6{;shQ2}{pI?9T+qLHpnRkN-T?s$@GS_R
zACvzy)%wngs|@!X!`3vR5MWdL?wZL6R;`Z=2?3>|KHMKY6!?W0n$7sTSH!W&+Vewd
zVYWHf%woi4^h*x*01g#(N%`SQaG(SiR<RnXiLxH3$?L1>*}82OQ6dna@NRh{xsXC=
z-3E|xerm%Mduz`Os-{CxZ=7q{5+<>vg^UJ>EatOo+=W#;I$n9WN9%|#oo`)ixJM<H
zBelOA)FOI!C2M9kX8H?6iTP9+6hJ|#@JMN6YTbrJqkU1YGiTNumV+Zj`M$&iv06}r
z8ht?@ttrfCB*H-G<Ne{rVtsluvldNE%MSV-A!2VyJ}_7qwyx#xbZP9ojz!D*%u&nw
zhVc@?5gE6$rUd~+=-$~dUg~ln%Vm6VCEXk@4wY45-JD*dVjw4aqD%AHOoE$UKUBdM
zsVDbW_t(w2)%5Sr#D^xUzu6};mmgGe07E^+2V0x}@vImrhfnw6)LKS}L~eRH*^syy
zI}FKqEGRkFUpP^f%?%eg^Us&v@v+js8jpfB{mH6XEG4fSSj~J$P${SZjrCG+q@q?5
zQlXlx=zV2~GX2&}wm1<<%wH5HarWk>1M;hujHkJElLX<D!^JU0Nn(Do7SB<1dcidk
zpA{jm@PP>6y^6x8$IHh<nwoFCHk<4n7YIZGshPfS<TLvUC#qry+|*1qvw>GL+&@wH
zT)$kR?9DYNZ+#LzsWVFeWhMUPf!?e2^yRtu2bVUN68i`HYiqH4b*}Ybe>7gwZu>h<
z2sCN@52rJ5UX=>JwYN|c@X+4ca6LP}ntuEJ_|RD8>%;2leU<%nb8a>H+r{MgWaX>9
zB6T1T5W(5(d+)A(-@)i`<qrn@m8NMJ@CmG>R4usKhPhJrPRG;6d6f0kPB-z`q0&QD
zTuzgpx9+VfFN`t9*j>lT>MlS8L^#wNo?1>e5|_{Tmk7?%NLBBv>YE?nlI%>2yxsWU
zmxW1f3+;RYNBY!HX0yxM4^9MwX(rawx0>SNNf`=o9->G;SPC8=(*No0&388K{(=_m
zi4us;%S!Rda{ABB@cBWJE`U%%wUY17We4`xo-6wwon3DNKt5`S+NA{pB`S(mW0!!I
zKoEvs-doupf^lFF>viwiCAJX&9Dzp^;Eg8)KmZR|)iiyrak8cVs}t42!uqvkAcA(~
zfqce15lQ{jp2~>=dJoo<we68hh)4v8cq2j}AcFOjI3m17HO0KP0U}tEM|$MnuBN2`
z9~suRmA$eEqkTbHLEh=)Jf*%<KEYG!+P9I&1?q{3@{?tZ9R$Lkn*}9+JS8rl{C4Lc
z01*j<l9r(q0#E`91V<D|;kQ?iLxC=_vrRJ>`yZT1tRtJH?<S?ki@J9+d1FZ&8r0RQ
z8lFzhuA?m#_DD(%C@J^%t0R5U-YaW=zmPsPP%Js$$yOi(dAvV-r(wnhqDc`O1V#ST
zOk<`{`_qH+)$<#tJ4MzdP~ymXLM3_wY@}|((GU_yaeS=$jVh!bh=`nzefvxS0C{i(
z62UuiB7bS1v=EKfcjo=?JlJ#4rQg2X0HCe@IYf{^7RA1S(jSh>*Z~na0!QtyHmSr&
zS?`UgkgA_uHcO)+0t5n;0HS=h5p<><0YImI1%baCtA|MeeUYdH(XqbhJD2Nk&b9Ve
zgXbnn7dEn&=30MvsJgQzq^BT?e(yv%o7?=+CWL_q$R|SV?Jpb~2uG(j{&_ilXs|r4
zaQ~n_)*robY3=)q*%JeW$axP41X>4QJ6<`6V1z8CO(W!^6Xj>B!gz>;d-YP%*Aso?
zV5!%663}QQXY!s??0i7(_#tA9F~;s?oUHBw0T5f?7s{_rmcD<b(abymIS1uH{QiMT
zH4v%WHlaeIe|I)EeU<;=K!_-!B>unNZ=PNYe|I42JGcI382+0gR)umijags(t%3@H
zHez#T(?y|xG+h+(L{X|vy*}$Hb(A_hx~Jz5f&#islo+xoLgAO|>G{lGOQ}RaL@f&z
zKms^RnF^jipnh>-^Z)hqFZ#og<@nXbxKR|=L$wke&=`4lVL9o=P$Q&Cc4kG*rpddB
zI69<D%8;{{*X*Pe<lNMHA~(%yra|KV9{u)G^Cw|cK^!jyM|I<k>oL@%A*e-qPXP@9
zfjrWu{&BH&Qo3{_S(oy$vh)q#w3IKhlv<+g1)~ulvy@-B6Hs4IAg<Qms#X5GKK=H3
z^W3I<Xi}BY$JVDFNMK39<;~>H6+BXuMUBZu`s$M09|rq$c6y<uGes79Y8tj`Ti@CD
z4CLhm1Zu?CkR#a0+<NLHq9Z!o3k4-wwmr^^2m(p7>&Yb>{L6=Hk0?sPpFF?z;<e=I
zgL()XuWpDFlclPZgMocv5x;O$Yl6(Uv#TZsERa9nfQcSmCg{W}iY+A`#;c`&`v@4q
zq)CYd1E3{lN%sDVyjr)7A^<>QDDOTLL~BMozONiDZ+`0%{qAIRuqs}gYYtikhN6<*
zQxGKu3v0>g5>x=CH5b;>D4{b;wzsb`1fYQCH_eiUg79<eiF4U}N+l=8dxB^^efhdL
zSQM2&9;oUcFE@V~gk?uA(EE!*b&f+bHfNU;3TbA^6sm<0iSLu2UeDGh!iS>l^z}H1
z#r2g8i-n1ru7_}Pq4kmve8XgPr$<WXVex0PjmvB1YkSMj?=8)2X0Of1|K@0IvK(C8
z$aaqS%+HJQDT)V1OEb;-52ssyG!aa%rZI{lxc4_{s8?5wIkjpMiIMZ~$FQeY6+PI_
zX>Az-k(VAJDuhSF^z1@hG)j0Vmh`?peR?{1c}^S%A@O2wRqZL!yK{|xtK$u`W;AzM
zF~%5U-8fm@Y5A|?#>2VQ_}!JXX}l0n)@rPzzBpDKDXAT?iU@$b55i~qw0C5^!$3Vg
z5Ue7^s6Rgu^*}fb-UsUNKv9dZN9BdZsTrF~8y=K=bZ_P166TA@IuEr{a72rU$apdY
zB%xH$$9hB*1YaHvUtUem7=3ss3IotyAMb@Kk|hWV`k@|KE{4CgpMJh%=0xdt_rfn0
z(zhBAMf#C4Q5b$<$e&zE-wD;{5JM?i_4r~7j*OR|s0sx2_;7Hk?s`XyPny=b`Q$)3
zd@@oRuy3&Z4c~fuIW}5H#o|{ElwX-k-d;2^kPn4=s{>(jr2I9EPtCU=(9iCP_6M|F
z3?B)UAhIa-^@dcy?sbza;&@M33DJ8X0t~`0jG4tq7loLpMo%d@5(y%j>?>p;G)WvC
zj_UKtyUW?|WMO!q^!d2;?otwtmA*1rdTBmBy=bM9kCt^$Ie0*dkUnT#uTO|TSWVqx
zY>)N^nWuq*94aaR@C2KwJHM9htL43&1c>0t33+rtjVs!;1c(QRi}M?_iDGYW;ZcEO
zkpKtdgN4rpc)X0611Z2{_F~;x6r=scCx$e1Ceo17CkA{K!4p{vgy57q-Y<HU7#u6D
z%qDNFQhzOav?vkq@L<@hfIMNKj`sRmpdQ&**_=*hQ+#5gV&_`#E?N-cXruw~$VhQ+
zHa)c_AB`~5!lmX+(^0kfdm}mpdSEDAUNNgd;rUT|Z9R=c_3&_16<(K%zdbHqTTb6<
z;^biInUS)=)_aSIL!2B?2N03Sd(csEsBGsqk~e@<82<KXRF(drf#|iCnKs4e_LW|m
zOWs<bQn~Q_a1<GMcuyr*PUadJ8geL#2zM+)=VM+C!CQ-IbJLtEsy{khJw6bfyw<E|
zexM+)EXV7q>j_17rxgbJp#dm+pGfuOc)_gtbwgm?<;^Tb9O*AUF%%T7NsYO<>a7&x
zgXJgsHEqq0()yu6Q3LP*f+!*R#NM)=kIyVxRPvD4M{32djp51F<Rn3*6z%B?9-k<?
zx%lLQ-&YDA4|M_WLeCy!j4^i4!oT>7zqs3N_$)$%<=D+Nj6g($S|BGYN+G6xXZbGx
zAi#n~vOb~qe2hQ|MHE}oS_IJUMG2MAo!bJjs8JyTQEGkCnY2y>N@CDiE*3g#2ZsU@
zL#RYa0uWdN?|g<B3CQxrWCa!lv<#8Jvck;z4Dw}0(R)g)&j_>>MTNrq3p49~y&nGg
zW96#xsrQKk0tl4|ky?h777;?`K>)>;96+E%K_CLPjL!&*8Uukul-L_fm*%g!ATj@)
zKJ%cI2q7P-h>=3@KI!VV%AZks-)eWe<Oj_+ENCSnY(I6RwpI$pf)*O6nRyFX&=?@Z
z#;1Tqg#jV~CB{44cJ%HT1Tdanns05UgwP2*oeFp!Kma^BQW!1ieE1~+Xek1u*t9Fk
zp}?YqRz@gAQBq>b5J(}4k`hA}01zXIp+p2SmRj9Y{Sb?C+q%GnSdx%gviUnLf6ox5
z4nmF2dPDh2!DyXN2+JD5`Id)*76BpvW!5J?Z<SCIHx@Sj!>s$-;htxzST{aDJ4%S6
zg2Z?dqA0-=I0EN<;z3C)Dj|W4^-T|<5|Kaz%AAkgR;#g~+AHA_QOl48&{7ly#MY;T
zC5?eV?|jn|2w2`ory9-yY{Z5trEiQVa(A#o34xY)axuPMH;)Vz_Eq)!tJ$f=_-lL1
zi!FO*C3$+RI8spC-gt;b1*suRfC5VjQ%h1}C{X|zM=eVpv7j&%h(wv&z92YaQ9)*I
ztlyn~)r6w`z0q=@l_*LSK+fOTThR6S<;AQRV~nvaoUHB|B~S~@7oK$<GDifrT^z;}
z0N$wNm`}|T*k0H)Um3RhcIThay~JmZI%~_`d{6hPpwL->wY^>{fdi23ZMLlxykk*O
zL^O$+Hez3;J^QD-c>?qKEuB?~+JD-%%<ERmKg>$OTYG?;j^2(tw~kNuOV~QF1mNjL
z8ywxbJ#f>}yJHYQ2~1qxy|E1e1QPS~bt7AL9iQ%hcE9}Y+i>Fu!_5cZ5!~(`w>3?v
z{hqwB#_rbbt>b*-ZJEEH2^<j!MB}Ct-&@c%Np9OaDxd7vu4uRQ&fKwr?Tz=w_OsJj
z`FF?Cx3J^PB7hRmXqn4()9_d-=%YRQuJlX>5*?8MG<hd8fk4Q|eBSa+*L_~{+jP@O
z{79#D#|i2jXMpYBGx;$UcXp~FV~jC&kK<%@*AQ%*G;u#IxG4k%2<guHhHSTpZu35A
zUr&FUFLMz?0oLES^}%i?1V$1CfcM+`cJ839N+kI~z;?C$PxF~&j4{SOGkBiWU4vV{
z^WS&8r`GK<0NVvbxb@&G`t%oSBZ}>f&aS({dunv*h~KT2?Cf{#l;GoV#Ta9Z-TVH3
XJVpID<?cwn00000NkvXXu0mjf_s+@U

literal 0
HcmV?d00001

diff --git a/static/nic/gke-create-cluster.png b/static/nic/gke-create-cluster.png
new file mode 100644
index 0000000000000000000000000000000000000000..09f3e02a043151b35d6c9b684ed6ac8ba43ed451
GIT binary patch
literal 101052
zcmeFZby!qg_cx9RNC`+IDH4MWt#pVu(ygR)iNp*!^hirc4bmkNA~ke_w6ubfLw9%A
z?{MEweV_0B*ZceDeXr}D>&$h|>~r?sXYalC+G~H-`b>zLitJtd`}i0b7<c96o@-!W
zU@2f=V9w#<04e=r0=gI&w~Vc2WYpwkWSG<(p_bOR78n?yXuGH;#a1<v&L+N(3WXUY
zqVHwsK0bQ#NQW*<>)r!7TM7g?Cg%yo;F%or99u;H+|ms5)$PG{>DMXb(rPeAN6G-<
zHzCLOD+&)7I=xRE;plTrJM~mPPOOZVuA9B+^7`6J?qH*zzSPVszF%mG6s?mKxK0ZD
zW+k4@9Gbk}7A46tzwWae)+3qDnnF@uD&Om(qVr#)$~NVlzz)DFsa)spKW~dsmc7U5
zAb4AHIfdY)bhs>5o@|;7P79Gxy?919@MOjEc6<T-{4$P@ce$Ejzs3jkBNLo5wbia4
z8OE3osXLk7e|cCI2qHTKsgI1!2-rel)}j!6|3J)L@orw;aN!a^tn8MCt8Ej5vhT<R
zdM1_M6(3|~Oi5Qn3vK-GdoSOv)=IQrNA%+xejlTIg}GILvDw*p-G~`*=iM4|8=>XZ
z<niJ>-IsHl_Eg5CE;V2r0d#q&g^s+XvNFaa;2IYL>(+e?Y~bn^@Rhtp`>*R4w?G)T
z|47HgzzDX+!1~8CD!}>X69s&4^89(e9TS9c2lzz_eBClI|M@hQLdNZXUSrMy_b{Y2
zW#r|7v!<D&g@wJ-8>n+tHG3(LfCrP)b;7`)WWD*`lGk9_0m>h-eyQWEqpT!q2DRfh
zF^8I3aJ$*TZpy(BcM}CJ?JS&4nB44a?VUv3B$)qrLKL{ZN#<c@`r{F28wq9|Wi=)l
zsG|jwAU7{JFS8^*6BCoTqq(K1#`72d$PWCHV1DE53=`$yfy3e4Z~<<pqZJRIh=>Re
zFFy}IKNs)>my^4_vxys*z0<=#3;Aa`&n=wH9Iau_)=+z<n{rJ|p)Sr6%*;0x{p<7R
zds?_z|GOr8r++jHXdutc9UeYzUY>uI4P+I+NflMIcC)b6eQs?B^chfxq>zBH_#e;z
zuRH&)@jr6v{5vNfugL$%`X9IcJL@Ya3r88K9Z;vU<iE%3ANBs{&3|MR=ecS6e{{v4
z{rpEN(9x3k;ynKvG)a7+utNu69O<l|tG)!zfRx>QZr!AT{yg7YumAK~emjJL@f1V;
zx%5l7TN|m^DJ<=Wodm+@L*WA=cvm!5)yx(NE-8x+t_qCZ4TeYgT}lpyiG@dr`9KG^
zIkk0i@yGc{m8+qVG8C=~-=6A6?|G)zr6$I$eTAN`YZrG=&$i1ye~R^&2bx+V_6zy@
zcesCXJf*tDq41LQFY`UmkbW9UN`ZZk<knvtZ%CptpF^boy2|@lSs-=wzsyJCi*r*Y
z`QKIk-LZd*&)<{eZ&mQOj{SdZCGk)rZ#;DksGI#nJc%$oK{p&-Y1>~obU2r(h@~Za
zcI-}e6R0kA+;<AM|Ag3Egl}CmH6iJyeHMM~{Tw=#e5kxd)^n;Rcc6{L@dZtz<n}pv
zoqY`#fmK0u>s!}98ZP=_$Fo+`K{i(V4*K@K@{=>xrQ3Bgm2h;Ykr!3VYws0v`-s)f
z0mAghQpX)T3+Nn0)kPc?LDxO8E7DF8$*Hw-CC$kBVI$ja`*?4umKy!5{b<jb8r4b8
zZJ*7Ko%ge-w%25Ji{9fW2CwFvCmPI7!8F3FqxM009WF9fsXsm}?^nu|wt#AVk|}Z>
zkl|8sit)iG3^DxeZMV_j+nr8j%0g+$g2B6mkzNaFZihXvbw7W0T)H_}x7W4T$??`2
zqG>zrV7C5fO51)A52rfOTST`n-rwCSDMO#+So}24bLVuR#X)DYdac}kqhxQ^2!4HM
ztG%iTe?)b4sJz`#6HZXJ@{N|!YqO|v`?hS2&+$C;nR~L!4>x=N_FU(o6R&P$LSMM%
z2eP7px}*7lCMPPiWU2j?$Kl-L#lZbvHb%9wMrUY=-R^k%(K@3*FIsWf>#7AbvKrg#
zYC-;W(Auvi;X?O;_mM*{`sODd$)Dq)9ecR8_6MY(q2CkCB39Yby&Q#pztpT5vr3=*
zAkZ(YygVdT+9GE}c5P_!@f8}2OlhX^WR3v7-zU_W8?$Y8g5xq5!tUyibJuZ5S;*kM
zsw4l|-cBoVok?p@;KQ<B{xJPFp8_+>78{8eCDD_f+YJv=j;A~al!a#l?31i>9HdUW
zRMEWx18A-&_B6K^iTz%IS>b}=*G|ep!#ZXzb^SzW__X&{pU^a+6nmmMX;lk8=V)He
zfU4wa+obD+T~`T&%HVO9gh<rx;%aWXE0At3OxC%0b-oQRZo2XimK=HQRO7ys$UeWd
zB(s3+?nfd!H%_|;G_b~VtERKzXxwJYpI8!xR2J0zJ|eP|(Ap=moRZC;{v;CoL)*~3
zUE<(}%#lE>Sho?4`%d$n$^7ERq}NH@Mh;{1%-!8TKFJ{0!y3`fL&{q{JauO(MV|}$
zcv}e}RRMcl0@1)LO<f-3N^#Xos+_;ObsN2wUu>wOGJj#@wc9>fKBSTykp8MOzmiPe
zIFE;~^YQ$zY-OpTLyJk5k;8dZQOVO<J6(^}Y#GmC@}~#>{Fpoejv~`u`>a;;C#-h}
z8o{OCneB5DEgw}s%e}EJGoAourk+4|{oL6dN#{EkrxeE#>E#x9WKj<hd`Nw?>WrED
z<z?~Y4~eUII**NC*pt7o$r=`(U0d|0GB_wLMfDsfwsJ{8k8hEOMobQPj!hn<6Hnq6
zzm)44z1;zuC=~v&S<=rW^wX`+zdL>7FhN_=S=sU$H3YWbOjn6+oSd9vUu+UzbPsO9
z99y#*sy3_qz8$_azS^|)d7x>twz|b=@Wp+z(`96OwFD1!TpOQcCp`8gJ5+4+((Nc@
zFc%-ux!PX~8^r5$q&>qsO<O++X?cFTl-r@OMQ-|FCS<>krh$~rfMIZC4BA1z&Mg`!
z2K!8dcGi5Xn&7&B>OCekO%QKibMb3yl&enl5jdq_KnlHADYly=<TuE+F7ECyUL5q8
zqt(#OsaoITnjH=Q;0GHN^q(APXaOruU9BX4Th0%P*+wZ_IfHO}aE~|6bG6YF$Bo;K
zmqnhwIpWu*V|kOalD%MvaxYH9;@vxan?4H^M!I`3+6&;y0kf{W`2I_EH6OM+dR{bF
zhsRqpiiR$T+Wkp1=g7(K!d8^BC9ZpVBZynZWz8sM*m+d9Np;u7Vm`ZcAH42CPwRr^
zv!6U&4WFXP%TkoW%Wl?C<XRjyLR@B4%cU>F^LYo4Q(VWb?bq^hT|ulqm+MBks_^r^
zh2W5hoMij8oRm`C5bvWgtGc?aT26G?TqtL)UFBHL#3kg;)lpSb4QFvZzdA`)aVp~K
zbh2M;n~v?+b?bxB6wGt8BL4j9yeR(81hlC^-@ayX!+B^~meG5`b<Be5xKGI7@{m&B
zc2-N@t|G@~<Ie0RAiWWuBt`RQ%pz-FKBLVdT`K57&xwHf0y_<1Pg_Y?d8ouBH03tG
zBe6}a@KNFzEg*7ty<%98^VDFu2Um)u`eLtV5~zEn@#<{7m&xa1p0N&?=;ELpex98>
z>kH9=F2|GbI)MT4A)lZDG8N%Z*&1_o+l>V7yStr??8lkn<A4T0P6IQM37;t~5c88<
zLezHIfTVJ~S}<rH;@HiRD;#T&dl<7EDdE~!Dw%rJCpZBH9qy$`kI6&_UH~29LcmiG
zbF|JEHOxts!&LMR5z)$PwT_@N@^Z+;RjA_13VgiS1<YcGSoaj!T|7>tu#aoOic=>&
z+_?u_ru36llpT|q36l#?PJNJ6{g|M?@zf4JYEdl6!Hgm@?mrpZ;fCPAP1GG1q06u^
zNO#OZTeT1cEA$j^6{k~tKJ6H(L&i3$smfpJxs8O9F5)c5B|=HzV}?$Tb&boDzL?md
zmZDWf3W&ksVaExRcR?tY6)s5EtK)`kSFvM@W97%XK|KCXHOEPE9WL5VZHpIl?N$~Z
zL|9z4t#a4;;6S5yIt?tH_N{cVWAC=M6n_PkoTDVqCYqh<YAmU(@kmso@*gRvJ$p^9
ztG+`QORS^V?&r9KUtHZ1+G;*PVCYJ9{aI03piN&1?bPd)sP!_~@a*g7ex`u^?fGTm
zQ}fvcZ&SOnRlI?k;QMi$t_E5cYI274%NvvAw0yK%vcB%?Ci~`bV`(6TFP_PC*9D&A
z`p5*eV>up5UL#p?^_5Al6|}wSv}GG<{3kF(KL0FU#fHvx7|x+k`lWnXCm%1W9e<sa
zZBQnNutcWIYK(Uy=xZox9Te@*=_1SEo|Wv-L9?lr03Lo7`x@4ay)~>4Rc@IhfKD}C
zR_ZoKI4-@rP4uR8OL#fO2~7`2-`iU3JKsiJpZDVJU0+ULV?%CHk@k17r@t1ixg1Kr
zA}7E7n%IdA=Dr7vc`d!`Xft1)Y(iUdg~BTc9<q16xJlBTTuVGFuPEa{WHk#(YVje^
z|06#1+^hpc9U-<=twa!)ws3DiiIYG$E)CZS%%yXW4so%o9IVfwP%T_&{02W`_aQf#
zYvadEtbCrmadLa~$Xc57c%Bp}L`}m|UX`4c(okK@WF$+<4AS;RBX+0P06zJft8&zI
zwKI5HBi7vXr}RA%UqRBS%q(Uvr8RA_i`50?vqw@%z4Ya~geLA-WDnzTcC=29Wb3Bh
z5hi)r!aJk)+2U|NYp9nlb`9JKBaUff**Gb*bd}PF4eq3djDNf;ym;U<c$Sy`j`@zQ
zu>XX`hiJ=G2wBCk<mqss<0#Tc_r(Zp-q=OJ=?f{7bZ5V%E<;@5Gyf;j`>_)>orYH}
zc0Pknvya#sh|{W{I?IlXI9xiEO&OoI@K1U83LW7pN=J;^zNq>Uh1U>c{#@rQz$KFF
z&NFM5s`T<@u2-ubE#I3QYD+qF#+Fy%h7bH(R(DN|s)w$Rv~(KV=-XC{J}=po7R|V6
zQPT||^Vn%fV)0k^VCVPtt2r7>dlvjvn_P&+&-29k^}TlJP2_(S`efSm_|D-uQb4*Y
zuCKmr!iK|+z8II34!s?!t!W@#^1d#pOFwDbyhaqWELzO!vJtx5b9PT%?ATPTOht;7
zk&8G5>!Lk;<aNMp?$Hw0%Z(>rIk!W>s&nTjjRS$Lr0axfrxS;{#9Ar>=h<33jS}ME
z_R~ujC<}g1>cw8Ve?!F!Fdwa$PgGU+*ceZ~ydp5HyH4NZ=e<Pq?4rB;epAL7=(ufq
z{*)tlTu`AFbR+%cnORDgVe_b2QXh@gAzhYV25|%m<El(rj>aE+$ArnCaiR4GgNi15
zy#aJ49E3<&w#pLoz<cSch;-*cd4G)um&3=SW|4MD;QiNeajzZPDf;KW?FCF<Zo#`8
zGis3q2w<_;`lYF=oLSjMsu+OxSb;h%@FNb=S)YM#!nUmDVT3R<-{x|k7#UA;wds>*
z)FmWDlmbTHzb&|Q&D~9p8&2lJ?5{76tI{77f@Qyxl0VO4ly2S+mb!SLbAP8UG?T@y
ztK|}R)nfG(eKS5*HnAUsgi;=KA0$?9Zd~)@bUA$+)h|u?8YW$}-FVLCB{DoD&KzD|
z`p(P(ETu*&vGeWr>ohqU2wqP%pw_Dv(hlOmiWEiG*#}QQ$-0MQTb^%L8F_tK_0$^I
zO~P3QbL4~aCREHNkY+CHFp4nJG?_+ZG5B0jQ5S+Y?4qMjfj9d(Hs%KZd#Z{nr>+q_
zwH7S3$Z#YnPtv<GFy^jhMJ7uS8Zz&AN1TSuiOx);X;Q&J@$Mkm{8TBZX1_!gJ)r6)
z`23b)m_AYRL|^=@{v0Xv7Am+3>nU3@?49Rccwo%Qvhpvr(t>TSR}5Z7J?z-Wlg{7K
zM4W!2eyZ`m#bvPwqO|)N^{AB!FicB*0;>k)d1y_$e%3baueUY)Ch$Wb1zcCIhM%lU
zyRTN-OdnkFRqphBP}^bZ8Ia1WGcR89waMoN7aUlP?d@!=8`V+}`S6!032%>-1?|bY
z?PApwWCrkelk&37eAn{n>i?<Vi#9iDbGWcmTT=e%FgNT!Y1tG0y2#<gqPRu?>Jg^s
zkGaff7!uI(V_}8U2%h`;+VVuC?zqe^hNA}_X#h>X-Y?LWJm`9k7o$Zt>JmS7nKp5G
z5#OrX(r^yn7u0QNv)y2by?wnilI?x*>s4%&P!Ge-bJH>B%`2x`$g-`WV`temVo9K?
zlIJt7L-tmCXh%K&%gU>EYc74FXXXdFn^>l-vct66<d`5?wIn88WSN%90xN$Z$Rsn8
zl$GnG()igMg^)@3w8ZX!npF%$7{qI<iw!NQn(|oBkr#C^W_JA{eTOwP!sv2M+x~Ph
zUN!T0S?YRh64rWmRtTR?I5857$Plntw#IFW?=J6hG@okq@K?J<N*u|N<E|H!MNF6@
zm7h_sN`c}S+!vx@39R7V!Nf<Qq%BNf^H7c)xj3VX4J#=pKmZMd4Ht<e<#me8@iPl6
z$Ga^~u}x}-DXA?Dp3(KPD?u043&2cJwLvCG93!Y&M^d_e&NGyp)s<e+q+fI$EcEmF
zSP#rhk)kg6q+BC5LtG}LL*j%u({S%HT%aG<{ROpk$Phz%&)4M?o_tVOZIhDNz0L<$
zhPgye2w<@}UeGOweHFVfsX9t}gG8?=V`{{{%m}$AViRCfI-6r9aZMROUZ3TNEqxtn
zeUQRtSUzDp>p2$UP%V6z`(3sR+V9?Fu*LO)gj`rDt1KX!(`jSp{duWL>h5vtvcvuW
zI(uv&`OD^9YlkeBALIL`6IN>LX-?gNZZR#0y5Ga`Q&;!LB{R~}zM0I5JG5n!G&}*C
zN<oS5<J`^C;<rv{t`Fm$=hKa6qi0W~BGU%=c7-^|f(&R8S{%gs?iPK0Q_)<d>q-7-
zA6g~G#*suOGNRcBydDb+*nV?hI=Rb`_+?c1M$+YyQqi~TUezNn@GjJGirdh)Om3u<
zJytu+%_3ZvH+6fUa7s8HD{3D*zrd+}n;a{h87$OIR`4Nhw;SJ_XIs{?*d<qy`@>kq
zH|y{LfsY0*6s%1mBO?u-wQHR*`$`+}6CW0k&$D(dPH(5n#kwzVh==K~vp?j5?RBe-
zol)h!3XOSu+J9y6qHDK>fF~fEJ&u%ZR_Q{yJHTY5Bi(|672O(h%c+}&lXy+36gPN>
zWa@%{tT%bILs1I$-UHYW2A`k!KYLf6eEXM<Z>t7gET3hx-`?%uREvcqn<59qX^&A$
zw!5M+E){DK2hE(7lNkjBPthE96*}XI%@81Ubuxd4^P^V3SL=tL>7#>z@)C-LD7UVd
z(N2YprtGRckQQYWV(ElZ_6u(hX-blz+ic+MuloJ|b=XuGIfud=O1-wQd{ALF?I3+r
zgO#XGPTfyttl@Y{3@h-n`h}g&>C=!G-rr+{H%l~ddhomN_&`ioLox$kdKF~5Wpmpu
zYrMzW>ajX!r{Wu^R=?I^VIqy#w#Nqsz-E%{Mr%Hx>ff*XO}7&7#ss2L<6ppwyDQxF
z+|4GuOg^i-O&Cpb$pK_oR_o44=|WB$9b1lm@ZYE95wXZT_@4A7)wNZB>kFr$qMw33
zISczEue?mqX&79icHNyP_=m2eFM@!rUe~W|02}W87)(2R!H5t@*8jadKB!PSnCddn
zF?FY1is70iC6t1K4n+Gx6#Zz?*MfH=+^>yNz=iGm?t%~5_75`lYWHWlmVS}O5{GT8
z1gt%o!jzoY^BxX!70~MW%a{jPicAGj-S|B&wuvKoQ_&kQd^qIO+74qZbiqdaA!9RD
zOH;X0@^sAU74u+|nrH)kZS~T@2dbiA<0#FleTPGrN2;R@ovv|7-P>1WVvhZfWL^Qg
zH!Ti@J;w}z$oN-|ZDiv*>e64kgQD5gAnJRaQdd7q_HjxVVia*$v8LCRO5NtKBM}$=
z6O*Mq+_YX&0gN<=xh`rX*b9lm>SED)OUNKTO7GOmH~Z_AwgE*P;jX`h*ohVgr|?K%
zo_yTCx@)wFW3ai%5jY<dQpk>4^1XX~eL8>$La85ps|#%#uwRTin!dh*n^Ls$GsfPN
z`$IcDb>9Wn`@mG&P_Puru*EOb2DWCcfMkYr@c?p(`t?5h3HYO_yN;ge@N563bYSBr
z@mebj6v7qnM$}`4T6?+^=|7ze4jGDQ`QT_%_ryY%;P9pTGrG|6kOE=H0u}nD#%lY$
zy6=gc{c+p%`zqW7k`Z5WcU4|##9}=@dx**WLmKdj<weo#>f29+?+4X?eVIs|+Zyrl
z!ETX|a6_9y+ky&o)h|8dYfRb~6Khm<l_;ueN34MV2mRSTccAKT)ckrrNFk#7;t9Ot
zgMp%$*3OmI)kbP3Wml4{WGeVx_dX=LQ7Uz-VA7}hPT)N<ZFAj}*)0j#lm7Hl6BePz
zjW0QfOEPf~^mWBgKmi(7e)Vf6sx`8P8+y-zjEFBh7w{qstj3RKv*<E*p6;5ol%_zA
zeZXV4LdErZc_d7%BRAdJ9P_f565H%KF50O2W;U;oubsk<J4-W;Ws&TlVq^aq#s!Ne
z{SWd<cSBPeu7trUFXSB}s|ZcCA7&M0vJ}OSY)ZwSucnMGP0c>QMhsefd3&jtTd}q!
zi>*GCr>>My5Hmlh$m23%05^Ewhe-hbu^{`|mU=borFv`|8R~=J`1e9!@q17$iY&NI
zEdE2{+AIFm1dq=yK~=|no2<`q7agYl2D-LgIQYcmjBH>Ylfk!QzfoCcTQ$o>p>$vs
zk~Au)(A#55ZwANj54y4hRf;FcI3Jd>HSC^d8bD3gLq2L7j`7_?9Q>4>{3**w&j6_p
zK~OZ`>FD8UqO<SPcO80EKh^zNNB5gK4dde_G1i{FhiP8(CrE=xwTK6hP|~>jpAJl{
z@5W@KLv`nuZ)aoU^RTF@lb$~|8KcB!A=l$$bQLx2{9N8<EvxSLifj?dtA6HSR4?HK
z1t|c6<b1IKPZjNLa4_7x(Os{|T#h%Z>I|84xE!)Tz8TK}J%s#24++7%LT)Qzr9V7j
z$b0mPtz#86kEdGzGRYriJ@OW>xkxOdwBPfNN_n%(n)an6;8qy5zF>1)-3UFe_S`@g
zL@h8E5T!X*$jMLPoc7@=aDxdR(H>_LcA@SbIRvBvPvarnvYODQ3ukun2>yCf!yD2{
zE#6mM)1w0`4IBKHW$Rx38`?w1SvYEkE88HKipQ@&nD!wn{#}57p49%;SyM=Me_&nz
z63mp2Kx`TH{0_}pe7A9fZwx`#_?k${_fw?d+|h|OK}}x${)Bk5EUrF9vbg6_3sG>R
zTv8w36mgHJtQ7r4AS|sgQ1xW7*Q+oa)GTV=PcQq3gK;k+WQ;y9qRrxq%4OJ)Xm*vB
z$@!{yb5c%G<fnRGmwHLxQiX^K`?|hV_>}vs^vOIbo0IN+E447pc#EGh&an--RT@gl
zmM%UJOHqOd5k-OvSlk3-7NHMP-e1imFCbNG!Dl*2eytNarn1R8kQp98b#ddx^ZvB#
zO!>NZ+;lA=EVkG<su4I1veI!i)8EQ`DJ?<<nA-9Mzl1M#T3chV*akOHe%M%KZ`l$z
zEH$*MN62MQlznAitrm)he#EwI3Y){Ze&`;@xEt|UCvN6fbvOi1jHo25eGR)?C>B<d
zkd3dHsOF~TYDcgv4w2s&V&PU4nsi3itz?Eh+X20Uk*CB7Z&n6`v5M(PKlo*K(UM>R
z`JXcMik$UCYR-ea2-p4H0Mj^U7GNG5B=5Q2Wu{9JHCudm5Af;xrrqqEF`JDpu0-Ja
zW<tpagJGr3v8mKnf$_N@6ZW)^53gy84S64*kappJUeOU(Zyj5J|7@(YRqWAtSSh%f
z2h2>ASpW3(M1}tk1{-3>^8z79WgjhZQ^b9+uQA7S&X6I4EKtqrY$TdTb<^W^cUvl6
zy*ynIea~5&$84eim5NGsPwUiFQ%AtOi}GF#ZWv*l3wpPS8;4F2x=E)R)x%wr;BtP=
zG9f;%d3*Xk#E%&>5G$sl5ZnljyV#uXis1%}p$K>9J>g|lPdQ3)<)z{eN>kbwJ`hlG
zy!=rjLmWy+HsO&tt!q0<Z++^YhO5s+)?`zHnP`@&7aCI@v$rZh^;RRMq+(Y>)#t6c
z%^98OM1ZoEpaacU&Fi^xK?%_O9WjTJSEX43xNQm%%-OfdMA@csq2-Bg32i2$B?YQ+
z?@>b`@_Oo}vq7}AyB)M+{bte4r0;?C$DH1*^u3uP+m2kSJSB2*wlz5T++jGh_&u|<
zh@XsZfcz1E4|vE~1ZjU^fHKE1Aq^t+7v|^dnW)I&i26l5*uM~uy63u*XqjZ)0>22E
z(Z-VY^<{2#3-G^ErGdzc|1{t06adrh;aS{$)`+rE)*S;p7-X_VppfrnUkCNw$vFvv
zi0JQodAIpIO8`%}4xwJ?zC#*SI$G{sj5J;SHevN8*NvSq!VaUWOBZ!qO0;5Ac%Sg3
z?jhf&j<<K#>2Flmvf1k+wdcFEix2SS)}%dhKMHT=fSTpGuT-Wy@_U}S%zqGa)uDUP
z@Cn56mc2!W|LRv>D;Al+B0L%rA`;qh9l^yJMxhFrj^ep;qe~t)_<Zg2<v;LwasZ!K
zFj=bwrInWza!;&leZ0W~T^r<8!DEo1N%OA?;_5xM@tbZ?;Wyku-^83ZLjZBJ^<E>`
zf)XRB89L*Nz_}cxt_LPoj4YLupjvhncy#7M?YR_eBK_19_iZglhr_jqwJ*!4Fk$6(
z`}OlUr3Ehft6#8<o>OP{@3rib9WjpzLQJPA|JXgUXw@2&=E9@uzGdy2)p}c5_w{Uh
zQAAkT-R=#^-#-7g>Fi3yNRaWp1Z9A{3ir;0MPxs&q;Ndb^C{!}*;04SBXT&cNvTvB
z)Nkg5{#`8Qb;z_ZvT2BSl2nD#wN3Agff?=%*ewz!*o9I}TV*}bu9Zw*t%{Sp;4whf
zvCMSDAGmfn&?p%7Y-=6zsBr3=4QOQi67M?CYF>`~hx9?ZypJcBRYVqJNvzqTm4ub%
zc-<8H^hdxZ&#Y89MAEfl%_qqi%`jWqlI6e115($+0ILi&R`(qUX7&wB+_-5AU=Mpj
z)pXis$wdf16!)C>vrGXxQ87U64a$W(=7`G7q@8S|K3fPZZ9;2gzF9HiDg{_qn@1=v
z0Yw24^2ZAe9O^C2eo`edw>j}$6}~=d_$XUa`i-q)ms_f2QP#Ghd5}9!+`#8_aSL$p
z5dGxQh)rmDaKv6ZAbDQRc=^Rf#L_m;?-hk&(oE0Mh+JGI7AISoPqPs|^3u&lKQ2c6
z%1xV*gj4<5yDQZcSIt;hglDf6(X2*4%5UW^L>|BccNGxBd94BJvg(+caZF>S!u!pd
zTIzmIbJG4e*~qAij-+n#q%LXiKUCaJBvKy6-P}xJDu|xQw_XB42|g9og1xPIH}RSe
z@l!Jgq|5Pa#MeHzgf3%$_gxQ>J*iZcFm7F)jPU7-riq`Sx_wP85&bAM#+&E<5_kRl
z<WBV=WpWFjJWq_Wsuy=jBZziHcoGsCGg`vdqi7%QYRUoF=3A?KQIZ4O9QA`1?~VG)
zeh=h0tn)}(2(5>@`MuUsFa6~cDF)^wiA&3P`H0jj$oPTZ!YOTY{9S!&sa=J5GtC0#
z!HGjkiPruSi(Rj}a4*lx;`t?~GD5o3poyX~Rj<MsC+t~lq0ncpR?qfEQHxuSK8n*+
zQ){MA6AhPhHD7AQq8{5FeV0-jPsbNK9^KMz3tpacrnb%o<>_7T4c=$Sk)l@y@HAlC
zw4-VY9o98;Y`Z7RvigYjg`>>8B7i&*ffCzh-;?ELu6B9cNRsqu5~T?qfuv+8md!2w
zB~v8&;IMv7c9q|D6a~Xakb+x{{q(eV+)W}x$2J49`E;;Q<lkL~W@$jVgM$j{eur2{
z8-0yfA2Jn>gy)UdSLYAjxSpF>#q;~|uL7QpGZnUJMV<!d#EGP$KUc|)o%8J`Vuf1;
z{H8s`Wsg6Ff1);Rq2-hWaD^OH%N{NPOMpQ{LTqQ;qmso4yVITu-B8k4oh8-wmN`AL
z6l9WxwudZR5r8XjDhLNx5G>!*WI7DW%=(gwOWbp!nM*{bL=Qj<fOpZL88dhr<kAI?
z(@tzkcrx-@KzMgiTtmpm0KQ&)6EyehArnL%+g{0SboREc{gpgA+p|yItxEZQ_4fka
z8;ndXHY?SR-`9#cogJKKq7fFp%3gM56y;Vb^`j~JYTef<u&Td=Op~o?WJ4<VJmgqc
zL;EX8L1nK#($2Q5{tKMMqY&X5-8NCoP}Z&_U8CkK0Sp!uhr-dp@FOarf>)!%6w?fB
z7OklDO#uT2`=bcO+=Mq-Pw*9DLNc?3U5zeu0dsz~WS|xyIaV=+P~DCUVwG~=+g+X_
z?o^3n$yN6;4vc0Mo_aFPQdoJ|SDS7ITC|*6GU;?=SorF_?5x<E+VmJV>>)Uk#LEfA
z87Y4+*)#p@S0MuMKo2@}G7K5aqzXWn;ztr=OF*-F<g80QxxXpDgXoK`PedMR#Qw@d
zK&&esua*hm#lCW!`LPGU|F|LFx>yw`kfkQ0hewHkJSwqHsRwQAd?E)FlhOrS8Y?T9
ztBVY*in8bJ(o}+_S=?Vr&RSCuqV&0-;e;gA3)Fb;wp00IV~pHo5O<7EJ&|mz0=CzR
zEY&^$I5qQGeh1iok;Kt{(&2bm@=&kfB}%J{jGQ0DO)~i25ARPI;wv6q1!<{()a4la
zJ#|CdW56tielLM-9sGE9YB|l5+cqSeC&nt>Td=FljYhM8uv;T`CajYj`pe(hfT<{F
zCG?}%gE>GE9hGMW)I&mA+5H6c61;Y#<9X^wiAk1whIcbv{a~e8D)ekAwV|Y2kkvQ(
zkooyQM{Wq7ISb$oOMUh<GzMS9p;d;l)=qUjDQfofTr`qOY3g;ZfAcD5ztO!5547io
z*Q}?9DVjEv6w`3Hi5_uQ!Oci2du7U2wHa!#{-sq$69Kyjg<`WzF+WM$NMEWlpG1|g
za)we*jY>_S$Y+#=^igvO<q^OFiN4;jvfun%+iRNGTZ#_sg2mOJ&W>z#dP>ICmvoLj
zQqk6zPuUWObXm1FIY~{fm$ZFaU7a9ypmkd(Lh_r8R_t1-cKZivTKUm&W>8X#`_>(z
zE~;V?-ZQt4^95?V`4_Jcx!kd!5irq_`>-;!u9e&K$wk|(okPPhEm>2DO8#V=Y5wN}
zjdU&BIlGt=Jrj-(@_=nzPph84Xb4yWfU`HhT(9<E%pI#+=^e`ODW55lpY4?*SH;Vi
z1b!11Dp{k!P}2Q}BnE?fHh|_)<j~RZU9ekxOB@kTYV7@OKOxq#>#h)*1WY1qHB6v8
z@=64UY+^XpK<@?+GPf~vo!9j~{4L;blMM=qKQzaQ5`BM7Fh_bGC2tUO5nkok5zUG3
zE8Z;4OY}6_?Ktg^9o;(~(!mciSrkqDxWo5#%#B~YYg;@=I}IpT?r>?ujz&nM2jZI0
z!6?EIyi;KBNz$#nK@G2(bXD{U%%Wi3xE~OxK_Sn1Iai)b!5Yv*IR<hh0du0fN?5I3
z$XN@=Lv}L4r2u@X`QW+wUI#5Sfc~9Ylv=vO+FKuebM=^Lc~KSsAy~dytKMBGHXUH(
zM%xC5rfk9^bgX`ELEi~esp`#5>Ur?<_3L}I?yFQE-G#S2f$se76MQ2MAK)_xO@uL>
zAq{iLINye{oe#Llrg75m#h$Mv7nMU7K7w*REEMPgys5d?cy^M(1&a7}_~LHQ9WYZV
zOXZ2lU{A~kevMfBx@)(Aqvr$E%`Nl55U;>sHX3Y%b%IwL^6n_uT&b4pYTv%0dZl@}
zCTX0g&W3rHo=?x>owRds%G+$*8&@pEr{*{GvXm1m5dDyyC(2s4wMZbAI3H<!%~3e&
zbuw0E()oqBUS_l$KyzPv9DCXy?;8<SMQ(cEmVmWf*#B6V&+;c|>UpFvh+oHlSo}&)
z;9-_Oy>v!+%zP+k5lq{_<<)y0Xhq^^Tg1bjfas5-t{e&pEW3h}EH)zvCv+3l%)8I0
z`a9D<KU3dpBU5GRNg2gF`mJqr7pV*8LGha8egp#u-AqBO1*KB>y^A*s90*i6FE&lT
zh5PxGf*RpY2g8H36U6sYo#rGg3*S>jNW9OX7DIctpN{%7bg%4pAZ(?DpEfOon50{X
z$URy#l$0Fj<f}29nVdX}c(}5S6>H-fSW?x-QK`HwgJpo@RMJcJTDru<M`bX=d%oO?
zLjgC8)j77L{Fi!c`CInE0o3%STI|loO)SDimD^}8IqQpO>44tYWC7M3$l0B%QwsRh
zbY1-#@g9-Hb?L~)WZVPvb+47Z1auHu*U_e5b7XG%It%39DpqbjXG7LOuT8%~H0Aa}
zYUh69(>TnM_KnR*A3CBrx|nPRwnDb^6Mf;67;c+eTO4JD1%dPkE%jK~^l94htu!$|
zq@HW3Jm(kGOtUBkBgyx!2_hmN^Oi_TMChQho2=nglGyQZ6>?Fb(=(kRIoHdBJW&1M
zBrWz1LDd$PJ1vyn<#SccGf<DPOS^6Xp2F8wZto|yWPN<G81S=64YjsKc_@d1B;!@X
z^xpBVIl+AUQqpJ%*KQVBc)95_`O=R(1IH4R7M0<P!>O`;6ARy~36p!ay{Aj=y6AO3
zQh2}4e@A>v?HTjNj?-*WnX6`8#+%876DxWx4Y{9#$$)}h*Z<wbZ_P?4zkCm*;kZ*t
z;pA1xY@rcmetH1H{|sv1)QBZv-<NHMv+dS5M8fl#8iZ#aTjeU{?9Mj_2&ldY%nWcd
zo;6lv-WVeQqn?glcKYN>g^{xYfg5IWw8!Oo%;fs68DFGpeki;bP<dSv`c$XeZ#v>&
zFxsZLVb}n0wanfphk{<tWotJ?14c1ZAt=P#D?si<$~yl>R$4;g+9jwwc3XAZ7+`-b
zf4AqIt*%mZt4S;$2xUu^I~uH#awHDHi+duRTEVJCSp`^~rJDhPsaLk~nOOZ<^w_%K
ze<9KaH_AdzQo`44t}^FXyJRK`&#$Zp2zp~aVd7<#_Xrz5XiE?}fQZ=?pk}g6#B?%s
zvp}<61!^-w`f1z}+bqo`oXG0@El(+1-)@n#kQf%jq`|kP1JvHF^J(&xVix%mbr)@k
z@~#wlUqL1<jS)sZW?FYah`3ZJY1MaIGLf9S*X~zN@a1_%_E5sgT8o~EQqtVyNuvZ9
z;&StNOLu$Ypi8?6cCx~2B0}23JQzdq;w<Up_=uC(SwQKDN)>>(5u~4-Wp3|c(LezI
zg!#6sG_{%g!vq<Gq!}&|XR5_TWs|LRxG{&!8C8-6=J8giPa*1fb~j=A>qyr3q|TyM
zE(qT2<nCyvy}))#ykjtGh@{aMRJPEUdL@2{*F4ZqAvrMAsAMV#85X3a6DxfkjB%L`
zU_V7x1jcJY?H>(7v=~Ko)slWt5_%rzqd245<30cI&QB`bKE2PvEu$M6bF&w-$#?vA
zTU*a<FlRHQ&h%5$CKCy#$mnGtJ$=H{nGN!5T+2{Zw2pmimIRlsNmg+PqU?1*)pSE4
zNcyLG`EQ=#yI^f;*h1IBq-&Egsp^?ks>?7eqH4od*_QM?4rR7Fp#BLoOJnQlad|i*
zB*AUSFzB4Q`x!t0Rf)iwBy_*$j2^1$M0^XF!dfoX5iTbk<+B#br`XapkA}2p)$5d_
zxa@7a-eGqDc=`mnEp!2J#>sIisB!PS*5u!Td40|h=g+&r%HQIK6_%*uqI$yR(=u76
zu4vlt9e;Q-EC*?rgr@ICa0!cd;PH^=N~o&0xRmgRPs>GTX4#AVq;NcLD#^@Jpx^2m
zqz!A=RF$A8NLRYoyUPp&shl`SO{kUSM+4yGQ!I}gW9R<CC>up?<kIp(p7-sS`a5Bl
z`e!=#VzdDNolWQQVV%Rq5<E#-4~PK?;!=%lS~@gu=_n~z5}r!f%Cf@|ql@Vne4E)(
zVcQ-mMLxCkQ1Mh=L~N%mj&t^Tb2<?3;@6_P<eJ+wv*mGt^oue`STS22?7sDuPA+BZ
z#O)&0;N{WrgtS>6lGUQ+{dV1IRLx{dnbPQbXv_(X?zF?Bi*aljq~?Z~jIK|+>Oxr7
z2GO&IJkSG4o%)T7;P@DNc<G$nrKo4FF1nilE`*5ucn83By^vt|H)Pi!f0`ylz2&e<
zd@p+9bR(Yb$~M%Tv?+F_y3lgVl7iwUYzNPT@;4A!3K^(!vaRTgn}|6gd;gKny~HFY
zNK>U!qc4Wvr0sajyu6BnbyuLY5lIwF#0K(@kT}vg?iVwNOL7&zwAOFWiOfYrK7z=5
zJk#kgl1t0PvO;ZC`k~M`j1=xYaIm*+S2&cs%@tna1WC7T?a}I}lu;e7XuH);Gr?#j
zueuL-$^f%OoF^@-%#)<w!weXHles<(W={Q$@qoxgojr2aSozThoJG~9NP*cCpK}H%
zyf@~7S69YK*pOisNSZIyw9VCz8O;m{kr28Z`<g0e1Z|oZN13^&JJ73)5UdF<M?bPt
z+_>}J6Ht&TP}XGo+B|)m!U{cuoPA*VVpfv_MB$nEDZ4tkakIlu`fZjgf$Ai@Ct`jZ
zjYmvX9n45Lf$>XD1vjQT_Z0UbeUs$Zo~?bmU6=Nc^3R1g%ch*|?_YO_aapjvMLQjO
zGghbeZ#iytZOaHI@@e~iJH1&zNpKW{i!MgaP4HTf#jYYn6{zJ@Ys};Pk2!!f8%FH9
zl*jB)yD3SIzaj4TyR(}>nUZe8lr@T7*JQz<XIBL%fC{X@UA<`lpWWQ9hS#%(;B^<L
zyAvSkwNopTvx5MfXTuIqF`uKv&zGtuDI~Y;!b~GRGc~tZoxj4t;be-)X4PT<*86H6
zS6I(BAe>v$v(8(E+toeW?mX&jj&uk?CncfAWUHLr$ut|)_!@8c>mZ=-13qd4;G&}e
zCosV%J~fJ^XD=9+@|`Xq@8lCtMU*yhMkwvGaE900h)i*WlFs=-x&X(={VTI(;})zm
zp=D5TXu-=34@udNnE@y>&M4M6ot6@8X!HUH(3%;)D6Opza5x7(=TuIdg#wtfYu`GC
z=uQ}Ufyt<PfCV!f$Wy1=AJcwkrrA|^zl{9`CoBcf;$zg}bKQQ2^+yVFa<+L6fD@$d
zflScjY#v4RXEbey@J+1e=$V%+I-ABcW{NJh?ypmhm;rHbokg`0?eo;u_JVpq3STS9
z+^yeKWd`g8wwi!bNp9SN3Z0OrSZ6Ws$XO+_lo1^Zq>K-c%EI6JR@jFtDPY9@Tf3V|
zkBkl#?Io|*#DvU~cIgx?&ceLrxRiSF{S4gP6nR!fZpESNm*UI5k+I$ryXz8)3JCN#
z>hGMc^)<A9@+P!|le7Ko5trmwL*KKCDvZ+(Wr<Y`q1M=Wt<u`He77|b<{#Er3804a
zt-9t<%YYwnvRo;1Xil`YJ-F)vKp7a>K5MFoSg5sqd{x<I{feRe52x=<5OLEDLf*7g
zFvxln+W6mxS|ZS>kI}0*f5DF<@x4+2rodHFnL_+uGVd&If*4-p(EcS6?u-*aN6&2f
z9~u02oqxQ=M<B*hgC^1bFBx_##eiwBS}c<99P(G3zn5%)Wocnv`<K+czZ?8N2l@Zn
z5k6B==iiJYKGY8Shj=}u#jSVw$!zELm4V|w+VErgCLDL#NoSSp#^d92Ba=Q!B?@u>
zmdWxPDYom!kTCp%%$dOeh~ApR(EpIUc0i;!mOhvLDUI|ur4aQ|Llpl_|9s(u>74_j
z5wsnB6QS^v>Mtpy5M#i}VDBO?n;xH;^|?$o`sSVf>+t;<2E5K^Z6A)xzZ8AuD8-Bc
zu!5sm2H9WV|MB2P{G-Cv9{=Uc8dnA0{b<?O^nXuhAm#7O|BFQYcZdDAoc%2%e+vnq
zTmBCx#-#j=?LYqu;7<+pe^}7png7<||6J++|Ei=LbHeKc25^j~Yf3uq_W)ERx4^FJ
zqY3DwwvjhQQKGRQ9-7)LT-~ifr7|7EUCefrSIGQ(RL+GcK>a{p9#3xzqG2*s0DFo3
z-lToqCOS9WXN^c?fkfyS?Zn=B2*G+m;Tvz{Gj{j><L@5;cF5<od-&Q|XV|^~b+NDE
za9H2IxZ%h#3|uPL^SEKZU(7zmp~K;ZiP&Q^;oS@XY?OoT)pJ06n4P}!co(?X$euQw
z$QvfM|7B8cZ|!D-v<7T`Fol5NyIOxD(KoS>{Z?WrXP_oC-1KEWsufNVfTo28+~4cm
zbsPNfz9%EqO&5ziTL4h(Jfte+T?o4P(NWjXS4?@Zl5@j{O!YZiz1byg0d&xiesaX+
z#s0t~zyf<IHqGU{u6pA~7jj-v6GI;j6!1A1US2&orU6W#nj0z?06NpNalFiwXG>(M
zic0ZV%iA)#K8sHV_-Zoq0gjNtF)W|!^Xa-f3~t{FfezoIYC3_Cj@5S`%B%~MGMx=l
zVhT-rmDTOE5KMy0dgpwO>!vGMi9EjGhI3=t8f(8$-|OZquAT;nZ1&&Y-P$TB>vtqm
zeylFbE&#<GjgPh$Dy#RY;h}LpD;rOh-CROytM0LBG|*4Gaw;VFXUIK);F+OUbCQd+
z_z`dB4VK&*y8dW4fKnP>Z2@$)t@%hPqRR;&4wx=bXEXmWH#G~?MN78)dz;ZQ{ijuE
z3{TU=pt=soIlr(nX~Hy&i(fIxMdjg(aNH4|+Lg@2kyT@>dnc`oS2J5cG-TD!7qm6N
z81sa@He5XW<U)r>;%&{ma}#R?Am4+^5{JLKCO+p7c&q~9qPxWK8`j?GQt|*j?Axsd
z^0%kPXOB`B&9XQlOzH3LZghhbro8r*tAL0C79QyiM#RO%JFyw1DJ&Gv=V5zG_e)13
z{*?o(3bDxXKKA0Y1?4OcvBpiU*b9K|<OF#A?A@As!ls=1MRIqrq3UN75>pW0%dNWY
z+Pi|I-}(TK9YlTeqZ3HM18JoC@Rh833!O7CF^JLB0!IPK|EniR@oO!<0c?{^ATEPk
zsGVHXne)1n5mE1XG8;U(Q8us@Aw2iqe%U3%3C}n)POzar|MljUuxR`oF{kDA)p64#
zK)KqmOfbQLx8Sjd54Iupy4dXjCb7NVeL)3AYV4`_)o_OVVrI3lKb!9M4PfNm11sqG
z46Vip-P%}pt3v7;HlardMK9eqdq2CDb>*`QMr>~@LUrQ4Insh>i>v4G;a#lpzZk^I
zJ?j<4RDAe%uUAzOqTOMXp)penBSW|&>ajaY1qyF&QwtqEFOb?~f#9un-T&us=Z2Ev
z(^F6?U*dBX%v1ssHmCF$m<)A*CybX)3<#D+r#SVGIU7p7kivBTm_JG1xguMN=r{?^
ze0uUJs|*o0$Y}T#kXkKue$ji~$ruqT)+^Sp_s<s7g7VMLiGAxmVuYgCHe;)XG6NQ`
z>rcc^X8ip#11#`$Vt;*fjf9`;sSi$EtT|SluRT)OxJvWULyTL8#uPX&{wa>Y`|&R}
z-(gg`h`{gxsMPX%Yu_J6I!8)fRiE!hA~ucyPu@bcxAZxL&2;b(co2(`O?cUaLv>s<
za32A1En5pcH%erMly`u^pSQ1`#rcEz%~gdSWVn~|^5@gCfB=i90QnjYdwZNbebLb;
zx?a%b;%@XKQ-kA%zHD6D9)qb=sb%Et5-%vv#szRJ67;RJKcc_+-kv-hG1@ltSY_?x
zXHBaBSmrKH&Y`zo-nV_6(scH_7`<6Fy>-LC$lzk*a_V~$uMf~q>9xcP17NsNAiRnQ
zdN9Af4NyH%9kA8xc%svL=?_2Lc*0N&W0uKwEgU*6&VZjB9>!Iv<LGX<_;t`BY8qhm
zP0P@Q*ytJW0FlrmB|$KN9|9Ha(*Stjhs8iVY#M=uB|r%!^m#O_XTv1~Ku<yjHc|jV
z^@EzA8hTd84cMp=5#5c~F~zIP`o*5(39ey^JiP{*68yNJdM>oa((6^XaJ2CC#lB2%
zBQRCPx;Jk)h211qm`i}Z{ALD(dO5aXYt{i&c4pMKNDK=?&EE1#x=!l=$P~ZMoMbnv
zikeljonX~cl1-2Ynar0YS;YCoH2MZ!PP=WjhSOt8GDuoQ0Mf||{>7QHuAcklc)?`c
zk0V0!B6Uw%#1}gvP#Ii!@_SZ<@cnz@{#>gRhZj{_wd+AvV~4xTGQ<+(amk-fATV-(
z$vQpyQl8x%0Weu=s0`hj8_w49n|tF+s{nFJz~jz=AbJyI@Gtn*Lt@w$C4B%wBfyc=
zy-Hn+?fL4y1JG~-M9<T&FW47oB2G~EGYdOZm1sU~-SFH$^*S(aKC~lLdC?_1^`@wP
zulti-ZokHhG+^maW88rrmZe`7=ucP-Y;q36KBMnJ*GLXy981@}<_A@d&ygV<iLF^L
zp-q>rGe@5pFF{#%$lgxDN?b)J(|^Qi`Y?JQ{M^aG?essmb08rur1)l8eNNr}4XwL~
zw0q04oUT>TcGI=b&b7bO%QHQ)_31cW%fu+{I7Gs`R^u^?c)K;ujmFG@N2hUADpOcL
zii*c^CcK3aZK~Qytlm_os&(?o;R}3aDC(vkmOr7qaj3>r-qMs=Z7wVK%Tfuc^|H4$
z<&_n`bwV#P(uTJ9jy_EWlDV)*M69k>7b&F2#mh=?j3_nQi9eI*IF&ejcLw`({0Tyj
zew$xdx&s%}%B3&XK<usIt+GS+!3tj^(m~ocjx_3Xeb3<5o<K@HP`MLJ%JN5-B|Qtm
zsk?9IG5YmGMgZpa{WG`mmuz(<FY`X@&QI1_Bnro_8gbZ!6W?2U^^2<m8tzFW#9Q<}
z+xFVTiDWCVt762E_Kc1$y_DIwm#>qsAF96_mY#Z;S{YgT!t*IDDS^p+%15iqvyrAP
z!KT(K!o?`TfK%-PkjUA}=ho4HT~ep|%-xv7DqSZQH&Pti)%?{+n&O{`j(P1ldQOEe
z>#sTz9ct~w6Vt35?jC-0>^TW_umSg)q4rLJe^#KkxX1X(-E6M@%piB*{XDNIV%rIV
zhq|GD^JZ9RG`}M@!R*wa#W_lt(M&M?<lEUQc$cGPAp$>)cePc_bwfEp!PH;yk+R1!
z9nO33^(Rt|8s&ngp9`e(%v$bO07SuQA4?y8CSXYoYgrg~J^r-&bOj?Xql8SKoI=Sq
zaYpKVqb$OP=7+|Ydo80L>xHctB6K^5H?K{CLImjXZVL={ARgU%_V9bst~`6{<BR@t
zGZiPq)qZ+#H@%USd-*p^f@;8clai!}Wl3P>#}F)DaQ_I}cGK$oc@VX72l)-K#CQnL
zLbUZ(2#p7_R^yv4EF6<=u~~%T-2L>RY+LE<7@$hnBPrOrf*F0>)ZX&S`Ijxu0!)31
zLB;vkFILdj&LlWh&i0RYaFJBxm?bZ{=Fwr8#EZA?veyyZlU(dblcC9&${5Y;)l_-k
zlq&o4o%?D4nM%U*_BD*q2Xu~nOkq8&CVN4Ciw<nB_TQ^SgkYN_>(IB4J-RIyu>VVw
z%?bDL3gEdDbcWo?$x_16mp7b;T4y_bCggMbaJrkCnrQ21Ht=ca!4>XefSX=}MLY?4
zLsqV>XyOb~h5RM1wM<tqiKN97!-qEXO?SQC<bT(;xm_LU8i)tg`x*z#|EJ!*H1tBG
zBVq}*m1CC8t4^YZtJ5IKe)0X@4Dwk?whV_Un8YFO)B%k+mDVo-WI<(NvCfcISwVOu
z{in^`fl~f-3ZZU6>jx3ItE{RucMt{(0xt2554RMnBRwJpiL`!^jgtlVl0i#N+j(aJ
z9`>b?T4i9^1*2Kmv#?Ux*F8G13(8*#5TDbnNH5OTi`fTIRvMHE7xB?wfr)Kt=vC9G
zLQB{~aLIBUr*ALMU=3DZc|iCb4g|J6=X*(hXD_OrMfKje<+?xhFEbZfv5y6s{d;GN
zJKunSl<w?`LWmg$xm-Qd=Y9=)`TT5JSKcuA{eR7Hm!2nNC-V_v+~KoNZ7l+vHLF(B
zfiM>bn!ND{?LsN{)q!=z5U1a}WQ$1${6C-19YtLAN5sF1eM#>h96WrYSrK9R0lpr$
zSbE7BYTqII{!qj#xBin`t}1WdAYzm*z;npud@hWK$o<Xi(ZbLPud8La>KJdyDRUD|
zap%0ic#PeJqNJe`f2Xvy$vo@Q$MV!_I7q;-yIUx&tEfOc-sf(}#G56;-k+w|NyC(T
zdqI3p_DS-u(F5>;c)h|*l!G8o3pH7XDQyn#R7;i0g<}AfO~K&P+5QCbuKZ5-&io@9
z2lR{MZ9BmHaZUHd!2T%x06YF!%RAC_{Mg$iYM?H2wnmW57c4^RFKA)E=VG#-n7~sk
z%vxP1hJan@P58}SOlffrA)dJ41#U}y`~%lywb@&#12AtEtaajFJ9cGUmY)~2E((p5
zd2@%-#!7=;qsTvD@{KNWiINIwyu?il<o7?=4@%~p4Ya^s4qX7&nOw2?Z~;F|kSnYU
z!yO>{65n=i$sXJVlf@E0e!2UNr<in+e!%A42F-5n6C$Pe#Dy6kK2}Uh?l%D(w2y7y
z82rQ%pkcin&d7kFZmnru6%rB7G7|I7_+_hdHn%JdAg-K1xo!S9QPRS_)<52~nfbVM
z3p=15Yiz02{}4uM$6}|oPUsK5GnSX8d2TJ6v@@q-XqMQVOh#t&>+}O#dI%8`Jj&;g
zeLJV0|J!Vh+@$#13Kr}jRMtbZ`*N!PB1M64f5v;2D1J+8!sxCO<p0OkSB6Cuef=sR
z-HnupLpMl=fb>X8BOM~$3>`z4!qD9!-6%uDAVWz?Nh2-Ybr1jd-uFKDx$g%)4Fl(#
zz0O)|ul<YPm;JVKM-g>#qKa2}Sv*}z9U}EUJw-HD9Glx&8t=#Q`M(t3R@5Qcl)%yB
z18p#Nn1J{aho?I3=Lq+mbt>Adqo(*=4E1=I__$S=G^uLx(PTnV^HP-o7gpgXx-<(L
zrUjq{l~rHR#J4SlFv>hve@;Lrp0@1PM+!0uI!+ZRpzNLtKSl&X;R?19bumqZb}v?O
zG3HEL(x={=)XA?Xh?sY(EhusC3t4?>c6NE7AYOf#S&wKgWyz-^{6dF(vKc8QBjyxM
z98c>psgbWbVLgWb3mp#Z{}}csJz(%jdJ-htSvdTSS&u*NVOk5Z;8j@Op#_i8D+tNA
zmO#d(k18|RIj+No9<bZqBtg(Wle!#j=B2vs6+L6W-KH*`W-}$J9@8{e3@^&h1d0ob
zn|;BOC~}zoMEe*Hf>y!zDSSQiDvJh*OVdtMtUz&gjr@qn72V)-G^|Hx#*R_)k6H7c
z^OhSTq=Xl(oz<jzVmR!Ud@YQ0o74se3q?0FqS#2Zx{E$ozLfKQBRLU2#>EKW@U-WT
zM9-MH?;!rR*+(QgODvRBhCR^pOr=*Tk*CGei$`rAZ}D11Eu8<Avw7@%oc3;Z)UTT8
zAm?l=n+xo9Bb*bTV>Nzx(wz~IX3+*}NN>Qf)x~8gp;CLXeN@i+Z1u-`FE}jOY0?VO
z9$ULTx>ZUQp=rW07^|Z3j|S+r&EU#3YfUwK!bvydA<5Kt!gn|x-Pcd5);5IKw9!D=
z78oSPuwz$hJI}wPipCNnV#bX?=DUbd%iVS$BJhXOzmHv>5Q<)D%{7WWbgKK&*RMw2
z4SDc%hX%Gz@5AXaBTm|7-;G=~>#k6a{`}Ezch(JA3VL;M*rz+>yl~K%4KbPM8zYd4
zq*`Hq$LO~b7w_qRW?jqxmZJJ3x=9UpUJycIyq(`FaSNz>-R)Je0&gx+9JvCb;0u=&
zrds?w#e>evtP7_dd1r?&oj$;%f@&p|HujL@VqH_J3)Acpn@aL7^JJaow@X{DUczDY
zxAm4>_XxYTRW=bsDtv8G>Rrnsdtye_==BP9j&o)1sZ}=JQ+n^qE+f}Pg3}(}_!9|o
zsWJK$W{eehAZlXPap<V?kX?R~#d#mWUXMtcWioSXyjry%rV*q`m#eq5+Y5=g36~cY
z(JhU2I{{`K#NEfp&Q}~au0SaWa}yuTB%E7WpFrm7N`m??%{^YQgOQ|GF+63mOdiLP
zzLoH6tn_Eee%DHd#DP0*9PMuOD`ek*yGBN<Sp{6s>a_@3kA$V@%*DI6Uq7{P=~r{j
z>^>!FbzUI&n;C!7Gcp#?s|iz;y25h6*bu9VSU6x#UeP~{r}DOXC#?Dbs>M;%<F&XV
zZq-?&`n@6vW06!)e4br&Z)_z=aG3qPTVzLz{Ya&~yRm_6alB;P^?1oJ0TA-Cl1lp|
zO5dDx_<Eatx*_hA6J}REQ`;Y*Hs@2_i|<mpnAYntNYK6Ke5@n}7FiBlQ1dC)6PC~E
z5hkA#sw&OCKwdjXADj8dc&SsG(6zhK`tx2utmK<dwo!{lbBJ>5&%*?fYFw*Y3|tF6
zfe))i+eXs~qE{(o`2EMLhNXDnAP89W9+0i_@GZ*41#zsM^Ks(`pb&N+r(pc)J|=+`
z?KcM0tBNo#1M`-7*}LE$8{>1+@LJM4{DoV~@ADRAOViC)R#XF5Iq|#SPHiEO_oYUL
zH)_7Lzdxv?1yYge@r2uhJm&uUU3@I2*mSU`9k_Xhbq=v3SKbw~``w6OQHw)(O*Bw-
z3!%xc7b^`@c2BFP<srq6%|+V#QmgH+=}g>lS}5>;34VSENL(U)zUF+bj!bCIuodkG
z3N5_P(iJ}99hF&s94GnZ5Ynz&1#}YJr#D#%n=;enI#f0W-rH)st!>BRB7K(;Hgj2V
z=dZ{SZCN%|4vD%6C-J)5{CiY)8zex3gPEkwG>^MnvFdv;p6+r)j?0kLro(dre=Q8%
zSZWWm+oKF)lz6&|Vh24T1?i(s4Mn61D;h*$Ja7gqSkqQD(+%MEk&?T}5(;VF<GDBA
zD3%|^lF|I(vZpyrdBtFSWEq0QRiPxb>3H?xdp2^Q_H<qJKQ-@DP+~+;`(!$FB1oUv
z51@$_%g_)VcXfPMWFmL29|-=f=+(N|K?a7=uS<WqJgW%)(yTfFkCh)bl!|-PWupna
z7u9%7Yv{kaV|SmB{A;*uMl$4pYs_oqC93hg*|VHY7ASuYFy`2z{^XF0Vl5p<;>EB>
zV<TUleNA3}eJ^Jlw`(BYQathZ`$DFU^KqtY^1nAR<Fjo4N=_qBW<&#E{rcwi<{-Ol
zSAAvz_1kWYVhsazw62IKb#`94s6eqq2<txaXg-%!6dntbWqj{`(cEEW!#~4y$*}!Z
zYM$OpiOKB>$-!z7g3a$tTnXT}B7c{jgUtF&z#?+#(%>jC_2{~oN`>)dv7~-!X8gvx
zuLfsM<kfn?zet_K==HBsynKOz($M8X{YB^J{K<C50R7yPB)IS|8)t`U6~cd3e2S0@
za(VLiD>gbJYvJ$!5%wA&T#@QJKz&ns08<U^s#U6)#hMde*y?)}{cGVW|E~fvH@8+H
z_@zM~UVkmE(&|5L+rPgEAFa4fO1-aWZy328n7i=yqwY^=iu%zR=;T3~`|Vc33D;QU
zMWAf9XvY7ER)8b(?M`9guhp>h4$p8a#<S;Ffj=1{UZp;2xvWsGsW~+gwfBtoUiP|W
zh^~RU2LUc*WiPABHd3NtxM8f8xa=!uECg{UYGxH>vPhb9z?qXY!IBh3;_#ZAunpwI
z7haP(-_U$?%U@1MV!C+5<}XiN8*p6Asp2$5$}E^`&Wcwekw)6LDiTpFoVHer)|WEf
z`}>e~iPUI~-Ji#{!fx7{Ni*Q{pY@YhcX0TU@d@p8hB;SwR0em^iWJifrphOdIP31H
zLK$%V#BrU;#1BBb1wHBGLlavT6BtZNRP8V<pno16Z~AT66?<qrx))sMytj_QX*P@h
z*SdnhdcQ{Z2Nd+QmyDk~Mf6CD)-y+6XYq(5sR{0Fo?+0hfHgEUnQMhrF=)9>ZpFzN
zpiT(3;FTJ+2=5UYg0>}o{l$$wNT=7-MNFIWz9I34RhF~EHeNf+p%M|!;HTx-%U}aQ
zi7?HrJ{DUFlqF=VjbVyC@11S=N1U(TW9W<jrnv@Yu8ya->K;KKS2vVC7f(32@lV~J
z(KY{QRt-yK1M}Y#1c7ssYY(3&GU#BkJCQQQQ=^@yM}Xw$^dx57_II6S#0F-Xn&zl}
zwCrqW8Py=ls<@z*=1{Zk$#}>E7R`E}Rn4dGuZBb+opt!r=t*?97B%jnKl&4c*;d8w
zYB)l9^o&1~&q*znMHJ)fjI7!HWK5B|>{6Yv;*=Enrr$qmeg!%@L@lVfjTbL=uu%eN
z-4!dhPne8G1YsPF=IJ52%l*>O1DKGV+Q$Tk?YPF`w5d8=cFur;=Q;g}p^pP*4vaHo
zzq8beWz-bTs<dD9tI@X|+7IE78v0XoE%Oxg<S&o&5M!Ok#%rB@BX)zALv4UKWs{dK
zxUAA}G#b_R1bJPv@WRolu6sySrzy*&dde>4yk@UhaVJHET~^<MHAQ3XCKi+}3?3pz
zqFX^h6lv*<g`bR4r%J6hh+MvERc+gBJ5g=&E~>=n7CfWZ*1t2oo)g_~3DYRPUoVy_
z=dR=rsH=VD5mJ{(e(M2wrYa2n!?rurh@=$18`A06oz}1`yn{;3=H>sV;Tn%m$~9)4
zTDQ+RHCRBN(_8(0Q7N1vabWTldOy#uBYT5f7(n7Vpjts|%ZC+O=zil3X{Yhecvp;g
zvs#mEQV-HmB|&!MYKj`c2GMifa2IRimZpZtjjhu)%v=tM6J#L|x8+{%Z5*ij6er6j
z7U?(ss+`V^>%co%vL|QEL~<U$|Grd^RRrZZujRhtG$zRsC;*S7{j`q4lfS$jPz&Hg
zicVJ8%=1nYPDJsR<%iU9<uv{lsH#|ctB#-k`&x&V%eY*BEkXS$W;K{m4z;WI_5OkY
z8tmEvm7I-~EGCM1_h4u&kCmEovL*nAt<Wb+70Qi~1XqT6Ej-_Bd0JO9p6kK90$p2D
zerAQ0WC%S=0{_rg7%`A0$%M@w6sT3xs%9NqeXxm_Oo#D^*n&I;g;$znHCC4b!lIn_
zFuyy}k+BkTI8<Kt*=d|q4cp!BdYXcL$_BmhOWowZ=CVASQDUi#WmjgtAjaQ+dX~wD
z^f6(=^ef%Z!!yHU!^S95?Kf#OI?nn5c|+|24A#PEQ_`R>S-!iJL~4>ha8>s1SURyQ
zUx&Q51$zC5v_po|XE35`^f^y-#o7Ysz>9rtc)ak!%w<wBi}Y*=Uu&#h%l*E=;V_hs
zW;0RW{H!2}6r_E^$^L<6FyqOzL#RVY3^(2bg7f5ypkT1=mjb9{bQJDt>f2}Zg6U67
z@O3zC7IJ=bmxka=?ZQ+X8~9)VJ3dNcKRZsWE{8hR3n9=D<-wdP=dv=Z?{A<ZvNET$
z*2M8FFF6=q8=73m7o8}&FML#G5O_SEJC$l+IP7K+#e0|{(v?6e$)!$MQXF4UwDW&r
zajfFV@lPF?ru@7b0(|jKAzeg~JzjfcLIGko*L#4@9sBVljbtq1_&CV3_b-#*>dDxg
zW{$QEyw_j<3Xv6iPaPP3S<22Rx32~$`B+Hbs;#!hdVaa$$2}yGo$rYuG8Ua1bkYKp
zhZ02cm2@Qj8a*cNaEZbtziVlG!@lWsn{*pu-f1Rt&ECKzm%oT9aM94_+Yj|kFG<Q4
zB5p{Uz~SDe=F~UOd9-ZC2{R=d`Bq}z(erA{ne$hQ*9-A~iGEk#JxmqIlWti_yL-#)
z)GGk<&S0e;RKMJ3w^StgYgiGg5+gC8i!9NC^mBIjg)X`KPZRKW#SI^<?nY9(#QFo8
zE?57S#xW+``7_sjhRojm<c~Ky|A#>u_Aqfz%z=Az>hwcaFW{v^1h&*}iVF&-flsK(
zlkwh%3So<kpCU^?1^cSCX?Z5#!csebzqpL@i3qxBAYC+aEIE@uDSv)2b2-ocI8j#6
zpxF^if5xTa$4s#!c7{L-oU!g_mat^Q-reSzhR56b&*jSM&^7ac&ag)aFIr-CIa7<8
zOCfK*pU@s)`f;T>QG>T9Y=_M4N@m+nMn!3N#IDwuxzaaTbF)hAGfv6u<{(lc*rOLD
znY~hxeW<z8y`07h4w8JUAc&_#uD*)X7D;8SkCl;`M81^tSCxgeWYZO|Y5H=CLf7rM
zz*e%=6=r>XjgO)_%u5+4kpaDT-)O7m(G970D#ba!I_7e41_?O?DU}No=JIKlW)V3W
zcVwLniEbo1SKwO3?b~NddAw4K9RsFR>1kgQzPV(d5xC@9kCuLjFP>`QEI0BkFH}cA
zPI;=M@1q3_kF|jKbgEcwpS*5nTVpnqA-vGwwUJ^V82Tz^m9jWV71}?_ej?$>jGWf!
zZmg9Sf9#3Zyi@i~D(OoTB8ycYG_3K7r3y=zsHD`<x7gc4Uin>=<0P80Moenx&D4EF
z%5ZofR2FiRotlc8V;{I;WHk)+tg~!aW|+4lum=5{IXk_C88~jN#cdtRIpvgZTn4}O
zFXVc`m2;(q@08~L7WTeq(u6tFk`Q2r2)Q-RXGm5anG-wNEw%j>TIlhwb?tU+h##;s
z*jK;gVEgrsq9kA@FRRPn064=sRC;r}Casq)k2DN~-W-c=xZi?BLPoKlqoaE=l_;9w
zmE&P+fQvx?yX_q}n>%<^q$y%{>V7Y;VQzM0n=NWjh5G{c)#bidtRlMA%G)@pzwlI#
zXscpXD(1Zkr3MMN_W-xI{7JdDjIK}u2R8um)$vrPJAHrr{Gs65xDmB5n>Sa=_-2uG
zqrklYGsGsP=L5<Ba!r&rFxz!D6Y@r3xG16_k-pOMJ&W>nbfeHP-uA15IzLuRR^^Y?
zW+ZCU=JEjJcEr$d=bh8qpj*d{Q2L6<X=+K3nu+~cffgyq<Crs>=_Xs~X~hJ(R>=Ur
zu|O}k!k)fgiZ;x-a_P$p=w_<*QGM|ws}0(xGtoP9#@%3#!Qx~9L?6|xgSlPQG0YxX
z0yfKY;`@g105X}eNLe8ZuL&<~jidJHqmEQsd%LQbap`~8)MK5m`MAB<slt`o0Lu`u
zd~|{gs5Vf*`aQR$r=i)*vDsJuHE>u9*6YGP9|%hiUGJ+MamkcgNf_q-f@8&W-tlqc
z%kf)7Gv%a9eIPP;GliGneg2WCF0AZw4rWs>OrruDnD?CNHlM9`Vxk%kE}4pQ6E@vF
z<6KmJcfi-kt<(RjUMk?oMOmqf^TzOZdR|0k2jpuP9`Z!4;29WH)B}{2sMk<;Z`&?j
z>Z9eriiTQzA(f*ylqIiYC6@c+NKrQ%c%Ia{-&nogo=ER-AXbolOEY%b-%V{8f5R!!
zW0S%tGFa#iLW()USJ7DltZ)A;2Cd$v3SHXf=f4Q3m5W-E<knMOXJz-!L`nz<V}=?z
z-BZO|v9`8^H$Pw8i>nSZ7Yoaq8uoD;>HK2TANq3beQ_*F6c8_RRi(g*YTZ!YG)+g>
zOpz*`OLcNvT3A?A2%4(EamkZLxAOt~CswbjkE-W_HB?RG$y8HTQ<~R$MI1b|VXA{S
z6`nytl1;5@WHwd$<RA~E)s(nt%`@s2z9)(}P6R8Vu1(3Y*m6oHwN1w<uixb3)d~#(
z*Sqih_9pJ6tKkwP9!z^{zN>uD0iqezYB+*l#&LKI%q?-);a{t2J$H{TC{k@NzM4IN
zW93N{DpP}fKUR!8@j~c0$_Un}fV^W&W54;i;!mV{%Te76{BmGRj-N8^9_Vls10?0a
zf+jLY1n3|vK6%$$e0;*?L$V|%cY^&w$|h85u%Oq;>iKb8JEI-0*$8F*b(b*rrEw{3
z^KI35|9bHf(n!4P8_=_z<ANAdP;AX^mGw6R7Xpf_>zAfWtTtR0DHr}#9_u&86F2p7
z(j82*4tm_^0&(W>xp;O*fA*d+C)D!nh}_XBfH?44u0o^+9G9!&C#(Q@%li3DrV-G<
z6=XUNIO0oEY<-h%<)xBT&{Pv&0R2vHd#>UWa;7MLv5_87rV$xBJiF==-pBf%?yRMe
z!Ri{<S3dBHhLaQoe`=8k4*f)8IQZl_9TPF>bB>qhwF5k;xt9(ECD-tQJf2dqk^&Uk
zi0u1-N1?Vuy*VOX^BgN3esS*eSSMO8Ta^xvd}+qE1rnhu7sjx27-AZ2@Hur*e|B2-
z=uHvHOMLN|2ixJgcOfDQvZU<397B)&nRxkH4bYwOFa|;-|5_bU8!+vXAGDa&siwKv
z%2Ca07<eB|!%D<Yc8Ocxg^W#4ut21^-dVBI>fSiy^wx4j4$>iU_y;cT?e~s}JO(en
zzK8LAj$^iWwh<u$m$|u!R3|CCT3q~Qnaqx)ntm^ypep|NXWL$47$4gQFX7Y_IHKcg
z`=*B}3s;oZkNYF=pcguQEot$@%`xVRnFCQX!Cu4qT_V&?oZInc$McrFqi&<_6CKaf
zIw42zu!LPUaR*H*Uuc3z-;zRDK~c3{KkCWM0+n3#evNca37LF~RKr@Wtq>~X?r00Q
z4(!+TnC`EV^s7pjqCis$eovV~+>DvQXRsV_B>1OP)h5*~w}o+*P=4KgB@#Nm`sKbN
z$!VKs&+9)!-X?xhF}%F@JWBPk%+3&(ns%&WfA}5a*-!8<Dm6Vrz2>ZqvqAEUQyXA-
zFxf=h-bPmZPLW%?p*_t-#>nye=#F&u|Bl%mnBANPf^3rY`d7;b%UH#Sei8mu=4?6h
zD~+cAs+zgKQw?&osibD##<vUTgxAD&BLtnJ=DWqYfUF2HBcpxHitJ8s!$ywZ`zCE}
zXX@>B92wuv>5ph$(V>#_#*Av@K5V6yZtjnho7gQ4ug27UrZaTGQ^pxNl46hZ=vUFd
zlBaiEOS`mUIC}HlMkQ9`V+Lts7-S9HDs(WRga7$&!_;dt194&cgC~|N8&hlWHSHT*
zU)8`%`*MC=nzrTMDVt9-E>K#fW3=k^_B!FEE@AlH$ex#a=hIBxmuLzR!lB))?>X-A
z5>B!WgrOu7p2df#RGZ9gW}8$}k?yve`f{pXt2Gl#cPS2L7g#1NA%)$5R6V~iUC$Ab
z7|~_0Lrb5XSdSyaEl;Vb@YgfEJZe5m#mfT>`w_1kmfDaBb(4X_exjUxpB{hV@NAnL
zNH@Q~6{c~X%k!<*v0Ysnt`;%e#<j$Hb*Ry~Fm&cb&zL||;w+4-_zK%n60y<JgBse!
zmI>q2lXx2urRW}&z>6fDP3l%>?_YV+_?wXS9_&`dWvoniFBQ+m0Gir%fOGnS?EPBa
z5CKvqy=%KVa4oYaxo)GG+HHLUfJ;!d9CILJou2ea1boiecAv?y&28t$6hnSC0pJiG
zEWWU($Cx>L>oWR`)!-eN%hDKnzs^xS3%RkHS6jZ{3K(`RI4m%MRy`MRNE&bD@-<1J
zH(5N0VzkqRS@kRW%^xGe;}E`ej10$bWhK}&1I#-Z_O=*bwP5ov^J&!SoZG`lxRMI4
z|B3YueQ<*7`#FaUoS5}iiLEoXKEK3r_!<-NYuceS2kuUcf29!6Mcr=+vvC@s>Fy2{
zb1@TQs{VzmQN5d00nBwXFnZ%WDVUr0hGg_FQ2*4N;A}q%Z#mPv%QSkmIG6w1s|}dr
z!ZhaId&)^WTdGhM4;S1U=6?3HR?2ashcC<iDg3h`Nwcg;KzNNme-^$ZOk~qfbB((*
z0wCO;d(IvyAN=a5E5}vcvZr{0Ocm1hf>|MX@T;y~wXah<u#KK^6NiMF=X_y?sM1#k
z4$e=-`RrnB7kd(XO>)v+8$9!vGu6{v+GZZ-Xp><)1@RQq+eC1@N}$@L+`N41{geIL
z^O|5MFE<bBcSQ2jlDXi=27omDd!?^gYDC^xDIQvfR1J@%W|>dXxi+}(No*2rThmuV
zctG|4bJX%<V~#zb2cNcR{#rDrD-hu_xz86rV5Zyn-|yu#m6S%+3{hk|_n*ZT_;19p
zFe&0Y<cqoj9EBCej?_x$_15r~+x#}E(LF%@pGtDA+ws0{1ugA7_XvB9iCTrQgY6E(
zYT)k+<CQUia8QMgc`N5Qv*yDf=85>VTyIAt7XIkkO%>qxu*o^v%`m?Yk~9GhVp5$N
z^o=#BuayxMLw`QjZ;gHigin4$p2-o16*TcUWu-4<o%9)c0>T8s!{{^(w6#2`047O6
z=H6SSuIQlI?s&&#@#q_{F)Nkwix-S0Hsu%j@#{dK%Q8-$DjiUl{{x83W{W_IWzA#2
z2g}T0@s^zU#B7S0Y!oMCTQLiRy=SahD&>PtT5kS{4d2K*ZS{n)%3^~=mPbo@)sIhU
z;_8P~FBt8^ngCM^=pUP{nRl!5(W+gU@1JoUE{l5dna;CGmPZD%lZ)@yQ{%?T8rTzO
z6@Olx`%e|BeyS|>J76O1^94BPr!F)emThH<AP={d!}{%AZ@f8d++*5{#HHm5y?9i2
zfnikfGuS`Jen7ki_ll^Ns>uG7XtE3bU~;OoIl7*OKr#vAekKQCT{YDB$g~Cku>k0W
zcL!zRWB<iHCGvDTa_W$IKJHSTso>JDmWCT|;k4>4Y?Jrah=Xp@w<=#eWmb>}=#u7x
z^9dPL!5jlNB&%;R2GE2!<+d$574>VQ8d<@&)W3Kl&GJZ`s12Lfm{tF)TM8L5O&nk(
zQG!Z8C-H=pt(&k@kwp{d%<5LG;D)vg%gk<aMudb=RNv{(Bacynq$#mK%rVYkp*Js@
zzp^h=er``8(4NWj<ZPNcKX6?VNf^pJ$I%oNcSH1#!DK5GKBcHxy+xq$^_LCb(H5y3
z)=_1K(?SvmLh`1y=@a#kf5QO_Mw^FWH?fr@$DM2a;W(NcYb)=I%GJ&{S=mlsz1Bf%
z<gibR#Db@C44)qlAc0pSzUN(FwE<Vm+_bR$oHc@euhT4~AR)?VfnY|&dy@9I_V&c_
z@lS+<2WimWV%PdOB66MGu!Vni^_ez2DXUoMp#BqZu=m))S95~^q~_F-)(@ju%N$zX
z0q*NtKH%<6Ja9)OJc^ZRhyU|F^frHbK+X&q9zbte0;|6NbzS`Qr8)`*oPdZZ0(w3k
zLEkB&Ih>SW;vHK!+!SyRg^xCEWY#k};_W%9ODqKt$Q!Y&f4e*JsmI50Hd?vrZ)Re2
zbD~f_olWT;G&wi}TR>fnRUs~y#Y85!!1**CZ~WmOnDdZyTd_g&3FJ)pz&l&Aa9&nn
z0@XnmHo1Z@d|tto#=^g>svGT|2L4>8Xw*MHr1QJ<p!zy996BHt`rbD*l}uhIVz3SO
zM~&srXd4|yIfZU&biIc0A2xj!?xOOG6Sc?ZW&rAwo7RJ!U!Z6qwNH?i5`yW34u?-w
zv%81Gq|oKI9V|||8!l5g*B~pCA~}weWl}twmAdJdz<~u)e3S)AAA>PXt$o~%AIf&Y
z(^*=-HeBs+m+ci;?ymV4Gr^OsNf3!s&D_8Hh-vFQYnYm(hoMQ7DM%>UO}F{?&F!FC
zwI*+9(WoIwN!S+QW1fdi*zCB-XUdIm!J!-l2!~cUCG?t>Qa<y(ko%+(DI5wPG><x?
zg>1h=^gxA2)^wICabeq`982XX^*Sz!xy{1boT=N+;~fLKNU=4_@n6ax4UzG?K69mw
z(JE6XEOWI*;SAC0q*Cxx^Bb?G;Odvafpq&fDe+R|<p7e*!o*nh?5#J~sMBlog8}|M
z;~1}W(N7meQsuCX%SE<3_6_KDSV$IyryiblR3oF+O+p1vbo`ao%MtEpDoxd#KRn%q
z`#(Lo#zF{L8PCPx+iKEeV#TIJC;ojE+ui|ehATCJah$D3!br>;GL&s;t7Kn~N<bdn
zABAOH-QZAOf>W>)%>7%*q;$z&EvUIxf0_V(Wu=d=%*pZcgo)Xoe(jSQ&7VOl=2Kg6
z$uaD9QTpqN80Blu>WUQE9|mZmxlf{LNrO*aIEt0H%Xe={S;D2>0))>7-rvA~W%QE}
zO?|_R%jU*dO7iko0+y*vj4huIrV7`0OTOCkk+vRU{6%zxitsgW^ca&Z$NpQa?(tCo
zo&2IUyc1;$rlpFN;tBw#T~`l2HYn+lj*Yb$0Xwgroz8<9qLkQrf#-p?dWnaE8KB=R
z(zWuZt*2o^6GT4#WWfQlPo(HLDiI&L<*6MeoyLoyr%wO5tib=itX7QV??e+=L|dC^
zdR{|Cq=V8a4(8$U>5|s#KLHgM%B<NlH{3$)V`t%kYljo=Uf`(X_kb+g?h7W2%9ITc
z*8+tL*I6w8=aQ&;eEpiXNE8+7L+Q}tq++H^Sv|nON9;Q#i{r~*7ATkPW=iiD$H(ZT
z-aL(b!%YG(ZBv7Fu<&gh;H<sr6sk&tn4#9_A29L1AS<M~Nvf)do-zh0y|UB4Bmd}l
zf3?}%b4?0}fuo{;;dkWzW~J1Nohx3^!64NR3O&<c$;e<jjpQfoO3on>bx_)99$w~A
z=c0&WrNA`O*pZDot!sfD{?-c(dA)!jlhCe!R5nB)iyY{`xL(<E07-BJNzf<%e+iEN
zmra-#2QUmD7t!E<{Inj>XdTzT%Affk{5FFy8@@cUEuqy4G5-@e*PR?7Uy8Czky8JE
z#7KZA`CnESaffFg|Hn^9UINTsn~ex_KyLW|XE*+me_Uvyb~?`g@l*Xr)?~%)$LQfl
zqZ`S~WmKWN(}`A>e%j{ktbqSm2Z&+$0iFl{09{p=o(KXjR1AD~fF%$hR#<5B|J=-*
zYN9PIxdFiCW=&P<&Rxj+(9{b+W}X_nyf%D8AbFYhsAIYS7+_H(3Ibr^A5_+9U5~CF
zjsQ?$-)Ug@-6()1-0}o`O`PvTaJZaFz&z6b8a-DxQcWK1wGzz-f*Oua0LZzE*Mds~
zV8S!C0NC-2rKI@*UR;jAj~5PCOCB&VyPG49xWD{m=+rj#0f;=nm8t`G;6J!*z#HWc
zebOAe?KOa7r;T=kEhdgItCt>ZSH7Rx?g2a(gf4(z`3|r}=J9An8x%D1habUre*gg>
z?3=Ob_G_d+fXs4?<wdYe32n-K69VjOaA^-jp3c?q@r?+twbb_0wGI{kD9I&S?!&s0
znzc+itA}Z;jQ}9>&2T*Gzu~x4#B)D)7-Hdts<}MJj{du>z{>k5*Q6c*`oj-42ja^`
zEaQ?!<}z;xiR8eT(b(uiBD)bHrjnysZuq68<|8(u6X|ZEsDHCgSPRm~)Cq@Pc0CEd
z+9}&`@b&R6vGK8?@VqeTSaQ5@53BNF>-casJ^v4I7sJixd$K)SZ$oJs2rQ;!W#hCf
zK#O;ZTN2(!*WEWg1B8z~ewzgPn|dOsY{0Epb|Bu&6f_Xv@DnQr0A>xb0CxRfAor|t
z0hrW7V)VEEH|HLA*Jo~k8JN#ndrNxwNRTb?m%Y{yac=!IZn1{Ilh3qOHc)FQ-}n6_
z$K*t>qhi(rfW=q-wOtrD1O6K=Kom*7wgq?`wPFBAC*+OQ;~GAKy1un4(@pdJONOgC
zeq(+^-2^}pb=DtQK`xI7cXn5H1<r`hpI;bdAHsvqjt9BDXhq#WibM^5N&Jt)2LM<1
z!mA{J+(2nGQc{W0Ua_z~wf-bw&8HAr53qDv0mrjJkG&b*w_(*^{Mynj;zdeyCNpl^
zrto!gegBDg^^xhe^ii0=*Pm1mkc@SkTt3>l0U%~Z*l$39tcIoW9V-hf89{q&U53?^
zwyp;Tt-HF$t-%RFJAMveD)qGMivpeg6or}2-&jiCmpl^7L8vtBiv~XiR<%dk)md74
z@WqB6<0${b&P1tNJwp3i)oafJO1~cG-O6UqxZ#?)_EH^N?x~1mb`yAON_RMi^uX3w
z;U56XyUwJVMF}m$e0udY>GvexKgimz$@>x=T4d%(OCD6)Wur-d{5MlS3S@~raDqJe
zVkvOx4v;SP_|WPZr{img+X3AFAusmprvOM%X_n7Cz~J}{U=+EJil4;J1M&YD>8{ML
zopL|lgdOW81fhY>K7-pZI3RzlQa{l6KBULie8_v9DIPj?wASCMZ<F09joLgt1fOfD
z2Sqzj+8T0aXsT<n(J`^;2i~3iq4V9-a5y%o@ZA|$^gW;*_W~YQn5dSLdHU(WkKL+x
ztBcCAIOJ-w)#%%`&D_AMG&c~0w{ZdX%`T3X9?b`6#^ne_D*@s`-1QG}f3?b&u;~b^
z<Z1(KY9yBOuXIm<IwP#pQn$Je5OF*n*<7KC#)B<FEHB?}K|W38!<AxjlppyyzgxWy
z;L-yo{7i>{I_VF<@rvgwiZH+#+bM=h#*=~UJH7xr+Bcj{3>(`dy&axF$du6zqDS=p
z=DXSP2l7*+Pt@KdO@*K^zoF8T4RpVWkUS`sM0Y>nrZsf8?-XbU`kt6QR1u|HMi|R{
z?)Q3iP}7b_A6~a-NL=XZ(at+DYk&r_#jQu`a)#j*qk$?uQ3*TeQNR8K+g&*us{K~9
zfDCDHFOn#?TA1k0CC`0VDGEysLjyqu8aV>>LlRSx=WNAZ>-%>%(BAwdYb|495jmUG
z`twM@lLWM<on5<ughqe<y&5n*17XEe@dHL1%c1{(M}jx6POfMAv>9Nagn^bp62*FX
zL5GjI96&KtS+G)NOPJOE_8bw}1Rt%?ge7usUaplZH#`36Hhn6W3?Qt1zvN<(FbOk7
zDQXk><$0|ary64)S?e2A8@F}4a?I=WES>==Ky>e-j}tx2p2ODW;Q^i6ep&sm8$h0l
z@DBul>S|**mtE5|-T^?fyD|vEhW@e*G1ofvbl)Ba`C%bAj}!<)MS#25t!%&CDojAJ
zX}aPW5Rl!BKMX0hv?uTZihd}{cfg`hxM*NOJ5$ZQn?T}J{bvHeY7tc|SCaA}(3_4~
z`J<0Ciom5>&GFe`RnVUUNHQFvUED|3OB@I0qx4ph6QX}Jo!awWqz0S34!?aPa&)-T
z)8p#Q6w86J1Q1}@pNrR>o<I5^mRHm%tB+F$3Yom4swl{1Dubu)>w?wwJxG@_!XA`Y
zEv-l%(eM7>TnFr`zB9p?k!q}cK`^Io8GSNr_*bDx2KEyuJq7GDJxuMqiIK3#h*%Ok
zdII-sAE11>_k`o&pt|i~uQ=8Ak;^5WRCssBoYo}cNr0>)g&eR#1KLBJKMexX<J;F4
z2PS8~33mj2HL#L=ntr~Ffi|rJwsOvZL!!_hfol|noTLkw*v=VXk41)j>JY-p#S~vt
zoHb6@8L}}F!}a4Mi-}*Y62E<L0lqqu5{Uz;-)}vOxUca9w4wqH7S0eL+sN>24ZRq0
zy&C@19K+o%3~L4Ghy0foebiUk_RKXy6UM6vN)v$kFva+A?;b#>s{ClD_8QXZ%hT|z
z!EDk3$>Wjc`6NHX{~2;s?s}V|&b!V5Dn1JkL1k_bH<cWpFHR+3Ue^>zB7bbZD3v)1
z-_`q0R08Pz;2an!bXVFI(^Nkm#bFg;)y<KMP?usAI!dP2_u%x-I<6kSj&WQ2ti$}v
zU;3`^m&t?|cf&84D!0v%{Ly@g$jq{_i^)1pwR1E5jnTQymYQI=og#fI6HESm;YAF*
zpwdP=c<PIAU`l2^DB?UPK-iJx0rn0Iw@0kS8>3!3H=XAb!r;~kfn_fGAdi{VHxgmY
z4lnm5Eb!-)ukCec3`B;s=phjsWd7I|WY_FFjJ7;l?`Xd@5xhv)aziJeqnYDh?PPco
zt3jnA(Azod4tw7U$jG$;#La&|zk+{Mz-{9fty<oY%&LF&o{bh@hUtA|-0H{7Jwo5W
zj9>3kX0IfTd-{_d|6N|7HODh%guwux-NCmKsU9_pxMWVr0Xt(v1zHK$uhh=y^W@_W
zz@)RakKB;MC$7;Ywvb9}qPnJ!Hnh%fhq-(x&8`M70U|g4o?5{o&1S(^DKI70<ogn4
zB&CIV)p*kw&qG13`H1{HLOkIJw88EWJDN56*KVkvQb<!_`(S&1mB}fWkU;hVkC6v}
z;Nn);a%>k-qK&K97E$*s<4V7AbynOc3btmIpk+aQk3LTM+=z)Pc`tc0hGm84X-|XG
zk|cHn59_+XR~K2v0aq>bBFZMuUzg@vGmvIHJ#YCgW}4@?=(yl;MS9zUo-UrBZ)ORy
zsX|X>@kL&l2es{AeE?cH8lNYWZ}`=_=zWA&!?BKmsV>Rlpqnp&*=KSXH{TdvHX1Hd
zCBxb}wr^^fE%G^43!etB1?qFAY<E6u^-Bbw5xDWn(zlvO&un$$X;-L3^;>lrj2JPf
z%6ckQj8GC0Ix+4{?3cErY75)!rZA!oV)RmCUXhnsO%C(&R*~ogR&XY?n46d-epVUb
z6wl{_K!)6YB+UJys^xqs$!pEy1thPC0aj+k^fD$@7MLX;qBAJUaG_WC^#{Op&#arY
zx!D&flwC4qn4=YMY9=F00^<o@dy9_zkR=vC>BpcLNewM!!2$V!OI4rXoPPR0S^(K0
zFTwxHZtSmkXrCqbq6WI4`ij0@Rn6L-B+M||I@HiiOAc)5lR`yB|7gwOFSsm|r}#%O
z_;dE{RGaU`FJlJMo)<<8CcIz)mJYB%6#YJ)17Y|GEQxb9n-!ICwF?ck=S6tkfEzA~
z!f{rOa9AWC*{INhX@3w@Nj4+@&%%_`_paW%)r2NcJFbwEuhPsw(*|%<k7b44Dv-oX
zfQb<Z<3)c%N!gRV2@`UUevyV;eYUIY{c^HsG%vgM>DT0EnU@nK;}K)@8Pbt*i+y-U
zP@yw4+4Ooz*m;igmd)3|WS9k7H7*M8BsZmc0FPfJK#OIRx%%2rrL7eRiEvRYCpoQL
ze-`eYp1&|wrA{#fu52$&ae&kj46+64m{cZMn2$hVSP6}Chb#90X&ZMx_K3~n9k%ka
zs!0$}nosv7mKiuhdR9CMeUAHjr6vD^;`~1w7aQEZqM$nJ1hIoxxk-2YN8gI@4QVQ*
z%qwK{gNYE=((Dma(+b^r1T_H(ytEG7fkmja`k2eS$<z6tZk`}C8aStOe{tzwe`P<d
z$ILp;fQJwtN4hYR=;GRMsbD5F;rq)TGRIrj9S<yks$*kv0mD(A5_3msUutdz_^7+w
zpGTIUM1EU+0C6+SaPF?9tVyb;I(geNaQbtttGMdXO*l_U;K~}=MubaA<4w&nso0J4
zuwIg6h*x^8xP@`Zli<4kZ&Eq@)sdOvE&}0G@$>BaqpL@QKWyM&sUf{D_c`Cq7xY@+
zEvZWM{<3Zd(t{a(%ao3x+z4wX2WibURdqRZ^it3mozp(^_xm~Kx7?HOLb1SP(pa^B
zV`k}$ZJv<Ou@Mn(QaizU1@ds?0l(p478gw7kDXiMo@b$F9@F~F0zpSlsk+IE@;1Qm
zI?X%?0SP0UFfDD;J0>4MJK6Jd9Wi;FC<!ID5Uq#{)4$$l#qxgN^MlQnkrYO;SjsJ>
zW6R}~Bp^{Nbn2oc<q$%Uaj+tDIX@4$w@koV8B1A_BouQz=zUgvOT+`4vL5d8=TGLJ
zSXmgv(SP|lSa$Z(qm+tY^)92FUo!vmn~K0QkxLsgU`9wdBGWBH%^fSdHiR~!rEz3l
zr17y>^4Z0GzGC$#)-vl<YUkSueR>6bgTa6Yz{U&#vb|~9i*C1~1I*4tmATb!LanWs
zo+3I-9Wn;*nB9f1f~v46pfwO#r;dXxh#&uC%-<V3n%!1$xmlO64fhqH1znmQ4k*9c
zq0Po0ci%zD?gg4*@~Rfbj<P|_`k%~D7EGO^&?iw-xR`~2C}1JN<h!@2Q#c>eG%EP{
zSz;4Z_%JN0E>a?tnkhmbk&;hLfToJe_ET*RgzoDJ_sYnF)}((<k{6XjtHRV(e0cO)
z?SA3tSIH0nmCL}Q?&7iP$7Sbn?6^CB@pePRfepn<kJsDsP*xu#&R@*LX>GEj?EA5N
zD3Sm|BGmYiTi>?F5}oPM)m1~Xf2q$uN4%4MBiE;M9S30VGX4`UrOz|TbL27YwLC)B
zaWk_p_#sh9*q{cu2Ks-x1{l*?oWquMrnl9$dI+0dZZUS$)(h4XOJm*r16sf5Xs<9w
zZ845UpCouj`N-s|<fPSJluliVpZ#X~3eDAF-fP=vS_BXO=M^rK<S6%>s!LG8R_5qP
zr{TdbR88T-BZ3h!ZP)|S4>)UN2!RT9>95jvMUn`qaBaf~2b2+CN=9Dew}(Uh%sNS+
zL9^nsFFyU333Y?m=F|X9{7V9Z;J;X$)L7dx(f1DYrqPU4sEHUA*vo|&Yg#&}zZAxD
zlm3Y_Rp&tkq35uMo^Y3E4rob^cI6)f*O-Ard#$p|%sez-1SFQ$o11-%(&>@U^JUqR
zvttMCd|itEO}dfR2xaMEelIxZ9=GG@TCcpeu8$Ssz+!=@8Iq+W=?VFcQT}fG=9dET
zlCj+#=LW~U3sg9n1hyV!k!4oAb}oLWpJ-FIB*;~oYh)Hi7M;a#nddh)n(15y%Y%y0
z-I2M;AmWCoubkCd2eY7_P|4Z9XuwXj0CPv72lG-MJ`l^@`^<y~JK)gdFeJj~;4CD<
z^njV~*+Upd-9@&%_rKHth0#5PP*B&1P?KE1kYvCaN&WJ)+H>sor?G}%zEXrZ=e<3#
zxmjU0#u;hP+jBY4d^?W2;iR{ntm2H70ZN9a3yz8yp6zRO3M)I*Wj}N2FUe=GK$l%3
zYA<7QZl>s0zCS!SIvo5Sy?41%oZGdi`|sz7U1h=|$)-L2Ek&6rK|;$BN&Dd~a5SfE
zrQsmi73JO29jFxD!M0#1UULyr=5s!PVZ03RP)y*_6&#D}8hmZWX{5K8(i&fKHKlHg
z8lI>u9sYJ(4Z~%qu%w%E6W$1>aDH~t9vqjYN0ld@<ao^Os7O89_JY;N$RTU_U-KWR
zvm~&OV4-n@tMiDfu{X=%m)-`U9x1J@U^sP+5PZfC$TM00g98hp4Y>2H{W(JL3B^Q8
zgyV7`;53Vxn<MI0J$$XiNPP9*Ek!9|_(8=^^0WFAk{%z=Bc7I08i<)P<{*w_()6<q
zpOQDiMG3C<h`Be_+{Mef7_)0zJIwuE3As-wZkGjoM&jsyJ`+2}2Ou~Ut(~!#%y^!?
zU4anJx`N7Ok-z~st83b&bgSk4?Hh43Ll%LCHX4DC>TNtK5<fFB0z~X#;g%xDp_d^K
ziR62CshL|-k6T1QDP@$fgyO5bnSp*D-YZoX**O-}nt1;Ff7jJLz+xy<Ul9MhLwhx|
z!d)q)=yNE8TwYY;OVoK*U)YwA>FU9$cJ~^;cn8`xzmrK{F<-bP+IW*=(6~{2T~l$a
zJt#SX^FcQKkOUE8GE14v{E#fX`e7%$J)urPL@`6twx)%7p5@jz7-9zKn&X)HNXwI2
z=7`$g5&7F0{Hbx(d*@%&b{MioD1{(alKm5mvDVwdsvB{9`t-gB?47WrOd0rYOLl8F
z64hb@j=-6hrG&~}<y9-)#9XMro-XuE1d3N&e45kUYcnk+q(89U&}s`R5kH*&A>$oO
zo9NGMfxFm8zrkti1W}`YYcRaNJ$h(o^+U(PDn{*iP8|_@vAPZNo6+<A`^;aiy5S1l
z!DalC(<YdEEvaPyXm|C7TmD>Ee7dgpHX8ghZ^S>V${TP@|3^k7VN~ljKDd)nGS_m*
za)U=C;JCa>R(OVgnm?&ojpyNqVAhlIe@y(-lnm~Q{G`H}o%#&sogYc!8=}G<#-CrA
z5$ccp8q>m5@wmJneAA_(6oX!3tVwy>E4F<p2HtuDudHRJ)1lhhN(vvry=gf_5fW5F
zjCAvL0DF4@%$Cw%MSdpxNFjT2o7*lS+aWbpX{EU*5^9oH+*}O*FcIUp+3YUsqk&fM
z+%!)s-iMmwIU2y%AjyK>Y(CNmg6E<!PJ9pJ@N0)>U2Una6s7}~+`Z+g%(@XT00)e&
zr=j@wY*@K(RQjT%d0ec1Ss=Kz@$g<-iIj7t=enXwQXgJ&lm3NoeL`(%d6EB98cC2T
zj(8>~%ubQu&4XF2D1=&YnTIdrd|sa3ZL**?=MP`dGfZ|@`2P0;F4vG{W3XV&IeWyA
z%GgvIktzs*UI=)78+|#^OiFpFz$(S!rGuCl|3kTNr7X~02#1)W<`lh|TC{Lr+xQJ8
z2kd8ELlQOb^7|Mi^%~nzR|*?($Q7yr=4D}0$qhCE9tO^8)Icpb$-Mr2`&HfcLrnkR
zzlj|uoot@RXE!0Uq*dMoe@~yH-TrB|KRvG(jZ|leDuUq&m(BB+EK0k%kW>>0A(Dl}
zj32V&tP=>+#-G?J#Huz+nr1fi2L-N{7||jpFlI2~8(dzjq3`g@WW&RoI+4=f?TlK$
z^x=jbGOx}Wp|<<MCS8Qz2au&d%~la;pa8>n-6d5{&2<A9l|^QI7Te}SmP~4a;Y+S(
zylTEyM@q)jF|{URl-{rU|3ZMV%$i=j8T=sO!VPj=|7t?B1Hx=!fmV2w;4O$S|3@ig
z8$x`oi8z2YHV_y#FicLhyx<15SP3!zsO3$+*|(Wp<sRT_rgmQ<IJOucff9O&@#Y*&
zDK&c}azeJ@`zRc`f>O4Q-UwIulo{sK>txr1v2cH%_T_NU$EHT6?L`8XZcn1|w{xq8
zPE{%*ZQ;ckTlc0StiJZcH8g{2(C$&?=Ea#r?v$v426kJ&9`Z#Z6Sm*#w4ikbBW9d~
zp(Hi?5333OXB_n^&)wf&#tVpBr!%Px52kCXOxk0a7{CV%j|tW=sLn`FQhewQt4#+r
z<&NitvQ`p`-O?=Yi^D9g<@N4I+nsQAo5pJh66@A50KW$o6`9$^P>I14krZCrZ&4(J
zAsQ9^<L~DKdRk38bqIGfK_v^s=7usV-;4a1@aCiCy`P!eo{f2tn%Uvc7c39z(Cjdt
zrEb*hQCJ05rn?^T2pM7h4s^jDw4b$Bn6=nN0ne^#mYLz;#<C>A#fEF%CjF4VT9cqO
zT>S72uYvQqeWf{;_4wrg^rSqfTd<@^lb8Dv%eTuvg6^~x5XUteBDOdu&ODOYe((Pj
z=$Wv6rPMK}2P%c)ri@dfRTjl-K(*_>bAl*Mko-+lE02fUO{t#UdT*;)!*<Q{L{Vks
z<Y(t&h0ckbD5o)$?i97p;x-oS<&>UFeT-eue5iAWsav!3Us|Y84+fXv^o}*rf|fLt
zK9rZ-TTfy6N^M&~n(5&btm)b0*Z)s;Zd#=D+7UDC`Ute;Kc}JVbpCGhpDTrI@Ay~h
zJbG}*qnrBwmi6f0Y3PW6%M${KNv>^Ack>!}ZMT|duDkhsZs$G6Ts?lyMSr?}(uB;n
z&-76+96i@?zvNgZLr!-SR<XK)jF0vyj}C3cz)}>3Gqc@9OYwwWgA!||h@PV(I~_?-
zPtB6?=Z)KS{w?#PBn@Ah53D8)WcE)DJf^e@Hy3_+)sj(!{(E!G?-VFcxv^uBa~{nz
z0g#leW4kDmeB!@7;fFLWuE$x3gcl?BA=msWh9KQJ$qpGN`{9y!GY)?siyOLD#3_H%
z3o3PpC~Q|(OIHICJgdE2-zORBsKR6B8OBn!r%!urEeI)pRc4Grh3-?lkh0r5aqB(c
zDiB=iocf$*2KtjtSqocv?@#gg;`@+9@vHR?8t7BXo5VYcbRT`5N^Ip{Si$#CnBu@p
z>Vo~RGP}^axp0xM(<4*)TNJ#YsV^hihVF4x($@2GpE95%nV$!{)`g~8V&oHtfY8KB
zXhyoL1y$Vz!0m*Gd6;Qkc&KQn;dv1eUFtyG265YUYALIS$VlC4CQ#}Xl%w1UEc8$~
zHjudUSR?y-7G{zq##yLOOb8i^hgdu;R)^ZHNz1LN%5`zSE~i*mIO?#mNE0ZfI8yr(
zT**qBDH5P?q4VPYQ^X;$oMS(x+K7I~z+zi*K0clW|2vEd9n(=uGD8IRpNU$%dtblj
za6F+djYT5Q6n}J^(Er^)8Y_UPWXxFOfJKFJP5?cG#So0YT(@J;cqU{Q^8DrcLozW8
zi~|hJ=Z@i_tKv!6YZ-9FGmv0#vEzjCL{8pPaP9jHRv`qNwgR#*+v`QcTZWHDUvo?G
zZO#<*H+bHun<t$JkPq0vm(Ws+chnapgS?Iy`l`{fnd!#~OfOp^)Ps1@?qrN*uLPyB
z=<O1tJtn&4Hfj8YNgSD=wurg<OG+O0-0|*}^o?iAc6JOb1M|5=sjgO{YQA!5wk5Tc
z{MI$1BMM^Is9-v2rA6Ts3q56Z8JhC_(L=4WT7uX~*1unSL)&TpxWhWUY1u(6D<4i*
zFjWZmOeyD&$I$PXwk)DD;r=q>xPOFVI|Z0olyun2(^!7jM@g5xVw6x5s~cI!Bt&qp
z;Dx^NHQqt8k@?!dlT>~*OY^Yns25DZLWoI+k6*_qIc4w}W`YIIqk(X82j-#ZAj2c>
z5|^flf;=cUxj>{l4Giy9*R(JKLnOI^g`u*7<z)g(=0{tbWQ-L)BAH0(Ss61XR5^4O
z-0(}+xBfgyLaNZU<~Hcs$S?7OW(>5x+!RTij)lg_AOb0U)Eoh6EEB`aXtg;a{QRIv
zQQPi@r>={Db&MH;I~dO+g4=+Fz}ghLjPn<aj-(>>s?CV0K4e)`=AXh=UM0b5&qyU{
zI5OT52<MZ<i06Su;f2uMxY~x+l@P)NbbQkhDK?OkPNs#5pRCNJ7Kavdn`;mfdSQcw
zy1mMTk6-i9<VFHm-6X==$rHpwh)-fV$r&(Ag3AaR6e>OyRA~eZ!OBk{J5JMRQ;T+2
zDMlK6oTn1Kwd4+vMQN8srLfvKlXvRf-(DiisdPAbF8gc7`9<<JAr_d*dc)lc$t?x%
z*m0&NS1RsV%4tfllq<Muy4iQvP?U`wDopPakw$C#im&~j><#k_$hEu$wC5m_ot^PM
zGzTif{-EE$1ugdPz%}WQysO_a0irhBUXO#*_C|8p`u=F7$@lBD(l)l_zX)?0-J$4l
zOT!NzT@pr_IUHT2{37|1gyJ_SQ%GPlzQB}Z$RDJ;IB0}J2h)<|D8QtAisA3Kpf{@u
zI3%{_cQpJ!D!YPRC1K5KksS&bc(0a0qwlQi&V%YAi2pp@TjB%x27I@<j6<1ekeHo%
zyGTmyqh#E-sD7*LcguJ1UW(<QE63lamwpYDu|hRE;SQ^zpb(SVX2<4Fh$q%!qW<kh
zL@;?8*XscTczC2z=e;06k0$iX%W_v=^po`@R?Rb%pn{7T0&eH%)on3OU!!A#Pu#%3
zAW3TdS>U>1$`NY+GWi{wQs@Xe4tt#4xI{<WXU0qE1PouASyZJT!!wc!r0JT7+vS0Z
z0=q@w{LRoyVy0_Iiy9kcys_qL$%652MH}K?Ma#Q1cSs>$D?SS2CT;@v2UX2zdEqNg
zaL!oMWtSahrfBZewB84~s8oubB6J+x)tzT%U;K5bKmOqGE2X+(_3CM@90pHN$%ugP
zjajrwV{_FbHfOH7AYVRwr-#|y9;TkRBR+Dg^f5cp{V(?ZGN{V6?*oPvX;2!JMrl-1
zx)JGAx&=f)x@#dV-Q7|u-3_uRX{0+AE!_>zv98$Leciq@@3-g6Gvl5)$L*YJtt0>O
z3-we{G}|27V70i$74sxEHK7REP-JQE#Vxu!k&W8{x&3*GW)3mgel6?=lN82}=5|rs
z#rwPAMFXyU`H3Ex4f;gF3v!rx@Na=%819ieP3Zgs;%>wx){E?H)>OQ%lSfWDLyFIL
z&dS+V6c!dtSbmEDg;Z$w_NIxSnGxvpj8d61F>c@MZj9g@vPwm_$^NkN!iJ1Ss(m;I
zO5OavSrJvc`wZ)4i=1|*hpJ#KdNAv~-9v=JH*_H;rKbp`t|v#Q6Z<B1Sfnc;8&NBg
zT{A64W$)u4G$bLpz#11XHhy|9>&zWWdM4#rVu(q?^{;5Ka_PkOT7$nRc4pduw0Eh1
zEGS+Nqjd|`t=;#0+w8+4h77yQCE{VRc`I7UoBFO0hnKpK<G-auqv3%z-&@Y}g<sXi
zzH6q@uOAOkPsuc}54U_z*t;g$d{Zr}TAGK)Zs;fQwQ^>QC-ROECSxB*PDUHA8Eu3q
zrYz6<1_QB7?9fO1CwgR0r+$vgTYY_{7)6)fu;Yu3LYoX>a6f|7KiW}v^*HQGj>#LB
zq%E6)^7umP^BK654Bm?AI&ZkN6eH6!N?2#Srn^REsmZ;MaL^Ih5+3gzVEq*j^s+S7
z1!L;tNcN2HI}ah!sLsRCpKf1cR&2kFS{825=I<3!gXUdJ@!h4=wHod=<R_h&q(pBw
zkrE?Y5@0EOr3n2<B9wzDKC<tu^9f5HhQJvdF6Rn5xC@$JyMTG$&1hNUQ-W%cN?hOZ
zeu`&FH}7TJTob5pFa!_2$Sl5O_;xX@_;9use+-gfozY4TO0ID35Ey(nY^5kaEQqM?
z*~>s>^SY==<3{bZr-innw7$_Ur-)R8paB>B2+IOT7>y6C!o6@M8#)yN4q=CW#P=iV
z%K?;|5?5wQ5%`ao>SOw9tjAz!W3=pEFD`5J*%iq8e}$KI8zf~Q8X#{hQZot)=Oh|w
zd4q)e%aq_pZpDDbm|m<ozl>P!Tn5+nCS0*5JY>&Ua8Mh*zM>0Fec5`(EC?iv@{G7o
z>RAzK#?n-V({U)6%4Kt-X%*aJF<T*AF*cffauc*Od(&mxDvM^(=kQh4*7^7(1nlfM
z!vtFRz1hB`*(DGZ@D;_~*`!zgHsQpeuUlSQ@nFFR%fBw^&6U~i$`X&k6ML@zCbr+-
z;KV3mulq7gyo-P-FO<j>g_Q*IMb|BVd=SVJ-D~7bXnFN3UQRrk1pUJd3j@FmUhjw9
zdA93bn!_4Sq<h7-ZVc<l7-g0T^$u338R9L{ETYf!DeWqnH_?4#z(ey%1vR_N>fR?<
zXQ+xK??-3Bg@9u5Gbv9072@YmkXz8+5jJ;oM_31C8xj8f1!l+=;jT1$4snd_zP!2h
zFto}9hy%X;G=N5zqR2t-MS>t0Y&A9Ri1EZ_<t6SR5d|hJ>`bG!?Y=}Ijhq<Fel~{L
z*H^A7FLr$S64q>?qBupgQ*c)yDWeT}!yPG@ec7Jr^5Ug-v_mN<@a(^6p*oIZBjlnz
zTAno(?X1z-*<MC!o@rR$Wb_dYt0?CW#TYF^UXrypHGlv5DyrwR+GBSr?J(~O5gvze
z)fme4%DW6|zwRw!V_i{)dR)sfy_Tvz;geAudbpj_$hVzDhb4JWuX_Qyz&m%d|Dfq3
z+a2i#w&l*T<;AfXzGstPAL^o+E7kvaIXmSr6vvs_;W@*C-SKRjd4<VxOQ5TGW#yM<
z+C{Po-BbA!8fG5B?+~+70m4rIDp0LqfikPXlU@ySaC?42*)EGUp?zax7;W3}VE;g3
zvVvQA4s5;(!!9f?RBh{l&a$(Ilz*>M-wO5(s<34bTNTC)s+}%2t)d4i(<p;um)mtz
z4^q}2rdRw-PZkz}^m1FI&A(F8cMzlTcZzs*16x|Mh3p%;>{K(o^1y>EEXU^i@2ywE
zXqnPsmP@ChAa(=mmQKd046F2P)wH<R>I&3lMrw^nar{}3sfw4pJ?6~we<rFaqAcac
zWKdg?_OL#EVOd-y^h99%oRx*{@Qs;d_$b4}95g>PCOJji+la^yo7kjN&Y^C9ortmo
zWHhOKP7m_bOUyqBEHoKl(Rlz}14Y3VzV(dnKOG4S!rvL3XjPdGca)Cfwd>ws_#GmI
zWz66p#c!SVvTc<gL%lL8!aT+S0!$yZm1tpsK<9qb9ubny5ZTEF4pxl%vjvCDjDhc5
zj~8c~p4ii8u?@%YN;}hCpiQK21d9#oh}2Cm|DbSv;O?^u3qspByaYkOJmY2L;s%m}
z2rG_D<V=9N<pAa4au?ma5{eGiRsbFO-Z4USMg%5J8l*&gP-Ig8T>xazZs*<Y^-+ys
z`%cQpJhP}{TU@U?@6shltZl7TpMCbcw~`V25WnIeK!ga*g@7wpg~YG)21B?)Z)App
zS{{G{>~1g&P|W}Y36oA*y(U(B$<=5AB{YmuNb&(MTiFS5-Uhwb6E{r;to2Ds+3v?H
zh;u3A!f7@Lal6Y|^l`xw%RlB7s|G6u0vU3JG3IXaQx2h13nLiPGyWu&4^QJ<6&e~M
z7)MC(^FD_JGZ|cZy?>vt7`DN8CD~;^Cg`l|`&nO}Gc)9PFYkTk=?|=@Vx-r1sMhm@
zi9T+VoZykHA$_0<8=<;7Gi16)#}u7CilHnvTh*3fzVtOO4L!*A@?@JtURlF1^hGc4
zv2@a+PbQhTr~J@JU8Af&#ce7b)}BJD0T!#p6Vr_AtZUJEJmUz?w1Y?EF0t+TDFT=A
z48yt^6B)0qKJhu+^$<_7js3v>^+`6G*fsk~<f2HokUW=gBD-nsmhBMMHs*!i)iUP@
zPq*`xea64apoQ7;*vIj@t_)i!c{6wl2S27hew{siIQ5V1buQ)c-bazq(!(cbpa>E{
z(P31fq`OWU+PIFvqtk|wB&H=tAvtZl&2>y5rb%D_Fqkh$;*pw7&V56E7#&-SoNY*Z
ztJ&s%N>BDN*jPgWMcnu=?a+xW7);9r{Y;KbZIHgK{K7U+okqcSV%A4p()`6gV@k0e
zyw1#H5NT7%da8Gxb@Q<yV<(<{na=ekODv;Z`?GBZ^o<RtF10C*9aFs;wpGeoxjaHh
z*#R1;2(j*!zu-Uam{YRw^cP|p&XKq69@f=xj~e%9p`E{O6YBLzz)<o;3wP~9dmo|`
z)lp21af~bA()&UYU)JMUP8Q;=3k+1OzS_7|UO!sF*0GC`V?L6jtz5QZp0U%NAlQ1O
z&<~Iw$1`z5N^dU$_rCMT@!sX@fQ_)r_j{F&27*+p5p_ev65+MDqUh2mVW`YUF%;<>
zBZP|OC>h?ES~d}R;u%H#hBy3}ze-FLC0AC@l=vX*8$etwl@m{%DFI&+SqHQlZ4!L5
z&oe*k?a~qJnh_(9)QDul04j(4K5j3CkNA++{!q7TXV}<*v%Xv2d=U2BO7n@Y1jk2u
zq|a17>;#GE7RYI&0)e)|Bn=BF7X2xX-xuJyu)$gv9kPUM-4Cp*Y2gV^5sajq#19ua
z-+(>#zCwMRnc@LQjp^bvdkph=u}r`E>j$PY4_Q7Ng^6HGzZecPuVR6z(N@y4Jah04
zLaTH}K^GmC6@wYMqw+x-G^X5!(v&(HNBGJ_BZ(Xs&A&&}(o<poqDw{d;m0(fV%hHr
zZoLzQ_IhgnOAZVNA@Dkjy$&?cy>XxQh!t#9C_bnGqO+aa@y*7{-FHSkV*}+esVH!a
zSgZ{fMDiq(1G<Pqrl;4xZ-kgyeZgZ9&Jg3PhIesO>31I4pT`o2sK1RiLSB1++u0cV
zh_7j8uH_{n73nsCe}z^3cGbI7*TR>I-kq9N@n3NQ1qwK^dYSM@rU(${Dp(&*+0*jM
z_Ub?6(rD<O99LEpO^LFgrNG7}KVw$z_ndt2Gfd&t(uU;R6Kt=0$M+4w9&zveq!esn
zueWt5oVw65P1U#FQls=oqu-Y#HxztvNxn2R2oKO-ovn1oS1y|3l`BW12iqNJ24)}%
zt%jA7M4NOFKSX?3agB=25+ire?df+PPcp5&C$~M7H9&6^$F~~Qm(~5vp<eMO*&6ZF
z>t?h66mVt0b%$Yr?GdCW@DTA1|5EFNYr=hnWXafkv9sb_tnUKej|A71<Uh!Est4U*
z`bAY(yi=UmYIY7_MY%?}mf?w3Qxr|0uQh3q<Lf~|#H838J3t@CX<~r{B^S5{)rZb=
z#bx+9y%|nloa?sN^k^fG&TIU3sB!D5+u@Ea`pN$zQ46s@#0uV$?4-$y4X#mqa0+p7
zSZD7+leSi~fM00ixgdIDwfa1}=tBqXm%dN2zG0Hc#pVy<8bq3!<GKz~sB{7=q;*i2
z#YFh4jka}SwF0WwFFiR_j;|Ti&pPm(X_;h|qwc>;a!XUnd^E#Ol^NY{9+Ax!xfuM`
zR#BT#me}=*vNv-{%3M<V+#+a=0~eDmB7#j=<e@0afYP^=f+&tR%BqnO4~Tm;bMvO$
zyI&JVZJ2h?$A}F5Kpbn@;aa&Io>Q?%NuXr=nm7Cos%J_j+eBh<-H==tL%S|pSG>&i
zVMCiC-hHL0?F|VQtv}}a*PfHg!l+Z~S(XSRarDKBZaURkrQGW=zxTM2NAbtWC;n14
z<3&2`kFZhjuHI<I@3*RHO)1SOZQ9PnY#Yz<XWaK?H4X{X;E8T$>S@xRaM>#8%WgEW
zZts>vjL1eZFs$6>ISyrEz*v#jd0YfgT?*HIZ-x29ADKM<K_n+nE6x6_a@X|NL2O6W
zkjWU43VYR)4+jaXXdX)Lwt72_pp;;{I06m3@jZ~LEB~dZO7>WA^yqF)0FvRGDf^2h
zWkVyF`nMZw`NGilU_pQ96*BV?UfogOarJAB%59ae+-lw2au3Bl#23`0YTL;?X!GOO
z*~`0K_?u!oSa;}lJybnAq_tI-%NYH`G36`@_*WL++gQkZc(>Qq>g3gBWY^wJCR~!q
zQ#Xqkh-?=Ncu-iaVxTD-02?_%l+|p^6{=4q;Ab1fS;(i*n~U}@cKe{Af5*n-ZI8@Q
zA%rVL*u3W+@>kTAiKti(&b=iWPMK}v|8NN?<tafNRBd(t6!pWIv#efsP|exN&{zZ{
zr_>e!H|9;hS(1I%xKP}w(ncfOOv!v`EOkMg0T0<dlP1hE1$>645Kz>J`+-Hu&GLay
zUyD#L$C!~$|FYp{Xa&$hlDMEe`{wymoXC&)`Ss<gQ^C_nQ&NONRxEY4fhdFSQ6SVz
z=s|EIeFk-8Zo==Zc6;%_#gFk{<bXj^G)YC6x21H|{Y*hB^Bx<!Uc>g<|Da*N65{ec
zRe#sViSGOOY4W?>=l9;lag_-P%1AA}32xAxSw>VB_r4RF6Za7R@n=$%TwVnF9b<}b
z8_FVsZOYP1-9(<eu!3ipqm3#>ONg3=<QXXU4A53WjJKY~zU!gssb<|QZf-iv({E$l
z__rgKFe1WTH0fXH2)v>byn20OR0Nr062jh5gi&ksM4~uJLaK~UX$+4gv5EtUkwP)E
zjbDC8o#?`}$EJ4`b9qzf@Oq+N^CI>-6EzJxPVrQI5=kuvRyOpK%z7#Q<5&U;>L<kv
z*~F}E3FZeY4_4gi#p7}Q?Mdaufp8<K)rtP{fxCVfB_LHOCIK9D&g73*h?-CD#w2jQ
zbTJJ^%JTgmo3#p8Fn1Lfk16l`frUYd@JiSl_eo~{-~L;0ZpFX<2<OvLib&-%BOv@=
z`UdzLeSk)0#jOka>)-$O@c-6_4##9H3*DZFyIpML%>qu*vg4e~8tp)e(9K!vHDF9w
z)@|h4ZBJD)o!`tuF8k!t_<1I(EvCohgszWhX5-2erZ%1taZSo;Ap*&Cx>LXesB;0@
z^HV|Uv89uT^Q|*Jw<MckQ)TshZ-aMKF5(VXg%@Tch3a)@r|LA`nGKVE&gcHefCvkK
z(Qk{uB;y@{8+eH9+4MZCZu@XkM<xVm;M;G*gBzNxTpVpI-2iKVnnxxn`^+dRGg6Am
zNCm1}_;=@ksP}G1D9KtF&+5Z!piIZ5MT{H6F<p>P4;$y-59PaAjkNrVG+p0`{9HAX
zf(Q5CYvn&H#xzto8bg{Ka%OM}Y`$v%0(8!zX3<}qKeuXuQbrMK77dIB+wW5d&H!0?
zcguzEUPXXEA#VC*wR1$?>V-{V?6mE<UcOUBg*CdL_rI(as^=k_VPH5ZGt7%jQ>MJ5
zZuw6t-Hi6aEwhYG?A)&BwfhK`-h`gEsD)Z*H6?F_o#cC~>e`Qeu9-Q9o$f^BOVo^B
z+S@yk&({Bt7y6sU1U#HFYO&wjiogZbH_1J(Y)(CIPdzOGTALZhQHg}If=J^&Dzuhj
zHv>S<+wTC-%W29q&(B;5;oB8!<*=5qy*aEw`(}I@=@|!h_xym+?bf^0O6RvzGf{k%
zNHm>u+(SCIBV3l%$E)@xI~<;Ntz2?#PN7S4b`;?^?K&R%%+*~7shjN^_502B&&&H4
zs#(U$hwlA@+Vq|ftocCW*9@Rue#8uXTTX!^i7x>)UAlW&veTT4q2S@Hw4(A;`W^|T
zrX)OYOeDRw%;|g~qZqX#qX2v-|Ngxh=h*MrM9@UN0E)c^eAyWfI9mwd-R*(d^T%Y<
z+{76X6f*oz?MNuoAId}PZ*MMVfsY4i6=^SEGX0Av1E<_E>NM2|0o#KeKn%fLblRR8
zJzoFWY5}ytEx~^>$I<SfgJBCg2>vx0!OJyEVRpgKR6TdEW7Tvw0B2+U6L8KT^8EUa
z<~vv%<hlVxfk3sNW~OtvzKb@wM#Kl%&qAPP7Z7wLt>&9NqJM@!@bpyILWo~5(x>~a
z0j|U*q2~L{ANRQ^-1oc;doZT`I4AV)IRQ0HKa)n+V_QHc(K8y@1<Pwj0N6Uf*;;5W
z?Y|Op;xrkppXO9lMLEBTx+OI2?#c=mBv#$cz(YpL1sL%!(*XNEi^<-r-~XAZ+acW<
zh6adR3lXREF!2aKWqoc{!*4EJ`Gy@~WScj@wuG;n!sg~^SiwhBU)`#9B`y;)w~@lh
zdX@LEmp#B4zU?i06IgdZHfRgjK^QKk5C)-`;O(mE=eR=}O`PwVCNFz*=x#0o+)ifq
zcl=H}>f?n{7I-UC=bj0A@;MFC&dyxvm^?qw1fx0eBE8l|=z1}XcyRU^r<Kk%OZbxK
zc`KRgsLA45yW1)1V)E?rJjM=hv*>ac)zZw`yu5Adl-#bXQ+oS$d5gAX7r7^cksxep
zU}hrFlN&!Y>}ZE@Z~xck(u8B~#*FbLVSHpMo~M(Vn+}OWGkd>>(4rHCu2%KiU5(i$
z!QMwE^t!Yy=&@Fit3I;rrRx@==9>DevFJs;+h0W!&3T(^$M!~vrxMq&G&0_Pf!#?Q
z&zKC$iVr5$t;BZtg+D0eCA2SHP<OiTxz+_!oDB)E+c%J$9`5c;4qw)7Opmm0Rtuq1
zJ#cD1XjE7;;@Tx;ucaY;zxH6_OLDS#mA#I%n9%Ly>}5BW<&RJ4(72@YhIEyyxFip*
z6sEV=l?qEj?wYJX??JE5#Er{oEm6BUZF{CAxtDB9-|?_~zP5cenTCGrK9=FF;9HvR
zrTLm_|66>h`pDX`Er!G1bjGSZ`@jV4>d^VsHyJQ_@@voMi%leV8wGWI8s|0MSuVw$
zxQCOogePYiUUO#BXD|poE$*Ljft>Cq=*^HZyYJ5Jn_8{K_CFua_t581h)*19sFQw3
zBLLkR3TU>qg7E%S@{iZfXq<+GKBo%5bvdLT_c(bpYwF3o!-TrTqZeP~c|mfT$*fS`
z&*nj&$5%Z2Vo$zFtoirdOB^5^jV6ta&GOaA!T*tb{NhN$W>NifezuktwjQ92p2KEp
zWZO?Y(i_INv!0;Xao<4K{-^j3uwl9%KAHA$(0eVF*8%;4EaAOLB8N!VlW=|*uzB&f
z#_gvHAcd)Fn&yn?p8)eKYsM~6ja-O=-lx3;1VyJkI8jM_n(k?1+cum%*v-4NVKJN=
zIt|nlS~+u;Whj7@^(PYVyS_+Qi|KeifT}^^BI0}moQ9?ycIResR^etnTZ9@$IGw*9
zmP>pes<kr#JgjTxn#;ohp)3|f%Am(Tv%hkX$1V#QL|d`=qOABd_);Keb}C7b5x^dj
zpLwPr+YL$4iJOX|9)qudXnyrt7h6>2?Kh9p%m8xYZU!g~;tNzZ*m<Xb&E{;qy4pRa
z=pSwe7>1BRCo%GpM)T|AaVPLCCGfWa-;D{C7;OO2K`zot2~m3HitSvXdgT#?pA@G&
z_M4E)+M=eaW4u9`6U{-3I;h?>J3!~g@t;|o_SMYKc!q1V6^`XOyWwc@5DLAQ{M3RH
ze`1%)HzF6}GLW0+@vzEEzbo6;J3Zp9`&d0*Rr2_DvqANq+lJV@quzO-dBHiFCH60O
z+jhNf8_%l^r|NwMiaG<m>t7K9d(VAo9wIVxkyn*$65??exF0EU!8WBtYWDY%4So1-
zGSdx1o5-@}O}Vfd1jn{LCQGpM9_6J!M>T+?y-{0J-I{HgwRvO3{NpPgxjT<znbyUi
zlPC+SGHmw(Hf21EIVWWLgdf`8yHnkKweEM{^I{DZuZYK*sv7o~%schE{$|5!7OgtO
zzS+eK&*uGjl^nLZ!Mw*w;tXEi5!&>7$tA{4%=>dunB%)#$@Tk#e%`YV3Xr86n_<c7
zUvJCn>ce%Y`O7_vJz+>)CZ1cg*C!_W)1|55>1&}P+$ZVxTx<Or6}v-n65YAGF<$o9
zn%GM|F}<F}@MS^u)a5p}8UMNF5m(wUWt%fOn=uYS)y8&@bi@p?<hD1cE+9&3lgkN#
zL9h$9+*{~&dP*G}NUKmwC3|w2MjF#Anygo0HdZ^D1H0S<SYk=E=QS-Dw{*7_g4Ol&
zY_z{Kfd|hJlVla&N-^YRK@m}EjG;B)H1?OG%2!m^IRK$r!05vdKBX#;Y8ru`&nzH7
zJ*3S>A+`RP49HD0*;3I^JKB;0-CE#|1NFr}&5>1B{FetApbJf4^<#+Wx0r<}=Tdp&
zLSNR1x=L~7C71kKN;FABL%@K^C-pXfmjWxWegM-}1=7?HY}^5>Vg~M$wgWC>_fAIA
z5V<e464t)hNQ<%o56Gau;<E+32~{~LeJLLRY%a5IYxX?t##Ip~`58m}E$RbqhjqBY
z+h##|*tBV0s;HnRh+ISlTMxlIXCph`sdtHyYKVxEm((HT<Q44b6WoVJ0eh!m_;uZo
zt$WxojYxx71Kfv@iwdX>Ui8BmsjtFF9~}_1geOu!&RWRa_gZ!UancEHldc{*lp{mL
z^|lSwX)V<WnF`G^A17uZ&E2BceTht}718}PSjZvVb>$1wGq(JC=VEdLB(!|w1Qzy|
z54&`83aL}$#|h<@#!}CaXbMDYx6gNH9v}9?p3js^aGS0K@6!5>Qqo%(D_=}>c|e2E
zgW*{70{O|+t?(Ih3I%(<BAx(}npSs_Gq#J%F3Vdc|A4jWf~j_$vQuxul=3bvEKc=z
zRT<?zDpUe%W}Cc~%mOZ4nRky*wsZ)s@2RE<pxz}vfX3PFK3WpId>1usoLbZpRwDQQ
zyTHbj;dQMyWv*So#&uhh81_Yq?IqDpnM4yh6UR;CfVUTqcl>Kh3W5V~6%OXKM&|^3
zynYf$PAhF5<l$9Xvldo$Akq8MI#>=Ct#21E^mC!=4($2tY4H)PcxEhF**i+1`RYYO
zFae9ihdF_QGm#Q;UaZCo_S0Vyc-qCa)BdBZs7Qe0M^W9^V0lQu=XMv0xs%D&Q5S7V
zLV#!(Oa6jvfJyc9hic7u%J&8i80cm=$T%pzL@XW42ELT0g-i2xBlo&#S8{f*%6$n0
zxdabG>#rh<#U`Xgx|Xc2*Bu+zUyoM~hwKb_xFQ=2rwg*+FOxf5uVuRPd%l}5c}#<t
z;rV-(7Ao-_Yb1FDa3EeFHG5=ye_?u+%{6h}<=ImFn7-_U2@?Q|g+N&KV+TY}L22RS
z0=xhUoPI^v0G-gk1>q3UWX|;--ps;@mFK0_BDhhWosFU{R;RD$@-Vwr0mnMT>N6Q)
z<}*~sHi5L~GQ~navlskurL2%Vq4IlcNRp9crc;1a0JUp&c;afwWs>TkT5`xFxuw)n
ztdBY%89!fyBT!9JeySyjz86B${4IN-dJXXwVy+160LY!6$KUEw;?1>QUNL@N*O@tc
z#@J#B0zzg*!d_D61+T^0c}L@LC;|9KI9m-7g+HEeOQbnn61<|ivKtVnzLQr&W%a{~
zx#5#g*wAixY|&b0`nNZG`HtQ~%zKOn)xbK>e+_Oqb=1Ic_{`OGYju&UgK%}~+|#cK
zrAg(?SlI@$_@QrU?*7Tz?4?@c%u<xXra<d9F3Nqhf$I}82w|dC=QZJ$^EehBBzP;1
z?<#fgs-LJiIL+qplERZvmA|ZiXDHx?k!ga=u63<tpp*;JKk(S@=RHGjoo2E52L^4=
z=7|MaC;A$DZqZwtE@;X$H@?)JZaLp{BHc~}_3_@iGy6K7KhYaKJp8^Xgjj#>=$XZG
zUR@{LdBwuO@6*yu@l+n~?$vHITI6+};Y|>Qqwi0*`IeTOv9+cZB^Jn~yg{X50O63j
z_Vw9#i@<plNB(WrbG<;5A??eTsm*syAnHby=NlCMdtuFA1)X5kP#g!+V)r9v@_i1y
zlRdqGXA9TQDF~r6iw)u1N|X63qmP_Clm=!KcIgOKj~f>G)+=|PT=IwPcosgtU7cU*
zLontt4XfKJ-y@$$_7WLroW~q!WN9at7;ip55TAL_VC#G&%k|F%`f(IR&a7K5M$USn
zx-Pq;i?#_^G1?jpP$!@<i28BZfsPTP8?>K|mfnDEr@8^r)3+~O&p~O-O$^j7hBm8l
z{hXd~vl$}XgLSs?nqoi1)}!5j_d&Fen!nFzlBD%)SwMl`*{Sx5i)sKY-&Ddr$vqMG
zzOzCxszyj`q(D$nG@ZipGYf7JeL{h!HqmRdwDkL(I^!6}m%Gha`;VEiV-ic*u7L63
zRMuyvko{<UYJkUy=^ocy)l#C)yW+m?XNE36vw#KS-TF0@OpB)zJ`a@JGH0NlgoV^~
zRqNenp?T%0bLHp<ZPUB?gn0kmYk7b|`+2xaV%Q&CMC*RO+vAD$?!&?L`a-F=WzY55
zBt~rA?!~LSBB(a9#E8#P&e2%6UO}|fI+sL!_JwZKj+BKd+g`fnmj@x?ukMwYze2oh
zy{^P%hi&TlxIw9#Y+e^;7#-|-5@Him8i`UyzO!_`NZxC@k9<Re+ADpi!|XwH)rR!I
z)L^>2puwAGLp(w$kfHsDdS0vyv~hQIx7BUoeFvfq#x{G+-f(eygN>mn&3(3iOqzmz
z(u}JQu6z{^b?7ZRMHPL?vG=ow536z-0AEXFaUCSJDMz^YQJ?J$;a+}l#OdZ_C&k1V
ziCYJs;=(VrEJPhfxWV1vp~1<%xmeX)j5IT^<^!Rty%OV3+u|Rdu%=S3lV}*ns=$;`
zPuIKjLB(3Z3M63*omFEc*KHVxzs|eL=u!g6U4ImUFt8uP*ZY=#|GQyrAy;mIj|JTa
z8YyDt2y4J!)0p_oq5u7(zT8|nXk>D(vuHrhSIBrR6+dW&b{$$yyZX$<fD@`}-C<p7
z(xQ46%3c+ei9fEkCb`daE)1a#C5k}wpzB&He+DrHSlJcxXNS)oDL|~;`a4BR>8AOs
zbaP~qqFo2fYL8c2ZbKa|bp-j>A?n>sCo_Xq9vaPhc^Ow_bHRE1^wr0?172b?Sh^Hw
zTDo<P1;uAatj#YFX7M^dya?y}P+n(YQI)!cT%474I~2<h`fj@Koo+Sybfm6;Q=qca
zGgtC?e{Xq$s=~Iuw0KNAtcz{>&8I&Z=xIZzZNi7tkCF=J^0MkT6W*rstfSTLR+d_3
z&m*&UY>J+bZl*3`AvGo}-fDDI9(KR(dsBbBYEevGb^9I5+cKVt=$UZ~zD@w-q+IJZ
z`_v~aIsAF?@T2J1cU9lE+!yl*?0UQNnXVlRqb<n@9?rQM+2|?X&nmn=DI}UtUy$GD
z6+hXz9gmZeVYyH`sr^v1xm~@&@A)dV%yL++EMoqmygjHqd3Zf&hYS`VA3IR2%Q;1i
z&odbM-!dU6`w7dTakz<~U66B&)Ad-}qPy~SC)Q*jUgOYP86$*+q0z3dr*i`>4JZRm
zmo>4NqIVeJx^1YT_zt_(T#TZ2jpyCGT9fGvBYQ$dlS4ZKN3z32s6qc_Pz+Z6GduUm
zIm_4PRx1e`P<^UD)GG64K{%bQbFc$iZQtN-uihn0k6v9l%{i$t(Tkjhpe0?Q=e;pd
zG{lfTSk+32pJjIVF&!2yFoa){l)PLS2ZBOKdwQ8&ho=OJ4(_`D_Y4Xnnc~Bx2)Q*!
z_VYmFnHb!di~ys_*3Folj@i7~-Csz+=&12=LP3{P(rt3u^%$AM?3zgFuZ*R#SXsPR
zafAAPPXhdh-G}CgJmW@!ZT5Zi>M)Q!HWa&qqednh4>WyQ=w(*$$$Lwf;?e5fJxwt~
zqN(OTO%*C#D+jFlCv>AitRdFdgap;TYU{!0du0&IsuOmj+}bhks7u}JmhDX>tCY4@
zDbaV|j4P%}cX{p0v^Nw4r})L!BWdYH6neIq-A#(0x_O*NK?u^1UUO1v{9c8Op&r~q
zqLCnXG2-6$B|uJrDR)~VnvZpH(b6v(J#6Z*BSu>VRc^<EcLtTn(tJG1T&7@>pl&#0
z`rIx790?f)prV3-E)>20>Go9@6Vux=L@JFFQzpEFHlLcr=H(zX`Kr=ruZI4(5^uV+
zxHExn1*N$p4p1dD<SsS&5kV!wz=-}@DXhm-ASLZ}_p*mmr8lmxCH<Eb4l31_3?pt+
zVlBnDSNRM=UEEVv#U@V*-qh?Y_|5qDs8%I?9`nWx#z07xXi%Osx!SK#xLk7N>GEAN
zw-R`}xE@0~6NejPT_&g3{29^i*sHNYKf}5GRY}5u6}e{tQ~q5Ru$T(ACaz%y1}i<U
z^G*_R&CX@wGTMBJ0;~k9wIGW_#;LJXDPMdH-u5G=Mtk({d#B$(#KX|yVBT5&Mf5Jq
zeH62nx*Jx?l6VTNK?>viJB^eP=gUFH(4fEqj&V)Jw?Xe0+1Jl_@2Zl&(mH#cp(yXx
zLM{Mh9oV<GO{b+VwG9+q&>8zW|Gcer;U!g1-kII(@A^a|5yDHmI}DI}bwoq<EDMY>
z5?w&8hvce*!0BdF?-qRkSOGV|h*r*wd8HLylQ?eLQuoMVX}J%_@Y5cU^K);!SpV{!
z!qc={8vqtXSf4@~?ogo*r?29som&Y1EH6lYN=B`50{6Of&eIFUZe&#8-_w46D~HwD
zNuidT!Wtyo9ZJL|E^P&>DfmR~;Rg-%DPg$GZ!mg)2pz>H>~~TJtm)F5ga;K>jwmVj
zxHAPU$57m~C1;o~3WblVRV1#andI2V9Pwq#CvM`2K?>F?W7x)BALQ|$T_x*1X-^mz
zICqFFx8;>4oV_iKAom=SicGf^Dm&86KKJk(8CVo(Jk6h1&8}V3h-(TH$X!P2mSB33
zoO&Yisgn%NxaRCM4+V+O-jUkj-JATZ<)xp^z9obchkZ~hT|KEJ*7omOu8r*P%7(5I
z#xcaM2FYFrc6H}RTTu`|gPCOeT2XJ?HVbaY)QDyH0Vr0RT^w!aWQ~w%xQJTE_V;vD
z(GB5)%6sM4mY-836um$CcG1&yTI0$jC9)WZPA$0(09c^)2Rwyl#*BsVr_T>|kJEjf
zXMn?{_`tcB7VL)}z~hO3Hbrhhgup~`d{OzAUZ$OGFx%XA9lb*nE!%oFYa=3+=8WBG
zd#=DMH4QJeD#+UpNOA5DdwsemZI7c)nIK8L6ra2PVxwxxX-Oy?P>kFFX2g^YeUXc9
z{reqx8$<7uiq}@s40eUaP3=o>Pi4Cku`TTn^w7Ec!Zrh|LoiQJ>3YG@g^g^G>bOR4
zN31hXqCuzreNMhnB%vknDHFwuiiq5q5qvZ9qjcD7QCUUY@aV=*QjELY)Z#o(ExF}7
zDXh%<TVI$T=qx{Z=Bak)4wH-2OOZFu-Qjw4w?L+zX?s~mq4_ZWv!31M=tP$v(y41X
z%Yda7eodzl+Wn`@syy%B3m{by?o0%>Z!f(?8A0<;sG;k#+YQ6me-Z{-(kVMp9Hx15
z8NH+OFM`tR@J{PnYaR0HQd~Rr&eLO88@!_`j&LR9`5rg!M}InCVax11xS^)#mL0M#
z!`cmGvdaN_K+#UHJjV8G+Cyf`Jh$J<^IlW9pnVWXmi#MLc}zx%Tm+4-c|y&Vb|S?d
z7jFBm;PpgvSe`bpeo0V95ms%B&&`++_`%lJGWy_2829J(7`$dO>LkS_W`HI?1bQ|3
z>ow}dAFICGG)~Z{QKW$K{^B{%A5*K)^x`<Ppj&K918(j<=`BX^`5mU6LDaV3-+TT1
zRwCq~(u6?(8F~uu(b-b?5<gostsEoe%LQ(IJnTpc-2fSV8({rQurFo}l_ouF4}TGc
zAUpHs(z0O<CuYJ_q(Cz$eeR_*7XO~`CuW<lbQWKoLPQ$hSi1SWc#f2bva=XNkELjt
znMQV4-g=EnSkVi>0D0>j`r=B8az6CdT=cdtJQ{;GME~*mH9nsz?b9;7*_Y|VPQVKT
zt@(<)oe2VaU{ljY(J0NGoO<IW&QRBMIH|D6kz{#eAGev#DEK*cDcq@cFB(At7wh)h
z4mB~q=FB&qV`R^GL2Wvtw`Kgij<}ejG53nTXhoLH@_^*w2QD#XuexjZO9~OJ#kM{q
zpAN)D3@8$Na++rKXCpjMzr;i}p%iR1Tm2WmreV=$Tk3P=yG6}!AIm9<)>I4KS}e%B
z?04$`u&L{4Ox7nH>9)ytIXuM~MqNGu_}rx(m~?KphpW7q<el`LNLDTnZKM^`8AR!!
zq49DPwg}kT(Rs(#-8ci6=|_;pVK3}2$5U?BjVg@0K+$WxI;t~TYs#MBx5n5HiHt6X
zm=Ll}g>MO;m+oETl=pEaA42`Cc`>>rcnoq!7+Am}Ey36TX4nt%=AAPGlYto53<xv`
zkAy)P24x2*!lBY-EW|s-vgc+Y&Qb#zBbjfnp<-)(dX<ZyeoGUOhK@-$Vts+;O3!Wc
z?rTn*Eu_bfgvZus5D!Lo(K4%|rbDpNQ*!j#`3T4qp$Dn`%!2X(B{o9*=%NxR`r>l(
zf=jm$^tcm-Oj89KmUf^oci-TGfY9=2{b!g-TdC7--SD$A`v{{+fV`t(9PPL#v~oZJ
zuM&^X0^>`nZTj@>(R?*$EK@NFOgfxQtd65jY$yDzi_w=}6f<<7^#cT&#5%j!L2W@z
z@w=A11ln%<o68-5h#zTe_d62=wfD?kX5c<uWIkRbg7fTruF677f=8aQpm6jnR~wZ=
zlg3Q6n!M)ZJk$4-EeG$XlUb=+-z40)mdn#g^AhwQ9Ot!?ZYl(_zLu8gVky3|?OU41
zkbcQCX=vf;+7mA%`+!&RU78K=>0!2z820XMeR{IT*dyrmY_a?9gF{|UXD6cD52-YK
zwG^~BJGz(eKPR7UQY>=d#{_)#Y3)_hjh7NC_9gUr5MBE&`Ddn~aUBD%9&^L3jMIrg
zmdClBWgya2E#!tH^`{`Y)mgMz$7Qqx_v{)}zzwlI&o@#+0`2D0;h2fXGWXrQ*Owc!
z-+~?O%X>#U1O%5QIziF>lU>guM!oJ0KE7;R(}Nj)&?K2YoKLSyhg=W$@pZ~t=FFAz
z3Q1vIur-lhY7GY3CJXf$_scubU1anacOEKz+?wfSud-o!I@7{Lb=}^)$u&M&FVe#3
zkEajL+1^Io4Tik?ee1E!wn6=G4+miK6IJpi5gX^i;T^M`H#zJ<PFoINg%Uf{-?Y`M
z>e!EAcT(NFOmTA8Fx?yuyEJyItR6SY<tYxsofCH~UT}!)73%EW@l3xsfd%V{KH|2^
zJD)Auyvcb&&78%jcQv=^`Dl?JQY}25I2(mg1#fwdW(MbYOmk9&NAYTPoY_|8j9Yo*
z&W7n`?tJrjcfZ?V{_Kbj-c!-;bZpW)Fn(L>_shO_u$mOOfP0MtBYAcQYjJ&t->=XJ
zsf;cpnznV&6~ySA(cHQ+`-qGtjT#Vbb>)cEiAFD*#7ckt@>2<Dl^`#QIIFMf(RkxF
zJV{t|R%1>^H?S&cL8f|>_T)<cagYeZQ*W%8m?U8uImI#{2v~ozJ&m%68ExGAw7eHK
zrsJfuRy~2pxoEIO5pC+r15xo_vM0qfpmaZAQi7rhtn$lXM;Yq@?$+68TPy4}<89xZ
zC(ZqCbBR!5f`@ib+42af5~cv+<k!CNC+L0`BsiMg3*Q^xml5<@<>*le9mgt@oYn|p
zuu+<a7)X~w6j6LAJBzc?I`uA9xQaY)Z+`AWC*a^UXP1Nfo~Hg;CgDvtcAcyx&F90)
zQ)e3Q)6b`BK}RfquCxVQd%iu{M?cJkoMa!e4qtvu=)EyNB^RM=DF@nk^N=2IzVj32
znfjXvU3tqE7O(kk4304J!C8lNkKDbdH@h{-uXw`@U$C!UtOSK=t-K${vm$#$J0NQ>
zH2|G8u}Ll(oFprCIc3S@Y<5ASIa@PI^t?~JWa+-Dbvk=CFBXC7Fs9v*#kaJ3D1kur
zlo8a4Ewj^&E-l1&R<P*mq?$+fKem|ZTH7QMA+X#HC&BMYv)?4L9C32+){gPDY|u7w
z8tcb!Uir4mizw4&Xo<6Y)rX;ev*yR2KtQzLt&o>82fu%IkC+^0Xs|q16ba3d4Mv0-
zGmKv_Km3$jzyXF)yUJ?7T5~9s*@J>Lss1ozCwqI%POIR}?fW_Y5XnwFu@0W@q*8I=
z!|E5Sd(bw=9c<<WnY1Dw3SVu=Wn}$01r`5Jo{%#>qG`{`)`I*DWNv|u|LB%m9K(2(
zK0pvCgSJZPz03O@#Uk8_3Rjg;TFu7sMJTwlF_^i7q0t(pyp}BTB%d9d!+vL`mQX~M
z40+=%0zZfjOvvSuF;k+ou-)x<`+Yxjo9tv~wOJvuqoO+N<v?&nMwU%p?0=!Yz2^KD
z5noV4DO8T>GSE$~dZbuXv-)DRiEqFSyFy9TB*`>aGGVEjs1~kRhFZ@Fq&E3mRJZez
z+?j~D>H6F+MvE=ep0kf8N5mh-R~XWCsS8PMjasahTu_>(pCrfP6-X!A_;Xt7-a=G!
zV%Sk>6Fv>Bsp(qdTO^&2V(9vN3NX|x{+Q|DNSX4v^I5IBO58i4Vb`}4mE!b);N0xh
zx5TISf+++J{jSgn5#==e2_B=~QQs*4sCNxDOEBvV7rNeg<-s@Ex9!JmXD_>^C+8en
zBZpq8f0Ss_CMDeVq~}e~4`_LVj&)I@&)#m3M6=^PE0UG5-SMtj`w8f3!5o3tB6FJ6
z0GqKlK}f}u`=*<}8r8A>#x)2d&b+~k`P7J7p^8A^ailb%9FsCrQu$+30ByQ%g0X}1
z@gtxdJB2NYE^UTq=1PycJr$3wY~i%ixl`-ZS$~gfhfsAWJ0K(P_lni)Xn=Hj9o;lH
z`wJBlpjA?xVSxt0F+!zu1qcWTJ?o94`u`G0B^Pk@%{j^q$Qcz;_7=~;LFI@ARS0f#
z7Z1Lhi07xf9<Ft<S7X#wk)^O-4VN7?!Q^Lb>kKYCN9{goajzu5c>@Js?En6GPYLiF
z#HfmM;u*vUPh*>JE;eWJ6!>u(GW8QI#MdWU!sZKTHT1oZzM-jFg6=RI{L_5j&zxL2
ziKt;pyD81_rmGQOo^wTelan2NPgy(O`A}~bAM&v0ccET=Gn|MFBeTeHH?0?5K<RY$
zKFH}(9DQ_&k9soBoW6g&OTa*GIl33)jPpZ8zlUAOR?nSlGPOEc?ad~^DreOqM|wS|
z_HzZuVbaZ6<NkylR@((w2s#al4^Ql>o&7$F=Kw_)m7ePUduiY=v{wZS941zRsbc#w
zg8|ikdL=a1IdqN+;c<lMLOw~HjLSEP-``dF7(l}cB^gO^-irfFjH!4c0J+<Nr^MB=
zmpFf+klq`>|EIyDZ_9su(C-h+aDW-a@qpov8o*FgNyQ;3+ncWc0O0;RG5?;S9|{0-
zceS<r`ZrL`UjUm7KQOA<e#T#-e!rmpg0V%UgY|Si*_HQO4eKxTnlQ!_@U1X<6lo;>
z^lC~Wuq+PBqZR&MDSs^)Y%fB9r;8$t%ajiL<EtTHke5y9(tjVyzn-6kfN%BesaP!O
zA76b1hO%owUhsDy!e9GN^C9?Fn(F?HJb%6J_lN&~r~a=2{O#cYFCv3li0}OOz46yC
z{{JTU_x1cq7=qBJsi;hk|4sTFNUf>Gy73VHbJ_lT<lgHbCKYBNQb{FqT72s+gh%Zb
zKzCE+Jks!wb3Z1Qp@Jrje4luk6GSLu(e=__|G2(X;IH+4qYFfCjq%)o?lGTgq&}gJ
zy%JpYnhU5V#~eSA`ST~pWN2VWcN<TCQOcTu%X~tv_9eJlG1+U>bY0q?fdprz;fMU6
zHbh1&-up;z+@tsca74lpR_K#_)(gT;03|ZoV>SbC-?xxib^;7zocdd|>K0^@n!@V2
zy0lBfaDlN<APL(CY%q3!*pNf@oNK<@*<!%#V5XQ3(0cW525tWdI5zY6N*+KpYi<FM
zWfMp)v2y`oU__CA$mRB$>&ceJKqL7-rs2PPnM1&fkb%DT3>G{KfHk=9p97uYf9YW6
zOGi0}3tp^K?nw%+aY^eHH=byY*V?W9s8dK6+<~jD0%c+c63d#*`uz@)Cw%pjAXp@Y
zM%0`GX<Hx57*I>4zTuv6+M4*O<8eG{nQT$@)g%w)_bvC=vz$yuI{*tAfyk9@2b}Qt
zFC^z&H=k7l;na~V*A^tA8UP&N=hp*rjk71yRusMrs643m%7GfQuL|X2z^#clF2rtR
z57e60;&dD};Id4$05m!}Y15ASPF2^%_;B?ER5zT!F#65|{DFMMl%LAeGZCxqymZK~
zI;UOo^Pj&L>;F4ApM;0;-Ya?Is#+FQ3`raC-KW>kupJaZ8O;h({Oq(lCnDKG(DEw&
zxsG>zARb*E+@Pfq+<}X5R4h3n$<-$e>3+e>51m2y>~7nYYU+=mR#hvcz^0|;SDM?7
zO#xfWhlc%*ofZ@d%+o7F@ou;WJOuP>Z+3=cm_xVh|9CPF9wBN13@;E=w9iX(HOu%^
zvIL}MQJI9I)U9e3k*h)O;NSVdZ4#`VpcMX-2}6;2R4jO@#HouW9`Uj!qfIqDK|+4~
z5sSX?*&`xXQrGp&ozKC~(Ffqc$au4-=OGMob8f-~fTSRoyI?>y01D8JKji<>*8F?!
z6f)XTrFGr5UsV74mR|=d+N}=1Mi}VTQ>~iLl><Ku9|I2pR7d!`)pc;4&Hy5+#&LVf
zPoh9^v5i!gM+8mF>O*}WDB+S@R4zVpOlhzKI`Xxg7E`_@TNDzcSu?SxR4kEyyx<aC
z5p(M@mP1>_X51(sTTOd;T_Ge~bE$T}0#%0fjbAlGu4e%76!&TloHRRNXSj7)t7_Y{
zzc=smMZ?nupp{>>;(<&O7<SM;uwDqZ@(E%nD@^B`8k0Fpl^gel$=v}&<tJeV$7PFE
z^O9x#<{Sr;0N(#SuDo8+d@SmhPvxz1X@vAO1)n(fJR2@nn&+xSNH_BaI_BX5*9Anc
zfMxAvZQiI*M>UXk3cvS&`@4?gq;U)F_DEtjk-eXF0W&fcD%e6I-&u!c*=qr6b-1vs
zn-MPGhdu_BB=*|Aa-teefhvPlu)<a9Oghkd{3=RfM<)^(IjHh~P9A+TyabCX`J!81
z^Ga^7E<i4xIbC?NlcNTjHqTjZ8!T&cE^Bo$PONp_?P^<@ORIKt9tYZQjy?NO3zt^!
zc3r9<k#B6_2jE#tV7J0-JK&fiPNc)Z|1X$x^UZOwb-IKiu3jUQkQCDMhvP-q?#cJJ
z-n*U;H~mA;dK>r0uuso_FpJ`<>X;%`x6_hvRxihdSONSsOf;&HbH1&x;;M}1Nxbns
z*zPqnaq7^}{b@&*6#7=P$ftNhf&PYGaPHJ&W>ksi4SUeNEpQe%fjXg1&A=0S9-x~2
z#JB_$9JA`dc^W+T0&?Yi3M7lUw~YRZ0sejfNNVR}Ppi6ml+o0!sVH9>Il!o|?;|_K
zM0aUwx!44oS-Vi=Jp9g5Ki@8<!PBNQ*ba~?e?~F~TEAPW>IQxb$nC|X7$H2%5n`n1
zx|5bZkZ7-aDE?VKIM4=goEltW?i`>>H(j4hm+&HG_5-L1McDm0(0}#b!Nng;vmcTQ
z8@6<&JN-xF`9IrgP#e|#sEftv_`U-MLKR7gOYnsMaJF~U@IXDwI<@J#G%h-3kg8IR
zX6Pi)^ZYz)=?|7N=Zv)&m+R5`2<2+J=MAMKfO5G!z6A0d{N>)pd8v-*op&X?+AZrG
zw|{|a5<fKwuY3qNsQh)<{r5q381aKK8m~;4(7~W7Z&B>aqAo<5swBizYLuNu2^t%w
z&D>0HTm+NYPB{F!YO4eZxplvh#G)dS53H0;GLjU)>Z*aOW$(HI$k<~qG-)FxLO1YO
zr`zbdDElXijwCWK&)c=6jPh)n0!C9dk*@pIa~pFWxA)Y7N2x=V-o6TXxCjShgP*tf
zF4bYI!&w{^Z-oo)YQf&iBIc}?)hK!Q_ny&zewHvEPKgRl@To@c_Cd8p@_J$DVG=D+
z8>vdp!V(yCNX?R2%6^sk$8ev6$IGhu5*#Lr%{np@kYOY5s4N9;8hS~A%NV?Gf(SKT
zcIwQ3jQGAJ+^MGv<Jo`11;k`)?c@bY-+B&zZUvu9dOQ#<b}=9zM^`T!j3i?7R~GPB
zw21BHkNuwE5CZZlW%OmW|Ffq-)JcgA0{3q3LFJDsi63}~{%{(pie%*UURHk2R>4=J
zQU1d_h~q&Vt#V+&@co-?Rmz{nEuV5wdG%UTX^1f>ANNnmN2m-4;~CGZ@by(_wfg@M
zac8Lf>xUH5n-a9E1pZ;5ygFz=77^>Ng<irK{cP>88|CkZK}OVy7?)<%n2I3Sx0ipI
zCE+DpFc#8H&ydt(yW;Hr5VpN1K-BDR&|{L;6t_`%{HL#J19CoPn)x_{f^MUp+CS_E
zj!)l#jyk|n?eK6J{fO9u-|qf<K&75@yjZV!uX;?=ycVGM8$@<ZzpTZv?T!aU`Ntui
z|7l`gQCb6VZ#~>bB2k}ulK@p79Au)^J<scncr5VU(4@b$P5u9#)^DgKwnlKR$9#!z
z2i)zf`Lacz2~#pe9e&#Y`S-6ph`V!c$K0^z4UcSRK^*vm`0wHTZ*up7au1+=>OjO=
z22-KV(e3&b1rM)FY4W~?fMpS7311eD<<>XA*r5)%MFiCJ^KKSc0>TjUqg^-=V-_$E
zb^t5g8qRt*FDQLA!K60i^Yri2^}o3h<KvGJM%$I+ML#TZ!qNawh!!vI-!u9~vre<5
zez7&69-Ik&_;49yOFsftdg*Ndj)LtpU0QbD)PU%0iU8g3hpu-Ns-NZmzMhinZq+m;
zHA7Cg5eV$;0aE5Ywrh!I8zz)s)y%zDp1np~9qO3U!3l_YQZ+eu^4TW)pe}J4%K&n2
z4YvW1>;d*FTcG}gcM7_Vb@6%-4JPR%@dr#%|1)O8ymt{F0e2clGmf8JWgx)HothN$
zrCEO=#qN6zY-e&bMvpXP5>L&=rR0Le4>6z0DB8k7r+r;~yA9>jKvZ9Qtv_`Z1W7AJ
zO&4Z>^I{UmH1@wAg6(B1`XKCT#aW*nj_OetfJ)<RfdkJ#6;3<aS&mi+gLGOk;#9TG
zuGLyGc;i+naRl-loOvPLn3+BR20&0yR@SNkyl!QmV<vKM0n4kCNLNch?@IO7V^C5z
ziWEoRo~~v-+L^6q0e~SWXsc)rSk$8EmJ!X_0n$}A?=%P+y*)H*;E1uS`P*x~lGARb
z&GS<eV<PuOW-wa(e&E7sTp-xTm*-ye9XU!^lO6^^h>7265eQVaa?m_MeCO`$2!dn{
zYd;VSKB=ot25cPmno}*SEv23OaW`eSj5xZ-#Sw!u83U5uPYgJ_d=a?V^pWNA|IZ%h
zz(Sx)wO8h#D0PvVV={OlQT`nPBgSZfpzM{@f!6z9wM&VQn$5D)8cU7RMkjJvSFc0K
z)++XrD>K??&*19Onp5b&fG7yPOF`)R&GIS;Md>R{hiS`B(PgvT(4*qp2x^&6ThlLa
zuPiHmzB*0`B^Rh;0jD;STXT9r+BJYmKivA%128pOM!T`OgzcvOkKTQPFqgLB`hhoA
z{16cOCN(b4w~g-yuEQdx!V2Zak|iuN8v6aAK~a#OeRggemejr)Dm^oIVE$(bXAl8x
zL{xo9+mG55ij^F1L&oR$A!aFn)K-$iiH)nve)_P&T>A?yl4dIjI2U{;AAUbTmj?H|
zW(nH)1HLUq=apDBbdXP)F9I+G(+7|nXD(39fU+MQqx1^M!6>fm*9SAdqes@%Zk6?X
z_HF<;@Qy<0HGp0dZh?$-<uM=no-BLcn*^JVM;LId+9H5aU>F?EFzMchs0ZS5jpmv|
zebGd?4*@gorH$`h1d?K5dUE^5OHEYiFM9=#GZEa7%KSjSCXl@k+I{pXV1p}>>i{0d
z@m%r$W_r(pg~67QG7zzQ98G&AiDw(*>VI3quoAW=Rc+&0Sz{IA;`t1wV)3xhR=f)=
zSt43E1B5ZE|L!h;bTc1qPjgMgYkrOL<+p*gd8^qHUzLbbTf*rZY2`V--W#!pZG{+s
z#ii>E`SmsL)d0w*)%Gs?pmtTA)P3N1Q!620`OwE2&82gbFu(U4wx-Zny3nl)6z)n{
zu&=T$LcP&!-nIvZ{PO}3?xBm2P#;S1qh9_Z)JK~X&U*Xxgt<xD*MfKD>aeJT1Aewt
zvwmFBQL+VjsxNf7NT(i}z-ss_$7pY%1xYn9djtRLnsfI(RVPKtMp()ZGz2VFKl|Oe
z#=UUQtE{wZfYV0@X|IfPKM=-@@+-lPy8>bDNzHoD9Kj5{mGtwlVIxV?8`r)y0$Fu7
z`_Tci7q+MF;)f)>|II`|rRf_^9ETGXnueOZ5ZYmmt*5StxzY}E<%qKJ?B%dk(9HOS
zgkkTcIa#MP)I63+TJYv<>AiRd*cR$FpofHk`a(JpAS%8Jdr99EmiO~U#={MF@P7b=
zzJMz*8LIX(fz#Dms;c3sdZa+N7Q+z$B0DXDTOlNE+L08$It&;m9b?Usoy~$9^0DV=
zZVx}Fe+G5%qXs!A8Qa*<b{VyQUejJ<QW>}gQlK3bQNMynwXzi@8U@m#oX;i1<u3ut
zlV-N#PMniCnv&<$ekaCF!t@u)%yJ`ejWTPyti<|(EHjthA*CrwRk+@9o48g?(u>4C
zsDuEeHISFTd{|3X`3J-Q!`@qlRke0)!%_+;q6i|55-viN5CmM52+|FLlpqL5h=j7p
z1%iTv64D`E64DKVAT1#s(w$1zH`cyO+0XO+dA}du@gDad50AZtIj?KZd5tm7ah~V6
z9tI*#ral{1`5|-A{H3kPyunH7u9Let$K~n=HaP~Hkey4KieEkc_}%d92!bJGkzOX4
zlZ%`&LN>E8UWU$sALoiy%l3Q1GHaGEBLkPJ!Ql3?8RA|Ah!Y5-)N3zNu=!dH7G4{A
zT1%v~sPt<Wq=(&mdob^cfp3T%N|(#N0FNYA7e@Hg2wwc=@fqo*V)fz`&EpmyQkT4V
zCQCpu`d6Jm>d4Ms@vGD5s1Q1F#l27UOiNn~!L{#G81mP*JD2?uk03%9rq2FD1OBh@
z4sqo?ng@22B=D``UYzC6j!ZT-$#G*)PX<h@Yr6DDbcOwOR8ov8KP)m6m7*rh5cwu!
zP%4bj2Yl(tkkoXADVq?S(w_+gUe=_OaAWiyi0X12QS4o*`)DpGtZYcKAgozDZScNL
zbTcF|18lN1*A8LYRzg#Y88!4T{>)16F`OfRpU(rksFNpcl!Y+AX^3LY!(}vXFQe?j
zq+jri>(wc^Zd<6~bx?uvHV*~HOh5h-X6hB5tx3-M6;s8Sfdt8bA69_(OD%k=;@1k@
zj%&uPU>pLO^3uClh&2f}dbMrv#$JE9mNipH9Ro*UjTL-oZ)`)uoYS6+*vb)!5@eV!
zPSV~_q<8_Np>)QsFBFgS9HE$xoy=VL^z^3QVkFNRgo-0?Ff33CPbEiuXMCA4fo97f
zZbjYwYbF*h;Vk9Y{n13s03;72-W3i6r(8A6*po#OR1rgo`~#!1lqtBr@mB2$#9d-(
z=^2<DofCaEjnN(gJi)`Qxvs0)u($iDn#*;$P1X~Bd_8$HSYtw<SGa5M&~?+SJ9X9>
z5%#gJucH!^W-+y?41-XD`dyUqt=&s!bxLhnWC8SR^^Q5FXn!q|$L#i_cG}g?*%{76
z$`Ca}_O~Y8_@Vga0AWH7GM_3E4U;cCL0bFr(G~Gqfb~E)h-A6{1q+)b#ts6<(^2Ow
zPm3G%kjIR$v_KwHgPH%6-$14};d7s_Pu~M|X#U+>%?&diFoueD5tKrg&(89X{fa7n
zm_aCZUf$1p@Ft@U#@6YD9?O{0{=rbMnBr$sK8t~Tf)$vdt^QWOIDYZ_xNSAosh2am
zSO0tl^w`(li4>ru&4n~uL!R>#zJoOXvmchP+R0>*5NvnF4<NSfn2faGP=7iO01FG^
z=}kd(bR6F!$TGcSHWvHyM&|fJ7<b@kd;R%`km>86=6S6bhgSWSy@H<K>Zl*T1+^;q
zx$-);Z*Z<@<afqjo)egj^N4?*JN3Ahh>xADV72@rl(}NnMxRO4$8t(vP6S>Xjx_%y
z#dv~^>hd4#QB1KZ!p&68!pnQAsWiR?M%3kw1?;hJ8OPpcN#RtySzlhoIUY`CoTsZK
zHV&F4&Dqf^SEVr#{b$`ul4QD0YhPv^v=!Zj)vx6=U{LNi%=4siP`~rfl8*&P-uBu)
zcQylA?@JLxS%*nBh8}&qFRDi<i4PbgQu-7M`3)^LWPvBK&*aeM`Rse~H&ZZ?@H_Qj
zrBWSMAklcubo{k(MqN3b&NWlhOmYh3vCs1y+E~6?m8CB#wVUj+H^s6{$s6ITi^(^x
z-BskG$+=xE!6$j}b8^++MnN!5X=JKsxEPS(uXZ4%-cci0tEfG#6g7%HQO<E@M#J)!
z@WbpTSCw0bAj=<qeV!qTeDPKlc5=LidL+m7;HNGR0)G0a4~w0?Ho4!E=rf|iCRrZp
zw94ivCe*{K?fEyvvr7Pd`Hoj{L627RPBgYr!n`L#+ln&2<^BiqwuMFZg-Vqa`DMsS
z?G7hwHJ=ycm@i_|i2G8Pu1P2=OBqc4Phdl`8a6&p4`kz?Ixw=(XyJ>uiq}rPE5_JZ
zWIATE^Wy6_38cRRR)U(l`Tt%bf5AQX9+P&3v&nqIe#GQ0T%OqYlCdu3uhN?_!?y8X
zW*EO0E)j1}3_d-KttfkL!Rmv3!ll!-+P&1f&BtRK>#X~o^VBch-QC}K{OG>y(JiVa
z_QvDOhdWnmYVIm3B5vV#iatHJUoC2@KBSs@Bw}DipMQtNfyH5Sc<=P>7n9MG!#|sK
zmdA!dyZJw@DSTiUwwnlNJdh6(C>%7Wi4$v7_q*I?gGF^k?J_R@IeHPd6Ij@P{YAeQ
z+w_54*)VNs86z?~uWRnt8}_ow9elmF&82#hjrhWq0l)uqw-e}6+|G*;`Ak>sA`%T(
zt9$b+nC<)$8IbtA7X3T1*F6J$c1zsUWFOr6=LP<GC4?A#s9lwR;FaVIMuI<nWAzI>
zQfb!RX>4^)i?Kg%E)E~9-E$xy?Gu(2$oQXo#{9|&GDSq%Y~<<tU-CUK{I(vr!7I4W
zG`AKIEC!|0f&W_OKkmX;L*zqZycLH&S=UARe{aEGfAKl@)o3_7A@TJbtJFVs=3oE+
zhAtK?s`CHiMHScux3pao&+dJ*ciM)NlT)dV@g3u_Efb9!T&j=W`C?L_m79NSbT;@2
zTkw!$4)wx<t6?GX!YSfKE1rm&KUa^19f@7#a^#&f6%rOTME=~Wi0?YjYG$EW<HXhW
z@#bDDYolG|D5Om~TGdPTUrYSw)|y{kT|Q`dQMt?IPbWypm!&t%k;u97T^+HrI%jj+
zIhRuMES*pI13oI8M{$2XD7Wf1Y&K%LFI#lN69ZFox187O+G-s4%`7|vCvWt*BxF1a
zXeX>?`129oAv{wm^{mf6NI9!Ok!zM!im&p;L)PTBSeX>vW4~Sm2d`(O+)pFBcbB34
zLnI^9I`N4UM@I}cSpEMR$hA0pDvb2*NW&Vo6f>8PJN`*=(YuP`ob*0E@%nB3KfAfB
zD_*0-$&gA49ksTPKUcFzw4Cp9h<7s(BW3i)$0i}gy}SES&$IxUSCJ>!EZ-Myg=~ju
ztQr~`&M5omyH(%SzGFwqUhGn7uhbu*II0w!P^v&hw3XSljQ8`CVdK-go%sC^Rj=x8
zf}oZO!&tk!c5_3Gzn1$GxO`e2D87H9K`6aRs0qCGfQPSaxpTyPI6cX<I|rQxSV)^v
z>L0)5uV2bYn5k3N!+z-Ey<;}b&b?OKXuKI!!g1#^o>X^S6t1-GxHp|F?{z=NT6UdM
z+3QlrZ-rjb6L-Eh`|;WNp6`nTADqe3?fTVPHRI|u<gkL;lU+=w+ae#ozxKfL(>~+d
z?2|IM=R{6m{r<<j%ZeYhZmMMK>U6=(Ub#WukEc0A#v@~Xig;(^|NWnf(D!2FN<VYP
zyCwYlj{LQjNxu{5!15AORop+WfVtqaYa(%sy&7&m8UEZ!dN+{~{BwxLNEy+)$M5XF
zm-_8F{dWWZ{Z9Q~`v$5BDU#r#xii&2YK6a_o4l5n!x}LLNGTU|*uygppoeULAvdrN
zkfi$^J4r;QPOHv|G=eLR!C7bsr*sxu8~)sxiKV(W(Fxsu1Kk&6ctub4x7UoJ?HSOl
zzB;I$rEQAoEA_TPr5XWE?u$;5ru4_Z=_xWqn20x}6Sxh91B`IJa4CcWp;_rv!aw%%
z!jQv2!IQ^c#B{WdZB9e?;uz_&3GKxGJYK$%qumLE@i)NOh#OREY-10?(ScvykiSA|
zY>qfu{RE6P<d$BgCB0%`wuTq#@}I}Uq=!fip0rkxr3K&_hAIF9;Ob#BRau`yNWFNl
ziv90b;vd&U<D%V92dCNrF31Hin333>X2Rfo7{Y4|yzyzk(zx@CTe(^zZgRtH>mYs@
zHQb{9z+$Rt7hsuI=){`A#v9Q>JG;mN=2~;Y2<f*S`kxXc`~dP5axP8N%u6l-h<M0e
z?|jJ7_?zny(DLi~-eJ|d4g-vNVKB01no@$-4tR=Kz_KcyZuwGh`_>y$@L5JR=RvnH
zvMpM$tn_=j8e2<B2(j?~w;^a=TMhziWWK2k=4pdSoI%o`hcYxVpHuoGhxY71k#Q^K
zb0;t#@;m9obZl?v6?w4jnZsBkbzOFh<Qyg{VHH)?ZPVjD7OOCR&q!LV3?Sz7(*+(S
z%!_*fgS*eV=q10mTj(KzdShaJu*RU4E8Za=B9mR{Ot$O6ldzc}1tF<h3eY_t5*i$2
z0yYZWXJ-r$shF*cEV61xZk;K5G6m)PS@Um<?A$0_K_O{<$M)c_D?h108h~z_(i@~#
z%rW@lvsyqD@v_0pF-1Q5vopEwi-*MlWWSwee;xHccjNR?!PM4u=Plj713cYRkLTOb
zcNt(G<Gut2wSYjFbUZi&4VvX!epa0oj?ejeyz2#Xt#I>zi9xkNlBSa4zp(V7LBlB^
z1R`7nz*W7`DZo#jhG)seD>Bwp3Y$JGRIv?qrm{b$TZiqP9RX=-g;C&hx`S>$3l;I?
z;30VPj@KFM!6SHV;h4s~iL~AZHb2m6bri_I%jikNlPu_1OHb$ojNA}pzE6vmtJ0po
zK~<&-fy~;~o0f@J(GayUZ-i+hJ^u<`F-GQ3zxMqIxbDt${B!zpSuun`tON5S;}Oqh
zKfLm)xU$H={_tl!QX(EHZC-t)CEGBeQAqm2GN$8NtMlgKHNv7nH`!txHs04Ho8z~@
zHLccpb1iiB(q0>(`8S54$2gb9gs7+qiUzBF1}$-DYB2U7OIk|Ks{WOSn?+Tgd)+u+
ztTYrz3q<YKS+XP>V-J6&tX?W;IBD!;|NeM7K^o$Ql2z>|B}e2=yumHp@+@1k`W7de
zqhEvFTiJ=t1Qt5hml$&<UNPQBr2c3g0IAPs=QM1lrbmwGVy*}ICg*9p@*XQdL)N0u
zT4u18;Tr>=G{zxpFuB2Mahu*Ua$pRHb|5xtu|@FV@GpFSg$@z#rMYpwSIv_mjiX10
zTdTLtCIA+un>NBb{&^c*K%`1q0s2Eg_29-d-O=`|x!&y92f~=6i2h>|5|!6L>v(Cf
zwvGs8=4c%JVra5*Z`sD9%o51;^(QH`!;R#Kod8~>LV6|eIBuHrg*=_8_Zw#5L6s*#
zy<PAB#^9HUUt4yK!Q-|l(_h<ft!lxY$N(JQUTD+<SYisW9d!}yK{A%ksN)KfZ*^gP
zs@ZS;lJhSKyGue&FMgf75WP|FUuA%ykLB4fX=&6$=ZWI1cI4A@*N<m62oiMEDQRYx
z8~ska8#3I_M{eht_dl~4R`Y0<%MRDaoZ_Lvl#jlJQ2{X`G7?Kd@Mc#FG$YM1M|r3Q
z`W-j|3?pLe5ARo?3I=t1_y&XOc+9%L29qInU|_c_xIXJxV;~$Q5wQs`lc;m8Q3;%~
zs$0;-8R`>NX@zfMd0nD`r(;n749lVivwpl<dZ!$ZGW)5bfSf8EL>tQiKd+N8n34Pz
z@aHgI28>o58yiooDlK%KjI`7C`q6&|A;nwR5laQS6{X1~6|XD?lMDI_YOS^^Ji9)R
zY6a$rcw;mEGmT}h`L+A-4vB6GN=YkDyg@eVRtMgl?gwH>-oieE(|pAln>!-jJ!Ew`
z+~11PTI~W0>=vvyb%1AOoZ!dH%B^Tn#zY~A6ObElP+X%;_O>Iq3iuGoR6Lu7gO=Q`
zJI#8&&X4MehEOe>4aGJtz;AgN;BS&042_IF>gPk&O!MCho@n$k%dwQ3_kYTF3{I`y
z-B>6~^Sya9Cz%l-$0D8Up(Iz|^h3&e(o^n_PekM$es{KBJ9YQRCpCDo&qxps^Zn#4
zf)k_9t)h?R{G#5Hddd}5%6QVY+Oa~;+6sY_T=8g<4R(j4gVA}C;TR{`Uv`>E>ENwk
z6?x8iIfI6S8#3?Nt&vjQdw24hTcQPf`_^QJd<9TQ`^Ecwj()~HYmNRl$JgfzjQc2f
zOx})8y(c`uvd!JTS=SFP04=BJoPHFh{G9beb(w5Z<JqbbGvS3WE5w-dg8p?Y!s?HO
zz@xh-vi0Fjm7YOm1b?&a{?kw4$j4b8bDbqYbHjO(HS|VEMG~Sw>hBpTbLHT?Y51ND
z(XmYhF{a|QthfRR(Q9pJ2TjKw?WYVn1KqLYhXhY{{h{Kj=$@1EkA#P{Udu_eYisC>
zReH_Pud9wi&8Lkq%Z+A8KIid&tqg&o1(;f&4<Zci2aIedo_Otk5ygH_G{m$kIb5s2
zY-gCGI6hZCIKCnI0%EQ&H(|jcfvY=m8V=cx^hmF5Ag<XhINkX(*$|<Z*WZ6BHNBSG
zUaEsf#@;wRTX2Ed`O+_{8{N(oyY+($PV>c@R)MDrDsFw&)LHy)v%srJVhoAR3O3cR
zr-L`6vuLOo!vyTiRyTU}PGJUwe*;QZkrkk(W1L#KXyPIrl`YKJ%Nii(Tx`3aaA40)
zQZyR-GpF`!*Yph{Dqi-7RWx-shh{VuFEKxiu^cYN<INdwqCui;<0zh~7CPG^a*!hX
zmql%Rs072F6c1-JwxcHCgjf8Qu9mUtWF|;({M1v$R;h}j9hq5(sXC{u?ij4?T#L`g
z+*rEFXg$Wd_c4=}NoW)znrV#Fy3`TZLthe$Zdq=Wss#7vx+G?~h+<mmh!6EwiL%lu
z%;QbxI+N`6BT-|?aGdo!K`>m#OsbzkS!_qcebys7p7;^PH#o#Mn3bXGOmYUEk2-5y
zmtowv(Q%>x0?=}XNdO61+?o{6vUjOUT0;wlgLjsPD#q<^(ftZ`<zw%9c8YJ=3Xc@X
zbXwK(8@8Bt0CQFwU}^435Wkvd=#FdO;+In-o-gU0?Mp+)INOmRsZZxe@Y4d^GSJbQ
z%-<>}6D@epkxUna3g@5$Uz*$d7!*}OtgYGK`FUY;?h6otCpK4LBskON4$+gIOoHyn
zFK5q2KFvByBY+F|dwKgs4z_`WI`TMOgxQ-)3?H;F&U^F=$?;9Tk2SooKoBT4s}@*5
z%akAyz!@vQGo-3+6)5{9sXNjDGA0S`#(eXBt|`;Svf7q#?uOP|32Wj!4D!rD#>u$>
zxZ%^Sk!5LK+zuQ~635=kxN_`D4XHAkLcWyf7v>Jc&CO1lr-Qc}pvPHK&0{)*xXzhM
zdOTIYPrRP<w8Ow=`1QNwbF@{BT5*X-acsl3#kJYg!9Aqab9%J?$4YsT6KHe7**RaC
zQ+h`5HW_D?nLXuI(3zWQ(u$i5L~9f`=?R<POX73KK7aft>5H&EpN%TSF&3>bwE6#e
zuDgkdLWwT*lj|bk{fJg(!Q*#&_p%~l>);oH#ixkPPyE>0>GJ?C==^n!G>0cr&i-#H
zpje#Z^4^@1GO3jYrT6j68sp&yC(b=U=$rCJE*?L<NIgY93~hBKBqBz#c>eZ0TL|Hf
zyNVR6JI#6fkFOR%h!!hZNs*LND%UY(JieT8GN?t8tv<LV^_zb>4p%6W{<Tj5f$=ZO
zI`17{4i_7Q47pJ;ESbFiN0P^OLO&We1~t#}69R8UW6;&I>?E1c(sjUYtOkm#Rw{wK
zX9jO}f&7eSugB@B%2-;ag<bg{FaCB7dQAT&ywZ7(lI{}A0x4mX?<LO9QT79-Mn<h)
zU9g!<Km9My$&?^<<|~-&j-dh)?S8C;e{Y_|oT5lM)@M$416YFh4&CRJ)}f&p28_N2
z*=T|9Ix2U+`NQySA6-5Fza6y;*jD9hUi{EZY#M%(m`|Agyb;O=(_i=G3rWy{JW1RH
zn=lS10+YmN>Q)G3ekaq=et43Ymbwx{34$u@$>&~cHt2M5Vj9mw9EHd0o3~0>cv7r;
zF~8s}Zr93T4B9%N@Kj(eZ`wj==IEpQfqc{Q$*5Vj`Tez4=%|?5k2*gGZoS=;-XStJ
z^)Nr)0YusylOB{uQ_#K5Vkt=wDa_O^>BLlo$;Pb_#?TCEamaXoUC**7OXo?Co~tva
z!i?&@s)nbk@Lj_cx^}!6-a-1};-9PUB>6VMOBfi;OWOz;<`ayAu{-VjwecW#Hp=El
z-Kk10DxZ}d$k;n3ZiUOk>rdK7+J{4YTVEczp{fxH+3n~eq$*5iK!xU+@L+yLV}C!5
zuSAl@E|?!0gfi562&zfOY!GyXK^ItPrq!$?-g5_R0b5tcYUPd&4{UT}Rmp&g;MEVr
zc%AoP$=7ZR%xpFL%|G|hlmPK|4fr=-XcN{X<UvZ%=j@W;&P3VE$dR@P1?UY+jU>zF
zZfDmd^-t8EYCE({n9>=jU)&GOb3MbkAIqBu-Si8LX;!}OL+85B$*aI=&ZwxomLVIL
zIBrk<#|N8+r;NwXGnJiuYSXkQQ!{JpHOj{%HYRh`6oRKjtzuo$I_`sUf0@Tr=s??i
z^ATCJ4m8K6-#@VAgefz;E5Hjg|0oeaYauT%$GG*{pKkFcFR+3!mplDGUXFAz4C!cZ
z&P?=mpbU`k>y~GNW-l?KoF0ej*n3}-oC)K%F<z`}8VF0<J8VkVD`_V96ue7xiE=jM
zlQPi9-GN9WoP(6Y9_)*QFuhz**q<vwB5#9X@!cNK(42#wsO?OiRoxFT2PIx)7pwtt
z*(Dy6Z}hi*xZ${i`wnZ)1iHAZKlhqD(5(b=0?KhA{-41#^s6g7a0Wl7i`ym3hL1Nb
z_2;Dw@)@^;{eUhyaRi^$a^>P|Lk*OZD&xhSye*M@*KJJ)^3!Zg;LRzv0Adc)S-=}m
zt24q!{C&W+z!s#1xcHb5%8#h(%|4cQy;eDfUvM`aN~-PWp7o0LCOs&!L=!3F**g)(
zUVAa-N&eYp&{|5{*_Kv^%Gn`r)lFF)SY-O4uAPZe=r(6)A>wUXUwXbAZ9l-WU3Iiq
zRlP~eIyFn5(|&+gcvU&B+-w5C1UhQqWz<0V8}ihb2DdNzG1ULIcHbT4Xww%w$#uit
zhLZn&D8H?&etY@O=k|f!@(K<;){Jx}s@Z$}(@Zk&U&?)=!IPepv$SCqj%Eu=`?Rvh
zt=X$;6sao6W}|21F(*-w&*z3s($QUHr5CDEb0&8248Kc(n2cap3R{;D&c!}Sl)-|5
zV=gYCYTs+!#Y4)QX1Gwf$=s@1BD*k+#8k=~CJ!>yGNvupFPvqc`hubSKk&M~0*9IG
zt@SPiVWRo(8RWDH0=wme>xggfqA-kOcOs$KqP6TYND6?9aD6!kNK%6A?JEHs8XvVn
zw4D~8&^^i>Zo(Gqkund5Ho1-dV*ys{efVyEU<(|Uckre!+l!2@{>4BkG^csu$mzLr
zU-Y+AAMJBmRU(IxUte);;L+CC;vcW7G+5e|8zfcI4Fi8l1Z4PbG*zx-`wFNf`m$0X
za`T38Pm^=lB58g}%tFTN_|am3Tn^?uN0s%fwfo9kui)u}rY6qtxr|qy?yS}otnm#E
zA0<7oSdTE~x)-l$k*1#dieYY#Xb<+=YhQmQ!%<SVL9bc<!g>{GFsCpuVsnBnqJxwu
zI8|q!;^8S`BGS9v{D9(-zmFc;yR7A}cLay+olp!KLz6)t6!nX2spdnRKe0g6)6WEG
z=b^fdleqzGc=MtOyQzFWsIQpB9aUzc2aplA;5~Ew#}tG>SM(66a3SsPs07x0=^ax1
zwHeEv%<#d-Db{C;cAhnB?TUCesb`<tE7w^ClZlhr<?GT<f!tR5tUv)BZle4{yjOdV
zv^wx(VQZ}L=y#35jSXPx7uS-iDmjy#S>Mw|%`p|pRVd&4{q0la$6g>|PfHgiY3%Pe
z|LjQQ+WxMMYe1$>C^_g8JG^z?B2p2h;n-aa<fsctyDNtf`l8oc4N{tkmcbc3UuzPF
ziBMpBgrxEWo|)PAbg~$gfMLd~cxS=K2kT;NJUXzL&OXE<_L@xt>x*~t>lF-vjzimA
zi>j(w+Q^>3DAFIRGiuk*#>Qj4oFz^jb;WSvxyXJ<$sgvj2rkI2XL0H6K?y8K_)I(~
z>lIDk*XZ6h1JYr#)a7RyZ`lVtTOTXC-P<!dFV_*nPnh-gceEgG9gmfS-Mh>xeLun|
zs}9J$ox>j6d$qRjcVAiaq-i*(Pux@$V^&FChR<rI_)~^?0Lf_BI<B-6F>!?{5QznP
z^J@J`sfS#T4r-Vq&BsUXm9D81`>Zq5A#%Hx>S-}RROz#u_R`wzID#S8+b0hJh#`M}
zo+!8vZU1?xBjg=}q*sFr@QyolSbA0Pqyamo*p^h3UU-;bt?}zlO0J00Cly&wyIcm&
zz1FeLv-c)Z-!QuJG2SX=3Ur|B(cWlf@ynzYwfNk-@o6%l99fl=Ma&!(0M9*i?B=e&
zip`|^2Ur$PcJJza<?kMhfwE+M_X@7_-;4jitUR@~$K|jAIbm8POAf40Rc%AyHC3oM
zUp45GtgR5jUf#52iiy{DWITd)Rn_Cf0|sXOQX9m^15xj``Q`!npf+Yvh?@lNCw_n$
z^v&B$RN^bsj{xK$c^}QHxDLzi4JiSU9xj*CTjrewc<pQ*B6v(m-lw6p4kiRp!P5}8
zPfxc+Q!OhLC_`2a$(+B1420y`ai@U5Nxic|wQg8A+B$=U77KhOF~S()!C+RL{Ik7Z
zS~!cl3+q5=@N6JK5U~7yQqWIePZ7K)6?-fG_VAD)+GyQb(ZPdJK=MD&lskiz-!Qql
zi3;JZnpBs5{SJ35!qly+n9r0)<ZZJEh6GF6)4nzSEkV-St`a7W)NUpd1`h$7JGY@B
zB+a6O!l?U#q~S;LpRD&1G>v#FrA*WEMH&G%c(3^W`WCR42;QXMixZzn-u~2-=ey~C
zS&^hO&;36cxrjQhGM)?})4eNSZRsl3j(%*Bf6&O*ovLi_P`MZ`8(zB7{wR8)iCNJ=
z4XSCOt@_T^qLaekUr^7Jz1vT!5p!-biW5f~?$f6o?X<gUhd|y`MzW!Hkbvc<iY6hV
z%=m#u1)IF>`cxT6xAU&QFV_&~;G3DxqzS!P*DQ0uM7(t9MMTFf_Qp-rNAy!?%)NH8
z?xE($#WgK_H-BAL9G}v>@}K6xTO_(zUkaM2jN!}rS(G{7Qz9)(S;`yMwgl4NpP8PY
zQoc?Qd_Pu_&bhmygmnM4<L#^dH$u@Q$SdQc`!4qHiv^giWB~AB;AU0HTg!aX$<CGD
z3*q;IYPRlhNXEvbs#Y8$zuwS-53V!>d6Lq(wIo|edu{W-zWHs_rU=A6m^?2szEdvk
z!jZh%aW93>dwDC2w%BQ<89Y8xi@rjmU@6{~Qh|ZPw1=$1G&sAQ1#=sg6F5u}okis=
zYH^Q-ime}pk2?L7b9i$G2xJ$?Nm(rDwOa)eN_j1Z`ZjvJFGekicqfZ(;`9gsd9Wir
zxI{iKQT7VgZ(ZxRoLG4G2s!Uvxq&CNf1r~b>f+lhtAn7ekW%4Q(RXor*O`1O29$Bz
z$&PRmOLuDp3~aC6L~SkW7`U2JeL9bD02s|sAzRdF11AwJEpz&?j^+ih!%HT3lB}O~
zPH+$!rw&0z!|hPy_|b;t-UVbzfD4ELZ*E>f`X_L0q<#aa^ujvgMv`-c+|^;#ceG3b
zuaZ@J_y_Y%FCd<hgidk<nCwD|J8UhW&OPzR`F8@{L~`$W6v=RC;$D)?BLSoNO5v^z
zd5)?dj=_j?ow<gRTg;tjcuL1Mr1+XJ@ZXRS@=AQ1w1WySHWTH-oi6;n#1o#ea+1QN
zKr`GdYbv0=X%_q>Bbi<PtX8TUrr251P@I4iK;e>xxMAQn%ky>!_p45r`bJP<qXf#8
z3-#xr<`De`U5KJ8kjIX3x=i_Uw>{k>E$)~Qm`n6IDa})C{!y!7$l<0ZxG9~k?J|oZ
zBQnd_avx!9L<d7>sbm5u-juYpgntyAIa$~dUy{qw#D1qs9yO9|C2g$JhTc|bEA8Q5
zeu2$o&B{_}M3@O6PkJD2WU5|Or6Z0hst<VgT^sD**m)1-lBz`nSg6n>qqPY}&F`7!
z2lF1c=X;zcB;4k_!(;LU0<$}`5CzN&u{niaTn+`BrIUmP2$LTHD%A|TCjKyD?5X}N
z0+g<$#UmUe>Y_w)!ckE$f@E#ASdMSFdt<R9E`Lgj3^E3DIh#cfCY10Ze7iLeK54eO
z79guChtq~B{e!5fb0jqCXrR@WAWqBs+q(x}CE59JFE1RrFnm`QC5g?CVa*;5o$I%B
za^|udU1@Ib`2<h$#l7L7SilHHp)#!H3q;AAgB}KLd`F7Uh(U23ikOmWPs`~8Ds3#f
zR>dGo;xnU_SU4wNa!;qWV1V5f!cao}*$z@VYNg7Lg#)a&pn>Bt*>AZoYFO_}AYeC7
z+MT9yH8aCs5LA8cK#trtCuoK;5f@O?r(%aYKWDB^vMhNLn+0DaQxmjvLB^1VVmQ?L
z7(S;5LsLd|IJROEvM6N)fuYCV*Q0p%dyIy6^xQY+*N3JVjzOw=b0?)$jZL?1g($6<
zP<WCc(vl_m-@IM3ZLDS+;?JVvWt^Ciw!_{-_=oe`0Cp5}iHeaE^wtm47d1!ufP;(a
zV-){Pk16EyR*Fthh|P+7pOHtjnyFG@o>Lprn{TSpRqkM8h;t=(>LV1ieLviCJ+dgN
z#9y}tm3N$c>Km<74-mi3utj^wBs-ICJD^p44Yt~c>oF<fm&u0WcA+E=tv{*jOT(Si
zqHKFDc(l#`5zwcp@;W4_LLAOe{JFGs{JsxFEdY#%a%CKxD$MP|F1rnuTsQ5pgMxRK
z^mFU|S;Dy#jFwtL_YUnW6gu#vd&t<k8XEAVxt!&jj^Q9*iLvlx7R4Fr<!|K5lYK%;
z`9}LPJP{>Pdk+a(XeI`+u^;Fs2u_r%$ND|N0~Cq?D6##iGp}j<KZq@TG7Kz^VFvbX
z_O~@MWa>X)q>kqzUj7V<ftT<5-2E*P$HGkybED0e>q=25aSZKaar28#>cZ1})}ab;
zNjf<O){++#L<i<K-umOG&LK>&kYWjv&$_$B^$v5Xk-7=G47;7T7*UU|hNk^>$-w64
zN-ZVu`Ix~Mfh=lhYcg2$<>M^rd-<O*@Yml&TnI2A8jAG4Alm-{h!%&yC7h}heu9+V
zB`)p671j6B<NpdVxdJi5_;(c0;N1N(`;R5It7^&6QkX8yIH@tm{P>#UvkfAKmd>PR
z*&`wHFlIk0HB%nefMd_=1hy+ayLNt`HlIOanqE~50NL$yg6TiBda(bE5C5w<!g}v+
z$Z?SIw_Zeqy`Z_3yx>}2F}s@a1Niw1!eQpL4hEV1pYGb&)bKx6qo8N?`P=o=@FWfw
zEV&)qv~7moRkUQ$45YM0%{b;=M7;BG-S^UEayZP2L;dlM!0!lFsor8{dD&puJ(+n@
z+9{hPdi%%nUgW{nuuKNyaWL^*sylXe#g5+3aklJ|2y!tilADYfXp-pFw8wfkR(xIc
zGJG}0Nw>X@-J8hw3#&*e)t?;Eg5e`bN7V|6y6#&GXp--jDcL*1n0_O^VX2&I&}QWQ
z6PCiKfBOVW4y$~7k7+t1Jg=pW_-Yxalxm6?VPGnfpCEX)4s~WG$=a%z#bYDl_;+*y
zTTN2LFc8y$3!y8&sd@V`nndqBo~%&hZc@0QRg7k#c?p4g^@_nC=+s}k<Z$JGqPm6K
z&?45z9{&BG<4<b2iAZH-pO`szgaOW8ejY$#zEF3cKjR!+MkEVR>&achr!Ifn?5|W<
z*h~&KEUEZ^qyU(#^}m<;_m=#31OM|*{ondp#KmDViJl7ss!u(;R{mEIZq`G3mZIzo
z_`4ajtQVW2gk4>dLiN%@J{ouuQE=4_0Xa3RC*bz_Yktsjq~AZC%JJ_v=C9L9<T5^~
zc-*6bd{YU&0R^F*M9l)TkTMQX+T6f6NAv^u(VFwHRu=q3dv{Qv<LJPcnPx?WuxUg9
z=H(jQoai=+3#vn_tg1uQ);M$&IFXK<FHatC6=t4R-4SU748a7nnm2$^7NNX`@u1;`
zE`3+A^@Q@z;K!1cr=$T^I-5Z6(Fq1WhL}l=>pX1N*MaK#rdfpP&-^N$Jhc-Ym|b-^
zkpHB&ja{#DNargCf!h$rSn0N4NPV=9i=5o1os30RK-Rc<fm!x`%ITODbRdZMzWGw~
zcNVPulVJBCWz+blJ~mT-_q6u0(2zucp$I~|*9aIu!X<?;atIRYtx*M&8MwAtsqLJ>
zUpb8PbW3<L)Di>^oerXLj5HsAt&<?6+TRQv`+ec(F}Lk<up92WKS3uifrG{j`eF*s
zcLjZ<<sMWIk1&LpJSb~yV3b0c#r(VY$X_NXP@C&mky=2B^|J-mHD)h~!vxb4JW76o
zP!a$WOTbqaXl*c^C0P)8CEP9f;kPpN;S+`&f)O(pk6fE4=z_ky4P>#AfFKHu-8wRu
z?@r4KeO)invCWpg0=epA=y%wv0JS+3vrg`bhJfcYyFl6-D#VbyFk->!)C7O72Nnft
zw+<VizOcY>yY$L;fZo;utcJ&1T4z~DQ&?1z!=7YU^i)6_jN!sSA!@@6!&#)*&~||K
zP|HawbA4#NUA0+nyh^n(A|+pX62mdXSZ0)fdD3t(r+_`Qka#gfoU)TieoD^(L@%~U
zZNYFnKiqlcWuYKMoP9iZxPKK(P(?OG4zxHX`cx~Gi-ycKAf8vwD(sWA|2zS0Y~Aro
zg4<7uk6`Q=;nwrnZ<mKgz`^P1aIa`HfWC|^*<^wqGGQygEFr+SFs>E|x3#rh=xcB%
z@$Y(LJyDNWVD_E$on8Y>U}DI@qI=!~=Fa4ik~>-D>rFo}(?ej5$k2w9@+57B9%5s;
zu6u){B%A&8D#a_nBs{y-|3f+lCg{A}a}vzY_n18i;<z)=M5CJS^(j($0IU76dY>xH
zdS`OFId>xSWkXZ@$(KWw5`L6;yyr-l4gW^%YPxtML`R>uS>;3=%v~HKvIqK-$JLk@
zS8^(7l+_csu$fBJijactQ1aoze>S-E`r9U^H+I{VM={<RO2*UX+3%}`xJYN~M^Bvs
z@>KQerH@YVP()!6<B-cWixrBkg1O{KuZBKd&gDyjiWd5gF1Up=GQ|p0PX^&toLJwk
z_V*89p89E*lZSivIbI>T_u%8lTLh%kN}mF_@d{^TU-;4>_!RY}>`eP|9u^O87D^$S
zPf72W<eNiVB?p>tWlq*;l0g-woIEm5yB9#Tz0fp?_va~f0z2fIViFG1=djxjpUTGk
zN8H$67@XoIS~O(K)eSk1P|Ef;*==_{yl|3Wu^2IyWfE5>gnhvYI;3NjCdfqwmNEN}
z2$QkFM-93JTL;j{tO1SN%qGk0I4-AB%s4Q^MZ;?@c@G98^*%f6x$GnjChO8gT2(p}
z>&)Z@G`wusiIe4dZP?&R@N=-n21jsEF-)%l8DA6ad79j74^VCxNWuo4MTuesfGq+6
zR^-8e4uYYmTEr#sW87X5`YvqXEMK7?-X6>q{Y>?OPX8MN6)N9&yw01zzvIN+yL1(r
zCC`k+!ck*5mjtRt>4<{QP;e#IaoTGK<cvTYJ9;oXhU?J!!UnFCyoR>*-4`&Y((v;z
z5DJeDR$OZh7sKe5FO{Tb-F(t>Ml0WBtOo-gmO4WnNBnaXB)DVzi+u>oviTVtjxqVN
zXF!AUZ0Of~^;xGwq!B10wM#Bcl!y|58gT^Q%iNcLwnFN9=5Lw?)(3I)*i5uW5IWHA
z_#Yn>owfQzhTjL+DGnZ?Q<G}k<jV{4`0WdhdBCm1M4!)wa6(R`gB8$quffex*Q4sQ
zx)G~(^%Rd^?!6+WTaF}4Bn&p$e_v|1P&#2-9*E7iu9Wlj6syz9JEa5(&zWuD=Y6)p
z1U-u)oG)I3@oeDhA@(B5omuEE4wKO9$t}~l_Uv78x|DT0ziA_y;}J-fVA8245~B-=
zl{@HciRNo(e^5B2{rtNXcXuDvw4Jp5Q&nzgRQ?37v65#zgFZxWFYVoW6`3TF*N*6?
zN9W>%l-eCFVMxoH9h6(0XQ#~;FELso1s41&`uXe^&$_;T0G`9W7-GT4s@?gF`jh;=
zOKT4o^)oCZiDZi@9>kyON6Xa;42XC~l3hg|nv4|NQBiXilD{4_qT_qUJvr-X9Gr_Y
z#7rHp>3|_UfXDdYB`Q^}N~FNZNv<K)Ci~U<c_tlK5-2>uYsxh|SuT=tulOySq{aIL
zXYNu%i-6#l>l>d>s`=8e)mvzk!3?;EMa%6;<kt2bbLe5LD%ZS;uuFovZ*l{$?((H*
zS1pZhMTF<gB(~Jb|Cx59f8j0$;U!~OiQpX-S!kgZsUx^=zY?m;vJ)!^wFBNgUCJ#l
z%~D%U_s)%4FUE3?B~Kcv+LjpP;8IU(1+kO(PqqMeY@yiX1LR^(E!RZ^Kk&c&oXzXh
zYW&#@Fw%KKJZYY!Tx>FFdwUAQ1~%&j>(NF1)Q9xRnIer4o-EryWUb-rPVGXex5HyK
zGSs&w-QtdSdZ_y=;k?sk|Ks|$Zo}oOqr=s1!r;vNxu5%Dn5HpJ=b}9_!4nygmG`rk
z*aaj+>5^=5m;ikGczSxa@6K8NI!ud2>zc+DMP&|Vu0Knx1xCdx7o?41QI;q9jYd_C
z5Y;K6otB@XRake1dxclZ*<NfNc-K5XO<qEwrc6UVyam2oF9Tkfd~5Giwmqi;99p9;
zxAe{7AC>!=Y#kHL+{mXx6ATgYeW42tRB2xm_#$pLgeIifHb*KWQ3+h}6aLgstFe};
zBUrv(6~<`;;yA7UyLD)xZx36RfC*0V1dPV@c*-1Q;sx0lL#Ctci5^?piVoX`4E2wM
z7<dkd=^u+E6lw+jJTOJx<MEtMUmmt2&USQg)ysC=7n9bcOJJmAJilC;SZFcm#n*`m
zljcf=z2adrkighE*jig$CoQS~(>5l{ZHwzZz?GhryKni+*cG63I6(V!DaJ@^HmyUR
z>fOa=BAhgFQ^S*yrsCOvoX>jZjKU)gj?&rqoRPv)61Ez}S>ex}&PmAlsf-8tdoOpD
zB;@@<#2Q~%cOWJ8W^M%weU_#RNM18?@<%@YO7Vp(rcvZ_a+#m<^O5)CQw)!Ny!5ZI
zOH;1b=}W2OFkzU9S1SKvCGrEiVl58nKg$wYNNS8z;}0O{5%9=;bk=56Y{zv~$);KY
zK8DxK5Ey9GI#b^G1wM`VBajqV3q_Dv_U0zxNkdnh)MWEg>po@{BreF*@4Og-eldAW
z$`v#TP3Fk;%4OCE9*OCpO<<ZaWBgv}+#T-k2$6}PllB`8)HW@gXqrKWhr9Yyg799|
z-fj|veABgf;mZe8A7_e)cUSq-&bkol<Asy5hYLQ>icH4PjL!xjH@a0Woc##>7(7Ts
zx!6^VOi+(Vjy*&deA$C%s28!>j)!9RG$9I<9WtLP&O%DXuM*PpnD^Z%58ve5=}2-X
zv{&qyeJIM~cD^;k4o_#luvo;~og+f3VaA(-toxgxsL<W^3riJaTMezK1ZUK*M-W8(
zkgtSev2S-&qiL!O#Sev?cehnarZ8^B(;cMcjVzRlITMMDEB4t&%1~b9Q0viEbx(*z
z7+sBEr9>!QCu^;nXs(3m;t5|q9b>+|HN+at6W`kReEaDlVy!~z7qyB}3I(?@E+Hjk
z>Ksn{clmly<;lPuC#YbKpQ(gQlLVWV&}|kF$@mGYmI-X8dDDld1c-PlU%B4^47mm~
zNfr)kc9hRcH(3ER30XXS4K#GeQU2Sz!2V#!!AUr2U)}ri=QcSw9>{I?`TOT`uWjpC
zme|g9e!ExkIIs&d4YY8$?PPGdpwq!x1KlZ%0i{^=BVaSxBGrL<-f$yUFU<sq)fo*w
zv0V3&uNU2NEAJnt`a977Xkce~smr7pxnbNr%Q@Y}5*wL-+Te+PzF@L4#vR17k?H)a
z-b72Yb=<%zQzho>Nd{kM#s(8F>ehT^^~1@}=09rW1T!`D7mKenma#1r5LJh1<{5|g
ze0&fZ_WsrmBd_Aa#p;jsoB7sxSpE9)&)!QrUgLAfSb6~Ngt=G=(rl6Lf7C&M(*9dl
zd2`9WZzRfoJXbBDGpU>F2|6&t>e5&;_VVZqc2}Zxf^vGT@t+4h1j$r0?9=4eczgXW
znerH|y16)~Yi(SZk1P<8Iug~G=cMD_ZxS`#8n~Cr`8PJc2z@s0ul)KXk8Cbf{1^a*
zGit+~A7ufn3q4c*`TG*^)jK~j>>N+jMd;h{0FR6nk&3D6NTvPrtp}t^6ab_MjkNzi
z(GdTEpaQ$_?wWnlyJICC{v&nF9anl{zc<cnJoYuXi74TdHaQC;rG3Viq#2Iy#n((w
zfATn=#$#_a4mx)1oj}K*Lj>=+pn^%i42DSj)~LmRU!*?O;1u-`Ls`WPel9nIMk>#B
z$^V6c`4EkH%W@4HA|S78$GBt^Mu9a?#7Ko>Bxsq!K?+nq-B@4$4~i%6$h9b(;|UZG
zE-8J<xDT7Q8>3%s3lw~oUS}u*gWL$9ftwZF8fltyy>k0Ac+Db>F=eGOSS&{HL;cs4
z$@Die>DP~Lr~vRV>IHpnz8D!m#g!#cXlQ>+6vI<pjguYS(#X*=rBgqLl%{oB6}5qQ
z9|^NbUY+nM$GDw4IfIEBa3OnMW>2VNN^p#dt60bU4*d)^_>vWda~b*U{ER({`dO;@
z$1=Y9ih!yBqX^Mv@yuYyll>F|%m|ifmK?m(7sKErYJ+p8#qJtr2t3Avb-4#fVoPQv
z244vO>hfq#V3Z)3>8eK48R--lIUvRxRwd6^E^o|>YPy`FIrKUoj6b=F;V`5@&$DeI
z=pz`T%xameCPAo5y1fKm9IXH#SV3K91kNLD!1de<!+8HsaW4K&1V*Q`+_0Th+$xq!
zAK1gv{{BQ9DbHi+z5Gf>26aYq%9sJu(xtKsh)Do$r^65QsTPbTZr~RfO+*gc4_+G(
zDiZoPRWeM|s$xTWvcoIEU!W-pYP{S%!iNb_liw30iGM;xG*d2hO)LL~p6fvYg^*M6
z9Qbkk<Id0Lg6~l?-fPkuQW!2|kOLf*!+EcPNX9LC?xiMv@JrIn|3Gi_ii+5%p=oIH
zzP1QDtPwD%d#y~D<Nyv-zNmm%x{ua#kZWAq=quhQ8<qgpZ;33Lh?3{)87kfujCF)@
zTNHn8L8t4Fn}j(irG1!%l<VO0kO3XIU)*GbCr#@xdEN%DU)GeKBG(>+Yy~5-Cx;+G
z>quY}=D1w&8$UZv8Lyi=Q7uC~*Dw%qFMiH#u*fQQJ&N^?!?-)syfc^0v}}UWznCI@
zpO#!R@&f<KbL;|7*F@K%Q$VofD44|zoSe!Hm<^6dxnv*ptcj(qW)tA3>46{bGhjq&
zAo)h4Iupj9uh(+#tI{HiMI0meq9Wblg+y+{qtKxhJQ*NZzlrchdini+a46d0aa3*_
zY&qy{6*lT^c7(t5nk!hs|53TfaFbxqy!{<X!``~Bzif)^@Ydtfk;bWv2d?VMMjjgr
zz1RBym&0+*1IKHfEv>=D`wRpYrI=v@k$3l4*=S%;?y}RSL(avZQ^o)C0{DO7V;U-9
z_?Wl;;$teh#e)W=1_YjDef(J-kRzsw+b!xxXK4?<sa~SuHkN$~`o>eOk$lhfB&n^%
zSHS}>_*Pav5eNlO>qPKc%u{0$D$7Wif#!V&ny|EeSa&=u3j3M=stosTsXPUA3%9UA
z-n-nzgNBVcN2dats^*OCHCr7h{4V;!JmQ>*x7+45fYF_c8QgsTbfd$;*5cPx>t~!m
z^^4basi&bwtq`<%673gXdN5q}oOrR1hiTIlU`flWtan*5JpDB;ID)kIa(Z<gOBND&
zX9W;B?^u!WQ|J-mO{FU{1%Q~H0{co!eL6PjTZ>SpKAjl>>`SLCLnE8Ea0<9zgg;?7
zv&TyHfFZ+l|33#WX@r~Q{z2=0DMye8p<0buV;~dD;1T5QUahZBzch(dFbYXJ2$v0U
z9*u1*O=c}?Iw@_dqBB6O^elit@MB<ehQ61Ay%%+r)`ujTnYs|u*vqFE8IZYl{Bwyx
z*m$g9ejM6&0N^YB;w4go8O%KJ+HwGFT#9KeGH7slassHBs5J&o3!X4Br>HCkSs~|`
zA|9Q2Z`SIi?;SI0Zza+GlRVbr;^g$JJLP_^ALG7Y+#}EatYF!%oScGC5%}i%nikT-
z7L(#?7{p?8SIX{1>3SbL>pBElYg(O<pyj<6nFI8X^?Cr@qoI1yadXol-?tD`7KnED
zp4y1tIoJjMlX|>R2NAAxJZ0v8xc;OOB1X6}=>~7bdpS9_$5t-nt7e}+N{V6ZaMn^-
zW(h18-W8x!ZLD*A4Z$)!gveNOg9xM7MG4G)#@M1)^zbgdNd`r4TSa&`_XL#TME1jW
z8qe=!&|V}=uiHp}O-olqTX9)^CmT#7b4)toMUWzA!K7%l^~vKwYa}~I$s|dyhdA;|
zH_k(-ooyVtPcub;c&uRI=y2u89W#SnaZ+K%q&G|F{w6SV$&ftuIu#cl#b;x1V+?b1
z^x|K{P1N1l^7(@shV^H9sUBfsS;Nc13_j`nt6tdj^Gos0Gy=Bxi}bl1ap3eczcJxK
z1VEnch6;UMY#Bt^<y(S&HpSNp&r4Aq?e<ocPE1BcIZ>&_0-+Y^P_(d=;M`c@-#sBY
z2&UR37(?<bBC`}41;%eTyM+W9l*JrCZTD(0%bBnmsNUqu6^~D~5OrsW50Yu`LPQ#}
zM)^uu6sb6uI1?tmcvC!by(8#6!rLt8KY54Z>wmF2bs8{kqFZF8ukLL%%O6oy(k$L$
zWC;kcr^P2uuM5HOXzS9G)Ko*3l*S)u#&Al5x_l+r>Y|{IWnAQlZ6I+lV)lol%=QFX
zY8srSFXV?`Ud6CGiQTZ-F{q2R@FHs&fZogZk<0JoS)cd@0y(ig#1THmP=q?xS=SL5
zJ%42=dxWu)2GDX8D7R+MlP+nvUFF}Qy*LMzpWC~pA$<=bcawJdj|)ndH&&J0k^yN&
z)26IR?b-SII|GP!FkOAtcXEB<lAyjB{02-hw|ohyo+Rn$)M?1i`UI+(jmXba5JE4^
zc2F*9{9uZ3%8ux)M|e+fEZ|C)<NgP{LW^BYy_dtdT$#p7G3O$-MMSpKDQuDu&=ovI
z{(MC_Tpe@=-7Tc|9k7`yU%eU;M`_<N^k|8=+3Y8o+sGVQ%$Hc-toRQSsL~3$*!CYB
zP+iGi(*rXFDip7T@jD`aLKV?bUCi@r^6Tn-;l9V(m6H~L&Dlo`R0|ucXc1HSmBrJI
zzz5}dcfo=G2#01X^$m@6|3;hx&|g0r?n}eQ6292hrL~t}(2H_pzh|dp6^7w1eP=7x
zt2w`<QO!Up0&ewggIP~5hLYl|tPs;=&~gjye9cC6iZ?u5+XD#GsMp?aheYn!CrbYo
zq1e+}S#|VH*&zevbJqEs#RJWSM$y383Qg070Zl8erVt?h`>G2hug1?R#oM>X3JZVO
zLKl6zM0?2G_xuhDq-aBNiIibHyGb=t&a7;T@sbw5rhTbS-!V!h_jdg`?=_GDB-3B7
zUkUdRFB+yC%B5yx7a1$A0Vi*=>gXVwO$EvED4t$!J#<C$LxYNwvRk!qR)VA{=u!&x
zVZxHj^Clxx;POR`FVN|1u8az^D|n1GRm&68SazMrA4ulKAefdq0dw1vI7s_>ovOxb
zH*+%lyKY@>wAjo(IFX65?0b<({9?8bidjxYMdn?EN*Jf<7dpv+K*meD|2fR*SIa~k
z+?hPjF)G>E3BOy`(0(f}`gT1ysF4row>);-c<M2<Oh#(oLq9}5WFo4j*gE;<B>poB
z1g6>Xd3Q&bI)auztF41-PZb>qsW|86b}?7MQUjgq8O`tiq>Wa8uonC$ZPXk4V#lZb
zUCsvT3l}%Qdw+0Bsr@_?o;lC*8(N3XzANcL{(~S)sWl{>?JP98PEQjmkE?-|W1>vV
zboAP<NuBr#o*c%*Po%<j98&#TWQD(hS8ow-S??<&L`e$zMpuHLgVEjt=G&G(!6WzN
z6j9*p$kiYgm92yDOdIX~yIl#4S!*tX&fwuZ5{25A@Q5|LeRjj=-XX@(;o$PvB6CON
z^3xQZ#zz4pNYwZ#sRMx4C*(7*?gTAl^me#Oq>Ff;^!rYn4Aj&2F~3nyH<~&Uu659@
zL+H+_yTy@i3(wK7mZbM0(aVLP%>`<d_C54F@J}x5?O0PI%~XnkhGX3Zvoi5nyqi33
z=?c)!x^rIxPp!#p3pmBkT}_IkcrCP^LaJYC8hl{a;c)Zo$NHyIpbZMV`{Fk*50P>a
z?VQB7?u=#y^+ety!XX8;H05d&;_pL*OZ8@&9$f)tnq_jelhwJ6)KnAHuMWxKNSO+8
z(w7K@CL>tm+40dulx!-7HYy&_k}A8=biX%oO;|PCrj7sVqQ!@Q@m5W<zYojWxlD&Y
z9%AR!3OL*32$r*@2dGI2Zd_B>p}o2Ql?2H*JvUjx?4jR?2bj41jLK7q0Is_i(1EEZ
z7k<nB5-+|!DMNVeUi|yLTw=Q_<(TYQM#>1v;@b_|w_S?8yT{2!BjH2z=}k3|yyz4_
zvT;#K0qbtt_{kyCNMoH2s;j$U5}HvZXM$&~sg5LigDa=x;D~{w{B(1-@3kqp`Hvss
zUenrn%V1mt*fhAmr54Hae0&louCm|s0S1<!X(N@b{8Jl%<T$_iM8KrAJE5E~hA{;^
z5F3{Ex?&H5%QL!rDdRMjdNkHEB?azHeBG9OW(n`r%V+q(j8A`e5kYg|k<zo&(R)+6
z!1&D4z4NXC8a?Zfq!D9W_$&8Y5{+mkwidL*Wif|qE9rfZZ-c~^v~rHeQv6wGYZ;y1
z9h{f%F^t7{)29=GbWak%EHvq)>$txl3@3^5Oy-f7M-APrIdgC#8Z31i%Z8ueMUW<X
zpNw+C&4XGiw_(<rIwXzWi}sy2GhTAO0#b-IaQ{R;rJ%%A9qe5D+2}#y`t+?k&q_hk
zHnfKNB^}UFmjq2pTo?@CP%PuIw!7t)Oztm(@|D~GZK2+0OJr8k5~TtY|BK+aoa^p$
zXogFfznvV4BG?fl8e6COw|(T9q6j`?QuO$&v?lg#TBg$TOBfkSm+8p}2zdg(zMWzE
z2fg-SOL&=Cpd~7Q+$xZpU&6b7_Z!b=Ar_Ib2B8k(4j_OYWIekE;|8Y&(y=6iJT9{S
z0NJ+n9@%|GD?bwj0zavEQE9soNM5hsj&;X9Jf$^ZE8g(G5^TNYdl$As3%WTw))Z|I
zCnp`FQ~kl4Kn{O>yPQ(b2mp9HJ0<-u?Tm>BT&{CTp+gQJc%OJF;^TgYRl}kyxJk$@
z5rqUU=a_9XNV>y>LmrqlJ+e~QddoC+V$WSf>J$F&9asc4))BFZYwTOIv>I(^;z(QO
z<Zt|3(U{^oiY4b0DmXQQlHqdzb|xnSk4h8z6z!$$7<|-)c`t$JU_TM>m9Y=Ys*M{U
z`g%N2gGXdAPj{*#?jt78igDSU%jqxe*s3`lj=?+?&)vadc8zk!?vS*xZGowhwN$Pc
zn2$-(iu|bdV+`f|!Mi9@*;NPLVOy2nJV}qv<RG5!+1D8?y=d@m>>qZbnr59M-fN;s
zr_`uaUBmZ8eBC7(Bz*6sMxesBPrUK(T3c79Z;DlEr>fteT&oD1Oc#Be&_#VUYI2Jl
zS9)Bv?>AnT$V2?p6iEjUTJEK=5FyiY64#Y?W@(?eha<)9n!25<tgH&(<BcZN-I<?0
z>{d}AGV95tsC;MpvkdC<k{S``%5{#s^M5%{X#Wtap*c#{sFvjJR!uzRHNXpw<WK9V
zLv}#^7HaYd`x3?{6ezVt-_;-Bp)PVb6jHgaLf_9F5(zv|au6(}Pn_kSJl8w;dFBm=
zM&|wVChsXnd9Tg1$I`VbPwxWau;Q=bEF%MD{!@oQM|;MZ-U%K`6{g+O(pXG>4@qVc
zC#F8+>haXd<<n5os~e66^WM!#UR5S0b8P{wc%*jp%U)b*l3Oo+Gq4b;Aqak+893>+
z=jfx_EE^y<zMzUg2b!6^#cO?03clpa)V;)1fonEN0_cO4%G~p}4C#=Zy!Q;iL#bA^
zKd-V~-sTBpz{JmWzjtjibEg0NHP=Pf{miZqE5<H8w4&tsR6p&x`jH=0gBh0#Z#xEA
znO`R|Jf(B9a7)fSX3~$>&2aGrZN2>9!n`F8QKP1Gc?|bs|J;DN;{7S4g0~o}gNO6&
z`abIiEx<bYF`yhXZeewa`$-S`4AbDJte~y$jyaIl*86KJ$8^0t^*d5Ts9Jrt(`-?k
zl;r_TY2vjPJ004viQ)qSuUz=3P_m(_C9iVj&{p=72X8nOKV|8M3kh*32F}?i3;hXa
zin!n-@SlOza7v~x&Gn9@B178bme5vuZ&tB5#;GYpNuFZ0bYbSRqH~BeZ3XE+6|?CP
ze@$9I`K5+B-VLOYuTCxUrV;vZ<(0;E*gt?e&r$4f{<k7h#@Z}ozu*43RB3Efrd~ix
zU%yOO`X+dsPy2V>INSf1uJ$@cRvv9{4>aB&>pw|~iaFSXVYi_<vAh5nnXknRu-2b|
zpkb-<*?Ic45Z1rY$ZfWWtIeRpj=)H0zt^`FV#vD=%G~L{y&0Ha`<58n#hgS~T}r51
z$_|)+(;<le3fljVk!05%RPZl4+a#cCo~e5F7UPkqR4!%mH%0yz`W!IRv6=gkAq%vX
z7CQ~1tWLQ$P+!ecNre4B?Y(zYRNc}ys0fmjoD?NDAUOv?qJV%vs|3lCL9*o7lCuaB
z1SCn4oO2G6Ge~Z7PEBs0>1Gc4Ja_K<+&gQ{%wOO7W>~$>;+#Hx&fZnEt7=!({%wGJ
z2`DcPE~STpd86j4RR2SEZo+6Ng10s1rL{I4FWvwtQQkEDRB>n3*2)451=$EHBeCS8
zTH!nml`*&KPimh-S^m!;z+a(2iEn>nJ^m{vVXv9jUj_XB2E0e~sN-$9N!a?juft#-
zkAy18f4u)SZur$C^aj;&y@uW+L06<gC0Td~Zpsd(!@NGf->7hOr7L;*k4y*wbIwPY
z(rc_p=#L&CUv{nsdV1Ijg$p8J_3`Te1q2cUL(k*5dHtt`o&!Ip|2)I{7eIpX>C)eL
zmg*0RJDwce|3}+=@|YGqqJOOGK6T+~^f>$B9ub^tKXC_?C(ZZvJGY`UG^=sCPEB#_
zhryj}yic_+tp20^V-hV9&Gitj*ssBBmJmX%>}(YMLpgwi;gtsfjWZH*N-?OoGH>_h
z?hgMyVNHN!&!>-_48lLOCt1W@Ez4X7fq5z&&ewkjLn21^`A?{h+vrEn(|~I3e^2R?
z>wN6s-4F#Yv$p*c2?FSHcO{UR(9yp=_@5=-Zu9_PgDnRJ>Ax@A{Y@nw9bBMR@04`$
z>fe0bKO*s25P-BeT7L~D{ErOO|Np9gk>vl21Qf=PL6`h2Nbws0^{s{vu#ULUk}%d?
zwAqL?_DkFEF@B^&vw*_e5GMa6eaq)HdKne-lC;MY4c`GQ8t`YdX;e!mY|7V@a)kMY
zl0G;%#t4`lMt+Y0V1&%j0N9w!%Y&5n`YCR&9s@U|srsl=cfQ_Zt!&|Q&b)k<_+I~E
z4h`!c!|lfYdE3@H&&v(U%o219O_;D-J}t8Xe=o~=DC8c~&H9+$C*YZ&;+j4C*<QEA
zDJ%PC!Ii45#nGxRvVPe=jLZv`uz+Z<RCQVB(+y-M0*#RI0hSd+i)Y54J`KbBh64<i
zA0-k;K}C-G8YdklNIZ5+h|Ex*{hv{@`bDA+;_~Hq<Bj$YT%gK5NCL>H0`nXv_A}}^
z<R~vg^V#h0Wt(b}G#AqGkiGc#(iS_U7WyYHrgQF&NxdrGx={`v?)~Y|1q%U^GXLr2
zr1t}8Ttm_1&2k1Bmd}+EJ;3y2dvHg*fQhqm%r;E@v(wEt3mD5{{ukC+?7tYBIiY7V
z5RJ>zvbd)~LtpkUy8q|`2{GK~*C{ub-$xF88M4l>0eVPz)58;5C<Lsc2OoeVkd`;O
z^P5}6jW3+o6}2_Aff)4ZQ3da%$Y`-#d{!Z%4C#HH_!rurnkLP@?R&;+JPi}pZ6K7n
zM&7NJW(<@la=iGCzjc`?gp@n(I5$~`yn*oPb6)-|(4>rMo>;xfmmR%KlRbTJ8rI1_
zkYX*sBj;RX<_tBZCntEa)1H_}i2NL%r#V6sqz`X?<Md4*jsSKMSn4eT%x0e9G{E7T
zR!U-RzJeg{k9!40UsLX04+6wW?K|-hYaYDOjGu4l4^)?gA%14*zk_%jQ1V{xfpl&(
zUfMeh<+*yF+VxdaS;^2<eAAIhv;*qJ-nN6=1Z#?Tq34sAkMnPZH2t;eo+SUHFX%F_
zzq$SAd--}oW?3J=AOc0LYhqKW&V5$L6EW0bBZ&g^A0?u&cgx#lO~+-l>m<5?un;*V
z*CB%mhT^g>!_x`O7kqdz6PCa7OdL7>DjNC8k=7gmY@Ohcb@iCTS#c&(q7>Vh9eji0
zkZ>D+AcIN1w6Wcs6HSIAEd`{JT2YILR6l9f661<)V2c0>GQTTQGrZy?^7>Vv`6Y!R
z>vq}iTyz>U1`v6EHhU`Qs*A!S2T?`HrUhdFWgTvaF9GXcDNV__`IY2u`52PARxHHX
z^hej=TL7hvNt^EDy_j+p1DJAGqnPp)wg5cHr0?HrQV4G&+tqWwLxSjKN`dt|GIW3}
z%BMn<c=4Od3tqgnU<6ol5Y%$0yPaUbWV7z>@tnH#&?jnjjam*>wSEUQk_D^*)-FY9
zXUo}~$oyqpeV*Tb=AFSAv7i>!+#Zs32n?}MNgAL6Vh}0DQ%;6@eJ{I$5a8Gg0`uw2
zY&Vl`_5Jn)u{4kiQi%z?e1}0RPcQ@xbU6dWqA8LXB$NLF>9}G{YyQHjQB-iSVDN}g
zBJCU<=)8q@CqwovjwU!cI{;e6nwIM)-e_Sd7#NHO>bV}s1FBCk<xh5<ke8>We}P&7
zDl3jdS8J)cJ&U9VD8XQUcf<I^6oJx@4=f%6{r#-9SWc;3D`zymr}0c7+7E;>r{+5>
zMy?3BKi*UNP7~rDvsp^%#AGx6BTC%=Z-h(+Y&N}y8YxK7m(V5P8c7IXvgvAv`G^7N
zXx4+nQ}&y>eWUB7ti+33A^MjymlE=hxu@o~(LgFaNl9S3gZf{VKN=nI^y_hukCj;h
z;{m1009fnLRjIL;fG1Gcvbr>&1nfT4_QVq@1kz&p^EBBz3^Un!3^VH<Up7mVfO*tS
zLE@$K-{~@m=oX-ul=Z|#DEB7n3Sa;dFh7aLRpKR-0C2OYue=-ty^2k<<;}iD0|E0L
zR3Dsq#7Hpl%nq0=4O!n2{tGe7jg8B8z5!_1;0og_exNmJKqv1lzvcs|wunK({3?<N
zLt#0a>ExOG)hKm53wXJU3AhGeBZU7&CJ=B}Zui1cG^iA)pbovMF5%WOnF$7zJNZ|~
z0n;VS3ZRrAj-vk;=8LOQ4WXMTAoPbEAP#`~ISwlMD<|*6;B&LL&i@6qxem9p4dNGi
z@nSYdk^oS%jVhmSf66(0M9IF2xYz^$=F9%e4}jUmV4wwe?VmgZ#PI+i^S|;FWt@Ot
zg;@Va=#$4Lk(SA#|LjH+s>uSk$JVO;agx(+0Sl!_7G<*J|DQic0tm-e>DN13zezBP
z0nnvp?yvV!fYjCtC1ie=rF@`ClaQAI+L@O34bXc>62Ob8bkOsFYLft<X_*Jb-0Z)J
z(X9_G$-3~c{_z0qf*EM@9|U6`Ut${YYrFWEyT1d|s<gmOYMX|y)c)^22|Vl*oyeb;
zkWw$e^|)$&n9o*q_UhzV>-g7|+WK)Zgoo3sX8fv7fZ1MYyQn!uI3K|Xs<Ld~=J&ZU
zJseu!k;xwzuN6;-&7bUC7dif@^s@2(L>QF3`fy*PiMJ1O$!`-sn|=91PXWK7beK)6
zsk2b7`E;((XWF^^>4?&r7J2Kykmt@3RgI$8m~+@^pVK#<9=p)Wm$A+zYmbfl)Gntl
zp%<fQ<?EBt`%U5H*4l!o#zK`wcw<8CyUN+v?YeWLj6M@q2tT~xGI`pz%RSpG|NdN2
zq-i1FikKeR!1{!fShB`e{zd-47z_fN$XM7O&$Ag6aUHW8Yu3|yr(O`+j55g1jD0q1
zWmUJQI%G9c6F1`F5cq8J#8x9=gNY-g5!GWIr)vSL-OP1<U+XiykRrD=3u^uvw4g@<
zO)l|XZi*PlK7C(jUF==a@5$p~(&pW0USogX!8Io^`&V}5K%CP1Bv>5Mka0-IfN|)p
zLDRXZT1aZfvAfm#?ePM=@88M<`ZdqX-L9ZNIkaUUfzbosH`ri9wkKbEbvVZ*LgsNf
zy-UXXHEU+B%pr`4f_Ww<RJ)BH(iy2qqtV`Crw)nVCdz~O3ibPt->m8{F0<{S4|_Cw
zk(cC%`t<~Oe9gjSd6TyF`zig5J#A}q=PLcYl}qkZk7<-1q9A<1as+1+p5#6BL}u2}
zyz4UCsr(2j7C}YMUSDy#x!`Y}qQ489GTVcF!Ee$sSm)5&o2hmhduobUfZ!KvG-~nH
zyE(TJ@eZKy6a;g>hT+e$LEDK?rn}Wfx-RUmNr@WCE*srWQX&)vnydnl$=5S3ODJ4C
z>-X=A;-}{A%#1<qpSssyYdAGhPA`OHEL^U@x2a~Wt)ALezuM(?$Dcp+Mb^U+8~2gP
z6AP9g<Zc71=R@^;fdRY2uHNAu0u{u+4~s@o4OWSpB~2|%yHi&$yq7N5Eq}^*Q8#Zh
zRJ|R4f)dLmVox0Bk=r}ee*7I40oArOK7sc!A)%8CkSwi<^Pw|aqX?1-m+2uP@hj8=
zxn}Z{Y6gxi-f4de*4>TJ*!6N@)&axWeX=uK<$QpfetSb>ruX0fd>l7Xb*+SK^};)M
z9~qJr=hWsew5}?hTqQtgjz9(#IJhp4HRn@zBKI~TCcUp4N;Ulw*UuX%naC-dsF3S)
z<t->(wWsek+)caKA&7n=(-PJ#6i1j|v$?QIp&X=&^{AW>UeDz|*n5SfVy|uhGON9;
zGGaIGQR`g=yq)nD9j_0#a38w;*E{&g7R(I_<Vbk7>6tVtlhP&BCRA7dXyu{9&hc@C
z?<1U+=VJ)L-Az=DTy>V#!rrx*eQSJ;=&X%iR|696yi{ahw4N9>G=Q&<h^^<Gn|bv9
zdN?PEq{7^Loxx=)xLiB?$|yzW?5E2BPh@5dwg$?mo{y*c+Zc=JNw3^`;%tGo#a26^
zNC0)9a-Dsm+rWGSYb?C({KLi!zGOXWp=<rbMybCt$9hX(M~nIb&gmIvmy6$&acQ-p
z$4W49SWF#+xKhZm7UWUE2QF>T!0cL$iDRf>he5R_N$WdF+ShZv71png+9P>3+ZQV%
zy^N^b9nwQO_oHVUR%ECX0-7OT6@(;5!_1S!D_X;;G(1ycRwCm$^-KNg4aVaX_mlU~
z?7fS{Jg+M!P4}e_WSy4pK<a2koH{D}7op>`Gf9_}*$@ZBgjwG}>7>_|vi?YFx-suU
z+^R`l>cVP6>}lOF;H^BUU)1OAKj-ug2aS5XYbhP*f1;bzu@4)E5tHkLKraxo(9M(*
z6{9iu!9c(1nJiE8$@n>J;8&#gn{C(xBe3Sp8{yC#);JxWEp`Ui%3Cz#E1s~eY8H${
zAQ_owvPFg#dQZv(1J>k6R(iic+QgkJd@?(dlra47PBmNL7<Yo8E%(YH#2JDOX2@gK
z<8Sv1GLszNh{97oSv<~8TKwcCE^r)=Qg5~q2!2+#Q1zrQSPvK4@=V0s10ES!<45v*
zD&v}IsVL!kpMVkzm-niP=$YJ6Q_UpGeaANB`l_VX%eINPL3j6pq@redsaW^bFDuHF
zOKr-G7QbjTtjkB=NsyF4jl3;Sz5Q<W`XD*^6pe9D+V`U^YDqYJT7WifYW=FmbSpIa
z8hp4GS2dSot;?GYv8+b)Yd7%>sa)<gj&z}}be&bp4@$UUYy#v+OVe}r1N(u2iy*%H
z`b@>UqZ>w)71z_&-kZg<iAZZM8sPy1%FJPYkGJ1Lzw=t`)v(%aK*tJ3Iw^B-UR0uL
zPvb?*>TbO}5^GdH*eT0MO89bSZFr&=mc2P-<_0N(QC1J@2)wUim2EcCqbT#L==MLo
z6ZDcBr+`@((isQxHd9}9(KNZT(l{}b-V09La?;U?Ux3-K#oj;w9x+D&QR)T>$-4@J
zmDf;;4_9Qe)C!)jBkv;*!{!gRq`ODjoB3d}zM!?nk)yTkW=SU0N}qqydg%P>1y4rb
zDn8A&PsyZ7s%&}9X&w>tE3idspE&F3dREyTP@OP^U_l}8DCWS#hWA&3@ZnFaDsye$
z9EPbIWt^)8?JkRT`H)*JN&{+4)=L6g&1^ZJzEVMTw=b#An(gWy95))ryn1GNvcT`f
z6_&je2{E#9zpS2rHj{Ft*YBLRn)pVG;&eBd@zit_;{VX<L=O6^eS4KMXLcUce9DoB
z1Awt)*QDw<7nj8c0B&8{#raM%oBf+2{HDtxGd|=`lo@2WbRZ*X&fQJy1;Xznb#=06
zruEe3X!bSx>B6`;^ir)2wswC<RnSTBhr#+Rr2zHn_`u`~%I?$aC5?nwCkOC6B}+2z
zW85_ryqGxy+e|0k{n;$hOIQtB@d%|AhB$S7Mdb(#l+|04@Bt%sCCPUl#~YDZ_p-sh
zi;HW&S}wk4QmT1~bS`42@$;TUPla3l%W9w00GJC#EQ0z%j!SZH7^a9}>uHOFF-~HB
zm<udqS)ls5;{N2~N-HnuSMeEy7w7CUGi}-r0_{BGxG2PYQ*{Tlop3s_FdK(8e{mU0
z%KWND9zb)m%Zb}_ny#@?DsQ<vaiTfEgh72;9;-ZRCW;(5o0ROz^F-=Sh_ig(dQD02
z`kg@Hck$FUWNlFa;J!iP)jEfqkB0Qe8El}Kgq57{$>Ig;*r5xs5u-6(CUA5S#RVa=
z&F?)Q6i<)+X8nOt1-fFH4KwKURoj=&tfSrOoVu2izFylDuv0isr@vTtyq0{^zr5Cr
z#4Iq4*f#A`dS81j^l0QF@|pzi0rGk;8M6T-6MLP+Cw;faAWo=*mg!Y1hOXu^P61A6
zK8+@W9}b)3=i3<Ql5MF!SPRPPu!x>ZfN#q%@UDK79cAO<^7rw9cp;j`9Q2f27WO@0
z^~dY;3m2aAJ59-mS>0c1&A?KZ+6u*xMg=|Q3uW_H=Uz2|JRTsDY){FSsw^6}$y`f@
zutD)8c7+`6#|ZETGxHv}?9Se9xv+`(yS2TXf+#Yqb9u?7rp0Z_q{;)g$Y}ilvWyi!
zxI)5`0JX<h$7~lBs2~T?r=gsn_3jLzN~&<>aEO={b>eT}B<P|N_Sk#*W9q!b9vef)
zR<)&}y32=LH2JEnR;_$b#aAx4){ETj^xTLilG(+9SyW3=h>pCg6Z$Y-KV{lmn=`Jm
z;}CCH!Git$Vf~a+I(qfF{-aTI%~d@DyP|u#(FOUW7)R85buY_o%m+Gv+7Ekz1LmQl
zrcT@C?ewJfA$+R}DhJpOrfurf=0l@^YxOa3e}6NR+L*1UZt^9RRSH|Gd*hQk*WMr+
z<@^e9bCqh@NZv8y@c_T#(L1{YabzAjrW=dSBdsX=C-8OLQE@Ci{p&jAjIepRCD23a
zx^Sr7&`ytLIzOt>hXZ~7xR07CB?q@t3v(`MO(~eB{%)%+u)%TQXKBH^qO<*${t9q?
zNR5_y&vC3D=iSH}`VY^kAj)-`TI5s^6*X4XM}4pj&GX~)ivVep1lS#C+isOA(X*vp
z$}+b_S7Y-feVdW#u}-wn^;b)jCi8Bp3N}}$yxb}IpC?dwj=I#|BTE01khCz`lOn>V
z{8Dx@ulVKDLtB5=2EB&Ihd*ESG|}R-@m#Z6Q9c*!sGfRC8#C@T-*vrxu^N6*WJE9R
z(yp!ih>h%#<I)&5l!a>)TaQVPhLc!<z`oh@LwoxtWNw2kah-(L<X!(QzczSBFItSX
zjhKDqNm5V^f%q>(YD&yiSMGhE)S^@fzKP$IY~UKB@8lu#l8_@S66SaO%)i&4s6op@
zG(9|!_VQb)+<8^FP3EMF^a_ry{sCV32O^8romTCNP+Ah3N1v`E7fXFd2G++9_P*~B
zJ$i9xRbzcip{{PXB$lU``s{G4{C(ZNKX_DGZz7~(Z%iLrv6OHjS_r*L-Wd5L&ukHt
zaz^Tdq91mU>iH#C7_BxBUWQ`@@J>=hi5cMV2|jLqul3ouH7Z^-{+kO_ajUN8yPB%-
zGlyc6@}`Dr@iX-!+XaXaG!@bmUA>{H!l>c@ma>q76qkj9g4!+LjyT8PhDdEU;doLW
z*Ul=5spQ<qHGS2r)tV$KN4JkyLCBOaK2J)1#G$8NkL61BihC}=o>CwKe7>kM@o?44
z|3yWy1FPw*w)Abs3m*zDV9U{^m;EIxt4dy=Tlld9QfoY%jDF+>-Yy$EJsdfLIOS>!
zKhNiqH{DmBCD;w*II#$zN6jj0J<DepwGQ0pbqn-3=clzcRBefysT_f_+G@vDCI;s5
zuqrmoOpfm#=@BXf$NC9{(-Ix%uv=5mAI;qv#JAXslhvXmT~@qeZ(vogH51YQ%#r7*
zL&TDR8Pv<z*`$(E?;Mw!h3kNF8^WlYq!FP1?7DI(Aa0shUk}q-WW`kNWM0*%WPt;D
zY<2j`TQPk(lBX`IYdKp_KTcI_5#pQ1zG_%Gh-NLza;aw}{&6K(X^t@M%dLnqqmPcZ
zU9^zQitl~4EE#oSW-v>mfV9~CYEf71EXACQXs}?G@XVonDEqSFSX%IHco9j1kvi&p
zX;6_#f7a1%t?4E6AyjosJ#5n43X6`C${oUp^M??!f<5fg^tge7Kg-EuT$1xxW9;U>
zJL)jTTumw!Gc2GiG72Q!kt>HrcSGbKk!RqJ;&Xb?CNnh=q{yiChiP_9)$LEIIT&?&
zu{!o$oa#Tk_(eub)hmOD7{pspxZDK<&PFc|`Y|c@OO@AUev&{Qmn8_|Qaw6a;2#}V
zV!=eXsg3pw6hm+lh7&i<C@1>4(tU;}>C%^5vZslvfxRS;v`|SsN$_GVJ%Y?-PFQ0O
zvERQ}`%583H%aM<-K&E(XVl?JuErfboNtj*Ozi9fRzldIngDGV=F5>49|BxVY1$aq
zcyq06J2Qb}3~*6ED79DCB(~SqfZdQ6pKF%g9?6MZ(7wn-ul4Mz5)6yoS(Tu)y-k=C
zXJe3eK`@ytQ|-*c5kK#eqq7U>%?DI<TRl08?o<LT<Dfmpyi72d%++SMICV%%WySKL
zjg-9RWkhk~n`RFg=8O166G0Bwh<E7yS3_u#xT3!%@DIHUSn&!g#KdG{efhSmrlGK2
zmZZs`Ucz~K6WOQqjRq#Aw|}_mx=KsaT+eA8=M?tu@{Y&e86?yuB|8+mV*JQ~NPN}9
z!1y{PnXI8r`5qKeVmdGE#PY^%BQ*ZP)1|qPT%~dQrD`KjhqsovD`GVPLblpGQOV5N
z)N?|hP-Cj^y$HYdcF9_Oli&Zviuj=lit6Dju6b$noZC!kjt{PT{iC7YN6#Nx#qWjI
z6_?@_6XUjdos-Lg&^HIm(}@6MMcd7$$8OJs;7Rv?Ysknq;uHdNN?F3LnrVV(y4~Jr
zfOlDvb*3F75G$z!bzk<0oR})Dz5K{i?D3OpozEJy<WrLg6lMnccIU4ulxNPiY?=L|
z)sI{toQ3_0%oYKOXM{c|(C`~6Z2EYD0=$gHj~=d3OHFkf5;{06-8GCxYOFa;x0L%R
zsHrIjvWTUyQ}EyczPF0fE1C*xuN$$csB6Rx5#Nqg1*Bfor7bSl5h<i#>8ddLd;h|^
z^ESn-AB+W}EPSf68Q=WcU0MIFvCq$?#cAYb=%FUHgVq)W=uXB5IS_vR%3*bMVPw+w
zvlx#4iw&cU688X_qI1-UH+jmTe0n8!4DxmRPYT-H?fT8gpPo$qMATm}CXwvY5>s!-
zLx;4_JZi8(CR^3JVl$ePxKh}M=2&9ZvWu4UV|2%bqo`y<1WPPFOK0Dny~czgRT#V5
zhDpV}Ivs;dc2T{T{e81ydIICIe&?Q7MQwDp;`$@&RK@s(YcjIc!VNxLEM<<8>}5}5
zbH5v%uZg_{8RAK1Zv_VLk+7WQcp4=*ilH`Af5z>2v(=t1g<u=<IG@e;ftql4Plyz1
z$m%MI>T$F|SZW?YE!kwdBq~2FrD=vleTKxvIlnqQYS1}!{&~<)%lL?%jAk^J^!mb9
zpXr&x0i!loj0V9&E?+_7&*R!r;I?l2KA4+ERj#d0H(A|-y5huxP?zp+^k&YMImv6u
zOrOH1jW%BH1zPr5DbRPPx0Zv9g>wP33gV^Bjy;*iPS1ok^zRR->||P}q5`FuEkF=B
ze6+U#5QZNX)P$S*H)`QL?VAh~Bk|dGUhJFaaj^R&d|T?0x4`AfSfJ-FX5&=-S}PRW
zXXJM>(C4leJ66MJ39NZ3m8Gx)9@W{+5g7U|;ta_}+pwv(Eb9TUNaqTW!z#rxZ>4D5
zfNC1xlG`j>4<7{~U`pu(krz#C3v-60t3MvgW%UhRLc@AWo7p0vZGj!w=Ub@zle%+*
z*hLzXc}-!5_9C<~1PdP*J<0e8N3g0lSfyPAaAKUS|8RW2Q4QKe4#<Oku;b}!?M}=*
z3fq8>iPBs2lL0vEh!A()F~h(=iici*X)5?B1(kto6L^?O`8hA;cCY08MSe;5EWXe6
z-0j15kFGUqZ8Oc}Ue)pyF%ntIX+BpML)Utm7@E2ws)jq8fnCS7uoM1r4o{TpVY$S;
zr^acsPoR7@*z|29myt>;>HaPeLKN$3TYe9T2`DASh5&!U(3zmV{o%VfO=Dx0Ra;_F
zB*Cqn889}e<0?&?AjLG8!qr2^zN1&u4{K7BA;y*Vj_Hv9zC`Jy5)^SVOPqmcs}o+K
zl6I(G@HY?HV0t^5dqPO3I!Z&<3y=9{zcd-sGx6B1S<&c#QQRY(9$+!+LzCacpFL<)
z^ja7+|I;nq(l;W_;mEd=iAi5fOeBI_;m5nzuLgNV?}c{YY27U(9oKQqtynfGlb~P^
zz~8(Kdg-J&AR^YMMXC^tZc7@`V8k0vjWK4rZWJ>W{Olg@i%F*NkB$JBUDVRiCn2m7
zWvSK8q9>*g3r0AP+ZUHDIxrJQ?sO)PFbgFUrBDwYpvEQ@;>R=+#QLUc5p3~S+F0L%
z2*v${=mx@@Hc#ZcJoCZj$g4{h*!P9`b%5J;Y;(t3zALzEs=&@AhCL?LN-q|zkg&Zu
znK5Vo=%*GxaLP@$syC@-bmxJwejEHm)aY<{ZL4i_LFM}3!x8lQy`!Hd`@P7B7eHCw
zkq_oWDE<#~qxtf_Pp|m0qAvo7sg>$SrUg_x1n%Evs>WZyLhI7HrLJxJMqilbz*O{J
zv2_<oai9tL;{^8i&MMP^BjF2?IQCI#em@TKx!y-i>(Nr1Zi3m)rb?}~5+-tA@{2U#
zJ9|%&$GtpT$c};|8cxEwjy}67Uanl2`3yTPPsS-%i7YKyz1S|k3k&#y*+BlsyG3cK
zG;dS)OfBBuj3{ER_NQPAmxwVlk;0xGD-7aW{AtmkP=#aIb4JPW)sx5ZFqehxUKaR+
z;--ysHAkI`0iW1gKdk1k8(kRY*lDhu%tw9g|8Wo9#`dS@C0l4a5p^}7u)D07IKzrV
z7Mw<_R3J`cvb?5yt1vgXnp1**bY5mfGFI>{baw^jLweTXP<cyJ-7r=y$Rj~+lGhJQ
zB`Em)q}U*)=(BWOxzxTRxS%TCc@pyF*d{kPU%qGc{SF*4AuRf-5ZV$NQiI)0nqhD&
zXSsSnbeT~Zo{Ku=?JTQV(RBZJbrmdH813XGc{m`GjfVBX$<g$?NCC&5@0Mh;G&*%i
z8gClkcd68rXcb~d>V}4ttqzk^!EcVL3E+1H^~1$R9RuE*&f{X(l6Dl;ku`^@-I;P$
zU|w>^zV|}L|6IKE(1z#XAZI(4<N*2?Kt9eJP%hsB4NVI(^&wZvgK%H)2WN_aKm+sA
z`x=QNwO0qRiiF&~*cr+1I(Aws=ljVsx8h2suI{Tu;Y*tedbh2vmeRz0r3eig8*1BR
z4dzvgfD@OF$wnO^Xg|QJrs;ab(!<b~{RH)e5BiSRAGpuS(i${2=j4&*xi&W(Pw_M`
zQ3+dGBOU~<0TzMQ(~k=s%RgB8EudGXFAligB0hSQi;h7kA(XNsGb{Z}W6+Q-Nvp`I
zt8%W%Ysa_q^z9`Lt&|urjQQ5cVj&kfQHAB>uI81Ey-9~>JAq$C9h3Ns_<kgd&z|p3
z@rYY9#+0y^>KuHhrBbpA#tjcFU&$eV&+_$NCD^x`(SE7m_D{iJ5^RuOcUoVxo8ycZ
z9hw&TTW!-ff!I|%{_J5n^LJu|ggV+Serm~2CIbd*Uj4YN!K3iTf9w;9(<jThKV-!W
z_zU|_kBJnvhexaEXl_i!)m6&~w&Vp@;4b})+l|b~Al`6`K5>*0V#nfPG@Pnx;yO1!
z`0C2<YPLG9-J0RwG*EiM@%+#WOw&<Fn$d?}%C~%sSgB-*AqYO~AxQe(jd!oG_gizq
z8a8OR+@1n}T$c5^ou3ExJ%8sFyJA_xjzvZGcwxfrRR>++EP>z27d>Gt^+!Y1;I^|<
z8q<V&4t9~$t1}@H<1I%RJDJj_`BK6=AD1W}Bz!OW30wZ{jA<<&jvKlfFE^e?DZU-*
zW(>D`%@|ifA2Tj5&COfHIn+C9JAan^b^=!_q<HE=h*QS1!HmqXOTUe)!L*6Sy6-64
z@d>Ti8#eP*>!j-4ILw8YL1-wbZZRm+$=0>@Gye4F9|gy;cLG~<IXZ%v%igp*B?R{h
zpi%%ms(!EV5EnxwPBcj*`02e#%TBxE$smIm?!al2%)-B9!*dcdkccTQ_W@M36MZSc
z%y+TXh4*a!aH!3n=!^-%M8SEtSR5U{f5WflEW}o24-GNywnO56KT8Df>UiS^q5)~|
zI@EOFCwKLo?}uf|En~`y6Ou0GQtPir)>3>l&+Mrv87HeQMrCmW`O2(v-|~!0VNWjC
zqa*G{(WS3055F_e&E0JCGYhRw_9ZZH*FvoIBLYiZlaXg_z)XHxKrOp4b4M8m<Q(C2
z%riR#xDtELqk(4YL)1gnNzGkdmS@^h^1M=7oM?25*e5aIqZP0@)L=!n!v#jSZ(B3%
zsWZ}6{;pSI+Wm}+jTXw!_1ss*%S>ltc`I@!Ao{z39rDaOMPch%y2pK+PZVDD1E=2>
zNSLwH%#kP6B1=)L#rVxVc{-MA%nw4Bd<u6WbT_wJp$};>GJb_GndIYu)MW06OfFMX
zMo}d#Opta4US-L|#c75s;8QVBv`04);4BE#jbx?IwxT3y@(f9IR2ICZ9miaaLs<~z
zN>?1}jT_4DF&&ektis>1ZzDW+#0-19H~8yVej*O)AE#$3KMYN%jP^b*Y9{V;mt;QF
zyQRv~li%AP`E^xB@9Yr6qK;VWT_?V@cVG7#3Mh^ZvUOWY`_ouN(v=aj2Ft!DC5l88
zW5B!zWo>RDK-;N-=eagl#hG;J@m`HNx19Qd@Peqy==_Y9*{N+?HM@6E&J*jaQO6wJ
zS)8Ca!w&5%d(@+{JtFT@nvq^{T*IUTYldOIv*h7qhuKAg;Ue(z5cj53;#EtM@s~vt
zc^BWQs{`0!U7l3P0)8avbK(ZN!y@kEg-6=!IZy%xA!<ph>y3#{u6kDn9%K6`@Uq;!
zM9Z^;FHER~#jkQ5eDzzXz%G(5#{1gsVAAvsNc{3ELSa2MOOP&p0N8L+o1e3M4++dC
z_Eq(!BCendM$>>N$@5f;35||`c=JhmN4@*J<8_DQRKs~7(iT^>hsWXY6RTF!htS#M
zJ*MI)nG~jTrlO3}O8OY9(*3I*8HAEG_f?l=1dgA07aDDwXd(YsPONilD{moOkf$gi
zYXQH@0=VU==<`Im@fJ_Z*V7KA9@YYt!Iz>t5pBaA)yd-o&pjocf07ip&=R<Y7ZXRz
z>AMO#n8^vXQf7r}-j1?9{F-j}+7zXmS^2r`T|Rs+4=mM3#qOzgub3#%UUW*$s?&2P
z#eYh`O`s8QiUCz{>SCzLi3M^rqP@i%7<_1j)wH<){W=EGyRv$U&eB&sy=c_qhG0vz
zeyx5n<-AKzizg#}OZIDqq7Ku2`xuG`WQbP$AZTu{<m1+iaG7Z@giTn-yg|)APdV(-
zY|OLjn+e77h)k4?;QED}w>XcZ{;9wg^hr<0qGm|c#?f9TcT2&p=G;R=1|%ZnK0aPk
z5P9Io@1DH<T8GRQYRu`l%lLN#^%&0v7?(8PvgPw_S`B`#)iGn03V~8DU^l$?gwJAn
zm#I&58_rHwXiH(YpL?@->g(gu&lz;2(mIF5ns5l42dtJ`4#pRS`ME7OYLcV|J*Ggy
zvKIG3)d&>|ZU^qU$uZ-{Ca6$*uI%bsfxIRN6~tT|gOkoqX1B6NevuAM<f+HSuRYFC
zp5ai0xOJWN^?tqYgxW8rPl*Q;5s%ms68P}km<y}NIu%3s0U$Px%%23FOG)Za8l+21
zW8Ylf8FLRfY|Zw#yWLdn>`!#LMEtxwuMs&P)U%D?pNl^}doT!SsW41}6bXu0D;$^r
zx?xU0borSU$25vKBCUWNdhnr4ks{(&hW=^$o!j&mUfV@|4ElIpO;4tv$E&m0%cNC@
z1}k?f7qf72QA=))`dIfAO^8^-w#v-S6PhP0`?U>9rt7DKjw-GNabc0Qz$Qc6tHzCf
zuq5XUACN2h;)9P~YcX9!viz+W?$rZiO7Ti~bdmRylR1J>v;vy_DNw1M1vQrjGV76Z
z;Ya>NMVShh1C2g-Y`Ylg9WL>=uwf5i+EHGY2bjK7Q&^quZ4kEDEa56n))yX<fxW%3
zNKJlC`VMXjQ&p<S8levG19Rtjmz|%uL7b+pGy4ALPrp(p82@0wG?~=v{B9*aO1Xtc
zKU9mT;L7yumOj46i5{|goOtWj!!-HllB&MVhW7+LEU|dBjDaA9OxHVRL$uln?z&up
z;*Nsp@|LiOPPFhMUB^hioj9<s%ae>TnqZ?C{3a@2H^{OG+)Vm`$Kgy-q(v0i7ru63
z;QG$$`H#i;`)j*FWjR;U!puW;pcp$Fm{*7k8=C)pPFMiZ*NBUWM$K@+>xjX6OoTvL
zQ7BkS*e(Jr_B|g&)-__zW_^_-+I2W^&UkFy2?QhVkz4ELubjVh#!D(99aMBN+ik|z
zqc!j^QC>B1_7n&Fj-)Jc$ee3axMu!^hvz4C@BbO4U>C0V@fEk4nvll3qlS4UFWhad
zS#ym94sK8=une~yDR-z~i5Wg}bfG|vYF%!6*w|z{TO}2VxbN>i^z>Pnn02hd1?iaS
z2vu3aD!|LQ`Ksre3IUYI4-rc2kL+zaNN}tu=qO;Mg+}>zBSXG#MA<w-)&oJ^(Ws|y
zcl{=0lCq$Yn}PmI3K2AZ{2t_E5g$+^JeC=lU<rm>?1i4ChfUm}(Upk_9w$eV%&lWx
zR>=h86LnHkJV|;^tGzw$OS&Bm@Q;PnTXuvBd71k4>&hw~lFU9KFdQ`!|1W!<mK-n&
zX+&Z*#ZDj2Xo29;CpTF7PZ$sVGi`~1?<1;Hsp>YeEUi^KaHF081po81^t?xzOf2V<
z;WDi@7ASuva$jN7)*r`JaQNDBTZ8qEYWC5YSprNzfyzftKIIu{$Ne3twr)XDUS7z6
z+dS23pDX9;nk^KFG<hgYDg~;kJk#-|fSeDdD%oPRUL|H|$WLfFbJSNlYB9tN2LvH_
zSSiUoc2=mA_g$|F9p6w_%$-$Q2nG-hhE(J0iI=*i`#ZTtqu!_G<F(5zkf1Tl3O<>y
zE&{iqW`p*7AP+WEcI7g{B9&Zd>+TyI2J01Os-Tq=K@N~xhpwpblKA+$dg=Fw{E1k#
z&-c6b)=jp0G9XT)&gCcMkKKodO#40Sa=$d=Kb6N7XNak|rBoj*L49Lx{5LjnaXOf$
zmR7sU$do(=sqr)Tb;z`e*qBYAI2S3`b>>Hn#e8T^JRPtuKaCL1AAsMvTY2%lhg;v~
z5qzJC38d{=EOd(*O4Zcp)n5KH|JXTFAeqpgNJ}upS=?{}oM@*GudUH_FhiP4Ro#YK
zo(bo?5-Kz4SgL`Yw3d<+6k>gQ+vT~2OMcxr<i=CWa<6dbertpQNg<ls1V5*#G-WkQ
zOh@c%oR66PaT=CtD_10Q1ZG&np(8Aphg@|;ops`=C0g5>ZLoaleEy6#!)<F3Qta&<
zvkv731xNt_aUDRh<Y-=2TJE1zX!sM&t@R}JD|tnJrjE8foc~Iw5#r0`#<lMEbXH&h
zXSC+Kt#iMhCdTrpw8l%6Tcw*dye$_dCHwPq#z?)V4i2mpB3PRud((!mEfN!ZM+72j
z-AOk;e|?6wwu~G8g5#NS0AEY)Lg1}QRUP*GU9oD-?8ksQIc&OGpB_oRMGvVFS0x&F
z!=<~4vbUc7WbL>i71MMb&QB~0YRePF)o*nQQmUhk`JBq@Sv;)*r%tw_3QXyIhvbwK
z`}&ijoqpRzlCAUu<}5HRF|JI-^A%13QQYQykUjwG`yfgyi2E&M+Lt>IH=}-4vpRrC
z)QPZfcV;(n*@bgZ<$&jz#YR>+EOamEZL|CVxV%V9O;llOGSasT3^xms{ao07&^v!%
zx~8cKPqPgiDfu*Gpjsu*x<$O?Cwo_f(QVO!)+S+y$!##07k%reXE>jCbyB>2_|$gh
z9?KS|SQFBwv*6bi^wYw&s+4^GYDFs636oC>v4S}_>UioGkBjBpv*HHib+kvSyT~cc
zTZd`kFMCp{F06JP++umE$`<T(dzrt=diQEue@?lm97tj7K44qa8DR|!<I!cH;EC^L
zBI_CmhMT-?XhxL~8u>YecP>LeStHZ~h*+Lhiwce4eGzHg-xnNZhS#!Ul3n7we$@X9
zwh=(Bt;ZNcph&-eWQ^d>(!VNg_MGQbz-5m7*62)D5fv*&@qOWZ$f)aHo)wob5k0}L
zN?c!7z5tzYsgYml?~w4}OSrQ6ZK}tCPqV^?8t$}z8I>_O2H&onSUT6WavnNStD=cb
zDiYHV)+mv3u7!*8Kgsl)d_6>fcAJ>9O-rzrLkr5rh%QokEt4MbxR^5B<$N@WDN~w%
z@ZmO>5z1n4HNUlSjzv7u-|~9y)f?R1E#-ZE5h?j(J`&zzZiU?siCOxyMPp+?re|@v
zk^8*ya?~N4o^C1YxnAE3QUT+qx>DU=Rwl+xF)Tjq)H`r@tU9IRD!;Pioi###XIf)>
zq#8c;`s70YN%$w<>Lp&z#(15p9E~!AmlvjXI-<E;K;UM0N7lf<h-cPn?_%^-!&K)2
z@&0jei%jRm!EVd;Zr53`SIx0euvn^?r;hu=6{C_3aiG|ScF@M7p%uaO*@zH^0blPA
z;ZI|qR7Kub3B~o3!w9td_z`TZ%KSimvSC8`qLZgb`Fif)>|}^;D5K+3k2!BR)^Z_f
zdgkEqI&%KJ9^aUBseyu9>=VwUfPkZTMpC>c5VyUgghA*Zucw#=A9C!K9Qs;lbm3?F
zr>zb(ChI&h%+!o0n}_YRZ;CVO<cQQlpkxX{{M@R`gqw!x{(H)(f%DbXzAoORhif#;
zUx#ZBXSCnEZry~~xbY(d=v--VrUm=YSQCjz$XcnTe@wApfp#!CbA+Y54_ptHGjUU}
zxx&9YS`$?C^Coz0X963ixCQECM>v`4zyy}&6xoF69-|?9!BmU0;r6<&={7Z^<3(nG
z)^*mqF~mRu>5G6+s+l@Tac(T&<14ZP5df|9Y_I2O5bTq0;I<3~Q#5KL)^oCFdUM<^
zIE5)qZMs?Ce;zjAGR>o<-s4ubtL$h1M{}4TMNVk4<TvB9r&1iFx0a`w$kdO$evc7A
z9b^!ya(;?CW;K%s<{9w$K=#OG>$oSO_0IQxAXY@;X(MXWpBAMGWJ$^#%09KN@zkqO
zO2obkA~7GB$o^@T_G>ndJ3`K!<|8OY#3`a}Vw#q~q`Zc=K|}<(c_=xr0;J`4=j;W!
zWTR*pgF<}W5cJFu_vr}QnL7m-?<Fg^plj9khI=n+2QEcEfaY}15GsUz+KT@Yc+eL5
zI}o7}=Z&-%5nfP~!j7FSZMNZ{%67BgbVy~QP<`@(o{C61Sd@^Soz_v1x6XL?@v{BZ
zNQBLoYJ7`3++z*5rhqx#(OF3R<BP0UJ!0DIaU5rG5@0Fw+5WoI*@}=WBbR9T^cd$C
zh-jQ!_tcT=Wl!veJO}pBouLSx{5J`qk$#xBb?@q>j&JS<F`>7Y$4{3oY5NL34wOTW
zeb+A@24sX}eU&0zxx$FsnhLQ%yOaI9Zp4rPS-kKXE>{_%g(p?eAx}EeT+L6+-ipEZ
z{U+(ufoM?*;Y^eLC2?*Sb#vG~?xRGm6CV0{l4&49!c6J4-i=vSq^6^t0+#ZY0?)iD
zqDXc7ObW#e@4+N6%YPVwzls@N_QupvyKyyb#P6Z}RFg8W+iRj1p%2!Xr4*>oa0MwW
zdT*~0P8Kos&f81GEkXR#z@+@F7;+kA@<x%;Y9)ab8&tRsGnpK=O7@R7^{>!Ff8Ij8
zDWC37nW+|$j@67xkSY79!<J+CV%_t-`BpcssAlE&pFt65k!o~}2wPUE9y|k~X(0Y(
zZt>kDoUF_=u&*A&Eu%~&|C<`K)xrZAATqc`<aA-cYR2Aqla3sUt)Z^rHrm#fe6kxc
zzq2nHVApJ2?xq#mR52pev!BEsO(XX8l~5+>>38vlZ;P=c^~_zc?|T}25dlP18Kj%t
zkL5s=MM6VqWIS5Z7JD5#+5Iaa6X$oTH0d7C$NT2mnq=7WA9`UuH7`t*nG~1<g!M$*
z5r2;Z21@UEJNKwzaIp3)iw}znR{lVepl7Iw5ak+lRG=W4i1fU7=SbW4v(}@WhLstf
zqqgI=`imScw3$W~m4|$E#8S6!H^LW857{V6_a<|DeI6H^Z?meV$c&tMyRpTTeByI$
zJ>_H)uRmOqq!WQXEnLM6+)tG85kr<H6axYT|LJhw{#Lto(A2#F{{(wUg0vmK2SXJ0
z1HWYldDYE(MWvAL|H@iG<TAbBND%|R`Ir)FDqJntfEFxhm_m!?rFv3o3WTE@xGfYu
z%*3t``{UK+e(j>&Iaq9C4OyIBhjtx_CQ$)1G|9=lJ!MxRVu>SvqWbw+Y7bVW^2zxN
zcL6P;oz3sPA`OxRBY0TLkaBp>r;VIdOxG-+uAwjYmdVZmxV`T~{AZ0<*}cczxnIP*
z>Z%+T(>-*~C+5#Kll)Ssb^C*l9aYa|H$r-<Ao*?yd$63}v1}BD%&}7d0O0-}rRR8m
zAP$%)$iCQ-kw6#qNg-9(WxT)|b#D*)OjfkvD^hh@SZ&Qm>SIHgHd>=<Ub+0(lcfSp
zd#RRkg9)#98Mi;KZd34By|<nUJ#|E}KZ>i3X)E|#v}_yQ{S|X*z1azl2a_yD^#>Na
z_JJQIO+1H4<8fd5F+#(@*;A)&cY*>e(=e<)aQ-z(-KHvG+*2p-$7Y*YU;}T@E0G?|
zbV0l!rxYKXBx#q<EeGR=Or1fmHW<-ue`fgwm0%3P#(&X>J)>+8k|*yAT+t>UQ-0jM
zE7ZYu(RJOJ>MlO><EhE)M&V9;0~>69Ru@S3==#p+qhE$e4B>*1r$SEEKuESdR)P~3
z)E-+~q=^1p;^q_n(VvJuJr^rjf)tHNArCw%0Nh45%y=6cWQ{hye{*tke)s0QWvqy9
zI0&5~=445Fl0EDrmSgHi|LA?*$p-*AZywiz^@5q3C^7USmMSexdL|CYn*QeJ)<mDd
zql^-J9KW9hoD%@&cSZMD(7awqNXb)+IYP^T2EegjFmH)DB)|G!v1v3h{Qz=LPcR{U
z^t5RbdxA-vW^{sSqQx+^#!ntwYOj-5mtS(PlXy%NjsVa<rY}q?%E0aw$-lR?790R*
z75w`ngoXtw^bCU1^4(<O<Zfs=(mqiLQ0%2RK>uuNk7Uiiy3Y`^`Iz7~;SXtmM31#*
z)Nd|pF#u$hv71r)>z=0)z?Yab+XVlwo@KW&_45m`wWik#!<YtO^-oW<BFFS{tc4&U
z@Lu4v>4kO!v97qVG|!YFLUNn1o1P|}Au=>B1n7%I&<(q|z>k&xYRh|otFQ0G36S0<
zd{M_36F##xxax;bnIRZlf7AIBVjoSjlqVOn@SIQXya29?v+;Nmu;l>_<*6(c2zesA
zrT0gQwuvN|OJCV;dj{>K$jt(jJGtvqgbkv6<mhs=>;I%t5||d=2ogUQTje5K&sq@M
z)9y7F0F*~L2+cHfx}-&*vK_JHqj?6v@@2Q9^HwhTY`K>owBhEo<IQ^C2<IPG@L?S^
zdIA7GT9<fX=|F!VM4O4=GWdg)=!LmM8_4Sk-J5sw`|M35Jrh1!Ag553NCLS2+P=d-
z%JqE<;CU@vDFHyEpTRssqQ?wZJ%0uiaJ)<G3anuwMui#%lsb*LxE@5E0K+X!AInjR
z`C>1XTIsCjonf=xFRz=nNXRbE>24?qytSV%_!#(NIe>`uTd7~_Mm07_0EnD)L<76t
zGr7hr8kBVqDV6{jI)A;Ug^)tr+tU{_2OH$n)V|M^2+)0#9!-~6AqBw5G2UIXWzd-8
zuZ=v|RtM;MncT85`5@|1)1IfrQaIX-Rrx^Nu;5JHJWcplA;Yn+2_YcHXf7EFT3PJ<
z4lK~s0I-y>2f)cDhZQaStplpj0f3l@Rbbl}+Z~a)>I26Wy5TN#fYmpM>K2lymav7F
z`>vPmVzNcr<UnJ{(RSE*9X@PpZ1mum(aU{$89<~}2Bb9K!jo>G_=pwBw5_<ETDRiK
zU&5dKRt;c<kNW}uh^*o4!qVs$^DKZmDmPs5?W1H*0X9BS{xJH>mT6Lq>x~N9FQpqP
zyoD}6ef;Xfrn*Bm;n^XBBm;LkdQ^u$Q5C-mQBqld5}etf)-C3(1TY&WR_r#y-mUAV
z3p<xK2i%F@D(f<|1psvYcGu1%Gs(HR-3vom5Ez)BZ(e!?01%q6r~IggKz0XKJA=#s
z_)!yMo~6C%=qC?_-xg<L1-IOL`7SOE$sx3X=uyCJj`uWOi;O<iFh|$OvNOe~Af%Vg
zER}BnFaIPIhrRj=ZsS>R1RL5bykwUA%ou5s6hNlMj7$P{(&Xjtq}Dk8o6fB0=lhMo
z_K-cm2I+~YLnTnR8&gwzW7`WjAot*8iAn!xU?)anNz4TRw9@!y*9fn>PsWMEhjCE9
zICZsegsSC$=G{Ck7A;A4Ffk86I7R@;%Iq>}&GidGQin_Z(zep0Qj3wtQF4afp>o(#
z*rf^t3T!3$M^kj6T7R_ka2R^s;p2T7n>r>SI%{|%R|GOxPhUu;pgqI5kpIG%1!2o5
ziPQw8okv&7-cU0T|2DA@fds*G0As1>1V0Mh-roe>&SYDL=&anUmQp;`#YN24cpmkV
zjh0%CDoIYc?+**y6Fz#02VIKH_1$x_1!yq#o8w%D^n5fi;IwKo@cNToZJCzrF}<R=
zn~~dcK>IF$H@m_#fyS`(h1K>m`GQ}4XKOZBp3~5a1|a*)7{?sRo{{79hn|hHElsJ=
zOFZ~PacCqUP~11lB$#fUPT3$u9HB&;D&C)siuPJ-;hb!^(F~4XK9Y7{2@{HOWnU#Q
zw~eD3m_n>!k!u^s(iOK<@)=P##^aalDr!`eU&esIHJ~Vc^k_cA8!KS%1pzL#fZ>3>
z1V;c|A|jS$?$`E7k!nP)e*pTh)I76h$$ImXuTAL86`HLBI2Ks+jGs!v-THAHs-E>-
zi8d!C4AEPsc#<5uu^giWcVfGwBpH7XjbTOfI^^ShkaHdRAAXQ3)ZD{4A(>F3DfO*a
z3gc9>ydmd1SE3TBL?tDzrRorR0h5G;)M^v8?A3Tv0b9e6qqp=KfTh1tI?V(nuwtbf
zs&nc%rP2)#-HhXNDbbd_YSJT6%*nCk4-aym2T31E`)hEC#a~jC=IWCV9oH9W&i8nG
z&mXBL%{*Nzb;7pv_(OsR0WBxzctgxqj>!Po3kiYoLqtBhvY^vMx~W}Hx(B-H#8}YB
z5PD~4{dY#1^X{`%$rj(tE*E-@W@+=i{-}Oa1~j(?&F20g2mM3XgDpL$Lf}_W+F`Zy
z4x1kGb?XOX-`Bh;e_PWQJ9@C{Vy|{ebwM(sr%&)W&i>Q)wY_iph`$tk%Lya+#Cia@
z!OC5~c@Ri9a$RA)Bu{7POl$La`Meo;qv>-rlYrtfr{tQ+GS3PtU8cc8qd&GGxW$eJ
zd{)S=E%>NNcM@PISHq3+E}d2Pfxa+j0ZcbOdYvxU8>(4++t~d-4oez~j}0U!UoXCj
z_%<QMJbE2ROox!_kI0bCYCveiU%sm$?T+ah?6&<<r2AX@q;dExojoq{K+XW#=$$LU
z*L|s;gO;@XKgRc;M<0R{;R*q727*6g{hvo7g%iBLS`Tpe-#-$v5>%iEI0OIV;@>x%
zhybn~5_NYI^@j(42IaqwJb+iiLy}1N+adTzn>Jm5FE5ezhmrsCZ~pxi#(;NY%*^-O
z1^j1ohhaCa4}vlc0a%KEJQg_Z1{}#Au=#Jj@~@`+^-tQujpG3qlz;;~{o|hg`|&g3
zXK-}-aQOcu!JpnrG!p}!C(QQazW(24^pE5E=SXwo-bklE_%972@bP8>T(5<NThQkJ
z`ea$a5et;!{VxroK|?A7Up6=2u7mv7Cj%~c^t}MnfA;f_eM$zt^oHDVy#B9GegN?9
ee<#LXLE4F)t9)y9=)VR0$;&7|FOqua`+oqj`>wG7

literal 0
HcmV?d00001

diff --git a/static/nic/gke-creating-cluster.png b/static/nic/gke-creating-cluster.png
new file mode 100644
index 0000000000000000000000000000000000000000..ed4f3a64d3e4e27d6ddd6b8171d6eb28334e0ba3
GIT binary patch
literal 66820
zcmeFZcT^MK*FK60QdFvRLhl_xIz+liRS@YAkf!t&I!YHJ2uLqMx`K4+MLJRil-^tD
z9RehfJAA(F^Lt<KKX<LW?pk+!Sramu%$%8h&OUqZv-k7lowlaRJpvj6EG(>hs*e?)
zVPRqGVqx7F#Jdd~sTMaG0X~@9DJW>GDkv~&yE<9h*;`>@amG4)Xi;m|Chl$#N_g@$
zi&!#3fi8jjA-6tVt{w@~V|(&I-njgS<Rcf4nU~n32bb0sn6GY)bjlg0-<Q*Nc6Fr)
z5x0GZr1|#sn7-Tp%oRF=y6NyVLx=}EOV@L!f2OLjzM4PWZ1^n|^ZMIDT0%9u)F*sr
zUk4Ut<QGmL5qpxvxi2vT4r7MI^SN{J6qgz#KPc&fH!1Th1gCLAu*<8r9t@&7;xtr9
z7+gee$s*G4oK=ifepDr!Cxg-|$!MYF>4qMzTi;451}!6Q2l!WMn+`sE|MV1cyHb1O
z$ImSDn=Dk_%-+9ztcykCyF{r@%`NY+M>^X{DiH*S-aL@*6%>Stmj_|zwKZMsK};%p
z;#WY7n!mrjS6HwhU6=g&I+(^EajRA@#c?ZekifKOlJ5D<-D0er?q*E$%@Eu-oAG;r
zdVVcF$|(3-o;})g1xQ0i$W$QE<&jqUs@57BSlqxq9v1cu8Y~=O?*{Oay+Ql$edQaR
zShxN<eiI8T+zt!-pXX=-@7I4HfY<dk|9HO@7lwrkd?E#2URgK)bvCwc)~$c--xvhG
z!;;fcP*nxqbu3-2tQ_5Jo!oN=F_FLleCNjoZdh0pY}c<Fs?S*Wf%eDkboJf!HPj_7
zogDZfFP$u`_`MvQuiL?r_L2m49jx3Tj9w1*j&71(GR%LSAqnhX9~NL{{Oc6=*D}od
z8rqBsPOesrqWpsVg3Pi6jEs!Zt}m@6pD8N;^K#&m4707fyR)Q#02B)4hYIsMx!MQ_
zNk~Wt2tE*a@PH3EgU`*|(H-K&=jg`rk4FC0j-r*DrK_E@yPcCG<8`|b3nveE8D{3|
z8~yw5AJ1v!W%r*uIlBE*EI>ek>u&^v_yq<2-8OKk^z~6mZ96Y3djmx~2cXY@d&r82
zK9K(F{QvdMfA09VEA{_#rI3)I_}?%6+gJbd(&uhgt_n^Lz&+h%|1)0yy!h{5{_{d<
zfoswK))oKg=f92u9W6^BE%5I_lO?E`!Mp>;k<Lz03or**fR_FBhXDR_0<Y_L;Fa?p
z%d>0=3+oY<s-m2(*NyEAoJLURWOxDb%q>+snwj7bit(jgZO&)LPh6lprpA$@rL~lt
z&x#*&5q8dkf)sxG9rX`1q*OwoL%VbFGimV{l-jO@jg=>o8nf3g)k3p5@I&zt_8+$=
zWM>K32_wbsS$Gj|{;*-+B-Q;${KrcbvzTw-bCbW_a3&$X@rUh0R<;P^P3Avs<oJ)Z
zKjW!~NB!xR5pS@`^ZwKzaF@czkAj{knM)e~SsK<t&U=3pBjS+~APD!((ZxSL4>O~j
zlHLDJ4{?)z$a+SSOi20XN5bcRa_i4+YRA68PKf;OUi*h`1s?LT_EVZa_8alrNNm<Z
zUF`gJr9VGXP~^y;`wdT*l~FE_SrEkk=WYjv^7em+^1nm*rzr{O@PB9Je`n=?4J_bU
z{=YD=q<L={0%<lKeU62ZXGQb1P}$45_hP41j`>{O9&YMVnMN*Gs<X+KXl}{+<*lUo
z%k4qTxXO>y9ldQt7lRFK1v;Em>3IJ0-uXe2b5DKLvFGRsH3xG41(<5d(Q928*`=Z|
zV`GN7ADuBdKmFhqhs&)CYdEwO#84;Dd?^u9x0$6nTdWh4L@hgnKJ-<H^QRS%2;CCf
z(EqV_rsg+vaB4kYuq9k=1daV61v>51MmYMS-H`izW_2~PSFM-5EMe^ym0Bx_CqrF(
zUnsye8B+N%aRKqL)%+9-Ix*XP{Fz!=$0%MNSoU&_VRLDkSEG=Lq)Z25pR<W$bJcoV
ztR&6*i_7ds37Avhk{fb+dOlPK0TK*YAP(1ALy0K_xQt&Rb&%;qhzzY}XgqAbPh)TN
z2e&M!|KaReMo=xLu5^Z_)DKkM{wh47z}@nF3K1qO{C2~*ELxThTo;%>khn3*)t`ND
z@7`6b32MPyrT*$Hib26A?K7s<u}O&o>hCYTYS3>z#nnaFjR2uK#lQ`BcIh(3Ftx7^
zgjYk4&{Fet1*VuT8PphbcOa&P=s+}UUfl6Og5C3$KYGO=J#2HO<;>uygv6-;mO7gB
zykeKbdD@|-&Z+r4e^I%M%JQz*<jeRvuKeV-fd_rOj@#wkjuY^!SaRiy<TK<Gp06ui
z41s>gotpW2Bd4Z^a|wQ!1OaW1R9oipmcT%<-?}=XC{<5oGkV``A>>+`Qy8D{pm<Ii
z(0q2&YBM4AgASSf@3)xJwPepbGz43*OPuDLcg0%H-=_s!Y)Ii8ZdVS~Q=0h+*@yq$
zEGpgYqI2ul?4At6W$^pigt<a3B09*lwiAsUC8mGxpRXpF)l2QxvP@R*x7`W1(Gq>>
z=e-z8Ipa1YLwVYPJp8FZR0o~+7qf@^pH9xEyA7tecrLRq1&O!Ts_cFvKRp>YYe4O_
z%r_kkN;&Q?v^tKca@;$R+$yfDpR`W<`it#LS1iuOn2}SR3WNWzfG~HJ3m(fD>B9(L
z)J{#j!srH%rZ1hMA+?CDwyWQ8l96Lwr$5p}W%h?l?l-&ql>GINA7ty;MNfX|G=x$Z
z7Ve*&P5Pc}uIib1{BCon>BeM7@o(m*yY{l8i=|D!r9Zx@=KoG2pSpn1;VflP;B{$J
zwNto970!rNUz{30b#G-DRyIQ}i5DcduMUwZHAy>fR#Cpt7j%bzJwMH{K8U4C?K<YH
zj{$-@$hMQ;nK1PG{Jbl}`JhSS@KcFH<Y=9ezY4e-3chT;H+32KBfmf^WBi0`otPc>
zLZEWzEF@<%+@ua!?D(TjQml$t(Nk*g9<*;6UiZn=@A0&LQ^0DqK{I^X|Lc`wn+q*1
zyk+vpPT-llyAP&*8Rj?;>QkTvtvMe=F=%>sGTECOp{q-!tSiw^UY~;C?(o1Po$glh
zt3!KfOM9dYGH-f0NG#qLhCBcXZLNI8tu-5Z0P%UTxOY}pNtpgJNNDz=dAYgUuvtL}
zQd+EFTq!uhA>+Cv?Pw@4mOH9&A&$~Oz1#`)ZMY?t+@<lmq1^IYQOsW79*UK&{=C9}
zraTS0>!&Yn01s^1QGhOa?BTd@yav0tOjQeuL|B(LgFE=@FqOLq2>xR3*W0!8-VnY%
zSv0!)I|2o<Sb)%KZ4s09Q6aWbH8nHOiTpMLF6!KZ*kv#Q8?w934AzNRWR-IBjT>1K
zGdE2c`zpqp7Akw@v^W|}!O*viaqP6Ie$<EU0=o-p^PYhXsO1@!7pRk$yC2@?<Ga9R
zIW-kL4$aWT8)cON@TH^PFtwN624e?PqDy$_4Xr>|27eLbel;_E7sxxdMCYxN21jD?
z5!CrCFYH*NAj30tYqTInq48{)0h2s8yCIgrD(OY*)L5S8cc@&B0_Kn>a>h+d+y<B-
zP$P$L&kK&CMA1iZjQa~Se-CEX+?WiTOz#;@sh#_ZSkuTk-@Q5+<jm;hp<1_E*iQBI
zAYWzwgX)IGqoW}(RBErW5_QlWec@9%AnI0BT=Aq`=rnlWbH+ubTY{?F#V;1*@$2dC
zMuAi>VMx3Jk&Fmkz|uPoN$eZ2=(R9fN2+GTrJUcSWsFSRY?-O$`-gG!9?f@8?!DzH
zZ5)~PI~v#xX9(!IyENW%^=;aHR3rFJg7=$weU50}V&A={@eJ>^lv829Oy@Ryjm{`|
z;FUy2Ctx6A)1!K-PR5KlT9&K2l|z_ILVs$%bf3AFB}}15A@_h;YW1TI-4dO0^U8(g
z`vif_0=R#?hA94$+1$g&zIdh+vZ(FlHK4tfpVr=u>JqWoi5H}9#c|=IbOLoNaf*UZ
zlK7<W41KgIfCu;xUrxk4BH*b!yRtVLMi5GEFC-ei`kbv$rS;c@dk-uJW3IN1!0zED
zSDwM<t+ux=63vJ<h@~T#lnafUhKe0yAM2_@vy8Y3{T8H3wm?VOzMW9df%OPviWe{P
zM-rHw84s11>T3Z#&#V-Mt=o=$vOI3vRFU1I8Zd_#SD<)HUbOav=;3pZOP_t7KA91l
ziFsN;(=0-vF|(N2bqd<9Y@({_&HB+MlXy-Bh7KQ$o{<nz?n+mtaaewon-t_le+i1r
z=(f!dq?Zm)^G{u5xw91Q{#*{Hd@0*j_x8A4uKDqE`v~zD-fyFxGFkf??}s(4%!A|y
z?*?FZU3T|pNN{ic?3*L>4m-j_v~&-VE&XWwfqHp7*u~MfO%D<!?TYTJ2Z!{johIkS
zW06)a`h^Tm6Qv0Y4|pnRGwnIJqt$kCz>=M?#_ppB*=yku9BuPo!v`1H53Q8#U1)kq
zbyHVcjw`z$HvUOjaY}i<)epBgCryM5LkW?0h5OCZ;)W_96Zp?@$fcapUAkOU=)H5(
zJg4j&bk=pp$aVQ^7j8lUqs#$02o*aAU;g6kU|FJb{(j?Lj?$n6f(|-v0u6QZj>jam
zpxG)}E(0;hKsoJ&M{N@4EAe-vS_4tj^FeRE9|#uYB-xnxpCn8NpmsnRfv~~m_W_@|
z3x85K9dyygs|j&O*nD{%p}>*h{)~B3UmWHGIeyen#k5qr9NkApGMXU1lxp|%t-}VP
z@bpMmVaRd}xEbOmEEgI)DzB)3)gI7c*LEsKrc0%yY@8<8?L9E43YI#@6~Y%1?yF}m
z)b~<a4FSbp!EmBT*b1EoOgtw$`6_ytH~PZoNp&BT+vea!JfbC~+QA_YJ1liQyYnOM
zJb@zl7pQ7c1Y&p_#F@{!pLj7?AURif47cZnj>o#OvCt~#W>uX3C=DTD&6SdT-R&gQ
zgxYD057~2HFFAEOCpyTOF7;C(momS!n;9&+$DnEW>l13F4?goGTn14P?B2MTIteXy
zIt8IryPUS~hrP)G!!&KTQ>Bo{wDa{ET0RnVN{F*qGF)XFcRx_KQ_V1=dYXQ3Oqe+~
zR@eQHETSo617hvirs~u*`Nl$qJ^4&bj<Z`*NN=5&k|ly@C-e+#SAV#BW5~2tF4<>o
zz-e{^g9e&dy1ToPnX~qa>TBz1vEW3ejX(P?c}KXrPwi2J#O#VGmM|^)x7O}rQnPFK
zISH#@cXFgh!`_E!k=$Aq6D94stCrx|Q=2C1Bmx$5Ph+bmV&RmpWlzTIk&^<mR~V#T
zoaq|eC5RXy8ozTn6ySVk?*vvE%VFaP&N1rNQi^)-Yw8?>sdH-Ci)hG><vsBBn@44f
z#ShaPyTLsQ2y^oDkvfg0DCft?H;<EO=hQ+5K$lfH!I$eX6BeS?myF<E8xC*=hl2@;
z?$Q>qK=-+ORc}yy*i&=ZeanuCW=bN4;jVQ7#rTOOk&hI*y+Bw-KW5es#MEvS)ZR&U
zkw9cd9K{6NHLsNfx#t%)UR`W`ir44{SrQOts7rn?w+bcM(+Y&Yj8hFd`w$T22SjS3
z?qBNobqq`DH@R()->V|PnDe0@BDwV$<rp*qy!%T>OT*Ejyp!S%$f1L#q_dDn@<^1=
zaxKNiQ-#h&@j>1jv2*vI#ld}?_uC@gJ5#+qx<rC<1frBHCcI0VPE)4?F_$|wUV8a*
zFRA58hhmtpFHcGX@3Byx0o|<{16%ZiA*^~|fGl<Kmx#OYSd_(?9)IxkqHYz*102b`
z&=hVObk2LW8MT|XZ)NmiIYMwG`{r~nj8#tE=WH=tLc07x5W#4b=d8#0O8Rk9ajXE{
zs5+h88H-HU?aIs3X@R+4`!ZXTDWtdvULKypUwj-DB|oa`y=!~%$V(I&$x7A5)Qt?}
zLWg}|bKDQwR2t*n0ZFJwTC9Rocesn_uNr;(QR=N!&4GiO!V+8Nh9SeP#%pg7@&z#t
z?pHMipDZI4>Tk_{A>jrBq&(CtzCfsv`AU~V_`u@Y;J&}hXNIR`4GacvG$iE&kTcXr
zY)JU{Ck2?nc#NO-$|@n8Ivv`_<R-4n_Djfbuy{$r0><gRg_a9#?T{zQxF|vw!jIkA
z@+H4s+JIwbW3pTKTU@(NGv=49O*r@Jb|#QbnCJnt2uBE`{iHX$OVaM-#CHdZu+W4n
z-ZXksAEZ>xOzRLE3uq9vtj=^vVmcGc&r|q8ImJg=1vK5JMK0-6xk0PUTMi0j%=IQy
z)SPjBGyU@O;;15F3mODn<705PCHA@6>0}R4s>~@37|(EB2Eu9HIikB3x`|FqQggBx
zgh8p-y4ySbI0~xm+P>Y(jvdb{+C`4VITWIfMtQiyew$7)BoMVcA{((uz}+!0f-9W{
z`&b`<nVe~>e5iS{JVn%W_RVOt;3>?PZLc%vr6~<}8fM9cFO9HmU|p+*ETZ#6u~;o0
zZUkopkG>v9i2;>2Q3{1FF*dQ$NZ8&z$!K=d?doaAcbEvt452o;^|B4RM)G;rK0aE>
zqnTTv>R>`iP7=lHSx=*y?TSA38YHp>Gdl|e4U1y(MCtwEw`c`g(5}$SlkxD&vqtm4
z$_+-kM$~QthkU!?>#wV#Q?@z8$`?d8f01cPlZXm?uxD220Pg8-TbmDZH$xqDw&N7I
zRSm@cWlg;de))nLy&<`L)e~)2=X{V<5*A7ODgvar>}x}EmGZ(zGmLBIN-V0xZOPTG
z{+)>X_}rd!I?jWVTfAb6A(Nwl%drBUgve2KZMl~U_RDl=+E{_}fG%pA5OEe*Rp$`>
zUSBU_TY#tVWrkUPdc+>nl_>|2TflR<P`5+n?;pu^4+lByQ?3)UFam7l*K#-*W_O?d
zb-FGc0edMp2WHtH+W&AbOhY`d(Q7=V9a#ZdcXr;?iX}<_XB^cxjKn-@CH7f&wxQOs
zww}GhN6wZF(_<w4G{uIFK~4mRlI~KdvIEH5#eyXQ@CnNfE&G<C_w*M$Zt-6kzKDW2
z5;;6-JQ{;Avowc6uZP>&qw3+``f1M^5z(awxeO^)BcDLb#M66HK91p!%=OssN{L<-
z$I(~sXAgdzV-l$D+q|3&*wO$sk8eCCBV2?C`Yf%yl{3FX`z&zDPEOsd!LemBj%7dQ
zC`~3)6J45KQ%UJVv7PJ~+Vd@o(!pNw*LlGFm-bV(8!LX0kK+<^HFv^>$nqstsdJJ{
zkF#%A7a-j#5mP#B;a&E`K4IUMg_X+dgL>hEC*FHk(dhECbh2~1fcA4%u?O3I6}Yl#
z5dny8ksPCCv38Z?mAp?C=K=vhFlBcrgMv~Et^9src2CE2TXnsdg*Z6@zdiarxQ~E4
zy<Hc_jh`m!u7{*$h=LcDQ{2YKHIFyTTpZ$_GG`0H?cQiP@rB8O*w?(rf=aiByOe7g
z;}*QCU?$L6kKIU~61?y=jV31J4ni`PrPpp2<Z_{(CB(}+_wU^zYGZI}JZLLSvetap
z{%#oVwQ@HjFyBikh`rB(L9je9MX&QIFE?@E+IPzE62ZO)>6NDL!%C2GW4D1-XL%So
zKDWz6gd0zBnY=j1B?tXEX}Ae%;Q|#DFw+Ebi-P2VjES<u(>+866kuQ8Il*Va$8YE3
zCx8fpShLcVxmge0q)ESq<_?OK0mH*Vp8C$xwDZB(3CUs2K)s_%`0cQvw!~2Bpj#H)
zFo;Q>QF(=$h0Xc&-2nwnL5h9?p}RQKg$`?B2a4E<*yV6rK&+8Lj{$-Si_*%BU@-vI
zk2+p_2YLLKQq|rdA@~tZU<T;b3oo0ZhIFJdUdCtov-vE`bSrVb3}{k8n>+cb*;zr#
zY;Qn9s&(SYi~+)a-Tx&Tl_JnyqW{xeVN!5pQBRdfy#>NX#Y_KIr+@_%g+=S#ohyDc
zAUyIw9;?f?*hUL3kP_WltuGBb>U=lef`~@yBnT=~2z~inETqwspOmo)T5?<{C<9U;
z0x5)DRa}+H_X0fVy%zgA%8v}B`l<3ICd)l=637X?2Zge4OL@=+mda|aQWud=J~7le
z`yFi&{>#9w@X1va{CUt5)4Rw0J64?^YL{v6&`3WAo)8<5kkZualVu)>{Xr)skp<5D
zmU|bK-2Pr5CT(<fL`?wXrxU_J9k`@Pn<3;^Ab9eFmjZnIF4aP`#9DIMR_f~#e4T`|
zR(B@9mX8n9vD<&~_PygSTKkFLQ9<`Hkz99am<mQ1bPu!Fu-8m1noZnTr0=(59qoZZ
z&12Ye?2}DHY~Oz4j<$GuBX;>50Vm=?-ha;u5xLJ&A$}W?%U%MQr@*szhPL}0`GB%U
z+1c4e8MxiOir8&D8g$l=%_5BnS&~$rhJ3^e!_cD-UmBpd@!WEaj54@iA3uG8L%#c|
zFukW<rTX`e_H;^wMgXNmUZ>shEOdSV(uzxVE@GOZ7WCv%4j4$%=iIo~pLg@ANBJ3I
zyU)Kq!IcDg@}_nap%)tCpK@43QL(~jt%a{P2th2AqR1So?XOp-JST49S0xHmUuZo2
z{K(~2BY5UrY-VPJ@?J{p5v}db;XB5D4OqGJ<5#Y<8TH1|=upPDdJ+U9?{I5pV%O(A
z)5@?tG#9P1Yg?JX^AQE!^#!e$H4iVswKv^!U&wBIBRgJ$bjJ6kf-tet?Q%QrM&QKU
zTOlOaq{8{P_!`GYe?-3M7-kOWy`vLpAIgz$$0vm7@O-k!(d>HL{>aO<-(k+Izj4k?
zGn2`+^>%yU4_ZKZDn)3q;W7e#!rRLIwev9|7UUeoC0V41KH5|GET4$cso;@wY!G-u
zME4;k5B_cQl@?A-z6ne6BLkt8iavffu^DHD+O)T~a7E9~Icb$Io&q}LqT&#IPt+Mm
zL22TZXxeOlzeVH@tdoVF>;kT?30TYj9;r!0TVvxD{hZJx`G)}Ce%5_U@J@d6pqtJO
zyEUAImufsJ3G&S?N|s1s<wNcfEx0s;EQ-P)W7#Wkm>Yax3nPDFJUk2u-27ZHGpxb@
z;_vi#!#uys00L~1vN)Sly;kM^KYUyP4THqmG}~)d)fv_9w_HWiOxX~nAOf9q;_&2=
zV5@iLLa)&u7#$g55bvNT+isy77I+$XW<m^lo))16fRl^PYUAV@;eap`x|%lHd+=Z<
zWV<r^2c9+n=4VE{<P5M{f=?nFQH$Xq0oqX(U)I7$+Uz%(1tp28zT%M6c`fyjwQ~?O
zKmB3|7#+#&+GUD6+`N#6iRK~J@D{Hz^u1>4IFLqj2S_qsQ?RWo|8?2@gL}CBnP*0J
zq`Hf{+(A#I6Y#+d-6960$y{Ld%hu`>wWFz?tZdpyxYW=KTtp=ufAq8R$wo_kv~zMN
z<nFqZ=I$|dIt~kea)Jg?4Qlm^rAyTB1ZQ#B?~TVSp3V-uGAFF|>X#{7F<R^_f&5ce
z*5Sfy6Z%{cpXDYP!Ajx7j1dt1G13W$${_ssSG|p9+K|R##@QORth#>N<aS;q0xHhl
zHDVuq5MVJTc@erW6mrR1=hw!Nk9f@o#IEd>JA%gje!ryjtsfRjQWSiW1YFhFkIQw+
z#MMDzWyG(Ow;w6<tH(LC_3qX!M@!9kBQhxYLt2Q_9<+yv!vZcZRyE-e0@WD_Ahh_Y
zy6VIJs^dyv6R<@dt>4Od1BoFj$GG!cW&x8z@*lW_#CPBGc~bRq-a)4r`)uSb5=*WW
z6YKuI0s?!Sg0Jb6F@B3;%!H%<_FNVnl#1ySy#(ClXD&dr9{!owz1HAq7zw$1;|8q4
zN6lc_m@IjJ>t@WCu`lA0N;rvZ$_uUFCv%VEym081zbvHJ_2ZH2>05BWU%jI!*-<}X
zzj8;XkXZR~Lv@u$W)>;R_}%CTU(L)CfAiTAv9vr1VazB6xIqJC`Gq*=i{PP9z-#+l
z<^NNIxPu6;QpD*Y6fA`Mc8cDi3FNx^dE8D3tZl6l4|Bp^URS+;>fpo1f_nEbhZPN$
z6Pq#{Tntt$#rC+8JdM(Fp$Xx7Ftl%@e{0sl7AuhWcW?<OEJy*XY>`wN3+SZlAAT#+
zQ__Y!%nFp5EVmfheSHe`Eft=zc{JwVaV4AV(|R9fO#z0+X1VrR!W+QpQwPckgt8$2
zO7XkXi6=j7BPfT`!IKG^M84h_1~S+*(`{#B7U^V7*Kv#_RT*E?iU$zKOZ~RY-=Wt^
zZ0SPaHiIMYw%%O4*=OiTIWHZxcclIx0T#;)6FIoVf)+6hKND$V^*6~(vJ<i1GpREF
z^r1Ua5l_~-n)P8z<wP0HuL@il+QhK6s}dXCAH`&2q`D&(Yj<o0#~Jg>SB@@+{H<!n
z_9blB@M)BHI_wHH0e|*wQJxyC?+s(iwUP;b#2a@1-5q!Idah+7Q$er=ML1--LN+C}
zt(V{0PR<I5tf7F?HKyBy;OYou`nh`1=jgl()|9-^&lsf2*kn=&3psL;j1q`qR#0pe
z;#aou`<$2fN<4i~;z~UEOYpFP!uA6F#`o2)BcsHRH*tqFIa11m^jJ5iYn;xaTgcFv
z=6E1H`Ysmx<G^0P8is$=WF9Ybj^I!P!Mq>|nHAONYiS&Wb|mo;mH*JQP`TjSIA*Nn
z3}lkOtM7^xlaM>>^^=afS6~ie0>zb0fDm1GAJc}%AO)9p1(v$(7E1l8zq8i8gb5;s
zAL#>%*KL`8N?d&Qz9&LkRrYZyFB!N2pIaQ&$<T+(;12Veb#A{0Vo5I3!{b(3Rjhs7
z1()<rHn+$}^V58?AS^u~dO132@%Bq`R+~p8Y_+8T$i)9UF_`e(maniQ!#9!EdUEkg
z;_jmwiv+kk?#JhD`Z5JyIzjctZU*^h`N7uErbf%D5`A(xt3Dkw4~*Y-rL#n0y%mjC
zY<Um~4>jaqJviHK3BgaQ>*!@$Hoe<FF0ZX~LO(4NF!G&sLi}#x!!EFLqQ<(4CfXr6
z*y6NcRAEfwKs4V~NRsQci3FMpgtO)1&<*;z;l1ywOMUJagC8@+WG`gxhYaacK;yFF
z6FXj>xD0o)dgLmu6HxxuWiedR)r#&H`T>;$qv(c9fyt8<t|N9eYec!k?i3W%93r^1
zr71wsysWa#TY(%^6)#0?iMqY&KOBhKmGN`emjuH%l4fMlk<pswr2Az88&;XiA|GWF
z=LfDc-@MeamT%9z<B%!ATFeGRj6kkKDX2G?NOoOQV)di*sJrM!GGLJR$I@zQ4V1fw
z(qC7A`GB<&nNv=VJZ{F|7Xv`yM){m+qJ-pc!S5^GrcC4h@J;#wLKdhm$xTGGbGiD_
zFeD)}2AegQ-W9Mj`IY4gCZ5_@LOMYQjesxkhj?4s4?G-qZ$ZuOZ6B8zKh%*I453?^
z>qsmsU(n(W6XXs~`1HlFXo-`8y!aNV^ws?s)^{qwf_bpddM`}9^BPX4UbpX1;&ZdB
zcU)<n&iOjke7^}AeFUugU?UdX<bDPebbX|{ROD7UcKe7RPGW)czWa$bnHz<-EXvui
z*D)PKjzI({@ov8hV*U--Q}VCGx{<y34W-968Pe)h9@yl`4^DpMFQ>$0RRj@eCZdpg
z@PLpNv7AcvGj-9;sOzQSF%WHi%L;PSP0zI$pz~hqG^oFovHNB<qx-a$j85yk)tf_8
zdVn6)_ekty<#z!nSIV82$M^e%P6G(7%RyTlG*5_zx_1JB2g($k->_a1)4n=pkXw@@
zZ1$2Ce&+fhHD|l2YY1@D9fa~JW3Fyhhw4DIi_Fv{+PFmT?sTS5qeZg$0;b2mHmt8?
zD8KFiZBzvHlA>gmsXo6ITE#i|+_P`j7D2{4#6ZyOsXui-StChT^`Muz3Fb2V(4Ij}
zVyNk8zh)65;pix4*|O-=zax(7pu8&!5j0I^;jEw`PwWoMi%2?91GQYp;ocfKHoS9E
z!docF=9t(M_;hOi4iEX{E3+A*@lNjtW9r(UQ!$5`4~^9WeMH{s-{m6J-G^H^Z30i;
zL88Js^js9S5&|&;EQ|O^Ze_T_)AXEtsS{v%r>+3`VG8>!e8$N2K$&6Um}cv4L5xi<
z)>1!Ex}^48+zZ-ZaDTZ)BP-Fr$XV1N$QDj=TV1Z=cW~`(X1%FYd~R4*7MY_?%81jL
zH@##UJmA6(FZK6({U7--CP{y^i^{AjhyM?@BwjbecA>A4Ir_SSVJ+xGHDV&FRgxIi
z@>rf+A#7I3uJT9ESPPTOIv=wui$IDu6%jJP+AapWBJYEQsG7Fi_JcqH3X1O3#h1U8
zBlBKlEhV2#TFQm`!!jXYYk8f2I7egNWi3E~1OWvaY(QlCwnfl4vs{txsc$_96fG)k
z_HkD34=CQf^hp2O@|T0G!~+~80f<FUq%|?c#sWH-SxM0q?U63tqwJ9@^%GFb5lw}S
z_0h#4;rzp&=bc^q8KxKkeO`j&Bd1!7%fj{|pXW9#LG#c9HMAD6?EmH0H}0Tb)l6i0
zdm`L)LQ1k}&a9zl$;vKf(!QQi{yu1^`K&GqJ3$7$o}?D`J^)f@<QJ2iaIZbOW(dgc
z{+2S|ky+dy=8NDWQ`UL2-FQ~1sp4~KY37QQ8DESsC)yJT|E%nN+9@`t)f277+CZX8
z^*h!|oLF?8Yamf-P!jGC0UdQZNw%aR@f>Kbtm|CsfyZ^=u`54-oDo9EnJbw^iKH<J
zM#yB!_D{>OhhYuhrBdcPw6=tKgylmmNp$<iwJY;Jk#LmKu7!UFV1V(M$jslFs&JWj
zAauv>P6w9vFTC*5J(!#S`P5ZeZO6%8IG|?XFL^zi?w(6xD0M5y6SYjCxX@uzYww%4
zQ7QBm%{pI7wk;RC;pJZP9B|EjpukI^eBXKI&5iaK<dH+mzQS^BnW?P@O}@yroYwtM
zZ8GNSZt`!qEXx&4l$!)E*oKIKGN5242@}EV=X9Of^8GxXnZ1Qv9Tb^F93AR6EV-#D
zwEVeAb(em_#F0R8oKQ_^nP)XG$@Iw*Z>B7Hl(In(L35CL77Ih}(M{y5AbsAOp|r@r
zB^#|f+#P%tL~tri56A;A=kU_z2`v&--`YX8YmjqAu_irxdVLT9f?0Elbm}aNDML;B
zEleF-F>Cg(&`KjFV69sAYtC{Q(R&WfOfhe=%xJIl@ud!m_Pw54-GiX!g1@u~&&v)|
zeHjXs^fRVAM{UfE^+EfO2q`r#Ti^0EGn9F4Oz7Vi9}sxna8;J~io~Ak#(sZUEN-KO
zjh!J~@mM*aQwjq9J7dycEXDaVO!Fsy+6`79!Kl_tpO}Jp5-joeo!<7sQE(|O?Q@@=
zA;(WLa80_(%;wp<jxu1wj$(BxPkZ!a!m;_{uZ_pu^1r{|SZ<gm>I>XDj|s<Za2Q&D
z+?R{OWJsDZw@u1SAPj2!)(IQXJNslRU1B~@OQJi2v?_n+Ej?A=;8Gr#=;%`sCJ5t_
zwzk4a@H)w}9_<H0W1yy6Y4Z&+Vl%{|ouAWTi-&!Gt8w_;(Bd6iTsWZ3uFl77e1*yI
z;PnsrW<Y)*xvf=~kk{#*QG>H|=-c7D#xaAh6R-1`5XD<4dlAJkm*>^39f`hH&r^ZQ
z?L&jZl;7dk=z;zPz~mgbXZK@0qdgdEZR(J9d=}0MUS=zCc^u{Z!A4xNE0&9*RPWbc
zk+@&p{tVTi^?`4&&_yr_J?z={rDOlyIt05KE#SSX<w+5h_a7i2>VetISNrWm;qGKo
zXFv|#gv^ZHPA>F$9Myqt=g5*ddK>uUY#>S3iffsBo5jwa+ZZI5XCOhs|M8#zP?6*k
zJnp?Fq^bS^9#be9=4N=rlS9Hy9h<8GSQ!Te^C}A6<|7??=YSs%$|oiR@?hU6cG1f3
z{9O?2rWyG>pmo428}Ef|&AV|JBk9d%`!BmakPM?t3nBN0;m5~W`aiiyaZHa1RbPm&
zcq1=k05kHI(n#|pTMbmiTqtM=xiW#fG6c*Wghj{RhZXizcwv)dSmsB5EYC(%AH^W;
zwT@vz$}sfaFK<w^&p>Yoq`M1lqDn-enLgI5dG6hL=T(#nkAl!)ILRY}>M*m&i^ZfC
z!iH4*+h0j_`A<h1PY*_$1Vb7)H0hHio`pa6e9Vx@F?wZ^T7JI01#crT2yU{Rt^$@I
z{0&I5n(1?=kkRhL<|uku2>p0qMfqrJ=sch+Rb?;OF%Nym`e{eH=;g9tRIb0Dzo>g%
zQpY|c;PhhytCLW$FC_M)Y?iI?XUft}qrn)r#DQ#LP3IC}%T5efB_!(_Bf~ygq)&5=
z!XeBsRdyA$2u-l6D1NNny1_jvwf@NR?7WBU9hDtKo<`HvJ8iz7n3(Fu8yEOlK@ZK1
z_VxRUI7eD!S`z;-BD{spPHXMCFG@`zK1AakD)<|;-EI0HIUL9hGn(SAkPod#tyB49
zA#X0>%yKv`;Z})4`HdPfC%+bbflPYDIYd>8Ga4?Vrp?5gzZ=^%qNk#5r>B`)3TbIj
z&|aLnMjV_uAt7*5U08@L02iK$y$*_rKjB_o@<HcXB=tzv_dxNc<p|!4e6aNK(zqiC
zobX-m$GfE3ohP{UkF~vrq}FnS?LmDYy<G(1oU`HlBihWnDM1}04N%z=rHP1mwfyAd
zhh#YWxGwv7pd2Fcf_~Qq3Qx3wlJ;Wbk<8vLY3N;>hT@rciV7-{4%=IPy5<~CGK^<+
z_~2ADmyctc)L}1lrmiM1Sv_8I4n;R9vg(%03Cr$-vdQSzdPt2Joe%4Yp`N~=vZF>+
zi8nn|=$G8CsA)f(v{&G*oh~H|HczqvbflU3Fv^VJJmsYwLdhE5Q*M03x=h4C9-3Sc
zsx?H^{8Pv{HP#%;@bE>j!rBA-62AqV?!y^7ppxZWss`GJDHM0;53gsNSZ}g^VeD}P
zD(2BoU+52igah8?0En4WY}n`w0K>u>wtt#vhs8Vm1VPz%DDmvR@-P`RDXUE;rR8q(
z=%kIvqee;Gp(vK8Zc|SRXu&M*>PPm9c-%9%EbR8&VJ5x{-`_&Mv7j=pc!AYK^ZDAo
zefp^Vt7p>Bu;p+`vQu1!#B;1Z;&k1oK}Y5m6dMO#p6nj>2@rKN{$y(G&}lX#0g4|V
zD0D3tSQpvR@MF%8l0gKJ&Y~as6Dwqij-q{Jy2-um$1G{lIxFJT!?!>6>3xm#M|TWm
zauf<a!$s7Ie(T%)8kzO1I=!rH6b|V5_Y@nI$59$VPt+CWuNCC|cUytNTqz&-eLdur
z$XW&jy-;=ZdA#MGEUCJ>s=#d8?xUlw7F)L1)wK*(-gq^6z~xOa+#y0+b4{=zQpLp!
z^D3bO!SJv=$Yl3J5}hS3p#jAkQ-@m&NQ;WQylPnU%Tg2WT}AppttI->FkmX?ecU5f
zL!aGuvq8dI>+7b{SG{7pyEe^_v569~thp8{D8OPxvp<C}iv?ygYIAm5Za|r6pUI+2
zgfrhVmyZW_EOfAUjdBEVgxi`$=nj^!rRAvRZjc>zY$u}MbT(M9>p1uo;pJ=<leqFF
z?`o2QwVgFAR!kb>Cmg*ed(}2%bt<czd8$U0M*g0#!qSkfka*5SD{xWtKr>7gO2xyo
z*bpJ2HZ!w>jE4)Nu}oH%rFUMlS?h@S*fd#&7i<w{VRZDg7rhdd*_|euDhNiu1hd~;
zBCu*rV+dr>ldC|jreD|L9V+F)&9|dQwG*>Ocrl$rQ@kMOR`NA?E@W~oy5Z;i?)5UP
z*t4C0!d=99DiU)$?dJC;p@Hy0|EY?$#|&f`>r?`#Q6s)W#)$iTZ~JZW^M9C&v*yJ+
z75V?1M4a2C+U1wU)SU88+EbvK%N#a_NSF$p?<EFbgC}VDDYew>CWN+CVzYvVh?VQj
z#b-J(Dw#s}f}&ffHC?HNhWpJ`5Od0{&VvA?jVh7TI^=F2PB#k+)o}Uoh?*GobR>{h
z3a!ct!fW-=fGsSYIm*3!P{dQ%k>idR#nw(jsQ<j1S4;a{Qm3-{Qln5e9sm0D`6+d&
zcJQ)wI=<yWB?6zDjxx#`-4%(QP`|3E(vyMd3VM<tJ(Iu%_M{vFWBjNztb&B5f!Nd<
z*?rDCG{CL-;F>nF{tjE&S1$B1<Xk`fMJhvFV}#+amgg-UEhjNJ@l{!I&=QCF@lx4}
zA~OTr*X)JPchy?y17{mlyQ3ZK(#&UsW>k&tIg9JP|7s8(ZE28A5y%H4{GPa<0o9|6
zRA~zV;RJpm;KmLe9dghN{5^ZrpM=BIz=$X4nxDclF8<-HZh7Ybs`q|!ULby;2hPhw
zrtCMz7v8^kjbBK-!+r3uqIsF_Jmb!7wg&x;@G5lT-ae(lBze3cSD`Z)mNmIiTFSw5
z*J_sKd}|wI<IXcU?>*tq`v52joM{>W74SGN2jhZBz{=Ff9Mny3Y>$JkJR|Kbz@Zzp
zeEEAKz1*4#K;#IaSOuV?Q6)|&{h;)`9;;a`Mhb<)-LOHrK_vqV(Z1dg61YvqnBG4g
z=!h<Y%sN83o8Gq=wVo3l3$K>Bv{PHpuPF$O;gn;Wb>UqeV%5@a{mfU?XRdzK8m>H7
z#pElS_@xVa$GT{8qB&bDk;D3(jZrM;mj3RIx9_b!RTdYy+>asvqL8i53~xQPwhd={
z4;*sIb#+KZRVVlJv+wWtw6vKt+6avT&R1#EnY$6wNH1#JeD1}q+iwK}P67XQgZxIP
zUNiFyvs`CM+Lb-vsA6j7UFasN8;8V+3XX8R(=PQBD%ehSI_iKtH!5wii`Hp-OyBao
zb+}#2^@`j54!|gCFJs{pWL{ZnkbQ#oEsKg4<H_2twhpYB3X1oL%q8I~be7W-kT^;t
zYCCK_?MmN?KmTp1cY>@!O6t@#U)}SW>UCciM@-@3Hh_k9ouBpYDTt<uzOXe9oZ7_W
z4r%?ESA;pTOTO5jnFbMh@om@T)6P3I$eYz<GRU<(QGCuD;3!43_%=b0N~vPWFa9=e
z6HKzFvRLpi+R9gpM7Nd_0G&B^ckgCPfdTYqESGh}%a#)sJx_h_UQHJ8cJi@J5e|8q
zO06_%jA-_`?5@Lxbu~+_poMKi!bRv)C3`iazmy}LQfhM*dR>qv&L3>LWPz?;!dbIf
zrVna_w{(~5BnoJUcFNauQ~FZ7?KpvsFK$Frf_b_h3gdGR;Jt6WG_b(Si2K2w#tUO!
zbl~ZmTl(;DsG_Y$Dse{!@XV%EpIiaNRyYP0A()dhl;)+FoBdS4QyR|lM4M^bOZSIG
z6yKVDYHiOUcETP0T1IIeL|4(|{ZMj&`MzV${K}PcW7Y6>JWA#9G5|HA(@z|lEFYpR
zX8s*(I{kby;o4O20!4Ec(f3?^Kb%bDLUG@z1km{(4?BiYTibdy^U8&aL<G_rok#cv
z>%<BXM8t}UD)r>Ab`F`c77~ln0VqE~jC`@BzBRR6-Ybb%<lR}m!Vk^P>HR%i>Ocul
z-L3%umq-zR$cl?p+LV#}bS9YM9%SlhIDeytElwvq`WWsmJAbO<-+X>$Bc?F#0@87x
z>TEt{(X-dZDIz==GaK``sea<!t(EhZ!-ABD=j6WS=H2t{9DxAW%f{N@ElB-@&dS&m
z-YdPPpBKRlPY-jpgjEH^23D4JX*wTP?COk@yv<a8L-@O!A&`zP{&Zus0OF&p)iC~a
zCt&?J@M5Fj)2Ji>Z^LaZDdr>t19`0cPkYx3eqhrEAd3mF8r`e@O#BiDC}Y_FJoSGt
zasEpg1G?<L?7#oV>_2TI?G)D|6&}+k|Dsktl6_0WZz>pAa0-~$|7?$lSOBJAxKf0p
z$~DMV`31m^R31+rcl!?`^LwG{qoCeGYNz_w*IwFI3OHqo|H;Xt|ETWIF@UI8<#D{Z
zc+Dy_|HZ^8XZ7nH&+O;F-RX_nH=G2qc|RTWADM?!>EDk>wdU8f^!E-}3x6%=SN`EN
z^D0J0IX0=(*LS!lTkVSe-ui#`tH6No*kS1Qk^ci1mG~_M*@vtVi!1`oYkB|YmURgb
zQtdF}V`Pzk@1=k3S0w`zn&Q@T=l_WQw~4!>1#nVP-Q}6u|Epc#PFbDTeMD6lMD{2C
zsBPeNuY#jbLjKq^A3HEgosY=V|0Cw##t?Na(v?dw$NfJxEd=xj-|a68|5Mn%#Gir#
zBAv!q%6$4`(^1#`A*7AN@h2kb&#P;Z0_nE!|42|ZR0sMa>MghUAIIU80}$zQSzn9u
zk4;+u{b6`lxAhua_`kOQ4)Omv(6;{_;=j-3|9{M4(iUyAfBhD~e~0_OM*D9X{{O1c
z&Z^FO@Un*(382XvfaU$@dw~2GT5~e01+Lp`!N}4HU!5&Cm|bqZ2<?7tgCt{gocBA@
z5Np3HEYdNq%8{``@3YQS1K{WzfaJDV-LOOTWS9TR?-#ot6bN11`h`>~Ow1I`6-m67
z--{Vzt}bWAmtn%${GXhaviR_}>$ggFf%3Go?`~azk#j3fn(QdR3S8-;_q7+>$c-13
zscs<hLS#VO+=feP0d#Wxj%R(mfoao>gP_lPXoGNcJ*}##Y#o4OpT(gxURX<g%@6%4
zhx@*48Vw|LXMp7faT~(t7)LoV1K_pnzQv_?PBIIqYuK&dngQ@yi<;60iednjaJ)Wr
z_-oVjtAKA=Djc%_B!3r(PN27L-*pDyU+Pr_XInrhvn-22A59%Nelqf}A2;=_13(g!
zYmS)yS7eA)r{C0HV@jridJ|rlZj>~gPW?<_s??A^=%|B20Yq5+HCMo~m#g4zC>1lT
z*oN$^&+KZ6KHv;eGxe&dZXR=m{4ua*)i(S!NcGLSS`Be6K*O3<qBL2tPIpm8BEXnB
zqg^>l^0!Yz-#o<X!{c^pI!T<if%_Ym0-a%Cld;O4?%YOynd}YfjP)L!9pEiBrBAu*
zbMdWSD!M*R%T)Hqmh-oZfCeM&PeefruYw31W<KYqei^fjcHA+!@cO#);*O8|Gmu<p
zQU@^pIjE&50r^W&KwcFlJ=CicJ1tV(!>JDMb0ZJsZ{h-O?hbOR0A|vSm75g7T~xdz
zI&ELszh%HC>c0Nd8QpeAAl*A%^py8z;N_OtEP!X+5uGr<RRh4dS;dl)@KtIE*l%PD
z+{4cF-Iag>%F-a~f5GaMLqljg91{qDFL$rmb^zhDMrz^BEyMe-&drs_+!9+@KwLM^
zv5Rl$D{FgWE|IeUFD;{yml^=r9p2i#;d>|<$#OJSp9biM^aJYS<JTTgIu9{;qhH+k
z;;WNO&zh{m7R=>P2B2(<N`e9*LlTJeHp*6|q50VzlaSpQ@YTfEnmHdwfZN1d|2uJ8
zLEDb4rDRSQ=oQ&@$A%q>+F|Q$0<j`3-?*%}arVK!`7grtsRUARGb3##&ZxrjE}Fg!
z*Iup?=-ymLi8K13y8+15^j}kccOzJ$*Q?BEefV#Lb>)ToA*|YVOU!-vJBPOhuK=)V
zeY}?Jq=xW-$ZiOkCe<e*%ry)59eZja<jE9XlllF#9>2l$iVN<W-|+NrmBF&waGC*~
z7nBdR1Ix@_%Z+MoxSki%6@c7Z9yWm7X^nmsJ7=Eo!*+MP{ByyIt1m?*u1Tgoc01Jy
z&>ARL_d6}@Ab>$@8^XbdouGHPwRvwGNOQ2~=yKk&74z&YmfcYeA{dJQ{ZB#TZdMHK
z#AV4Zv0CP!1!`to9k;&LIM((8jKd{D>HY6zJ7w*JZUCLps6F74>I84)FA<ex;&!~d
zbE19<)=S&?=8p{TeFnx)Pn$XcZ`I?zN}kR7X4Bg5K9hSd5H&<^|2b6gPy`<N4B>vz
z{z5PjA&`h*q5AY}yuP7HssblL@2IG6b`Z!=PMn)uR$WvT;By-cB_y>xw|P0dIaSS%
z&ux4Wt3t1e&L)=gN1bZyuJ^FSxDQDm!B7DHZs&BuGUjE2znlh31@#kAul<DuOB@ab
zb*3jVo)AnZr74x>tUq#AimOkc`7FC(BR_5CzK;5$=)9j>gQ9b_lHA}g@_dF_fJE6U
zF%Q2w<`5fI7iQ~T^_NRvJ8A~NE097e9cn7>>dh}j^~c(_nX4NGa8CeJ9<()H3U2^X
zwzFHMExXC|o!=4-tWz`zja*iqv_@Oh0}Ro6fE79_bI?I1=f7rP4fpq~0qmKi@{NbW
zZA^{##AXCx#1S!p`>nX`bUkcI#t%AF8e?o4fpgkyKYp#A;@%EoQ>Qd>e_GSS9K{+A
zs2Df--Gj^0z)PMP7G$a@l{ApIh?a=%<8QEUcg#<|1c<KA*VK;3!hrU9@8<ye`??lL
zEfp{7qYi+%6<YQ7dwB2)Ab_m6wXuD9=k|wZ@VnG6zu>y`V;BO?n55f*8U|d-uj~m8
zf_)H-L2Dm4)o<iSyZc@<14Tl>!GL9YxS#A;zd?s=BW?lgm1x=bp&NEErYyS?5Uz8G
z(#%NVlJp4MpfSLmwXV6?EDHA{Qz)cSxwe<HfJ<U1xn*;Bd(=fRlZ~H}*y2a{3QszA
zTtN@A1LC8o>!)=99l_nerVxKDT4~d{M>PIvvEy<<(Ra$Ozym-6c-AI@7y@N4)^i}K
zv^Ryq+Kmp?(6<YF-AIwp8JBQh!1T;cJGFqqDC1AZ05Z#d|G_ti%0vg#dB#!1Ejk4q
zia}sZ-fAUcK1*&?yrM&&Eypko$pRjcY0#Oohm*DU6?)>M(BU8eu_PU#Lp+sz*0sQ!
z;I(pZ17Ipp^?Dxi+N}Ueg?D}fW7KlF<0O?};yD}JN#mF+wVNib*vy(y+<4ggskj>T
z4lEIFvw99j@3((<c#A`UH`M;qVJ=yyM#==Pofsbg_u2fszlM(+`3v`#jImfBCxQg^
zSnT8b#tufAMY6nNohdEwrN|ja+YcU(uPMKs)cC&XM({*|!!p~=H}aAk3wgF1vxm43
z5-BxJRfeNW4R23-i<fuA=%=!IP#$R2siweIg(}NzTePj8I{i#6tIrUuNWXZYVdH&L
zVFKQ&d{tjn@y);}@{AF#vpanHX(p7+n{_sN<5fe+lZ-@46%*BQ_mQtM^0Hm;z~^t!
z&aub?CHfg4-B_^?ozg3yD~$_0Jj5T;npu0V{dp>Y+2op~{AtH&6%;Ln0PsNCg9i)7
zrGOaR4*Qzg;SS&N`H<g$=@KrP`5-~l#s2xBt)6d<qv0BT@2}F_hg0EHm)wUGJ7QB!
zRkXG*I`pcq%4G2nZ7UaBr9>WtgvKclLEwiMusNCs&N{~jFEl4r40EKj?!J3p=JKHL
z+tpb&*mHA!5f$eCm|7mgL!lcDXvt5}PfdyprG-r|PaO0Z@H0bh7;V1Vw48eV3+{qS
zKt<z_ANnMCTBB#iGS!il;$i3~^?CkE4G%>xgkUrmfXSw_BVow*c35gen-mO2?8(hb
zk*!x`$$to^_p!A-8#&K{L<|pGMiPOr!mi@iEpnK@=ZNF*D|38+y&sn7p!M38N$G$2
zUh2UMpFBpIICUxJ%4c}V25l<8<j_KvgtO8|{gz;1u${Px-$CamGRGq7r#<GnA78Fa
zPzwaz2APMv0qpw^7v6hjq+n$#;FlAuY#)c;yCMn|?58r+2vxWhZL<tc!O1Cmsfl8Z
zS0@cXTnZstuAzGJOvDT}E+Wngk7|G)gy?PvN^T>5Ow+p-DkD(2>M-=hoQ9wDGON;S
z&KnUrcmtUr%6)HQwC<vv;p)S7KGT!b?1gsD{cWkG?*PMh{IiaN%>{sYAX>tGFClJ3
z$6ww-y6DZ-(MR<ji+}^BESSJZenXi9cagFBi(R@K$ptYrr@4W~yM0wLPtXX~`RyAp
z5iQBZD+h28cDo@*vU$*o9xo9i<Dxz+%qX27KVFPpy-&D^MnyNw{Sn@D{~@QQrJb$C
zHV1rUqrC@d7I^6~G3YNClAviR+*ic9ZSWaeRYAnnGQiJ<je84k(xWiFHW23C=5N?+
z_540IB(q@KjTw7C9nXMjD2ytCMAq(MX8Y@V*smF%>XDS{-FBv5B>*i~J=aKjzWfG#
zQ<&R}cMvKF{Gx|O(9!0xe_kNVhjf5YFDJbyE&0V|###CtZ|)bhF{R#$aAk3Y!^`sg
zVrxlSD=FnktqdzW*{!+9)6#d45eJPOT!;lNm>2urGiZkgJ|cFA1Zl1$`$@Xh*8ISl
zm*NBd9_DHf6U0eLco+!dYooM_@#PbiXDeN{I-xz0&RD(v8IHOzllZDPkF~qLbQzf@
zdn5Y}JbKObO;@DaYXC-{tE%O@{qSMud8;H7(i@-G=_3@D;>0^S)4mdB9}IEMO-NX0
zxF^042)|>E{v6N$)t>K_8k5KY^LuHv`c;FSItXs1msLVZ_12ePcHS<!VkV=*;N99~
zd0N7bL}f3>L(voAp(p;vU0)KHpC4(>9U*?_&A9zOCEG|v<S9gUu7XZ79016?u0wEm
z)YzHM!x-yt(5?K{iW8n7@g0`_O}ggzIpX!tWc^=$F^u6Z&bZGtuf(az(;3#9oQud-
zW!Nppi}n|{^f*mzxu9SbFL^KzK2RnfyAX>NHz~HnRgl$?T1}}L9CST22u<92Rtj;U
z)_}j2HQdIG_R5<c{>;y3usDYwoe$a;T30?O&KS5OJQY$t*(Oj`vwum}qPU1dS1C)p
zW*2YaeJ<|g`&*KwS<HWk{U<3v8n`J!_4ua<z3KuhJ545R?2%%``wlgWtYDa}y!9uD
z9Mc;GwO_KNM34h((#rlGBv7zN3~M7Cgi}6XTngeZ%U$-QZ-tVxsEEgCN|E18xPh||
z1l9Dvbft#4tpnVo`v_R}8EKgM1rI}D$~oyZhx*3Ju`aa~*|<YPv~F!7lq?S?Uc5xk
zLg7-tiYZ9@zSL$eQ`4;HbZD6LVw^->A~iD(j^WIs{yux}>7)OPt+$MdGTi<^rMtU9
zL{jM*N(4c=L8K)|x_jtur5j1<Mqub}>28MZZtm+jcm40WYn^ZN>76(Bv!A{9^9yvA
zW~oPT5GvJ<1S=}bTRx6&$U!N!;&7qi5!LdA2|Eq`C`O&+)jGEgk{p3POSpa*^dYHa
z^e)fOH*FzKgWk%@6JJ6Ek!XUvhbt7xcc>4^WL!~s2sgTkz<vj(e97kRq$%R$l1rN@
zr(czHxhDenIn6Y0FVgrCoI-aaJEF1Q6Y;ty2IJ25?DwkF{N~^YWFXr9r-dQq&=G#b
zlUc+jV|*RCZpQVzrGbA|^BVW{U>u4JO&$U0;~u|#qU|n}exW)`mQp+-JPVtB&pbat
zQ}#G-S5Pp?DJZ$?${G<D9^U>lOetLjkKERh)(&ohQ?V8A3)pI%GBp9M^0InMW0Jv0
zJqp25S)tDhI0D0gXWxr;Nabe}M%Xy_g+o9Uot0N!e<k@X6AvzITquwK*|=L|gZdY#
zDP3;FA9Dd^<gO7ZqbT_q)POvC5b~1HnB1Mh*R3*r-IpMgGoR9*-HTtkzmqEp<A8m=
zm&Bw5ZT-;~qe1&cv4zYvOejnUqCj<Zdbs7>ZFn9-22Svj(4{@Jqs9^k{Rvd?GC~dD
zNsVBu*d&^@?WQmt02Fxe0y$SEF1UOj^5nw~l1eS7!x~EM<`P}ooQDjD7Ax~IbH?SH
z0)#L_QP|#}Tpas>;5!1FLeB%Z(rQ0=%cZVcGueuV*_Jfy=hZ+x1eYuT2>l+{d!3pE
z)!K0jZWXif>nas!t&bh8BBQTIFp0iqYr`)+t$M|wh+NQKD)u|7FP(Y1d0n5}KM1Qu
ztGqV`U{u90w~WW1H;?Yl;EZd6+<v^*V4beO^R&^o^c274%AlK`Di0Jc&I@blTGRVm
z<E7U&%eA_Nkawx)YIV<{547>_@oG@3?H;}>j>WI0@hR~rU=m!^xmw0br-$k800H)C
zKnS#l!ab#)-P&rOdmp@zvqdt&b)+hp4JeuL)oL~N{b6HU9NmJ}a(<8YNWTvfHgbN|
zcZQ#F%@REKaj_$kq!@~5?j-zV&c;r&V_ospe6H?F`$IcpL1J=DdQR&ZXS|YuTkuIM
z0oPO;*#TkeiF)AEv-N@UOMUqyWYrM+!Mi8z@WQsMldn9^Ia&*?3u5s1&CY3$`C8?2
zg+`{kepkmh&gvZ5zL1uL_v@H?7q6=>ZHeU8$*IaQl1QUwcDCUAhDEFguR^P$3g0e>
z7>Is;hg*HF*YU2`qk6gZwt>>9&F6wY-Z%nthQhjbTv=?{sOV&kG2}k_GisOl(&^r6
zH{*jq^rkn8R}o3=kE2#c>gX$Yt?DRt_r;c%bUP?XI(hWi{W?aGUFiv>*%385joYo1
zLG`LDYA0X)g$N%zD&|#2Xys~~ij2#h)c3h<jU$sZ?=vdjN}RXadjrv%lM#e|th3jz
zC84Zdj8T<itV;u}AaMFmKqg=ZH<1MEXXW7#&`sc8+rJZY8s}roN_>WXPO#dHfccej
z$f)JL>wJTgG95-gT6eiGWJ9cez9-~5@bojw_#(<TN8b(W;fbljO>5iLU_8j!c$?B<
zOm;plT5I($*3Rvy9q_IYNb4V@e7am9bE1PWbK#kju0KA`i{D3I(Cv7tFz8~ea3Zkp
z2Oe#G66oo5yp<I_WW-9ImPvBnXvgWmn!WZ9)dP8{7P!N49MX&Na*Iu~QOaqrOCR%4
zDn34pTNsJC&+|8tU-!Y@c#TLATMkO?6HnBU_#U3G|Eyk#SYBTl;5V~hIgjF9O!rd7
z{)v4{Gy79t7-KQik+e_huJ<hdLVpUU`7@1XgPU~3+4{Orp9+a%CW#2>NXd5X?vVUU
zl+}PK*NgGZ3ej<p<L!w-CC}l|y$a(>b*GWe%F_&UfRPO41?4|+6Oi77Ybt)Cy?cr)
zPHQf1=Q%wYC<rFRB{Oe%1?;O*?e13&g%S5y&Xf5GW$xC@`&57K6rBr)ezcX@Tuh4p
zc+#_;)%ZPmzEPyuRDYgz4jOH~Hhj+4Fchb#PMK!zJJ`yC?u?blmDFc_);gudy4^#`
zpk7?qJ&ajQ&A_It&rzfhW-tA9q;bJyWcr_t6?9dSprZeHbZMb+5c9_-YLO%Z-lhY2
z5P4%Y0uC!@9J>&k;ptXI0PA5lz%H7`FU6{2Qh#Hs)Gb%>jaT`}r`s*^>mZM;Cwqhb
z!A_PVc?|X^uyX^+{7=1FpFagx^Gr(La+il7_X}qK*)J17UFA7r-{3K+EW^fs=c_47
zjG?2RC<t*|iM@XP2DyUE?6|={tnzUYY8PoukC!hbOKBJc@X~%vXOBSL!lHy(Z#sOM
z#T0A8=VPP>Fna={{<Mc;aKA`3Pr3`2oJ9u3DxzR7u1OaJK7<QVnRtBZ^!2<}!}~Eg
z&}}8>+IhjHvvOVP&(ipLUoK-5gp{E%^G~9Qr8|d?`Y|mw4*{P4K+-L!dGhS}o$>1*
zxG0~tcNUSQAhmMaMuZRu&$M#jhZ<mMIF^l*k;D_5rK9X77ml>$W8cU~v+=P$UYz^V
zOcRVoU>t$$yLroUQW%PoLlcO_5B2eQK1Xcjnk8z<5Q<m=sBEC76`F-D)#47?PG~g!
zdgn1}c4M>gnX+%@!v~X5E@Og-D(4B)41o`{!8jYL3%HSM5+T1+QnEKz>rJR-8@rwR
z<+RPPVz~U%GFDk;i1k+rTM$p_!9OH$v)!oAoisCGJKZ5qlmvy+pi-*~+ngVj8|-ht
z#hGysq%m*q<(a3zFvNP8EM2?mq0w43_an!w#N_1g<)`$lE9Z)1&8r|&J6)+fK-Ww3
zivLW4%rMavXNrt6?W#J^agXQ6%2Ox<M)4^(Yli(t{g!m1FUw9~FjEP2PI?~XE!OsQ
zp=RM<Db9$4+EQWF2E8PWLRgPVhLbhSUNfb?X5QO;I^g>7TDy?4!SO=0<{T&k&8PF7
z7nC$x`;HcGpPAD7F&=MnlQ;Ad+IH$XSW&i=ihfGhEHpb$I%M3}0aSpmKHaAJnlyRX
zlTb(8h0qrXY{55zTY!)p&Z33Sy$bER5Zg$k(o*5?N&VN*Qa6csSY~y%_Gpe(L1c7K
z!LMqLZL-;ezywpsSB*cdG~yYDQcl~MOeOB)yVA&v)~KFnitZFQVm0TSaNE`us^)L_
z3)q7YzjDF)klVYv>XSRWVqXVy^=zNKm52LAN~>mIC9C9xxq6n-!P#nuD#3h!U09Q&
z-O9PL_LIT81-hy)gX3sKR?z!bAS=1cCm3QZ534e-&B+zeHTmqeuyX2X15|CR9E6K)
zPw35PKXc-ewQRXVWIe^-VB(pRqjar@4+s0NXAkn*bUM)mH*)%<G>+(}qp9Kj(F#uD
z><NF_tGoyf0NO5c*(BF2%&@Xe2_!SV9^XCOVG7ehQt&(L)-&ATEv`e67_#UK(#*r2
zypL^E@(qSfsA>VpgX6>d1@@hF%wo5L?dDQe@;iRq+Z0Y2lz+G))Aw|4RgBuSYlL5^
z&GlXg9Q4LvC7F}fRs<drcNXSTl@mNzRs|&E2PmPX&oAs7*0VpQ@JCkdYBMVhGsf7W
zGVTTMdFH_x+y(s>kY}d%=6swCE-0)pxJ-9pQwvH)?x<8a7gY28Od()y4Ejjf#}}Aj
zv>ERX?h-?ee%|2u!mEdGmLXsWLUT-Vr+#$hFb#zEsRyxaQ=k}uP>nds=&a*?TF-IR
z*w`}q`f#P?n@^*DRTk?)Z6#}>D|%{`j=T8NJ8Q)@;;S=$)0ULgr(R%X*a-|da`i;)
z;py+j1fZ_U*lK1fQ!mETu*#8*4qaB%-eFt+p;n`s0Y*_ASkn>l>t3A$Ttg&FC^u>*
z?rI3B)3%s$*HN1sfho)~rlqn_SWuGlzZz^K!Kt^FvY^L=Y!V(E(>}F5ZN7{!w*Bde
zV}$O#ZFT4Hf+k;veL2jsfRJ;!pntzWPEJDGnz_JsGcD?Oo&aQ+YXTV@_?sHjwogjE
z`F)AvP&oZ@j$%_mW`1jahO{TUwZ0XGXl?a=$7PlCpgl&e?DK%<b7@np;={ngk1ezb
z*@aWa?V!xc6sX1wvvmTW+kNT?WOgK1Q_9nbR@>s2&DV0ZHq~f?EPd#AyVS9Zg_eXe
zvB696RC~7O)iyV@s|FH7i96ZVfe9>A1aM$|$(6JKbrRmC#xD04&r(HCW;235iph82
zpLgT5Ml9AT=FBV@7Yixw>kIL33p&(djJ>#EBN6gB2A>zho+;F<f0N89Q6xO)X={p_
z8LV8hI0x%VWc46^1%$lTbKBq4#G;*M{ot!$V+?wiApnAEn?(_e`dp-~MplONA1u^I
z3683}I6?aRhZoIl1cEp&<TxeYTuiK%e(ROv7e(dZLSIi{9%lNyyH=1<8|<s<Q)(p9
zOOG%iZVJg3l;=_L@5Q;$8Avu!mZb1fNQRl#Lyt5=`;Za<EuYdwZAQwMMAlFiCx6au
z*9k%MOd&_Ik<tsZwg}Odg>(UuVbCaL;)Ht+!Q_7y#}T%8Pn!Y;)%IMD<FWt?KKbE%
z>RH6j;5Jp7mdsSy?k?req_cQMhUhpkJe)6r%<mS6L>PDQv0-p`X*`2oCLnyT!ozG#
zqiD8HM9o4!WnMjpj3)aJWcGkIU<gtEZt1tsb%7vBXwQp0ca8A;cX3mb%I*13{y{NN
zFsU;fIIzjDIwM$}t>`Z}4;sEB7(x*8G=Q&;Yl_=4lpJ)hI)k*T61pugFbo8$h>Y@Y
za$D`Op8C@0Z_8YBpw8R-Q`=K6cCa-;GBFy<l!}uZhZqs-?c4w+M_tu-(B>u34-h%s
zYBTCN{L0S(@OtKt@vbw+{Y^IME8t1xw=+k9#LF17qs5ce6KH*WmJOz8L5axc3)qR#
z0ErKX#pCAh|Bc0|!SCgh!;yY8djyZV>j4OKoYu~W3B}f@m%M3D<!S#-;#@ah>L4Qo
z>ibhPruVcX0-EzmR50nCw-9l+D#;Y-tWZ#V5@tO84F5VoR=j4SLmB9ZVRR^*|K4P3
z^;W0bN1u$9<sVeH7U?V|%$9fX)BPAndkmH-4!g3OAeenX!FK~j>;18&)N8mEdZe+B
z*&HmIhI<;dnV32fFh)*17?dnDp#1jv0iEw=fsbd%>)RBSq81Mi>&*rvL}6@QlyrgO
z;bSG;jIf08R`LAbakqX336m-}w=XMpLKLY)IA|D*=8r~2Zyn*zB-$%wgYz7+_yVK%
z*dMRS_=O3&dXo#2_?ipGpjgf4^*Ua6;W_KKr8In({M6SZG<_}hF;zGTZepuXIxie=
zR)Q@ZguCoULb>ZXmsa?N(O(Lm1iz48@2#eXRC<Lh@)1F16gCmR^1x8qkc0^Usmv6*
zxWkJe`>rS6Aq2iR9MLgN_9ja;!JtJBjR|{|bQ6W~?{2g&UB~lU^;pf}nF)`kkNvLN
z+pJx&s{{Or1p`XpRl!eVG7H^G7+tGm6Is{%aYTJ1!Id6#JWHPGy(I;5nGGfOADS+R
zE|tALCZA9RpB83uMwDTp-9!bJF4MIUh_wd%Y|OeGfJ_w3_kU9mJP}e^zi&l|zh$p_
zXfMROAs)NnqoF=i{~(k(R>~|k6_zN~Vxg6+RHVdlj=$qp#r8OQZ+!PnQt|H0cBs?)
zcJ#~4J07bN0$VINNwE!&X};Na0cDt1xl-?n6tm>PzWk=X+BKeQkijoNiTnpBk!N@h
z^5i<Jc;ct)xy2B-;)J=SfPt_(mzTF>-9afN^nj;X6y{(xvS6*fw-ECU9ZYL`Zv>#r
zod?fAcZ?@@Q5w2QU!OGdpG?$9Hb5-fheF4GWbTE-@mV12(_0VI);^fzys+$_8NSfP
ze?^B^mg#|3N#Ae!ZzXCz@p}Q?v%CAQ3pjaj`?BnLfhQ1vyv4Q`D~yhj7On6#v`o=6
z?4o94qyRtZjNR-;S)Di$Z2nc?df=ifaPQL}o;9I#j)Jtw%-ZVdf)Dvm!=^Cf(XmDS
z{83s;ZAbWb7dhXOz60oWN-9G9NE&_1LSC=0bkgRl+uNQDg6UoERiQ?VUy-&GbQTFk
zBk&<ze!ppE+zJU|>j7?{D8ZkXKUJCq92dDVo$l@luJ_OKk{yM}NT^sJxCwNVjV+_3
z5hH8=lMA(xG(hqX-oROT@Xo-&mjpa@Ha5|+^N@E@$dSk>KqW#Zv-$3@=&Uatmpi7q
zbXsOJFk^bY-ZGj=9H|YbGF%AayxG6;T28sDHlY8n1~4}bKlhvtk9O$w!guFwTThJ0
zB<MiR)Q%27d&3%iz=OM=H>BAMM+C~C&rG<rFr)vdOr~A>6uWks-mRBd5dt8A&&m1h
z3*Vc?GZa;>4yuZ6@rw%IH2ZLqmrHnqKYHIA0=eyz@^1p$J@e{S;M^Ky$^lLl*bI_<
z#P2EZF$Xl~jGxdk>4e1?BC{0A6hZXLL$iA%wAv)4Y46`*nWC{kE+yO)_ZOi&7QZm4
z;A`-v%ZG|5&nIN4#CyEvW20+^7jm_)4DWA2|L<5s``=jOC(ShZ#0R$F?y;{L%D*R(
zV=A<+J*R=_(3I-)mtC$+cg^~AWeF%4tm@3)=gQN(IiWtVYIr7i-gumX#+rS5iA|)I
zQHm#eTi!ieJgFZ(-+i_%eH!Aqra$;qMf*!##sIH^WXH?fC(O*0$8TmZp;m(5JDZ{z
zRK`mackH&!LD~hQm6p3T$sZa}S%~B8QQo&I=#0E^(GQlDew|y@MbTKRoj=7Q-h(dB
z(p$T382zy3!*=|oC!IkVH~4pKRo}}Wj$FSCK5~}pB?w5#!*$#C;84ZTJ_afn8pYpk
zbt9J%JjNE{Ml8KIoY=7J)`O(sHFDeBqS6z_Ne@3E<=6StL$Cf=?QgX8DYK|!5h$Y#
zJ1sCDj0%l(5}A5Ap$unTN4H-s>bcNa>}S&4$dh%2Y=p@QS-|OO{rgsnBhDJi1F}Or
zkP$zs$dUbSyq&KL5!zppQJL+2adG5KUC%SJQpZ<8Wq*DDBn|Qt%=M^7)L*H09NSaT
z{WJ!)&(gp?MIO-PF5Zaevka8YaMI?*wutXQF6SYf=w1ALOS{2W0}xyy*=7<~s>!+H
z>8^W0)H&Z+K`M|<Nlt6XzOo@on_F$c4Ld>o4w{25JETiazxtft(h1eMFbw0r5e0@^
z3svM=%oeF4t5K7eT<WNlqsW~j*h~GV^Ql*ro!OT|b%d&ib`}2|{e$8;<K%69L*g@|
zko3uvbtzJAC4xq7*4{I(<fw_o`KvyqcJn)1PQOw-7D(7EuI&_+wl%6FONs_guYJc2
z2==GPH39VY<nG-_4^<WDh>>*+m!8Z$mT#dV&-u9zrUj@fTbq8>qy(Cuqa~KCf8F|G
zOV80V2;6A%^xa=p7kQprN0e2^r`tQW6tvQ54P(4fYU$qv=sdl%Fvy&=hoo@7$Jv6c
zc+Z05imkymz3Tf|GwqSd(jvA}`l7!#n<-D~zc|PljvpKp#Cn*Q0<PvaT!NR?{!^&A
zuu2S0k-1=b6BFzbiwE(4cPe0ZD?_kqkb(OY642d)8ZlQoDUZMm@$4pqTZxR_oh16A
z(izjG=pzQmu}QeeGly{t%~q=j=(6jhwX>LIzI!4L@sHVorT@W=#^9d%f^Nz!wf{vz
zr2NpzXN56==%&5yHcPX(tY%mgz4QxVHOGJ3boAa%S)b0xTi89OWyI?3#P5cOXbg^$
z()lFfsV@bSoe@cgJaHpqX@^tVQcs1a=MXdU3DtZ3qXu_H^SqCMnuwqki|<W?aR^RX
zTCa3o_QwGJ<GGFuusjFDSkE3*k@5^+@V#Z#ivuK6dajBNjib|tiVZ_G_n=*^wJ;6*
zPj?~}za-YSGAHh0EWbi0KZlj=3bs_l;Zo=FZ=Cxj<U?2ED`O6NObwQi{g(~q{{`kQ
z(>#SRbgj>wD0Aj6Qe>?!edFZ6iEb0wOL&-Ed`^>)PI0pHM-L9nO*k(dIeywaodkm=
z-g$~B9?W+*E1)V?`JIBbEe?6)kO6UniHebXBWAM^`DF;xa`eDW8`!lr!8dWwr9c+s
zICKTZOYZ`#8Q3&6KX`G-)kF$;xZfB$6Kp`BY;W)SgIgyvE2}GQKtm--M=O(Az(hf1
zUiS7nF@cLt<kQ6dw*@r&CYbOLit~cA#(phSp!jDwvou&Mwy;QI(;<%U^%c#7RkG-q
zwh1wf>Ck`o&WnB3h#Hn7#)DIpq~2d>ll-OD2uXj~hBs9Uu`)?C$FGas<15b>nl&aJ
zmhY#9!f^IjEd$l3@9B>Nx~<z^o1KZCUj#wEdaV>YomE{gOU1?!Pgt`?i!T|{ywqe?
z*?2Out`v2ZQ4zGMZ;9f<S%2s5EYw!fPM#gD1%?IIZ{f$%se2TXU1$ztw1lfq&(G~w
zu8V=rLOSaX@#}s(vFkg5+^aYm%`ZksiNakN&134LT9Vi&y^{|_^mcD{dV<#~@d`Bs
z8p21~I2~HgG1Bai`&lSkJ2t&`1WIc+Dbn5_A(r;LD^t4MHyaGTFRfo6M+%Afhf=Z2
z4n|<q)IY^qvkTW!>e^>|<k&G2ShzyUPcsT8>-1TzbZq_c35q_d<ZUMZUfQjG5NBt7
z%>@7lVa{Hrymf2oz01*J3&<_l>V9hgeMRu4dL!Zlifo?j67G|WpH6#+USVWPvN%>)
zF-Nu1H(7$bWj*F_O&F5&d@MvaN)m452%zDp6kmDw5NnRKU+~+9sToiFB+Fd)rsok1
zx$PTIwS@-p1YCT3K^An^oJceX9>Gg82FTWHgLR*|TeC5DZhNf?E=-yWyzgb{OS2`s
zuJ$Gw^F$_I*&`}xmeZBtX_+}s{Hcfy2q<?$BE_gEDR~5#HsP|613(w(^z|`?wvi5T
z2r$`d!ACjWAQzzRNtt=o=7A-p8yoBuFr~oRL+D3;Ci(394))4D+)2kI4`Bj9vD@yg
znP&W|cTY;=U<^$(O}e{-H)+)%?pZ$zcIzg^`7hfg=dUSDCxU1pxAd)RQ31RYH8fIG
zot?%aH=X-x`nQ-3`m+OH|C9Is@DJ*xUsdB{ftUG1yJY!=rQ0A+{s>lsTdyy28Nap;
zjsf*3dA__U5h-Q}G*4xa?YwOo4P2PsEx6NxA-W|ps5jaL2!OuIJ+9P%+(vObX`=ob
zr9BzunUpuupkt2?xlhn=vMVqzp^j~R#C4bc`W9=mC{5`&$t_nN*7O`CVOKlMd(JlI
zo<D8tUNRSF>uuaR^&QQ5qip}l!7GD{G;zyyKa59?-7ByOv0!Sm6g3#eX-soOxvGp~
z|7ltANu2tUDg~FlH8-Ucs?MJQn;y~?8v-h$U)2egv6|YAaV`kp#mt1J#FxsvQpJkX
znFJRqqr|d*BVU`QYk2!Fae+JaP0^O8SuT|B&5;4la~kjdZ|r+e3yghBeI=KZ-k;cg
zv^p}Qq~FYI>F=l4w?N+uzf>>4(kIj(Z)I_hw*ywF^8_$Wn^uam7vL^<ENuDMJg|Vj
zWRP$lP;26i%O1&7YlK#kGQa<0Ds1b8OG+%p1Mh;}%763v77B>mkKe^v8T~A?Avmd6
z)E|uCA7o?S4Q~3u$LbCI+~>ABs+)Du@BeI*Q^YoGY5taR$Loy#Q)jsJp&1?CVD#MX
z5P)<fpo2X2*XA8J82|rPag&1bdg896-j>!(wwm;Mlmc*2W&=nB4Igf)+E+OhxvCR_
zm?)Kk24x9Kd;M;90R_>(5p==Q@Xb}O3vM3#-P*~4zM*=pWs1a+ns9emf);iLCKoCe
zIFexl@T_R8T)@V9RRa`7=cf{l@FZ?_l&t)f=_FYi!)>M*tQeK|SV5l`N^8;?bnUJ5
z&4v~;wUqNKEZdl!LOns+-K<hUL$V+aV{jip2<L<dR9$pgOXT)UU=ndhJpu}*B6%p$
z-1JuHgfGbaPIL2$FnPZL!Ft&MDuYWIdOt<spj78Ti_h<xc7GXN(MYBNAc0MKRpp#@
z#ZSnNAVkuV+1m#2I@!dHK7aHEGQ815Xmm^A=6D7&(apCT@zx#E3F8zP;RQ=r6A@J>
z+KnViyc^$UX3^(8)Iwl)0)P3TS&CrO2_zJ9av`434VcpbAMT&R|6q~+#ubjsF#g15
zlroNv7Wu_`Hajd8nBB=MO>8O9Mf<)67wPG99xY;xtoV#WGn6U2D)>~+T~bh-9#Gv!
zlN&k5tly_t9kD37AE(WMYza@`MzIaDCH6)g;EmGh7X>^r#lJC7p?M8eHlGmRWA;bC
z(cxVYU>pL#hAvjqT*((qt9W=%7L9=nzr@&{cp6R}ki-+F87s|hJ_KYWK>A&~8IFj%
z`NgXFrasZd0<wtzIi|$se`@*O#KxktS;?FR_Nm+mCG)4HYW+i9>3v$XSYDzEjF#i-
z7WYwuN;N++PA!CXv&t<_GH-s;ggRu3*shpQJ3#+4n}9aOKfJLit_L6=gP^C<SF&Cz
zJ4pb15i-puumectxbsxB=rF!>Y|}W<S}=p~C=0|~0Pr)H9cl4%-m2;==_Qok^hL2K
zyPkAzcX2WUR}rnJ_?<DtXs}Y6X|hC}n3x>~L4RI$GNzD8XT9ZXReh+v^*O=Epq6Y{
zDyl|FdDHhoSbW4_XOn-pfp5=UoZvdFnnnbF6LnRgG#6)Iy486hD=Frpe)cyvNKc)D
z9JN+g8I0Ppg|l+c5gvfei*@0&ErTK<or>9K52dnp@w$I3ZezCF-I`3U<M-D#GSL`L
zm)net!_&S=(MVQVKkbDl9#MZReIQM!$GcH)hmIs$RS(FnHszC{>y8e6OT&&72;|2y
zmO`82Wl@-*i7LEwXmU4NcuG{*bYGvE&wT$lAjYxt?rX|J1%Y&)d$|gsm<vrL@^Abb
zXHs>+kmy$luWf%=%UnVM^<YMD^eI!}#<-mOy0fY0e{!`zW_9XgK=R)Nuc-v{5s<4%
zRsG|K1slE}EUiitgjDP+TPiN6*AXgIc^KUdP_E%}X%Dua!4{?WM2u1?_r@l@Itebw
z_DMZI#=W}pX^N>qqxO{i4>sUzc`B1LeclY-=8#KBb7Aow7nR~Y|Cy{uAypSQ5BFeV
z^-)v#40z-?e;<PAE@jq*+d=3Tnq-W@R_S{&Da?wbRYysqeHU_|4i?jH`gJrUS6WUw
z3%eg#Skr3^&ak}EdmFPLxHrZE78GreeUb&y`OxKEe2Y;D)i#5Dp1-I6r%wp+2)|JK
z`@_^bBASZmnzPy0!~a?#CCM|llY5U^8rzQ=Xh_nfsm`>3Azi8-ubeX2CHgwz0}=dQ
zuX%!_b1A@C^@c~a38jGMD5ddAPEH0+^zGgBGqx`-myQ!cWz0ah8zl5>7a&ghm*^5b
zdv&EGksQU`$%GrOb|H{6q^BSloH70FvvkCVF-G54frg){`Uo>Gomw+r5St|MET{lV
zSDA6jt?~c`DAk!6K)kBgmL(v1eB7)_7|X4cG*qW+|Em`)$z5y&=;SJa)>dTPlR=$}
zJ#PE`Md!LlURm<YpV*8B_dE{Dk|N6uCC8Zy)A6NN%KmJGhlv%a#Pt+qzHe?;G$sr%
z$ay2LVJ^$}yhNJPxoBPBL7&LgG+rS~y5bZQ4wk%OgC9X%GY@25{sW#f48TgIDt~(Y
zUp^p*2k*!HAPyq+Ayg;V%^FjjU%rxtg!JuD3s42>jy#F!t<WR_X>0U5K%=XJd6nt<
zi?w&Nz^DnN@lNa;a4fPNCJ{L<<@7pL0p)NYR_e-Wo?xHHi=0CvhIt_msX%>=9wjcG
z`Tecs7l#1`PY15QEny#$(ALsIet&US(`@#FLjrW$Q2&wNBAL=h&$jUjO$4;w8S|8b
z(~SgNSh%HI<^O=B5F=knaHd!uBn3NO40Fd=&lIADwtuGmfU?Z4N2+<f9z_kQvhdx2
zdI5?a^y}D8Va1528UEa2l0=#&-z<degC#ylmDft_7^y2JiR1&!@0zc4;6O0Wtsd!`
z7VOtkh#Sj)8GocAfYl?J$cDBO^Z#VLef-CGLsb+1pNzLiYJh4NNqtsY_`f-RbpIYR
z@OSqA<oHS90GF1Eahp;5->k;if2_t%b>;s_J<LS`E}bhae8Bv_Nq+x~I5CV^nEofp
zZ#)3FbR6jz-~iJ|A?#L}27p%oL-@e2D3$w<ZvdyC0pzX+AdE}f^vBYb8?-@epl7|T
zqT-(azrQo&Vf@P=4tst$aRsbmnkYC7eTBA@jinsp?_yp6Joldn_SQM?^8v>7Y|dWN
zu7AjRo48NJ_Wv-y&tcZ}J2hjXjzWi(5^lu+&AmNJ?D<w9>okgg#qR0hCh665{8Xse
z8sJ@J52%hM>6j*HESaTQ^KGyv+XvD3JdRrfC}tY~F5wISi41!27Su!90a>8q_sxe~
z|Bm*8CbfWmqyd(wGlTZMR^T6e)gE;#bhA2BDO+)QvbeBVE#&C`s4YizNfdyYRgz5*
z*9G9pW7pzw#ZoHW_VVm`Gx<{Ex>L16wTaM<^YP8huh&0{7nrg9!^?}*)zoXhE2x)N
z_2MIz&9<^L)YDokS5?#n^(HQStH`K#!8;3Kcz%7upEbVokap7OIP=hQ)6#NsBeQbj
zbs}hP2EeH^oy{@<e<B{OKb=HUd)x2xG{Zc#C=MQU3SW`&A(uNOl<;V^o+tD{n;_;f
zD(&zQXKmMY6)k-pd@VvRPbWTUtIyXBBSs-qiKbhZ<j-y0lo_Wl`Lk^<tVlC(3D(pp
zG|#6YBLI=*d<k6w_Ljd<hOhhOx}l91;Ldwp00>)18t0tIv=Z-kv75#*UO+X^reJ<Z
z|GIj4G7f?8=Q5#k<0jR~obZA680drax4Px$UjEkcbih`uQ8jpSJ%nau3Ah2<e_Gzt
ze6`ZwjlYPjqbXVZgRJq7L9T1kgqGH^J@d>x8z|JA$BLOawL;3cn9lrgyt41+`b1}z
zj$IloGjE_f8qL?hT~@mf$m#z;U@uH}kiCcv5zf0`Nlq*2_LlcNa4k^t#q^x(qUI}J
z^FDUW+Fr-;xh-;?Wj~@qe>`?=8@gAZy)Lu$wsgEIG4MWdvXN5KziFD~{r7^>%FerV
zGdK`n&T&))?V#-H5yYKKJbBmFi;T2B;cd<l-U|1TrC-wuCE~NqD_8Yo0n2Jn>bcjf
z26wU-^$jg$jYrnDi(u5_%#|Z7dC`lMF`m`CQP*=X5r6=d2&(%Dm+)S=w042YaY{v+
zR|#_dGwD<)_N8*+c44-a@8?>|nAdh5k(rS9`<BZI`AJ66v#=;CCr_&2-RT=IW8+-+
zg~`mBM}Yb;;;_fp&^Q81)zyR6FK2wq%UuT-X3SXeV-@aaYFxF*g<OrWTUT%~aS|%u
z0o;H&=o%8c#Xr$v7;Uj(PES^2rR>tqM&%^zngnO$$ec{MYN-6gjZts09%;M2`F%q(
z)9GZ^bM4(}h}aUP*J($@@}}Q<7J%f3S}=%oq^(>QtO(+pUY}n9h7g_?`Rv}m1)nY_
z(@=!h;A)ydT8zUsc6xSwOqJM0R`kEE>%6<^smJ>j+QIhn>mPyzrH;g&&tkU8XaDpj
zVnPv8w$&bvnG!c?>gZ{N$dvaw>ET&`PtuYqEwZno*4$ve+Q%5<eQ50XvT_#fYLZDd
zsomlC&o-}W`Q^h86^To7k5RfiK>u4Lb=0``n@`JRkL6-iO#AA;pr%X*o%ho>)HMn=
znQNd<JI(!l{A#NFi#_{w;bMw;=KLI|CCZRv=0*CptX9)RVpFT^QbS-rHt~vqFi%5-
z=?B;+b`KTD2%V*GHW~*GNyg}2z&WVZ%4snF79k=K4wigZfzdS*Jylt}Ja<kVEYV^k
z<7k%mClK^f1eQesDb3YyL{C6^5?rH)K1>!Z_ZqFJY21(nH`4)nG9-D>)u-cG;maJH
zWwqK>S@U4Z+VZA=%uJo2YE@_2cHEZW%o7IktFuR!>x&O)MN<|6JZ+j}@w@0na||_r
zHQ+Yz)ZUJp@hD^O6IwIS>mXCdW%xH=pPJ8Bo;PwDYrmkVZ>!qaCQzUk9hR*eAFp8U
z1ujQDkqZ%i(f$DIVTagX3@AaW@9xHYGTR94b19aYvbx%KL{8>q_Qam{ltuul{ME<%
z*|yO>18kAYzuStgO=>G1E80cpA71y+Jnc%4#P~dJ_7d|+`8A~@wE`h#z&y_Lwj#j|
zRywh?hRokD6%?2@+c@f+IQY+D%}U_suUhyw=f8B_)`Q4w7uRh(Ceya94eitW=I{S4
zv^(KySHEtD`iUVWyA#jV=D7G>dYZe>qDi-Z`b2Dgi}(oO2WGb2Pgk7F7D;|~DF6JI
zrJ~=t!gCo~eW-VfG3Q$d+;^Ib<KqTNTfdVFG?bgX9Tj)0GH9eKuL5#aB8a!5mU$k(
zROn{AFQ765@O}y}+#X@<J_F;nPf1A~F5j|`a`I}$ZaZ*Nf&C_%Gl}}P9R(TG$Og?g
zm`>yl+m5aHN$Jo}CpgZIV2@6UBa`^g4-JZyVGO3YA7IQ99_+7$-I$9#XgfAEFTZ1?
zc)wVWK2($-R+teuSH&J(swWSN<AC+85jsvj;6P3TN@TcJugYCvcP7tH48ZrDX4p%V
zG`U5_=}Fh}Ayek0-Y%@Ufe+cvzi0Sb4hMMv9&An*U=7Us_Ob2*EVz@lt!_Z=M*n^j
zHA9#M?)0sk0E(uDSN=9YRI>nBk=+9&tZs|i+Rhs_IxFXi+KFE47zP%n6W+k<?FrB1
z<iFmgYJL72A{xH~mx7CyydGM=&Ft<=T(7;luh}qoF@&y+McLAcu$?Cwr?Tq__$a-1
zdjzZ*2OTi=T7kdc`M!0jY`*HYC~^ZNea^Aw6Ua?-V>*>nZ}U4w;dFZTgiT%V$4#2C
zr|tF@;KNZn=UEJrTA;)tnUIR|g`9B+(%ur6$VyyJ_;?tFW=5Bg{zMVk71wSBi*5T?
z6?zW4-uDRqQu|BtzK-gZ-OE&=Xu_3Nzx+kob7X!0Xccxvqp@eT_2Mg^RDPIZES>%k
z68nQK+lz<DuJR^Yqu?ofcE#Rt+VY{<h&T#Wyfe1Da_943k&<|rH5DJv%SX{9aWvxw
zA}TG6qBS4)fk+~4+oX@DpJjX&m#C0lpX{yU5BoS0#5>k>>#ZPxmf}8!DMZy#A_CT9
zq}14yr_3Hd!nQ=x0!s60jtnE+1wv@*@QgndR%-0BJ{IA?skvDcV{=G3jo!50w6Ki<
z6g6Zk_4;njR~hsngHu#2r}seWpYZ~?m1Az>utPP$hVMdp!M(prX#Qo}n#k<Fsj(G~
zn7`wsOF)e1&AsX!?4#K=uO|dm)h#&kEu{V$i=Th5BX|ln*qN9c{RaJzludN^{TWCr
zuC_Mb2RiJjXk>lSW<ry!(K84#FK2~%mR?wWFSkV2$>GL-?V^`OrLyYIfJ%ZkEXqiK
zI{M_aZI@Y;V!n6G*dWz_mm+J7<eA(jaye9b&$Fp4uo09~YW(Ess%pppM}#bpBb&lW
zjK-rg07tLbo^37p?VJA+F(f>ZZfFe|k=xv4SR2Axy1!oJSE6_HJ;Gxuj0|-JA60Ep
zm#n-!4*w%L$E#YZ;3!X0NfAVhF8|3qpL<D8xZcpbPw~{o&%c$t_x+JG`%<=YV?>+c
z3Vm}%vQ-o_WAOzhDm<o39GZ`%h4%lF$h;9Wi32QI$l%A4K)=e0xPK^e*$MK%8Qt0`
zGUvVuJFt2|QtM+L4aTtYa}Y&U?tbEgBMP7M^jGd>r9IuQ<q#ls5zn=l{H~+WC`|>^
zpla>x4pSY|0RE$g@--;~QM949cKPFoJHBLzxA%4c&7<MPcnpMx^<5vQEK2J5O(#h!
zhfq~(G7$$7V;HBPH6|*yJ{s&jpvd=pHIG5Q(){Wby||2|xOx>!R-f%fngdp=^Q!R2
z2-KNRAA)jsFbKExWL!;2!SL7&sMWF_#SptPOFdS`%S(zAq3`&DguQDyx@Z=FST)sX
zeAXJdA?fFO0UpSTMkZWGEJo;akkQ-I&<1)tLIY6qI+krREMbidH;}X3SK`~VgU!11
zO02l=#1%t~>K>Q+S_d9nB$eZ&H!TNvcp6qBx2-N{vvL->-q~0L*XS+<+D90y9*lbj
zyIyTPS6#NAcK}LfnBb;1)^?<yM?7~QsqCw$@n!D|g;4^yQaX>ED^d@1$OPGzJZUi}
z$?Fdv3MPy$jeHH0s#xJNccYYi1xY~hP%RvhfS2B3W4N!quiFhQ44+?N5RbX_a-Tnv
z4q2+*YEg)XkSqNy>xFM;ZHLlpoqlY8p7_57>Te*?XTK&`PMI6~X?ODmz<wpb<o}i&
zEMOO93+d5XL@LcG`SbC{@?<%RL&m!pVlnEBgZ+dk!Y>Su6aQFF3N&1CLwir{)^P7b
z%f6Lo<DrU>Uf8jS6$fCWw)7Rydp=F#2tpC}JHAk-79-55n8@uCI56LbXzgnI{chyo
z&;AxUmqDrP%jXn!-w(Qr{Yw)KC$UL*Qde=f!R~W6G+(fx6Wah2p3vW__89YA`3XaF
zC-InQ-hS6;(5dcSU^To~FS;0Brn{m3yn-IJM-rjCjU&XpCHnRDy8)YB4euVRHBxu-
znH(bdut+oN@{U$K2TEV|x_YyBsVM6i#r=qWLCAdgrHDaQVC<rkkSL<bc0=n`*&#wE
z(2_;Wjwn!|`-{oxYluD6rw6FG-trndcmC?QiqVtvOF&e=97SKsRaHcY#xo=6021?R
z2GTqFeZY=U2Uon^FFV&{^t05H$gzD48<Sj@0<M&L9gb`P-&tLk-)mGRNk!(6(}W5y
z)98ibh|`^2LwIzWQM-_cEqP6U)Yr)6L`Jx9L~Up!C03LygMli)vXW&g^G$f3Y8Mgg
z<~X%JXnpvUMM`l`JE&;1Do|Ek9FfB)i>^tgtU@EPxX;ivDCYNDaI+g#+!MBLlk{rg
zi|P7haP`HakoR9=;WHalGoLiANQ#cvJf^}99ui+ZrIfS6x;S{tBPDn^6ye4E1=9`1
zD;Y)hWb`z)9)8`yn-1>lknx0dck5g2{H~Of@hu-l<04{o+-N!Rwx#C(*cSM&*Kj{p
zi9M_PeeV9yAe!rGfK6md`rCzXU1(6oiJD#ct*!fz&iS-wF9kb>2N`1rG29nZ#MHxR
z+}dAj5;?51At5_(+f2FP;vwt<_yS+5xJX3I5$#`x(AKwgN*IQp83_+CNEvxuLy47D
z`1|x|n3epr#Yvxh_T&sw4}8<6X>NbZWlg{HwK_(e8$Sd3A2Af2Wkxlm%<=HJfzMo8
z(<FakOWhactnQ@EGi%0HvR{IrwT>Z^0dD~p=#iw}MysI{LF4T7yBHh+u!UIy_VMu~
z!X^BQ;TL~84=j-rjH04d-8DBf2&c^v@mW5RGP2Plm1BlzP8Xsn5@J+?IURQ&qWbRg
zzpDwxzV27VW*NhMlXQxfVJQ#)>xq19Y<<<vWZGae%%b6>f9!ec-$K*_Sy@2JRQu`>
zSU6YGQC$F_s(%@x`V=@b1Mr=l*EgD+J9~ZWCw6AsXu+2d(xozsO%c|@^uaoA@VNF`
zm~trQHu}l@cp;9Gugv5Ju|nrDTY$3o<okas?ls(7ioc|DriS)`-rrr}s6J&K+)yS{
zDAP&wt9eUPxFC^r2;yjedQLP5r64bS|45&`At)4cl&vSUI7cCNH=slem$*6kp179(
znOIhEeVa_E$6vOc5?FWxF(uUr2!+?qB|K(b=Mr<>79BU0o(ac4+4F^GDDG#3SxHpZ
zrbv`i0*qz4s$3o@y=Mx{XIG7qCV#p%4(TQ86VP(D?cSk&bVgFYb-N_Wie2uvt!-C2
zK9}jo0||QhH-e1NI<9D%f5OWM4hQqh^G_fyd{*p~LRYpbW<+8-zt}pp$|Gv%xyaK!
zf2xIf*|S65h^J&R<UrNmW+u&UwZmM0I#$IYn%*(JC?e}Xuw#6;x?!HoAnh_SL83eN
zg#o-zd_VjWPWCJpWE=j_h+THo<gIOJw!Ss0XG+4{$~Ole_&^fVNAe%Q{4%Xsno0Z<
zeAW5p&!5Mq9);2TdTQeHea01KcHHR7>|i^)Djyv%FP^lZ8$=pk<*68*{Q1A;CH$`b
z{U~&LDvVUgCt|z$*)K&`>#Mkq2ca89u8WV_U*;s4-bvMza<Ly5O@4_o;#M9ENc0YR
zN1O|n8>alKv}|ozh-VuK$q3su5Q;YZ%aJESyRS=`;RH>Eo1%@GtB>3K5gw19JG#8u
z_-vE(p@%q5zDiNl1N}o|Kj`Y>DE;#{m`~%gnA4(vzsqFUWSry|jH6&?s{C^zjb6+)
znB2v1xvtWhq*>`eCG*=l72}LeFg7hS!THvjIzL;koE7QwVhsO;O*+=qZk9VGE*A&P
zasG32)W-EjYWlA3Tfsq!fl$4r8+tOYyOb)4Hs4zKWH9mzpBr*W?T_Zm&{DhAw(B{z
zmbv=?-EfBiLtByMxw&HKV>hE{)$h@A3dcTL>n^>^9FdqGRc&#a+vgXx__Y=uq52YI
z|GJ+YklLEFiuo`S7p@}1ZknL)41>a{%~$Kuo5^BZ?Kdxq(Xx;NT?Lw2j66d#h?pS#
zku=3wB$PcTW_J73_HRxE<FBK&29v42vL0ujgG`Nq^Y=he+NSw?Q`L@dENttGO<u;2
zh`V^r43f*^d-0nT&uwvvrhD8!4W{wu%$2QY{nDabvnlY@5iC2WcDwXVb-fgvIEAP5
z?s4$LWMcJ_6sOo8l>~CTn>m6Y+IMSPE)#gY)hVSCyC8wegq@G*gFB!pW5{3LI-h)f
zE)-}?COFPsZE~w*hxt{l%0jcmX6^4^LpFJvCXJ%?5<0HcoVBp5yBP?zu@ds0<$qS$
z@Seu}pr6u1lLmRs&ERt}jrGUOeBU+IpX;`<J=UM4m$|&>85xFqI4uNvY;ZDoKV>ES
zxqiYnsCid7rv$ctKXx&pB*TcyB_iwdV}$Uc(poHEZ>f=bY~BOT(fMP%fq^SKlH{Vf
z1nRqvF!JQ&_1zv5<1fL+s*WEf29JJW8rR^EBEGduGK$qC=Tn_>9`IF&>(ebz-!`Sd
zOZRnULUKc#<Un2cu;;FiEC?kStu<HCia$ax!lhhc{QMnPJWTZ!^5|fWEyXW+tq=KT
z{bOW>wf;ZtNj{XoF<?r+OcYxmCFFbR`7<IqVx2gYewUh2ML_Vu4fV72eEj}t(mwbR
z5-!h9UFf)cmnqm;Wo*?=ipIgA_(-AFCfjWHjjb!eo-nq)-^|bEJ<geG{2n)E7l$k>
z_1XOdFJ=qZTIJ<OSd1OlknfM#`%|V8Jm`dNup0Q$9VKJ(xahHhP3=K%G%Z%+=w{f`
zn)4%ku!$k*8kkX)P`e3vWQrTP)8gNZtNGF+$+6~A6^3*1e%q~Vb&-yp)nZErh+WKF
zmo?r6w3P49$e81nyY2=b^5tldsq<ARnj~Vmwmz=yrbg?q^_oWt%QY{bKbV*-R$lW%
zEZ9XOVRiTww|bkabeW;mdT<HL*`AsVL(TsgpX5hJ_{t)3`LE6!!S{GqCiu!Kh*`28
zne;oxcTsYLgoIp<{}nDhGe&G2FDUpKU=XE*<}J)4jne(`^9Z&H|C(_}R^tcaZsFbL
zL~#qya5K11rcT>ASopKhYvL2ksL73<nHbcfyiMUU#+S(>PX2dZb$&+#Pv5wahR4kZ
zug^9q-HC2%D;7U()=F?q=31wXp%o4HRK*16AG2RA{mbIu+0_LT3XJT;2yY|fGb*_v
zB=ud@>*hvHomcb{r{Bp=(@F?rb!XaK8Id#{w)*P3@_34M?0)<my2HOdT1;x_lskoe
zjyNj7zn*I6L|V+tl|Q1ovC6HjYisGLJb2<kyrVQqU2{Lsq1*$vWnsp6$$!eaEE7I=
zRD@ZI)Q1i#e4{AgZilP)V+dh>5xnkKvf`}~(KxT-djpre$kecF%^MPa#^l&*;W#QF
z$OX%Ce5t>w6UUCqv%9cfl(4ox2`DeKuX3&oZm8mg(2~)o;bXei?evo@EW8FofBKHR
zSj{6Gos~=z+$mEE*}bRw1M1vNFKGOUSq(*+)>Q8c7j|W9-(gt<8j{602Gm*xzUU_l
z3@l3V4msm&+XDxyWnT7?F+PD&C$Maw=4M}>@_8I>U)A4PJle-lAL}mX%;~#TUs2%=
zDy^#mqEcwf?3t+JSR5LUbFCShfJcDTc3!=up(T?(_e(9pHy!sR%*b52Xs7x6`QR-l
z9<Y{*sOYp}bRxXuU8#raqu@(q>wQ#jJ)h74Wvu_~v={Oj^dS6tAiF<iQ5sS&r|+`P
z<%;=@wcNgf%D@gPPmM2glL>UcJKG_<yqChg(@T~+%6q98qjz%Ydlv95s9Ty2mm_=*
z(uNDMkwZPrx3)|n;ey80tUF8@*8Og9(e_KfmwQR|(>mKEgz=6JDy(4x{RXm$%@j^!
z#U}1a*c7P-B~$kHTa3HWt5o9j5ma(cZ+>M+(5@^G#$}~KG%M)onO{{ovAJU7;Oyn*
zxPRH~+d4E6dG`{t_0u}LfwHm6+u%;1V4+Wfj<sO-mGtEstUgzh7UL2JOsZ7;&2soD
z3K{Ua1~mfn0i)1spXA(&=;-)9+CkSRGnASTxd&&9^abbcRpzznH;lYH;WCPrOZvJa
z?A4v)xw+Ax@Aj)WO+$Ewv<*3D=_O-R<9#uXTL~b`N<AJk<4Vr6MnWVw$LPoZM7-X=
zs)g8_!ja)&B0A0M4P}hqE{$h}FghVuamE51;4(xF=_q{sech)3pVbJW8?2~kPJ&;g
zRt|IgPIuWkKq2viaC{iqXtvpVuvPQzr(%+5(YL!?uRHD0gBJ#TWowtGZ!*w}hJmDr
zABV-eQ!t4>RzNpb21g{wy2Zby>i~K)0#MpPh&{e<awxAwPg|FWnOQQ%z7`Ut9byj9
z(9N~GyC_a4v8kE}qhujwBl^A`(3=t?Vnh%7`4;z04kvvm9bHA3uy|wv=U;PDY%(c5
zIHEALgdS;3<wl;Zu`>$q@u>9dQ26`PP}hxp%!WKL_>)7N?pFs8cD>^)emA!GDNz^3
z@^@UQAYb-tr9tK642!;7QpRjCc%w)vsq9v}yaCotHkmC&M0Ft2q_P%g8;xl#sJs@+
zYaW}2g?P9AVvFD~f=l3tq8U(XC|~e*e!~%&A}#l`dYQk6<BIBF0-G%UrP!zgs-&%c
zv%m?T|I3Cu<YSKMG1-<6Uy;>2$9opHc->#WAnFt&d-G|M#9XeIV|6HmDGaT>P*PJ*
zNK0H)5-X!Iwn{}@iyTS&)<lGC@4vFvwv%a&I8UP9gEPcaKJ~>CXCFqo5Q1kRc3wd9
zx4aq*lMZnl7L4Xab=O?*mDp4->1!dy7;x3XQ%)%vTbtl7-05d^o-u5;7&b$tZulcj
z<0}Z4&?s;{Udfsb-}n1oKBWp5BhD>61|6qK?^yVvVymj$H@tq=PMipiw!OaY5B*EH
z7bnB;G@2>Z!75P60<i(+HsGjy<G237DNc%~^_scOP0XJcd|<~%ya}0|E>E(kQ4c=4
z>H1QSAjMUgfm!r9+0r@EQCDt|Lb1=~L^*|95tuAKI8;|UAl2s`*<coZfuj>(CUulB
z5e&2dV@A#A{HkzaBBOUy)AVSTni?{~Kjdh5^K7EbWkRZ;`Ri1oT{nH|XY}IMSo=V2
zRy4yFV!?P@QQOIaDJcuL3F$OEi>B=%`d?S^H(}}$DJ9&PdyPWsQ+ToUD`qQIAK#*J
zA;|h-jtF9T)54`J8);rK;Ffeu`O5CueF-|j=m(Q1AvgyABH>wog@)QAYe8x&gr_|J
z-d#Jl%oEr#DIJBp?)}Xp^ZM%zq7}e~$TkvV64F+@*{|uG7e2NybK0+QGG^nOBDo+*
zl(KB1ocF(HhMGMiUY<QtK2tfE<SvsoTx0*+FW3H{Ym3ghWgd7TS`S$wsvoLy86X_`
zuf2ICB)u5i_OOVjTqV@IA(z6zv)xJf|AmNtrLmO--pA^NN}^x7Ld@38(m;->#aY9|
z__z*pQWrjOs_p8_e;;+zr@MowUTfZ9F#9dbrE8C{G_2wYD@u)|wFJ9pc-s8*V6#u~
zytrfx*eJO=O1H+UbU5wUpTgS9*o-?^4Btn4^BiInNj4i_X+y=fi}hNGJ(3HFX&HEk
zQFAusLK~M?a#UL-43H}pQm_}E|LSHa*VjC^$T7#hUac|OjV$KQbf6G0ARd69<ePkK
zkgTuc-c*YXLyThP5@<?BtUr}m94aw=LwCN^C~zA<NH=n`Q~^`A*PN@_qI^Fs$QUB~
zrsv&-U3`L+XgpVlY<T$lQ%AE3ES0xp@8n|cM|noc3O}Q!!6V5Xb<;3&)U|UnH~d+4
zKLT0Kg*2RT5<inQ(0xWWgJ?Y`@%1y~IZy8{Kvq|oNq-FWb8lc4aHrl=;qGuSnDF-f
zh$D(2o^2EukbpOE9;Eqy*n8`@D7&wHSdkDAK|(qtL_k2gOQgGo4nexRTS2<JyFt1K
zP`W#YuA#e!`d-|hx}W$1-s5<m-{zQ^EBD%Kuf5i}&U3?=N8vO(DxB2QxFc}*b3t6m
zf{`5zw>G8c*oLGD(N4^TpCeGRO!lfb{@Vt$>Etf56j>)O^dq1_FqKWGrPOY5;vtSG
zS{|0Gg=+}&GU54VL|+i(iV}$3qEY;wYv~4T-1k%0ZTc$EwJg-T_OebGSl?KjU-=bK
z+LNF@6{|?rHKZg{UJcU{L=)%O+hM;QS#M!aujrU0qOIj#U>V-Q%4od*hR4u4-E(Gt
z?fjEE`=p$Rwpr+^-4>^+MJf<&s6u78p*M?s1VlK_G|5XnYv7<rNKP%P$?slKg6`Qs
zhigykY1^5B4?RAP<R?fDWb=~N9qT(6@1c27t1!b)f}+j@LON#?7tN>8#22$SXNcue
zh9K88@3QJ_By@IbN4||d<uTNM$g<rn4jIa9#l9{E|4zT)MHpu1D>&jiWAs3090Fpo
zi=iE^Q^_>8Sq6eY%fz=03CV^7nF>2{ov1XNkr|a=r4mC7NYM%)2cEFfPRGHc>%x};
z3>)%X-Z|kep!a!U#<k|7Z#~DD^~z;`p6=}(<^cfJ>UY?n;A54TP`gs;_kE+kC2VDS
zgii01u~6}coq{vb*SdT_-Wty<zyn1Wsa2>i^G%FRBeuZpnXlGa^r&CZW{q+svk`oW
zo=|)y8Tw_rgQrX%9ui{iQD!75XgJK7x9}PtN!AqN*JdK%r4<c^M-Y2-k`kl}P17Ks
ziWM;QJ(~4FLF!e@HMtXoX#Zl381+4!@%DW^lU(@;ms(UYxOmI$<U4F&MKn}+xpw3e
z5p$^7^SG6I<~PPQBV-YbziQAf`FXQjN??5%5L|RgaM@5#6-f=MffQUl`wG)R=1!~+
z${($yavw|*M%OG>{eD5M6|7+eT|orxp5O9<RNdBbr&Xx+jRqKQg6(vED+lb9G#|4Z
z5Y3+~hqr0U2Zeh2j*MkIyco0Vj^|skvzbdgLa&9}AKo&0yzl&%DzTU_7y52*l*a(=
zQ5?14I*Lri(-`9?^D)4w@(4ZABAij-CVj_Z_8f;7*O&cnLgy0-U$j#Oc^_uy0vpEw
znbnF;Odrvriw>gT);|rX)+abK@ZtJ2{zoxEjbV^8?5V8b^MXXQ;L^oJO7LxX?f2UB
zi0A9&uOGV+l_lquZ`eB%oM*lBT3K0T58T#{4qg_1=S|5TS;4Z8pI8h4{F1iVU8@Sg
z%tlQU#mne$e=(&S0$J}T)5)X9ywciQn-%+`A!u06PiISfrU_^0q34@EBr7oec18a%
z_IVt@Cns=b#^Y;QV;-fw=y&#?y&?!xp6Tlc^H&&Tv=;hq(@U0bUh{8NSY8LU+l$U$
zh_r69S<Yy13cYtiPIZ=4xXt?=IkklHDN9$@&Je$ch_~Ak^18XO++olR#VU?R`9ro%
z@C4U2RrjR|Wi!D!4Y7dQ%9hwC1`&mDe`ZidtSRac|MP-ju61l*IQ3mAF(%@xzHWZr
zJ30Ze{4xRu<aGWPbH7HA^8ybbS<TE3P~$<PPyDRle0{AgFZg#&bUl5k`r|}%u2yi*
z#(DUKW&+Aq9EJ_)!gtvZYi}S{6?Z&N_*0<4z*jjMfRVbEm{Fm54$*<CS0K<XeqKor
ziuRw@LzS51oW%zkHdP)oN7v(DAW(3P#(>LtQ5)U_^ELao8vCDp1k6;H7g}bDk)o~q
zQTW|FOJT&caKFDcG_4_Bv<oM(cbeH*%GNH2wFSb_0{h3D1Bl}=-nM@nhr`$J38!*|
zAZ2_>O9PjmI-Vn{IP$)_9tf0FG1}1~M6k#`7|6aQj?uScU;A|Cj`khIv;ur}0s)r8
zwV-wy5aRr$@7As66@0j69FR$rzV|#ckK<<O2Erj<q(-8%q;-|goJSUcb`MD@zBxA_
z)WS%E0|XLZ{3A_eI!hleUf$e@0O(ix%<Q973QmICO9s_@Uw8N6%ac)MV!`PGgWvc_
zy1zcA@xXZD9yhmU`dS=34E|UJF=e880!`x)xBawO2I=7v3=T2O+p*D|P}p`ECQxGY
zsK09^ejdjKdnG$|RQDR$W2?91gQiZsqyg_tx5DUmH2u;6gl7lchfZDyBp<WrGMRCE
z_z9fm4wNpE9#Ug0^mNGyP+?fSKSXO+Dw_Z&VAqjDzXy-^N9T;^-wv%^(yoxmVN~d*
zgjkl1D<>UW@S#eAdD{-NEVtL5yr1)8qfxql*k9))Sk)p`Brfw~nF}ioMs$p_<m3+T
zE(Rx3s^3eln{<0X0NhEfoI>VYOPL|4lTvC*oMeOO9WUiNH|wTZl=VC0lm#cn#IRhA
z=R8TmA}OcToC3-DGQ(wAy2C6mYII>t51AxAg(S{|{d)V_VW}Kr6!}efsqSn~*{UPy
z95-mFlHxWO?vFFrvEVYcT3^r<C54P=Qn7u!caX$w=3ePn(j|jo{dmh{e=zj>^sw+i
z$BGm~w-(s9UDXRiLbk`}OZCI^M#WGS<R}rXwfUOtUz{TZM-~VL0J^I|f-bzVm?DCg
z*;|NWm)M^EY=N_YK2U)<-~M$(R`qBt5$*Q&VA%~B`cLj5ku&&KPx_9;n>AHt#J3+V
zS1Vm;?myLgsJG+llfS`pD^LNyM{qnVp~)Oibr_d0tlYJB$<qTt36b@vaO_o_nboRG
zqc>Ra5ktPs32&XVQLa`pHYOTy$m*iSB+%ez;`e+L-?+oK!|7~<Zaib7!AP*}6z<O*
zaW&%ZN}Zg+wi#+6PK!d_03?=rk-gCY634sE#3xE464eS=D8CO;+;Rb0NqoWqY@lr`
z)c4e-8{fD}fwWiPREnS0J~EU;U?5dX_<Yy>(4&?s4K6|x){nk$;^!d=-kpk1a`}?+
z>>-3Q@kVr0K-WGpRwH9bTbG^Oc%wi<)&|OD-*QKwNLn$py3EA;`~sD+<x_?#$I+^3
z=x4-z>qV^G#o~`g<6n1=Ql9p&eK#Y_;&$hwXk%>+?~TdkzkO3ik!7@CY#N<WRutqO
zFyoHgN4W{p^#vz3li4H)#%XU#22_eg|A|>PomaDx-CTX=$;ygu&ZWGP<!v`7;c!r5
z{jCW6L)JDzmJX}&@+6YGVE0)=f#8=q^Ap~t7<7j>o;xAY`@5O05Vl{VNZoKpSH35)
zTkxSWl6%^x%KDyeGY!$zUNMa27O&Syx!Pj!38;@IebDYUalAIEA&JE!u_0WG7n{Xg
zr?f!5y8g4ldO95Z9QqpSs_w<AxvqynbIrR0=>ZR#2vS|)-v)P(IAM_+uBXk+fK^8E
z$e?iJ@!$|Pk(G1p*%3Cpg`)gN0b@B50E>~bbkLuLc@u-Z(zAwKV-T{=qKoo*eI*D;
z&|`hxBWw<bqeCvl$cDqE$xg+ghi-l#w(WcqmRm!#!|u}4DXDO2apyYhLJ98?&&DqW
zVNktIvD-@QhG)0MH>S?;uyX>L8NU2(A0r%{{cG;{GQ2Yq0G{>#PW)*XDtZ5m2G+P^
zUs`f!VONtBF1S%QzN-Khk(adkvXaFT&~yEKdnYC}nkXPDCv<-beAwQbP9U#vm1?X1
z#dbI}@bv4a0-VNFi4>(|AW7K6cwC{~3_n8Dp;aPqC_x?vDoM_)brpZf{E=$F;G@KA
zjoVPiNd+CQHq1&VPp0>Nx{%228br+wn(ds!(`xHlC$p=;6KoM(-ss3za%lLXz`8AY
zOr7@!4}KR@O=3Q|I;*d;*ps~uH9||`gf!3bsk-}3k12pe$ts$N1mO7Yn!gv|s(3Y5
z(_el4IoKBaSZ{?%{(~4Z`YZf{F#-`e(-;mHI5c>#-bN)kKF2JJ))7uA9yU99s#H_a
zmI`7Q0jRXcG#_N;*URZBRl#L|$n@Mrt2G?C@I!;7tGY;T1DE5g><>skwcg-S8$3%I
zez(@1^%ePPzJU9EP*Nex6QBLbgf&*p#wA@vn;kR;ylT8rQ!`(9VVxrjB88ylQQ(ch
zTr6oH!#9yd9Ux<g#40W|0!Ls0N4ZhMlBejnsLk5z$Eyl18|`7Sl?CwArLm4G7dhuF
z(8xxGE>T&Z*-xnDsVwfBG^q{`wWke5IR$NyRkSnxx{e3^;qZjA3rIi8to~ziG{e!_
zyz}3Vts!JWLRqMO_QkrR4Qg|75_ziR;B$pw^YJc;`s+kx-Zo1RQ(xV)pn?e$w>qwE
z1XvzA6j6DSMqR)?CAD_+*~fF@49qsv@n0E|cmxHfi>Fsk2+B1~A{nj%P=_#5J|z2%
zsYgkx2XBTjdLraHWO&r}=Wa&;fpl+1RQXT{v&+_fjV90DAlN7PD*q`o;!k21$v8>r
zB}UEh%Qoov%+EJq{Y`i(lP+^@F&4G#&EyxBOF}Zn>sQe%3D1Xt%#Ui*gSD!Xp49U=
zjge1?1pzD*Z%b>h7XMtQJ_|=R<j4JD#KjBxFyC#jnuhJi?8lF-EVJSew-|K$9ogVZ
zXWTmqliwJ}LF&5ErZ0@@=tKlwPODrR?{W?$p&mT!Z!AMI`RyDG>f2@Obj{6aWr-w)
z1vVKzeTqk#x4h-{tvgYqCxdu-4=$TXA*UpOhI-nSc{w9rdAAUiI2%Ar+y1Q7{1M@+
zjOj1uvgamFQsX2%uoL!<;Yi&ADCJ!u5p8}x8&lH(b<=+0Dh^W_Sx<{iu<!AC^~JzG
z^u-L))23=k^(qypZT7i~CZ@&1#lgrwaH*uPb2uiWdg><m?O{AQ)prDuN>I+gF_a=k
zrYXIO-So6{T{cK~D{hlXuw{Xj!QlI>kbW{j-DV}1hKh6*-W<6>xqFhews$0cBiO_%
zo;7+o(L3k131P2#7#<Wxir*b)8?3O+Oslc!DDBQOc(SYLIIi->ch_d(c;Vm?u~@f?
z8AH%Sj9(9(VJ=s4#v4K(NXCtwE+MPt31MA7(*hFZ?6>h6bkZF@ue5+4BH-xI3rmrk
z9Z}@dwTFG=xO5%HL{h@VEn24>(cFFE-rVy8gq^1apRPV<I8~v8-jr?BcbH}6V7>~o
z*A%ma9F;#V5g@#-VbU8!S>i&O4)}yo7COJy7Qluujjg7nC*#Y8Ac-;wN4t6UVzs_K
zT*Rnp@^$m6+Me&|qa*2+z!MbsUI0-FPfez#EYe0?!t>0Pmq%$ITp1SOYneC31uB6v
zS5qSUplAL7_Pjl{Me6A&wX68bi?Bx2v>;Oe@bZ)E{?LYdYR=K=-~!sn2zgYdfAL{+
zV)V3wJT>EnN&p~_TV;Q0G&0n{2$VixU^Fj$<5*^nQcCkHzdac)LF@@NDKnh5(-2*Q
zCM=f57-7)T?RurO^7!o8v&YA9*SLy*32PjrA++F#-1dk`YA8g068werqWONltYUF7
zxJ+$!k)HNF?WH*`)ZG6iEsZ$E_~Mm7TjSu@ktHry^aOkK<*l>TbiV55YL?|B?cux2
zB;$CxYNKD-<i}mOx`{xP-aVMYF)~@EIm2o`Js3*JF+7;W(lc4EJ)i0Y+c5$jmA05!
zDKSrM1>oCevTnPtOX9T6rt1V$7Yv>l)B){rGq+6|rToO(!{(9mqvhqPOp%bcMu!WH
z$mIu+S{6Wbpsbm?#1tn4JUgII_=<#gb^%}_FVC1NRiCJ_m>ZW)=be+z;9snrA#vaT
zDhuezW?S>1ynOyr@EM$n+zJ3RWaV=^{{)=Af@}3VRx$XQh+S6{g;=tRs`k`JfYV(>
zkvzEa;~TZtLV27i?f^m`3Sirr{1MTZb40_KWm4GLEFm>a0G)B+ZHIPhUcR!Fe>=cu
zZgnpA7_|@JL!dq{UVkD;{Mv}6_Djz<N{~uH<Z9{n4^-kAfS|m8zi})5PArXQJat6v
z?Y!XUaR4a34@*tIM<Zahxwp#jykttTsFE0d#q}Hx!{-@%JR00$lOxNr_haiEpf0h9
z_jRt2t@gX1?HfUPn)1s`R*c?|_8QX(Y2fBgxf5c@p8fTtPlx{Xk<1zHC2b?i`m3ks
z|M$25_!w^s{5If%lnMK9KRg||A^S{-%GoIO`F}m%(~<4Wz;A~5N6(Z=|NAM)p7|~y
zlND|ZhqC<lI{}VV>jr-NxK8Y|EBrrhhAfijIegqgk}cvtZv4OeVSp3(&9LQ#yyyS&
z7<SaZz97T_@y7W1_Sm0&K$8Lbv;ed^#PJ$*_#qfw?#~%DZpO1*?9Ip}&9}Io4K6g=
zFFrIm?j<L)ndkGeFNWu7FFP0-=-R$XWHJay;&rW3cbrlQDbeGKht>o>G9TUZ_GvkZ
z)7kfRl-cp7{3&_iyBs*edZ01McCkBI__`}E^zU!5kQok8<32x_pINXQpqC|c1<1$!
z<O^ie%*vY&xmld{)v7xX2@`<^x_)40@VHpye}Rva{yxhHhY16EtBF_)`?2l2a8whA
z*yl?jenRp^bpY>jN5+FgY9p*`)o6l^FfoFsB4dh+2>x%Q<7@asFb^RPo&UQ14j`q^
z7Y=+4Fz8=Otku;Z1W5Y@x2OVrCZa5W&`C8wGM_S>#*>1GMnF0BE`d?18Qd6KE8mlE
z{`grtXY!PWj*bPO(T}>hTJ|0ST0jrJx9n>4<k1)M-kb<P|LDXFfi+7_WS6U59lIKo
z2RwxmvWz;f8=-c4hBXInVbT5L_w&fm-vt55#2h9TO}b#&aenaM4Ny;=THaJ>69AGk
zWq6zh%>hCeLqI=Pbf>*3>Z=`i99QH8*R3>Y{jwJeU0F?Z;|(-r(O40|?yjn4FU7zX
z)y}2qlCc*-k`?QsEs4cASu`vf>DN?Qla!`><LS*RbZ(?4Ddy1{$A13AT$#f|L}4k7
z`~E9pc(P$ScSYJ<n{W(@A%TD+SiMn!p2xB3Hv{J1&GnZwmfCv+9M_k;0B!!$^tUCU
z;aIToSGTO4qFsE0p&X4+EBS)TKbzVoQ}J9Tw$djFJ}wmB=AU!!AEq0x0OyKIi;12u
zlVTKrMrhO>MraIDH^iA}ax_;ekR`T%xY^=KRq$N}Xu>(3dQFDfeP1jp2gcKDCIcYZ
zE{o=aI-zqn|3`oXFa_|G)0@ks>MRraGKBUkzDUV{bPJP<EH6`Bpk%$(qLw-~T^?{&
zqx%cGZbX;0AnL*Mor$pi)^376Yw)J}F(CQSI6(7O6zIHJaH;{{9<{XrFW7m(ft+}`
z&Qeo#`AJ+sXRy;bPIZZ&LNwGy$f3&~X!PMQFRKNu;aQ&V&5W27hvm~8v|cSiYiD%q
zO`qKH(~_m%1||h|>QJEHh{Y3jZfi+pohrkzIB6@5<H3<)_if?<Ji1Fw>Ukb@hNw75
zfS|7pD7Op(Ea}E(Q^lL;QXaJ803VZ=ncKzgCPe4?4=NX$hDuJTexsJ=5_`;h8Ri~h
z=hP7UY-V)8*(0#O-2=E0J1;s$FC0@j_v`_>G3QNQKqF;vdn{*YE5q9gQg3|(8P6zr
z$nmn>h!T6>$-7)GRke6`G2tnj(c12DbE|wdM5;98d|!|h;Aoy4HeF~vyxjIfJ!kGz
zq97m8WOsvEvlw>6+0SK_4Z=#|fPRS1qUyJa;o1*Qx}>~0VFSxYDLie14z(oI85imL
z0rxyTrSfh0>IEu%_RyuFq4$<=k>bG{No_;9JE);>`LFAHYU?&3qw$qiX`6#N##C2P
z5))e~1r{G8Nj&otktd+@ce}}DGp65$t6Znc<My52MI_k9Y$Xj?Hr|G%8tPOl=>*)d
z%=3E5YECS5zv=tt9iC_i-skD^u$(KpLxDCOy_Fdp<6)CIJ(f>ma5YLCI1I9%PexiM
zHUMw)Oi3qkEqk~Q1mqiqo!Sj)%0v5)yRWb;__mU#lBbyn>&vZ&7wdnRg7rD4m6pG<
z3~4UQv9<;d+bFq$>bES63r<sO<<8*uye)_;svP5rO3luOAnc#$Qzn@X=BGJu_m{^H
zu&Qy}h^(h|Thmc__c1BF5qqmQV{D-_?^v`*_U7uA?8*Y1U{kb4HxM>*F@kxWO-CK@
zr5&`gdcFw;Hr$&UNY}K!AuwVYxH=V9Ws@OP^>|NdShF2sT{17L_U9E5-#`m&2!5hx
zx)qF;-t5|p7(P}^H-nsJR`nHIKw*&NMz3^-%cV(ybSc;Ih5e)~T{Alv+Vv)XO0srn
zsE6uNH;Wfsbv0hi*PZlGC%{&$I&m?9<zxwU>8a>&{?DS~yDLIwEhO^U4>9BP@;HCW
zp+-`6rd(S)8W-<L{{;73#a{|-jVj)S2M|#SLrhmtN=N5C_PGH%wX~}8MZ_26VJLK^
zD{FElg6Vyq{rZ7sH<KrYpZe1gKm)_1Zq6u0kKH)UF<$e>Cd9mg&GyZg>~?(P)Yaj=
z@jNMgNI*qJKfBQ&9<Bqc#xen$Sz?SVcb`l|u<rSKgn+C~j1QTD(4zwwBn}+hidi83
z&Fy+MP^JV_7J5p=WtTf&52!j3xXxeSW9lcfn(BK!+!#AA0Ko^A>j#Wtxa@BF`KS5V
zuX*r3U@hw*s}5TrsWS>tLm7-4qnZ`axQ7DT5pt6f`am>Qy<nAA@jzZlOE_==A?9&%
zxK}2Rg(pTP8M~aQ>#rN;?yIES*vYL^b?>|53hv2aAFZk4yPW-#3ZQF)^fQ2PPc~B7
zOJ}qs*hvbTtgE}U5q0QY{c9V4TViq{gZ{zO+uCyCLVgEWGSsK+tsJTZRiTAlhqci{
ztSj__Zkmn9B9gaELP?yRyRDv1s7(x#@*ZsfX|!qhImeargj|i1|A?v63T?HFbvd6M
zoBc39{le7{_k&S4<hj+x$$EIyHOux%myj3rNTT&+b7k9&`Mw23*yow(Lh=~FvpW&<
zl(%ob>dz0{CTBek+LHGo@liLfpNpLcJ3)TguDP46FJ`<?Vj;O7h%0g$+Duhrv6sE!
ztH0nz8!AaCGeF3&i~2g4+h|lB?y1F&sg*rLa5MNeKb}w5QOT=cwJti%iDfPr6V<Zm
zOJKo>=72@3m2myYqibDH8x)cdkm3qTRK(w%DO>$ce_&m!NPM;vM%b{!Q@rk^dhS@z
zg?~8aC35D`Q@a2z&j@2tZT+-h(dI>Q)*ZLk#QL~ZAOx}j8)PQ2SZ5i`H-PCgHtA!2
zUT!oV0F0b1r_jApr-nfkYG*K4|CEAbn)MHgq%YalR?EGtb(R@@9-72eLz2)mQfh7n
z%wA>ZBs{(uTg&PnII7w4^f}vHn0m4e){*!uMRz2)nnBvd1J5<%bafr?p><)|1xdyq
z+hpT2q#ctD2Hxv%KL!|pI0|Nq%<%pbwFzEOMb>Aom83ER1mNO1lp@B95!rqx<n1pJ
zS)v8<8Zl>wqX0yIGs{5N<3!{PP}ynp-2=j6^JETdE9hX-`Z(KY9LFFaL9~Tf&dnd!
zg%Ag*ur2WdR7{s*9!Xg28;eo>v=oIO<bpmGSL~KeX>Ev{0^1MHufm3^X)PD~a}x`|
z!LlEtog+Ymiui4?UAnVLCAr1}K=rDpw?qtzv;>K7r>qnqm;Dofmc}9D(FTw2DlT3s
zkH6%$N1wLa`CK4z=1OZI%YMAJ4IZ(qYO>ASyL#TLISH7BOSNa$C+lfsx#z^r3uA?0
zt$i%whOuJ75Wyt^lqFj0H?EuF%8h`Qk#q{X<sD7Oh)4MW0*+zB*)R`J`Kff2^GHbr
z*en2@^bn!~7gZmGMg7z-)jpUZux!zKF+JRD2=IHb1Hl{HVzaZeesK7Zi2T@z*$ma3
zRg>rftGvKwM+cOGaKkahkuV8K&U&3!apOm(Z!Kar+WxcqvlMn#OAyVKGEHtKc}09e
z8;SL_c5Qm&V-35NVN%rk7UvNrLdMj}#X2Fo4G95we@DNtcYgDj2QiTpNtUDMaADGc
z-_4PFJT&>!OzPP+MuOM%C0$D3u-b&N@g12qvb!}nJA{UuF{W;4FByj*mt@1;R_N-0
zn7WQV(5g8a3w5bJdr;dtoZUMj#XxqUENQ-=rL`f`a%yjqFPWz!U*b<P=$XlOXBMF@
zzA4GQP3hUS%k>}|u{|;?2blSH?T;2aaH|0Y2d653o7zawz4h+VaO>6vyOB4YN1x`p
z_kDh&Q0texKXux3ymr%Tu-z61B`-x}TK}Fwr<rK6Au6O=JCZM$?aCwJa`%>Ac%O!9
z%++UH=f!y=yY?1#j;98NG&w3i3)7!HFvbjCFh<zGY1B#Ch|No;(~BMcs>1rVL7yYo
zj2Whk7(}H1aUd`XzCgSD;m<a|{Iat5oK2Y9u)+2XV|P*y|6R`}F|IQIjbjzpj&Dc)
z97^pFg>ju@_T=Z3B)EH>%l%I?0${ME@Yd=Y^9uUkCkTZe(zCcKAn0itl-2w&VZ5-v
zGJ8->E|hd3DGssZd%M7&#$z&?*$ICB0+DiDEQ}ydd?tXHGGVU0-pV_IgfIH?2YA-^
z7tdv)K{(Cr{nhe7sk8sB6;fx`pP2Ds-ZN?E(&3O49PtJII6e(VUEO9ssU#f6wSu@g
zoF5CWAQQ=brL-sAzXYp-P|ET9?x)V~OZ5os3}quea;@ZD!-62->wsnJg7VlP<H^zl
z$)vQm8^iTV(U{GrG=Z|RGY_B!+nKS8QdPw@4ahGgg9R{vz$%vZ?3f3_%B}GO2gZyI
zen&74!va5DH`M{EXWtfN+MsXK8<53{3sRb#WH+;>v-=W*bx}WHsmj??POf6q>I2*x
zo)q^{&4jG|jyJG&k+;&$)7y^qb|bY()0%tz9x)_LzcQaI<?1`g`{Q(Y-aPMpr5SQG
zphQZb^-iY8%EQYVcqFtP^XPjX!}R$AbD30j#!BmfklTjy!{u<fTvLMwzaNI0x*Fi4
zs4LtnoP*}I#;=E|bQz@i6%v>2%{hzUOJZ+(*DuZw+~1n!XHGja1|A4_=qk-q2Kp=P
z_xWB7>>F0sEtcQ>*}R$!G@wg8JCws(1W(D`<XIfHoJxzyrLK>6uB=`~@8!PoB4MSk
z^giD1+MM9utQ=NvU3jq4y)U6Oc7n*yy;i-XN3C?(jqzSMF-vGTa8Yq>E>5*|hfbWH
zy>2b@9xwN|+BrIHhW!X$Pyv@Q&}?0IiiNm-*}L0D3YqZiHWs){7&zN*MuO$mWPr=8
zJT1TdSQnK`RH{qfqz50}alWe*AQgSQuWY%W=BzbNf>|vv?7`}r!)M*G{OgR*9d<wt
zCw)O91{RNsbHncX;^bjye-DJj1eeg`svKUJF@Bn*Vec@%etrsw?Ig@rbW|ahW0HQp
z1cbnv@B4XTT!lpZop`3Y(+XNHM%-+3`C6I%B#U7X8tFp_W@3x$SE0>`XS`OJZ<Te>
zE?aMW>k;?f4b&{NguXsKqX{feE5C2WJMSj6{vMo!A+D@r?bIJ#QgNYiDiJi&XulOd
zw<92{CPkS)+q(tP0s5_dRC^tNe@8CYGDAf+Tk;@%0QS0`isJ=%d#Md8iL&w%Q{_J_
z>T^Fc!0e>1qO2lu2{LyvZo6CeH;@n$_^{tRL!l`o@-V+4TXe(yNISNM&Lfj;0V_p7
z7W#c8L0xz)w8v*1aT!SM=@tdOIC_i9=@t2)P$41FlYh%R5iD0G3(J%C3+l(?KxWyR
z_pP2qd#t}Bi3mnjG9He|P<+2C{^IbDmE2qAJ6~KrzR82OSuZ04;m4$daMg5L>q$Et
zW$3W3+Iw3e{n+mzk$f`-sm)7EX}G8XNxOHD$L?nP?B8ELSZBl+m33-e#H~by<>_yz
z2g34BJ#Pb%54qR2hftl&)8<Mny7#{=ad*$CIJW<7>srj{OPh3>qnDiw#^AUGEz5+B
z#-hvIN1AdE0@{w-a0O4goF__JdMaJ;b0#@qgKRTeN?*NMJLGOoOq&AW#x#!J;_huu
zYg#+nir+nK8yn`|<rY`y_dYewS`|m<vzfwzBh<59KFnLzYuCKA(zNAeof7HL)OA@!
za1PHH&oN~LaTeOh=HK^k0e*=CkQpth{2j$3kYTso33zIcR16vCG3@vT_0`{Zz#pv4
zCbI%bcAZKN*yyEfov;n^fR#^_$pt%;19xBx;?*Cq)&$7zy_HB%B1!;qhI4tQ!O4EN
zka_+$?Vy9q%bzJYidww!*Hvp^k1RaeB1moI!CS@xFsbd9Aa17egw#XzVt<w}Z7z;o
z|A@PQ9J8?iduLbv>?Goc#U9zlxtx0xhM&eiP#Gn~IW~>`&)iai*mZ*QA*|+FOg?)(
zPLcuo23oeW#n9{*0|gT|rj#Rdc;xPu@!H4cGFM!q-Ckp?g}_SAsiF`wo-?6~eI_zt
znC%1+_D;ImXH8sW*Xck|3p<>s^IN7p><=eoWv|eVBAO7hm0o(VjmEbsSPreL)G(TF
z;Di+j{;7H=XJxfJPxfocF75Oz1<k2hb<2z4Qu+vq{bG*N^YY$3e{LNnp#3WSc|=@K
zO`o!{3_!Z{(4lTWI0=%QHPxSSCS1jHYG%E8jMl=t?~x_Ey&N%xiV~h}gtoqwn>xn<
z-Nmzz66;S_PWXbswY=L65ouNNX?70B({wk&SQ)`+xu-PHfnNo6;?fe5MD2ge#R=Au
z$vgN3uPK;JWlHDA>0_%>rimcnbk)maXrN8vybylj+SSwWl&2~Fc;XTNJu@5cJ^!bo
z3wE0loSg|bj!s6>yYfWVFhUO5PI(Eo<6$xRz5*iJZ?r-pwu<}bX?lEXK_}PbP6VM(
z{AQtPD9|sc#LL+tsMUbVX9`fwm<`fD;muw?YjrC33)WwE5$bo7Mi9vXGHo04Rth>^
z?h~lqEE;{3*y7WqSdSlbGqYRT>Pt`-VXzOld!H-mz6I;r{S1?^TYXM1L(KCmOyjRB
z*EKZoZkwN9k6ucEY#JB4`JxO7as!9GR|mX@47CFrpH&_?^b>v5bp3{jTh~-mq1pPu
zq18l#*Q&?=D2(Z<m8JVb!!N(q@^AjflBEixs%6}iw|hZD+8>EB<jVc}rF6sU>9Fq)
zKt(sluwc4e8eJZ?ZVQVSSOYKt$WrNSCa9YmS3}<QHZTbKk#5v<^Ici$2ED2%kJe4I
z!eAoxzN8!yLT6NDW;Q2tg$K)$F7v_G5qj;2n_*53ekIm_(yy8Q$k=I_c0i`F2}ft6
zGE>D|F)2QOsAfC@SGfi=eCg2q0%uO(@y=j_nBoW>fpkjokF6#qK(j)pAeJ8&pp3*Q
zZUH1o8Ei~jh{ldkKy>IS(tZ;8_wVEaJ^Hh%ZqC+7@HF~*D!zX+=;w^cG||qUM_DT-
ztFcW1vZb0?g@E2GLqiE%8*Og|h<e;isOaOe`4(-Vc&bvSc3C=Q1p$Io_<ZzRW!^_E
zm|RQfLvz@RHD1ytonP^D#v%JHEGYDa*Hz-PH=~F>_rDqD=l?JWm&R$<lv>wIP0N;|
z<Qga;(`xh?3-4u-yYIF*fds`bpV{)fy;q-NaHczgQ|I>!<`t23J!agJIJ=P{{MgTS
zFZN!jD})G_baLE5jmJ?pp&$r^5pDXc!nXy)+%$pm#a$hplu=LwA-~_P&|}uVifay$
zF+7B8jDXH(Z#eD2=J!x$4~H`eUed0XiBK2PBu<8NIRkFf=~ste+82^SPDeboVVV!z
z8giC_@HoqiIJ4KCi?sZ>*{&uCRLins4t4MTlZ!8Y?%O{MQndIfANq1Lg(l!HjpX4l
zL^2?o=B^Eyw{Fv(%Z|IjqeWRF;As9G*&N<af?~7xqW*Gsip~q@|I9i&XT*+WS9yhl
z&@jaXG7;Y}Rjsf!b%H67(@%)z<IyBt0;79&m^|J5&b9~`vY3h5wg@a{8$BnX_gFuW
zE!3E3-?Yrg%ApWNrN)lbPISpvuB8~{Un=q9SUcUABv^IvWW=7U_u|q1bM@3$y|%3+
zOTTN-Zyy~!k(9y_&b$AyDP$^ez}NV@sK{>|#A&1O`<HDs)^q-5uS>b{ufSHK)Oom~
zoZrbXA=iG~vkyCg!r?H3!l-Gl)ZVGfSY+EJ&oG$UZa2G59%IVlpgrZb(XNF6b+_c~
zz)Zp_LqE9Fz-@y-*l?v#ouOj7;NoM7@p{qsK_pK8&hD<0_@ZIb`35%H4E_0U21$_J
z09Db3yKG<Gv#+^lD&_OK6?k``%~xIWu5JpSmU9jzU!$bUv~nW;ZH~Y&Mq`5|)tjC>
z0_O4^8%?8DF&vbRJO|WIKKJ2_k0aA^&!WqhB?u*H_jB!d5N346<!IJhN$kL~4OB$$
zQITm;eiASv<8f2dri)w1Cxgg>%bl?J1ay}Fnk(QX1tF>oyTZ^Ni0*~*B2a&-G;ze7
z*Jz|}B8cwK)N99Nr_}2lIzvS$4I@q2t9A4OZUgrjsq03R%bNw~GCWGeHEcG<>+hf&
z37ptEU?HOqS)N|ee$nG;twtn1c{H)*$cW~AOQr83MOF9#ebdqY>dnJw=N9Ro0fd(a
zS0#7i=c6dB^E%V@AF*?%kP!JE`!-Y*S~4-|W7;AStDCxi_>$Fgi<ThG8G7HZ9<of3
z@$IaL=o*b^%h%PR@fVw4Y*%yYRSG!m=QbLer!Q4oOvQN9Ow@ghX;_)pZ>EERUUu%C
zrLpqe+%!BiZo)+)UfbU8UeT0$&>8^Vv}CT6zNSCIZyctQnqBfrWP}e^eyU<&<>qL6
zYg}v(_LD3G)8>Gj6+Lt47&rg)hENdi_lxYZ*iJ}_Hp#MnD1%jx*Nn?M;1q2)o?M0;
z8W8?%?A$O4YckgoVro0s=q5Qyg+%BUuj?NOewrI56t)7(j-f^qdkv=4Ij5yDrt&^^
zG&6lx>2qrjj3cC@1T8y>@nQxi0!jUqva`>A!Q;B_2er9|4wht#%=8AOp0?HjK-FkI
z&v|!}rtenB@z;d*0*Xil7*-7C9-vJ81|cO#q+9<-KHzaQOL*W(DV4db>Kv#hZXbUi
zN@6LH*7uK>xcnRq0kjfqKk9hhY*Kn*s%^|sc#UnQW8rtR+qKroj)=*hlu-1c(l%+t
zow@_rb!}G_=ytFqMD>G^i0kHr6*r@mMwU^I$N;ezQWkgl$S8i0p-F9SMZGd$D1uH^
zbQz%;O)e_}R;LThj2b5GTwlldUAar$of^q9rvkFqr%kJ&)crWxU&RewIv6BMJYKit
zWiTqPRgWyQEbQ{o@0+oXc%`>El*RwxKY0)`)F^iCojr|ncF1PbWGK1YZV}`EfSbcw
zNP?q&BdR~p7?I%4N#wevZ~a4h&F@RZ&|73U%<r*slZWocHCU#UpIvxX^6k*$?hgtQ
zU2n4<Yrd~gfG8ehbdq`)RXutLariy~Z~N49bI+UD`2v?PcUrgK(@DMNOLb?+hk0qo
zVO9CL4ZkHrjjWy&5N{i_%kD&OKuQdu$pg<+B^T{&kV-!Xgrf^YM-pW2;YeP#n|t0`
z{#gCnOdN9wk~UW2H!}cGm90K32Q$te?sZfDZHsODrqJP4oJ7oiKT(K&<OgsUAVzFb
z`f?SNqky4ORv2S8l`={zkW6&}xZcJouhItnWOhrlX<ctm+=6U?lFewXGsvn7H?71x
zkA+lNq*6)8Z6|Lft6z?Zs}%PqkjAwPT{G#eA&&sLE2O?E`&A9dWE1dA{dq;oztF{0
z>F2{!E|tI#<U#@lqhxXeB|lt2kgbkGSla_^06}fhtfXu~Qs8hy#5=Y^n_(7Vy-c?a
zJZJL<O*?(s;7=$4TmJ_cLoMU9(<xr&F7dt^0c>Frk-l0YZffmY^G8kVR>LOeqr=^D
zvL>JkV?U#?i2X;Dj*&(uEW$dcimtunLe}oC6DY>)<a<9ph|(RfS}!diV9MeOi_FAr
zx*cd46vpayHJo|@REgyy6^+p3eD!K0hRkwEtJPwY=shQiOTB!_UE!;nniNL&J0-e-
zRD&0;!?jFO?50Y~7La`3o%^d-IVzgph!4y-RUs<2EqTFNrwM3ljb~Hd4SIzdecx1@
zHHH#{?6pJVH_aK1jfT~?tFF&hFOBj<YZopFm*qa;&f$?YUG}qE*2{oCVHJ#U2)s_T
z${*2L0eLH6D0jU)VV~~SFtzsI=?8WNH^H@G`t2X<KR6xSKN1@py4c4acz0VYG=WX6
zRnZ9mF7FWSB;#UjQ;`z<MQ;s4+;$b$4J=`it)julMo*uyU;#STLeo0kipnC@f`FUc
zt8Y0t+BI;aQn(eCkU16IZ%J!G+lh=YS+)W`-r2##*3r`Gn(#TJG|}$YP;K4_rWj~r
zB0b~$lsQN}%L9R;E1Bz(1i_B|sh}|kGUur2P&S@3A7UBWXF|cIn+WF6;Om{&WOpe6
zsTN!M&zenTUd$94m-A)w=0`;cXLFKTYc+D_$CcZ{D4eLso0((EYwz8{wD8^MaeQF2
zV8xkf?H=o~a^E)TZtg8YVAvGxtql$GO2-^r&(8F2TkyCBE_~<1b^oN++^*rhzhT~e
zIDjY2Fe<FPmf15JNRgQ?wFb(ame_RpLW>0DVQWl=qVrx(Kf~Ix_1eQM^;QlzOg8-B
zADLYO@HyS$O|_OE+P>X(#+%3Ww2wW~C+K=Lu1^8m?@*@Sn0j;nLK8gI@Xg?9=?e=t
zw40qA2OeP>YDa#O$h7@pboaBSn4)xG6B~M^W5pme>NJOFEPO5fWP!PtwA|Wo;qk4t
z8VLgcR^!U4kye{L2(gqIp*~J9TdzdN1sRzZKn4bzj%NB|*|HYKPnD>S?1OI)yJZh-
zEwuDEA`llbJxde($IJwoH{V6|yVW(|1l_GB!N*A70)b(_K!V-%X|9=f+cMbEQOHFs
z6mJ#JywRj=obvhJuRpI#+J*H);^XR+N<wkVDI3H+xB!W9ZGmG~W7yy(<OYS7*8d{a
zZa`D&E=uCKGM&px-Da=L08p~8=&Txm=!y%8-2CO7ziC8Yof-$?(?{@(l)qN`6At1~
zYXx(eXFze{m1Kb>Sr<)*(bFh#tX&Z_VU#O$)LKwu`}@auwqG!Kz6cWvL@de62X@^W
zMWXq>4_`so4R@m;phV@UrExA-fEz$aue4`*Uak3_UbuwHx?+!g0j-LS4CFa&r7}YF
zO9jimPpE96eLf?lA~XA}HhQ@AD3pD~`=kONsALZ)u8j;6va#2b)Qf)R91pjE$06oe
zc-?*A@cvBuamQ%5#g0V(mp=}tRh_;sBES#lv#{43#!AthfC@%&YFdt$89bn_sT0!o
z=D^Hc8+epF=ITaa63}E4ue)es|GAev6%1rqACjlfdU($t)N(TGmnb!~4G@xuOMNhE
z|MKOo=cRR4j)jMhDUo`URT7r=_X;H`{`Ex--)#9ql_TWb<(PKO)62f68aSDmiS)pr
zpXuPcRk6moF#qh=P@lzXYq<7@B1qc#&A+uIOx_FE7)o2mJRmJ2$j{tIvGW|DuWyJO
zy5r~nTU;F+BPaxqqas6B0_1naB>n_!S}&j|7~VI;)(64|y_ZSGCLc&WlW%2}x0<Um
z?51*GPcqLVK&C9yFkPwJu64c3oOMR##Kd%HwHOI9REVr-jHO7qte>dY((LyaK1k}D
zygbE@4vd7w@t@UdRiuqLQuY>AOcyCpzk|)1%H$i5q|0K@dq3Wv^|5c++nLroB$*qg
zbr=|@sHm1JeO*aEY`Nxl&6lq7?{lJ$cV2pRa-Vf{+8LQ3b)dmEXm$xZwUaQ${KTrK
zyXa<T60{UKR0lT{=?!f#sEIv}W-U{s%*xgdX_D}h0ncDZWYz7XSvG2_F{Vnte;Y%8
zR$D3-3ST7sJ^~9F;grbCvek4$J0?UXooPAr+PU1+v@1P7?9ZKjA7hHa`dR|sy(PZs
zCPf@Y%w~V@*4Dh!5Ojbi>i8t$fhkRw<m;tLo1g1ycJ2LF9Db^g!&M&h`8!yrKPT;T
znMayXaNqv}kMvirNiXQlhs4aPPD$}@j1P8jFA!hZC?&1=lgXG?*{Ux%Fv}=RoKwAm
z!}##Zw;@w8QR`2m_=0)l=Rxk%a$ji4azXOhrTHqa{co;Fl>gvY<b&ZclqD-wij?Bs
z;4y#u*$9*}7bZV8e~vn%9q-x%TfZPo0d&o$fMC75@%WaLNd?5o0Pl<WUS0)AOI+>i
zuRos?=^OlGT*o#)OQVnseve+>yi8(A;^G_{l5;vmPuR%GOck11Ec72}QRhpt!cL!K
z9Joe|$dCsBz+ldQf3D=53`b?o9i#uuGy^=qljpcM-S};w62nIj5l)4wun>>Yn{TPB
zO5yk`LYDR-VjD5LRd~o*4kw%Qe1o8vMVnm!X7%4A*Gb?au^J(Y8F`;qfRsNo0Ku>;
zx&2@jzP9|q=LE=pC96E!%u_UBK=Cz`UWuGXOa#g_$<1<g&z&t-mZ>Z?TDRE<uj{sS
zCl*lzG+a${*mhGwUYqUcZ+_g_ixK!+&~x$x3Inreefc{Y>7TwEn+t$Ykz11mBl#AS
zjjna-7OydDy@11biGg>!5bvuT{kJS)aN09J$;x_+O@Bcg3_<xKxLz$dI2zzFa-Rt^
z|NDBt$iJi&SrWuX|4*3yuUG54Mgc%$JS;y4{q3~>`uKkb{(tS|AYduK{ivn~9ZE4i
zZ?swcO<uv?<^NyMOn;4CJ654WPC$`*b$*d{bKULvjz|7`c?=;#0AVL9E#ZlO`FDud
zKTScN_@%gV5wMGP{IIJ?ZvX()fJigx=4^{`O47#mKLv+>I|3B3Oi-CdzD}##kAYwC
z_QkQ8e#Vl>moJO|j&=LTzkk6WD@!b+oxWAZrZWU8$2<1MjQ=*z|HLd)@q+iTi=d+D
z><i$p$FdSavETm3g$08!+NG!*g`xC?gNaQ3Qyz-;hJUNs{qtpHLa;`61pusO;pK%I
zCQh%Wd=k4QB>Dro>*s%&{=XlDO#TZz0O3&nl1G!CO;(64rzwy5KQB85%vod(WIxG7
z)S~}o+NuF_Y}Lvq6BGKG_J4V_cwnM75Rw&sZ~VI}{a4<}hYC3G5b-7LSBBjG<^J>l
zH0Jl_=l^%<zmLlQz3~4(nprga#S_XKz?pz|=Ibl)*)0<B`8^tVykcb7ndnM?`OUek
zhYdZU)X$0kr(;w$ewwAz!t%)W$ob&&aVcosyp`0;4;}vGLFT2E0XvgLF<7ePeHQ<7
z5*DKY%d(BqJ75M==3VYg^gK}>i)P#;@~Qv;Wh2U8djG>I`0joIpxFx=Pt!U`S>|Z$
zJPiQMQ;wg`jVhA`(efNN81NU^zlKK<T>(%rtN@tvld6{O4}4CWOxL}#`oYKh<;SGg
z#M~R6VE_aBd<y^;KD-Mj=1G16V5Z?xzsI@;P+&uk4_5;A07-ocuqvbgc+urjpmYco
zc)XE2_4UxCg^%yNuTiG`ErKeVSz0={0N^=|YNtRf0G_?&W+O&UdL;cXNblO=s-O1H
z(0{J|D&oMczakU@c&+jzrRM-x>o`%=Ekl=%`t+AL1k|^QPv~V2ATwswGzrvoj}X6~
zF3bUC=OF+{oxsye&bRK1MDoe|{vx4qx41-lAf7&?Di%oQCENf!`9qySSVKS}&-@A6
zz!7(_U_Ua{+ya1%esFDP`Y+r(VQT0qS^#QJdMWB+G#&Q?Hfobv^BD%Ur@^253vrz0
zykvWl1gW#!J4{j4aiwzcV66nwL9#wi==&iBF=Cv>E+^lYAA@d-1VtzarN~m;OGh)$
zy>$Sf>LB~P#d>F~6hmXD!_Ih@2f&=)38G`QIQ`3Fd})DIA5%08aOG?HSK`t|rN)xH
z?ykk#mS<JW_hQ+T07K^{FZtTXbI%a^x=+A6$S_?7dzv_p<pE6xLm#yoMxXjB#PNb5
zy-^fHh=dj^(cI3577XC)we7>~x#?$5C|bK0Xs!iM4W7`$<|B6FR9n#{!;kNU45v%g
zpPDH0oem)RUiUE98B>WgPVWbgvz>wrg061>&N)I$ecAnpuX;k32Z3=10f(4w1RI$V
ziPYnlD}Yq??-9eIif%prjXG>#0^scPjfRrP7A<gn+M^pXP~=Oa2gw)DI5bwZjw-hs
zf6QL`^$+tL?SC=9*F6THS4mHb0;NFi>qi5;>pz2p;#6Sm!s7x~pO87gc!1IgjT3b=
zfRaz1ofcj14vPT?f_qtnt&1fWS=9s%Y9<B&=zeO-*}FiZHF#{a-G{p~xvOqjKNX-g
zgD67TdOIX21|AEUnq$c&XKXUQuy5!V=*D0X4tT{R2iU_HI0&!@K5cv?bP|gtk24wS
zLf+f`YUrpidKieh;6NW!netViJJ7Lu`N<l<$;)1-MI)7rNPTg=m{J{Tuw9R4h?A9X
z1k!wi+RlrHK!O+dYFhIu=&%GxX>ia)jN;0$HJtX-5r+U1kiy}mX&mJ*%EJQ5w?*IN
z<gV^i^3Ga&P|&3Ph9&9BzP;wz|1?o+u1Z}lB_DOAUu`sm;>q<7GkN|}85wX1pN!z+
zp5dao4fEgbx2Fe7+`Odi->mE*Vd)`px9EB$MQI2`DGcueuX|BNP7KzR^tvNRt)1o!
zaXHXT0BJXtC;5pYl@gEwR`0n#xDd6i(1zeyv9{OsDiSqks>f-c75;I*w1}{L-@+-N
zAe9%Qo<qTADVC1r_PV#~jWTwD=!@FgX^jCHnu!`_iybUA%&Up<3KiRUvWYW}Wx(cZ
zFZ}ue`2J4kXb3}7FESn0d+Bzm($Qai|JV%_hdzxio1di5KmegtqFu1$-LVG(j?B#s
zQ1oA)iyOS!R`v%ZDgLlpLRi%}WIRVTd6V*4E$SDYI@W`!m?qF+`ZUH(cD?q(6LG9R
z6OaPo<NBMjDGGBbbii`H-oPju;A%Mm0_e=ie$@bMuQBbZZ9v#mBUNAM4schp@<sdD
zWrKN}KP`}f*-A5S&S>6a==K10kHAUJX<^0@D+ciL!@|;j{Xh!X5?dGLpMG6g^~ssX
z3(E)D_OW4Dg8hOSG>f0_o*O7yudt={v}J{SmGziPX_+q5BpeExA#{G6_H6fg4y_ts
zu<z+>7C9kj<;w%Iu2wd#05+HURG!czI4mD;hyJ0sq<j~#Jo#;uY-W^Cj_-a&+rzHc
zwwXx46I#B^i-Pf)HPEk-<a*qJw5W<;pT=SwUXl^vPoePngqzh`XCnEVhLG4qcZ(@^
z*lzI-VVOp)oi+UvOlqq#6GmsU4K!+`F++O*r)osvb^Vp&K=@*+rV@DH%TJhG2GKCY
zE&X}`m<W@~znfI1Le`qmvJZ>Gumcu_<io}0<{iqh7}l<hF)>odnMrJ%IHeht#cU4;
zSz4hypu7tO)I99x`p@Xj$)@#$%a8S`ZK<tDy{@y&b<4zAT~EJNLzB%3kTDZ<+=|T2
ziGd>0?3Y(~2>SN`CO>tcwV$qeHGnX*B{Ms}Bh2rmH-Ou>LK)`XD_w`^-phKvGiyBW
z*>)YX>{=>P$Pp!{(fq4B#8xN`*z-HGn2uB0cfJv8@J)tEzn?&1HPgIMxgfRfm%55w
z<1(R*g#9{XtZmFMr_m;In*EC8EeVmk7y%&C><3I<1&31&^~w1eMHQaFRF*Y4^^~C_
z{IQE~iH@f1=($;PT2etf9SSm@D5fp))7ct-0PkmwNMFV1&we=mwR;XY2$kN?Oy1$V
zr{W3a?jkyG6_j|%WN^pMWUhiBViVwvRR^FQ*swJ_{(3j5z(oafXYIWgN^<%x|Kuc-
zOwpJ<HHkG1X*?#<QR5cL)nn$cst41Qlu#8_)veRO<xL4}!#$!){X2Lhk?D_#SuRBJ
zal~Y|7+wKkecGOrAVYiv2FQW*qyhsCZGVC8FoJ)fusHBfylrL^=F9u=igHJqZ;fx1
z^;y}}&aJL1wGkeRO-1tXW(0+tFANm(J8YEIUJ6aFSWOlxSVbPHszlHJ0vh0&|FE%1
z`rBH=-T+|jg60ZXREe)h2EXTmvkd-tgnE+KiX`hO3aUcPN)AULfuKuFPr!G~q|;Hd
z-UN~P9Z>sNyWrMdQ!)qRgr178aI5K3%jt|`t(>je+WR8}`Y6KtujK};qbj;%?Q~We
z+^R}>tfSK_>H<rsUxQn-gwnr|C&5$L#!M9{^&nL8^&wVY#7oKt<(p%y-CUoY7Zr&T
zSUiax$l3%S#(a1$)SfbX%}n#@SG*ZWKw(LT_oPQufDP~BUSbDRdqaH%Va%j$Y?laV
zoUYMy?b(X5^giz~K1(XgjF!<U3O_kfrHt%F?Mqp!a5!9;v#1#pWxy*(oVT6u0lg4s
z#O%HjYZII2N+yATG^Mc5^4*<*JT?17ft<6%Se-mRL&FLjb$=1MTS#5tZuYGiu;KM`
zUSo;NOfkQuW*#&UUi-ltyrG?C>SP;}2=or-8)xNXxW;@a^P+vH4i!NRqGd+*#w4N~
zH)7tT_mvO`0N}qmt6bGU-I5SlvngVY3G8sRr{RXUqwdlE9Ep-40bL5YOk;JZ-t`;|
z>c$+SJiRftWgl7o;!95Wqp63|Y{&Jmv5=TD9A+H#-6iM@^T(%uY+?k9FoFGK{YO8^
z&=9YU8&a9SjG?|wL$+a3T8N`{CCgN1DTX4!O%zF*TW&y3l5>nu=zbza`aW@L-c5#Z
z93Ao$>$Q4L@jAN3x>R5uECYgBSP2PYe}P2(R?Xy#*b{mJzQ6~u!73|+Y7xEY${Vt=
zKHs5x2MNQX%Ij+hO8f3GJD#%sI{s>C7#r#39AM1P=hI4;fND|V6N1`uFXB6HtHLz8
z8`@_T{??9ZLT&mSLNsX&pbUEPb`NOiY9edK%-yift?Hc+h70_HV|$@PI`+J_ADZ-K
z!X8KYoP7rAA@0f_@p34I!}%%{QU_>yl&85}?(cjj2$E!uQzegGJNrPEE8UTO@1wQ!
z5$L5#DT#nD0va`!E)>w-Z^n(~h@mHBz^niS_~OmnxtO!wYi|^`St;i}pjB>oYDGT%
zwcA9wZ!0XWMSXJVw0QI$1NUZaCiVlF*Si=s+7lU1wR_3?9@H04%~GEeAYV#|c9te%
zrP6Zhl)MxA+@<vE>s{Q%?_!Pp5792Tg7P%_Bsc$Gd*2?<bpQTOw4x+qDdoI5%;~1-
zAm{Tih9MG~6iSknMhGce2j@c+Gqz@ulu#iRH&MtYcPVmMrh{@=B!};7cgOp4`}g<P
z@BVX-$9u2$^}1fK>$+ao^LoCn_p=J;Wafz%{k~fZI$BpEp{DRtffVg^P?<*OWrdb9
z7@>5J7vKPWsUooNu6+lFbY0efV0%e9xqusiVR-}hCHWO0jOIR#F8}&hzx0>u>~NRC
ziWfUOLWmsh;sdh;$nAPX9XSzee)&eS5n;K1at<T4<%V-oltV!3_0s)Q$kMBW3%<_2
znSUvdMfSC5*x{@4@Bi>6I6fY*Yn>V5Pek^Nx<U87fzQwP-fT@a*)pZl`LVRUK<0hx
zX3Nk|!*v5IZro<88~CN|kAuL*%`RI?h&7;EvPxs;K2YS(ahuEg<XWeOcAC85opv87
z02vLsi7YBGD_ADz$L@ME&|!^zx~os;gOud_AJg<ncosLLvex_#VRSHJ1LjO>^{G>r
z0sP~ZWHn?YMldfFhKX$RDzU|9(q$|$b5nHpOK|Js(x26;%|(!R>gj5yPT4Fs%IZn<
zp5vIobsKik-C|GyX8ESjN_ed$CSmJxXZOWV<KmSjc?;{GsOEhzU;SBcx9UbSt9X}}
zXWRNgJM}T=w9(wB^KW~hJ5X+p(Y}2Lpc-}Pzq;x)?&DaP!46T<O6d68?$QzZ8=}*>
zz^Il43nk3d7fR3xuN&?vVO((E^iwv$)%{4wV&fy?!C?&sBh;Rq<aB1r3gGKgMv)y~
z<_n#SI@s%=YV#R(vLgk`P&>E}KjS!rEbOo-btut67tei+U3`~5iC2$n*O9okC3(fe
z&mFZXHcod&LaEr)^X4!8-|m9q*!SRFK?a^|P#)VcvWJEu-5sBQ>i_)oH-zeEDhf_7
zR%@S@WJ=)7N1Dm5TK9rwSX$LD2O(zUfYfBG6%J4+H8dwWCeoj|^~%=%6F2kLy=Ki{
zfvoXa>%1MMmaahAdP`4CZcu2O7@nY2W?CF~Ddwe()+_N@P+0=*A#bWCXidHFCSq61
z<ik8XCeSP0P~SXEd^ldm4DG(s%<9tINz;()0K}iA!i^D!9toj^_7X`gd}iRx2ARX7
zT2+vSzS8^BmOX5gI8hUwGLhwomCzyXVU$UgKaBcoCY)Dtzj!v|6l}Le7ABUk;?1Wk
zYZK}mvfJPcTgoREno3l6KeJysITO1nojYDq#Sx_6zcaR(<nOGrQe-)FHK9X&4Y@J1
zrX(6+*d}Q%hn&ErTJ>585s26(%)I$I*n#He@kiD3L&T8@BVRMCd^j`PupB;TCvYLx
zu!VglfDD64XB0KhhUj3etoD7Fe2`V^)2LDJ+b0c;4+S2jajN-*XD~TC`ALy_R7@~U
zr^v8q$~*O>#N~zJ`O*A)3v=B4ietJ)QHV_%YqIDKi4OB#a$eAnc0^u1_7(bDRv2)G
z58;)8;O)H@hc}&=Vaju4EY<!@^e&vN;GR@Rh1d$=#m@1Hd`wz7N1<CuyN%V#`ZR-2
z!nVp5$$vUxl6_c_mA6Y|)x?d|ULw0|o&u~3earh;;A@SKa+r`bnhcw{kSK*iaWnTP
z8RCbFu0CiG5Rl!*|F8xvwM<LI3?XyZ+AN6^R_s?9CZXx`C!l#2+))U_=vq<D@X^M(
zYYLBR=R#DRWIgE%j8WfQ6^Uy8x97wf2S;aplJ5Jc^#^(}e1q;y+on(?kP&z4H$5?V
zRYmVCc?HL}raQ36)Hh$x4T_I$mymuuS5a@o*+84IxZ&`j(7*OIbCTzf#_3%c8#Y`7
zX2U&FKZY+hE-|aiH&bNcC@E?*e?(OkDEWxMa;q3~gxGh+DLWAZIJ1igbNj~BY_g?3
zQBvKPCuwwmD!2a24P0!BDkJ|cbPE1D@C9w!ShV}e6<XB7tUtBj;#kGO9JF^@p!D<$
zlFyltZvnI6hAAIS0p3_w+ig3?M(L#YYx^fYfP~tJTsv#_Zlrg_rNcpp&fV31a3a&g
zYAOWSh!@#C{54O=Wbb&5n1Kqg2|@x^K4XhCV8Tm(+@K(*7@BIn3Ta$_Zm_l`(`eUZ
zg1@Z%<(Rb?kN1h*30=W3ISe{gI>ABw$nrnBUwgS8Ln)lglRp)VOrl#^VswM&>|CBs
z;d*5bJ}dV%84~beb+N6((rr#At4j4}2VIvoF)sLMZ;yTI=jpSOJgz7%Ov(?N%r}*3
zIM9&WY96h}nlvLO3TK|^HF0}>16_WOLjAf+u%yV91&6o!TTY*(+YuG*Slv^XL_BfW
z&-puiig^`e_`;(i+d;~Ucl;I!HnK-EqSkQp)1`ChvBc8VZF?S`zFk{{&o@j(9d+VO
z_#9dATG;$*vPWKW{xKmr08g)1*D+hpIlp4){F17@4WX4i&M3ehOxhX7<apG5>G5-?
zhcw-3>DCj=sZ~v!$ovB~flBgmO_0%X<a%RNQ|;^8d7(BOz4H4cL)_G#CxTWXogtz=
zrRrP4G%6|7zeJ(BRMzgnp4HLGqN-qj6SRn=z)x3V$>#@_{~@NS|H<`nHiIUKW7Bhw
zAr!4chc`b5*wDM$qtp<IiJUGe-MSAK@(iQlEvGbDemVrlYeDuF*wpI`H*gfwP`DL;
z;;hBX6TYkrZ7q+2R@4*A#o;pA=j?!Baal<yZXzU>lU?p+jUDgFP@pc9&mf@6wU2r&
z^SvkNX(djH4!U_#mTq*nbktER)&~7DXCECeb=&(nFt!Kl{nUw!n!?(7srDH%Ix|3B
z*P_plnI3=hYe^2W=o)Rybbx#A)lR^ha%gs#CY)WTMaYrdKficDJI>@A78n=6Pp)h3
z^L@sV-CJ&h>lP*2d7CaXsnrFdKDq5v2|kk@JRu(;Q%|~}E5VJ7({(rRVJ9EIU4P}Q
zJykH@GLB}%QI+X{*CWrA?<!mlTdeX54QSf7YgbylUFB-LQn^wYx7c{-$`}Jv2UIAv
z*CTXL-&O`7h$e`k{qzM;AZZY!AsNRDEj1o6%HZvZ4hfNBW1L&?k2D+|R)M;n3^8k`
z8=1%3)qf~p9(-ObZH^`R*i6$JVIm2ld$mH>5N`$?5bcb9tlPXz(Z&4qm~2@qZKnY=
z16FMv^x|1KmQ^KHim0DDuIOp^(*5utpe0=dUr%f&7GDP7h2zWf&kmqhBA?D#^bVGe
zTv(=Gu-BvX!FQ0c4avt;+msoNHC#-Pp{>vRl;Uy_2&dk-A8Mxsdfhe~8yHt89lz5m
zX=$>PbCg1J<n6;{1vS8>4>qlN+IzSxzDR!lc}`5_*KI=1PGs)wCM8A^=`BO>g0OJY
zS`uGl%k$ZUWyCoy=D1oX?S%s?4&|2>k*t|Xf%4qDP#Tz$vw0si$Pxp~^<Q~_;#2sU
zU{kqRS1nzuP?kQ-RwIRbzN#Ad+4$bzO!<otI`qPg3Ws^!Jj21}3@SzGqfQx)R-dQ-
z<`jKLYq}L(q1cPMeQ)kFC2=jHo$aZt0G6Dh8KVEQc&0`#O5W9unpj&lCnXzOA3xdJ
zYq#!lF4unt8nt@fr0}?&u{MSo)#j@_tFG&LmG_>Vfg&>1)T-#Fku0XIsMOWJG`t3^
z1D;KqhE>#Z+FU|P4D8vfK`z}=2f9Q!4m)qkW=s!st;Nl?+Co1M>r3iYbWUx#l};Dg
z^L;nEzyYp#$PM6C+1`T;;KYkXAsf^jZ#j_HT<1M|Dvlq@96vN9iek#YFm4FmBBb)<
zR(9SUar$~ucVwKY(2+%f&W+(Z^;}GuZ#^s9UPzMIYTF2iffZ7>2zdKKe+KssA5@Oo
zSQg|ex@?2|IrUFhrUj6VNE1=(k{~Pqo*36FnIo^WOP~4e6q5I>tSd6l#HY-Z=*yf7
z#6oXLC|lR;+z4(4AQ^#&sp@i(;bqm_7`GJeZJ(sn>;!ktINgj6$s0%b-0~ILE*6P1
zsc_qrRD)jKsgGDk?0Y`deBAhAeReKINzl|4%g%yw*z&B4W4a`~=mqB1#R-9=U6rvm
zb(J@Ql2a&Yp<kQZGTS0ZaG%v;BrYExku1#EkHe1V!=boA{OJqbi$*areu1P2+4R<_
zb1b9M9E}OJb5R8|dK!IXLl5foosP}ES$(T;)8%yOCd_m`zM9+Tdi_)2>T86K{^Q0V
z<VHO%KUW-d07?WORZStNmsJ&K4otmguiB6)@g2m<P!crBM>gGYqdTrd3Py?=kMy5{
z98*Pb_^acXn?clH9E`1OyKCwr?B&>XZ-AYQ)zU5DWa^*n9s!>&EMSCf5u$^9;$lek
zt7lEuI(IdKC3soajZ?{ep`1-1DMgm5XCD>Oj<H&`+tq~2`JyPkVSfFy*O-K`kT&xK
zLoHus92N3T2K23V3bhBe59!Z54D=_YDIylBf$WLCXW*<T3<EcZ)NW0jzE%{&RQJ>)
zK4i2*jT=3viI!TPfKU8&ZdZWF2IM`+ror;KTuU(%o{ILl7FP!$smtX@)ZEDsPv%_+
zK3HD2hp?8XA4)D&N`@ItaT1}jDWmJdTy`LJFpJLe<8ptHhYmkNWY-|B^7i?Z4z%1D
zO&)95v>=7Qo;`ZR4Q62_=P&AwbPRb<kPun%{A!Mh&Pt*MLkrd9IDWPk{SvpBHG?oS
zpJrAce4z|yaOb`ya85)|TXyEw%&|SBSg)tn<J+gayNoC!g__87+!#swXgL5xX>Yq(
z-$tm-FOhlQmS7>b%lHC$hr+{xKvU0Gs!%gd*c%L<WT-_bXdA9m(#fjfJambE7*(Zy
z8gQS>RN(0~MPD5|BwtNKQ;V|3zHBsV50xI2lZ?GpAZ$V08qCa17J<iEb%-}nQn^~m
zhJbLxuX$scfJgH{>ny*{&{x?iW|YoRW@Nm5YaHf|SKeb6XA}TMO(}bZ(s}M)Cb)pe
zjU}VTGB{$}zJ_A|yT?Afh3t{JWGj#okqUv3)hYK+LXLua$WEFCSHtHNTzmDFx3k4V
z#oBofeK_pObtL_XKvM29HMxkFVcO_8Io@dx9?NeZaLsp8+;5MM%`o#~YBb)Q8dPm5
zvYGrEkO;-$#Kn&APJ63VpAfr-+WASyq%1>nx0dQ<ijp|(X1hTfhh_pUVehdYOx$Vz
zDaFIW8=Klm9aWY|X~lVT?+z&yEO4Nn74GC#3WzmuUQq?F&Ym*dYjE^!Mvjk?u1&t)
zAi_1ze%RU1lZYNQ<hhb;V(hS0^G^eEI0b(vey!8I8Nc$*HWmAopM(zSCf{pH&T>t_
ziyZ5#ZH}*h7t=NAoNo^mVY^RUz{-=!+0QF&kbu_zc{<?9v}=bM&-LQl!jX(dW1}M6
zex6aL29m+u`6?lI*^rg%s~x$guhck0EB1!zzCi4oQP%ZRiqn+IQ;Ezq{K79+Bu<|u
z$)$?}kU;N%U5<mH0fGBEe}7DFLDtb{;chGdA%0)xw{on>4~>#egbqz!DCr@zZysp{
z^7T@if`29JkDFRHn}$9ej7O6n-gJB>;5)90O7eAg=vyx1z-_)EFC3^)CQk#`Zg=B(
zm(`LFLL3&3&ojCOFyqd18{I@U<vIc?-yKKx@IWWcUb=|0bG{XdOm-LSsuaRtoc%1D
z3_J6B8EE0OE9d)cBUuejgRN;$96?sZCO3F9XjKv6DWV}0$h;~u*Vct8JF;SU#zxL~
zLNsLtA*n1P4ppA|(=Zr7^RlY>!K+B7dZhg_+cd7zAs!QJ$g7YBjvx3PTy{9YZZAf$
z6mW8w3CpJfs)wLZsk`P0TQANuwOze`aoK6+Je=AxEJz8`7<}7ru3?nDz!<t&VJ`N$
zYj-JA81}Iw<(g(p!I;~tX=fHnT<f`p#FOg81y<JeEB-?vmoQPqP~6<n@SxaO$NGZE
zLoFLE`g|iDTL|I@MnjFl2|C=I8VYr2>O{JNnnY8-iCs^0dDO$G6m>0WR=D$ngWNu>
z@x)wL-L-d(MplD8kIvA9?YnpL(p$zbA5_YdL7S$>st9A2QLN+&t1Y6$<VO}X|K<y0
zp2bI6q*hq>k;xy2>JBPp@Be;Z3+uwS&?h9mg}Q``Ve?c<8?SY4nr&={_NV+caK+CS
zJHgTvbqf*0p|(BieFE-iZuYN|sX=R|1Xh8B`p%?YekE66z9vih?Az3{rO{Pit{6D>
zbW`knq@mmR=!~4`L`j@yA*Lt&I^23ZE=0R0twymAipDK?Pj(RmE|&}BPq>pJQHiaJ
z<<iRqyDM_>5<EOfuKa!~WTLei*{kOTscI7eJ`m>c;O3wMny|CWJ@bQ(lYvnYTN)Oj
z+_RrDW?@u5tiKL6mxU@iIN5QAmfss3UV*K<LDbeP8!6w$T@*8l;CNaHyf_#IY5tpZ
zXQ~d^WFpl{pyp?<<VGdC=a*c)LWZm)f1uRJt`|O{sNk&7EgnIPX>qkM8ROIq`m=}A
zOq&0vYHn)-5;lhwpoWZ4cVoq(Rv72yAknJYvr6THB=xo~RKeO6T}M<EB97l~(BO`N
z)_J+`oWKHi*VK{IgPnl}f{<Sn9X?Zr(#c;AO9|Wq@Awk35VdBbXim=gM*+LT`(fci
z38u!vQid*glCi!`EU1(mixcPEqHfbBql?tFKsO7?@R>=$$J_r=r8l((C8Rx;`~rQD
zE2ly!%t}s!tTSNbF-)Su)=#NRAmmo-htS`jG8J70LWe!<K#5<ITG9&%n@t1D7)V=<
z|B=uS&DWc&72p>r!j@Utn3hTg<tDq^y9l^x722)srXElc{hb{Zm&PwOA94X@L}{1b
z*s|Zx$7`?iC;SR%@o^&Vckavg%B&{;_`DUok^i=TOzdxr$)2Ati-8fmZ4<wNPQTN>
z8u<8ggwTJl{#|kZDg3`}_7CIY69+-7LC>1Qd$xHjWulDF!oh6D9vM_1_QSghI1+T!
z(Tn<gaC2y1Ey7u4;?%zlkFs(lzt1M%h*Yn%b2(uJUf~HEP+r^~zHhuc3HlrB`G>h;
z*DeD+5x43ec&2IVL(4+<#gk26(_DgI#m)YB<Oh>bK)6-p_2smBRh%8x`5E9V=uM7v
zIK{#~|Br9}`v4lUlFf8$W0!iAzsQIPlB(>ACySoH(%Kbha82Z&t`~47)eHp<U2ph%
ztu?dCc5#3$FX>h-UEI5(py-FQ`o-gHGBqvz0?z%7Qh55_9wk6py>WMw%@Pw6h<ocK
zU`Cs*R@DFX@1OQaA%i*xPWQ0(ihl`n(v-(<={Mh-BJ*zzC}5j_-(;@emi;}+`u!2g
ztRx^xFND~N{afy}3_OSjZmTb~Eg>s*o-fVfmSV_H0e>+`ak{`2BO&dar3PK#OB1`%
zMQ91zV&(vZ2qrXgWT`=8fi&Is#7YF0VEVZ^0L78x!nZFqs0onfZU1TZF9Cn5AP%Vl
z6xY;nd(#qwb{7C?c%c@-zqZrQ37Nw9io?J5Ui0rz^Z#ra0S(ye(u_S!I`i9-nAQtB
z_7{~rj~@E-OMW}?H>I`x5x0BG?w}3VqTezB`DEWiIlf{L7C=jTbJNJb%^z$WsP%;(
zMBTVFC7=(NC+L7*GtK0O#v$t;an%&fr|XxzDc1Y>K8hW`1Q(|KgU?GT=HDH_g}ZF{
zxg1y;KX}*hPb+_i-@gx&cFgT1tA8q<;le+DyyPE0{-*t^se|8$?n}5|ccF3WU@8AN
z^fO9lNP*vJ!H!6wpEkkF0E@OhqA%WV+m59?)JfA(uyX42Tj-~M%KvL)NbxsdTwI#$
zPpN)cB8_jHQ@uGdOF0ieAnS67-LWOc%rFK*c7^%}f9vM^k0(syfaavut36-J#AboY
z?CzZ}QCvcp<@|l?N7=iSGx%?U|E=J!E&apRvHxw+|9@?8&O~VRZf&yp$~e$iT>x$6
LXnD=tFaG}k`-|*t

literal 0
HcmV?d00001

diff --git a/static/nic/gke-existing-cluster.png b/static/nic/gke-existing-cluster.png
new file mode 100644
index 0000000000000000000000000000000000000000..48c011cd0d3a7c0c32f988490027132a85e4ee7b
GIT binary patch
literal 169834
zcmeFZbx<7H8a7S{Bmt5TJi*;1xVu|$XCU|>1Hl<IBoKlJcef;1a2p`OZE)A%&IEV(
zn%%v3ckkW${r9W->Z?0d!!+G}P9J&CdtP~-4px07`vjd39SI5PiM*VYIua5J7zqj0
z>Cpq=4Cq@I6bb3xYimhKRe4ECa#be>OKUp|BqaJM$fst-R@G;n&Fpas#hK3pK1veD
zF>*8N66b1TQOMch`7uZ5bK?zP$WboQM)WVO{iM9PKin>En2IZ|`o_r#KY$M$d`ehV
zd_>ymbLQkedx;EDOJiq3$<%b)?VGKH)mO6y84vkCr`+)WO!QRII$43`tQfv1Eb;T$
z<Re1hS+4ml95Sx|Y$10(2LD<atDAuM{T4x<>B||^0F<)oZI1rSwrFKpEHX!)`y%V9
z7-!|<6|wR-3pnmX(!wfN62t@C8<zJIib$5%ANcxIsv7mHhpU~KJg89J>>kW~jZF2t
zlM*`WX<5V*)4}un<h2<FZO9vI0crI2fynzpJuhE|@s+(p$!lr6L70Flx?)yH$X|_B
zg-iZ4#oiDowtY|Nvwpu;JIQ|AuOHp0Yl>J4d9Mg*x3lTC2|3{5+pQRcpSE|ir_5!B
zKNEuJT+*Z=EnwOY81fJcU3p7oWh6%6_z@DyJwhZ@;OHLk6}d<B?_-&J^ho!AJCBTn
z6l9Hr^2a@|fZw~%C*XTm=J((G(I1c=0{>wHUyn@Wf8C7&&b<GxV^k;L8j`q%q`W-v
zt6}D3VPWqKc5u<TMJ)kNpuLgPb4EhKr@8yylUJwy1=K%jt*PsxtE?no<^W+eF?TSv
zVD*5!xvK|B$U^`)gjl$kkb6Mv?41QXgeiZ!LjX9wJIzK({@X1sw!)OU%Btj&4o(*2
zJghHSUs8&olarGRIhk7us7uNGQ5^VBm=f&b@<xD-&E4Id)t!^o!O4n^ou8kd?Ii~r
z2L}sq2a7Y*-o?a&#on3f_e%a%kCcV8nUnP!7i$N5^1FIXOdVWZgefWS9`x_e@9nhk
zu>SK&_RfEF3+N!*-4!-=)|YJmt{W&Sbaz%j)!M_tPEX1j0*o2(3=wutelDTk3jEil
zKOgy*qPl-6%Fe;}*P?&9^q)nwoGqLr9U#C%T}1wzus;g__2M4|h1l-;{+F@%eV~6k
z3yib~x)9sHXH5h>?!otDU?PdFrBpP5UqH<6KFD>zANt>af#Z9|6vUPGl1NBmNb*wR
znjZId(okV|WB5TeA;Ajtl#CRN51xOV15M7EPH3oM-G6M?zSqWTSC#>q+^23smQvFc
z`}T5R=GJGbRm9n9txfopl+}CtwAQM>ujJfvz-R9k<W;QaH2(O(y+>k5$j{y)p^zi}
zd8o>bTtPml87@pB`QI0j?#Uwge+d4|?SCGARYLO5@4<Y#NAc&mKPyIl;`~q5J<?1<
zLRO9=Lz?@?r=bw8{k?U6RQ;Lb9!fH!C{lgUKV5#r)%RzA{?Zs#3*<*!TE0jwnE!P7
z894F&e-6f7;mjVCXW*|_NE@X8HCDi7^1+u6|Lo<TBPkY#28`nQy+PqW&;8j}u}qVv
z|1kDQ{){+cnO_d>XL|k9)VvjICH{}u`n`8rv~R^URv(I;{!{yb3FH6EApCjwzX|*6
zVE%8y{wCi4TVa1wSN~gKe^poiQ;C1uK>q*P!$y7(pKT*jp;vRkYu9YP+{Tf&t$o6s
zMV7&V>m0q+X)|{7Rdq>_aXp)Grvt=oV#@8MkIT&<+#m(ImdbsR?)qj|W4SN3`Nmb+
zO}`?~dcvlEbjjG8w_WIBT#9q+lEHF`&99+cak>mrE5SKplC|P_KmBrE>0*~`!t&G}
zu3R9!{>sky^lEC7VW>)Y!eFq{Uc~E2Sm;qFaXOpJY{?k0WdS$AXRV!uRQ3VbZ4C6X
zA_J}?dSz`{_Oab$*J6#6Xv%BkRGkIpVC>FwDW}hyGRIu~Gc|t(TN!S6GG(c!PNcVr
zIqO2fc{^K?bmskNdqZ2lf1=IBPB=l&DXOlog&{2C`X?QyOCO?SD}-dtk+{Vzg#X61
zr+F=lw=>10I<3_2s+B9HAlTYry<6Lj)Wx1xrI^-;=%fO=erP-kEfetW4TSGh<hA-8
z6{D^7I{MWfU`%>VySHjrP4@|~yR~GjW&OYjTRX;#xp6v#1oJp2rA_F6XEx8!NDj1{
zX5|ZF%FuQjF1<~>H=yFhdpjb0nLa%I;^r8!mJ`*SoMn7%FLV1V$jhEYf53WN&&{{u
zosWn$et(wJeDg1(k&8zI+wP-IC+>LKKF9+?hhgW(6UK)RIJS!_lJQye6Hy5a2brrz
z)h#3V*SZ==Z=*+LU`l5`p)A!e5BoSH&v$DU`bJblNsK}wtjd~I*HausM)H-3D!M2`
zYxkuH-oHPc_ZkQz6`oGpoGi=Hv(AfqSJ+PSDv6^Vc5|^^l1AotHN*v(9%Zf^l(4KC
z)8^crsVN=n8qAV}f5f5!#%J0x1=43%0oN`}6=nDM_4*KaVtwi1fN1lSd5rQ^9&DgH
zhAw42-HTPAri0M7)+_QAHL>?WH=X6=H<LXDzWADX&tC6CIPcySM=!Hkyn%gP!1Q^+
z5%ZCfIblwRKHBAKf^na1X`^M+&4n$eNejvd4C;JpDCoLn9&hBinO#qR{Nh}u`C^Od
zaIXPzQEESLeS>F)fE`A>;IvfI<PvFasVk63W}2&a4ehZa5jq~#SUX*?y=m51<(j}Z
zuq!KKwD<k0GL;?5YNKuJbKG~Z*vM-=+~$Iq7j{nnFyL2QHO_&-275E=J1l6lg$Vv!
zHYwi4-p{Aag|NNynKB6?+3^b+yQ&epa_{xrE?)P|Sml1^Jw%Mfmb7M(zzWJPTs+H;
zdGWBYs651aq68#^#wreM4WESo3$%xm<x9J`g9?|=-c^sc13{>Ke&E2AR}H7F-XeLW
zL&vRkJ;`bF#%QNb5m?`X`DM<#lh>P6A}{r&dLEqYnU8N9UW(3Ae<Su9p+6kG#8K`K
zdEuDS*v-85Q`sP8x!S>OEsg0`)KX{rxC~F&27hRRY-q@?#<SPM^)L+Y{z>zdGgX$<
zxY=@G-}z<!ZN^UyS#PlK#W5neh30Csag$Wi%XQM+`ReV^(DPPXfp|W*DRGj%uZnP@
z=Gb##7$Wx_Jh|V}txV$k{>%(&4@@~aBvAs=#?<J%e~@2{=eKl7Vbt$8;fL7yCZjmw
zKGEJs$#O_wBfNXqbUH=`8oK7Ov0$AnJu&U5i8+E^b1wI_V@A4~stvmehcaR638@5J
zF3m7lHfnrG_RD`2poqEi`sAAgC_4OdldW?-^2?HGv+xWdT1<Q5R;tUT&f3jHXG-(!
z7vU`KjMMqdIR269B<g2@cDV^6zFXy%7EHA?Q*un?#Z#Bd8^c{hI&RsvF4^CI#ERZ>
z7t9HF%-$?vexa!`stV-yIc=Y<h$KK?SLH_-dz9{1$21w+FT~A_EBji?uk!2op+tyW
zfDf-vN7{aPs9-aVgWN$CBd-Mce^C2^7BH%?N}X5Zbdt4;^<M;2+@25kEhX6cOk^u!
zbO@i$jxc`{Yx3}&bDc;^F!Jmkn{pXZhWkGx)h+ZL52nlT9v1rb{eIL-EVhQLgWeRX
zNTK0i^qc9)GBf2;qsG4G+wrTRr9nwdZX)~Itmf3yb6|ZZ<wOYdTpjDcZ;cTRh$hRz
z;_4oz<>t?gR1thFpCgo3HAQ;+`PYdL_dB_p1*zLo9Xno>oV61e+fl#ls(dpCshOK~
zoW>01?<Di{cF`-UnRA=j@Zx{Se@TXX|KU?E6`}orb6`>9r0BYiX~9J<ca~Ag+K^Ao
z`3Jgcj(eC&6KzZCI{aKS2tY1s;_NFKem9N-ro*}NYM@~4ha@hlN5ZLI0t}1tKJv9)
z9BB6%y-xd?vfbsJg?d?=ubimLRPs;NuLnfDF38Z9PMao-y!hGKi!tHCXy9@j6`>)Q
z-Dz${{S6YfwNt54-5v53-5x>Wb&m;<yEL-qm3!!(^l7Z64#+hQ2g?=ou22_>(YZcg
z;X~?swrF{MJTbu7!hPot;n4wZj$>{+ugBcTvQo2G=L#D6!G}Tp;{*n7<PiOshw%G!
zZXC7`D3!g%jpY5;1RI{spI>3EIX8Hm<Oli`o?G#XzPe$;)^dSdvmT~+dAar+@-bA3
z#k#liSYh%WRR4m^y3VTS%YRsx%0o$h_%M=J*n!yM1|5HMsqpsf$TX^hD+u(>*s49R
zxW4L*8S|Q~$AaD}K?Uja8se&4J&_+6*^@lpmwD)1P3f@WbRmddMW5-25Lrtg^b2x$
zTcpALQmkXDA<21@EP34e1$4^;{e8Eqw`yx83AO=Q?ZrV|w(IWlM}&gQ>FhFyFr{7C
zlppjo)mzXy<A8PgFnge{K||QpyDoQM{!!!hS)L6VBL&e|!kY`b=2h%<I}i$CqgTV}
z?WnhDqZMp(ZsfXWd41q*K|ou<fbMvom7i4rurpEn=MP>IG*5in%{4<wre+-D*8wlC
z%F;Lxviu}4_IC7RykM?=Vw|Pv-!YNm+|Li6vdVx=S3|Z{>ZEPzkl}Cd-S4Xy5Fx6{
zyALJ2x^{2+#-{dJB|`){&&)gf<~?*VkiZZGB{X#ErU}M46x^$AMZ;zM?8e%#Q{E?i
z4D2s^C}?p6&Md?uJL?&KJV7LGiBXB<F&;k~ofYuFm9->XVAat$SiFnMYI0k?B3mOD
zcCfeLK~I#sWS4GBM<9Vw;zpT9f>o}_GG$<YJHbx@0$!-{5n@3U;X>gr6S&+WV{~7m
zIl#Han2ma{t5<no8pG$S&gWNG^T#)GsnLAN=B`*^Z!f)OI`5=2EBd#i31T@Sk^F1V
zE7p>2I~v><u)x@5Z?KV{fu-&||D$h}t|o<?qQOEBt99$@_+4w-XL)d0x++m6{iOYF
za*~_RDy`WYpo=^GQR~t^=v<eele)t<ScEJ$7pGtc9;31(!ExmMd)t9;>Osu6b_7l3
zA`Q%z5!0T@mv+E~&ThXHmWwA9GsZSI$Thj3&!Q%Q?<@~j*f>C~KQN&xD{RN%=N_XD
zmKlno&UuxSzUxbP?+CeroTm@x4WwtJ#%tyY4^%%{_rmqOs<@e0=0`&~`D@yh=9PSB
z;@Zk}igZ6!(|pbkvKDQ<j6dyOJ4w1R3nWJaNy^+>mUtcr)+j4+bLA)WZ>Fv*XCKN#
zHoTLolAD8ZIF}9=&nx0NF?7Y@GXWX5JPv*r6?KE2wHvzm#a08;s7(uQc&vSjSYT49
z^E>{XX*M67e#!NZ#rQnE`ukR}-R-!n7&wEwHy%8pge0ZjYR`SoM{r-Iq61Ab>@=)y
z?OTMUY{M}tS2#3o`PRz!GG}ed0y-UV>@s^fJ`}|pav|hcAf2Y8<JFM2+v}(?8(*ME
zN<xH|Cp!tzF3>~74odLcTzwhG*pzGVVXz10w8i(xkhSs<T&R^S$i@vV@6OrHoymvJ
zb_*&~DuEY?Lom47VSbCx-SlQyEq8q^ljcE?-nOqQ<hVL3K9r~4EN4|TRx4dm_Cu@`
zV)-nx`js}~B>L(^i^pe<6_)VSM66q;Q@~{VR3oR;Jl*1adwohI`T%mD|8&+l2come
zx;O8!{KUB(Pe)49z-zZ^t_8Fdc@eD>(sr-;iA6U}0+&^qt9E6eMEV2$U+1V5F!NCv
zu#GIKgx{6gGD-5P_42mQ`D(&itj4Q-<GDtg8QEz0#Nq2+YG#n%^>KfN!~!tbOX-4N
z*+#ByLJjz7O9_INIiO<Q_Z5+Y)*^0dvmkoB3*Hq`ywP?*Be>|&T-4ii*0(OgMr90h
z2kT6QK-8}quTN$eN%h!~!>jX-ccwVM;)u!}^r<CDn1%*O!8-@rc2;6ko~o>p(9Jbe
zBZW9e<1r1!UV2e}QAuMuC1GuUFLS+7w_RuBWicCq2VPO8N0c*bTw=GrywlK6<bfC<
zh4n)pS5fC$=s-tmlyyVP6IoW1t9N4rBkx>WMOtSm)z_(MiD7#1_=vN2Fm+NcHeaEs
z9mk;p`$q@N(ENq+d_{?!PYuPLt&Zb|;^Q!D9L}Asxa|D`mS;43JLba9^XEmhYah3S
zT`$UIjBr*HO;7AB_<L6N560kg94TmlbipX62Bo=YC(MxD=|w}Lhu=NVyKtM=wpwj&
z<M_YiR9>D~G*|7boK(%!Q!{t-=r<+RHR#;<y(F+{t--rxb`$ZwfFmqpMm|WVKj*!+
zLgT$1HL88drky!NJf<zka%CaBGyeJT1d_3?mUkFZkj;-kjSt1#czvSpH(i~`iMXCN
zJREgr+zQA^DE6Sq8lHh-dYiG59Ti{J$A;%nIWjTu#IPYmZ>{tkd^^6$c?V<QH_Zx{
zUV$STp|O`=-HiEboYNCjx;iGJ==aN62qG6XOT==lD#SCgqUa{53Ya0|x&nT-ITyaR
zZETi;g0dEbh4YQ7Kb2A>+nf9r8}S7(XJ4PGxguxPMjsJaqG4fMP>**-;|B&#%QbY@
zic$HCFDcLBHb`Npv3(%++9^}J3U|VHw~=iLUTDg0o+f+q{T_7bZAT{R&o2e(glNn`
z#7-Zlz&YXBi*wNRw6*<CGWP`<;^3G_|Ew6m11W{BM9I#&wm%*^mY6ZtJgZ%f2n`4Y
zH2wTe)8$@C_!%aeKAHC~f5GBniADT8briy?tZH)>gX*yAIy=~Y$J)>Lm~QKe=UIuI
z)A(zFUr2>L6LV|XrnPAzaS+Nm>}QFhah@_+a#>bXj&kv<o0KNXGn!l_-(JOwE%#dY
z4pmJU*{-GWLK~bnl9so@LV+lR!EV?HP1*gdBcrXet-?~b0VPNq3+(il{;*fcb~`$k
z{Bh{HFjfSG5bHXL_O&`H;h6m4AcJ<Md|_!d`<*0@Q3JLH>P5&vwsb5n3r}k??F~$X
z&1=WN`R4sXtp<7r)L?*S&an)`Nr&%*is=D-h&PPuesNHkQcD#6FZp~HiL|Ge->*c*
zh*q1eSgqn6j1LpSDp8lzsv+%2Q4IZ^K5m7ILe;O-jjh)eu)w%KYkSqmq)8RAWvD+<
zCoLh9cpnq&MdL5(BM~f9d~#bbAtTct_`=fv87t1^X6&&3Ioi|t5bM^2C!&f;n8HPJ
zN0m=LF$-Fz@T{$*5x91)GWU%|OveNdJxnP6i6ZDuc|tY&AaB<bGXv(LDX|}@EqJp`
z?+aI!)msF|CGT2b!?nvOKb=n2PZ@2C9P5vY_4vaE?Z1^dnuol|fq<-O5nr*isiTg|
z9p8EGev{MWGN)PuZ`G5lnKS8R@?XeY?lo#3`W98pdb=4cbBPRz<&)Ztx`U}H=iivi
zR_xl02t^F9sg~VY<Bzx;4@OQ;P21wwn$B7v`}^+M?ae3;9oj1wdp~3VbMrN)_=U)%
zExmqhMXiRQjY@vAi)~a&b>`EWN&3M(>w>hkt<9i-M{^CBMMUVb)6tYzU0y%sT-3-X
zO?MW9$aqfY+%uSxtH<Pa6@>PeWF~7E<0%KhOwsSqdvOh9g+^~?od<SdPUxt?Zg}s>
zvaBN8P$1SZK`POK>@F>5LcfdJ`ucrFrtc+*G)eDP=K;TPPkp^VE&QECZ#hcxH%PEg
z3Zy!z5a$-lb1eX3g~o-h>D_`xSDTOfU3*{i>gtn6!6`*|ix*})IW!vVOK-0P2KJ}X
zS6K@<CdP}7{D^N`36z6pmlIaazSoB2Ki@ol#6|HWf&$6ELk`fO=qkIkDL!9H=M<=7
zK2tbS!B@Joeim|E#~F$%S>!QyfdYTZ#*5(?#XP50qldFXj|>t(G866wR{nB!^7`aP
z=V$I~sh7<W$st~<QUnTo^wODi0}q;o*Yed$Tp<v(D{Pj^7$tFY9icU<8e!Q92Yyfa
ziafZ4W>@r{;Fo@To{p|wN!kX*EU|2y_G&DLn%MKqU74OEDh%O(9=*h%?3O(q)uMMy
z1xah=0jNo^_76r?>Xp|@>k{l7-fXPC=0%$hHJ05g=hUTzrphzfS8nx8c5jzJyYXpU
z7z>IJzY!jG2MVHg8qe#PZnex^TTH}8wd;BLDmqt6nn+*QvaDPC54WO|GzCtJoP(rc
z{K~1K7NkXa=g+aHY%m>^<Vw1iKIv@QhG+!CKpPtvtHb&H)lrgx=tDbwOqgAo>$u}m
zP(-iZY<KG-5P;Bjt@!bPsCJTcPq8KP4c6!OG}8faVM2|n(&k{+d;Z(2!@0bNWZr`i
z_%Hz^Qhg`YR9QTwebhi*)xbh}I9oj)_hq%NKkX5I)M@nO#zJ9f)7Er+7xjFe?xcH`
zSf@kNx#bFK?ye@bxcP6=LosB2_G^)qQzO106jrsup3i}fzulh9>~9H}4DJT?m4WgG
z!<A3i>?v&H)PxEEGk6}a7aJ_0!g8DgQ8+M-Vz`M~BBastKww{RIryBEQ6oOrqjM2T
zjw6C|*|!Yu<R=i3-(-b~ru_^780~89hL4#V3ryCyQ3!)RkUe`VMs=4G3JfB+(K1d)
zI(S4srl9w!bLOdZ;>*yOcVBv#I%Y!0D`Xv|6spdU)za}U_1G{Fu5Tvsi{UT4Mjt8X
zRg=WCNoVrg{+w9bqO++Uv@>1aoV9+BZ8gPX<%bPvR|w_CE+uP5<nCyFrOHyku$+2;
zUhXYH=UzkxNQ_pZr)rP)BUH+EGk&)jo{~5x{569UB72dua?8T>rD}R##bk!pZyMgu
zhpzbt;G?n5S6*9(<A_9XByYYbwyrq?W5f;o%!62Ov+_2VMxTGtl_YuUE6R8n7G6`4
z9nKqTi4AX)$v<Puu{)u0aOA=M<T=MN4T|SGNIniwk7w1ZLsmXB67lTeusqI-ncD)<
zy%1e;{ycih=3AO)dD!!uFkvf6tZb<V@aN4)eU8+4lkv25DcD{qltJ1Y@^JlW4bOJ#
zw@WNLN!(rFaTT@OK-}#7>X4AFsqu7v#;);rd_PNiVKpn8S<=@w?Drmo%Z6HHK;;dr
z;z4eDbmZNwGWj<xm5ojI<LjFR8Kf-vt(V8H5?IvMWh6!eJxjQrp>|E@Ycj~+WyyTZ
z`vnm~6LB5I`w6BYjvO|l^g1*UFO94d#^W%FD2Y&)_U8v>j?qG(7U^c>9>&lFDSo|p
zu^bi<b_yU&@zh@fi|{(7O@jk?^peGJI*Nu)_|SB)hb2UMX7e5!Ibt9{$l<VBF43|4
zHkmPukyIUt%<c<eEV7JSqkh4n`o)UjQ)Yh|BSTO3&hWzXWsBLvNB%M>z)qOSewUGK
z8PO2aLe-9A$PY8^jkN((&@v<l<A-XdTF-Ko3L!QgnImKZHi<tJi2QI7S<OIt<=#q7
z0ln*Sj!%5>(ikq7@z99@S-I9#(NVph?URJQL2BigyxT|R)g9r4@&~x{?)pVIV>%b+
zs3mbMko(7s5y3Uz!k=Qmlj=coKT>G4J(%1?gltDrf=rXjtr(Chi&6vY+Hj6pLLI6c
z>C8k0Zr5A8I5)@5;<?ZxNRm0kt(jtrQs$zm9q@u}%X4El_au5E&$L@8bV|(eE5+kR
zl-OU#9?Z-XOt^BR<FbTS@Go>sP2Ip$427P9bVBw*PaH~H%TWlSt;{}WT#iQ|qF?$`
zO+96Ap2i*C1fJHvJ?>W{JmrcxRjp&s9iCqCK1T_`(@FQ*<98lW=B<msb!d0M8V>#z
zK3;54U{5d{pY*28xJWEVy7c0ZQvSJUZfbiPOk%W#nIZi{!?P>Zouuv<TcPJwsB-?X
zk{I`EdoZN-U+*<t+UrPRcw4+>9J{$(xUDCz|4QJww$UI(0dY9^Qb@BVhl^ee=p|f@
zexXC9nqx@}4~xgqok92q`m>CJDrNcgM&Hy8iTCNpewQNaBAVw6O-jiHiisxj>0IdX
zps<JG9ANA1PkwCF7xGsaaIZCRZ(;yG9F&1BtelBvHXh)-37CK!KtL(Q)~F>0S+$b|
z=H9IJ${=Uum}bPQs8)17CKnr78Bk1TXIH0A^Cn{~(wS=BOmPW=Oe37CO7z!FcOC>i
zhMqn?b5+jk#RHp`yL>qp7Z5-FKx=<Fa~VC*=d4k|*<MqNE0}6Zup+;khsM>zTm^kb
zX3_W7o>f~3$P=u$pk}{Iyun#1)%LW4Y^sO+tk-8i4lftJK5b17)9r*zbR5k)>h}fa
zItJ{kSB^;;yh7IlqBF>F4aBwiNptoZTNCzUYGMzJnP2PCBCEyhOUWfed1u~yKRQ&b
z1$4q|GbIkhhE9?QZgg73)|VKDTLYnG1_tqbN7wYAdeeM*H-&h4q^M_<iV6colQP?>
zeALqdbSn7JmPyw@=(OjoIrMwm<=C~&%%_^Nnv!US$BfIdDAW!jfptxEWop%>;jc)x
z)PrrkBfGZqMqn0bT#k-MF}B)0IP0;LS5+pWmszVmZU*Jn={jnBK|Rph7BBcV{bDFb
zFT*MykI%D5?QzUy5*YF<7Zw*7P546dEj(9sxhjx$wKY-)M}Nx%kQ=)*oO|~aCZt+9
zw$h4O&}gQg%lP_hz<oXbP(haA0;Qy-Ev84`O#RK1q+Xyh##=i!14)8)ya`j|eWgln
z`TX{bHk@!ZjFw7fC1`kC)5d(&hV~4HMXEkHD{!`Ksh!>)ux^7<a0gn`Dn&y8e;c&~
zKW(eECTE>GN-lprn^~!S+V^so0QFHkU!IlrSFNoVft1oU_H%~J2``_9;ctpS8gvzN
zReyo=q$aYj%Q{Ip57475po8?j5kjB5eHy7I44sv!eFKW(b`>$8P=;;;`FPsFfC2VY
zFYNC}pzOQ=mBxqred3FaUj8ya67UAr8W1)@PVO@hUMfr`JsOncq6M6im;ka>SgQ@K
z`B#J<DVGRR-4fIJu2<GiEnorqmMd*8%~aVYXa(5bfhD#A0r*MdYq&iZE=Fv+zV%nd
zD!?hl)=OQ&(6^9Qcgt00F(juQ)6(DWQ~`BxmHEHhHqCp)_0VuX5PHxUTq2k!GhUs?
ztnq=-;%ju^JeHno%Vj?{nAFGi9sf}>8%QIxGPM=vw~4M+VM3(vzW9t%o~QJ9r`E^j
zI~Wu>5R@yh$PWR<oN7LApf*e-U>XcCU6|{f`QFRKh0*ZEwTMM2r|GseO+}%g7z6W3
z`s;|=k`Iv%<V>%t*l=zio6T<|S2Lf-F720JlrS5BBCm~IHd}jj!qkfj%Ibb)IfR+A
zcOSvhYnGNL#&f{%c{17Eu*z$EbdF+|1>58FwMKlujM6fO=>b@&rP>Q_p=0uNe4$iH
zpgN<CYYc=I!<wMw$1e%fiIO3k0m@`35{@*AnJ<JqzSRM-?YYb<k1>f(gUJs!jHS&S
zbV>NpB9mWAI#HAFdd1>h`Ez1v!T^vx2%Fk7<0K(D+!3nYwswbbIiNT7rOh|>I0`Lp
z<;X)HR)-^KNY7X}7qywu7!<@=LObstKmsu?D_LGmZ{@g5mhV>2^zQ)j(p0bLP{Q((
z15MKN#0cg{$LSle6atfpJulQO9OXopMsFs^tk4cjXU(b!sUEbpo%-&7A1;Y0yz(J~
zX3!&xDvV&H!QG+apoe?LNOFJ}8fCqmc*YnGW0ud1nutF=Q4=B#eryr~hD^QS$X&a=
zFR|aj4fYE--9se=X^@cN$nV;ucW>wXrtr{2OU|qSOKh56HWNz&a(pm@=@XV`ib{yu
zXb&XmuJE%F2c(A*HZIZke+!L>0fzlO^3Dd;Z~Cakad_xOgr(cfodhfUsA+5oM=w~v
zwz9lJ&;OeFb$-6V9JOKtInSZuBipmM548iVp~<bg<E#j!oLagNKXn2oz%tvc9$FhG
z@O?A4TWhIE<w)Lp0z0edn#r9k`*4~@GZ=8spelSln7l$2uxL6-GcfnJFXo3sghOW_
z8p1qAT|1TI$W<_TATnKs46modWIv#evJQ=GD`M7AdJb*t8eZzA*N#&6$GrYZ`?>@s
zwq#veaq(*+_M)LzZRAG(wj&Uv)HyzKla1&-S7{$sQzA*a$z=0apXxBTwu`OzluRMK
z3`N*H2fuP?_Uw&DC4}5FWc+xG8<~)!q$!e;(vjnf*Qc*7m&tH^t=OP5@j^7;_AXvQ
zGf00Ec1k_SlU~s;z*JvqI`ffHNtj+HQ|+||3n|`Dtsgeal;U?n)u0w)l~j$+@If)Y
zTd>7}?jUsA0}ADk+j$}ES=o^5K{36T9q3q>pGYf$R8)Qn#)uXouUzf13Q{M-ZeIeP
z998oX|JZk1`-<(ho{Yt)Gm;FEtbM|0!N}M_ZF>Dn5`OD$Gt>+?e|Q=!rAm3}YV_(J
zA8v0hOL3@H0<k^oJq8Hj>}cxx;GlPkKqMlN1FGM>tdL&>!oDvtkUFT*UC^&RMeQ%M
zloXk;Jfp7XfbO|1Jhk+qLz5PEs+u{(4L#kc@59iEdj>A|RjKXA_KiJ!TA1X7LOABN
znU|2-85Kc8yIp5XloI){63#PI`*X0KmC4<kyXqY64wq&EfX}!dufvQg2h}?Wr#|!!
zIP7hXF(5pzLXAIe!cGN(*}9l02HW1(D)4=J`^j>;KDWKnPP^e_^{q30$m8N&<DX>P
z4Plo|UeAejLid7H^rnj}&4y!b0R@+!KTn{ftkd-2iO}W8UBTWKu8wuYOn)$;-l{7L
z48iQb=CPgTJfVpo&Xd*N!FOn{UhKUbIP><He$WQtM{psCf;kT#7^HhQ{;Eg~JZB~F
zwlN~n#u-@jAaam1C>*vMF6HU(!6K7NpsDZLrtZcaoa#(xh$R*L($p{i*v{{#m&{DQ
zIc9ogrJmQ+5sU7@x9Ea6r81pZiyi~~l!>5QJ2wHp049O;or>gpJR7G*ZbUgXrb1v%
zZRGICF-`io+P40nf{wBtY%s8umhX)%;AD)@`J1-mp(^+Q8H!nDdXKMd#DBEARxD>%
z%;W<#N$)moZ;zf(VEV)9`WzM^Yg!c|sI!M6j+6^%#>9IkNu87T{G@e2H7p98DSez^
z?7JyMs#zi#WUZIe;wivNJs4o1rrBiC8-LNo*`7J{+<bbRM!euT#(m;mCfRv@Yg!7q
zcfm@h^d^ehU#xILa4AY(CKki$spmItaB=kw<|~ht@$HX+Mz`2$eZ2${FLk3!A>4<6
z`yeyGJj;q7qAHIZZps4vp@I;<0uAame#Z|{u>W}?>w$3eml@DriW0FvcVec+p&e}#
zc)TpM=~;&G7)PL0#hBl1i3NuKGOjdk7qQzRi#gB;F)EJdDCC2>cSyy>ZsD6fDd)jB
zZVd5u^7EhNcsb3Zok2OTThJMqf!O;5+s0DFGRA?zBQ6_{``b@`bx&}!OZ3k-r167C
zl6?+JMkX;)akY0I>m}Oo;l3!T{1Wb-lsv7A{7DG+gVJ%>pz%pukM2E(-ZH>XuMxR!
zw{w3Lep!Y;G_9R0?GgQ3Vqj~ZOqLWKeW~zuQy?=8!R5b}z;K&5=H)|-+S9l-*beU>
zPiZ$`hn$r!T7lNyI~1e_Lg~GW2Te#1?V698dqhr7P@KEQxSjP5Z~SzMaDzR4AKx5K
z7jz`~o<=wt<LP>S!aMINQx#*36=psv4{`Xy*hZ_w%gROq(L2yC62q~aV5}@I(e=+y
zJuMw<ytrI)zMxX=Yf+ph#5TV&RSm6kodEIHCz(!vM1T0u(Z8cJ_)!S15VMtI0SnV~
zJ*A>z@Q&cq8oRC;iEC^2RP#vDo7%(LL2g8Glx9h+v+2^veWvX}z+K16d!*y`WpA#5
zjz>o>6Rk#thUb~!mor*I#phJ?+SC_>`BFM>U!!4J=YJnTXJ*2vQ2Wi43N(dpG+ChE
z6xND!KnuF=OB>;qzwur0SPoZX++p_bu==j<lh>~;oK)>4|H$KVw`LB8cAxbW2=a%Z
z;t+siQ58w`@^lUD9wUTV2S0=Ik`vxi$It}}`CN@RJE0^?G}9T%qKWoEgT|CVD9L4J
zo%Lbb*p^2kOuFA9d*44)ZjoHVMInDV_nSvZbunkZuliCw4=)~M#hGQ-EVJ9}v8i9H
zi(Y{_W+9$l-7bF(I_lDO9%?mn1;^WQCO~(u2*tb79{IM_NCqOS#dp1IdGK*==V);)
zve{<OM~7+N&_p`bsR-9!W*!&h<!jz?t$9cw1@-J&rs|f!q+_YB;?95GTkl}p+-%`h
zX2BdI+k0E0J4FAcyvB6;mqqJ9ec!`{S9}v8b4y2ccpKwr9Dd!L@}vs#)y2x7n-i<%
zTE#$=j|ym9HB%4>-SjSm1I?ezuv#LUE~=c~+V{+zgOse`SxRv8)h<V-@;Cnv%YaZg
z4={-)n>moKejTtk6K(VvI>=WJ<zIr=A%IY&W7fCCJ5iy1`Y~n%)gOpyULu+ogwB4x
zw})LYHQ{TThz*-g%hgZWpmFJ^c6)s{P{+^xl{`$*D{=3KF{bFYWabM27jR{o(wErI
zuouhtLkC<@vf&&LY3{sx^4jVCY}7g>NA+PTI_NtOlUL%Qs}R*LYPl{+@q9<dCfVqq
z2$&VM`q`PtB7TE{aE@y3BUHk0c;{Q|;oRVv{#+5fW$8l$|8$GhM_ky9xS>*0)zo1d
zH*M1nG)_-u$n=1uG-cjuymjaTfS=ilSQe%Je8$JK|8{7xkq(W^M$rI|yK_l9LQG@h
zR0@W9+enBUe&PGm|KY5t=+oO^v1R#Rz)r+Pdk3rb)b~ML^~@eEBr{_{>@p`WJz2DD
z8#)cBeAxx3i*ZCS)DyAmSTPQOAXw3p*srKH#-B->ENq>p?IF8<zm)IivFIp_U0un>
z%*vyZjKvc=1WG+<AK}~GBSbtJW1tnTa1gv=23*U=6c&U?e1p=D$hag1*063f`T1ud
z`xFg3nNL|?eY#ZtDLd{{*jVw<7h>=2W?0Em)EquluEK1os7<6dH(?=i=GF^JBm+18
zNdIPJ!U4BH#n66c>VVyOF~`}FXE4DZjL9~=BZ`eQQlyRyFV(oI`ce@j_2v77p`}R9
z(L8)DX|0OJF+V76;JxS<N6dtR>CknTevD6`$0`1$k-Q4)q&0vE818y4A{o}ElEk4s
z=h=r{B}Iq^yGzV>F)77YwKD*#&pYe1G|@{-aPml&T+wjIIH77+oWZ9mF`lN~uG@xc
zJED+g5UeCJ{}Hf^y9_A$nzApoUh9xa>4bW;TMtR_!nY(dhxk^87HiVansjtcP!r%i
zevy8bXup9y8hFPTD)E?(%%jAp)p9;r_n|*!W_y-Y{g{DO(L1ys0Hv7jHJ%#j$h^x4
zNPQD(Kyzo@w4o-y{18eMaE)~u%^;hpW?)iHzEC}nlXr0fcwyk}=xT%WU0FT<A{u0Q
zzC*q4mgn+|jRk022h{2>&6?xjk;S<F`I8GcO}l4SRVajx<Bf`m7*G6ZbAPbk?J|J1
zqPZ#GP7tC0(%x)2s;Kr%i1p)^ER~-#J1vY4N9CB<_){+x1(QY}EfbHkb)0JhAf6>b
z5+9nFTz`3{t-IfQU*+Nb=9fo;g6_m<L0i%r3{{FKaohJGR${EYC)zz52|MpVp_l4K
zn*K5pKTh0IVosMnZB&XUoWmIv`)w-?p|^*|@K8xwY2*-f875bkGW_|P@)y=wx9bbH
z$tsX%b0%iKoFPA!lxLbMuc__jA#J?@3z&1TDm}X&{5BSj=)%b@2YQ{0Er!Uw0=+a=
z4r)XddIcGrC*bYm7@gq@9-nG;Xz$94+)Lvx%R*~G@@{Ok;X?;y%FtbwUa#(iFR@}d
zCq`!;(Nnz-e8yoh49@YUqSpOeQ!sGpwof!e#PIb=Qm5HifL%E()UE0DG|cVEG#Q{~
z7)v#$J$bKm<17ljYSvyA4I$nQiC!(18=mif?Z3<VKXe$^59)8>kEI^O^#mdZEL@nQ
zi<Y32)x7hP7pS6z;y{W!7B2Tfq4JH|Gf;c;F9T989*AwU?z5U)o+XPG#B_X4^NEgr
zX4LoSI1Yn(;%R(pjkmhN4@6Qz+wRZZVk<H)mUI`2F*G#>mPuaKomu%j;@XnjeE;wX
zVeAB`_6Z%LWt0t=FVm7P9NB!Nu8@pq%jpveiXSQO@OyJ|J_V<>AtUl~1ny9Diq<Tc
zq<INXg?U#T%YnH33b#S<oiPMhFxek2j+Z_N=<E;$YtQ%KfhE`|tMYIUu_<G@yA6QA
zX1-d&>pag2IL|I7N>kJAW6oy`pQ_&h=Bbwo4p@^Fcku`mPji>9&dy(*7M1kRk9DtQ
zHAuap|A0xh2Wx~O6(8y$D`)M0X&SC$QY5%zz+_SY<_{P3uCB2HZ_(>)kqE^drz2OE
zOP$+>A{`0(@4%|~{HEuJJWqp?N(#R`;5Vqf$a}hX`-^u-LT!C%+@(Yhp7+r0CAtfd
zeimwW4`W{0(p;C9cy$Th{a7`|qfti!4&PYD!Osk+Cc<Z5+4>YEX{{>lQooZAq)Yg_
zw#u|zJ{<_^>_K-4Q7&X1$fah=5C1l=QNU(f?`Eg(=uf*twW<5#YcuH}OMR}=tK?o|
zy?YeBA@Gk{^8PZ*Q9%Py6OmyYax~#;hzVC&7p@fd;zl?*E(;L7Y)_y1Ht-FMk#WHQ
zD9&>$k+W`M=$u@RhqN9~^IW;BN#sct?E7z0^BG<QWL74MZmzlWigdO-i!SbbeF&F6
zG2>*RIyRjiJ0#%vin4YXS$R@+xNJ|-G>A7?mB8?g|M|@&;ee)}$jzn(Yv({`^F)Fe
zj`2r)986l}OtnuY7MRi21~I0eav?DXrv;;HAwE=xQz2JXMJjm}+6r$n92vh9b&&sf
zW!)B2R5C!1%diA&F&ORlELzo{Z43e;07MbuSww4M1C`hVBouMLTy*WPsyFjf)=<AZ
z-M(CY38}5NWYGSE()nw?0)-H*9NXO6lCvs>X7J2+IU~?lrLFf8vB>#reORQ`o$tnI
zV{Y74kD=M1g-_)xaMOk-#f<ZSFuZ!k-r)1|i970&W-JgAl6H)rPeeh77R{ctoT_=_
zR%HjmIA)0(KtvVCj4U?Xh6~8y0-A2gw&@rBc_}A;LlfutJc6q3g8B1;tfu(oev6R?
z>=;sGQ1CAl=QdYvakJy=qq&)Ubb@-)8o<M=%3{&Sgt5;<j-T`7(~_4vG&nav`zTUa
z%-yO<S$nv&LIO{Bx8=K3X-S}Uc1`Ne1TXcBu&m=pW%TvZGK^3N!=*{N0J!##*^8^w
zHLq>{W##Odj`5teUn~SAt4T|}ZK6ypgP(oSvL=Lu`)3_88dZ*q53wy*hFmuAi_<1z
z`rBE4laVou`*ho006J|;ZlivG3IYE<;TtBUl%@mAeihmWiMQpg;rDHjPSr{24+6kr
zT>dhvBX`i|R=1G|Ebwp_*VQ?-qjYF0fM(`nBe>?)wT{Lk=Y>a4%P|!mj)aQkly$vd
z0~{IG+m*6K<raS-RB8na=<3<QMG>373?#^i4FCsMt1)gf19SV}@$;X1TCS~j(t41<
z&Gae~r5X2O)A6>MsD}|SzgP;{8Aq7B`EWb~njeXP%dY|)(d`2uJwhp;sdk0m3}Ir}
zaH>NNx2HZ*;s+4KeM_Ni>F$1j$F!EYbpO0hn=pmXA_*3|g0@m4bq@Ks*a#$UZ48Jn
zj<>CDziTh^=!c1E00`kqug}$DIp=v|;|Dv@6oa|K4E+E(ZG;mDSZ}UuZrsXNeb#!M
zxTc(vSnVc`(6G_*`l#O*QD%_hd%a9naVFvX0wSNRW><dvdEbbvhmocfrDzYOvTD<|
z0U{?v^NPWF{K#~gG52)mQr<6RT$|Z;#OWluz4k*rfuJVS?2Was(G5p&GB<lD%S$VH
zBg-e;uP*$*AIXSeRFe6g{Xh+YjD6LbcZ=PG6oo^Cu(3LTxCQ<X4CZfdagajspe<gj
zF9NyvKKxEL8+``E326Vy-S`)+<$qMOzY+8P#|`|Goe0Fm|3A5bVmUZq{CNZ@o$&V|
z%rr%5YJkLrR7p$zm4HZ}04UPBmCp}<Bg=520PE+)61x-5zwgN$0z66UqsUK0zY+2L
z>j7c?f+4&m@h=$#lyL}9N1oj9)8C%Nr2u#u;Rj{x;Jb+GZ}q%v#R9t^!#9R<tZIY4
zKe>bE|CQATbn25zrqAWcIi2M%heuqTXZP1m{+q8E9tAwc%-bgH#eWsQ%T<{ohxfnF
z$EvX0_|MAk*p%dVg(>l0{iWIeY8}A6q<Skh@}_7L?Vl>9#um$zZ)=hNcW>^h`=bYg
zZvgNqVFb7EKXeJnUkVtAU|qhuIN*Qvm@oopPit8|-9KC-{{-MmXt6Np{)wb3)`|tp
z2jBP+%0E?$4cJN4ri;{nTQ+|*7|aK>=SgRB`hO2CfJLALW?qUpHQ;X&_Q#!1077y8
zqV5RJKUFISfUsgd2FCo;sAn$Tg+GaHJ>UIPwZXvP{SM;&4{5lYPU5@NqnWbGKUMp`
z$$a*|$-MXI|Du&CCe8-D{^9p`0o<+i|E<#h*Hms&k3d2%p0rQAo+ZOqL-i~)9NI*y
z44?6$hP`^rA!!0-M)fl1yL{;#dl241<X{J|_Nqgw41zxhZA&nRvLtZlH~Cy97naob
z;6Z`#Tpw+UU9?uJtrq!9iymA~&m(Zo08N77FhB+5a>WHTxN%d-MsNY#j)E7w_J%h6
ztpBlzfb9VFxr1|w@Vm9;nX#+LPM;IlE;2LnIUdXI>A)ziT?$$AyS>cNd-DSo4j|6W
z))LJkJfcFp{mvGH;1Pm*8`Je?OQCSbP7<9cH>M%EE>D2w@e)(`NVV8f^ybX0VqD)g
z$=LV29n`QAt=I=-b`1&*+36xgZ#;4?%I`>2c6F=q?V34C_n&!e7uWOwsQcHXUOVgn
ziRreMlxEs>WAI0+$5QYebeIRo6xz<q#p{})9Rgs#diQl8@ZQzXLGT~@UpVlpiEtm!
zEU@Z^Nj%eF7g4TRXN2YGXSIIGp8)HM^RQpgA!|>)l+3XWtAASzmDKOb5yvxU7C?Xg
zhTC&h5!~e(DK%~$btAlx=n|061bklv+@`P?e=Y@o6Cl4xPPL}KKux}*ObVY&wz6*z
z=Y`^k_dL*5!8=xp6grSQJYDcBIQe$5RhR;#0fzbj_?cRg4F(s$gi3qC1^z@dP`93L
zOI>gJA6pZnIDiaQe=PkzPRD49*mYFxiyeVJn4)4#+aS+qp#G)HhAI^zUYU1p6uhrT
zVBmYc3jahQX^3+m@<{l}&DEibGXRQhV0m@9*HD@Sz!kTKwWPN{6fGl%3sLe+gQ*Sy
zp{f<R>j6MJ9Y_THwZ<LxzA$9?+5U1`LVTvR;2cvaOr59s;`14Ro~?5igDC1=4fx%d
z@ho^d=eXMfaK|;+VLxYv_d)RX#T~s3TN<WikU4~S&}^}HzMkQJI2IYM@*gweO7T|A
zY||q6fvdkkhHC{%^2JU~3B;;w-l6%r?~W-{ugZ)K@wc8Tw@9m(%1mkkfZf4q0<KOo
zu}7~FwaZT{0QC8~@N$OlMYqe|>{J+u;CNbsZpG2CVgtZ!64Lbc|C@1ONe-APCnlD`
z53C3D4T35`^5Yd&DpUhR4k4V*z(T7l1(>4W>VCCg%sB#Ny|C(ETmY5y@$;A83EVTL
zkzMZyAE@QmSBC?j7c4UFbFMm6DmV@o7&p1{F|#}vEan#aKYMVp05X(4MIq9U31h#;
zhU#9{hD1p9R0qj|+YCg;?>GSjOi#a}_`5DZ=xhPX5o^WP*TQ5C72&Z;@K8$}njiho
zUls`<%LkaGJ4@?e+aQ=T?#@}NbHAf>)virA_xPj2F@aZRJ~!v<DKRP{Q*jRSusSHf
z!OfAbb7(u%7+k)?!DhH+0K@Wy|8l2dZvO$1-Rq}(Kat#t3Bb4?PXJWDb2{Nt0|5UK
z#EhsE>%o4w!oCj(a|3zxGzaxSI)K1mfiPVHi>og$!D#COmq6GI>f1#nb-dc`G%QcY
zKa}OVJ)ZA(d(+=5@92o@EPH5vM_LAuj4r0CRtUVj^DHRc9#he`cl=ksTIa_3U9W)o
zte<45mxa?L!PHmMvd^>D$&!U2C5<Qghb<UvwNM7ET!R{W`^WM#h>)}#6SDo~JAUQ<
z2ozpZv*0Ue)aE0)9LAYl4An9AsT!J%22f(FeNQGbulE7)<Zledu;=V8?ZU&_Qb21F
z8;zef>(_ES3Y|DmQvpOq_!Iyg?*rywz5krdbHE+|?VeuY9qA4zAhM^Q>;m9Db`{~{
zSiw9N4HePrN-sB09#2+4-}vdKn*B{~U(3+GCIE3ZPW34$EUw(>vFFm0^6V*Uc0Q<t
z7n%_)4{<jjg_cYOW(YdGzc0J)@|s|jpNUb*^-A}u0Q6{W=Y&kBlXXv{cdD4VBn%If
z&EYn*-oF_H>XThBe)g$?QsQXtbPUkvvw*H69vkw9e~YPjr&L_-W}wyoKqsPq2BHN$
zj&7nZ^95)ZPTFE`cEL*8ZSr4}D?*)hI_#leU9SN~L}-V}^0?Fl<n77^3@<X<%&++Z
z*O<vo+V#pGM81Ah)KY#k`GBZjIhAjS06ryFqsGrvxndWewb6j5WmpHu-*}oW5NPNR
z;Tv*Y$QRi)6}1^5y8<>K{$qmp!%nw*8AN<<GMQ}JGut>A3$5^yk6(3H*-o&Q!H(Z_
z>qW6M8x0e~3!h(_z89ADF@mnfl@*RO>HlD|lIA%b2uT_WtaSgJT9+kL48{-d<UG!R
z%v8hm*!zwfXY3pD;spUcl(WD29X&qSg1Zy)YZ+F)cr^=v%MQ1$&z2*h7U#%+^HKUH
zQToDsyxQkL(O^|2WtRMF(|!#0aX~5pD`A3zWO)O_520K{?`f<WC7pOK)$M`ZC3IR~
zF#yNVKz~%<A;yq?bTW}-Z#I$L%rMCm2(QiDXo*@0V>+Fb-a_9=&~JSfM|*lBQUw+U
zwmK&sd%6CF$YvlhX4WX{G;Tm;v*5{C>m_%g)=w#9Ug$Vo%*mftLHeQ&6<?QptHvEM
z4+Ys6!jrk3Cyp6jT@W}CJaotsTZYQXm8Y}5f~oPd4Q|xqZ}Z?s;XE2QbcV}i4s#Q|
z@8sPU!34;};M8O?&w1=P*k_CP8*6sj-%^k3-yDATbeCR*$WXiYTPlW3SBeKXGZj}x
zGf^#e*t7J?n?EBGbxY|NI7Kwy%D75I1g?QK85YTLDX5*|ZG8LNrTd-MWX}4i6*ki<
z?p4n@?-Lg#L=r9KM2c+jZRwrcVj~~3>PJ>>@U*xOcvAD109r)l)j-!oh2!V!0}36#
zxsEWWL%Ws$G&TOGfAjhLUu4|vvK?6f*tII$EBb7}Ql=*b%h>PQ^;IYXOVJ868@2pY
z;hO=KlUt#>(RpQi9=?-}<ovTNx}Z5D9F~>@J<B9m^^SH5_=nZ9=L!geAUJCh+jDRd
zqQajdPWRP)J<VNa*A<}m3$T@aXCtn9L<-n2F3M(O67$AvTA5`tp$Af=4cAmQf}5GC
z(jK))+LvyHs-s7MMTH+M=^3&3ZnEPnc(2#qHhAlElb_K+^nSK(?PSeNo|BuP+8&^4
zLbo=_alsNlq$ZvUY-D~GZMc>%NEHT>x<lu`>Nc`3e(likL1WefMcEumYNsGhL#_?i
ztcY@$wl@fol!JVeu9%bqeWG%WjZO?i>`c_7`kbv1s{GEa_9h{FW0s*I7jd1@ev$1h
zmWH7v@`*>@J3RRtu%|ot6{)^{8})Pg@fFrfIop7Z=3=B&PrEo~z$dEJX;0DDzF=h>
z|MyMwbq4_SH_LFKA3ST<87>H?P_yNktYsd02WK<Yn&^=HqQwJov>s7t;8}tHn)gDi
zj>UY;EM~&Cl_)F}!(o*hE5SdWr=l_xOLyvF7`mo`)^r`VR4{5~?jK(j?A-$P)Kdpe
zMD1?_S-o#`Fg=p+Cd%H-zjhnjMhF8E8j_-HKsr}Jz%Jpx_O114sE*@;q(80E&#WNQ
zkm<+m_|Q!c5grkFBW@xBdaLD>+U-S7ChEbnU7LfgN74-3tT#=~Z-`g>hG0KlT`vi{
zj|Q!|eu+PM8pp}I!o7;nLO6mC<c80V5P;zn$qImG55o3$t+zF2sh?c{>m{y%xPQP4
z(a38Qi1?ey^j%2`u$V-40GJi>@Pk*%R|QUvF$4-5(%Gnq_)8*|O1dHtN9Y|>6NC2}
z)o7k&x@V=46M)n@=AjZ+Z7=78Q|C`6%_6~eJjFGlBtF^_nPvXkIU*~;xSm+jBvbF5
z@D~@6`Q$Upe#GW9K~#+=(gL0}e**ZQ;m$m-A@ib8_4Dm{99mrP(oEi!usP81)L)RE
z(Dszbl$=SS>3UqU(CU|8=7kRXmJ9jH;5B%snNd1HLf$T*0si^)i%+Wg+aX@d#i{&T
z+aEHfIaWIJ`8f0Rrv)|pXTSX@qlzR5moI9k>aCzt%tTwB0vqV3LY`aoSkgP!7=eA`
zdx8%BHXLHhG%s7t9X(I4G2w$MBHYF^qp%oSWgdcb*JO}0o|Sb{U`QdvP$my}lK>B6
zNgp#{ns^<}kxfeHDze!vTRms`c{Z}A@xm|m38RohBVX7Pu^kR31{@Wzo^^Fxy>3!~
zdC%kJ3M#$GM+sHHHuf-FtvY8gwoK-FM*7=15Qm@5J03R}fB}Z@o^Fx_045v|*k;ZN
z)8^O~H!I3qju-(zzgm{NRTDft=H~C8G*nIt)BtZCNd`P1#UN<@=nP>3URhW<VPJlr
z7Vz?v2tf<8_ldw86n>C&R`BT!Q50F)*<qP2XV*Fdu|Dp4GK;)nM|MksosJM|sPlJp
zt`2nGs;>rY1PNoZ1Usc+u<f2_<~6sq&OKszkHr+^iyw<ErgjzLUYZJ9g@qTI9i`$M
zz7coVn#!^Jwei`!i$NgCDKku~=jCegC@>>|89i?1?ac1~hq1Sgi*jrChZQlv0O=4=
z8fh3ndQcjM?o^O2=>`!HDd`$gx{>ZsO1it0?(Y1p(Y>F|dG<N)=k+gynfqS7u62E5
zt@=_WFsYlBDmqmDwEW#SG6u6>B#rpe%1IjJB<L4dL{{P-z*GmrBP7x#VeG`xHe)SV
zEIqtO8vDF!(6Nf}i>%&rNt3y`H;r8z_GpsTosQQ-4apJYl3}x9Q@7$#Qvc}g4jY!7
z+?swH-sz778Y#Gj<efZw-z63^5-As$*W3?R9A}E_yplcS)Fw74RhvyT2S^7p+J}Tt
zNHCzYk!2P83%N_53O(clyNu^?+)o+gQ4Q%w&6t$62O$8M7D`=u!|T+k<4=zhC~z03
z)l6S2MU{=-`Nd{O8&x<h(b8gOxk2U2yFmB-KK*;Mbs}BQiYmT{M^krn+1XWcWyken
zke?Syv7$U>Z<MYD=&-y|q?r<Z)aICzUh2cfc;#%Xv{pckUdQ1oZhxLru?r6p--y>2
zzaYZR7LQ30+Zd-;Z*iKdkPz3*gZvU>Hy!;-O<y7BE+H6_R{IJBdNT!0d}$?R>fw{l
zxsID%Eq7QrrX5nQi~-P@Ry=Y>8zzH~%bFs*?jcwKPD%J4lwRKf@8Iu@YJ;RilH;Df
z{$3zEG}EZ2o4<0h(KDg*VAcBLnf<~6$HJZZ3-ir05;r=|ANm!|S)-7Ngjk*6(efV`
zd#djHnlaI!33<u1q-IKOSAnAR^Y|m(fMuswW|l=rB9M;`G75ny0BN4hEiLUVHU$B>
z#8w_(%?Td=crxalv!Mf>ep4zlOVrk_xwgzW5+4>7Y~6#>=C)S1K8M^W81t*P$=TEj
zHoiJ3e;j(_+bj&(o>|_gU45x#366^~pYje8#GlW0$Ge@b$W}7(N&X&dqH7w~Z3Z})
zIZRA;!#EjC>48Pu*t({c&p%@5{iohHko6%*;sIYutB1GMI?ilshmTo{*~al8UtXm6
zsNn+jW(>qguDeyb?}HSxn#-zwb#oJac%vl+Jp;D?%N?P8X-nGK^!<9ZI9i5JQ>z%7
zN`9t{q=tP&YRrHnFYrN;pXN>=($%S3xDt=K9j&5G?cmdI0LeE~w@A(8)pJB;9j7J^
zAdzr6A8w?sO5bmt{(k%GY>roY8LxKfn&<GxF^3Z9)&78Vqw%IgZ<2r`lAJ3F<V{Oj
z?csRN@C(S@2oGAw?aPBW7x?nFQ}ma1Cm*k<$-);ZL7~eomDUjBr!QnalBW?L%@t4U
zd>ewl3goB5Y~d4k@&SzS$}jd}W8?eNVv{JW@T}Tbk2uK*QVzZj&=?>NDmK&ReY+V`
z2GN!hh2gVi&&^JNwS|>@x}@)__a3VlGyv7=@6m%eMS9>zzaQTJ1Yv(9tn1RURdXb;
zzn$Q`GQ>6WlDc<vgT(w>j*vw^KYddz5zs^T>2zH+Ys7p$pDh*%BCg9klT_0%?pwr7
zQKK6_X5*x<qNt+I@wdpaUg~x<qj{fGpB^BqrXUTX@rbNcFdNgS_%IIAI{8R|I87=m
z<JAsSH_Ho3W+^xuS<lg<$bq8|DcaH3cxP}MUJFtvq?Td_{or&=zZ)%!K59ShNL4=f
znOpcm6c2S{P+mGPzs*?;KOx*vM92HXw`}?}9dN=c$x+e<V0(CQ(pl(IFIdW!S)6Fz
zmjvpD4%GCr-A;W7!-v~w31n=P#ZCgpD6(%2En>c#Ff9m%(O|-2a82|)3T2_xG((Zq
zlHrSl?a`JC-_wz}a^_Ggg0RJKo}O?yE!`3RG!iuW6{7wF5O3n$P#<e=g6?Trr-0LA
zAD&AK#X(9^ubXN6s=n^N;J2FQHgjM9eA?0SaXHtE&mm8<s@RoaQZFMOc(lCvdH0{m
zd;{4^ZNfQ3*yJ*%k01?dZFeOx<(ZSS6yW|7gw?p(Mv12;)spvZ6E|8~nm=7W&%d1@
zt((gZ{H7>o0z2R-*6gD1Y^3g<O4J0hVbHIaWDfK5-=WuGYw0~b+9J_BTBzZ8NpYLt
zfX3qSmgd~qZXzF9a2=4$$-2L3H!5@jX#m@C-)Ba1GB{-X=@1|mv^gs}4S)LU>>be<
z$*xuKU1=2tw_H;xw;V+<m<fV-Sihh72c;<HC{=<rs}XI=)oyFLc6hXLT?NBwcEf9i
zLP4BvPpSLKfo&KcoBPEX<{=^RL{eL6*=umf#b_6gClr6PRW5wuHWybq^c;f1P?vjE
z;^CD-N+ule?t6Sa&eh=AY_WG15GHti{w+87d;71Tm&PzESxm&w>qCJ|I}4u;KG#b_
zg<!l1|2)B1H~$!Yyo0g+iDnqb`x$t6S%rcoAr_kfEB*qOb8~r4&qIz$CWGQ_udeF3
z8TTvRa*!fhia40dEP<vxqPXE@luYrI$ZqsacS>W>5lAZJuyr5%2HW=IP-$yTi_~cz
zn0Vf;mcXdt5z!p^Frr`4PNP@Em`K^{0$eV-{lEEZW85>nq1HNmMCjH|_Hrd{fo5(Z
zQYD>>J@}mpL^%;qEKU)*mhm+iXz)++k5xDv@%O!72J&MWDrl+OD^OyMnI0y`)ue`h
z<~C33?sK>}wl_=ZFAn1fUCJ>?HZv$!k%qr>jxAVAbk&$2Jdj)ZxcbR=QEj5kEQQ&S
z&h5c-OpaK5dTA&~*6Hr~Nha`c8hDb3Ob`tvltEWDBdL@O|B_|@bJh&@*Xi#J(1HXq
z_z#$|m#(A7>ezu9!fui~-j(mF&m;fbC{1Y-sEP~k?{*TN13h{`QMbzDXX1Hrs$V|i
zMm+oBq=dKT__JS=wj+>5vMm?aZ)LpHgvgmXzp5q4x%|FS)UV76HMX>-;g$$X7vT6-
zmz+IrW`M|3=JQv(W@d67$o}vXW>Bog_M1E|KK)uh*##0JdIR0kR#^iPzi8Tcf`m-{
zxYJe`TEM>QJubh<P#8fY5q98Z*}8B^ZErrBC(1BY7D%GIK3vebnfG2V_ue84o2q52
zN(fD1O^c51Djw}%m8q$(_kZDwg2>Y@OT2qOQ-Wd{I_OOfCyFU!O>8Xh@FNgdPF&4J
zIpd?v6OsYrZ?iaItjDamM-znHcDWL~X1sTIae6RBO<i#I=7RVMQ10*%+0>$a`kzNf
z(8#Ypl5aN#&2@Q4Y3hYLRZABnu+H<QPbmPv*(uQ}y-Y9WemBq1=mxscQS%Av<KWhh
z4}X||Jelcw8H4Vv6fQ=ej6}C_9*}bC=6<C)mQ>Yp=VzWw0p!*{9r$NSXC=FtCm_wU
zLAR9V_DeOROW__tJk<K-jN9hT1OBu9m{kGAJ^j0no*0^H;Ogp{kU!D|S!j0luLTpk
z;VSR{4M=*BqIBl2xgo<zseW{7N$#+l{#4Q}R>qG_A0O=$V0aYR_4X~`7*)p*p&k9p
zeHfb*XtkdOA53+2o+hov(r*0Q3pxER66;zO2^xIm%^~xh>oMYAse1&bDa`U%fB5c@
zC^1^&zp>Uq--gbr%~sEJsezB}f3FVL^8N~;05zsC8rD^3UGvNqNrgQ8?>0k^Hou3c
zB#&WwEX@z-wGiX)9|3wyZv9%{RVHwLhe`5ZrG&=+_5D?dS>}U(J^nqE0-;0*)#oi^
zE9T2|5)>c!S2;aaKK`kOepSqe2gv^msE%lcyZ=`+c&vmsAjq#;ZYO$sU~X2q^Iz<T
z5gP3+c6Eu<=FMN4ef@Svzj~uAXO-wrRkOJ^mY@9VH8S<c=Cub()<Ba+!1x1e751SE
zk+D6Tu&942w6?&7&=lsmq#Rr%2?yZ40ko#qd?)jm91gG_MD~+~yBsh5|6MaD@~6@<
z7e_NQjve6xfi=b;M}@PbDlc_mwKjNERX=GtWY5cEi1Zz7?irlRNuHg+-0^Yz#z;XT
z=SImu@)mFrs5=4l^OP;Iy9iFz*t^DuVGNd!kQAx5LBI-s)A%t4Na0FWb>H0hA8&_V
zpgRD)QRgG>b(xY8$#Lp=*xq&{8ljo1G4-n?BkF$J^^7{=!3xW{&VC6-GfEizEtk#m
z?|gDGIM7wkNyT$j%3htW73fbpF3~&O1^7)7!V~F!q)F~=khA0117(8)P+<xHP$jG7
z%#OQn_dsF_4#19yPR^w`MH1;(51~EK9vuLIF@ro=$GYAAa^E6oPY#6i7;%E^1Tf6f
zVS>KWEa~+?;At;4ifCL`$v}fYW8LU$QkZMrS;mo%@7=CJDjT5Qk9Iwp8gX?7Vu-Hn
zoP4#lG1tQ}gBE`_fNBNCfV8}EM4xZG-FVwN(DnO{=zE3Dl52tVd72~exXf{r*cdNm
z)olr2Mlc;$rmF3SS_foq^(xieLgVR0k;gEeJp?Tti|~#xtX~1(!E38Z4FzNm%9r16
zUN5CSHPZMnxg{n2bSG#g3#Y^Nl_ng=R)?_6lv2;j%-FZjX+wl35>_YB4Oe5|d5;$q
z+_hcJ%76o(wTTk5iD8$6A!Xkb#S)WB+cuMVpgR(yV`Ys4hzMVT)iaMpu=TQn6MHpb
zE{}iNw37+K#S;!9jay*7n0w5EdVMA;#Jxuj58^weF4SxeTj@&?nPqdABMqD#CXX4v
z1PT982E~01(1^5LKb#C7puw|b5Y}i2Q>$pUVU@-Q#5^w^A57WLm>rIrFqUJt-+e4a
z_rfy~Q5NEN&ph;hHh3`XRway>S8wR6l^DKx#CQA}A&P(2D@hU*EPHLmfhHv*7d2r6
z#R}ZaB1JgRYMNy?ppVV_bla{4-vF;!7gnSrn2_p}78k1u^n=cZ3d1=)_?#Cx;RmZj
zwB<W3giE<g0f+AMi;3=TN198fbTKvNAb{IyUsg*4o~G>97pfd3liR-<t=UZ!%t6f2
zGuCWl9tLA?0|p_goP;J#wg$R+^T1g#E^bOK+yuZ(`2Z5E1g*zsFx02kSSavXvwGO%
zyJoTf!6aC|V}ajj^CUkZ-E$7Z-Xyhyekp)BvCkF(z=-=1VBkS*HskH5vlI^iY|t|X
zEvW>cD+|C!_ZHU63MZfWJP9o(7B6i-#bn2k>8_es$Yohe@J{FuCNv8#o>l2?iP>qk
z0vLqCVEMr#%Q;zoC-&2&7$Iz(yK}8ULG6$5S;+0!qKY@)Z=R;dn!}3=eT+5TK`=UH
z%S*-^)oY5r5*K(Bst!!XCawE<mpLbaG3%Q`wbmfsLlvpLZ{}lGHA)(m&6B|MG_rW2
ze7AiQ0I&I5h+O~FQEqWJ!IVF?c5)H0Ly@*wM>9n?Rc<x6+|4+?zL_*U5cmmBYxY-p
zIkuXbS6O*2hQL!+y4Id>nWKuLS}{wBGk#CM_N}qzkz`)*od3{-LE6a00edeh2hYHL
zh+5~FFV0msItILpaI0Nha7Uk&@1(Ja&+G}|NV@GafQiWa>K1BobE1#~m>O0y4Uo0C
zK<3bq`U51tc4C0c_E|avu~(ROo3FL!L>)HYiG-OpmLGv4Eh$DUzqvIcYzq<AR+<e(
zj;yE!aHmxC_5u&#m8MP`NI@@Ti>+@jh4BF?JcdQxustExc&Q~&0}fYF3j8QHQCw6T
zX@-peHHEj@h^a<&X8xu?oU1zbR*iM?&lH38j%C)Gqsm1%E$;4tj*iMSNuo`^SZNDp
z0yGK5=-ssqjVa}ErkCh|N^=Z(UvmNGKBwhu)3W6R5xL_Unr6_9y$Xlh6F*Mb6l@+q
zczfD;YMR}T)~;{XegT%<?&4Qr`2YvotnOY>Gqj8S6x*~b$hp&mX^r5{tBZD|2<k|M
z;)<#8ue{Lslyiab<~;&I)#Ch4(aB=02xDLu@dA&y)QexpOUz_w=#CmCMguJoAtNwD
zkdr^-x;&n<wx~Ubbfy^+LD<`tX#;HLtMP1M4Re#=l^wt|m6c~B`Ei|cMI}RVKb=OD
zw<2_oHQMWCOiRy__jc=0c%{i}epHK$C;?a}?jhg0*8|7wA02J}PeAU?b}sD3+?ke5
zpO7YR>?2;TC<n~KFt85C<xq87?j2?BjPk;FI=ZXHMrO5?cHi}%0F%`PVuznM?a`{F
ztBGhb3^GmF8<n-35s)}{feD5i*g=0SCOmA43&RcUmKZz*Fr{WKph#4l)gVOZY$z`h
zghI=uNAZzhqMp}~IuHDi_g;4{IBYntW=Vx~XT!*=!oNcgUUg&>G7=8wG+Bai8G$GN
zs)TvKx!2(b$Ox1;dzd{SaL*oI0@g3FC!rH11Dy0_63mRfqU+n!&+6)slQ|co$yVk4
zuPVg8ZZm%NA_6c@*uI3YSqB@;wlpstYXYDQ8nqQZAr_6o59~+EM|JK4Kh5y3vuCBw
z1SxyF2|Gt2sV&AiLHQCYez8Z?g&>I%#ZoVkDHjV6FKLE-ul~Zaw{0n6-+MpYXNVps
zqp+yT=gK|<8~Et}C*i?lgfbD~Cl0PHwEX%@CuNa|krMCr*fRdCJb=v2B>M5ygE0_S
z#<Ws}oY-4~8v<h_PUz+lPHJmv6#8cu@WA(ia+1ROtFoAX^*X&=`)GCLy~bqb({4;<
zv>_*^bPp1dsv2ZAG~)SOIBAENe%H9S46oU(&?7>lCd3;@?Fa02^Q(|n(Za>s1dbBq
zsz;ksn$>=Rm<+3~s<9Y6PL?la0e~X>`N@j^lB*W5oR!sd)Wb3X`ViPr+}=b?KaU@l
zvIyfDf;wS~ziBBsE(ZZ5l_lo=CQNAnlnMYAw-?UVkPfTO$>QW8ZJ_itze!$cB%z6e
zW^zEjgdvJ|ET8LX#h#PC80Afng2<*tduGA@G>V(5=L=K!=laX_;+`sJWy!=|bi<bf
zPp-$)PZOauq%d7v1DmCdiHz37J_7Q!#E0jxcYB<7Glpb4drwPF)s9A%qG|isi6Qbd
zIApz<%l0#_QA=jONIvM495<H-$?kz&y!v%Hyyh4GZ4d{FCiO*9)?$ejN)3Lj(La|+
z@vbQcAfj2?jx9y-57U;!n!;1diSVwv6^%&f-ndCYCHuk~Qc4V;*{d2V-?E#IVNAcu
zg^W7-*+w+N&cL%T7CL(X)n5Jm`Eg^<bgi?<2F;Hmyiv$nALniMVa};NAzaP*&!t4|
zvAEHus3z|1uFqe8U8Q*>d7f}#PcnLhNKmdieG#$+QCLr0Q_{N*6$K`{pKHGaFmE*~
z|1%J7-jk$|2@qu^`@~wMnMc)rf{SZVl0csxe;W7p9^^o*{DavD7z9d5ZB^JaA8~%M
z+_r<kN53%1!aRTrw|h{_Qms-+Gp$kQm!x2d-rtt52Vvubm4Mnq@$z{OS#v*1hq#KY
z22OK<STU&3OR>>N{%Nq`B&VC#><B9hC$O-f2>Gq0<mvelr7&kr1EJC5p^%1j>n|f=
ztKI@3t{|6#G5s=3Byy%bm1{RTRAmp4OBUuM!a@1O6khz{7XJxnJzS7fNxK3_yO%!?
z3=^v^bzmC|>bt6eSZ2+-Gs3XiElWwqtB`$lO~BETg7yx~l)AKTJZ^6@t(TqZ_K;!?
zwxdVWl`Du8Wv7f$A>*@io?FvE8)7brDo99DQ0Mbf9B49MH#w;;2&Cl7dtWw}EBTHA
z#1tN8oI@}8i!ltiIA<%x5kKSt%9ptKRA<@udSLeQmC#Fk=mh8Zl{%jtYjTXNPT<nK
zUXw9jNXjha;aH2Hlk}-jEMiq{f%Hm`av&c+KwBpPXJ)HE<ZLO~4Vy=m*=hD86qD+^
z{q?RR#}vgd(kHhRw%1(6p{n0&#N7LW`<+c?ys!*9lrc0?RnOO|;am3DFkLR!3yN?n
ztrn^h#Pua<R$&A2RP_#HT$wI5Vpf(>X2Bf43=Uz<2+eWL2frfS!XRp;hb8$&Nt|sS
zDL*2B{Ls_uKW=>8W02sOUQK0YCf7o%DUGq~@`TjvS9XqAQ#DZJSRt4>7h+ibk%j-u
zw2OsO_jel325h=qV0a?aqJJ$1*1m&z+~=oXdoxb6rC%jwNmpT;R@V_L02kkB=G}l^
zK}pp4Y;^^kXR!Hq+>&3^3(}z}X0Xd<dE<2*dXUZsJ9jdBgh!@In7v;Uo*9jJ5yG6S
zG$%lOR|+*RA1P2y&;M0V0<ZOW0_9dja4VohP1>d@DlgJRL>OY0BM>P~ZUF1fMak9E
zZWnK=U(Kr4D2Q2pI3LcS&95LWAOaksC;x*(1QkHS(AO8V6z0$}hHo&L$kR--s-cDG
zSN~L?&A9>Ai$ZJ+Ljbe#mLCtlRnQ2o5QA**$YVK_sh9vmt(DZU&Q`gV$x7?&<#2_q
zhFfShbm0U%=Hp7_kA>m@LFfIk-jOC!RMQuk<=uKo_R-g#O<d!Lsq7R9hO}~q7)>@X
zVupoiG}GKss4-O=w{Qa8>criXA(u}R;3&1WYT_STMoTgF^-ZHyqYqjT1I>@(#9QJ6
z@o&c&(ku}{^H!10&*hrgg(jh#nh)P_`%UjMz4)Keognms|M1<1J3Uk}S&S|R3(>OL
zb9oBY_aO3OI2eW{H#Ud!Vq@3aGa>q&(aZSMbKM~##4Gu26VHrxh_OEt9XC7Ty<?}7
z^QDvWTS&H<oF)%AwmaCJ2B)w~IoU+SVXj*Fc2S@|h4Jf#_cu4IkRLi`cqKgZ<4pNk
zzIp`WpP<vQ7r)#?s2@q-QRz=sSXLrfZJJyCX@FouvR;36xd}&3VcICI*IJgh{qDfA
z%5Og1A*`$6@XLFzi9%ax$2wBYn1%xfh3gk1J+u2_jDZF};6`aDyeE?t-&mavhfm&D
zCK&NV<HJj%cL!ui7v)X)tXAG)h$U6Qhl>yYnr59Zki`RE&5dBDxnu{OvICMDrN)=T
zwKW0I(-4>D8%6-^QOBaC{KRr)S~jN7x#jppEYI78W*8kQ@W>Dt48F?S0m*`43V#CB
z&uisV)Og##aXk*$uC^vmL^k{s!emAe+@xlGz38>2bp$JJi`$+aZV;k8nk@ontfl#>
zId|0`tU}WamSLZMb(EM-jXSc?j9Sv9hmX|-rUuAjNSz-*dY&F+>@Q-xQ&2ie+A;a;
za8opS2&}V_91zDrhc_Yz3feW~?@#y^tfJ>B=4#8D6u$*D+Wc~imjpEq6ZE#eo)L&<
zzDG?Pru_=*R3Z4MFD6x$I~Rk(w6-$If!RUnX2F)_NU1AG0%6brR~A`cR1jrbn1fSw
z5am~#DKM#Rqy+RON<X3-@|`Y|QALX?>@r4pQR-<tZ=Dl78qJVSq`nnCUIUnWCR0^j
zVS16Olo)ynzYksr+S%+_tjmJOt-Fg#09c&_WEku~#e=eOW7;Ln*$(eSU|D4%r5bf!
zyRrvPy!ZXFc<O+mv8HPvM;Az=F10uDs?IKynu#%6e=nK9D8fpi^bK3}_t80{)|Gc4
zLFEC~T}D}D*rO7}oORvcAcR9AHEsW|Y2NTaq=8Cc$Hc2d+Lv|OCQgZgM|);0_S`{V
z$wMFK=GO+o!1&(sL_(9RV(Eg_=sXTjd`_#>LUoq_Yy(MP{*%L%;IPE5S)vLYxu%Q)
z2b_BF0ucuMQPfK<rrv1|rJ;4|vfoM#c=-abaRLrzMRP5hZ|l~|1w33d$t{=Fi8&Ud
zeS%L|&^)?7V!p2Q^Am2?!3D6LWU=E8r`0y)FD1y@MyY<-Hd?`>52#GmM{<&T!)L7l
z1Z?d)7!xmh+V+N?Xt?Y&2L_7COLBz&7Yh=K1ZXK=3g2K&a*?kc=2GjflWb}}j;(1@
zDY(j=ZMnQTKH7`g;<RZHnbXv~qBo`O>r9jO5E(9K$d+6rh6E!c;Cto$KZun89b-We
z6-A_+SWPD4AGV~A*y()+$4*^VT!YARflpUG)2a=siY1l~%UCkdo7jc-9^bA;{1YnV
zQy-LW-t6w#+}sqrjTMU}hVuBa*It)<Bxi#2;pAwwz5UkISxx<nm9c(zoWbG~yUVj~
zZmHw8=u9Z?V?$KrqI7?nk&oHWfh}k@2HAgIx8`yB3Q8KN`Q}9q6|9UZaw$O5yL`9_
ze<(wv^}?a|?OGs(6Ol){AmL}@>oFpr*;Aw6gxQB?1O!UJm3`S41NL&W0*zpOsHDAu
zMp!#;mFx<NvB)0j*-fJVmCj9a!|2^lySzACT8HUI^|K?=a+vn3A4DrZpY0@N`A;j|
zKT-(JkmfsSnrh1@e!Gq;Rr*fZ{N{hBLz~5+@(~~eOJF<g`#{M8(+!OZaKn17BA>F_
z53)p|ZrGce`41Iu3zGkLSKPc8PUm4obTlU*U!)o7_g@tQdYDxbkSxY98n80U#4sYx
z{<nxI6X&n*=b69KzaDb@mAyel*n9^=OupuVM-T{#_g!B-{%E<9pULFUfmE?y`hB^_
z|H~uL4aHN@!cAU9i0;Y2{`Gfg>Amo^3XtwLwk2fwcLkoxhyo(7cdDwVUWCc3p{H_w
zf5{!MWtXrX{#6HvX0YG2-~at1NV$``CTS363&MSj|1I6h7D@s`gknj+dYtnX3>|r~
z$YUw`<3mEFoW8beC;h(xV(1QfG{1Wt=f&iGnCG2`ok{n5=o9>gUc$tsk}8k=Ogh0K
zyvyh!h?R)Dq~NyTB+|c9$~Qd5pE4QkVzDm62_>uT%(_%F_6q{lak_XBk2v}!()HEC
zCsxybvOBl*G+XFa=>JwJ8D1n3_d{>T*_fp+KiYkkyPL%#2dK1#lN40FE_}zddq2W@
zqSLAv-hAes?Zs$>+5RswFj0}8A15{;DZ)W)&YMLks%8;&E1^Rjd*Bh7*yj+c8pBn+
z#Q86O=luWHS0z0_aoCEniknVdWDxUcaqe5b`H1@+|A6j^Ua9~8qG6NyfIRK6<hr+O
zVo?E)N;wK3t|7lopm@Hrq|HL&a-L<U$pdFoR&U<eL;Iac9YjO&n+&@4ph0(}X=`EW
zs!cVM==idUs!M*G@0gLm<1ej@qTl7X&0w>zilMSXHBVc+c)fp0@=ORvA7#_4Wf6GT
z-0+a2eE(X$Jx^rnKP}Kuk6aRd7(SB$PZSA&B)XqO_;aS@EYNi?pGZh0g)m{V!R(zD
zy2`uuS6C&_)gVM?zel|c7c#moFtp30`A@<(li_A_+?Z8ZU^@f#yEt{R`w&?H;g?<I
zGgpQ!p9u|`;VYlmb|M$?z!-pvp^GLAd%c#&2o$0CPf?&!$otir0H*B3(5#A{=B<vZ
zWt#gEkqX7c*57|R_W7c*==Y@en59I=)ya0!n3NXTxZWYb3D7na2t0>!FF9c5R3w1p
zY|r%f(~}_gQZe<Cmj*VXS}^4#u1`D#N*ODpt{TU^NqL87lyyTw?)kfOR(F06RKFN#
z==N+++Qh2kd8v*Y`|9<(Lp>ys#pRMhZp;ZqAJ@67xKEK3|EF}=s^@iOD~AV=OEs7J
zip22oYaIwpV(|#YGz2tu5~^-N@0gZA!fNe)LUvP?6BN!rh#iFpbU^hWeuP7N(Hj6Q
z$GYxa6l%fUTYp~g*OCdPc}&gep}#p<xfx}5vCHsAm><|$ftfj|jf7#ePxhFPp;ItO
zsNw#LgQz>w*Gev<jS?OQWpzF@rRqi8k_9my%&aTB-*fx-gC8UL@v|FrKcQ+^o*=>2
zPd;n^Ac}djmEk|#{2tnd4qm(nlsPOgIOLmk`r9fzY(&*%@Q`+sLvYi0jFP7zTEV^+
z_pO!1uW!Q84RmTTk8~k_oYGf5)xVb{sO;llQAP<2qZ(++TAwSC?)5d5+71a!zaPz-
z1F^sFSwN@eM>^$)^84`v1J3!|F~?=+_ja1DeIrdgX&x9rJbQX5nPtbZioo)coRIh3
z8*){PC$Dau)<5MNLh(p<a%sB;^U2sFgS94$TVe8#4A#%10W4b@bS%KDl#u`#u4DLY
z_3s4_)G`<iY$Gn2A$NZdk=1~Pa2okZ1!b6Z=v|mb>JIjvP9VSj{cHQ0hYrG&x-;+9
z)bFvHgy8{#OSpa)oWiM(x)4|YyiD$9+~4cTZ>ig3Adsc`F8oFOch!Ou8h{=J2Ee*_
z=v=KKdCQMj;YDx!dYCqb^7YX#!vo|?ei`(cD8Kt^9{L)bBM^;k4#%`Kw7MaT@z1#T
z2z?65gwZAVXZAH<21Civ;OVefN`~?cUW4=DCEfq;DuA>y8<rs)kf>-xzyANK1GoyR
zkw)qsWQEi6_CMP|QVGzrhATPCsv`=gCk=Mk_39fp{!=e#E#gK3#@GlSgy2=i9YCdn
zGi3{H|9pTGsHtg|hL^?=Gd=t%Vvje4WMA8?f+GOLt0YMNXNT4yed-~c^McJ}xD(wo
zJzDK!)!$nq__~4*_^9o22=4C!8pnhG<&iCYyf(s05q_39Pp$9&ZcAze{`|c#mHb-E
z&H{ChJdc?G>~|5L-UVAWCzSM0pZpo}Z9s3__N8s{Zc7b|1N>yamA`XY%v#d(PK(XP
zXlL$(^|RtOakD8)IcC;NxWT52nNB~&K(6JjVu!PI{kBJ4l06h^(UDyQl<6G@^CkRO
z%t7wQ)hEA3>N_pum*7GZ?Cc$O#^y@ub)~9}m*itP+ET1D0Vg^A6lV_lA>IVlRrIwg
ztOI6!`VsxhP37!cv}FMrc}Jo2oj4ccX|T(#W!1%@g7oUO4tsO+GIiHq;zm?G$F1jE
z8)6aNOIA8W6Iv#A7G^A^5^|ho>g+5&re%ixX}L>HB5`jCkBoFr8K$0_B%~tmaBUTu
zJCC@B_ODKMl+`~XQMa5KiZsz1*8T#EhG<s%py+U`kF(43S1c@`{E8qe*PtuxsXH8k
zu$tO5gOl@D&kY~gcOJK;yf3Vs%4C-|KD6{h{ian`>h3fd8$ELdu?BoG#==r@X6Yb8
zo@q|k=bRYfDBIGhsv~e+jHoWP*)l7Oy|`@UUz{$#+%Rdim}rBTr<SJ_)t+@d*lX^=
z?isY+!O>q+3_Ck<p6O;vyg1ItIqR%njGfk0k9O-QvATG<r7_qfn!8)bJ7Qu{Mb}@V
zwq+QuTJosUjU?F-wKfPUZ<ri@EgL8E0L;Onk`H$jZfz3idB@aa%8Mg|JAcge50D?v
zkI-0mW>cYwb>i|?zFTWq95v&LdBveUSYoKg_C<KMFNw<C)^lmhdQrsx;Srk(kNXxy
zmz<J<pV}3-Fx+P*_6cu9MSY*2S?5YM!{(jPKI9-brslYJ6Q7o|0?wRA1?Fsh7~|Qy
z9&=pkBwXy<+iNEO2wqcS?}Df91}}fzQJqPpCmZl)U1!~&`BL0gs_CLCVPj~_S8qk(
z9=&ImU>2t+O`y{v9lN$`+Mki<xE;P=-Aw|+D<~EWyelQ8JzQ8Gz$EPgX~wn;*ic{E
ztQ1ty$lusx)i60bN?5aJq9wkH2!T>Muk!PDjw@~ZO)M_CnSA^VUy#yvHRLEhx<fQ8
z)=BK?#)JWRi@P;4bZ{o_iy<YM$kr40_H13kGXvgmcvityn7s5WmQi17I;+@dsz$bb
zVVRYrLQKSZ%tIngLz?T@a?-T;(*2`%l<;(&pHaf%Ma|D&%!`Xr&yjP%C6-N-F8eHR
z_%<Hkb9ThJUK!Hvb^}`!G`Pwy5!>-rKecJ{%>=!@dEK6bsR5MYAxDvvPL`o(Q%BF_
z6IQiAHjY7H_gdtQMFuALgS_OM=2sIU@XEbQqKE9pqYaN9-6DI_q%P0RRI?DR*U6p(
zwv?v3Lwv4Pc|3H)PkMRtM5K5Uk>59395>e-HxGtOY;0)HE?6=jCA!mAs#H@hcKJII
zYVJj@-H=>4n3Rs|Ys?**)3%6PeQ@bQbZ&Q=xF?y2S;t~cYFpR*$jZLRb1E|;6uQ?k
zGSF40e1WH={eZtdJ7}fm-N3d+KDU_bN||mHGk0!Cdux<3CQ{e4k&7pXrPfDk-=7rQ
zQn_=NN8pa2wz^^05mu`+Cawi#()~Diu_%#p7+Gug4K+RJz_3jpqtdQ=-+6DqqPQ`2
z_wCwfx-WL%;>V-G=7)Jn$J;bnTe2kuBW2LN4zDr&wfi4^dUCniF-0z3pAT}<%tYzt
zMRku=GybZ(nMT^X>=;^y#-%O)5h^eLmgdi5`g=7@VgT!R>KFcYr%qFcMUEEdwEfNT
zevOK)Q1j>CU1)nBlnvnTkC<IVXbz_fk%1gFEnG_J-VP3lLcQfL)bv^+nfAp?u$aML
zwDN3slkW|-Vr!9cxqsu6Ab^pyHJiKYec;^s#>|j)C+C*ky3XNDMM?-B+0B)dtxKki
zDem_3n%6S4XrJ%ip(8<s_6g+N88Fz`DTr#u;$9{???_y1&uH-`eo7!yXK%FC%l+(m
zuOVuuyuo3oikaixHde~EO-J2i&bc}Ti<>A)Xk#9BgO`OmV{f?+$j$BR`T8`@CM`Bg
z(pjdk_FngT4|fq(RT&sZIaG2D=SF@;k+%))7w#c)o9kJul$LKUE?)n6cDy0y9cY+f
zbGE}p8$W)+JFzr)G#d#NDi%i$oLow=SsU}uNTnagcs)ZAlyzS5H(LC;=7uV5<k$5x
zN1iuGSn7Nt*LGDVDm}t1h{Swz>CVxcbO`rdtv&e{@#fFYYNAL=!ea^2Tz#E_)GhM&
zhzWErzkW}p>*gFEF;Pz%v-`RI?li29>{hN%kCR<{%s7m6b*gMjdwW}j?3<!pV~9lT
z)Uc6-{sr$0O5Wz%`9xidlV%sDb2R%!uMMu)SGh}?ljG_IJdRk3OGJSz{zqXNb!a<W
z*t>X$b282SYuh}+2QSsgclo^xGbu55tuwXcF&*5haL>K|zHY#Jm7TNooa~j;12BnR
zZG^|Cdbrsz<vB3J6N0<u^S+wIIQ#zX1>hIYmm&~HH>L0xMKm^U54H>=3la4cRJFMg
zY2KS1%^o{$L_1Bm)HhHS`_QS}@+8Hxe!;Xe`Y2B&xWLTu^4(r(VCAzfS@PBC?4P@z
z=n_eF;wtC8<(lwtW3T?@y|b7s(pvRa?7I}iJ%0nEOMb|;R2s}gyGim?L*w8(Kj9ch
z-}DrhunLL`q^s=w53?lY<N6nl7DUSZ3P}qE((xn{wfd->#$dlH$#AS!Fk>mXN;i#Y
zg^6wV7#R|0XP0Z+_5B))j<ESF-tG=MEPT+?Z@%sN0)F((o-#IUi(o~n)MRMX#aUN-
z#K(p-s&11-_>!gxD<h_ODP~i|72oN&#@5nepra+uFV;&5CBMjY=DlnFabFE*38|92
z#wWih^>}*-u6_*Yh$^iAqa(;mng(O8MjZ&Xecbz$Cea-e$zyoP=V_jWMS0xu=KCz^
zA`>r_<mf#5pm<~f`<9F&@{b(oOCd`6b-ag3Z+FK}I$K2hv^&G-2=>TUzl3$%kX$gc
z|7E|pm-t-AfI6~ER$bBISixW$H*d+FJ-<`<{%m`0nTAPmOkjc43TAy3`PG=2rS<G#
zd`cVUkv}Y{vcqXV?xY?y=&2(o_0OE3>fJc(pP@Q96nvu}!glIXFTcE?8|QOYTG%yy
znG_;g9*0eMnV|j*^-;O2=1y1*4SR5UQrn#HY#JT04<$j4UW1foXBM~p&e(uC_L8V8
zEWM%6{z<v1jv7oT9B+5zgNkIq!;*mvQ*<5Gd{<tzch8XFTX_vM(mWPqrcVg3T(_4>
z6mxS@aPKK&M6vkBH<R~fZm!g!RVn=+D;jyPdy^jt6$3i|{>W7j<5rjwQ(t&&g!K8i
zq$<<K;wEO~edTw)XxRfO5bg0SK|k4NVLlC++)85AY5@i25aLhif?^J01{fh)Byu~r
zM~YEqdXK&iB)zSCq;^!<f7$FNa4El@bQ*r!bM++(q)*_?{b*}dX>@1cb);%;<;go4
zyPz-~OvADlTk5!YN^vt~TA0RjVVh5~UZo5L=JTY+PV^ikI%vynPx(y8uNRqMGx<J7
zg{<XKA`?W^h8^IY9iO2VGCbGFzM}o~RgkPX-LZEVrX>i^PNCtRwyT?W<~WdQMN1r?
zqHZu{_ixFqEWff6&Jj;5&Ph1wGIUCoq{TO?ilrN=+r(fz&Hw;_K0OUXkjf7R-lQDh
zliV&JiZjWQ0V_m-fL7$>l}zwOH{3-QVZRnNCxbImST7ImcoqxCI1MX{qxEFso6;v~
zW58;Cy}uIMbJ*JS3GVIF@aDTiE68v|I((FuaGcOCcJ3wh>Nv}0W6qUy4n113D1jWE
z?OeBZ8CIiH4du8Gb<c^tb3uua^WE&SBio~191OA1RvNvY7|nwC?U6aRIDIm7T$fam
zM1nzr3!5;3VvTx5_x6KkiIAvprA+bNRMDe=ox1(82-nWdsEgN8Ci&=O-IK1CWYR<y
zYykW{A62ow*u&mxF{-9Bmzpk|P3UoFA9`Z<%A0D8Ov$0Lhe7({`;z>WTo2!)z$R43
z3d8ZB^a584-sUFKFq+ZQT?Yvcp&#1P<y~n7t$R3tZ68B5Y0mq8x?uZ8zx9@0bLm|9
z#(E?}&<tzToDPN|iz|thW2DQ#)82WB&o0+aCe4z-;^>QQvi$Q$MH0JOa6PeUL#9!(
zT#k;0+tYMA0=A*hlw$&)36H!xc?ch635wXfw{x+Q8c*SZwRS}d{#rfkhC|}qs4VB5
zRM-Lm*n|7lg!@Bx(*jW;YLB>S%0AZ5^r<uI+i4W<`n@V};q0QG4wB5-GJMBaeKCZx
z7<czMQh&R;pu8T7sx3H#v-V|kiIqtec*{j*N{M6g;|5Y;#3!fSs6tJp^+(m*ITvdM
z7wf(ZPA_OHIWP7~GWS=aOH0UsrYP1%t_N40JMCYpF{s^4s;vb_g5s+o><tQV?MTTF
zte>hL38l#~>B~l_323KuXpkY==ML15LT8`pvEHuGItqC6hQ*g_1qtTki(yxEaNtEp
zb1-z^5;Zm)o^y+i6{hP4*HPanIwak!RVhIg$lSv=%s&0BuN%2>hVDB2a*M1N3r@Xo
zEn|aq3j~2)O1(D}Zpp^*AkWhTx1Ik~FgpA?@I0TpMn_!4MJ8|M35<ZlM#u=8%8}mz
z?Oy!kpwrr<anzdm6i>0TM?Zsg(@!SoSHXwAgo>rhH%xsW!SWh*x2#&_FQZMc_~&}Y
zuy=$NsC-e?3r@H8Lo=aa8`HQOBSTLjzm7}VWDl46*s?n3&wRsX`^JznS#UMNP?5b!
z9~2hZ^?a0KDhDuc<s2{LBBkory!0;K4Cl=zWlp1_(#b#7ygeAfd$zK*_=%7fX+Gb?
zn}l9HA*cB)6!+|NwXK)qc_ZppKxRWk4tV3G8r;>J;_9JsP8L_~dN>hGPi}jzpg?mB
zyAZ_NoC3PF*f=afiPMdFPZqr+avrVd9~KT&5f@v&{an8D_APudWrc4{(jx^MIzACy
ztptl{U+6KI5I%Ft_XtV(5Zd0OoFuE&yuo=f-8USjZ-vLCvZS~BWTMS4Dr2*s0&Dbn
zKKWH_0W?fwyxw3Aan9nK@o|@6I44Ge{fd#h#(#w(ytu^-Ju?lHR>a|D;cX>W0ZPFk
zfWjbR-TY0W^5QsYJYMoxWPn(zlvKu@@BxSVyVr@XV`O)IW_=@*hueh^oj@l)P3&LJ
zWKUF|t2&%Nh*g>iO<CdEy(enmqh_f;F@z&knOi~OYIaWSOR!smXZLERms<pd&AZi^
zNOV8+IHEh7te5(=1;kBapV;KUFkUgqKi%DN8)DsCicL)EceMAtvi5ri{89gely&HG
znq8zrSer9Nr=k6<YukN@PQ~U*<99qNH6h6y--YMB)D8PAc6wPhcBR-|$vI3k@wmDr
zS84H~lpX@annlYBIc^s|6+;y+PvFHHMf+|M8L^+$S{#EaB=IltS*#*uc}Of$wlszg
zu-)U<*vCiKUIHm|xJd8Sbi&&b_>cqbOW{1T9N|S-+Oqr_o6{rFl|RE?I7Vm<e@6Pq
z^-~7zJTnsPnUNgMwNzgr@TL<p^krQyNpPNyo6k2y{ctBNhK_)IFO`TZcECPwy8`TM
zr5ZLVx22vE<T^9nfB3$1->S-pUF=B9wLyke-%98_WG&aAgZTdJck(otJp<PblcAb7
z?S4GFuXiL&v~};UIMZ*N`bJ`78}6#=pRrfxZdcklzKLmy<<7f@Rk~c%hI)89@80hm
zry!EFqa(6EeX=PL7a~d~;r9^hz@g2SE4JP5D9tcFh1SWaJ@m9+^@>n8;W+bqak@;0
zX%2DGO{HL$*B(!^R%~}4?MN8ZTe%g;ybdl8sL>zXsxOhBOU}7)aa#}<*1{h%U7zRF
zFTMHd`&%_T*PX+$J#T!Rb-^<yO>nifmS5}MuWkNL-Qlwpu`{v|x%3rJ>4Y&dOMJ^j
z4sC#m{TZ=$wP)a?q`ia4itX1Z2AL)x4TM7f?x46nrUQp=uSO}zyK}&<A-s*9^NetB
zBf4HAbon`b%$*^>nXfH0uf8vQx=U1|P*Ek9?tEgxJ=)Ne$Z${6Wq4B}dagX@p5%Ig
zNIAiS?h*ds`O0TOcR}=vLsFu3IrzeQVPH;!>tQN?O|CRWkM}CLT5ufNIzxBQCiivW
zPL`(iI)tg7D{?hYh0@aEk+Q&<G&Ar>pM=!5p_Snl>WCHJmLGTFy(%gEh;^()xrOi8
zH$Tf3k;RymySysuH^ypUE~ASCvx#7(_qeP+m<>_>!~^{}Gum_ehEhBhp7KpAJvDZx
zV(WS~3`%ZB)7yk=j$!^{<m*nOxaQ&!{T*at31Taz2^&jrHwqKOvy%_`355m9srly?
zis>)nuX^#UJ325mo>hLT>Z=Zn-Yy?=?L89K319!&g~JxL4xC+-HSa-ATu738RF++V
zcRywt&$S>z2P8GadQlV4nFiJ!cI-F(kW7rR2^=ZO$3S8X&#~B$jdYCrYQt=Pm$8FA
z^E0Y|-_o<2q$3fo-RCog)+1|}Q?5nLVw@WZvgV3J6w@<O->O``VdY99b&)6u_FA7T
zc$5Z|NA7)Avqgq~Nzsq#+IV04oW0?WG@tD^jF}ym=BK@a%5#1rj8lcPz0|}o_Kx8w
zh^@XZEtYWvH3}bUdyYqaZZ9#UUNYKjm@|*`UBT>hKn$dHdD3q9{_5vXxPuilOVNt!
zsG3Eua+iOetvxcK(=q2}FII+kl>AH#>^^OAF}OwAF>5J@Lyp4X=S+sfa{I-!W1e5b
zV9cpgG-p{#!&C>+$rh@d8Yk^kc!{q0Ni)xhtPs=2a><WaZTM?pSZ-zydt}d@+OP~#
z;kmuzh<cqN6f}Q<q_%}Kbft<rcIbx2H=YY!Lk0&q5xXB{aIr7XGf0;Rr7Uz78mei`
zYnER~%u%F=V`9$tq(mp0ZX!voP;_2su2!)7t9;7o1dUwfsL0I4uNum5C1U2piEk<C
zp-r%!qHd#Cjjx*s@J!y*b%20FZcfcgqYPxj%ug)pKZJEFiX?G%w2)Qqm7;oxO-8PT
zKDnz`^-!Gln<S-lLQlR5P2XH99x^;IFE}Y8;%yH7$oLOW$~IvY=2z4BEcB}RKRd?g
z)V1X<X>(f#u!r|(%)N086)yeQBR}(eEO832(Rmv+Hq<?D^q38W6T^a>$C!;wl|6(4
zu6@?G)DD4B@ew`edI+8nG&4YA;uLXY+J{x+@Pr~QthM`N*@pX9fl@ubN5O||2NFB_
zZ+A__%L&FN8ug=V846TFBoahtW(Io}#7;Btz;!mX6GzXoHodugpz_qA;n&1iGLj%m
z*kAIo>6Y(3mfK$ygU91>&e^67`WhtUU(A<2^=~z9(~}`OsOp6zO6TIjsyu4z3(7FG
z%Dxg)H{wV>4#jQZrD8Bp5FX5T-Q=)to2##qCm^T&=)=fAk)(KQl}#F-fMF?bg-(rq
zT)hq{Fg-8#t>-Q2c-6xGKF?c`9I?5B!?>|UibUjhj)zjgalBg9-Md}uo-KXvgVJxN
z9NOreN*8*|2d)DQcQ1C1Si7XI^0s^BVjt9kb#kCu?&+wf#%X9pyZ>UwZDR7e064l~
zvPa2<D<8oim7bV+JpWXSb(OsU4^`sk(0wH)TH7=GW+r#ODW!xLYpOlbs_x47c+`q6
zCV8VIAFs}Tvr7uRLZr4dnO)72rlQPvo>+{XR!QT|2=nSzsrOVY^{m8T{7_rjDj%qp
zs&o$T$bLPrHGv0pd!A5Ztne|{cLTR4Zfqbolu3w|V34zlAgTlJEJFnuZaU+mQhML%
z6I5O%4(mDsMviEIh!=8j{5ph+WJzd1xJ0syhm5@S!R3nd-tgCzH#PU`Yu=SqXxte>
z{aQ7g)i`O)(eCUOFAV9GqH1p@M>XYr=kTJ|c%>O0lc!{4;56<rPrf#_J>0vpc#H7U
zpt=UMU9UIWhz2f25f+_fqyqm;;g1SA&AB38Q=$vmV4yrNt~m(hd_DJh@uVjM-k5(i
zmKLl6X<`_Pqk&r4Y-eNp&3{2JU%dxWbCl?b?1n7!*%x%uItpdPWj!R1Ok;J_$aUI9
zC;KH}m!|pANxS-iEoDa<Bh6LojIx8$$qPEJD6yoKQo;MhS|5I<xlETWkCcT{r)P2F
z@@PE%sk$;hmD*5m>AX3RwYW`4JFYfTqHr2izJGu2Y4bn^_h-~}@nZd>Ve_hBq&ppr
zLN`M$!Wl}_n(+CDWL8pKc_&zDgO5&}m1{iJjEquP>rpaJjfQeu&D>Sf<yli+$f54%
zT&}}ze#fSsjIATv4RAb)#or7+J;`4yDW3^ZN^g7#>-1W&?kY|^H|HxMwwz8TesQT`
z1A;&K2z!Mie-{5%5WckSyKWm9>-a<EF%@VquO*Z6K^F0?;mu~%7v~=n1Jg;~vN*aM
zuFCNIFw6H`J)4HV#i9~UuP<^pyh2K37#6A_-o<;do30%&tCz}pTb$P_r@7P7S@8jv
zYn8^G*Sqa1XZv4%L4ph)#Abq<wL42d4BxSCKNPfha694A-7y;GsPQc37|EWBf-bUw
zZ~~a7uQMuGrrK;Q+<QXG3qsjrcrr^mOM*r)<Aoy`1{y?K;IUdywirxewwAg#V;Hiy
z6HT<`W|xb$xVp)K_d5Fk%bs5jMk%A)<$$S4vw+2!ipR=xT1YeOrdMf61#ZCn1vz7;
z%X+qf8*3E*fr*Ne9KM>F=)k9Q2wx)Q_{c@2jk+(j?v@%`&H1?Uz+}+^Uxl^9v$Em~
zg8M+LGf7C|HKDEabJm~ajLp=-ozKX*b2z@p&*KDK0Dk13xVM$rEfSN4i8xBm>f!z$
zIij~lD6n{kNe0gxiZ2)9Fg}T`eEP1(>U73-#Xybk$&%J)E0d?_KFsYJjn9@vnwb;X
zIov;13D<F%JfB5YmL^$x<+zadRN9ku<GHkJWHwJ4dDPA5cE{zZw#8I#5#tfZsv2i8
z3tS5-5^w`6&&4SkGeJpvLYX|@@M_=qM#h<lSrUyb!FmVQyvj@2!Bx2=UngJDr+E4q
z9D2JyWNX>j%vh`aA~@&+YfUreU+{>Bfi_k{5rSjPM_Cr2cnIIxTljq1PhXhlEFS$y
z`sScxOu~S4a|hOPC8_PA`@&<p0g1V;*jJYaTJn#YMde(g2kcgKaLm+y{lccF86Qbm
z3Ok%b3hbwr8cegx{&`<p^5NN+ZV8!<+P4zcE$05*Xx#A<28d&DZOSX*PShFOw4saP
zvK(;3sjfkBnWhw9EOr<)r7Hc5@2&IaRSl7(tVg`N*Y;H`TClG^FA2E(z~|)gslQaW
zSiF!r8yISkM+AQ{Vueo+>V;6IgFGdTC71DhIu@!2*VCkiCf)VHbpERZgGjBCO7+?5
zvg|KeFtYV_$qhBOvIKJ&X7iY-tt>u&P~t}VeLJ-ZF)h8f)grES;4+&;^(X^R0HXfE
zvKJ%(km)j!K;?tLRYSpoC|)#{3HkfafTMu}LRQrqmVbfb{s0TLEWKNL4bP{30BZ34
zT`Jb^5G<1de7+PJK5-3C9efTxq1N2h^(XsZ1>TY^5qy3<Yk|1<8&BPv>-TvZss^56
z)c5Y@waM-UCVTk1Iayo8TNV%>f1)05@DKCp061^KE-Z8t(7~6WwFpsh0X)p-S~*n!
zX8SS!Pqit8zyng@{_WR#Vjf`*Eh0nyyKy{bpFaIfQAjr$NKY3FqfD1g5l$EIyhFpE
zoz?y3TG7#|u|a9m`sD`ytW5w5Cg4K4)_|@E=$b@5!r(V_9fW|c=UNu}{^|fwSbPL@
zJ=e0-_ZzxK_(jW^vaMc+t^+~c*k5WO`sjv7GU@hOK|Or2D;Co;JyXrQ{aQ;aAY8|7
zQ9?<6x12Eo^3I!G)W25TQeX|09tpK3{M}oi?@%Ca*cpI*QtT)H=Bpg)wSp62{>3aY
zR~_P7Y}xq3p?P#~`RYArkTgk4<I%5Q)aBIGW3;s<EY_0XlNkSW*bOAb-;^4l(|v;j
z?ofTsPmTYl`}a|nuWnqV`U|8`?SBuLiM*8GL%vqP1t=hIz%A!mVi+{5!e32n2mJmc
zI$6@yt$CWc+i>AP0!8@jeDTv>2aG?wo<Anw;vNXv50Fx_Aatw1QIGz1-QeTjB|;T^
zeY(G*KVD)a6&C^>NEO3O!GpN@g(2fJwjY~$n8TQ_6#zZc62UhKz-MjgOyHfcSsnDv
zl46_Ytw4xc!MI2=f&oP$T5}BGZg6@C6GQGnn)`$YuaVjS*#uBYLY%9S;efH*VY5Ek
zM_09+JVXXH|I_NmNSIVoHXa_OR$)8_<lPS7n#2HH!+rE=>lO?D({Gti{^^Aq$fSse
z#W213fN4nHzs#5|fFAvbh^rzI+^+0XA19I!qWR~c&yY^@d*V0;fRn@6g{Z0QI|pA@
ztt6xIk}Q8-Ol-sCWJ#NPFXH&@YePPq8NoqHmyFR_?2MTcgsT?o$KbQ-<26$RzfRdZ
zZFajnKhc{^<>5lqyr1G{?Hlq2(E!<+LUyz9=tz3?D&6>~qX3;A!3>TS-&*Rq@-zt#
z_%+-#oDA`N@|Mnc?h#*Rpw=u85k<(Mt4L5FfXHIKLH*^<pXt{B?58(23L}P&TB-4Z
z8+o^AI1u~X8D@XpO`X`2lM%QX)jc3D|GT1p2pm>afUp&a9OHg@(&`JrFeD!~q_q@2
z0~)hgFs7Wz_I@ufe(~>d6-y#;195d+a`Ec}ow^+?2osfi@TM3K4bt7N_xdLcFxrK6
z0&3op_aBqE(^<AiTkK9OH<FGD8hu63T$48Mk)zOHXuKU?ZS`j!KTXVB3XmqDr>)Yq
zmu`*!Jvsgi#HTX0hyf%T9`baq8E-=*$Q%0dfsW)5_bpDu3>c)i=}W8idWSR+G5nU}
z4)s2<+K$Oh68<xJk|^(mr$WilLAAa+d};A#aZ|_qO8sYjF^+tXYji$*pN;Df(A%7t
zMcDi{M@%2m5dHJ@8%S)g5DX}OTbjB9V%B>QwgFkNN`a-u41N21z~+JwE})Z{?W?(H
zxBelE{k4RMhajeq<xNVrT;XjU7!CV9Tf_=0(~Vq1J%=xNn=oFYYIEQZ{q8Sn6O;xM
zkhxlJNmDhYa&PSw{zZNxN5_5bLLb&m6~DJKc5TE#lLqgFmq0On0-1oKhxzxoA`cdG
zX|u_LBu1)T8#~YjCx3NWGHM}o3bhS6LD=sW#=3peD<;|S&hu-GVVPIR;z~)rd(f}G
zn7@A03XL$K!899(DTmkkSCLG{0&t{x*|V<q)Suk|G|UdjaM2``B~f1c%HKbR(|{$J
z#mwRVvG>+dRc&w7@RbGyq!A>P?(RlFi9>gHibyvIh)TCK2kAyiLPC&`lJ1i3?ta&~
z@w<BO9pCrY``<eT!*TT9v)OB}wby!{`8;z@(w}DN&zT1M!7qJ2fBo|x4~JF-oD61@
zdxG3Qzt4Ye{B2LbM(j4}pY+rA{ntmu9B@Q-RnEIV|9i#%uaztq)}6FpiOBWS+4fi8
zSh^hSn6&zOIR4ko|8+?)Qe0Te+Je<x>tEGFfB!#36JgC}LvL2g{^Rk`l7exx4dD;}
zhvbAGI~6$Ia?txsexAF(UW8wJ(SEuY@X<^LJODZ3w2r?I@&Da)x*I4I<0|MV;{3-0
z=z@6^C2|W!{M5bo|0eRU_woPUMB-OU-bZ**3W6Xlom_gW3VbQJ|C*gNAc49KSK4rr
zGy(MVbS>6^9?%0}ubKhwPQVZ%J_IrvwXz^AD1-4sVxoaY$N#4N@7HGul(E_~g3&l1
zy8@O{lIKqC)6YN&D+e1}{?}FX`*#%~V1eQr>ZW52!6c@hmv>Uf?LF>S6>mZPk2@>?
z4gBqJa@dx2uDdVZ+<Rc0#AWl|pU{sQ5gGYEZUy%h7*JpWW&gWvpp{^Pgz+%JpD$UI
z!(r(ejE<Su9Dtm>+j#jM1PYx+^#@%mOEC)EdUa0Hbh7JSg2_N(YWf}t|M2oPptkDW
zO9A2w9We3s91x+HU!Co*jOy5N1$!O>^^`<F0ZIT0E$jo`Pk9pA&4OzIpSc&1C#|UE
zQ`QDc>oy8jUgOBK7VA{Y=fA}O@rT)qx^-$moZL;oqL4~B*`6W}Qtf!?7`i@IY9MoA
z*#Nq8Jq`ikDgmY{-?pO#WL0{A;KI@Ym-R3$6;#CSXy9ot5b@Y0yap6%^9i$fE|`?Y
z<-XOz6inAcC`6(H#D>ZG4IYVKF$8*wfH2*D)=o`9A5;_NKWtR0B)^nAQ$0BW6kKam
zn$rp(Q-Pc+;OcS-N#;g}ag}g|b?h3P6Gnrn=*H53pkF!=I+%Ah$oa&i^XZ<x@AYx)
zk$NTS&<^0B`{{|%3!b<G9r5cQK;8tU&UsUPJ!x<b=<3s%ZNR!(#l}kX7_v1I)tyj_
zzC}f^g2(~`-@t3X^{B1`2(F|?3v1gk0CMRRpj!KbxF%~Uncvy^<B+@nRgT6?tIKS?
zJDqz`KlT>TZVhr*tyYoeqoQiSD7d(aL;Hd7uRS~cJ!*n>qk+;aGkyOS(0lhg-a|pW
zgGzb0+K0IbIwj75rcR4s2xIv(a;(LY&pT)?)Ak*TZdyP#!yoAWQ!p~nJ3UL+1o{L1
z9N&2<B5MYKzQadBR4kVQwU09{Q;0OFPRfQ2sx3Al%ypKA4T>%7RKZ8vQ)7B|;~$L-
z;YpE4@6xUT9hQU+kJc=~A^O51Y<+>F{wD!XN!=-VuaAb{KS!&%-2@WoqwHdp!g$a-
zgJcfh9*GsI7q<x78(GYGpQ4vaqg0Rz%U=ZrOOM9T)<?LU0LCV3#740Ncx2uWF<Fd-
zfP$1!npc`gPtPCDLqET9>EU2!*4%@M9F_rN`Zq0KfM5tIw*tQ(OalMz&{V#-k;nEp
zoydF@Ot-uqACI3hRAL**&!8PXdlzYmTLt61)!&S07zD-x%Y(DMt8}q|mcz-YR|}Hp
z25I$>t6G@w8r3yWW5w4O*vQLlu^I4?Weh^oJfM$G&thMOaC%=j#oK|9^@CdlkpDvh
zfu*ZvTEZFsySQqYxQigmzV*r0#Eo*g#fkf<rb*bIml{;0=i7gb1_PXznrFZzEsP2W
z4Gn16yks?MK^T);2XcbAH#D<p8oKt9wA9~hT6I*{-1gfDuC1zJugX_JA<q-J+MEC&
zG{{{4VzKG<m~B0=Ya{5hZU*8$q-kT}VJtW+Wo2g5RUm^5oaM)s&ma|cT<JlDxiR`k
zMUaxbkISExsayzVcyk&gzj@%5;U7L|qpgz6ZL3S_{=hwkAcDXM2($C~@=w2Lx<2s>
z+r)WRbO9Fm^m&1>uO^|uzcwpBeoE0u!@}Pr0uZL?<e7gI19-mvK*q!*#d2&spIge$
zx&jgPlX&>uqf4+YCBRIMe|%P-etE}9?K^nrhA`6FcG4YqB*IO)#gk%DlcKZ5lj8`y
zhoPw}OX1tGR4|K)H)EB*+XaxfPii!%Hi_I`4I$!w@_$>F5y<!B6}%H4CqrnB*W`wN
zU2ac%6Do8fSg9S2tX;l>-9;u&%ko2D%asp}N<*BK-#a`(P4is$L_kL!-`*sf8Vkc~
z?E!+ut7o*Y$~F$c#`u5%rS``+AlB=!?mA&ca0t{KYrWYj;i9J$P8Ayape2GZce;N(
z2kQ{g1}sZqva7iBmCs~7<3PFzuvTEKq~1g$e!#<j8&--POu^E0RbC4?reEXYD>DX@
zY)T%?cE~%j$LqNymJPYKIPR065{zE9rGBS$TB7Lp+G|E`mq!eqW8WY5sI5`UbW%F5
zQV9r6?TU;3<bJp!pErP}qMh2QljFhA3j~r3fqaul{1wo#U|mhq8Ni20ZI!XPhoaYS
zg%nhdY$(OhD7dWJK2M2kXeDORRO_nzApsjuee#Q@sZc^L{u#4>4Na63;ko9$P2K)>
zMk5XWotcWyFn*GItnzJnY`rLj(MlZ895*0fDp;j<v+%Pl^A3rD;kpaoUOCdVeCvLq
zPj|4;uRL6yC+Y}v#OutU&a+5M&a#H3Kxo(;h+uKoxd7dzjp#$hd^*4Ok`q(FLgjKL
zW71<{NpQ+pZnC{U7u&7<SeKNcPx!Lv9PpJ>pN3$M8#cGgt2uNBZt^CJnwX5$tZHbZ
zY9HhcI7}WOlsCsZPojz^zo^T{`LgB2SOHW^K4&*)!u7t_d9hw^8>`=KKJ}w}5@Ivr
zedE@Q!fF5b7r_cJxwL|QF58nyOgs}PA965qHPkLg6@*TWUv_D&eui$^HBg+b4fO>C
z#ZYT#7w}DmMH}}^9KsG*BSzdQysy`5>{A1xU%)%*!|C~QF^uPp`xb8Qo_3BVGf*Ez
zKcp>@nP#rvYuT$yU07nCq7ycHrQg<@$YrB0sPnx8ZO5};3_0+0kIhC^G{<A}0=OvP
zuXqApwG;h2B)C~1v@~72CPE_M;^bcG5X&Qg$H-{0_oMm7sYXpV1)RQ<*R<h~M^KS^
z)PKFLii&VVO;%eaZ1wF2KDwoBK72ZzNT}h#9M;1dn%sU;eva{)#zBgVdygTi=}I59
zQ|$nLk^Q57G=Q>4Ck8Hz@MwLAre4G8n6B@sm@m*-g7^|zX2YPI&rrZhW)Un+T|-kC
zC8h;?uq90Mf3M!9l0U}c!$`_=Mp9Ryy2r7{)H0nMfXkk4*8RR@R>^N==kqQGRPr=5
zN!{t-v}~4VJ{#;b2~i~fjH2>z;E0AO2FG6&JBv3Z@mz0(uzYRzyxu-7(9%Ajm){o$
zHQIGW#%DnB*eP|d4*fgvJ)qz8aVXQj=Cl`xJCNa%;PEdM@-8omW%^fHN0&nD0l4w(
zw<y+3ysXJjw#1w^ql|9LaT>Zpjkh<KtPNoti><`Pv!(&3NZg_hZjf2V*^J{)_SXIa
zJ2e!MJR#_&567*fjncp|+G~OOT=B<Vy+i`+SR~}KR^0<y=Cx`GUa3?s*KgR_)<z2B
zyJ@gG+gt2U2dq^=z~iYot7VajH=A3~M`mvN2c_qK_#B{&hQ4Y)(a#!4XnI&oiI^0^
z+%(Ch>nvp96<~3gzQ4YOrtpE5T<p<?*dcg+NMS@=GPOIB$f%EfMCi380>eSGUV)91
zyS4A!+Gu+|DohjZR<rqwAN<#RC7IO*Ew8jT0)y!wLE$Hrv+HRS?a`=>=PSg}HYPDr
zJUg!m9|oiLT})zb#vU3rsf_3*{5k8o*!O4=+Tct}iueB4)DXkX#z>jmI8*}YrT#Q@
zB_FTL0nc))e8Nx9g&+5B25>t)05LdX(u+k&1b6Q(Fn&LDed4rDAcv;8o!1{Fovvk-
z9S0~EG(g?BDW@3S>mjWRL{(I223OV`oVo*9FXoVtF<=L)C@EXxjmron!P|BPm4ieu
zC3hkNU^42K02=JhE!LZ$|H#07zBI2c-Zk))ELE9?*on_=r*_pJX#I)Q?*d6a+?9cF
zbp40pX3g-#a=daT@Z18JWV^O8(aof)$LEXZeE&=j{U&LCm<+~d5<ohO7o2tjB9e^e
zFnB)i)TC<J9IF+-SM)M(Q0W1oRVbcG=y6*95SlfrZE=d}VijR=WNhzN<>N!3;Fbua
zml8|#J`*vpt93<J2FIX3dtMp(NxiuIv3j=P08YUW@KLhd!eumRaLkBj-?5o+oXG@H
zY!28p9t>TCsCoN9BbfdfBMuAuMTlIs2=4bBnz!M3B*LFgWS%f6zI9~;RJjF)5_?%|
z=;$r)P}vig<_{PXqf<J-Y5w@c$o&su+h1us*!A+b;9{s1*aAvwn=RM3E9BP=Y)+Zp
z5XYs6!Z^8HOx?QNdk;-=hj8J)mKVaqK_<BPFn@xKVfk>nI!X^zWG=;LC$PN)?KzU3
z+l%7q3e6YFfa#cTVen&I&u75Bt>xp^hM%a43*<ZeKaNsx3(NdFpkh(QtnT~5sgo)`
z0UQ+FLXqg$&td8u7l$tee<C#fQBxR(fhGKH(97QLst*n{5;Ff>pRYvMv1!NbMMycb
zr!4aM{`mw&(`NxMiY|(pY3vPs)XImXe;n=rh_uG~<NG5U+@}9r9I#<W0`LS)x&o=2
z9x&s@vT*+m6VMXDMh4_SE$hhf{sTq<z=XtwD4@9qabk}A)W7rR{HTVA{=sKguYSbw
zuL1l97YIZApCxf=s)I|QKhFN!u=9T~#lZbP#vnO_n2+)wmq6j98bt1@`XH0#o=5$!
z|DLXm(B(WGfefjtLr?rKz=je`g7{!jb2+$#^?f?Yf6OcxNAR0J#z2?E{7mwvz3#7%
zusIM`Bu3`~(o}~)t0e(s>;rO1oSjaaqrFF46GP8|Q0R*$2}Py<Ah360<%QY%vWYhb
zP!G~qSoCqjG|+%Zi)RmD*gn>vchLdbh~Ie^?>Szq=O%+ZR;^C|IStraOkg=J5vQdg
zI0JN^k7Nq}d-i3(?9xA?`;NmkqKM57bKv@2%M^JINM!bc+}70NXw9fSoWurb$3OU8
zZp!BAL;KgYK=396M=?v?b;dcK4<t=tuc?H{e(DDJb7}zDl#6SJ<z%%zz+CKZs>eqD
zN-#qSE1<Zt!9>~kKt4iWm0H4(x|N@s#xAg3sgljv<^<;lID`Q|a|nOWnM9ev%{qKg
zMX<8Y_y82atU%Di$5Xr>t0K<^bmiO^VvxiPNA*2z4?Ag~2@vjy)_RaJ2dxJ$Q^G;Y
zDiMx<+7N#K=%<T1+*%_t<~e4?&%hrWo9Zxn?&pJM1z7iJ&nXbNOXOHzOxJ`;8n{fD
zG1~%&9iF&?8dxk0B7g|Y3J6s2AaK{b{5YoXi3ku1RCR5uY}T+jcMuKw18r6|O`w_)
zAc?O<`B5d`A2{UEoPkP{SG3F&ok|V@n7$W=x%!B(<g~xman%sWy4(duQY(gld`!0v
zBu(rz;sH=lTL<h5`bi3XT&L}y%4n0wC37>?tYw7g>H*ib52EL)w?I&=T6t1e9u^a<
z%{4U@Lc_dq7#ofTOJ++OFRYm-R0f|{ji{IGfLvY@<YTXY0Mr8ocHX3e9k`?s9_bzm
zki$rfrtwf5shbAr-;NIeI2;TY?;`>=Xy=b@_&U5RAW_By`kOz1tfw%FosneSk8cza
z_dHH_NGgF-lP0k93y@{5rTn<>+rqh@>g5I`qUK7Nfxm`)KS+$ypS;EJ!@H~Z`5J^P
z`#K1i!e{B8;lOOK`#9qE=CsKV4^Pim<r0YZ`89(?SBK8vs1@jC5scG0Gy}lpVV*(J
z#}>3^aM%-gfh!M~#+`s<cTv>)Wun=8R9KZ`d?}g*dYUoV%l8wQ4OSs99GH$YVod8I
zof)z?wPbai#hb|@-^Nq+bMvA?FRlSaV!QgX&5x7j9GkW{&-w@YT7z)DF2QtL8NRlc
z*|&uH-r-CLp9I{=_yY&d7t_3gJ43k&dqWB$k};pXH_LFGwkNsdXdZROmlh*!D~TC`
zon5Y$6k-$bFgNxV=yM?eDMR$3r<+50N|~bYmjwyOlc>*ol0VkF>22ed72vK)aE#o7
z%;uTVeQ#=16qsaYw!>k5Hvk^iHeQ%uB3gH^d0#cQqM=Ih%s8o#?{`BZUhn|XS()R3
zATKwCRQ{15ibgNuBfkC!5p~ZgUTM11m}gm=Kz7Rb<NO=qH&))Hwp0#aLCDgbJEb=|
zUF~<|E(Lwcy!ZwNp+^Um2LbzCzl*S@h*WmM9UfrpSOc&K?8D_leM<b+Umb<XDHTzo
zaz3>^P-~=azkU?^cvdXEEUaRyyt_^;s~+uui>2SvkX|A9E2fBGB+nak=7;#_AoD~d
z%ChdKpEo&J>U_akbl8Y-F#2v1)C5xq{JW~Uy^s&Yqj=hYx@zjvFftU`FMBX4Tx1vb
zy&pi}&bg1uj*MiJX2bT8(i2iX`b>i+AHUb+sl*~aUWU0If$*Do9q*c+4xRw}$a{w=
zKu1%)Rnh$*6ojcl(_E-`fdQb4@=2?sl9A}_Gw`yw?g4NRk=xMmBgng6pMC~_pUT0i
z4gpL5yG~#p_Yh_c)(rDY1Cpma;jWh_+cQEyM05KSczb>Jnr^RIBHumk%ZE8Y6b<1h
z2u3OAdbxKeOCKvWDMO=a27vFEKX5o?-#d=tQ5yyne6IuJD2sSOgI4)tHLb>;^`YFS
z6>qL(`YadO5V5IjBiDcIcaUMK>p82%E2J50SSZC<W_#xAx)Z@PJe#l15A|-q>KjYd
zxV;5hgc%e5Ub7*waJ;|nW`o#y;m=eE7D7pZWU#Fx{#am=C9O!_FlVM$?_JIV=Kfb4
zFNhE>#rA;-A5qg5!f(6o<YHfw5m3?HmV<DPqxZ*_g)%n_i$5ia;Ju*IUP}_xj+V;^
zFL4DpEb6^|&ZL}-&005nx>5w@?6ITbn)UMri?CLxF6`pu(JyhiAlnCWT!GZq=c8?R
zIjx@tiP{gTatmepP%3|;pteqWK_w<PwjI4aAp8C9v(>^DouQ(o^$ag*vW~Z8KD<Q{
z2)uUs=~09UoK;%@Ou5(Ko1w3atqM@em9F8VlA3(R5lIm+DPCP>#2uZf@q{=$aSWx8
zmt%e`G0mN}tXllctiOX|N|Rpp`c_DI%y#gM;xZL2CIhV2z<jOV_x{LX%bU6RmXpej
zKyfmNNIIvvQ6B*nZ9jocxWTxUwio22D++uO1Z~hDPrfsRgO`e=L2&ln)cr6ERpwIk
z;D>!1;d4Ni%~fytsgNBu&QwfraYkL&)Z<QYOb}?KEp#negQ3vKM!T~Rp{gl$S2KgZ
zK2?eCynG^fl$jtZ{i&CGs%F#PF3-!Yds9k0awoS&*gl5*2&Obi=DzQC2-gd9{83Pw
z+yP3#CAtu-L+VG8ws}xWF-8BVR`C%Udd@D64o7K%sTE+3<uC-rjrpe2xEt8lhyM$F
z^DRtNO(Lld*Ww72)oZJ)QgaJ}-W=GoXTX0i5Y8j89E8Lu-`7Vs#Jlg-`VK2dBndx*
z6PCa&Y;$Rn!BRaSkcylnd<e_<(rddYc9Uz&Kou3+Jp#WCN4j7Lpvfc{bzE(^^f|9O
zk`^+^>yn5v>pbqrO#QwtC}r3Yn@0{Ap4ssi%IK8?`-uW4k!!*8rI?`V*wxUIr;?c)
zd$Zuc(Q`Mp2dZDl;FN&W+Z~xQ!}S(d&u(<7k*_*Ye~>-(1W=(KaRJHlovc+H20Jv`
zBF7|rbv%YvPo=oas9(msEJscdl~dC8ph^J}dMW#1W<R~GIBUe5vu3zU=v<rI&m7pt
zzC7*sF2A;<O3$Oi2+R3kxt!zVzKn=l4VsdFGzSd5k8{FA^zCf}=9=+8)-oe7+MrqG
zl}U;v>Lh;D(7NGRQ5BL|>_D%3WPOf7RPRyb1@~J;_2mydf^@*0!%Q$v?x3<Msnkx{
zR_n>I8vEKck?_7WOpu(F;D=UPYbDSc<?`=Jirc6BYB*kg{~P5XZUArQMtq^@kSL}d
zvO1LsR~cztYOwK^>RppuFT%}7kpy=IY&$?@grVJ|KLM0-a+M!&ONEw+sfOu2o*G}S
zV$h37`{*B4rcbjIn`&<Sd<(+_xu+e;mJ5VeF<NGEYN6m?i`<O1l*ikVUU8|Xv$<SI
zR}z|Nu(7)&nwkiig{Hd1I`p<<vVncFLBJxnrsj$c)fjBY_9hx!!Ko0T%4XAEZJT1V
z=l69^Ll>+TqX~(>jgBWUuYiDzjoYoX3@)rJjVnKK=;1`ZPCJq$_h>--L#KYRIAyH}
zY)3Gc#K5Wx2q59>_f<2GW_}&llxUZ?XLpe-{wUZ)5zcKMB~VGqX$}tVllYcmy*r&%
zLC5KA++WHC3{Yl)i%nEnnu^qE6{*7fHOQRc#|(yP>b2}x523eL9piNJQjF1Z-um7K
z=DD;FHXkgWsA(K?9Mc@5Gh`4lpga%|>KiBTlj_Um{sb3hk}c<=omQr@9I6L5Gj2Fk
zlA?RldD`$T`}yF{F#T_Eoe1B-=3`<Kouga15IS&f{4t5}l;EqQS#bbpFe*<{99-Hr
z5<}G1=1aEHGIpO{qp7R3=f))3y%WVO1*yB#-ftd(0DVUY?F;Rwr_QAtxHN63O2XHc
z&QS3LgZJ9q{4{MJ%8a8v8`#R(cU3cUEsLpG&eAJ5AB#mVdh-xq5<!SnF1uwrJ?B9i
zjldp*s-(#y$;-C}_Kf^(oxye`MWDY&BF22C58S;rE9zf~#~*QSC_+XWXWIhbB7-i@
zqK|<Kn_c39sm@bbBhRwOR&B|a@T87CY|OTt{rM#pIF?tqkvlV=-v-QE)~=u6DQY-}
zl%gyRtupk}{#K+;uRH;aBww*G?-nmCo{fCOb)@dJmQBx>*Rz&M?~FfP8_0xbax77c
zkKO|2%_x^UKq<3@vKECCjlbwb1A24<&bqhDk{W>rV^t7rOHib8j#p6G&S(zKJg-EH
zHy)RWPXl9k_r6>Bmqaa+><%hN8};`!X+U$d>C^60Q$b&jFVy$kt{N)Q%xW$_)qHoC
zdIEt6y}SX%36y529EM~dL~BxzZVLuzYCE>j_6eSwx~%r5hw?olmRXp8b^nHd{Sf_=
zt|^dIwc>fk>cdoORVxMCI?IL(bls&3iLK(uL_U_T6LOB^%R*2&jpHzPbJIM!*wjQV
z5Cy`MjXTbK@bpe5?{aRGN{fdO((!&gka0T7VfS)(;ZG7Fd4ZSQ&O$*NCYE^sYz}@L
z(C^trpPS8W57+HEH10}j{`M=3DcV4xsIqutj2wvE>yJP9W$5lbo03{{!^McK%2dI-
z7ss2cNU##0bNBtHIHow3u_v$KF<zceRa)U#cFyNnwNWs+7V%4zk^ood`B&$l5`~_N
zG2zDWqKZZ&Ve|y-)?xVT>Rtz9b0EZtwc$Sl02^Eok4yy!_j2wnag8j4!jeNv1Y8p}
zQ|&_*Me&F(ZBTC0-O~;d$Bt@MFJwHgV{E!Q*e|k*I7G)zvD33wPVanMofBO3d}6R{
z3PkKGIki?nw!{|gdNHCrK&m_vc+0g;w=<#vy7*p_1W8lIdv(?dHtQCf#rCkfbMVEy
zIsDy}Ujz@nQ8bI+Wy1Zm2+Dq>D?{O7flDR%jWU}Mv2a^mYMwZm<0t~i@PRu^#`(nW
zoqPZ5;MgDl={dGlU()kDP;%owiX0GCwl|<0mC#Tqzheg<#AV+tnLhBFHUp>o2XXO;
z9M%cZl6gM#mQ3S!5(LCoT=gYZ62XV_-2lkcs3ALTR3f=NT3;-&`E9P+Zte@x7f62H
zd+n3QVfCCx^{^0-H{pGJAi6|KG|h}3dh|n#9W@cAjxFS);Hb=ePX1DF;xisSHo8?n
z1v@B~g`jbId<4gQNP9;hRui7OW;4_LcKqA1T9_zoU^0Q_aLxut<24@HHw8(R#;ok+
z>%rx^66lMWy1=1%d@WNfnlI~DAQz8!PzbUI$>um27rJ8EtBlhMu@2>fHFA*hC_hU1
zH5A-H_e*+sO29!WXlY!WnVrb>EtcRNS-N%MIx)!go)H^R5co+|50a~^Jjr+*f^av8
zCNY2&_b)Ag)roUoX_cs@wjbT6&e4`xXB23vTYa4Yk6sW>dqzpDFGb<-v@s9h(zCpw
zO_g}WRFT4bB3*yaw}`w8O>=XTGJ-rv0%leE669%bSC{X^hMe=$rQ1fkvx$-N+jr+O
zb20Vjg`e-KlLnFa1gEZk1|_>3w?a205G0+^>@rrBUL^KagF<B8$=-UVPTL-=suTc{
zAznEaHcMbuZ-2cFD$I_n$MTdDK+ttbg2b0)Ic^Uo_)0_Nx(b%aAbvaIFF;v(7HVvv
z=vVeB7u>|}MW?|!KAN)3Q_a?OrtVNE=nT+dp73aXEz4s;-y_e#1~SV`9SpuH<(UD8
zO3q3=_i3Rbjes&zj)Cs^Mv??#fdtoX*UiL26K?V%PzMh!)8}aSm{-lsvtDJ&sgoe1
zHkftcVli2Sdr)Oo=aX33^C|U{IjB><C_1w&5+y8_S!mRo=wuow_S7mR8Dqi5$>FmC
zhxmxv^_0A)OiaPSdO;&Woa~Q#zifbtT>zy@v<0WlPSr38oE2!F<Fo?)Xukw}uYmLy
zz?uqHo*5(pJ;fu58aTf$7{tRd|BtH?{fT*59Vu9&`q6`L<zq8r|B7r$!n#}E5mBh9
z0pN?BZJr2W0bFZAg7;UPP$uwC@GFi~M(B|uA{@*~><)CBeX70WhiYI7<?mf=|9fA_
z6|2EjHs1SwcV!uS)Ais!>c25JDmj>Bq8sQ@&duKVH)?eu1;Z4zEB}8a7v1_*3#TIg
z=(Ya!Kop1dXHoVNF&2VLAVn$v)S~?d@G6>a`KN4T#=5`ie{^cW_MCP2<w-@VK|$4@
zcocuuPZgQ|#6-1c-t_!y0HAveW|8#BYSd5*T!QOeY{tKzf#j1vo&hd|AnWmeTmrPF
zJtL$2|HgHFJKg(JT)vCqAo$fj|G}37jC)3`o&Hk>QxIXL4{9ebaw<NQE(XuB*5VkF
zYh0xm1L_{kjSEB^wv$ed+P8~x9T?j-cd)8|-Ew|^y6M~~a!G=1_v%)VhD!8w97pM{
zZ5H24I!1s??0D}facoV^n~#xHbJ!F&S`WPX&q1k1eCdFC8>P9exK}KoHT3vhZYedi
z$S}HsPD&`|O_$)o5{G$y31Do7^H#RLRQaP@_t%>l#HyM9B+#2TVA7lRdCO8=C)=*h
z^!UIFT*4Yrq!*PX$zy`Xo%WX<0#+G)0ypcK^DvhuzgAW`eP5r`<5e;D-0<_dd5_7q
zUzX1wOPN*-&aVEj(fz!NN4K|oz*7oSKN>EK{^sbAB@t8jM)h-RrakW2zsg_aiXI5{
ztD)A7e~C>Vk!JkH#jNEg)klhFg&SjD<>TF3F6+v%O`w%PRdctWkM^f#=)abiC7ia5
zXV<PuZy$wJQeV?mS6j+}P?uK9z+pTv)I;uf%GH?lnqq1wHo5of1_4{%euIzF6F78U
zlq*djB8FEh0_OCMALX#u;S8qvR*k*+#nA(56gc0Ye-&gvOe`r58cdKtyA`*25VM}#
zZrV(@e!_mQvK<1^t?17U<o|nOqWQ2bsR}={@jn*vumI>aJ1&uSC;#VkfH{?cb?WC=
z5gz|z1Npri11oIgyF$9)e-ah=D`r=;20M&Qaa$hCFI(szp!9J#xN3uqGAYV`JQ-yQ
zP;9VflJfrd`*=Uk6}E5b#T<zK$3S9<z>c77!?y7&5b+0a-2l7lZc;4rule2|Z_O}F
ztWP^c$>2Ypzy^t5If3QP#U=}f@68oG*K+_uLqJo052y;7&w?T~uqK*HfXCoXmobYZ
z1f>#I&__2^>u50q#2Ll$b@s|ZdhP89km>{wQX~RJZO+vL8u=8<ByL-4AaWh=n3nbW
z`tp<q^x*S=$hJTWIBdj3$1c?Zg!YRr=pX||HhFIwfHzk!z=Vxm0DM-lS@IdbV4R47
zX3j^`1dqPlzXQ|<<oT9yVH*dmi7$J&B%ukIFUe;Kvi{uzn2wJc+aT(AHvcvmcEZYh
zgZVZCD3uH_c9baWAy{r8-R>1Soi+i^T@McDZf~k{UZ_Mm96lh7AQhTS0X6U(Kx9~1
zNw(t#J$v6jGox_2XLcuG`B77(MSo6^Pp4b4gFI@&p&Bz(g>^3fzSKRQq;G*DGcfe}
z7D8>Uk}J;zTv_dBQ2<zNdK5h+0&_oe=w<?R(x7`Z8~$H_Lyrl}F0BHDB}74Q+n%4J
zaDsNBWSBA9^d&7z6h4#o()Bw)fTbh^WsJ@(fY6u+;;Dc8tUuEG4jE$R4}$ArcYv`%
zz+>r!m1(2Np*{)9qCz6iX!?hbtEp9z@ec%)`jX>2{$dWLzk@xRm|<>!aMjm>5`8KP
ztSN|!%6>IrAr>E<z&h~@Kudc-guIkPIebuD==9kOxxK=?*MXEXX+@QU0lf59<U~Db
z0R1%Y<r*uJA1R0<@XKLu1a;SOpnT3{4uA?)So@WXzt^Ra%%kHo@>J2xrzPEXkQ{Ec
z8MNb6MXkTP*Yoaz*AjIY%Mv^NB^n$ex#AeS2|^Mar?EIz8*dxkkYQuVr4d|927jD%
zdVY7Xx%E(85y9!-VL>2Z48@4D0~T5{8`S$m>k#0<HFTJ0<8=d4#EDg7`U3M9?LEmn
zef6NXLJA%ckvo>S5iWNJ1a^GL;-HwI(F?@xd*2YhummLrTUg)LAt)%UI{9AX9f5{1
z9?&OM0gJsrH&~dKb$)h_yukL-26l1fbe93JW?favdiCu_80`~S;~K8JOx4qa?slQX
zJl}=J00L|QG&#-roi|Lm0iF)?oqHN`?-b||fZ9ZI^{hwtw`@J?QR3$x#i%gf%zu5G
zOkm(OaI`VfJu;tYk%l_;^jJMovr377$h+}kgW(Y1JvB`|8(PC@b@Bcd)DxgNX6GPJ
zFSZn*SveMcY39HNga?f|)l{bNld3=^$dsxA60C^ym~;3WL4B%(X&AFXE!X#qy%O(9
znJ#eLqCd7kUm|s1!XmhZVIbk=9H1r;aaXsHd^-3zOBkPo(7>USY6Uz+jwf&Ku?3Tr
zeFK)>z^Hnn0UoVo8#08BXY#ZMsDhh<UN`IDj4nd%=fHbm1ef-B8PuhIXU`b%Z%Y7I
zTH?0hv-MnP&(=gmSPsX=gCkON_Tx?P4h&HZ2s!&!jQ~LW`FlMVty2uiL$Di+m3X%n
zfFPpes?qy02^0ZYk{ENZ0isQOya+349!rm?c}otlb0DIQdgkvYrKxQ{7KVY!TA)y<
zvQy}$dvGt7XB6w{!}*PC(EY~G@@Ou;tqKsJ=*|H?=;7l1<fs9QrEF)m;qwGYdsMm(
zyw#6~D$8ol?V@J0O~U!8_l1tG)#Q%qH!zcKXr^G`A@o}=nbfB8jO%E;THNl-#<>bu
zVf{D)v_lM6W#-U@5wf*F9;h~rR7=|uS2@8!>g>Y$3Qsk!^}LR5lV;0cUUc3TF^!2A
zH=9%0x7DgNZHdaH$9KJX8kPrhCK_=-lLFUn!)Y3<M@w(!NJ!gbJ-Zk5AMajdG{w((
zyZ{pny}adz+6A(N{C#GAgYm`S@(a*7e|Ot@AQeE4&Uh@FTMYyAui>^Ls?hzv=mPvg
z$`?J>ij~uGMb5Pmv@yS^lQ@c3iKm?>6KRw2_d^o?-KXF*-Yw(O<~NEVA+Eg`s~^Vz
z>!P7bd-FOAlp;G(f4iXa1g@@eJFrx~?hZ5u`wA@Pl84vgTejfNUEs}qi)@7-a-xhl
zVI*!8uyg*1wfe#bY%^Z=<CDCm3qvB=KZz2}^vgr~KC8OxSwx=h7a#{OxP01|*<9s6
z+K&7XI}~`^Jsf-AHCCX;&>?<_P4->*^7&A<ECI=z6If3)z>TL!WI+^il<8q@#)@h%
zAs3*HPE9$uelvTpO(xtlC-dzy=<iH%%V@-^0v1`rFd#U505rVrAZgyzA;rRs5s9y?
zmZ=l%aL`*?fl*`Q%dJd?{Nv5BzWw9nEMmru3t$~=3wp-aE}FtKd$>qs0?w*NwPoW|
z-2J37-XK|H-_7tAzXY|_5@1L8woloL!AMyp$#lbac9`slsUJ;g_NrQ<W22Pbz&KJ)
zB_mw$;2BL<EsoaBz>m}NZf3{*vRKsstz+34jpGr|nO-#R{gE<C<#z)qe2%&#t&+QW
zaseuB7W>x*aG42oVHfAXB6g!|OvsB^`n9qgxi?QefX6w{Mpc!LZQ?Sy2T$dxKfrvb
zIKfbA1Yk~5J>WH6-^jlqj^N2k5Wyy-WF+yu+Gkd{B0J{trdY7ebVAE07IPQA?w`xO
zzgyH*u;DsBre&)ex0|?oXq+R=!rZu<M{4~PGNJ>}Y3DV@8G-m6olLolTe;iPJg;NN
znJ2rsa<|Y_VD(;NP>XW{t_u+xBI7c}mZQ9X;SzEK1p<UQg%w@ui5nW&GiDc~1urg|
zw7m_C(_6KU73|WI5u{N&lZ5eZ)l+~yXwX79OTgc2IuFJ@MKJbJ%x+>{!48m;q}?X<
z+?ucFqBH~o$^pdatduV#kcoorGCkK=zIBj#7Qy<pr&&VyOAQc?HGI+Cj=Bx058?L;
zrVRop(b0~(bC7OtN^=V;kfw-O0p2pp6u9N9bqp7_li8g38eXVWP?*zgEJE&hgysAq
z&?P%g-2q-nD5hQy$Xoezz9(ERE_iq})(2|11L(6$(vQT%`!bikmj}`fK4F&MNvQ^A
zAFg*r(g*w&6u}J@R3j~4*xaZn2rUnSozR|c_MU>sb)`FqNm6NICZ9GNaMj=uBQB2o
zc$V><I{Ep+!6w-?l`dT9jdjswcZ_7fE4#+?_B=s%?QaaCV)<Mzqw)n&wTZ~BKIUIq
zl7G09hkzxL7nu;%If$Nguudj@I$)5~CT2_fz41n-(68<_d}1rH`xiIQg&>+9P@Ob~
z^;>l4uV&h2tg0JC-zRSty>6`zLJ~gkiq0l>a~CFZqAPxl)F2>JDpom5<*xl~xL<(!
zFo1cx`%rH8RXyL5AB6(BkgV>S@}$#y&|Zf06&qI#xxo?p{&BdaVaXv;I<UrS-_fo+
zxONvRln@(H$ao`xdz=d_?|2_6>D#iW4jp=^_#S0^m_<L<GC*b-EO=4yw&yPA<QR|a
zweD{Dq;AScF6T!zzPc5rR8finZU6X5jcz;HZ)&v#)w5JVZrB^lO;-*YEDbsZ5rdnl
z?>x?)kq>gAFF0yZ3k^9XcwKx*t5V#3E<87HnOb-t6msHzO-3bVFsqM!eC!*8@U+Sg
z;ofbp!s++y%TYHh`A`hLrTeEsYS58ezYC<ihRnG;*)f_qr}A?`-pG`K`M2w&7v?g&
z1E*~C))v-7PR^qZM>B(`qI1f}3_(uT@Tl(C)m5c-DG0K5N-qM>)XyCLrpx(-B5biJ
zX@<Tc*+Kwi6AMF))*wA;p?YwN>G5CQH84b8qa!Hh3H+Snu;ui6FX>v6ThLBOA2idK
zHBlm+#Ot_Tg9@`;?R%%lzUyMe`<nI?AK`y|3C5sn(~hDpd!f$yaurix>*E)XnXDzH
zR1iQLy3X9RaeQogm#bSHaQRVgW=co+;g(@boEfr9W5UbLQmtLTy%anrT@Qf<>W@ul
zZ&$Cwud`?Ls`YtpVy7nkf=!M<-*axtm|sagWcvsAa?){){VFm#QLKYLa$WUtmc!UK
zF1oAUG=|`wsOxt$-ME7_J|{8;YqdIj5u-Mg_)!n(EZweL-z?nwd>`SBT`?JW11&~I
z3o=Q@Yl@H4QA@3!9uFJ?%FWwV@8oeSc)ttL;jP~UKRyoWHp$(89ba^R?fW)}Gv@iW
z$D5%7c7gt1f|2OPoDAD=TxUv_aP%u?iFQ)(5a4E5tgVqp#xU?Rb2)YjcWEO?cyqE;
zypKZbay;50yN$C1LNTdm1Wmf@n#-4UZB1M<&k==OXVA>)+>6QAz8iq(fNs^<P}0;D
zvc0M$F{dHmRua1k4AC6ihoNz!Q)(J|%io`BZBBwyZTGtl3mcSkdV{3DTBYw8L@2LU
zM<SfQV|@SWIH@!@<nB!o$CG?s*FI;r+?`8?e~{X{DzLSwI|AE6F@=s4sZ6b(+}f7=
z8@mbpv3vUDek${IL+RcVXx!cK-rF`8%A3B-|1{8$VJ=xGx?9;*ks))W9GMRp8qq3J
zd%pucx_xz1I&ut5+UP&d+Rk4KR*QQxwD?c_-Td|dWv%o`GgMR!F$uKb^Qeor&7;z!
z{P5WixmnmmmfUZyWD#8m@X;Fn!JmA7$4zYqS}Z3b8jexWAZj8+iCrOEq?o!0PY)f(
z+{w&P0jtKqc*grEq{1gCA}PGsLas}62Gg==RgBZBW)~4@M2J~1FvwWoCf<Fs1nSV{
zL03~pg>D_!e<L}*U*_xQdcIYO6F=+0m30rz>%*uGotL^V^9=V)dVb{fq8~Ep%i}VA
zY9lVrJbZx>wE%PUmsg?&3s5A9iy#b-@~WWSTkMDRU_-L{l7C5qE*Pg#G(wYU96{!!
zWq04et0pWM$EC}_O?XJ2->=={O-<cIzT%@8H@=$&tf}YbxhFLTMaZ(o%A0!gB~LHw
zCdIF1Lsg+Q5J0R(m8jckdru3$X-3eukk;mrQp;X^D&{66ojxFte-e+f+>Ob>I6m;3
z?rB8u{OH$jsVe#nL$gPzDwDd6VO=p+tWX6J#wCGGDBTSAx<E?t_w`1L#EbeJy9R8M
zvAi!yJE^i4qifgi#|iCNZl7<wt$RBwxjC?`U@<L|psu6C(jDuRILWD(T1*3FV3_%w
z>9gTJ<t96S&2AskNK@<c&nabXqib%;D^N+n<<(%Gv>%F%z~bIB8g`ykK<rnITubqV
zYN&+az7-Q=;xeO-Ij3V(t8HRY81h^4DWSu0U>J*~nNrYw`4nQ*?}XL{7j;f2-_2MN
z>L`0^cD6mk{U-RjZ3dA+jdi?cqABCE70D=k2h0U*$3gfZ?xLg_oql+Z5uIUaPKTw3
z?4T2?2$g8b;eO4-#&BTQ1aTi!<%akMC+*}~k(|Wa6O=yfsVwCVE8kNo+%kAO6MLsE
zxzl`s>V?Cc#@<X#z7Q^<ii#}gyt)lk!CY8(N_jCU=6vz=N?158G-sJEEl5tMEkbeY
zfl$ar&}yDxNnOba-(o07%K}&qX(MPNbSl1s5WRjUHbjcBMuYjV!L2i^yV5GAoX3!B
zv7CIe+Del;I{6#oXgc-aG?l)>d<A-%n4s(g>x*yrI?t8p@^h?P0j=gvVKQ2l8#|hC
znrYHT?z)6WDK3q~92^81oe#-W;qdl>JRMX83FHI~<5*K)(qwMF96MsC`ZN|KS7|GO
za_Do`Zq~w}B~h^4+#>;Amm$Q=p_HN@+uyCa-sgNUtB@NqI#_=j=w;zOQ+Pn~UELxs
z@kpq9cs1_nTq3NgpQ>H8&XsvxCvzRLIzbndB$a37sK#|{1GyZkR#TB2xuJL(&Z#cS
z3F`Q%Wi1Mtra9aY4GYM*O1jPUT-LaX^vY%B4cXXjZn@m_!MQr+O#I*GXXNrg07Jf&
z^s+e)X{)w1JwI4<0r>%HHH0raJuw(Hvh#rCl?@ff@`#}v8?rX&FG6}YsnLUmPK2u?
zaYw<7>rwwww^&mv!>iIXG5>dR_O_KWv2a3C$RoA)EOEP~?AdXT)Wmem^eqPrMFS8K
zUDbY*MRz(5sa4+(LgU1C@ai82ltb2gH5+KMhY<^Q<8-Q4B{^y8I_o#<j8^?wmFFiB
zS(kYVv@7r6rs;*luL~<ekOu)8!}H~Rq}i?bjyh{ODNeh*v%Lrrs}wwmg-uKW3g@Uv
zN0np=yo->=2V_0K>T1&&tdJp$ii|QHCH{hLiKo&oA0{h<ofczgBt)rue=7@bAQ}LJ
zvu^@T$Cb{p1s$<0hi`%fvR#h-)uTmC8hUlfdX7lq#tUlL+2acBqI!^_qZQgLR5X;E
z$-^aj0yHOQnsm(eNxtmpD~G?&q}p<U&)bR-Ei-EGKK5hxWu+oY0mScZ#?gw8WNBO|
zy=`#i^d1)@2%~z}Cf$@OHAOw6i6P9ht8I1hHaRY4dM!%PtaPm{UWTwpdB|psE7IeU
zT1%N&^QfOvY3YAL5rHtxJJB*~L?V&&DPVoaUV@wXs%S#pq08d8lBR-gj;CUFT#@P@
z`z(Lxv!o1HB14?{p3(OI_SE-5)lix44@JaOwFauRZw?Ro*Gdb}`01&A==7VEL%RkH
zRI9|p$?ji>*{P;SA^XGK?>-7?tiMy92&ZEGkzyAWv9HGzErTwKHkArJDV7_06SYIi
zU)mHdtJ*KB)zd27SA0<@5|sUZGw$P>kTB<72(xo)F{I#ee;(<<Z$rNcOIJSgcrT7w
z=Oq%3=2cgk8omgp)B&F<wYfCK)M%~788)YJJ8UhtULOeNg+=jQ(=N2J{!G0&kjiK2
zaladz)Ep~fYTUV_5++g8V-@PMiMw~uvKS*sZquYW<Hpl{N}F$QCj>BGN(UF96Nq(g
zVXH^gydvj&c0VZO)vI(ya;@k!J8?+~|GS^RFsCDEA>iFdP!$zziFS;p<+FHCNq)CH
z9YOjUT76W><?XqUTI*@CTDV&4>QPr%P&ikxlX$T*%%|y2KB<cHHDv6oXOqvvjmM-p
z`EmB+-#tIYt-fsFcJwyutI#${V;9Cy@oT#by!lA=+BBr|FekjS0U81hP`L>P^(0LV
zEceKlhwnCFR>)~1Z694wIK8M16E_~4`b3+4?XV+qF2m<R<wO;<4St34?)RU{_*Yse
zw0J0$-N<3r#sp)HQ(3|y0hiWaXrz5rgvcn&Ry*FJ*Z?-K()(#E3l3q+=L^b?VNHom
z9gF#2J6s&TAj1hW)-YdYq#CFTLD6F~@A;nDk<SaXF_JDc0*GVT`CN+2SCIQoxLFV9
zT*atY1E6o2_=K1$a~Mz{cVCGsmc;EVZF-sS<4lFJ+`p3kq0>rz<c_tgk^)(bfV*XA
zQ!Q0^o-Zkg+-NDNcE~i3k!*XgqqW&MNy#*7uo8d-We_IqQ7(L;XPUPX&`w=m#$55G
zP&-1)zfJH=y&(SOf$Y>?uG0JG2c!{Grko<r7u2S!K}N2A91vr1vx_vgeXq-_KN9^`
zc1hY>#(geV-rqJF3MCUEGwUP~(&0T3etRu=R@Z!sw<<?ca!RK-uGDQH&9L|}_4GMI
z-@Jz{vuB!L)@Z^iuaCZAGCyUhOJAIj&2+7xPaYBE6DM0*Ods*7PTc$D!yxWN!{nWk
zb&WjjWTsfxqD??{EzD!^HZivAiQyM3Z7Ytmkn|9?4f$(o-idO-G0rQ}-(SlT4PgCB
zpg>(pI*{@5qNfNa__NGhHT#{@Ak~f6BMcoAj||GK3~~{Z%=ySu_RMDAKQZOSVxpE{
zorFjbDF}a{!$JGD7-QLr2NlgRI8fPd-mKi4+8303+eymQ@t)Ux^ePVZodRnjXLOIN
zY|&d3dWkD~*|6|{a%r67Dt6(n$@$CY6Joe#Tk*?;>$J{WGNc5k7$E9*vu*3dbFWuW
ze&lzZmV{;LbuZC5h@jNXIk#M5^I&*KI{q%_Y^e_^buo%2uL9Gi0rilCq)AT_RRTfb
z#Rf*AmG8vs(V`n;Jvxn@2d>zmA2r|iTrgBD+nj$;P5;mof;temnK5H^MCV(Q1&4l$
zd&=Oh!bVe!;}^YX79QOzA}_eIP^fj9ExGxkS|{CVRcNz5$sOaeVW{Wu-ZSA96^mmG
z5KSZ3hCWhQckDmi*FGsSN|{iu9@j84d4RknA@$_U#bQfeVWNta)HYwWsPyb!K5+h>
z+-f0$lHH^zl%ftquzhRj@?P((t&;6I_Bf`8drbc4PZi3ubh-~i(tdAPUVWk#_Ib3V
zA>KHh6J&6H#;$Xc&Dz`H!hrLVfY9aB{l5G_6fC_f4T;7gW2X81q>*=Ic5VJSco?rg
z=Gb0M>fbBeGRjv8!G-q6LVhb_Cf~T<F(^%SJ&(^Rw|9M4s8o*L%Rz=RnRA~CY9jY;
z$iOI3?(_XtO6qO9B1K-2_i&OS=+ykfaZ(VOzW5iHrXBC`vOnt(k>TOR*4q~%P3l#`
zEozuyPIT{c7S(Aidq<<8`h<>|BM|ABN4{Nz(8Lc1xc#t|{_0-sIk^0u$?SUR!(7l_
zoRo*rJvYAAY$v(?lk!+JepVStqQ{&@WeAQt^PIKcjARWiP?9yn9(^)eUbKCNn6%(6
zWoZiKCFn@Hi?QAyAuzoW{IOF(=vZ~KvS;dzq8hbvbI-11NtlHOM-V?9a<bC`grqq1
zNmtcon(Z>*mhDPXu)liM>I2&owg}CWgKm}z2I}@m9s5T;x%et0t>M;vM7KQ>AD1dx
zaTdEM*dG~tKAt2QYlbpO9?q~?$3Kl*AUst}vOcz|;y&DRL6Rsqu;4#tpB3sN@4Mu5
zPb}{<*6Pp7s$}|W3j5{Z4uHj@aZ!x0CGQLXC<(l|$Fm+?Y>}fyd23-vbTuQlimzb$
zf1^HoofoIQ&nAA&%@-~#vB&ZXUg7G_k8XHhObK*jZ|{xi%AQ@B$r6<w*Vo?mcJ#qG
z%gM{4rkE-D4(PmFZ5H>!sUY`*<f*J~L8I8=n&wW0-}Onhpwt6Dt|)O@c;5`#FcN`J
zEq0-hH2)yXeeC@{j_C~1`CEAAv)bk|x-EGwi?%bg15;VVi~y??-31<VK<3{kvc<lC
zIKfgguo}8*(FF0&Gy$B_G(M@Ec`pg679RM^HHODDBQj<_kG{=yo#i=`hEE^}-js!v
zKDY|W>ZHi&XW{i`k{UY@_OsG5EjIV+e>n?!ABBEI5_Eh&L(~R-z$QoJu7Y(yKms{=
zZ5i^s+5q+Ry2Y8DwAK}(`fl~>0G)jM{;FS$#gz-|i`qW>$lyNocKr=_dOOR`H<13!
zIkGf7iJp1w{A3Zb_!Ow{o`n9aV<`l5WZLWcY^Xqkh56o<zdp2hc<o_I3pB_VBy{%C
z7lk9`UWN?xtm#x(=fCq<5f)S?<E(5JF7jt$3%YLgUOPoxU5Rk~u~f^LL9*;ESQbY1
z;Hr}|rbnD&JWKdO%-AdRAs_o}A6Qu5r%GVQ=f~>WiPgjicg@4;1$Tdg$7vkY)~(*_
zgg^KnsGMn7w<4pT*WMCtN;tJ36I}OHL|GaL@;oRN>~@=tCX7GJf9!!1<muNZfK#`a
zaI~+xVpyjQRkz_dcI;#G*&}GLJ$q=F+;>Oc{yrv6$ykh|jYca^sYdDlc8SM|A+JE!
z1b-^NB`*~Y=ff^+<5-qzO7W*0K^)ydynGP?Hdi*zaN&djUuAC{dg7HEQE(v3z|tI3
zj(@1XDHYqYrqY~`bv=;SwnM3yriKkmq3s^D{~iz9m#dc&7MUk^9T@%ZOXfLJXG-Qa
z%8|l|$h3px3z7F_UuxD)S{F*LW^X+)OyA*rM0me5Xw%rCD+}dQ3KZ3uO{wXch?F9q
zRf&9nwCldUiytCBE&lqU4>=;yYx;+y>;vqDLBh7RKuE)1%Owz?5nQXW<}#OAByi}?
z9BEhq;E~Jk5cZ+qB|k5h*0d?E8XT$?3dV_1&>6&|`J6)QT-oJWL5_mrD$&Ju7uTgt
zn*5Z&<gs)5L(I|hw<^zf^eTKp_!1Fd)Ny;=Bxl+B9o6(lIE#^N?0~OB`=UHTT6hsF
z_j9O~LcZveTk-_9+U2xY3|P4@ReNlb3Q#%I-X1zCVDV23WrQ#jwK49@Sa){FQbd(>
zZKMk>4nWID_q#WjZ)}|&dR%YUSmYN@tiGIFF;BB#<|My==>GL^+8rQ<t35D{i+BQq
z!XT27G%j56Ee<kizdZSO<CLvWA2&Su4KMIn+T1j8<y$tHmd+Y2S1Bx#)qX+O2fJ1U
zqp+jG?185sjo}wyK=A4zo3X?fKGsu-q?BZYq}bq3lA;I_zyI(<MByO0sAKuiAk2(A
zO)`CK9S@xys!v&Qq#7#^HmO%Z?uUm_nTpE(p5AMKImbzSF@{y*z7JwYaQazby=EHf
zTZPv~u{U+vJvv?rpJ_uP{RoGjW$0;g416;GKJsj)ArhH^F5{N9)5MrZF{qQu8#4E(
zCQDt-ikPtU6X)abv71>tl(^xMEzS9~r?2z5nN|Fdx_Ku%O-UJW5tcF%67>xzrc%h%
zht(LI>c`AvEiztNbt7jUhwR#|;E4rVFs?2>nELKnNOJl-vu|D<Y9aZd8CoUCfn~`b
zmGl7mj%rrqxJas@_<CKX1iFf#ZYRjF;f-;|_w#`XFD44tE2=okmxJP0j@pZB^-i81
zPER~tE<I5h@^tU<YyQV5^OIP{o_tjof(&S!4Lyou%ztgx<ZuD0;6-YlePV6Uji8;{
zU+E=|hwH~o!>Wlu)cWB4O<C3(DqY5=t>fX1L*T(t8u3uC>CYJVohT1hr05W&A^Q`z
zWcmmyM1@Al94jFhMb66a%`y$|vkqx)*-^~{e~yhC=Heuxy1bFqM1-XL52w!P|9g=e
z#K9Dn9ywv^uL2Yui;>bk^hz87iwf($-z35wi9dxNHrCL^CPVJY#09Bjy8YW?hT=+P
zr=BnlqwM?I-f37&s7)gH8-n~>c(Pdc@BH=S*DMR3%8za0DmmC%@d*D--o(CMw|By!
z@6G_?-?88;lp~nXqR`Mto#J2L{oh5v2ft<+a2><#2UW6vuDL%}-k*P_TYzX~J+Wjo
z@PCp2AMyVmf8JAv!?wJc;y4o|hj8?A-p;68XD8N=*bHESE7M87@~nyS^p>eoSjGGK
zcizET69V5W>VwG&?X|J^u$|mYJNA))GH%ot8?B4M_(ojj&s*hgYoK4?F7$GGwX56;
zit_FYIn`dF!8QF><K>PKDE4B2CX5Yo+w3H&zh@iv-1}`1DEl=da^cY7(??q&;PKBq
zuA9vd`z@mfXyXtyUe4?ywGx3D`1Pg;@4>#tf{RGRzXCKlPz}yn2riDI5R!zSRX#yL
z5(3zt8#yDmud-C%n?vYVAW?zma}Wc44dZX^c!GwEuYw?hS}T2mj{EDC6Fg9#rI$4_
z;aI{nf_`uId|;mNA>)*)U-d^nF&5zw0yQKFSNJ$zAyAS)kJIaV(*X198}z$?=&A#g
z5zusBj{6FTnh)cdW<kJV1SA!RkH#{Q{xK<Xsjv|=y+`GAI=zGZ@IH)#7@Ss0(+_if
zpAY5uj&db)+r!cK8l256@)wPVsk^UXoXgS>52)8c=U!QaHzSM_hKC_b=L^R37O)u^
zKRseGC4T$R;hEc3Sx3v!kOG;{<<#7p^_*m8p%l9&aH)YlBmt>VLM)eYqqnR+S7$G~
znW|p{i_td<z86FGi5>AxSIhNsbz+U6vd0T1T4)}o6ZG{hCMJyXcs6_5NMN31mBVR6
zDCFT(Kgzd~K#>-(Sqpj%z5-O6Ncb?ZPeL}!&U;g5pC}Olrtfg)RtVNMTWLKG2y67?
zS#c^IK%0qx_7pT}zk#Xz!1zZ-Ku;y#aK&sEG;r^28r<?v0~YE&|0<Z<SL5vt@9{Kr
z2P)b$?08~ML90w4_*MMVZi`{_cD|Q7nxJ6#6@YJ8jR$e1s<Hb#KsrgCcR5z2MbC8x
z5B!!!Rxs5ahhHo}mF?iUxBmK+O=$ynu<y})v@G+3#{Dq6*L`4>cpsE6f||hHrt@Aq
z<3tU8cdCP|8?vh($VQ`D7EDYrJ6j|6k?b|#A$|pGow&ok&Uex(7aj06l&0Ifomx<7
zB<87mGj0F1R$1Zjd$U%DK!sEqCHKrC=C+4=%l>ka?AGlB6y7!VCcsDz>#5mQA9{k`
z;)<i1vCd6UQcX(*_@Mg@XdL1w?RamnbUAUhWg$Wwk$5bB0`8YX#N1zs+w@zc+jG!X
z(svqfdv(3*+qcPMM8zTNcjY}<0xEHzGI&>c_rAb$B-g)RF#xJM<?;F+`5B?ruAmnw
z-{Tro=`~z{(1JPj&QX56gL$#45{;eQw{L3!l?{#PtDv*KA)^PB72^`g)syBPpO^yv
zqOYWn9gp1nx^r%+$o0AcL)YFLwz6Sm*|?QeLF$ZSIumhOb7O@O_PzhZ-dl!M*=|vz
ziYTB+hja-@H_|0wP$Ec6y66-^8d0P}deI07A}E~_(zRd_(g@NZ&7v0h-OpQl>weGq
zb^e^|`u>67;(6|zbIdWuWXk~r6Fz;%#>-0G@MX=e0-d`&5w969`66#*IVgv9CT^4s
zs*V9mjkr@V7+ba;znwhbSdybxjw;0~iOIp}0rV)^HzeuVg`hB=c-oa#DMD%-f)UP@
z+`;Oz*uVl()#ehwppiBkQ1uQXHcus7<-e9FQK)-welNNFL47)Z5M>(N*y9U<y7l|#
zrm7V3Z-Ep`?07rUHzjdT*)USK?&<l_NW;!Y1Usv=`7n=@oF{^>T@zaZ3VqVjuak?3
zMC!hI$~y^&HXQrTxOhPMY+;V4C!lW~o#>+E!`%`p$e>q!qm={Wif{VKJS&P{`eX)w
zkdbsLiwEwuS&EcORG9DTHUJzK_r$XA*pCdz8GAdTfCp*WM1kK9f7lyP1d^s*@__$H
z9voXso<1=b25Q*W({C<-h_M749ku_mz9ZHX%_?y1qb>L+B*BabmM_@1={x-9=;%*C
zN$l>uSS1#(3wRu;lW#E*J++P{{h@R8)hANP*!D%P?~10pzvW`A|8|-Z_~C)e)66&&
z<9b12!Ep;kf0Krg-xY>d6#3;a;Dg2`ZLVZz`nZCGH9bW@{Qwf$F1hC+<980<;WD%%
zO_bj5oWiJ9TD;mQED*MxY6=ya+0_7m*)h|ZaKw`jfB@U+$e`C9&3pxVXJC~swLf|{
z2QYf?`t<N`)-CZDVHLIP(h!eeaYW$xa-Wwp)ncEJ^!`Z0nGpEf9sK@G<9=1!AY^Vg
z(@7Sg`plrhn&xKevo<k(=IV3H?)K#1(_S+azs_U#8W79woMIbVnU-wY-D5oiyeFG_
zUqBs0*yd>&t^w^xPvj?Xm!Z!#eb0~4KI73WEnL!S)^Tx*+v|o@SU%rjg<y|Zk>C(A
z+pQRuS(~LK-`Ofz8)yCX;-bg61a9N-8E#@rgs(F9J>GX_nMxm7`iy&KV$2K72A-Zh
z*s0N>oWohA>?#Ut9n49#r#z^Bxf87B#b`E0xME{;tS1qm&<V!ohr$D+!C-gwqKubl
z-p+|+)t%ywtp?N9DdF)GAV!}L)OdGkhD~MBfkj%4J;IF^#TG+%0As1G8R`d?b&I;F
zk=J-)w|M64(k0xVnV)&ho?Rx>$uPCLk%_myun7zmx>xgt?43E2EB)?ExVU|6TLM;q
zh>3DQv2@$FY@IWk1JQNY!EpfkV%K8oiz$Q`$-=3%l%wer9S;$5WaQ}LUiFWq_7HGr
z;)RTCZua=9*%$A9nLg#-s34e#V$#yxt&ILV4*MI~QofJzjL25t`?vc=Tu2;9tG<4H
z=0jG*)rtZZ`w61B<&(;!7~_=M*+a7S!iq3PklDqfd@FES#0FXuIq}Tz13L!!QBY%?
ztI&<X)DIy(p8^I1#!61FxXN)BM_9!6-}|KCCSQJVZ{o(agp=lX1u7DAgv6Fj;0!Q|
zTD6cq*8M8V(^+8H1ms#ePLl-|O_#|H2oQ42aF++Rfx4cU$y@DS)RhauPE@(&BHPR}
z*(36As(PeTE;|%8UfDhc{0~B!?L{oRX8Dgd22#9JumbBKp5drvR=8;eL=hY1FRfZX
zH-7WlZ~(eLQf7cmF!6u}FVyL!vLp-VWqqIdR@8{zItwwOH#Sn)1Grc;LqhCIbYQb7
zap0^|%B^JS6k{#Li-Bd?g+6=vGbzr!!4o1>z={hsSAiqnh?!mWWSwrVS-xsnK2fR?
zrb()+LLZ_U?k?2G3y0ln-QHCJC+hCepxs6z;6BWIUzFasPA%)4o_q^#K2q`foZ#N_
z%Tvs#Ms0XD--(o>H7vS+1_&k;cy!`5CU1u@DKl|Dm2|Q5MH9vm>UN$Kx4f;bz55nD
zxg<r-I#6-KI$A>KI-&x3FVNQz^!p-^_Ymjp(r0{drWp}k!Tdzy2)C>%nF)eNww+46
z9HH=p4^rmgk5CeyR1t)ML2k|<lo&3cn|T%VAX`uFE(gZ-sE-J8<sQ^=BXHW0glEki
zlASp+);vzK4c2}dOs}}hu2w#-LW|-cX0k0-(fj}|=j0xd&ZQeO$@$DJjEwG4h)1k+
zcjVEG&$K`JcbF-?vxap>_G57~E{Mm38&YF+F0}V7rTH>&R((Bb{k|=E;8uRmvK1pz
za{H;sO4(rOmp#K@1L=(W7$+iPPdnC3e3Iw5>sn?_7LaEahLcZ)G@k5#CbuLo|6H|y
z#OuC8MVji|QpHEQX;YWS()X|}{*ydmfYC&;`PU=APO;9*lof>9oU@N)aCx!H*FGi{
z88XP1B&sTe5*9onFo1J1a>FB|9Ctcd+a3G;?aYa!fV)=Fkd}U{7?+;<P|-J^0WH==
zodJ5Xs3NkG_hOBV)C#hlDaVRVugp?OEFX0<%M+sRHnS-a4-1v?srcV+H@zGc>^Kv|
zc#|`hAPoDR%172dxI=~`K#SUHgRJb;U*8IR3-fV)CHf@7^s2Y~=yUvp)T@G2_EjcD
zu;<0JP3Fm2^UzXz_l4`HmP9S^;aD7&hoP4M+LUCf#S?jH>9JDAwnTXCgA6PG=$-%0
zD}rQDm;rb+M8YRc*f>HO&%7V|BE8QP63jir#dyzXJe%&1ee$gn@PrNIS0m#US9wsf
zG4U#=-J=h?Pkpo1QyjN`whx?INx~*Jw69DH(oRjpleHFze04G61fnS2f@zjD*wF46
zh;Xn8b8720M#<Y7XdeezDmm0{D=O5n5G=qRVKtR|Rl^VC64(@<WIoexiluAs=fSb~
zJSD83Npetr6lwFdzhorg$QGP~y$SnyrT1tqMpE7WoT&@(CVXi1XJhFEqPV6Vlp1$V
z>-~(ViC@mrods;^&Ywn{XJs1E@r-ojx5+Za#@_vP!5Guy@NSxH^iro)*CJOF=MJ9z
z)MIVT6S<SS&pHHd27VU&Piw^9h8hek;Weee8+F$TkJzhJd8L%j>E<Wm+#=;Z$uXk*
z5P)^NN;({kceQ}Kl@5t)bszM1Gt;6$Z>wGvtf=L9aTxkg_Dcwk#TR+M9r<h~IWN@G
zs~9>ZCW%kQZItz27&#9>Oq{f7(ah<;V?!h5<>nI>q(5b3)nU&M-^@JGVef-Cq<EbJ
z!g1nA>lMOOM*`*4P_7CcAI@;oI7LDfu82fE(4(E&4UK?H@UiUj-{<&WQ~foA`D=<H
zV>nkaMVX{#mdT4r7quyOZKLx9N>M6tO|^`7WCeO&rW=KMGG<Em`3qD<%%!+Y=V@6^
zbsFJ3(Fp3FZDv-7u%8NHTSsopnQBQz1NS1CFa)FZ65+{rX2af2`beS1h?-5!E}L~f
z-#Mkeo!jg#V6B^3W-5E96^q(Y#z(3k6v{Ml+klaZX9e)mRlG)=X;gg=Qt>aKgI~UJ
zlbvVof?pavxiQR{HsDGui_^FOxVXKx6q@FEekgv(UWmLCnEoVhwl@W!fViDF5#88H
zFp}~;h>&TA-|-0u&F1(pZ&sNK-4V?B#%=|ur|uNvKU_={Uf*lhk%Kc#ibd5Hx$*~g
z0jxP33=|BvOzpQ7u|;fbzsY#r`OHxH30q&7`0Vni(`k9iHlBlg21B8OS{G}Na+-!;
zz#Qb1W3HaWzH@jpc?58eVT;6X3P?M>lILNnVk_ApW;!3;Xt1UIW9)C1^Yi5zI`<`~
zBay3x^(Vmxd6rREX<8RVK3x^miP!N@{b={@`XX^I<H=ql7F`O@^;x%K9uP3s-+Cs}
zQ1-oOZ&ld{++D4RlODII8xdn%h67%<xn78A6~ln*EjQ%jOeuWTI`&MbH$as77^Q(1
z%7R(1mq*?%%S9{3@@wG3>xNUs{O9Yj_EqiSu6`Sjqa?NDOnGKLlZ3kOte){sa`BdM
zX<s|(?8`S_B4+X0yQ1~obSyV48`Tl76|jk)IS=bgXzqFE6FWNxq|kWp_LG{v5*6&l
zliclF1FTX+q2v?mxT`dvKM0h5d5`OZs-HlAywTZC0!2JO_fum((_U`@=bLL|?1nv}
zj=MB5dKkLjvX=wf<Y3zKDih%fZ}ml;xV!W%_YiUx+Oad&<JGa*r&tWN_3g?nzniLN
zqfQmJTT;l|i=*_$jjQjRo2_fa6I3DcoXWa(P{kxyjl^Jf9K-$ja~U17oBu$3e*!Hv
zuU{T#uPAUNeGZ*{K2Bi~h(+gf)3$mn$E5tRR*C594`q38epz~W1_2_l^M~!zaIO9`
zD8mNCIeIuffwIKMs4u8MM4%eI*dX8n(<=Y?;3=oCMWTEU$6xxkAM5^|;)l8<teKpN
z$fTkcBBgKF167iZ<<E)w^ZMn>xEZAg(cRQ{Zfk}S%r1tq2I#TMAIrSAr^C9`dVh)V
zS1`j8-)~~0iX%mQX0{0NNGTw-a=Jz`&h<Xm6V^WJXY+?Q9s$1(SN!Hh+Nxmdgx%bv
zF-$*xzntLNuKy~6{RNNpnPbEldUH`rorxS1dfmHGK0<5v+1pWj#08^g3X2+1Qm}=3
zjSrvIqIvzrW~jykz#HF~vgiH**Z%r~w+ORncG_Zh)R@q_dB*H6{#s}5)>sYjMeaPq
zQh0hdj7s25|H|%nRRG0R9%PL3{I>dph?a-k8vt_WB)FPH$p~~o9a}(}(^^Z$#i2uz
z6VSyL^LyA6B(nq|W7HEB!;|?mLs~%}|G?pX0ncPGudw+UrXF;^GJlJAPw3wOHjgL(
zPI9m88LofeUZEAz_;ug^fdL;WWN0s)mSn7q6sep1jsrkRm!B&UKq*y|XbSSR#Xr8j
z_qhCj9`+?RE+s~t*k;1zo(zgt)<OUB3qjC>P+Y1TSAQ}fX`S;gzp)!CQ`mb9lN~HH
z$!hw23jU~WuHU5h%Sja!*U>I?)x?VWX#M-+E?Z-Gp3ER;#<b4~6+hP+jJkgsIx^@M
zh%vl&$0AV_H`P5ys=dr?ix8R*PRlFPI+~%s4Jr6GiJsSV^3buFNv(w_i1$lDsh-G@
zjZu%y)*O?zq10N*zO_kdTzq%r-cB0`-05->&6A3H#a40IafvLiJbt0+pbQ?*g;9+0
z*JVJDQK$0tGCWq!^{8;CvUM&<r0{&d<HU`}7J~IaZ2@Nnm;hgg+{RXzBX96ALKP#3
zbY^n6HS^y6imAmP!y`bDrL^>WG7KQk8-AG=nuD!z1Y755Y)0un+%Q?pc#Rj*q%6<_
z%+H@R0V|}OpodI;If-dWuiQO>7=!*<s^0Gl;))PJa~Hn9E=NTA>}G+eaefEaWgm29
z5u^rZ-o;{bdW}Dy;%yeE=m=zTi6?!sRRmOVfsoCbD8HL94`>ME2;iqTo8FtAGmsI;
z4=cFd{|p8W_(M2h=k^=L?X)v+vxpVXj5m_s-aHg|cpt#=Q5#F{Iq?zWKwH<e>2vS}
zg2MuDPkRX{1K+LFn}cVwkXf4>l%4=#(hWd--q}x=5&8|V43eP&yC}~eSeaq9!BpZr
zIi{=4j0>I?6*cnofHXoqk<GpR8S77)Ai;9PaWahgT9SEiIomnp%cRmHJmoeA;f=yW
z<5SkqL4S+Ui3v}OBYoen*qZp)Q)^ifLaIk>IBmvVMxLBkGL2F4KfRaYtEFG^yzw$Q
zW&tb>AY<9z&V|)P7h*5!Zrt=+^hIFpX%)JD%h(_hQvH1*a_Ifet}@fn>HX~mAjstF
zB!@ewa>M?tMhN$IJTGMFork1op=h!$1Tcz_XNXvb2Frl4odEE9_-e!Y=R^&5s=u%K
z?KS{wTue2i0T}U}Y?(L*1kbg*)_z}?lI3a;Xk~uDsa*q{%1nu|3wxZ@$_pHQ4x8y*
zy-0&FDK~><&&Goz#sQkt403J?2#~FcT?%4~zy`j1c2z)(*aXr+3N1tTg{{)`(*kR^
zV&GaQ^m+3O$UU0@CPx~tXPs9Bg0?`QlcY~^Y{G%?OdN3QyFag3b>q7(4!qvYQh{B3
z^d_D~n!C9O(4{o<cXJYBNve9FzW|^8JMl0R;OLA8p?X_;uSmRrmu?eKoRI)9`gIY2
zjTK|cYMajOe=Hw>m30ls?X(X8RChyazc`Y#bk`jj9w;yeU<6LD^W$k`q#BN)kE+Nl
zF;)fWuV4mw_%s6qJfSlD`u_PWc|(x*5da?i7vlA~3jl~WlPi5{1$Szr;Mh4zhVc5L
z>{Sq-;_%dN$-#jh!IW;T?qF)hIsG`rBHzs$$bFg$eNR^%fnLWSpg)ZJNYFTfOnB^R
zOqJL5bGZk<9doIy4@q=H%qY!|Ux{yC%bjx5hdYj(x|<Em?R71^xw3sFo(Gu2+#Mq0
zA8}eu<iE)Bq+YY|GlY0%X$hvn540}}!0|@28}bJXv+xjyHWno~zUJQ1i5*di&u&z@
zr=NlMwoMd8tUK!^k6HkPys%?+A>POb4Z*RI?ci3wC2sxgL)A29LdYrbX408-$dohx
zX<=12s4Sr33T&aYV+FPu7E?_EC`y2xUhV8C05}px%x0Bai}f5JA48qqmedeijaLcj
z&abZvcR<+8i3ji(((11OD$)Zq-;oK}w8&{55EhTcs7dKYrQZgh<RuI=or`FMiF3UQ
zO%CS)n;CvK!oNy_&bul7;1uH;=i9`-!Q2$rU$VHD*k$Qo#mpjmoA#$a9dd|w1JCSK
z8t*ZoZ63)fOLQ5+ctY5ZIX&{Q_NF(?aLyNoGCcOHpN$?UX|?Me>iib$?#ntc@wo;)
z)R6y(RjiBk99OKAw-YFlI&M9K!xSrkd=wT$OD%A>nzTR)^bYWfmI5r{r{*}stP4RG
zAke)8v=)$TkWC`B6rm$NqdPxr9|Ho%Xi0#EB)$>qh95d3hDpuM`C=-U0ASEFQ35oV
z3&-bsg}w_g2>YKurW*Ue+J}3yuq@KH&TPNO!AIbZZ4$4EoDUmt<$SUauwDs))eJ;|
z34f_=7ov;VtU)0=WU~ISm1hw>CS&YOXaTA?-H5B~uNOeYAu1eP8u9PwJ_EQg<k^J%
z7dr_>eam)e=tu9~rE$@uzEcEsC*kN?4*&HIma)Lz)iz#nK=&Fvb}k?93KY3(!adMM
zhf+~nw8$~10Yb!5i}em0*2PmAE6Ze#I2kh;?;T{zR0_+UtgVvP?2i=RGc-p8fY*Jy
zu+~8rgeOj6x3MpAZ<I0i(esnUa5Z!xb<3_4!yYE;`x*<~83ztAral5L-G;!M)6_+1
zdW6{WN_4^jq3KnF(9WhtSP-*BkgcfRwxhXH`7_~)UViC_8+R$3;c+IUF)Wz8oGBup
zQ1@jikYLfktJEb4?K6F^y%o44dsQ0#cHoK0gVRpQxBJC%Nz%vRN#mAkC5~C#eCYu+
z0V+jr&+)S=3yxrF_C#Bac)z+7`Zk^5doD?kYR&y<iN;vHs>VH80LHUEAIZ^vW3=b0
z;NqqCYERaT(b3blK+Oe~F0m-UObeAN_)+=9pYC@!*x(+|f2zz%lMw)TRAkXJHYJ@Z
z$J8J}$gEvA-WK?ahPoTi<HW(AE%M}OeysuTQ3}p;UNDstwfD*l_^0KIsk{3^aPpbE
zwi2Y~L(sdw!#<LjM;t}Fm0q5oGkwdqvPzMp$?jYs0*m=M_L7J%Vu@mWo10HPCmvUF
zT83q-o#iK5q36?O)AZyytLLMge$1-n=vhC`kTqsg3c~j(O>`cY(nYY@SAgKXMFN<C
z+IXFUI_WpoX+Q~xNqqf5$~VtVT`hy+p5fk+CFoGHt*5ILENVD54V64mkg2ICJ|<74
z7{A5WF#z8tn}lod6i<fxe3k1;5pI9~Xs>Iz>i=!Q9Z3`?j_^CRX|sIG&#fL7O3=qp
zajwnL*-(A1S=Z?+<Yx}ztdN-Jq4OGX?K0N{1u@fwHg?HK%MrSt6cj@2c&47`x%J!o
z<w)25+#@`52^o2`ehT`CJnA>nVJyZ(pi0B8TC|Y)ag<`~lDePvfMzXmc3>XdDY{B9
z@!Iu#(cMNRpv6W<>CeZ%-o+Wse~ok?PvN_t-cp0h9Eun7TF*h{BmGPG2W>1ALN!Mf
zaV$PI<vPT5jgm>%VaJH2kN0Bb+a9M^s`DAvRu8ZRAqmp+_->WGPBkBXP{JBH62#{q
z^iQ5ON~%o7Q1NviTFr{n(qr3iWtG|vwrwTVE<jg;YiEDP?~chehcpvA|11+<`u_IZ
zR9C(9lln`1xOaO+?DqL<_27FSXCo4Z@_!p%&%gHbzJbEIwbd||%1@FT(&;N+Ia3v0
zeY=H)ALHU>%%1*KIqSxxeCe|&kRJRR-Zwfl00vj2;t8k-n|<+GQ57=c18kDx3AVn6
z7QSvnt4x*Vd5c+Xg?Ulh2MlvkHf|!R;5u{(g^tIu(PA^_p~Th4M85?`5`G>S-E6lf
zlfoO;#%*Ug3gd-y4ABE}uWc<#)l&w3a1>yEVC~9o&#(SsNlv8OR~Gs-aCJrg?ojfH
zHnAo47=oU8{#m(TA4U&DAT`lMOHCu>o^Vk341`viHl{<T>tvQk&H09O;k1%sh6f-+
zo%*)J$Y~6D_}+;A0{k<i!DSb@XJ6b(hMoZ+26ud;yOu8FWQ}y~M#K483Fq&nl0HR@
zJ<Rys!=U237E9Ak4y|K@b0)`|<|i)tVxUaB;~s>(YhAYibgE;ZZhzz4Yf6K|*CWi?
zh2O<=YPxg3BHv!O??$Ib%(*p24~Rpk94<7eB%s~h!5vy!y_m$YXeAt?!J+zU@V&|g
zd3#(R(1_+f&(rwi_wDaB%or-o`;kl3OjnzaT1>V0R{QHb&eP?)(jo1|4|ZC{mAigu
zVC5oO1wo8n%LS^IPTNIO|4qyQS7lkEjHKWDhW3fc$q3CrX^M1Wmm{IQCxgMEpjRZ$
zN16|%#59k=YE{WFc^0wN_yaOm7Qm!X1N*?T0+dG=Zr{tjOj#i5WkuW{1kLbhEEIz?
zJ-uxQIkVQeU$3js&sf1P^zd%E3@&ihZ831D@2>$4KtYvarVv9L0lTDR0PiI#Mne-=
zY=C<E(dG6AYTyX>9d!iN&2PjfpMrX!%09?^7TR@a%fXG?$}eL5dGV<TPsa6M^E*Eu
z;^o2%8iigBR3b8@hxogQ$3IU^NO%DdeK?{VWZ&Dr0$u636O$1~Fj+H_Rh6@RKvlRf
zOtQfV@05O5Nv>n;=O$1zjpYH}%4pnwI&pS@s>$iN=e{SE%HK;!{kADKVbX~nP(U}@
zW`zrPxosUvVa9>9jOXsl$JZnLP7gUt5z#ZAZ3<lbJS82B-u`4F9ygqK=-WO44+4r|
zO~a9>yR?bvcd34l?wB5`8Rxz5LZtKb26&kvtIG296GUXmyUEgDAJt}$uL8GY6rR<$
z`@AkM#ytWQ?`L#=F?V!$o|y$UsSS=`UsGf!Xm3FCN#Mo_wvaq&4ZsthHD-L^kDwG{
zSDj}|V4=p-z{-@<ZF<z^!0S&w0GhSDy-Pa|YU*7fFp%yzacXmY)X;sWiY=IuO9~G1
zjtTs9;2|xN4AjNWszF*D1x0e20pCkHP^hkYz8q?%&+cx|ZXkJ^amQW&Hpjq%O>A>h
zfaB!h@wU{A3$T0c1bHuK$*tgDkyqRcV81KZ%}vRB4cfYX+onK&5fb_tn&alZl9Ds-
zn(K{pO9t1|K@ApaRZy_^#|xDs0Hm~5(DK<MGHgoOf@gpa0v=f%E8IoFHeJ`$AF9cR
z(Me0e?+GlAOE6P?voa*(mw>ZVE4$&CQw;XKA18Xh1<H<?C>jz32CFh?Npn4}6sFo(
z;PmRv1RfMK-+{&6|Lt6t#8eEUqO*6K4-V-n8T5^7D10G-6p6Eia|Al}$(|>QYk#?U
zt(0aB>&y*~{)nC~h!@(Zq$|I)hbK>oK%J=?0!YVaz#AkZO`uy!{55_n7d44(`JxYU
zP6@g*{!n3Gax!LOb|~ii=TNf$J`(*Rh(54>{U$!u-=^}ei_j<na8i;i=m1Yo!Uq^T
zj392moyEN#C8JR)eg)as_)Y!%WJ$UiYUE>kU!w{*L}#_WiSYn2`|CI6c+kz2dC#mn
z^%XjMyIB&=ZYVjnUSs*o-dPs;b4F+!evpVY0)KbPPfv^X9hei5iB*&>a?dIs)h_VA
zwwjvWQ7C)(kW7$E2E|Cmz_wO37onaa>&1sv-spw&2gdHA#(d30R488}#LOdzTUo1v
ztPjyfy4G<U{4%;?4>Hm&2<(uv`s2L#Zqy&}97nU&FK?|!04YJ7z>?}ZZl&^M3}jZ+
z-Ph@)YV)40cX0aU(2!tdL^KYoS8Y*<yV{CuRLwPkaE=|DeiX_SO`tn*bh_K2B|pK_
z=)Wm=V4tNjIR2<k@ZU}_qMC9${(gd~aB&gJp~xp)j6~MkCYs+STHwa`dTORsk_!`9
zb65R%b@&2U@x&VLh^-b70|$GG^BjNPxo}Ebl#hdUt`WeY6q`h_>j5R83Do#$X$JLf
z=2V^Jh3CRQek3Z)`zY?h_sjm~Rlrg9IZh=|xIt_>TJLjyF7lO2IK(Vw+Cv<dPFQ>U
zA+qkpw7^EFdC`TpG6FgtnX2L*<yk+C`%QkCsXvh&I6L<4&srlgL5<d}A%)+P9_ZVz
z-(&&Un6PUGpr(Z9kx6X7V@=@MP8s|1Q9inTyEdaAihd0a{@kxJ;(#}1#oB{6JOnUC
z+3b)10|x=5;L7#CFvdPySt0pfCi!pZ3_M7f-~WFg#xK3E%r`IL;pxV|NvHFYfrG_(
zJhZ~j`7cAr$m@pf1v&|ur1zUO3l1t1gSxZFmZ0qgy#W9rGu(~9k6~>f+@CT#;I-YT
zzH%W-mEm7Mg#eSK?nqC>>%_@qxsSo*o1rIe3maCCD8P_K*TYJiU*k&?RZQ9r7LBuW
zT&H~d?+B{QIrgM$`;(bT9P&U|ydM8r?dkAoenIzx7pb7_)%Syd(%xhOGCjw$qT}=R
zVOZ6W!N0650zYfa2=VRttu<#Jf4hoN&VrLM(vPrY_5<)KcX$r@S#|rB<IEnB|3-R*
zc#p3!Cp~h=6K?l^2UVgf((B|!{a04s><#P2sQeGx@ekyf`=(>h_1kZ{3u{;^YRNxY
zRBe4Gv9vtAOm0MGU%y^x+eN36o#Fe-Hu_V>(&vpi`79v5uz38V$$Spgi)n?jcdbu2
z`W)Bu?!8t^0^O4sIBT}Hct=v4Z(+Wmx)S*De-TjtTocpB?%SNZNlFN9Cps=k9w?>@
zq+}(uQhaX6zf8&fazRzwz|$MIuE+D=AAf`4B{K1P18?S13I@67ht<oJ4fOs=fwbNd
zwOg~HGvT+VaCPI+40XSwj(_YfTp|nzG`Ye5bf5RU78US5L8o@<4aH_WpfhY=8~80+
z|N8=cP6c4m@55%+h5xo;ziQqEY+B8c_ciqYI<@vp03e_6P+tF?mG;Nw1OExY(8QlL
zn&dbCZISlbf%3<5{m8t!f0+<^3=JCaWExKre!lv9+y8PF)Pw_o-+q;^T>F=Q{_A&*
zKY}MS|G4_-$=iQ>FPTb+2yG{sv;VI{sq6xtOxfkh$7{bO7Jp9qvM|72Yd*DqGyG#v
z{A6W+fWq?CLeL-3?cn>1W>#r*Coh<b>mjarg#Z0+-|uHET}}eA59=25mqbCJss4j@
z3bk090nHAs8v&{?1TB73ChZdcin$Mpwp&2|69`&`azOo1FL}A9ejdSrTq{gKHw6=r
zZFH+c4IG>#Q~_Oi286+g10#@0&Aezh2E?S5_sxJd`*t&(@^)9%^KO>`wOy)ohHM_-
zL@)ygq#l)m4K@>KU}hA!>9r(Yd^*Vru1n|ck!Rop3WP*3P?~K5*sr$LX^K~+03<%6
zk$$8J2WT8+=Vyt3UQO}=^j;1=sN@-dzFTN~mj<9-5$Fp6m=Gc3u|1rA=3P6R3#Gom
zYh?y-qU-^g^LCTe@fxufD7Xe?ja*K$HmETvm;|m*5HugGLL>Ivl4MXz$K*}Xu%3;}
z9n_ba@b9<!3;>PwkD>+C8dL<dp81m0K>1Jgt4|k0k_Xi6IvCJA84*c5FG1&Ay_5Gg
zK+v)E9lZ()<3v&bEmF$p3>Iu~0%24Dz?cLI0G-DKJdb_-D;6biJrTi6D#K;sVKaB7
zkJRCUR*z&Rp8%6F)9-cMeVTIvSKT<BBE)`v&>`WdKGS(D`0NZ|#5~F=B76maWiaD8
zeQXFF@F>$u-{VhOBun^oE+^@wTiu>?ydwg-mi&P&r(cvDcwD3W_m=V_!``ix(P&!(
zc_g0i$sAo4wgBioQ^M(#9xw7(LF3>;&I%{tjSsMkM3z5YgZZDoy)euOb+&-pRgCSF
z?$*d$3gYJ$&0rA*u7EvTzUK$N#VvsKJ8`vFMRV|>mOr!n5#aGnUwmf{NYI71Zojq5
z6LE^Hr6>Sih)BV<%Lmd*lyU#rWf_!U=P^IM*%vEgh5GDaWIo|l1NQlM`Nu}S-~wOa
zX*`dkyQhw6@`pnit29`r%|#~7XCnj?lpPhCDOGo;o&yhirtewZ{}9KQS)tFopigM&
z$PXk{<N*MKmEeYbrT7781x-uR=jdpGlcj_?kTvj4J|9%!yNYeJ6Npbo3xSrHUX+3{
zX8@V>hx{}o09W^qfE_TeUx2=T%uNs>`{f-owZrkopMn0yP9RJ7ha~>S(Y`H&cQxTF
z8suc$Py-1A?xH@qYv2aa=g}i|_g>+^Bd8|pMLxp&9Qd9Z;;<?_CGJ%dhe{`I-_s9U
zSTS6n`M`(Z%t3ZDso{-5MHWdBorRhYP`@RBW;<+McLELptw#_Idn*y?#R65(`Va1A
zslK8E{QsBLN02P1+YtEL&72)?M!EoKK4qKS`3UE3f2+U3SD_IDVnCxSuEKof%1@@#
zrZ6$sBD8HIt;z(d9tU6DpdttRcyD<xC`uGZemDT8g4dPTR?NH%9cv3{QgX+nvej-J
z?}`r7%D;!25;sBRsbf|<aSSTr_n?O#R|OWaPrR2S7w5UzT7O%~w`HCC-LpY)Qf{CP
zXEUJsQ@4}M1=PcE<K9DAk0BCZ<P=b8L!{S{pr<6(qjRjd#cB0Z<>wAnIy&H+wC(e5
zI;0_JP9)xWaH&3J<#q#F<!KE7`u!nl?(hgVfW*8T%LR|9XWcK5r&)!CL%o5fHp3dP
z3y;!Uv<$R@H{z}Z9ci5C=6nG#g$F4jb|mW6+gc-q_-X6Xm#0Bhgq5td9shs^ISoLn
z&iwqN@ny+lFn)m$!J$7-;(!fjl_Kp)*dEenzjQls%u=6{CcQ_ZvYWf4e>JNh{hAU!
zXSCbm*P(P#iRP*$s2KA&rK|l4SyWg!sN~&}!mo00j{sO=jS1-4Q*cXT^ZL4Zm=p3G
zFmEFduAg=~<EN|MZ1Zsvr5fp5UQ(1~ZIr6F_Qn(5No-pZ;DnO(<+oLC>sxi;m}`P6
zO$i35NnL;}&k1CAj30MM3!uGf0T2EXQZ%h$YcWyic&(INE$iT)L-UCY2&nI~3UTyp
zwWf4R8&xH8qFM(Afu5LvHUBJ4TY27zH~6j0Z1+~f*<N9lZ^v7Pej^1Zema5p6Eh<D
zZ1S!cFMg!3X%iR~I#Bj7oVwyqeQp}MnE*9%+*q0hIc=KSZei7Ih+`L9Zi|^08fMx=
zH=<a^&a!3&;N|=#s0Al$<Gd`1+%5w{G&Lx%p%WB(ku9`W(%?THwIMrwJ_oMO9*N*F
zVO}SSAoGR9A&{D(eu-}HbOzrys3~M~x87JT?6p??s4!70&bwe75xGlCFNvjC1}u$~
zF`N#QSPmmVA|3L4ZRr~S(yq;Sz|WqYZ|klFY6x}syVU&8HP$i)vl8<M{MgF!oQ(}v
zVla0G@T7Y&qhMsM-)!j^<x+u^qu9_5rI6m&coUN#{^-5Y;de%y;yFMi4PJng2#7NC
zMVQo$nufL>oE0V(&%%myM8E=`n|}l3jTX^Oa6P;7Aqh_}SczOB1gogBbS{|@-36`4
zP6ISaDsE49LzYm~366eWasz2SZiUf^3)e4DD`!hMrPJ#<8M2_bX{!Zx_{`eoiHBTq
z1V8OxHv5pc^p<C(MOMs9(xV@u-4mqU(~0HPy~$TRPc6kl(C!1y4Q*^an8B@yWw)Cl
zw2Zma__54<0S)`*g$fr@(w<%Cx1EvvcrS|It7PwbrCi&FTl$1oyieR7TXq%~F4!te
zT+RBB9(sJ4VIGw9Y@T)s9ii|q8iNvF#6eYhZ~GObf=~7jL#1@ANon~ixp{}1>S-3V
zrkrfv8w?&tXPGjCYfFk;emVUXmQ3kZ*g9q9ocvU#Qb_GI8plQSV)_!c7{tBj$ZT+@
zi%OsifX*cmT9f%{$-}56@`ghNy6umI`&~?bhi<$uaQ3s!Oc%)9Ayr;P4}}=vpclw(
zDC;MCL83APXy`6)NO8{WM6ig(sg-v^nT*cHkeKoJX^f}`@0;8g$TIf305wqe4;LQ4
z<)eG&p$SH?3vPpiDeNWF(|XQha`B(D-83+`Z4XG0ofvzhd?=(qXMni`2Tr|1e#BGY
zRUe}&#%7OdO*Cq~??pie#5DzxMh57(luk*b476Ox*Ak#}Qe<ExJKU6x*nVG*z`Aav
zX(ces2q~W+it`OLgC%`RQTl!1H3>p?Qgee#a@Y&-r&|jNotLyEZ?XghX_QA_6P%Z|
zl!-MhY0AFX{St+gmL^kUomit6!_uPV%|bYq2E7s;x$jGl{dM@V0J-HYB|0ylABr&g
zQEVt%D-L41S#tZfi*ke}#xvb5<oQ@Eud_4h!px7~Zoekhub&hbZ{up9WlD0QHZMZW
zXI|K(IMBJ*r|5Ihyp~DlS!x*Rk^i?Y9g{V6EG>#jeQb_Nx*#g$j4C6710NvLYCjG_
z^%;_LB|a1&Gw!I8eJewMGF(|t>N~{hTi((VWVC@Vwwz%ZynqgBYvS3x$(aXgik{LW
zMfHr*#IED(dCEbSl`_rMl<U`agpa9r?u)=ECUg|&<M}CCOgDIZ(MpFyg+8S1tg~b>
z>Km{P6?yJ9^3z7=b`6RItv0j#?vSK93#%73Ex}9b{f`O^^^<7Q!zC(HEw;<YR+W&g
z0xvDZw4QtUIO6kPsq)!iJ3u#!4i+~GgjkSj(N9VT9q7zB;xihPC-{?2AUxB=C#Qo*
zvFXb$%5DJ-QiNHslY*&1RN%L+B}E~>oH2`AOND!hS}GZ`*o&wbBpKW!{K|`}8BO>S
z4pN=d;PhB#{O*~1;A5)vQ?I2%aB|b>UYB2X{H*^E@|MwqX^WAqNpHM3mUzmTqT3SJ
z6xCJ9n&K#ju#i(UH|pZROX4MrR7XO+yyyfP>8H;t8&0{VkpbR~h&Amtw@Dw0&mvm;
zZ7d;to1i<z)KZama5ut(mG*Y=P1?#1O>{M@GQ2Mrcj@-@Rldm6SKpTop&Q8!!NQE@
zBc|m~4ukD0h)yq2nU~O@CZ3MISSXwiRM8bBmYL;C4zm!>>+UWxX^?0)gG#4Y%%V?A
zk`onFKp9+dGU1FVT?Kc}=@=uKmi>E0usOn};j6{2c9IDBdgeOYo#R#kfzT*~d>DfB
z$pB-bF2Pgb#9)~6!;Z*AOOgZi1RQZtp)Bfr>@$hUKb_i;^pYSFa#KRrYaMNYm_Kq4
z@CK!WI8j};&5@0fHV5-d6$=ve9KNs=^r*mUl9w-s*_*Rh_$Rie@R0>7-lan*wx5nm
ztRg>1ysT7@ysaz}-mW~EUqvgO25d<97R!x341TA8S>ew$`+o{CD|@{U7t(G$bMTs@
za%z|krGA?7Hla9$B^lm!YMvUi@ww*v1EaDX>YXK;5eG6W?{Tvx1KUa!&V1TAis&4E
zZmGp2ipVmo_!H9f))n-?y4HqnS29f3hkIkj^y5gpdAmj3lI!-#S$!N>d5`y%`8gWg
z)+eXu_vX!-TRIPGQKz*#xCcw6!6z&42JC(=Ol9)eSv^dbkkF_ttX5R(@v(o{TcB+E
zWCfKKXK~AA=tw!=RgDf%ceYO?Y(j!vx4yr!DSvN>o+*nw{QO8+;^3B9e17X4kN@Nw
zmobZifG>%qRz|TA_BElCB`#vz`djZ~G}Gy|lD+t<-{Bg$tumJq1-W<E-_wZ4Db}@p
zx^H7#z<z3Kp+)Ka@x}J*PLY_mru_NgZc;4%;WtY&gV5D!rrzcCh#G?DKywzK)>h4!
z{nlXFI5U*@al99iO?O-up7xrvUt2uy<F$j^Q+LCag==v$$*2+5jV~6~x##Y%v`|MR
z#>uAN$8UckbMJDg)=?kl=UI0I(M|HY59$85%o+^Z8_w6zNZ%!^hL5>lP<Ex+K`u#g
zYW0P~isi+?ru;QOL(tKUi7+SfZp*?@r~Osubd98;M<nte1X7LnJ1xcG)X@$II3Icj
za5fi5U|Ql%;-q?s8IRfuMt1mZV{r&UaU*FZR4eU{6i(rO?VXO<aSE!SXscPtxevEW
z;+(8t62rs_0~LZbPh63YDx@(~IOa;HoWJz1vMq9asrOjQJY9UjwqMEx>&`E@EsWUV
zjc2=><bJvHimBk-2R*~IZR#Z?r`k?5G>JvZ8CDAv51y1u4R&EtZs7RelB)bD8G0f>
ze_H&(kPf{hD4p`3iotWbi(F3Z#rLdTgNf_0bOs(Nb4nKDJTVAqj;4-I)|?a1UQT~K
z#~InQ)CtjmPTPwLInmE99>;NUvo%gD*Tp6&PR!Svj*-In*es-3hVl#RJ<@;bc)Ug#
zAii%O%qnSjST;OWq+^GhJJWhOZna0#5t(mrdhcj<Q%@#H{&0(BR&4dpI~7=rg)dO+
z+ZHPrsJ`JL@X9u}Hj4MUuL`V%blOaej*d0k%jasNnQ1xW*jVCU6sNS+-)o0i?&}1t
z!|wl~l=3!v$ns=XbH3ThsG{{5f13(l;)1fsW-ZFpDAAG>zj7cjjG34r(}*zs+6?l|
zc4rAUV!b;W)k6L-kx8o!Cubif^(={kgVV(<kF<O2gqGbVa<f?t-_F#Xsynias8>Yy
zk#U3JfzxEl;?flVMTVn?Cbj%N>k0dZ?R7nm*y0(AT7sRU=%lG8={T`=nQ^|Ym{Im_
zaF%~pO8Il{>%-oUqaqf<c!i2@9;KO%T{a6^Rng53>#i!}r(NaZc!1Qc_`WQuG<L@6
zWDWBg_OwrUqUL0jH8Rpstz+LzL{E2+l0P;2!@Uj^p4yJ1m*hUpAKXAPqzSaPc(*^g
zOLXvF9B04y+w#(tg;S|}375)uaQ7-S^(*u%T5tl7AmQcQz{3<+0&~6eR)Gmc0*(xy
zQk_($!!lF6YH7B{e{P8{0H|VHDFiwK<?L<QhdiX-IwU9oiY5na93$p(>NJlr52H1>
z?f4D`(hwELGru87cFukXGns9Y#|^AkUQ4t@m(Nzd?rg}l#!z9`bDOd*^df9$$Um<C
z`Yw~}fW2qql^pA3%Fl5;Cti6hjTgvx6M+nE_gbHoU(S$}yaD|Y0jHC#a?{9ljBA96
zj#?=!OS&o~U!8bWpKaf1eA=i{YIeCnqNq6+S4!n4vlr^erQE2e@wAV#3f$e>h<$h_
zk@yksRxD1=e-K~t!#mf&_E&!8-ij4CoopDXMw{y|qcKeWNh0v4N>jC#{QV7=%wgV~
zdy|(Ad5?Z-H&D_fw5Oh*YPY?)(-YCI1>BQ1b;pP4{Bq*9bvLV3l0UvTFD#65W{{d~
zp|IEn8Iz5KOI>lJB%)4vcFIIqQ^`D>*xP$1zoTI0=qU%Wr5<`RV-_%^hb%11k%GM%
zEPX$IP})mKI}#bh6NsPQy-+omUtmagKZA`a&-<@*s813gZn3+M!60E`_=vXeWQnY(
zBsUfAl{1Q(Tzn}aJDVW%A{IWZKKc2ewYR~T$d37XvVK9}fk+b!BQm3zT(917khXwr
zRP8~7AUT)(iGc!Z<BELfeS7wwEe~RR<%1aIh)ooONgl6~-ytUvWA5X%nj3kjzd@AB
zC_s@4n14INM+s-D*93dZ6QvMTR#X-K3}QL+N>WXjy*`9+_`S%YqSmw&3n9NY)|+7_
z1?=}eg^^~qN*qi&Ul)C`NG+n>M#vW7e|l!@tJ~z~TK9HegkkY4a~l43R)ngXpoNC0
zKZU^j@N&w1j)pS<LKWSpLgk<vx2`3X)LSlyYB~`0x_FepWYn`8MLFlN`|)i=FuAF(
zd9u&Vw!7Iqm&ieedtkgAneKvi3%1~=Fr)|4t|4vKh6CCx2H$=N;BqKFsw<9)a7oe7
zF8z?n?c?~h(?{r9E59Gh`njU?ZIJ{cC2QHip90^yNu>uxBBx(lk+5>YoNgMfw%=H4
zTcRKSr1NQbl?g|XK>IJ$(~p~_&pW?FY<kueoxvBgQKgzDG?V7lBYtLblx&MZxq2J5
z9q{pErR#Ub!ImRO)d|ZcX{`DST`8kA4mToh&%JIteWdd(Js`;>ir17%2WhnHJwsZB
zjCDQC;3GbDlOldndxVIeY4H|uX;HhwH-;%itCre6JbTAI8PUqm5<rq4x(WJ36u3<y
zMp1L0c1;YciW*%;vzgK^<yNh@h$5|h)V9j+G~}K+=}~Y9`vvcfM(4?`c1<V2iBbCV
zg(3U#OP?D?j<J2^%lvE}cso=%;G|g3`CjoQ682luD2}uucHS|&wD3BofJe_AZwMt2
zZKPxJ+LMlsvZxftskNV<o0KB@c6pl_hm@sWwS|?cuUB6gztpN^C9ynd@+Si$rX_v`
zv3=Ojj{2!l-YD+);vi*GJ5JB$x)z<h#oQju5VsVGJbX$zrEnj6NBai+N34yXr0yi|
z$(qe7)#9Z+9+Ik@yf20%Q`<WVvf#Jf8p`<xDF+pa`I}YQNHMlPdc@X3r_VyDdh!F+
z^s&Mo*q7rqlqEeZDin?wEeUhuW^{P_)4O;sl*^7uF7WO>_O!B5;qyl+VsiWZB0M=#
zXTXw7!h<kVQMcs12B{IkPE>xwUx>81w%{~6<*xeASeZG%(<p~q7V1XH;{k^ry_GvG
zZ1UqxPPTmS&D!FX<^!K(u&usep`u;sD(K(g2TQ-fh%?2@P_4$VS+9*ehAA2?*_Dc!
z5F9XX^5|~5U{Vm`&6eq~-1gKx8r$YTGi4S+?CPbiXd_QnaJ(EfRSTo2KMLUliqGDh
z>p0=rlLfvp(u5b;RbU2s6p?u{&8|#&ah~xW$%K|6c2+R2oC9OA{hv?FI7SlEy5pJm
zL@#Gz%%#=~(y^nR=%|LMbCVzIb83(|@fOZEP*unaE<!Lv$!_8tT7+k5iHFoO>2xxq
z9-K)~pa&r?Df2!vVvmYLYb4M@slb4tK7V7W3Nwj1PWUevG=l@mc2_FEmEcvq1RTp^
z8DzHJNUALE3JC-@>k4)I3-Zi-L6_LB?g}ubyUC^S#r$-`LlM4BXFA<^vK}f$=wwON
z5FIV8B40jZpkwbw3DQ-BntWcFD&w-F{m)r^C4WJ5VYbd=5@Mr1^t0Y_CmJg`TfTG_
zzUX`GjD)R$D0*Du#2>*tjq?Ytg2d)u^hk2~uO(@QHSM$#N7+bZ657#|6th<L8vCk$
zWmMxJ6O6T~z{i<+K!v?+Sa#<4+22S_;X1h`+?c?xlh_RD^>%*my;){lF@`k0dRmBN
zN@Q?SAWF6Qou}IieW}5_oV={V6lC`oQ49?{wd+HM-!U#L!iHf%cd6%i>TVAlb@>Om
z>h}o_LidOlQN%5+c(_;dOQYjzwZVBp*N~Gg=u#I=2z}Lxt!E|vXS5ComK_@TTs;v;
z#k7f(Qn+4q{jNc)&&}-eYds39WOP*WuQ+^Mw=Z2pI=3mZKO~z-u4k1mi+r!?KZBls
zmn)hUFlN8toTZ%cj;2TI4x7fRKu>E4<8A$YiozI+NdUSj2)XY#HAzPM48Qk|l`^W!
zz@%h-r~MbMzWk@JnZzf^*NjF=L+9AuXtx<MX30t!Z4o{?Gxip(=W~3Zhm^kJQk<5)
zUy?)Dzzb|jLiZ*Ts&2SkNvAkuVi?l@qDtE}Mvhv>j$6J_kl5Z3cKY$gX?_u?phEs1
zV{_F(&!09+AEh-GMsSISEHy3ppT43-RmTh+ww=BA!E}u7C{KDXM@w-vw^^Po(=d~b
z3kVj9?aG?#W7~qH4v!p-t{m#~7PAs?`D07Tcg)6FJ`ka9&5iW#cj!py1YPb(Y^_u!
z9J16?mZgt(Xprqfv%Uc~{DfR$O0HyicRKW>JU(Q_-BN|-f94gFk<QHA1=mA`EvZ~p
zAoXseazL0XZ@j+J7HcB$<KPXy{6`ZyJo)YRAHh!3T{?c3PGzNM8=eA49#3AT7)Q6j
z19ZN|7uH1$$~Q2RVTeblq*yo`5#WSkTg3{z%Tt@!X=0{2guipRe^}0TWWg_cdz5E#
zTclTNWzLixRX%&h48-2%YOpi*6P+;|4sTh>9;v{eXo{Js<~)8RMcd`5Wye^%S*Pc_
zVGiuXE9{vgf20G?BoEU7P0c1#nmbKj;$Rri`|;v(K+4BHtJ{1kV+wkQ@Z{*(&D8dU
zL5rysh594yQ=pqYZaEE4+#*e%*v;e8&A+iEC49>))2;SywHlg}w^&N5U1M4Wwytt8
z^Wy5c>LK?mDsbuA+^Z$Fh-atHm(L&OotK+S-v-{7eG%sA?_%=+-mspwh`OGxD=}9k
zeIk&uMB=;EBI`l9&9}~UGSEk76^)-18}PTMRmSljp<^kC98#i}DZQ$n?zFeW_z&u{
zkeR=a4#W$``gt<fO%p+y7sKP_m1h=hX)`fL4&yQ03{73SBVyWQrNlCuV7iZDhKt!z
z+zms_xx2THF}&00VZ6Dq7`h0Wa#G&Gn+uEO`RvcYD&dfH_{^$-bMXs2n_qXYr3G)P
zN%^pvJA#3lz{dp?>IyoPC|FdLNe~ZMEJBD){DC?`lvVW}p<mD~4UTfgzK3)%IG6&A
z<$Z=kF}GQqMT(ye1blrXaQ{&*Cgo523VcGYW#^-T<0uaTVaF?axK8Vt7cl6};5PeC
z${jD-?(2To*J{5?ESw1+Ekvjrn{d)UwJ+&p@g7(FGK0+S;Cz{B{8g%rIYzOK!R$jn
zCe<;iI6t%8H)>~ux_WHij=4HXR#GCfY`W9^MSh0N?-(kj-m+hSRVDf+V3peaWYWV&
z3bjaWV5v!r5cC_2?w!I6M26SgvT-q}o3N0gkAAiYZ`?wUtVt@7hJ)5&;{%98+uiCX
z&)ij{V+NcVa>k<(w~FZZ9g&1=k#7%bb2{6vFmm^fJH^`#bMak6)<P61IH}4?UDR-l
z{agn1#V}7=!=UXTAM;d_R2Nh&+f~6>hehYCB$+#4*@6>iUEmY=nu4g^DGXupiq$8U
zK34QVHEBR9S|%pC|8MgEWg4hnJmWJT%3~ytCM^)zwyCi4KZQM$1ld>sz~Sr1X5XXH
z%uzTv#Cw_&Y~2X*yY;b5nN=_)-TLQrO_vu4_zz)aoMZe&9oVZGvxRS9=tSUijnl|+
z>Qc_>z`F15iF0Qvh*Xnx{O$0VGTozy`y8+z+FaD1uL;t&cDD01R5A5^Qv&z$&-oE|
zpE!$J-ff$kd@Q0y;+vt0z2Xnuk0!{=29FDAkPHp>EXfivRSq@^W~h@PLn?|$!+6i>
z_}48<bW3)-qThl&EBY&NTfo2`RjJwH*te|2`1%vThdt72WMV>Ie0$T;-(eAWU^JHR
z`&k{I(I%_2u(}@^uD2(Q!nK<h_%vR9<C<4Ma}pB&ACiOL6vPuaI5N=Y#5iSnNOJk;
z$vbw-#Fs~zu;=VL^bcA3NJ?TMJE;c(*17*xua{8)g?8)Nepw(2<i{Yo-1R{@(fem8
zTeG*dL_Ux=7Hhkx{8LZ)E)VJ{xA)@5*)d-Gzm)fr9UvUW-D~}^5^C=d45$K|vgJm9
zQw1_6pgQJ0t>&?U@l^u)kA(F^oD#M=fQ_0fbM5&9){J^bB9C>RizyPsLP7HKpB24)
zqR3hI$W+B4Bc^^)f#cZ!luLntj}^S0yE*&6a&hP}?3lriKZ!g}{I6I0n|}egRf1~Z
z!BGfJxxb(8Z@0WZ|HL@3P*Kr$`pExxx%j_{eHRHW(*O@*F)`2o-#@%84*a-cRulHm
zIQ{ZPp9Cn&_6TU;{6Bm+2l%mFYhKrXzwLj%&Tt3wlVp)Y^vh@d$*6(&JCK{&c!);a
zZ*<MS=w-kY;bxy8QknTbANb#Ip79C%xQsNH{Ws;?U&I@~MKFa{X^9X1g{%e!S4JQD
zF^B5o-;~*ZKU@znAb>~+#Qh762aK;@1tdY$O8Hk2EO^}iJK=wi<1aJ+e<%FkH{t&W
zJDd_x!Wnuu7f638tFN@b1N|8JA?G=WxPk}NGpj!=WA*w`m{ox_GiNL42%-zWZfHL?
zNGl%4JqrF$GoTRAMACXJzcT^N4fCU&yEc6wO(WorkVA$4tpy%mQ3F8I(5P3pmPHc(
zQ4s>o9}kL9z2bo&>Mmb$$NsPL>(34NjS(Dj{=GmYNq0FC7@oIgf#}!`^4NRu3@_pd
zF{>&rq@ew(X9AV{0Uf6K<?XdUxIjRmFz3!we`u<!g6oElTTjf`wN|tG*{|47C+nYd
z_@DLm5VF4{5(Wi$*-`Ms91##(#3Wp3_`~RJ_>=)eegakftAM@atpfy7S8A=gxxd&#
zWQRF-pd4=I1+oD=H>&4NY-&KHON$+Lc>vTkmLO-DH;^OQ46vJvJT?SGBVMEgs>SZ~
ze~+I-(2id4+$_og(!MFfc^MD@DV_mxyX)9^ki((KN_NbS#P|nDJsy3Rr@nc14Wdnz
zEgk{yG+LldB->0@&r*B?%<e=}KyiBps5-6zw#N${z~As7jQXtm`%Ul>97h^5F-Okm
z@sWD6!`5?P)`|z(f9g-B0UZa&gCFn_?;)>E&*^J}YSP{i&nT;T3e<B2AQ{=8L?+No
zp1li_t3cv!CpmFIFw$uUjKUjd`;`rEfCY#YXx2qG!(oJeppa<o@CVyQa(|SGR`FJ&
zsoyT-GDZ#9A5O>O(`Z$oYq;D5s)gN-?KCg^A&CZO-R?ktWiMnFh{`_K;f81~@*LRI
z1kO)5v&I3hi=!a49*`>nf$EjX;Ca6SL|`kvS~YVcJ{WBQED>w<J|6)7S{U&zXb&f-
z_sH?n;c+6M%Ave$Qvjc82GDDQk0IW=%o)VSnE_mGT!CH@GaXpm<0i-)auE>6LY|#1
zLbi~9sDnW(O|yyWHmLjrslsb5^4z?^+G~P%YB~XYGGDaytln?EraQ@C$nD;0nZ9b(
z5=3YMRH)dXAu4|5<TE8>oN=JPU8$PHqLYOMdvRVjlc)o1J4hdIlIk*y6P5?|V_s%Z
zB+chkXL@RWMHBfi4O?$`{2_10Vtj%-sz4av2<Sly@1nN-q~8N?%Ir*4-#av66kQCe
z+@%P9lkYAg*MTxs={w8@45Ra?>x7-zah;T5an8|lR^;qw$d(c!qpMflM_KCszAik{
zUaGXj5n%wKCCR(w*=gnkgXposGqfl1_2`uIF~PuE^fp9xN(PL*odd&29I7#<NQp=4
z`#>yhi?|Jp5g{S&rba-?pDu-(o+xmtEG#rYYR@rntQ2^igSt7~dzLu8W7=~<d96da
zs1sByiBSmo04eu61Slk?pB_)2N5G`eooZS=7Oyl63%RJef!mQ@(ujN^0y98@hl=Ia
zg1gGiPG$P8X-{!mHf_k8u{1LUhbs|B-+Sj#n|zin;Oc$sKtk;{|8_$>e}|AylY)ha
zpMh32OA9JGoe0yLzMJa{dw>`D>6Z1dE+mD5CkCk}rQ3J`Iv;!2;V9p=LPVx(T>P9E
z5|~0FT2iIj*|c3%SS(?XR`z&4_j}3`$N~y2@0Q>G=H0;%_>`q>-UX5pQOxzXv{<*6
z{Szeq9gKJ+U5J2zK{hubV2y(~XXd@H=CZ#jkeA-P_w39<fYcJ+k+g8fTvc75G^rDA
za6In?bz!}=8e<zFAUgdtMx_L_FO@D`c<fFQLHZ^%<iXi-4xwK_4d;NyK19|V0~D$r
z1gFOiDmxSJagu_P52AptL_<}S`A!v(ufN|pHGfZxjQ9ab+&PurBms*g&JE8q^paT`
z#G>P|&{8Nqn?BumF=n1@N2WkLu87vOy?>c9Vj>!T>+{35<JYHTCLC$a=fK>+6<rN+
zF4um%#_vV&s3{~u6Q3q2(4All8rcTHma+a1dv6_7^|to`D}oXt4N3_}H%NCQu?gu-
zcZ0OFlr)HRcS(1rbVxUXw6v5oylbC(@AI6v|GhKs%scbU@W+|sX7h`+zO_CP%7s0c
z;G`(7eDRFx!2{w7DKTMXev^lv<7pP&AmGmjAR0_d%tZoN+)%OUapTYq#Wjcxv1&&^
zW{?A>38^^C9GZ#j6Ic<I=eS3rmDrYJ1#-vm_$@f)M_$@2;H;vM#PN&>ilsauiYCQ<
z8=(eId^hd|!xJUo7B+;}ztLtyCl#UjXVIt(%4|w~!$H&I{$p@Tzkd@HN-6surk@J5
z5DSI;KKLL6QfbmEk&df7QV1%uB-T<WUV3p1Wm+snuqqaiRkfIlWmHfw;KV%-qLR(H
zOm>>qp!*_5t#=Po5}m8ey-8s3?nj8Fh*Kv62mpqF{@t&%<PgK2u>Qzf5W3~iRMdB1
zzQ~sq${7{L!ifRsBaycNmN>L4(;W&3p6tt!Bp)e0<-<^lf+mCCJX}m<s*i8q$zx@G
ze9Z#@U=yOAwLo#YD5tutKP7~%up4ulBju4@Ukd%!8QChy@w=x*xOM7eqO@JJm1WIO
z2@229<D_7+k2Z?6$GaU#G!RBvdjU=S_?K<~2gLdk4bhOX5uAN;FoN*QC5N7E)vrn@
zsg=&4LDyfR{g>M8j|7VTNhmt((aCv~yxs(obE7h11u3LZs0x6h@&i|EFDd$WyF_}F
zc=`cTuFliNgWa^K0ll*;PRhPyGDt|tit|iAb`=iZ;4>BcQ#@39)|kVHG8h9%t2978
zIu8nmI!$#KAE$o}m{CIudIEaKUkimCK!n@4o_i1CjDtXsK^n;R>CKEM!D~$?YW~D0
zPSK>Q4L=Nlkm3t^{*Xc2=a0TUDJp={;FzInhXfl#b<}8obH%fwq=GpZ8&fo6R1v%L
z(6X!!CC-Z$esjUgv*VD9H`hSAn0+Lvjo5Ki*frIB;pA!m<F&q$s`Afd8bSN&#Fm6T
zwf_)b3=+}>?Fk^GTB5}HF-rjr<jd@gANA-8<*X~uWfI2w9r=A83z7)1^r8jkL!+&Z
zb8u0`i-^j;>T2Scae(@z*?MxNpAc#5S`dH>jS&gxjlUT4N6FoU;<D+Kacg}W%CxVB
z>T5jP;@oPvY#8D$F)jHetb}dWw?3GHuF0pEUnN)88;Pe|@zzd|X7Vd*%IQeT(Ppdu
zua38LKo?E@_l7kcv_*kQCJe}N5yWSZ4z*Ki>%>53Ch>XIw4GGEh#d&O=l5So9XtPU
z4|D|3-mPn{G*-Q2inltO08#6j&J)V3ju|+WNY(QQ7otv`dmiy}=AS$Op*RS;V#-1D
z_0q4=?8rbo9gndr<QACX;rwPyI29Q#MrM#0HsQ(CTg6$*c$P|3-e5*CV$88nzWL7@
zqwvY?J-2s}1+tVEU3Fq#Nh{HV5rxGDNE07SQoW754DSExmP{e34j9OWOO@V~Dew;V
z1ZatZiSGcrs>`~{84*UuT;xDW(u>{)N|7A%X4!mYNcb!R(Jx<N;zVUynTH>SD0&QK
z+J&VV!HKk{qh>uy3_?Gj^XHQ|kb3>jYc}UBw|9;MgF4dR2$zoK3+6Q>BRDE*_O}>0
z)efsZ1>f1El3g7V9t$$2?a&T&LjC%jjBYTGQK#^B#i|@uhHo%+_xDS8GQq?Q%;jVR
zNcjfzl7(YPUOp_Xi({-{$ozHk3J{eDj*6818G2ZByS7;Eqinf{K5P#3CW0=13Pv*H
zy37hX{7RAR1&3`C7_S3cJBpk5WQNtqRL10u%~xNKd<+O=Qg)`6_(bNb^lH0ZG!oHv
zjz9Bn#VxZFCNs(%^B>BJp_@&on4y8Of=!*1u9*-Wl^GN^#Mgj5(h~6AD|>Z3@;PVT
zs%H!5AB+K@wxi0V$tU-G8wTjJYf2L`d}e>5Fk!NS0ji{C_0nnb<fogn93OK`u7QF9
zN-bgV@c1N>&qpi_j^xo1T+kfs@P~0=S%=!-3}xCZrGcI7iev{NtL7xlm;o9a<)G;4
zb>pLd?~Q;jmQ7dI%$gQhKIhL}7Hf5>T5cx8f<oGbQT!zr#wpGV8v7#Tr(h`Hv}*ps
z578n>&)=AHFqRqU4ZSaph70HZ@N5&EEA0vCr`F;)fbB2QI;Gnzq!`6MnRa9H$-^Zg
z`b)v>QyAF}+`v0O>OLpU%u5~)`quVy+^S6RNl%-hJQq#VS(%GTnXDUoQEgY=d`(iU
zOzUL#N4M6L?0JrFYRiCUpsw9QA;%?q<`%TKUO3H)b6o%O`M^~}v(*s{s1R~?LY&TU
zAmh)G+p5c@V;QW3UwI8=Xvy5u#(A!rx@gWwji#k8xji1qQ95@E_VmGM{MR}inbu=?
zpW-doYhuBd-<{<`>C5PTpMWqF8=0ya#}zBCO$+oABNVX;@f)-@{-!vF?h}W^{L=8R
ziij`S{-ubBK{+puO?b&_$8`OQuV#xErV2r$<YNM=$o+{hm;$P6BIv=`1=En(!~>fy
zULBqMILXto$QN<|LEF^dX44jA`CW&dZaiJSTGXv>#HVR*1HYEbU`4n#5NBaD7(xZp
zct-Zig!~S%wj>IEv8@>PEmQ#X>_*^QT|xh5M#_|v`O50m1A#+;)*t@`4(ltW#Z$}K
zchhd%z-c55x&5N`qh4T@-n@z|mo_DG%s*mlb@BrTw_rAH{O;|Drh|Uo!=2sx@xzK0
zegDJ^-0siS$1s?GI`aZ+%zJ7aGiuvGCxdz;!fVW_egr>&nJy#SbD$mlk?|X}6aDY9
zECs|^HLs%MWyC|P8Md8y5%5#$$5rRU-#7s6PKm*1V)3vd#<j_+@a??+Q>sR<lC_@j
z(5N&Wkg5}?YUbM&k3j*JjxkP%g2wcf?wL9NRLH6raUGvjDm)<LUpGwX&wBx)Ko|PD
zn4xruqC`0UMt*Q}3#$4U$@q__FZ4eayai_K!CS0t0x(TORe1b)nKw3qg8LNo91&i2
zn0wc*5YbQhhWTb^(L6{tlfEB!xqp0kbbO*uWITAwO2$e$yALGR73*09B{9thcyzD-
zHuAcH{21#^AKJPcx^!o8%0(Eie-#lyG^0ECg69UHocpQrWIZe?x<Y|wG08||LNqcP
zF$Q(2deyL3=gWMWR3kOIy44UmlT9%W2Gz#za$skZ;0^<R&83rp_6jbp7TRjyrCXsH
z%Bsjw<FE^4$gf;wA79%nlYUwv4T@n#9s1m_;H_0?8z)sm;^p|!MAr-(U)`3BZiP|D
zK#r<~ct)mx!>DFW2~DzcflRMl6FfeB*mT9OAKOlNb-|m;OzZ9p5`Wh~B!R0z{JRKZ
z6g^Z)fJWS?Ain(5Q7~N`0&p}@H*}~?(scP0Ng;i4L7nILIot^zmqv$46$dPNZHebU
zCEhk6;D3Ypubbjx&=LS<&=TXkX;c9#e7u3k8|iq5s2Re=&AIYEJ@Y8tS7ajqLH{W+
zd&%QvoNO8ttS*>CfLLf6Xw_)S2xJJZ@{-y=Z1e+Ol`bjym`*6=l!9P2?I_6=h8rJF
zEaJA;&&)s*`fLZCWzZQDLE<7(K{y=j4WX$qIc8o+3#>&qAd-0@$aHJ;tmF@U#nXT2
z0200WAz<z{7LvD{#g*#ZGq=(a_!3Ferq*2DIyTmdnA=zhXcsyZ5TpU(m!6CX+?e;k
zTkwC#&@isv2UElq5Rf$%f0NsP6~<0l0<l8gBx%?*hZ!pHeVGL9*>|ckjV$=%gy&d8
zA~_>R&Icrm=P=U75I*(CXqz0H(&#?T%`!@fw-!0FyvGS#m{zVzdV2}XlT@;<yx+!T
zi8jl*5=L=`wiMFQe+^G&H~+m(9DVvvMa0A`?ew}`_$1K?!k3~Jhb_Ga`m>7;kfUeR
zSZ4U<%85b~Z@B*v=U|i6!r1m4HC>dzNI^z)H+Mipl`V<aaMK3jihG{z9rT09f`S(x
zXl#rhC?c`tu1WL$O-To~Q8LWoiWz7BkV7<q$suxTw<e=FrV5=z-=c*ygH&ju@Gf5H
zHFcwK_&>+F3DSs9YhCY!^kao4<i}xyfeRR5+L9&kYexzqr}7$5m;VaWl{<mWzKG6y
z#}%^w&fNc_6U<`<Qy-=JNBI1nfCHWF5%V`u(?34cnD}o^!QpIGYrMZs>S5RBQy2!u
zSB%@E|Nmhx|GyGQ1o!-$4c^UZi3uf1_%-|#`d`PAuqUF5xOWsN7-*_{EBU<P*j|6D
zMs-)I`=1hufW&@rl~XMa6diM!tAVoQ4`4=#^_(t*EuxOfH>7XHGmP}1_&V;$17bu2
zvOdy~J`7)$S6S4G7?CU)WN?pGk?Uy#8M7pQJ&x5*d|vtnT~Qq&cF;^{hy;0Q`ghx6
zS;@i7*;R|{_X&p^x@||7?`K76`a2_Px=|01KK<#3OS?zjY2dC&Bl-j4>ztDYx$X8=
z;ulhfQ<*idb0!+(Mt+wxSI?jR0#pYsV`JlQjZV9#HKrqJZ3*mVKdQ|qBy_bK9qrtH
z?<La4%{Lz8BS5~S6A@57#3cFa4|U83L}nBI9o_q1I)2;eb_4g^{W4|SXbzi0cCZW;
zM1sY>^te>-wbPEW>8~FhiW*o_`9jf%(-(9lC0ICuQqynX$c6s$!|o@f@S&ri5{a$j
zG)b7$0lPfr1&?DvZCt->c!ZD2@ZMZijWNXW;KF`#+DVYXZ1wu1Iu=rn$PXZKZC7i%
zeBih@JGMQRElKOCm;IOT{zUl@nJw`&o<Va{%V|o5TXWcG`j^_%Vsl&u=(^snk}(1@
zTda6vyR*fBnDuOVM<SP9mID~s@Bl42PaoyaG(ga?j2Ecd`8rHMIJtooz7A`6`Lr(*
zY!3bHcw_L4j~`4m5oUUk-+X}o-=B;|j0~Z*be5pkc-oFpf|c!cpqDKh7fVX2JQ%^_
zW-vRZz*V{f!ol3-9tCP;X;m(VI$JQA%EHZyFXr>rg(qP0$@9I@$svwj15>xVm_`*2
z+svT5f8c-r#s~N>q~Pwn<?(CTg;OdnleZTesvH0#&Y}Wgngx?&r(JD$vB802z(rCg
zh;8<FjAMpSG}}tTP8kgr7{1w>Q$c``MT2uIHddN?kt;|q)j^KH#6(SlE?xbJ7KAQa
zNC`p}@tyKd?>{K~0YXxnqKMEXm;&BKFsJ>HHvt4N3E9n8V)z#&NGJu@fV%foCWO5-
zulV{TKm;YpBbY@HNtp#){+C(*a^63`o>;jI1)sc`7>%n08^W*QMUBK?Qz2R%V{=?4
znw`@nnl&{~=?y=rDl3yq$w^5CpR_+hdw;ko%19QO*hV&jZAL4?5WrgFl=W6<n6d~7
zJc}u#tXasP7OYPfA~x+P{2(5?`A@4v9>$70N);BdIO~Pl097=}widUuadUkE3)z>i
zXDO#@trte!MtkBIG({#>LyBv5y;O!fe^yW+tEIrEy2|ld_QCd^odrOe2hyPF9<$r5
z2Gc(tIQyD)b$(d3h&DRE4&<$ifJIN{e4TBX)|n!#dEWtJ|F_q__m!0LWXGJEzG-@H
zjN#5ZdX8PJZjGdut=Tqg;1adzb--=7EvW(qh%XOVP)==&FDZ2sQ+ZuzXXL{e)u7NF
zndtb{RfAM7Ft8}n^}bcfs#=naAS@i@12orG5A$E2IXdi4Hivh>Kzd9TT4S-XOQ16_
zFc4Gppa_si6xpq26&jX$rhqJC5tvNnhc#nXc-^{bn}Xk&0t}MUBzDU@xATJ%)e<O$
z2I~P35)Fm39de1LgeZfuHFj54BmAYH&WNXk4?PC!p<!>tS!)M4N>M+*2a|0Dzb9y_
z1e`WcOICbQ7!?kfL^gOFe&-I}K+*-i<1sPOsTPl(gdQ@7p|;Yw*nY7eey(zRbv6a8
zmWoHIPR{@bHpb%pUt*2VB$6Ys+Lx4v-K~RrlUZofg=x{I(24AUWG9s=Q#HM@UASV@
z&eG#!`?6hi+s7yMr3}rEeDD*)F4eI{Zw$Vt8+osNSqLu58u&sL9PC@~6KOq~A?(It
z>-GNFV?9cec1GW(hgtCM!f=B&DD$Q5?sUo7Dv{G7IJ;@BR1bP}2dcBvZrI5T4{_%s
z+}`n4S3yuaPl8+iN#_FS^t;VYJClmZ9M;FV3|jT0z%h6$?IhROy@KIp;s=Gb^ZvXF
z%InTYok1@)hm*I$aa@5*l-}WOan-lC>E3q@iQ0lADcnj#fY+fTFr!~}9>$|}(i+Bk
zu`!(`j>7bE6F&YF#h?eshQ=y>!zDdgsx+3_;MqUkiMo0h_@?sx(P|j2)d~Cx;sy!v
z#{lrLDa$7YSuduGHL`yV%UlanCOipBeER3zMy`N^xK3LhbGT3@jd!o9YtrVxU>jFx
zF`}Opdc&VSs2v7xq%}7He<Gb&e;`$Sy|$zI`Ai|hZhK($<x9P6iSS7vLQ~zh!lU{Y
zj2;!y`9EzE2ks|_f@k<uGw18hDv;9|548_^@Y-Z(6vg7Q-~`7^;Tg&uIP%i&7}xKO
zAex6hLh;UliQep-FMFR~od6b_yXW>&OB3GxTBM-G;FFk!;{m#s3oT+RlzX=KiPoLc
z=HO5R*#JxIF_MBEOz__c%*M^=3cfeFSXz>HeZ@q63i$J^{iTQKvtnHhKv8vSAeIhC
zy%n(E2iWf?jG55@NWZj<kp8{G%PU{6_IY>*pcH0wi%L5D-EEyNdS4tKKjv#4yiDeZ
zz_qL=0GaK8N#NA}8~0`J`<61=1wIw!44+^2<5E=HM>Uo+at+T)YQ#t9Yb>XLTPQ#2
z4v;-PI`d=t%ai_u>mz~?Co-7NZd0Yb;C*U96g6lJ?XF+Qtc(-ZlzNQJCN&;jaX?Nf
zjeD;?`=kyna~DXw2i$R0n6W>qec2z_>bU*(wUpr6BRso&GC0&)C<4r)Yp3Q#^<#||
zw;D{DC+fo_dY0%{LHke;44ldviw|o9yz!fJAVD;nOwV3C5JL%~c)sh8ghf8zWD7Ez
zp&x?+CP`1`kfJ0}u57emj_3ow0IYEc9X6svxrwmH=u`BKp+mTZWqTyD(H{gJAl0#k
z)TfQ})207#(NE3~L1rsY>zI8PP|<qSL*Rs8?D_o9spw4xEjqQb9!<4}ir%}O!hARH
z-ofRQh9&LZwpLO-&NsD{@BBXf&%R8?Wn+}mxY2d_?v$woEYYNH?K(fhP2*sS)o;&M
zWQ!RuMtwx%)%AINr_>2o%hZo1Ju7kt4tz$pFIKul2vEG%U0MLYE}s2c?Js%1_-Z7&
z`0@uRcwty%;nusT9wj7b&!s+~z37@MQe#qX_nqnkreT{W;*VAyw^}PaTNw3ys47G4
zM@M}He=^X7$d<sV`E#MJ%m%BCepv61TSfO{=FlpQcd4Se-QyveFmwm&;`R7*;lGqE
z=KsE9e8Xq8G~Qpg+|fc_|ME_hA?o<O=8-RiMKuh+D{YWvbQFokLf;2AQK31;!>y7a
zKfxE81qDKengyaBpI*iR$0C|+4K8<nAo=T*_9}u)WZC`nXH=B!e6{)fC0&gC32QgX
zLZ=|Aj-quZ3sZeNDKjBYptfk>vnkiBv)!$u4?ieWCAU%>BHX~NRplK@RQ%lgc4yA&
zCnz*lXC10Enjc>4M^{|lfXT~Gg9b#lDwE-H>(2RJ(0_a>5PI~aJwL@h#0EuV1x7ZE
z7bL2(_4sqnC-E5|Q7CACYj!#C+)$aIQf_EVN73%FHTjFr>gQB*%k?{QaTZ!FY&%j0
zSy{OE96otA-y7X9LJ^7?lxv0jyxL8}xmvmn1co#i<PwpuJJ|pCZrbE#-*>Kl6S%fo
zcI?1J(rhPZs#WYjVuX*<ZgRdn9zaRiSrwzF@#C#+@6ebAXZVM_8;GiECITlfG|SNK
zG0Z@9v^rH~Izqf1QaP+7j)1THG;sFa7pvbmotXaR@`AUMmdR*;*_t2-V$+smLtAN?
z+r5vIz1t-DpP*vD!?aO;A%zA#>*c>ApT4y_X9>Qd9<5i-#=X}E##&E7@6LStaBZDL
z^NnZ*kYbjvuF|^sMF{i}cEA8-@F#Jx7|9|$)9W(pmGsAD1srx=+&wT0vI0<4n6zA-
zZbx@KdKLhVgv=2vUvc5b>GCD4H8^aUtj8k;>Azclnm_#Z@wr?o&t+FCiK%P+zB+hK
z=$~^?xzOUkf)s(rpG4J1l1n%WUBE6MePT5i-6|vaw|rUsulo`xu}j|H+$Db=@qr>}
z_lbtB*!OL6^}cTRe4(}DFz8Jn5?jJYkdbx~UgOTxD$K#5-ed#UF5z>T+Jjk--PtSp
zqdx*k);zW)ZgM343nfOEBhps_mcItg?`|%m#5rvi3wpu{wz%nf&Z8{*#4~&@Nw0jZ
zRnQSBW;Y8Jd?a>yiI%58X*`9>x%flFbS2T}PlYikTH$=CeT<#wq}iR0yeH$dn?#!k
zR0OIOa6*U96Rb~!K6w<ImQ${<EcD9?AmGPaPOdHkrcR%UM+%qy94@V9hAY5KIHmuf
z$LoC+`UY!rZ)(~!xDJ+dai%tbpkjXS_hOCL>F-GmE57SLe6;cqm#yOgN>o-BnYQiW
zQcKJF{zBa@>$^Mx+;@vStteW%Gi7LlpE2S?g&qZV6<`^%`B|rxLr^Zi(tlJSo@N=B
zx0?I>z?(<U*IG_r|3|w|qZTNKaOA2D{?ZruR3nKY(VMu%+vQq}J=yip=9ox**o~~_
zgo3WMet4a8SX-l@HB{eC!}u9#Cb~;ZoZ-$IZuoS2;tcJ9oOEYgtX{i0XE;9lxa%>0
zcOjXa?{EoZ6;D!m66mfmIu<FFk8C#mdu@?Y_c4(!#J#rKMJ5hp?Cp(>iAfMWPm>JC
z&)p4B`3#=`m&I^F;;Xc&_rd%5_8=H(V#q%8#PfOFnY0}QWj*}fr1laa!YwrP7UZ5y
zBwWV6$bG5u4@e&Y)pvL|pJud=^HJcSzOX-0ip57SmOuBHpM>V&v*6=ICMJk=OZT^S
z10|*zE*GsWr?jpUWLm+-X{b(iCWemIzecaQs6%2?PZ7On?|lkXsf@_mqbx#k8JZE^
zje`xvZ)Axj_X>0HF@1&|CfXI3Ui*V>9XXeOM>zu_zsIQKYsI>4t#05r+0(Gg9D;60
zLYrWYZqojkN~dF>k57VVn(5t5=qbi4iT7vw%Wb+Z2g5J!Zm;RMgOOg8^IHHKXya2t
z_Jx$E?y<M`!e9r@m1^_WIBdx=p}@bKvq4~a2TDF2d}6B;Bj_<ux_-42_|j{1gG3pU
z!lihQvA-hHMnSJxJ0z3LtnVv7E85n@nr}Q9_txL#PYuRH%r~(@nQ*eom&#A#CD&GQ
zh3~$NI0u&XgSymng<DhSHL5i^kwuZviQt0=5AN?5H-nP@BV@mq`lOji{IZP-KF5U_
z@olaj9A*f%&jaKjIB6^&F){e<xAY(UDYbn+1R;-$q2~sN#60lD7DZ|ad=sqfqkzzP
zx5X>Cd^<AN<bK6{zSl6~A#i@c-SoN&h%Fr?ULNosHs%<uw2SsoURj!6015X5uC33Y
zN8U1V2S=X)Yau6K)Tq|gaC1Bu4Vys{zT~h{uUxbrq<{(PUzFa$JQ6Qpj;3lkyz8Gt
zJMVB*)iVw5VIr=-VcrHf*ZYIO0S`T*h#qE4xi1Gp!IXQ0daWNc8OaATPr8*nZVQ{w
zJ_7SE-kdoAQK0+$^l=$<OZlNL(10=mB2F^9jeTUH<S>aFvN+Xyp!&?{3R=*Kt7cGS
z^aI#H9C1204UYz)gjoZ?rp7&G=qtqfcp>Y8L2EFv$sP@Wh>8Y^^mK^;OET^W6!YJv
z<m{MQp2N)66<>felSU(eB9j9RZ_BUm1Kx{vy{LWp1*ys-xp7chh7o`Pk1A-RvEAS_
z=n6WWg`J~pUIQc=1yI~DbCdOy-co?l^@0{B0j2_FjxQke01o}b19*}L4-tj*n30NI
zCTW5fR+@0U?OZL01aHvPs2mQiS~^edbXx9QforLB?>>ju$O6ov$z0`>n@P?&{rEuQ
zXIFC@!G_HlVd>P<#?)3UR255@{H)@wEkJ59yT%G-KP%n`Ap0bkWo4mWIVfUPGr(aA
ztOq84c|F_P*>DaD>yVS#c-RRv;Y`jAP#UlKu2LtCb>HzrWj93?14&(y*wv`=hc8MV
z=X0c|n7lBH3L{We;Ie<WNRN=xdVM6aPmN&^$^ZKesA3z~Y;IsuK=LrZ2cy!4P3e(b
zN4nB_1K_L_-=%2j#o;4iFb?YUG!LNoAg^rGL@IsS1diYwPG~Hs#J#|w2d1H^t5gB^
z&kR4`c7tmJpB}kmfWZ;a03t(5564%fM}eTbuec!!cy#}Hiax?r3NjxGofc`|UHS+2
z<5Jy|Dc)2*<}c?IeMs<i%bEbkEXH*Dd4^ILOvqbVV<GX7*?5znh;1bU99J6iAN~C5
zUOLq3*95SA4ZxDN$8|SELBKY6B~LbS6_%%(-%L0d6A!^TCB@@qEdm_cJ`k;IR*}|L
zITHzR2c6(z^U1f}W`u}j&=&7Xp92M6ZrkuR;2><r30Rafv6K<(42Fwn-WQ@<2>6^p
zW%%7su)a}@kFt_Ze3b}WRz`r~K^`atdKZDo<;!nlZyp2F+)Q^MD)uN8IQtF_0~lU7
zITho-*37?doJUUYHoLbW`K4>tDqp|t$eXqqo-~QQXf$B!5xt=2hx%n2$oaAy#3;!j
z+5KMj_I3fRd)07nfU9f-IH5L+6lbEn4Oj1`orHKaI0$j<<KHm2lQZyua;NR<l1hKS
zic|+q!~(UKkbAAG$0UwcNH1ULTn?vEjjs0^G5z^kNIp^g@e25obp<`*-&6s$?T=6T
zOD20Yztw~HpJllkHV`5-Asy<(V$H-JQ;Z2rO^CMQ*&2XI4z0S@^AMo@-tBo-r0WC&
zr=gqQ*i&tJj?b=;HUy~IRlOR;u3AC-^WU?;D4=Mc<k6wKuOv<f1Gnhhu+8jY_(KOu
z_38KV7{lbYJP@Yg>*P`~ETjrBWKW_<<Z=44091i|xn3Q0^A<QQork#tW>5;fNp)Ax
zHHIB4f+lDs80J2G?<}g{2IRcCckutaOCNv}pGi!;+M8{SgMp^QvOY>3I2F4Lv^KNL
z&*y5;I`(iaCYZKP5U-!lBOepy0#3VcI+oN8zqoe_vKIkO;^2lLjn;y^V-qy*_ON5e
z?z_wz1f9#0NTKMFfR_IW2jJBf1h&r#-pz$KnKZkvrJj%f)OffV(sbaUw&<D8dwA&5
z$ZeX~-*Q(JJy9>Z;TK11z8y_(c}gXigbeK=r+abRKN1!vfok%z#?`w{T@Prlj@zT}
zE!(W!XxjT4LJK3HcVc~156bRG#J`2zE+nUT57(a9zPq}AasmIRP4y6QQvAo6%aW6@
z|B*<Tz_Q~{uZC^My|cPyyU<}l+XFl2X95p_Tf41aqcpQJ!52m@F(9w-M@ak6zI=!n
zlhUq`dTuDJbQ~dbL<$Rc|NC#?KX1hz_~en7aD!hb9~Nc#=LZ-to_{&<qBn!?aFBoe
z$F~b*q{5?{%}Z7JxuQ;e+#z{e`OnXsKK04uIqdb#Gi@Y6@cHLgz%Ia3uYf~YDk;!F
z<S$nTdnZsbX63D0_0j4{>o-sTe);Ghfa)vBXmzy7lN0<es6h4A2=yPI`S}7))M+Ua
z0W#t!j12dWfBx_QC}mx>D_9qNW<%@t|HlPZi|G}7yOuE(cKD?)*+?$6cqB=@3Cl=v
z_^DlgUN!&DC#TPRV9NWR_q~!0U^d)<6>(*Eh+T|AK?8(MhosgPcgxyVo-Nrjao&5J
zI6uV5|4$zJ)2(L^!0UKzsJL|2Pkh&M7~X!y{jSX>rPB19B9G5zbEwxLvBw3*c?|=H
zi)Cr8#mI*olK*lc)e=7<kX)JsbzEyS?JhSKe-hPNGgN)fWdzqT!;kfyB3^qNS9?9$
zrtEvG3hN>^-k&$yzrN3h3@-ov*y_B@G|geb(+P$1xQY%>e0T6R7t3rCxpoMNE~#}d
zS{eE8zxk2mVO83Tkiq21#awK&p%4k2S)(=7?;m$dvLoUDwgh2+N&3x?kIA-9Gg>a9
z)Rzj?X^P!4G@}JS)U<BZ&Les63L`JFk+3hG{NvqGzkFDgqS!y9<KR@cv6&oKhG|W0
zXO4hB#gA*g9&NHtOV=dN(3+6!lGfmg;6lLjMB}f^ANIHBAwp&2UT1=34f$zldk2j!
z2EVwo9iAH7Nt`j&2xTLiHB2n`EMx1mlpOxIOCJyw5-@G$vbZJP!sc2K$;C4(7QwV2
zc008@UyPwS2<OZLYi18!^S|7+n}0h{He3WWx)p(jAHFsL#_`0*onh=U%ZO~Mq_zL$
zl?r88f&DfxZ4mR{URLX?4?+_z5b1!w#Q@knQxkwtQCahRBj6tkTqxrZk!18#JNhl@
zf4Rs339vz}7$jW(85_`l^1>mqdCuf0BmR8>kUa3I#1P7$(F|48`7d936#+KgGCK{<
zKLghP-Qxef#s6EV|DWzfAsU1v0!mruUM;?U{@**rHc-~)>~L0(S+=^NX4@vwTHQ|T
z`gsE)e!N7{KP9OLa4k|lKq9mUm1Ax)C;^j!?97Fd6wE}3b4JS{U?0rZzt(bE3KfEI
zphKm=<0G*;^v$$+)=r;t;T@*Mw`B)-G6?R|<v)j((O&p({O4LO05X;1D_in~v3AzL
zW^cAa&H(ixh%!R2;H9ZX!+7+X-7jLf@e2(XRv87Cl{xR$6|Dy&!~PQae3r;bWD;SF
zj1GgmM9hK8P0%d6U|J!<BI^z*xE_;C78mF5ZaqQ+A)A*DGv#Ggf4-ClJ_6(!8?wN%
zG}av$8EAe<jT4Z{(Ez|N&4ECW`rAiIVBg_0=7MT5*!*s(PnchjD)4{e>lC5~7;+r|
zZ%ik^`$zy@%5z`DH=e^kj%~N=CEBW8a<i;k|19&&g1eF`o~x?kF@cdw-RUjh)Qjbq
z2a^PoGP8lW%r^TCkdYq|2zoVNgWljk0FY;zU?zg*ov>yJCL!n{2*4%ZVLl$jbk~1q
znA!})(AbpJOxwf62?unD2GAZNKE;3&Ki`FwCPY9w)~B;}!DbicmPRU)(>&z?la@Xl
zDXCl9DFwR5b)a#NuVamAHiTdDzV|$jPQM{vZv)hTdSE8lXt-4wcGB|(Oc=_OK}~-R
z_%C~~ZX%SYK$F4pGnbMPch!>HZUaoaIEbM#q5=lT<+=qpSJ&DigQ9wvOy*!JZNV=D
zIP^YDp^Sda!lM>#xM4t|kUR(Q?s`CF>DmVk9s4)vx36w)E?@>*59Ssf{NO&#DN5V!
zt{mGhz`JY$a6TsfxbqdD@EdszG{+7=`<jNFNyT)acc=-V0^b2mW9=E=FCmxJV5(=%
zc1b+<Fo{=%z!xS79l+3W*<oH41^*qux62&BEdBsoco;eR4%UMKLWkfYm_*`TeFX{n
zMOuQ?5I*~t*}CYfJ`K}Uoa67{9nwAKfSqPB6HIr2^RRxH^g_Vaj1OQB*xCRGOq(Uw
zEho@YO5&dbnO=L$XMv~$n_z;#lwXMx07!P@+Cb5D<rkn^>BOURVwawi>G-wW!{89G
zZ}<)d`74w0xF=o@;<TML&U2YO3$vI|ow=V}-+&j1CV0c#@<a=aU{<8g_2StD?!iMC
z`6UsXpYAm;l`u-~(6AAQvO!--$PHv87s1&Ht|^wluD;Jz;2mH@jnspd$V-TDzueu(
z;~g0H*Z?7G#Pf_1&jSY=@DwA^T=pG4lLMubS_ca{ZmL`0<%V@&sZIBQiWb!eu!$yy
zS$gj;9br<dU->I00!9d4NhMq!$F~uB#XIo>#@%Wvqr~vd2B(B!Y;%SsY?S93IPPgr
zP2a}uD(otgL;6QqLjJ>hNCrn@kB@Zwbh$v3SoSpDCC#}5CLNV@At5!b?eg8(c+OD(
zrbxZ|q^KW^cBUMOU6IhZ*FPypGL0$|wjMO@c6v=M%O}uAY<O}5K(^=&Xzh6q-^uTv
zkcm?l;hD{=mcp1})gypAF;mM|WPG}B>&<JOo*lvS1v>d|ZzBE9F{lkpPH}o#z@P<F
zP(%7eWuezwCqt@v_H*(bY@V{V^zJJvj@?ZcFMlnty;C6^yv`EHIk}S3>ek<|+&Jol
zbXQ!2)=|C@0Iwmi-U}`ch7CVj=^SZsY{A2=9C>!p?{-{b>q&QnwN-6h5?-TneaUH0
z{=Knur(>be-Hv~Yu~GLrmz73PaJ!7EsI=>-Q*$-FHs3gOK{Xu@YL>YU(_OdGhy$wB
zosMylx;9Zi?*M$2VAVaRJF@PM#<db0e)?ZKb6DrMxp(kQLe52*N}aA8*L4lxmMkb*
zo;3?i#3o^fM>#S9*ZLlOOUGQoDY;c(;ws~zy?cVIX{8u7iSo6--fj((sgL}MFc2*N
zI_8(Dez3MNBj^Ji&uG#0iCDDrK{WHpvE`wE8(&nOww9ZD=OzPMXJjA91@oml0UjZb
zZ^Dt;?xakp)4f+mr;nY;s<JvH>9&qH+cNK9_K0+Ilc^kO9v*v!FX^!5=)XeYhJiw7
z+OxM^y@G}EcfSG!{U3(wUd0V@t%a>z04zendpd$aj_=cSqh`NOfw(*mB>p_}O@^Y@
zeKlRoSIseUfJ)ZXIbH`;8@XNkP9&=Jp8kb7nHhJT%PZ@2|7W&|v9+-W){S1x+phKi
zH$mmqFX>jCR6c9XnA(UpqZFBS?Zkx4wsggIG)<d{>J)h_Uxj6BoTvpz`@yAyU?N3n
zt!qofnQ=uqdXazG53`d!9npMBscF+-yjp@he(HLz-6ZL@JHob)=Jm@@Y^GtO<a#V$
z;H*&WyvzmxiIwLbFiGQK>f+yd7`AAD)iI_Sx&J)BreRmd(<MyKmb)sraF^3$+~Mo!
z7wAmH`8y6AEuQD9Zsr0Wum<rH#RnlQjr9bs6F^Yp99tenyD|NM1Hsj+T6Q<@oGz3S
z9{bRS;j;;FD#(KGVB?Ldf~KU>Wq5p4%4yI-!X}0Rgup>+sb7aj=<=IOYxD*C;iF?$
zFyO*!%c1U?=;9{8$1sZ-0U0HInCw;ulHm$aDp-e1G%<!CeiJIFwuR9h4epKK6$D$h
zWX6}CyA5h>zOU3%T0R>*`3%JUU)RxkAsGZ^zdy?0<+P7?cHYs^l0OPPm}#LL{i(Aa
zkNdHf0Js9J-WESCNIQ6q37xEMq>@eJYaojVrp639@hx@2I+_f;c^epFMmhT4n-2`9
zLv`U|hXn6$R&FZSj|Lt06(sBMbl&T8<zHbu1QVgt&qCRi1LLYQ#pkzgi+&RErcpH(
z$o{6XbU<;%Wu3=+A_L4%yHmJO(_x97Wb{Tpqd(*|R=V3O4U2PkbTeqZ1Z=e;vf&Hu
z2EvGXmYL+=W#;AK!YL^^3NC>ABNVYBNodWJ#h(uV@M}6xd43h?-qLnOpACRfxEe;C
zj!)0Pb!?eOE}7>|Zjw;;`=vTrsOcdei(Jy|x`vDiIUxrox*2}v6jUoQaiKELLI(A$
zOLg;fXANpFgVJ%O-c<5pw@`EJws8h{(&`DcNE9&)e(Gc0Ew1`lztnGs;0uKdCu;)}
z+J0buj6H5zVg_uHrD3eHyg07!=(3aP6!b-c%fPyn7VaUO3estk(5peoDxD^fev9H-
zl%AZ3;SoHUs<IZ#=<nHAPVED&Bj}sq@tH;^>AsoKs5FU;`9r4R32f^1FD9Zz4oBIJ
zBJMB`Cs`B0IN6WgFAZ_4B($zl8|2eqZ$E`qB6KR)fU<I2nvMc$lJzhf;XW_(l+T3r
zfG9uj+HuM10>o2n4<2g4jiUU(C3DMTK&dp&{&*<<=*|rR|MJr))QiEVU%+SbEtVb3
zVAx@#<fYr%d%*Tp?gD1Akj@Gi^Kc9+492bvcA<Sy{HoeU*FcQD73PBRi;3jqeXKlL
z7Z~P#T?a*l6nGw(1kGFbKX`@Zom*Zvi$$~C=Y@x`0%db=$e^vvhjpxuofy+#dvN|A
zcsAx{KqnIk6KgptQ-^d_MCnDNF<{MtV~WlX%e*79%?^u;Rw3~Cc6ATK{Ua@e<#VgG
zg!pRWc%Pjivq5=`x9E=f6=gEUTw6|NKSffSs+u0o@(f>pc=RkNRBdKUPUjHDwyu8`
z57?D@4^O+9yjW`R$67=^Hv!mQYVgIfA)AmOaNQGmsp=gw63%tOsZI`9$&OjZ9~(EF
zQmp`OKG>UAldxp9su(Rce`v~BJi~d4J<G#U8yBIb>R7dHq6_Nf+r{91i<?__3ti3f
z%Gi}SZ?F)?vh7yU+`7yf^X%p2kvHm~5@3~CwkRt3tb4PH7jTZ))K;JkvnPF5_NhCN
zl6bY?4(s~bVqM3|wTRy-a<oOX4F#rEF3wKz<)SW#9DopY$mp<Y{OCm-1%E{d)2+_O
zgE+|#7hZ~`(YH;U>qRE4D$~18MM;3a?LAk0bwCsq$bmHo7512HZN%%zB=(UwnmUj!
zTW;W*<*)4X?OBz6{?;wH*Y$2XsYR9k{(aGgJ5T&P@8Nk7#=)@GIc;d^6wF{)KQXpc
z|1!OZLqY-QxqYDzaMYdn%oZN)*fy3RiTkP1)~w-+%bT)2(NB>qXY#R<Z7e(Ky};(+
z0iBe%064Y~S!(p^5}qkKFpiUp-nk(4?ICNl^#uCzPX`Yihs_JMYex6Z#`h8w)(C_B
zufogSeLQfcUX8N7E;Ta_%V9~qva5N*Fg05XtY`91IIpQt2vI7BisK@`iT@FaCH4AH
z*usNee@8bvoou)H301O{|7DeKeVc4@JpVcf6<1Qz{d4iiz%BssA#JZOvPHz-S{-3)
z7<_<OF{A}QzB*WT#PHxXLQ!V>QKpu`@}wO9#>nsH@y|s!g9N;F^_hX4Wpo9M?g7Rp
zS>hhX#Oa)glO!{b&*R#xDU=i15}K*b0Zv5jovg)C3E^+;N1`YdWmvq#wpG#n7loCp
zg%JAI0b>!r4P9%?Xf#L+dq>Q>{AMHP6wY5vm}YG4HLPs3nB5yiY8hkWlny_Ngw2-x
z`>yP!rQUf6Kxl_EE8ux!wI69tiTgrz+JYvwJQ*>~pe;*Gz-To@z___)%E?fs@<uaf
z+@O04a5TBXy_+ET@>s6-wZW(F7xNu;`=QTiGW|IqPzHGovF(x8-K!ufPG?pm;^Sof
zqt)xU-{C~O(^=DtU(#tI{3gfHD>7k8@5=fhKT1=RsEnIR<In0@yRQiL8sjEpg4b2^
z-_u1c5Y}_pGu1ZV(%F5@Sw4>Wg#V<ft76S=ZYutSzCGk%rUoAW{$s0SaMm}xbF4E#
zBq_Usy8CYPy(+KJbq9$pjAf{>NZkByQ^9Kuapk5!JO;bUzNEfgtwygkz4Ja0VM|F3
z)3q&T_G&QWU)?nWRR{k{>6AW{Gke?3#+l1gUP~vO*HvbdrZtK1KFy=Dy0Is28%4|1
znjv|IN9q0|!8!Pn-RE&!a%qOHNP;1+NJp=vQY6wTPJhmy+x{r#G9@hQ>+qtRk$G(>
z5-e^ag&QxQ4%wUB;<Kza>A@)pi<%T1(r>$ZyX05UEHL@abLwWq=+d~&l<0m(AUzz*
zd*+btkM5V)hm>KIjrN<PX2w{!7V(;KLsq{ZJc=f3*2}WujSxz1=aZQU3!-?1OsAIL
zqL~k?j>n^)L-fw-z@h9%NBo4@){DTSUcoy%u2QL@$BjvoeNeFo9b@q<2ioQ0SQ$`5
z==cEAQ;f@WqZm;G5nTB3^n>m;H*Q&aV|F9lS3Gg-q48Y$SR56jkriSOgI^kyQSC|R
zw-v{BUmUGX7y@vQ_j4`_-@JUK9$hSrODn}s4-BnIL!WOHI+uHrj^E#H2Zujy$49pu
zFV0u95ZsTCmd>4;=yvmi2(VqKlsl~q^tK(i32}&n1Ux1Esv;*=p-kx2ldqK_;|s2i
zI{f{^AKl>ba}@>Eh_9+F<<bpTSd(394$lzT2HK)_Z*}jl)Oa*hcrD3_EfsFnpUITm
z%;O@l@zlah+P$)=ey!$bv;z0oO0v<<Nc$6&XeWnR)kjJexzW@)w{G*r`HM+iefEa{
z8YCAW(Bew<%-+Nz+N~y$^7GDpBja#nP$}wn&K;!bEo1&kt53#$#f-{$!SuAD{@mJ{
zmA@*H<d?>&u@qxeRf*e<&XLX_vAUfhzjx)yibY<XuX5RH6cK`vz={B2onP@~Ok0<!
zc3I={u2)HL<oM47u^G3+nJIXDjr#<|+}e|}FKA>304|7s!0pV)Us#8Zg20nDb5C#M
zT-2Jwc7-)#;s<F4_1vlnT&vgM>c3X;c;Aln#&B9uq9p~R=<llF2`FO{-p<O>o)Z&k
zS1A&bSYzbR^S6cw8U<hOuEGbPn;Z*j;JmuEl0+$$!f^-k;VQK{5Sg-i*E;cvD4P0r
z7nVFZr3sCvhb=ZImYJh0ZUz3<Pl3E;6AiNDA6Bk1dgIT<Jr~=^c+|P+O0MKo!)$ub
z#`|pjOYxdae`fk082%>EH>8eL@y0jp$xO5pr!yqyb@2!<DrqDNlgwV&yM5Cpc(y*a
ze`O~CIt)VikHtb0VO$f|J`z~us0phX4<o*xR@oNM0X*;53ce~SB&6TiQja3IX0hl~
znFvn(EFZ}xVwn0prc_Pa!%6_uIn+~j^zn(O5WUKd$9N^`qd)tTDGlrtJYmKd0X$NU
zA@PrHfZ&7tZc<&Bs6i;|Pf&H=s+;PL6*$O<y;dY0IqoU8uk=EvFQNQu;Rl25luBO|
zKP=*(Qoh_l;<#k?kubNKi;Ocjdw>&2=F^kLXz^)5+Dr_T16IMI31$ttggZE9lUwVA
zb62&sbH>l?T5AMmKyGnsSy-rG6CN{SB{1r=-H4<jJraWqW>%g*-!LrWn>v<+SX2r}
z+iehO76v6=qHzJpa+MVA&Gj3z>URLO8qiGs&SWIFa@)M-n~D*;+2!msWeD`!gw+MO
zoAfxE!(jtVF{`XNCuS=wG9*0A>Q$18ucb51cgp)Z#UAvw4EcSVC2N@5#lsr~90co#
z*I4NnVnNYo-U^OwrIe!yHJ^)vD}~9DZ=JiQ8P87JtaN_!-`z(4n6xUO7=05I?G&Ic
zeesRwMXkFL$p8FiLGe~>?j_1aWk{FeWcK`v$qff8lvsD<Jw|?BO5w&<s0-4%>^>5m
zHfirHXUgW8u6aw3&4V*<L9s*!nt>8u*JoS9wz0?4&&dc@H_GQKREuV0vfD5=fkwEL
z<G!gM!;!MKfsceCW|KTSD=aS?8Bg#p_t0a;G!k`XjkTF{zeo*)^`#_{LfZ$=Fr}ck
zmZ~Y+wL(g#r|pjoFlkmZ`rB+SlF%&`Vo))a*z|`PT?#p96a=pHXLPMp3|%cV3SWAs
za$bw-fGphWD-lh%k;pkV(Xc=|YUHh4BIlM>=CI3@=8?!<p4NjCK=zUi%1HXr?Q<%g
z6<j*!SRv);a~ae;wx|IVjvtc~zukNx0^oYH!XT{_(_Nr9W$9qvy%#pGv3e6-(%e@3
zV6s3c`(YXbWVD9tH!fHs*n+<^v!$R*_PB#})6?^u3offtO4&0_{2dGyYG>@bz2b0?
zY2=X|(xS(?Q^^s>zHt%iOSS7Vi|jAPy)HEd9z#ML@5glMyWU)=;9qhNoV)=2$hkk;
z*;N(`DO5zes)PQ~nSUE~f|GnL1R_RLX~ay2e_7M_(c;{oyQcYse$G*=vs`_1qht*k
zVBt{gCiB;FKZC&%nUBQnAbq+c(H27To53fM0rewzXM&;0-=&||c~MygnD~KmTc5&c
zKHbZfJY{ZOc{QJYu(IPI3It(Flb$%kVI8_T`&pNo0Hlvlk!V=>8FFHJI596asCn$`
z;cGr#LXm|F-7cCgGh&FxGa!}6Wq0lH8mXGj{p}98+ODKt*U9vTRl;lJRe9m@KDBFZ
z=BJ!laq8OZetC0t0W8ByScVefhB;gj;jYy=MGL}c2ql6uRl`t=d9LQP>Pjmr*kq~i
z)hHfZIDCA5Uh|8T+i6T&D28bx!zkbWvczXREA&{Wr!TG<#>j<mv0SsHIYyw-zFe)8
zO_<E5j=zB|F{<~bk-A?V7dGm}ey^^e-chup4BeQd;3)n(T$Z0XLfQ7SN}ID5Z+rs=
zQnas(Hl}OSIs&_p5<l!Bm8X>lXQLw53_m6)Ue_2kqe&hh#}F$%zB95f<<bzunLC+v
zN%rW13y&~=Ti|h;zd?r!x($97RjsobtM>rPGTuxtztGeAKBiRBr)S&@?hBux<Tz+i
zF<%tR&eyW47fWU+E^Gue?`j)F#X@G3bP6Oh`g!vy*G<N9`^|OI$1MZ*Zz{(t_0BPo
zknHD+-Nj2XEIZN?cDAd#$oV_0In<j>5!T#Jus8?Tzz~>D*5q81TR6fmm|7g}-I%AM
z>+?1~O9`T~*t)aW_XY)yc0ry?UD20W_Bco&jMZFy@MqshoRQy4!(eg<3xLZtC-1ZG
zztV2;)z-PA997qG)eP2xN+jUz5o<&W8H(sQbEniey_%8M(WqwfD)^+`Xku<*XZyP`
zek0&QYRH1TdRz_oL1TuOKtc(B57<lCRT|{o;^HB(9oHDT;#Jh<jvk3t%jq!nuo7eS
zbZVq^m(70x@_Wu&W2G#g=f%QK=tBs$4Trm85gKc3`4=uo)A+3ls8UzgHJUh;Ovb@t
zxRuN}g@e%7H{Z<js)#3XmB!U#w@5c7^-YvAjvgQ-$I8fu?;}-uJuo^WsgUr)hVUKx
zqGE?qB1mUbZB_=A=R3Lz3TdolnYHW6WJGBc9gkqq72g0YYb)1K4Y<C~eUy@OxyGuL
z)*v54YimF+k`ukm_i;|R`M4MaSH#cpYR>7!(y#>5hs<W6M>!8&v&E$VMb6`TTEDb6
z#(r^6`|4zFOuq?&@blAS^O2<Sr@01^7ElFwI}>R%?Lr5xun`ldkIKH!G<kHYU*q!E
z*r;Yib%$(dk8n75mIOy#DpyuRBeFNx8Uxogej}w9U$b>ou~iO@9zQ(EeEVdTEd<hf
z_A%Z>#EM9{q{Xo9?UC5<l}sH1e((`xaW|YroDbzHWl(qY3~2G9gtF_tYq(EU)o`j!
zVIo&<gtra))TPojd9XyN?N*&(Xh?6@b=|Eu^@GUXPWo-)kIjE9n!{=ue-H9P*GBos
z@8rUh=cc?S3(&>nmV;qQZGPLS%F60_wL$7p$78pCEHiS(g__SbNwv<@K<Dv=TD4)A
z(MIL6%x#<_@6Wn{`l+fGa0)R&#$mvp-CQ*&I}vsP;{8)sIB>)sH-DQ(QvK%Lm~PaY
ziD!0sGYn?MoP$qQ<s;ciBN1>QF~>_wupS+Ym0)y`Txl?p&2F5)sCrYq>})a;0vP7W
zKa6!REzc%uCqOpq7%Sq&S#=uw;-UyH<uqrO%X}`}D?y%jzj_@E?vbAk%L`}2g)?-I
z?uu^=)y$`R>`r1?9Y+CBo9ZKeeik+Ng&&1)GREv5b}KE9k(a45n`ZBWRtu@TvcFmf
zD;`#{R#9bGyoOj=jpJTN6{w_N)T44$<t^7xLIz&h{vygBbdRkV2ioDYSavn3rRNr&
z(!J!RMt+n}pq(TK1HE_aeQYDT5#xi0fyHl)C~XZ=$NSa%mk?EL%j+7gTF$1=C<}w|
z1W9M$^QimG3#RCPtLS^?F2IFf)y3u~z0Y({WPpSmR)DE&t(f?^AJkK<7t$4SZIg}5
zR$0o{3Qhvt6elJZZ9&ShE5n4goZ@Ei2?~Z7p7()k*9@U<qjt>%HD$8Am9e_fnNp~G
z)lAF5%#O<uYpvB~<+A2}kukPev98mqTmN<Vr+0eikK7YJTY~~A4-|bxhB@_C(4CS>
z)7wYgc06a?n<h6rHB-AINU(FbW5gJpj3~3WGCAh)TuQh;ls0CG4Fjv9#5ZTJvZ;z$
zB_l;aAt8Wl^+98Ow{t1!v*)Th$k-;ruLK$JKMXz*s!@CG0?nv!>gy$RkPR6i)Y%DV
z69);nLMmGpdP1K#G*3QaQILcX9;|WfFj}e?9m(e-u@#gKKhQiQ_6e96mSiE?<6A!>
zNOYM&2G%l;0+)r%c8Xc*pwRJ`pgRYI3&IfVZ?9|Gl7!Thd!13(DlQu-bzCzwd?awW
zRqrJ{{nukfFSnQUy!b<|R8my2xPqV7E(&c#C1}WhicMObaUkZVoift)Hetx7P*c6P
zkg49osfIp#@dOJUWTb+p_EujiWo{UdD{!P2TVWX(1)t$^qM`DPiKlG8i~?J|Icwj3
zkOA+T<*KV9-+nw!>bz>F9^n@dG?9k`g9z=m5Sk>XG0hAxn7qc*;`4vAJCsms)4#`N
zxc$=IGPk?5L|oW9^TsT<EKV_Fd;RP))o7pe)PbSfpsEgR?-8k0vr2>vnywYR4|erv
zo=CU8F}>lb7_Oo}aBS&&3C4wJKCS3xUxL~8u}$4HGNNpsmyFElrq%d9Uad6}Ekloh
zy&^yUYrBCHyljton$Z-uox&9lS9y*#Rv9kEhV^?=+c|#^b@hfdisu8_)9}(~)l@@A
zIitl|r_NbfdXGZi?^mbMCswuYX%f+=n;_u7W{Q6h-`jC)Yh)Q6nT1rEX0U+C4Ebio
z9F1dU6l@@8Sj3QCRp}&>p}6$hU+q>`-gSzpi;l_cv%#%s93iezswtMJ##93P2cohX
z>pG$A+S<BLX1+0aNuW5lnZ7qf32k=hx@J3?xy}DsnBi~GM0wV=>`RXrBZswSHQF-t
z_|`yOz8=unCQjBh&bwS^HRTMpa(VJEGl1}+!|G3*^o>K|v#7`@F7^8tPk~<&iE5K%
z|5ofk35D?yf3~6zrOqmjCVDshvA_%_^6_}rHGqHKD|mfZveXX5R8UsCTnT|aw4=Rq
z@fn{3q&d*PS-^$QMgY;r6y52fMq8-aZ)nA-t7g?`n5RM4(H|MJt`2wm4xjfvVuV44
z{ESyS8CFJtoyX(avW~=t?=smK33Bvs1YHu*D~<H>l2SbFx+(gH3^r7?jV`-4XE!j3
z##8q*PtQ`S@Kx+v0mm$XbtC{1j1&TpBXP3uIKH{#d=rmv)XNuT+K@$%8YwwVXfpDh
zU4>0Huk?euA9WW|KI>9NceSPe)b==;y4El_I!?JD%vGjhl}C!J;-yGQ>d52U@`WQ%
zM#{;a_-ZJaB?j=TsPQ>G$VW<`e_kn^w?X-)D~uhnGS|e_Hby~*(tZO>V+=J=C{lH?
zG>h`ner_QIt8DsF9KLr>hX{b$s5{<JJvnIpGM16RK#*B{H71uuCes=Gl813{&E#8|
z+!SRU&ymNF0;`OoeqHCn4}=U*UK1*hx#r5{1<w{bZ+D_*9Z@3r>ixx|x2aimTsRCY
zW66*%^Eu;q21mA10UX|wsV)U`quhAYTS|<%tB?aa+`S|<-F_4f(ix+=B|RDJjkUfd
z)>uf9RHeq55oG&}N3Y16ucDTZe0Bb<V9P`5XU^K#sO_Qt=o^Zl<65gZ=CFJW8LBM%
zsOpA*MROK%#)TbQ)aNT<&E%t%0#23Uxr$D!u5t+>y|-0y3ZEz$FGzm>mT0gLAY7&3
zopYCG@R9KBA?yY!n7YIYm`##kic!h;-89{E{EpF%>=~%B?TF__c6Kd7$xJuT-od6+
zhskG;xZ{UWOnjbKS^a0P8?<RwMC;Y~U5btIb1-$yyz!8?0hQC<a~j6v1J2qmc4wiN
zz1uye*V>iK#aY($(mM`{&F{Sx-5s-aQXYY=|HP*i)9hF*$vNcpK$~_Z78XZKzoa1C
zar*zm-dhG$*|zQ9iWrC}tstFBNGsCau;_+`NT*1*fV70t-Q8Ua5Tv`iTy#q}yvOps
zyq@cMo_pSz_nrBF_|M!keDLCOTydV~e(cA7{I+dN8JC($R)xs3@|R`7C!2CFIbS5)
ztH(EM<u9tQ5YO3n2RY9_-n9<PKPeclB2L^wt_ST?d5d`Jm;Kz;cFAt^9x}0RXDKl`
z=S?&PgOb!sxQFjU%P@jbNyt%9Sa4@nFp7*?Ai5gG#Pd95ZO3IHEG|^IF2vMUrr=G8
z7gg<4QC2)=1?&1SpHLE8(-_m$GRpm9Tq^n#Sq%fP#7NqLDM%4ZkQcju)<!HhZhIi_
z^b)XMPdh!%yie;~d4(ei(QlQoQoM(jzj!+cZq%7@ZzmFB=P0rT<+p4I@S@|Q(@Hcl
zuzGJLym!Ffo#nl(q^E9fhFyd)n1?l9N2inz!^AdQk3aXL6E!nVg|pHOWb;mws1+%N
z6s)qIjWEB_a{u@!_qFoCnRNLCI7g?6ls7@~(N-%ceWA7G+a|;np%Qj>I@)jI>>L}5
zBbRS}P+42J)sXQ<P(MMhi+KRqRL#QJSf7BRFXo4qT1WOJt{%N^<j4KdUmy{5Dy6vM
zLXrhZy281H8FcDXbMZqPiCE(rCn9w!9Zpo7XD@4^poOLhq5CqDsatTYq={N;QKAxH
zIvL~b^cg8oqnr)(X@bVM-i%vq(x$dys>crf9=En5SVpkhk&zP?MRxniAKMZ8-Niqe
z20?682v6MFEd}GnS`8v__eJtp(o(l@K))Ut|7-V;TW7y<9uoCQVvPd;_rq?_QI!e~
zN0}e8!bfs8GsKep33>C}TN*Jw(h=T>h~@ix&C=rIsl2!`Xcx1yn5`QPv4xcEPnB3$
z99@`55-KI8Hac)Agz%+t1rmL+DRYZQMM7UQM{)(=J6MK_<C$n<?br;dsmz>gt;}8~
z6H7>MY#XP!=^P4CUI?j%F<^1Beji#Qe@$QEQFp~>-09)ZUHXh^cmwEAvXDYD!fs(8
z#y64AjbaqI-vKsZJtQ;VmjZbLSwzO#+*6riVB(gx?Le4dnW7wb>mCpj6Ush{F^c<?
zcFD%~ru&J%z{gwphoA%SBBc!p&NG*qk)P}p4dpQ<!?`bA7*wy?y(-DoG-~+vb0vH1
zhpx`K)az~WN(h!goLIZ#s%vGZD0slbn6RKWL>b+vG)d<^5yAwDP-%-^xL7+YX<yt(
zrC_pLjhT2rUj&X3MWvc^hdeptfdWyijk>#vdyf6BN&ii)<*$o!i!}Vg<ArM86MSmz
z2$@9{fk&KJTIJUPQtEcQAmij1SJyncJ8=HS!Y68F(K+>92odzl3)Z#H(#SA1ZX3e&
z2L17G$EE^=Cugiy5l?D;@lcmZ10Rew(UF%!EXis2CrS7Ek*OoZ-K1<1)U?X!X!`y0
z_c}MbX)M5IvE5`g&~&+gi?yWK6nbKeBBw5+d!^y1H!Zy$(4{1u{Pov6q*8|sC*^5z
ziqd&(ZbrW-zEN`QY_3tyK3YjpPTw7HqvjM^#pMx{IJ|cpBOl0~vxAP+)8IO85#?}f
z&Hys#;xNn9aHiVIuIu)+L1D!07$HuIN9(X!-sRawkh}<{3(ChFRuTN;K9_~9PbBu~
zmSRCeietoKTaS&xx<Ry31ldkCg*IYPajkI_U#Kbn-aKwS>#QxMFX}3zs$`#?l8DBs
zGI7WEm53gMa#7Jsr13xyhdr`^e9(uiC1S%ezc(2p6R~_<SzowqD~VB1a1kiO&(HE+
z2M(deeR2_5_na}M;o}P%qFP}zYJ~`!>7VzdJVgn>39}<oP^6HNP65ApB0~T>^dcXG
z4ttsFe%;7DbQ%t(l6hT219l#5(SZ3W5ug~jB~pY{q<l|$jdh(-JC?!-o=H7ax+3?s
z6e*~S&Nn?)NHy+7eGBf{!horj`Hj~T9wVhk8r<IHRrsp$TP?D8^rTgL_EO<7Mz+=N
zaq`OHdF=cvfzmvPgX2tUo3=)PPH_3lfM7BM?~2f_Y&VMA5Tqf5>@xd~0N5R=aZI#;
z%}9rY(6XGC30m@@&D<2JcGv6Vg~4DMFi!WTQnaeu#2?tFR`XDO%Z67jyDKEU*QyPe
zr#oGiK<xKqTnvLcV{nNs@da%{Va(}zZG@=C5#&hW?5sq*YG@5s%EyRW!!FI8bY$Wz
zO(3nvLR71=jvtidwz5opL%!+QK1bC>Q(u?|n7Pbm4oVr*d=N7g4ykaqDu5Lb<VLyO
zhdWnx73wnzM?yiz3|glI2vRbg9lUaQ34#@wpA;=}p0o@tAGP!s`k{(F;;Mw?vGc}J
zz<WOzOi#Gf6xEabub3vehl14_L)i;Amp^04hy~2Wr@7FxS{JBJZ7FZ-UB{M2`UFfr
zI58-6P7nlHk&kp!FY1H_9k@~)tc)^?B9)R$oT@IIz$kDnzVUpthz8kmw%_InmNQm9
z7%LC4aTXfceMz^TlIPZ%u1BXBicZFX?gqIj6LkgtCTfU~eqeXb8%bc{K66!>)lYaI
z`IB^K#6EL0Ayc{KY2R}-5MoGh0^y545nO<I`yN1s6Nsyo>EnpSI4v=W;Z7dyXH9m(
zE;onNORGr^oHu$iXPpAAd&&(CNz8q53mm*gAKYYTWR>TbTh21LQefBqSqEWTx$9R8
zEsjm!&rre-u>8=+A-59Towi}B3zx`MCQh7d_uuq^UnNDe-=q)Njn6n)wK{GRWR;#1
zZ^!P@dsgj#a2wdYyftwqUb;<Gd<6ND@FvC9t#n$p=APb23L$)@_0H=3T@R1S&toXr
z5Jz5y6yAV!a9d-X(ik=#HlJl!NGG*GY<{q1n$BrF9!&^=Hmuk*{=za?ZS|}jI$IX%
z)40Q7ISar1T(xqfsglX_tqT6Z4Nvohd%b=MOv%0RQt%0@fEJ8I$CsnDz?Q*cDg7Mn
zmuJ}lTyOM3gxnFg^(fVGA$>mH<Rm-wuy<$NGR*DH<>w)KaDLgR;ldU-nw(*}qTY!+
zhDy<=@sNXoqy~WmPX0i12Q#U0SFxi(%TRY&`4h*wNtMl4iucLwE}RCRH8Vh-G-6b=
ziBFom0q4XvUzUX3SLt2it8{JMV%#bpcpYmsCgIbb`-(|N@Hf`Gomo7qV~e=$56D+i
z(d44Lu`=ZbG03qpBaI4<=M|HE7s)8Ro^$^CAVz7w7t4slNr2gx&-a0t>?p|oa=4Lr
zm%2jF6EF1S$QcQlWS|ilMjX$Ga)_JL*I2{EWwt&)C12)7zED7z03};ScxO}ri}@qX
zBN#8`YSf1JeW@dCnbc~y<jil%&ge71?a9ksG?8QPc^v83AjcA!VF!#b0*7md?~e04
zeGL5{G1=eW7HJ0#spQnO9E~HbXK!5C;(1ZP``^d-)onN1bf0(&w)kN+>V0GpQn-T{
z<}b<m1ZXZ!e%TfCZY=J+7m7G88>VS_L`AgPSciNY!?x|*8z{PdIVEBmYvjYXjvVXV
zHnW~d`6DjJwA<L{N!&^zuYFMD0jXCLfSXvVFW)*lKUhPlu|FqF40m45@8evwovV^j
z&2#{c*PoY()Th>5$=?zprn^@VzV2_YXKfT#UD4jsJMQzupEnMT6ptX6bICn<u6MQ!
z-P?v)@5+z+HY12-qX@*S%iaHC|D=&wH1EiQ=4$^y+IA5_G^(hMdGr`aBj$`zC5G^C
zpJAN>G-~nkd0_k{UJE}@!sTXhf;~FX?g|UI46De8icl==-KD8nAS306Z6DAm)MH}(
zVxai2&$|Tuv2!U&B%z5F@EF0%aU($G8OC>|(`R3v)>#OXZ^j&)5d3_tX<l+1N*%>d
zzA*oIVM%eQQK{`r<?ONgTXrVoDdF#pcRP*M!lZsICo9Ro>ekaMw2nxKfB$n!_7Y<(
z2$zQgOL|jC<`R;}WAtB^i#D8F#a^4`H%*VR6X+0>lg(%FY4PPk#jJZ;!)D$W^-Wo&
zh&1;wA2e(~o^(TLi3zshXa09GkZ>fl-h1G!|2M`PF{3&62lo$e1(of;k#8l314W9&
zq!~8;ztMoWkpV>tq(EHjzj4|BdWjd5;A@wE{oMP1OUC$;lMsp&1ylK_|K{CDhyz7R
zc&|vxe`B@(^^dMm14YW!NbCqeixKNLqR#&LI3DtVHGZjICTH|tzx(@t|K}tA=PLgH
zxl!?L#t8m+0sQBt{lDh9^pJnZ`bH{xE4aqtoAcJF+HAR=gJ{ze;@7?OEW6V?q1#a(
zo)=cCiuMby{9Q+q@jZa*vr`MCz*xXr{4GGn$WO@L|4_TA^ALFbRd<q4z&J7aD|^`i
z9)q1`bm!}c&#_<y@DK~T`@{ZE3F44h0IsXHq6Ah#G#w)xKXn7?SAZk?CdC-~pW+2Z
zFheM;X^)@n61nLI^QY8Zx+u(^hKZte)x3TAr^E?{e4^8DIP0~%7Z_t;!q6St&Coa_
zUi^FcM-;+=X~c3w$GXy2sL`*A^}qEleC-d6-VOuCbs6Do9NCwW0l_pL1GZF=`=m^N
zUL}F@FTsm#q*%}ll-*J<=o!Jk>NiI9#ZKKU!1b3K4ia{6AtP~1F8EU?K7hCK-zQuG
zxin)e%i+IOF69+m2pXSETEqVv-oO6k<a)4(;4i(!z8edWmnl~OC0lgUSDAIJF95r;
znX}a-;s?Y4ow0~iGcXQ)JxB`Vg_x&{#5Zep6YuW7`M4x@0zxCw@<)?r2&sN`L$8OV
zW0+fk07iWW6?!V*+rKgcEDv^G0fEMcMB=M8(Vh3i7tx#`G+`D1(;EmWjy>>4s0M*3
zg^SDCwn+b9Wh}qHVot<|FblLpVFf#@OlLq(Z*p9a1=7LofDoh>Zbvo*2;L=xx}<jg
za^;N$7(3V|!GSlWJ+ODN^1Jy<(NeTiULbM_JofSCKJFb3L+SueI!+HXDj>io67|k6
z5X4b1x+R_@xB!$ReMesze>`HThPdsAS?skwwMS_E<K721?U6<(=-Ju&eFyGg@l>I)
zmmB_9G<o?$DJ);jCs7d5Jv+cI!U}YN$p{;8PVEGQ&-D%>qKCa7s4SKZ5^R-EK-X6d
z(u8UdvWwq(86aEv*xoI-iM;>Z8YFKli{!0VsXq2zuA*XiVd>BMw?ft_1hfn?arwo+
zdfx2{_BU`Y7=eu?%01@1LTW_J-OjH2jWf3#CuWuuQZK-XpC?Y4CMP__RW~BF2Lp<l
z?W%d6-47}!^}s@V2SC0kR7VIa6P5m1|1gk$Gyf5RK#t}sLFmZ`!l2S$9$bm?g=x*s
zBbeWsy~Xyj_|%)&>H@ZnyB;DqPQYeh2EqQFfLEQq0)NF8VOFBCIVol^+7dxuIYFk{
zq3Y(;Td7?`-~G%#wS-(}))2ydq!_4PQXsmNBli98Mx<8YmIsxW8oY<{{ws`Q3;Q98
zC>-M{`T?U4=LpnSA)u=W|AXtr^nBsWWUHk<h7l34m(;;5^r%dnF?DPOmuv@DRp<5z
zV9f5Z9D}1`y3jCxM9Rt0D|rG38h<=YHUp5mL^AT|i(DZ$)j)^52@p3(qVk$gu_7{z
zs)0;}UTVr#2P8CEmsYP+x<4`YI2*vc9j9plezkMbc;hPR__g{5<uHJc{9m5L+}a=^
z!Hca|XK>uI0l5!GBHE~Kk^ey<I0Rp<twTVBzdJo3f86G=S~TXLqO(R18YwyFXm*x%
zx*tF0IEmb+&7I*2a*uAp3#5Uuk>?7C*DB-$(juC^K~rcK$$$%(_wHCHUBnL$Wdc7R
z_Or$T63)j?rHu&mFe{{VDfH|VoTlQ7u5YZm;TQqwnd1r2#-ZuF3`_yavYrGGMD#N{
z@@yNV2;6~}q`{DF2y?HJz)8};eVZh5K2UyvW<s$K#1Jtb&c|6cOu7OGlOpBAV1jNe
zEjU&^VEmfYMK1Q~^p0okp}^s)npK<)gA3Ps2>G{!0?`ZV$O5~7%O~#2@s3M1Co`|L
z<73YI$^-5RB;zSGrA<XyoF@Y%HmW=?cWKY*P*g*>2J2b#SB7w42|A6C&G9pK1WkA+
z2udeo3{i-C4y&HUPXJ-ZEMg1!Ds%;Vmh1yCp1p?=Ub&6Cx1W>+nEtn|QK9*iGU^*6
z+o9C8tnxl0$gyTKB7K6If3E>T-yzWwzeP~SC%;8d+HTtkEu770?thdDANz-2sY=pU
zD8l1d_i$O!^w*<SC=kRx{Jt{jEI6W!Hv>jIod~In3y4z^LnK|a@Osep3^xY7d<#73
zuq?&D(Ur7d`a`P{Pj7#O&zFXuQd`%o8^l|+0cD2)H~4U(-++qkrP@1hoNpj(fjYdE
z(@yG=Ir6q~5qMxjWsVM;J3cK={fr`_yvBj~yPL%H02la90GLOfE;IQ<F~goW8f8J5
zvHFf;`du<#NYu_lhy-U4r2Xt_fvJF2%h<(*_(?l4tX0%cVZ;EqN4mpZrzyJW%B0{|
zc@%R_BxeZO7cloBw0i9iRma)ilL-`jd-+^&$od9E<P`elF}SHImx71pvrE0#VhiUK
znmI{><4;7?+F1_63x}-e6aww&hps~U`<}|NBaNdJ<&Exv5^%y(pGu`T><YD5#)EfJ
zT6QQ$d$`y!<PlKt9&XV4IUg5t{c5!AJ@iK;MD1b4wZt9!a?rtkHT&D2$E-Q+DHGPL
z4)%d0H{MRBc7m`|{agN3xe~BR_v%Eqy+G(vrfEjfM8#$lEtNKj6e5I1$W;f_e6(?X
zO|c`qBP^}74awR$JMhT{p28jW47H}O3yeEK0v1-GG!r6e4(rAzmVN3|KO%YsKA#xo
zV7T-XU(+}v0@HFb+`(Pu4t#8iG`M!IUP;G7k#`-<^#CCzxLkTOSiug)?bLwVU;T7C
z=SjME{Tg%k4b6z?cwQ1a_1yZ&r|QbZ-Z%47Zs)^EJ{Nw~ZkLP1knkNKb&+hzdT}_!
zHWsv5HQ2C!wd>AX9``f?OY06V2-|A544T?O1k06z6LLzo8YzsqB@iixa;4SCcHX-;
z7Tk%DU$k5-NWkW!1`J_g3p0n;^dkOGr7>rxkDjNPikwWQUX<(a`|@6r9uhaUu+<kH
zO=n*h^5pXFQcR>~X<QwzCFU<`i^-hWZ+e}Oheh^xO?HfNF3SXNL<uVOO0JUq*|`m9
zARh|VDZXO_%wL@rICozGf)cbluh5j)NPC}GJBF>aT(~`xRouN~lv1Ya1xseqBVrz|
z-uGY<34#4+y1g!yyjMhmc1KT=*s}3*nc>N^EpX031R4s)mz6GxL>F{>qFB{Vo=}c3
zha?u#Z46NYITn8^U$+?PeMBr)P#)LT4F1IGT`XJ*GJP+q!`Im=JWMLC#GH0!u|ime
zoGNw~AnJ`IDC@}_a=oWxkJ$DW;SLpzGl3#+w>=0Sli;1^nLZz%rkZ1rLVsWeg&j$@
zHn-69)lIDeMNEX+s@!u!K^9jyXhw2%!u5CODR8MGCasO()Fs^;@zT^x{LK&o^>u2y
zZ3*NqndZxH#fPl!p!(6Chq$9EtBV|2S7>Pe;`ub>kQ;dJJ1RY1D3oG$+V-a5Yn$9m
zv<Gx58c4v{CMmq<*-9!79B=Sy_O`U)SAvvQ^{~d+fK$v^ItKGaw;P~$a{82<(SkYg
zzA)Ealh|L>k<6w@>-}uC+w*POIf%N^lbhE~0rR2NK@^Env8*|%gh$K3clfcudxCME
zJo;_7XzBs64`FL2dy8(#l@SQ`QtxWBY?w7tStFyQcFj4FFYOZc{yOv;0inOX2zEc|
zwy^Fd8c$m*BT8-I*EN;X+<vM7W?ui=xz`Kphyk&MY9B}#C|ogBN*-L0zzV(dn4Ltb
z^r-v-7%Pe2uPcr0;9)x6T>qhC4h~k)BJalL8zG$oRWcWsv2x;bv*M;tG*jsk?fUvZ
zqnMC4A4+HHccxvPa~=)|(hezO83B_i%)|-W1iHJd#pB<nIM2}_2Nh7r_bizN^{<9=
zPe*6FLJ5;sTKlKRyIM3LFmrfv?F>k<>I8Dqs7oLvm4vah%f7CNP=j@t2#&qH-p2nK
zP1Sr}*yw;sUm~R}mm4=F46z=~bdoQ~>Q^>wRLo12*h7Y_as$dY3|LQcI)XdZ>nNN~
zGh8_gXE&Lh>-LFdr3Avx3thB1!e1J^kiGESXu}9N9ti@5(Rh8kuE<Jy<5Ecj!!By@
zY#t}f-6*NMKDrqwNgGA)CmV7)VRW=MQjz2)v?b$VZo5mbRSVXl^FP1`BzT!TM9u<=
zgs`-nK_yfpD-q-0rU=Aq-7D&l)|;g;*g&Pq6ieSLDhUq6$^R5CLY9XtGAcYCOh=?=
zoAG|KGhaw}dpwB_TTgf&NY#-yY2qftg`5!yd3{QUt&JrwmnZ|HQqkun_1LJpxg$;x
zs_s}J+*`S6$OI8;=43ll45nxiD!9B>=;Z!998~WH8%L=|pkuGQpcgh$WACljT21qZ
z$BXFNT2j9@U<TsXGHkk~G^}4acsqZs$jhf)OtxdfP`r{oF`V_)qs+Rd&SQ%Zc0Z>N
z^xCmC*nVNP-3QVePk48cc{HaZU+r)L0TMOm3N(vwXuV421X|HZIIN5$tIc>@a$K`Y
zP_sdVC(xWgB!oyyZaftRXLb2AkJ9;t@<`1i6VECW3zrq&!Q`9#VOFOG0bE?$t~tX&
z-9qmU6PhQz*sYSz+{9;wUffnAEljil6AK!t-&(xQ2ISEa6f!qs7u2$;z#}1xul7>U
zs|8IBZ_R-lmnk-1J;Ad2r;nMPt*a$akah<26?KXnqtsL3sVAl`mKykbMJ5_G3VnkW
z1EKEcMNDSJ1~b_U+AE;)$85pjB!c{+=+pC}3k&bNF2y2f9cRWP9AC<vla)-CBOK}9
zhN<sk`5K&m&NrlMoG72)AC*slIT>~O9Ow1wsYRmc>W&9SqNo~WB(;neB7cRE3<@lF
z#XU1A&C@sKD5NC9EjJU?A5Ef5E&U1HvK|_j6SRINX&v0BUZ%_oGaI0o5~?K&EH#UT
zUTvt5HnNRtvN*rEvN*x?H;FYe^x7e=4awF7az4%D4`h<$WdVbjFHjMxO|i81n2u%q
z-S5J)uHlRI4nem2=jN3~(R}2Cbe1RuCucYl22u1~--fGK>BZ%rOC&4D=kujGHy)e%
z%O5x79!ESYT-+1%Rz?4|tZBDiu+v_8T+R%Lmr@5s0{YesyW&!|Qgh|_!MDF19uOtu
z5Z7bqiX)Cvl6KmlHAdzEYsI~Hu{v!{RF1-soFm2I{llV1(qSgLXP__lX|yps<iA#+
z(;71jkj@QoQ8P03l8$`^4h~qy0nXxfzXwiXilXBm!m*JpOLP-!Hmy`0L=C;Bm+{`q
zB{b59(|1#rgvpZ8hMI-4`Cby~)qvu{Dp!G0n$NlKnSZCJS)}1DT?-bBi<c}nPuf#o
zDdK54vXrg-wCRun1V{_qct;@H5Z%w0h0&+U4XK?f@s?$-0=j8O(+CGYKBkHhk*x}|
z7mxS7Q*26wXdW6|r7u4Q3=misx}b{Mp|X0mgQcOcU!XOArD<9kTJ{0>Y=5?irC7bI
zhBrx}iYtP<G%vgwwk$V;Yo~egq$JQ=n=`VCZBR0jU$|+95;JJubCzX<S7`@E!YfBp
z)xv|iACvC7U!a7&R43%xPgPd$^!GIjqb3Nbik$Ut6cRw$!tHsZ>Vh`OG>v<f{FSkQ
z>u7+Kp(Va&U-ra313;Rp(C+&|eflQ`v)#3X_*!t*DUGg{rb5$2S#w&+xBsa2$qZnV
z_zEKJ$TC<N`C&MKeHg_<MAC=#7X5jkFs?0O+>$YR)Kk`+lG`y-^?{y=+L8o=^0!*c
zvbH4hJS+*!<n^)QPNTv3`pI59v1Og7cufSQ9lJA-GWsw}4E!oulukUBv@3O2CW`qv
z{;<@p_&`rMRNZ*nffmcsUzbXD-5=)OYVS??HG#aYLYy!0ZjiL1DGG(Ud~$7j7~BC4
z(79}a{j@ZjQnxPD(pbh!UBrcJ8(KD}q+8+ku&jiLsSaRLCP+G(c7{fpD4}9{_1uUj
zw)$sO9LE5MK{J(Ny;3I}wMgtUnq1rMu9&j@$P7vHrhJp7#uv_nllInPgq*t-=j-w6
zL=>hzPSYGkF3^jq@!aE=89BBLU!$}3jm}~sxa&rT7+U?W#-bN8^}UXKwCmeA9It?w
zM+(TBZ?{dU=4!#6>j^SVp>}wg8N;t3$%DJmJAo3kKiQ`5A8K{y*=V}2{18XVY}mZb
zH|EsV2T1L-d9Cicj;^+S)05Z7X?ptEl|l5ETkrTQPWMW<Hf!w0eJ}rP4voI>t>2AR
z{V*684WK|P&9mg}<H}63lq@D#Yl+4Y|L_;Sw9fpwx%bzUa1Zs%x26Hwrt%r;vAiLt
zXrjVicJ=y{JkWxE;b4Lwi>-J?uU!KHTBM-9tlRZeW6DpZ(e-p0QgS+ceWgPWknzh%
zzWq|7@9@v)!)vV14a0(&=z|r^(<id0)qQMU|0?vU`Z|_+1GQmVo3_T=#t}VU?LOVr
zpfg1*>z=HD{jv<#g2OO%Bx!98^_alQ+RXR7L`+_={*MC$_thj~G9uxd^xELus$5<`
znVi3yKU_4iOr<+(tX_ymaK9^|sz2U#Q`^E*!%jRq;f>{V-ni-v@AS*!${`hSB5lKC
zx(llsR*M7pT`5P8=|QTi0jXg(Pnl%FmgW?I8Cq~NgvZRR61Oi2E^KLYEn&RcQ<Hv2
zU-pZu_$$jUm+t;`0KsR9EWt3aW;=nY&MG$k7u5`woswiZh{9Oxl2RGS7JX2992zEl
z<`9Y{cZM=Rn{GZZ{)La+Fjs;XxJ;Jg1DxCi?L{G-(UMozSdw(`@D~>1!}Jj<BqwhN
zmXrwpssu=%6lHBk{`?$GhLee7Cy<OA4i1^Kd9=;hq<2bI=rmwbd{SK-LGIsYn2O~K
zJBc+fdyMfUPO9~+e2Tg}UtmnfshJp6pCgHYu)SN~#%+5XIyNt_Nu_qK%5|nE2bPnO
zTDyYYO|>z@<&j}m+BAZ-vD!#QA2Sd|McrJ_=jnSkE0-9%)YT5DZz3q}YR-5uVXLke
zWEjb)t}dVVs&qmw^poi$IHjhre(_aX-FRV%j8<d8VT1uPKFBWXZgyDD+p989<inb0
zIOI!FhB8VH|ETY$Kf0^-1;-np%4)jmNkgvnar~Zv33bEMT<$ir`LwHlOvZFbJcdwN
zF{MoaL4;}8MK>_POd|cgu;F~;HaDpo);FpLR@rPh@|rCA<F_US00gi90^gy_U82sD
z{%0sdfI5F_8>S@P*OqG)^%#fM1W1^OG;$BrXCuxwKtnp2De1A(dx;92R6ha(^}oJE
zb+vuKelxZI_!yfHT8F7g>hP-b3jl*fs{5{$c~3yX=DsUoZz=U#@tT7#57TI?Kth<u
zB%tdhli*ceN0FplE$nLFi`>)~`0j8lz1)07FPKjqz3_GQbb4sKHmbw-%Le9&p`?a6
zt!Sx)%HhL(Soz;2nw5OOujZ{YFK{|Ph$Y$T#xl~YNIf1&ntP>eIq-ZUT%_po)k7fK
z!4(}d_QJqF5`3SJKZ&dM^RbBQTk1az_)QWY^a1PWZ~jjo*GP{(tx020!%-c>Xvu6i
zKGfus89=T5qk^OLJu{5$Ox<`71K{eoZ;oTvPsJO1_Ifvji(>jv?H+5Wzq49u7xLtr
z3sY9Jn4qA%2$%=d#-+!Ej)tT|fM<QP9Uy#+!)0WC4TUYa0M%KvShkZs^-%9I3JP6U
zmERyp4gk{9$%wOb*|>>s&(uP3yn(w9OL|0^4(jhGycbLwi2JfAMI9{*<nWd_C3w>G
z==Jyo(xSUCtn2wLtufzRwT=l#YKQ4+oGaRJt7=Zi;%KwArvdS>#tNl}SpFs&)%7|)
z{lks-y3~QB-hWlqVU?C#HIFtrTHs$~s2}zmTvC*j6|rlO5^Qc!3ri^ZahmGv>CaGW
z5D?ifkv_7gKBnZTZ`97C7QGIb+fEbN6V$79Yi?s~(N&Va_q5K)=OW23F^$WYIwN`6
z7Oh3j+T6EI1P(d}3n*pwQB(M166qvlJAF=%W`rf<%WbGl&yrnwm{RVI07HD6ScFF7
zz_dAk-$*{`DeK!X>kcPs<Bw7=Z}7UxrfSb8Y<M=8M)U72-6wxO;@i_Mq73d&p3<I9
zRI05n1aC{>#h15pV3<BqT*VKZ1jA4`g|T)Wa{9p3)k54W%y2oc(eAuh3?ln0C6X^q
zZ-ty6_sQN;_9V}{Yy71<FB!x-(C@1Sw|2)I#+qzH0nU2AScPW;qVAc+KB>>&dkpGr
zP?zDj@Sth+_UI2MrQ*8>b)<VgTJCciXsA&je7cX>{QN5~Df*4e$V}AyH=w;)Qn4vF
z$yGrw-74P9gC{{31A;5%$nPqwt4#34BeH7wt*sJtxE``x2hJG;hY;81<-oHnk@El@
zgl@vpt1s$=!?|AH91Kr8w++>O@{WhtXqu=PvWZ(74fo^p#uSAg517Br*bm<2x4O1V
zXbsL@T%0{MYow(ytY}p28C^B8+E!)5sCaI>Nbu*-2ODdR)`JR?Zk)xQb~%j$aD7c+
zps@a3`i_dVCM_zib)>OZ)fSdyoZ@<QB)Xb<NvI!L9u8q3y}V66P=qk4y?PNu)#o&7
zb%_ndW&Eg^y9oTCd{f795H{Q8!I*4^>Q<<jPKSVoxMk`YhvVKeC4lu7<t<gL-&gv2
z*_cv+z%!2+KtUmeoU)aDeEkwiBvA!&=G3g3mBX+={hgywgIw53eJRDVlZNNNn$*`y
zh+j}rBss_c?hBS0Oz%jvA7|yqu49!XJyY{<HNS=jGTamG)s3zoz;bq${6eP(_m7>L
zPTc6GmauD{H{%5gJU<VY7vSdb)omnn3M$SY-cnbbFHXKTIKlE4ErFsOS)ov4z8Wcd
zf4iN)IWTB$&0yS1NVVR-2hiODnF(*|l;*~u`s-m&^Djpe=enl^&cr^9vOT{~4;fyP
z9~W|w!aDGNs?DB0+`?0t>I^K>u;}aL6V<h!`f9`eYGVMVuiGRPT(>+h>q+1c$CfrF
z(kxD3Gn0>h^ziI-TQ=91Ah5ej^6?OO4??7b!y5JZ&`taydD?{T>(cScg!#zKjb0-!
z92>&%#al2r4-rQmLT)j<{Bx_n-6;1_4iososE5jbd~C}%+Gl#*Fixe2|H7nHZW~gB
zQ7LQsjXLGWy`((~nXp$Zmg82^-@t5ekG1gZ!(a(W^c#_RTKPI>h_<N!=42YooioC7
zW;2-n<}na(qs4C9)<_g(W#eO;7Mn}bvRawxp@i>`Y--ZiM|Zsmrn|iYoFU2!IYha>
zRxz7;8cRYIsiaT0aQe=9fPHzWs4@^PX{tSa8GKEln)AwOyKEaPNp+&sdTQEN(Lh=U
z5o5uLU1>m?>Y^8u+?lnJUTd86IWu2LftuO@$Gh7l2Ow^kruJ5`%=!|sk}R$Q#v{<6
zvh$-U(;`ADcqQaYrD(739?Dk(%Cyq8^HAIHquW}<jsk*ZSLtIFdHd_<5juMMDtL#l
z8L{{)c>CogaTV>j13W%IIKr`x&cDWF@EWeslf#<#4cERJqZ_n&rN$K_o5MQl30HFy
z?yKF_mX}T*v`w{RyjOdVvbe+0XB(VZY|~IJ(?spOQHECJ?WowfzD($%@}Pe1w2i-c
zcr+~qHC9f>FjXs=#8f>J^k=5Z%z;k3GSd#cD7d7F5hLff4PqM;L%4w{W`|FNR-A_G
zhojJ$*w0>2R;%-@Fi5w9s_ZYJJZCmXqwq$M`?1$@G?Xmp`f#%FE1=pJ?8;st2;$#J
zh{ySZ!wf#GK!low;~l>Ot6#uLd(oo;woY11qY*;ZPhmK|+<4<}4;8hru+dD8Bn-Ew
z0q#TV6e67q21G4gbOP8a?WK@6^j4sCg0G3!OHD{C$|Yj5unv4l^3=F=s^loTw^wQ;
z2WGA<;8g0Yv*RJYRbp(%G$yVjZB~JLaJmYnDO5RG&PiHEAA>A~wlMIt<6-uiZ6C;T
zbF4iSa0E{AJ62ZBhSDEcbNmlRDbyvi4i(v-b8t6xC-ygt(+;e?td;(>A8E-pOnpej
zTz}QEUr`zMfod}}H93P9;oKt3fkL1@^$Q#`;ZmY{Ledb|_IZ+&OqjWU+y>d8SeSxZ
zGtS*JzHhdW%MmRB@6TDOHnnXa)hR2$RDCt<nZxB?`<u&L^Ml!xO$LUE`gFj~+th}L
zn~hc&n&;Sk^~>4J7h{#5mye74m0A9AKc8d8zf`$RySA;?>gx5B3g{48R4s+SEm$;{
z?&xFw)RUw39WcoP+ACvy?`$43S5d1~5TT_9Jb8+WaTNfbo;_%(<w7q83kxAf2^-4-
z7gQscI;HBVr%-G)k@B%fRhOV6#-A++V8MSVa@`0*V~fA9)or}mBq)3I#44+SrC^7(
zf~*0UF{;ZsT~|Yomti=c4g`V@!lYL3ccVp3@-ExW)wZ5dANBFZn6bOQ_HZ{@hl$r6
zK$H`RT@0VRIhxf_VZUhsC}rXSJnR6Xv)R|q5Mnh)*5O#vah4%uo24MssM&TV{^`I{
z=i~Ld`+_F@oxD2t*e#f!Vu!*WEP3IQZ`#q+v)N&^Pbu?#TgF$OpRHBj#ayRR3Hl%-
zo4KV!IXCNe*{^@WwYAp4=KU!CJLiGzHN8Y1s=MvD@LBGzQ}?S?@A}xQ{;m{LCj@4I
ze>le42g%%)oz>uFdOZH6>dQxMIxFp-0#0)|A%=YRMhbGq0XBKaKt+*r{8QUzFulZY
z#WNX?-k6bs%GDZpx{EEq4zyQ=9aStfrW|d8Hr#f+@mHZQE$i|uMxOvfxEdSYY-$J8
z*Q<9qSLf~4E`RtseY4@}Yw^cQa5wr1+}Rp3`<A2bax@auSlp9N_$>5ig)H~xgQBvU
zlZJPu6C=k;MVvkaTbg8Z<V$&))q=Ws_wC99Wkd7ss4pY~#z<~wAqU+l@z8tI<<EvX
znVonQ`xvYqrK)qUehn=;#kBu>ZWHbWj*q>zKl2TfFs1^8PcYyU)b441s2+U^N)dF5
zIei17-!0BJX6@z}UkA!*JQQ;cmXwxQ;74adF=j+d%UPEHHRH=k&Elo}cakn6$v-ey
zvgThLgv=ZIv&Ia`SrKmFb9!=FV`_6z9{&WC2)>*LGr;PvkMkH!@<n~xXz@&uB2IF#
zVDNV^@?E{uNQysES-Pa1^VPh{Vf@o3*YhXaAoXV7X{+;v#=MtZqyNj3)a#>#%<nHm
z3i<N6L%e<H_T_ZCr;<QSmyDV(?(Lf{yDD(@$-et#LJJ(xHud)oknx%S;o8=4kbuv&
zMKt5&wo6-}R#ocPBM{*n{F_WEDkoh24IK<4mut2(3U{B4x1ZR&eK|8gwJ?vpj7Vcb
zcwQdY9~`C34vi4~tM(0CAU^$r9HH3vuM(GtoNdQ~QQ0sJB4bX>?K_SoN%{`m+%rG_
zxwL<J)mwm^dy&DXATjjsAivuWu+afmck746pYzN=&*<;>hd4)`CF^zk=P&<Id3?74
z0*J)8^=IPxht&JMDV{~JgY-l3_y0G^_n(&pK+k`^*#F!<NdI|A{*P53SqYC7AC$0J
zrl*jPA@v-2agmR9U*!G#ky)d^;yO)OdWC86V-$CDt)_$EcZK4R{NHBS!+8G#4=kf3
z{Tuy5R76G07YTgiRtBpq+FR9(3jUpMQP@^@-y(gbLiO22)L{v}fAWDe`~QXy{9R_z
z5KDy!A>$nPWf#G$4$A^TcmJEwAYR9jPgh%rzj5pT)eZYkbzY-Du!g8XHD#M)EMvDy
zQys5o*tTf@m0qy+4oSVQ90(0+K(KOshP=som{2St$0oz&zeRI+nEYO28P5w%j@D00
zfRbf$&-w$>@8!WL=u=A!+Utqr3Mu9sOW2->Q0ybDhJVC<lq0|~FFFh(d}L+MH4t3;
z5wwYJFV+$I1A`d-$Vka608G{Zr>}9+B!t5>JF)rOVSGHBR3bK+Ni5&p#v3<#0K(NF
z(5i4lux<Eo{`~F7^f;jWb58w&omz)no-YoU`nuc$n)+26tu8W=F(%x?YWTyf#)Cf2
zemf;I9N<vBt6!sV7pLLxHSqR>@<7Bpqu?YRkcxZVi?GAo0T2etV>-ilE0L<L(r%wB
zKbK`%sMQZ2G}Gd6L6&on?L_!&4&Zw-?(kY*^<4{bKOf#Pg<izQft;(4O`3qTv;bj1
zkK47~&h&w)^1*VOsopA~{mf6ElbU{S3dE>Kh010-yB*l8F1i7#td=^_q1nGxcW&3`
z93Ithm{B;Ag3%U$h(Pk;t+0I!0*r`u06XYtcM^Jj4Gw6l5u4Rspj!7B2B6X#iVcQF
zrrP^U-hT+he`Cu0`*uNeakBtu{ODKsPloR<e#}qP(qF))(e!&w`Fp@PJ_+klQqf{N
zaVXl3N4SB5Oz9cGscliP+R`Enw0~PjBUrkfm%tM9<q0qc9Wie>Te%ZlB{<Pxp#Iup
z1=uxPgZ3wCxP=w6CF^{>aG&=Bu(>^{n<`W*+_R^DgU4o~I8iZWl2>D1HTznXcNTaZ
z?Ihh?W?jskG^kjU5v{7U_1BKs^u9zONfyA)8fUZ`a9lIsD45`Q7Bp@aKtqzxJ{JPb
z^{3S^D-kXZEpdVz7fp`QR_WuB=i#G#!_|9d4Kh!s#skc`$soc=|Ge~k$&W!BgC~Y*
z`0DKk|6=<(;Jls>M1dYFz$?gh9*`C@AVh5efPEf}O(Q}IVfo-c86U7P4<>=xO*~Zs
zCY}>FU1<l|4q$_9fo>2s{4vD>Sy})D9;uuFd+9oFT=fofVB{g=8Ht<<GVCT20D`px
zroJCR*j0TUVB7AWW<1+K>gC*pVbS>^zSIFtfFm2Lo|p76ceB%v4j~@{#UX0D-L&}|
zdtk?Io2F)(D5xw44*6r^!02)o__d=?RT-r61Sad7C!LRE2^8!AlXa4{Hl^@eCB3hw
ztHDg_2Y^7`O}h8%*>AKj>Aq%&{fbPRr>~k}#^&r74WfImN1B$bFOTpSK8?T1vhH9G
z{?p9;t}%8%V&QKTi=YN?PO#5|+vn}36IG4B4!-g*KzP!FY*Tx6PZC-@X#!l$4^7#u
zujrTtnWRgXAcBzZl+1@8*DCqQZ<~VW_eld)dAb;Z=$B`59&5mt{-LK=zS#;W1t+JA
zAu6W{i0=YH7Rzv~rxzn{0lG708r*HPr|W^iw21;-ooJl**5`q3#wq|X<xUXB+earX
zV#0Xk!+`y{SD@o%1Lqo~eANY<(Id4lfLkz_D;9zDYt7j7sr@0<9&xN+2+PI4VD4K;
z^q|W<BZlR(A9Psn)|kWCS&kAU=5Y~5FF9O*Ms1cS;ogq;5c>2QplY??>!c$%M;P`a
zh88d*?y{n3q+Z|~O>Pe!(R;!BN%Bj)B0Nfw+D_}=#d(wg$Lt$EDT`}Faoq_CiDW}W
zO78&sJ*k=&;%^ivJhplnDf+^1W<ChIILPt<r>`0Q=&<Z^P^g|r;N81Of4~|+5AZ_8
zw(RQy3=gX3RZe{b|J3;K5h7o<<SD*u>BIVFcN4_1)U>obJ|~WVk$oEdA@yJBDlWKd
zR*mn|HDXim@jStt=kiZdRqh>PaF@8;|BP-AA{dM{8*Qj3!QSXc(h2|9_>WyL{i{gC
zVJrhJsOZLAuD_J2Izi@Mg3Ag^k~l0Wphbg-0#ra(_}!!che-xEaUr;Ox*iDAd$<m3
zg_HtwJ*sQ-w>Wb3e&La=473mRkHW5Pk~ZSdKq0h-U-478iOVzha~)7zo6~f@^CgUg
zfh#nb?LA+g9eP@I`1!ywFQnPQj&Bv+zLB8I&bt8GfVD5{>;SR?+PAuaA7xlU<rIyY
z&7iQLvjdc<6WFKEE`hM}@)tN7mfPVg>rny}AadIl9;Hm7{r#b>vi2Ni2ATA6pgX4=
zoI3tDo;NkB@sQH(Ob#ApjBqeM8X=GS1*D=6mKEz9^9r|q2JE^`s{3&cOR-SS8A`V@
zxym*E3U<V5WTn~b-v5T9qRBJ~63;Lr@?Mygc2cDzIc#Pw0b27nBiN!5bhmAz=sv**
zJ~(~y(2@!9=E+<vU3fdH<vLFzD`U%%n^<!L2z$&jUVKtp2mtRSifd_J|EEsP6(zu-
zl){9TfycXi{`$CTks`&6;{?2ta>;zdDW$IQTezFcpzza-Ge^-eQerJHH{-ES*9yCA
z_5eZj<{DQwEhtYqTmJeE>H@(~SzInS%Fo7`7P+u<*&SqKf7kq3D88O${k#0Q4^%nY
z;f5V&b-nHBt|--V%4W?V@9y{u`pm+9lXcrye;?f=9+WBZ?-eX%7E5f=@GpI{!6a7A
z_pZ-1X^lLy{L8_5fzO6}3l{d1m3P^>4bL!rZw_#eEf<PnA=Bx~d$6K7MsaEKn_Vwt
z9O?c1FH^C<Qv18eUv-0msfF=ICaZt46Xu>_D|}fkbsZ#mhpJ$5f70I4F?<DpZQ~O=
zK2;T;(QazD4!M-w^U{!uK(YJq{cYLyVw8m9Qp(}f(?AO=s<~R4y<o>-Rwnn1qwXO1
z+E42Or$=H7_F~DhZc}3q=ccF*1&@SxhqK6Pp*t8tT#J}hIU70qD=4<gMIh3d%ugkf
zXHJ3yP+L!aoWUUR;o=1CJoBK9AWdxH**<WKqv^_FaEp;F1pxueE94~uoN<raN1iU~
z==#}b670(GIzzdQ6ESt^98imj=P&5ROOcwv@{FCz=F}^GTFPNqg(*fivVm1_Y<?4&
zFXX9J`RH7`rL$|yzW{jzRytDF&v{+&;@i1ag-vbI->5dCL=DIw392U>w|s2-oMQL=
zM8<sBqcL&f4VLb0zA!&Ta;G2tO-TL0t*GS8YrE`+Vhj(F$izg2(`k~EJs%=@`aKv5
zln<xsN}9VX#E+4I@<Kv|FF*`~A3gmfS4<_>CX{*J@xZZdYbJ)?+J1Mo{-XO}hO>-C
zoXRmQX7+Mr3HfJ>OMVL--iWSMlcTj=%;aG>`v9A7Zj7{HXZHutB)q|X2QbKh)nd=$
zb#lBr*47kp37{d1c{?Ap`m6)2*=0<GNRJ}XF5hANIO_Njk`Z&@<J9#stH-Q!Q*{pb
zQ*k_=d27)p^L|Q6S&dR!zQ*#JO4p@u_0DWphqMgq^A_z7O?Tx&;rOpJNXwK`$pkf;
z-<0JTo*e}WXq32`Q6}_c$_txP(b1d5$|goG8h=mq*xaiECCEUPe;`uxhcZn-I|g^Q
zJAUjac~I02=K+mm7^}r7&((WC^M))7tTFkHmB0?S0SrrD6iDySO@{i^D4Q0S<<U0~
z(&%qw`+j&}zufN=GTmz!^c}qj2QoUZkN%^S7(TCxhyym!F+5yS)m^|^;|*@K_uFbD
zlR`CCI9RC1@S1(zvIk#z?Atl@lfvXz0n<%d)Q#|*3VFx0nxdApraa$<`M8@{h%^7B
zcqy&$!FOR(P6m~t$~n6Pi*<YB1vew=5Z0h$VLoJ`zkhVfk$setbIAK_x;@)2U0R55
z9*uS7Kb$fiQM{!J8rQ{7)zOdhkniDD3MiK2zeof!pQFXI5hqV$6xcd7;c#Yv$2uF&
zhj&vlOg(_^+T$927vS*{m!~4|C4TFtj^^ax%Ro<2rdLTN%zLGby?GYd_$_2aXV^6N
z_FHAKzoS3lO5gtR3C2F_WoKW4T0(`!!>+fW@rco;8(*lBRS|s03Nt6?q(&oX2>9FV
zzEE@Nb&n$1lrd<)`ieh^d!e#QT?w#D-O&v^d73$f<CR1k_fe5@K*!dbPt5Tc;J><&
zR<TbNI@#w@J$!O}S{Y-VA2$u`-bS9#&ECM8-I#vx-C}lW+@LEg3I#Qx<dNH~Or>or
zUSSFe64^g~W+@myG&0V9(`TKog-cZ-<I|y>TJ?Xbun@cZDYt6mQFP5?Pg%9<joiF_
zk8nt*PVp(|Y+D*jn_iQBe#;uX-X#=ifE4ru7f-b=L$E~iv^%*+-&2gKuz)T+s?j01
zzf#KLFr?`d)71}MGBoX1g@H<*_w$k1eJC-cx{wr{{eBQPNFu%}l3F^1WtO8l9XprK
z?WUt*bsALAm)J@9-bDWOb%|1>Z%Jw7VxfQGdP2wEg><bt)13JNxrWagl=KM7-kAWO
zb>UW7(PS$t?5}yb((BHQzzy|%UO7%4I&a8IVjk^)O`c`k!S)bG4Q0aHy;t1xd0q)J
zRy69tqygtwGbY{GFYaQX-~O+kH7XAj(gBj{%k90VER_YH;|77}Ii?Ya)A`Q+;Jdxx
zZ0N&V`ornyd^1Cy#*mhm*G$sw_eqr$KBJ>r02BMIW>kirKCXkFQ(xi7>j?WRj8;pk
z0Ud5Wj`$<oZg>(1NgaM>2x5#0zuND8N5p2pF7-V_=&KTvPMk_xV@&XKKL^d)&vR#5
zvMqOQx{Sz)E>BjP5R+wID|Y1*`*~G2g|oE~XGRa+d!<_<EvUpj#NO(f8QYXDWk%aZ
zf3Y<#Wb{%UC1Y>a@Zp${@duAgqt*p07#gmYjT~>d<>muccBae*zbK^?6(lq`KW9pq
zb73LhqNej`l@`GqXrrfdK90k&T`$v5TqoT&vY!Vwm9i_fFHuyR_GW(huZN8f`C3wE
z;cl$rhj)~j24vFsQ8;n21!Ibohc;=e=`tTTWqOS%Z!O$UH_?%^BXGwy{$6VUN@7T`
zSvTA|zbDHt5Jz7jeoXa!P-V9ww%kzZnHw#XC$FGV{m|C~^5}YIKP$Q_@X^T2iexL&
z^y-Z;=zJA|2h4v;i|%MN%G2`R#1FFGd?Su;cD7Va_ASs%-&{5xUr8y1bsl~VI{fF|
z4Z|{=IFO1XysyEfB_=9m3p~odSi*ctaE)fDu^L=*n;lSCZFg#Fk)(?*j=`T#{b}k{
za)W<fbO}<Au`IP$VE^;u3MI!O-_uTh_txw)E|jcJB7NP5eV85<KYsuGQ&ZI4opL!1
zlv_OB9-BG=Az=#!?(0Ln>9#*Vl}ky24aWOYu%Y4Rkhkp)m${37Qo{@~m)Pi0mo*I&
zY}Lu$eOM;2%AclL$c{SQe#qKF?nb+Z6i5Qk=w_}mA@1t3VS;Y^>8Eh(NH2Yfp=str
z=cUbG@eW;l>{CZNfM`7Z^%>MF9n{p#)e`(`8GztLI;~V4XD=X+Ca8kXtC6a!>D!dj
zJ1*qd+7nGJkIZpbXBcwqVGJMV$$rRs(8GTg2eJWaq&o})B(dd~#<i4vHj>Fr^L|eV
zehCiIESMro`q~&TD<j=<Q@+Gk;xXwe><*AR)g-0AGg`Vpdt<}V+Nna){MPCXQl41N
zk8$SJyjD{int|$@FlF7Z8Yv{Y|GIJ&WR_`%(hY%BQYkME1j|64RlCh>G<-?H4Q!A2
z8Jw1nfn+M+D)hXzZ2o-+_v=V~kj+#m)sBLUv7v5u0WKiWE^ewm{v4ajIEK_~^p9&;
zZk*+2bV;<OH@#z1k;{|0_}@O8tcZ@l1J+)lSc?F}Lv8dRU+5Wn_*-7-=K&Gss`4?_
z2%(=_Zp5umUeKyOo%LzEAE1qRUetOtw9aFEUW*h2u~yUZxEp&;D_%5el4PtJ9<eUT
zP=6>tyq55gwc#Od-g!DLYsOPYaE@r*$4+@Xkn8FfRp{3$KZ=~mebxo`k1tVYv5i33
z+YGE;fi|~v6QN&Ydd0<6JcWCC_Fi3CN!6^RRW}}VUa6#As;I0Dso0U?t)sp$9VMh7
zR6`|Ct*)U2i!kc$Pd~CuWO-u|kMHni19u`4+VvM0q;d*QaayyQ80g;Mq@Kqbzl#4q
zF0VNfmPm3Arg8NC(s0toX*}utVUY$}=;J;G(TLVduw`ClpZFd_i~E#l3ggy?TU|Q3
zDc-m=TG!FAS3r&VCBlKL*rxJ{Y*!}QPwG3XZ7nb3;3HBn@hrQazFBm#xLqR_-}hVY
z(z$#uU(BwYeJLZwdyu28L>2|v<5v{Fe`$Qd$j5-XbAZ&;b(h2i)6o^ZJivoz;Y%G;
ztN$eiiZSH!Fuhs8X&X!f*rEGQV8`DL`PniNr4Pw+SjI5Be<L!NweSt`5F@4m@eB&b
z0Un0lfvBxY@s(gyq8fr{7+;c7!2Kk%*^yfzxBxkJaK<`>YhTPwdZ$-6dtY*-prO|W
zR=V)0eM-DI$~z}!4!5_`kA-N$5_i1c_=t)+v*3Z>r$0Y@RVY#~JTj%y*E87#uV)`6
zT_0vGe!3+Yh4_P2D^WkODS9UQnN9*_#xPhJl)Tb`e1SR%>GO}75i%cRoP5s~%uaTT
zBg%@B2YaS)4R5Xo5AHuQ$^x1*7j%W!BqvJI(QaW6akcHLbYm=P*Gu7tuas$ZfBiTL
zT;+0|9HZxa#^(yeRz2ugL!Z{X29|M!g;D)-`RN=Pzf(ZFx+Rp2zcV~Sdb~{kklpy=
zLt+jej}{8ky+$6M1xfm}4r2Zw>(i8X1JW+aIl4)sU%0delO)TW(wATDgcVhtfpqUM
zZjjD|CRhCHLtqiOZJb;7NAl@}V>;5<N58-f!RXN;5v;J_F+&@Nnif>(I-;w~W9)+s
z<rjtGcuTqDx4jM{_J6zpu1^=OkJ+2tz$D|n?HZI$VP}0Jb4(L)5$3E_S*@fmFR=y7
zcm{(Sw2rp$EIsbsFoL@1Dj1i(y?6m0pd~e>RWfH++<&ac=pHgCQtZF4fY0(5jX|4-
z)oL!0!@{z^nvj&4*)_BretI8JmcDJrY!&VfRlH^NTIV}Mz=iQUVUl|bwE4vXD|g=C
zBR~wK1({q?v>Be_V!pEIVI7vLxih^S1#KWDBnHQZTQHsnj~;!*J9W~TCk+3_d&kXX
zi}C75Q5C2&%bs7eOe=+9znU^vnLy8O2zH@nuYvFC68z3;aj6wk*MZq<zt;XB&f8Sn
zW3;CXr0$K%lL1P`7uDVmd#u9a12jkKtA$QMdpjd*5XpAJ`anQ+=7ae$1_?K7o^N~3
zR3dolYP=sgD)635s6#G$NXEjwZH@@y`QF!iL!Uo&Yxw2O5dP3^?nz$e7YFFp81r;E
zVUkqC)H7TCS}cWPSpH6O&5MBnOY~OQEXMYWr)1RaT!a@14_L!HH`g8QKlYo0&crch
z?Rmc9GNQQ_nJ;uY{!+y!cvVtpov1V|{d$rj3EtwS#Krrn{rg;5InF;Wz}j68l$QhP
zWYTY1V=OcV9K7IB@4@x$M>ldI`F;&1feB3CX;5=+$+C&<+emHdyfh+yWR2!hxzLzl
z_T6K-`>QBX%)57?k*h$O<YM!<yL6bKojLVc^pwZi!ukYUlp5^;rc{Uk*PeqP8sh}e
z{2YK%8*6tQBjLrkaL0V#AgSq<ZR=1P9oX++5~JeM2@dgdJBIDbi4rP-g<<=S^}XW<
z&scgG1+}5ah@HOtpywm2j==9fU9#_cHi1SyECCE{&h~6@ij|LE&>MY3CuUZSN*A~@
zo|RC-CsBa*P4Da#k1DR3-dD|H5_+<GM^agrODJaT7fY%SSv8Y#bPsW!GQ6Y}K+DrR
zE3YWcp;I+HlaQTzJ@WOp9PPkvT`?K2m)kc&gNERp$8w5N(lhD#%xk6oL^pIJolj!J
z!IVK&`lFFt9g_V2*sky)JBjOHGFK62+`*bF+e0&tvaQXb4zz+gEEiM`mj|5ohees;
zWE?w|`8=pRmuEEf*YUd1QKqc`+cYDu?>fVNo@fDHYM$Z3#_R^loK5lL_u`r{%oYfT
z*@TSto9>l1Ddz<oF*0Q{uYfr^mRac29+MZ*#8F)i3Gs}LFMg)@5<R5)f7pA=sH)QU
z4S47-=`IE7lx{>sQV9tqrKJQUq>iMdN;fJY-60|!N*zL^loq5@I2;b}K6`$@nbF_y
z<z4Ij@P7EOH6NInz0TfG?0etOeO>o;;bW3ZJ}td9rnZ;wmK}gxHIFq4ex}}reb83I
znbs|kb-5Hzuks#8BZYPx;^BgUpgcQJ$a_k3Ni}183<iM>DG_8R&+t4M?|0`v>I%^C
z84%`9!5z7ctc>oL^;*gF3Ij!Wk(BS+O$XTY4@n=Y?VDTb3!dxbbycovw(+{5`=?7i
z=K1_#MZ@mdk=W1URvbB<Vt8Dgi&vCl{l3u3x3&_ic2Ed4=5ZunYX`qYo^4$#ti$$C
z!VZ#myZF`+D!Zu%L$_;8@kJRaufG82LI*Mh7LgW#y!J>VX{>66XRlvrO5@u|>aWw?
z`W%P}6;RCsd|!J{Yps&bM8q|``Q?BFat13!1$52ugeyZHxEjMMIdI&Eb(1!2`Bqpa
z-7+OLBe#53Nu3{Z-xXYe4;%OApR4qh$vl0`fr-ZJK<YS=#$55W3R|5v-IwNJku`<&
z1ouB56!2wfHM~S40qXzh_o!!j&(1&RRbqD4a-=Vn?o6olMgO$+lqDmD@spX~SOI(}
z`hJ`{=8>tAIK<1HlID_Dat{_nS@}JO6mdc!6=(Ik`eMJOIA9n<X|1hzqCDGvJ`L-u
ztH$FcI6_pZ-$PxG=Xs7;Y^}M_*#wg?AC47Ofc#h`P-)e3m+yhr`wmb?PiOkl{MVQ7
zuTS7X2J~ym_s`=hhPBVGEgOg$!cmsfUg6q&*R<jED%4;BXz0-)tfK*#Qlbxfy6HI;
zvtpSjIz8ksEB<Zd;5QYN%;zxadSh?8&)El(9Lb4j!b9moQn73UBsb0yeXa~%W>kIu
zza#o{ZN9M!K1bI)Dk{(TEiM1&_>aQ7nL~Rnrh|9k{}0Ou!c1e`{-fw$BZMBY6+!-7
zLFCLS=hFW^@SpQQD2awAsyu_H=l|Qr`|rUKw#&%^vq4QOT>14R`S;&6kI*mKg*9Qk
zMP4|rMQsK20Yp9Q*6%y;zt;*bVO}00^uf{j`CF~yuTghrgHi3eU?l$aAATFV`A29<
z_K0)VqW)UWUxybh4@R{(i_H!D-$nm(N}fYgvc#w`M*Yj@;Ga<if>Cw15b2>`I3=vm
zlzfy9DiZju_VCxJ&cLXm1L@ylUN|MnT3||^d;Otr_FKIC@7T=$Z=ru%Ww7-Bx6uFE
z!T%q;(b3a$z+PCp;m7N!c2LqGmqX2y#O;omm~BDY3lLy~__`uTJ@d27t5z$AhD|59
zRaI{9#m-zXNtjpDBI7*d%$3z~IPJn503@xu;mP+NsTn#H=Iyyp0sYLlBc~+m%GP)d
zVKvV-&l|sQbr$gcaHtB2NzWp`)VD*{tKOABFh>ZIv#@fX7c1KXB-gN`=A#euK<I!F
zvb=5wtxe-MxK+qtgLwVm>E?m%%aat4`*f_Aw`AE?fOB>@fR9&p_d!xb4p97esEo(G
zcn6FAeeOiBl5-yOx`;FWn);E#*g$|#VUs;;`oxhQ60a>MY5E=L^^owC*4&9Jp9nZK
z6cuz`9yp5RDWd`BA^F;DLm`}`R<Y@a<V?OlUKyT2M%~e&UBQ@XTb{`Q?_FE~*js^E
zh+3ii3P8#Z0NbYre$kSI?KY6~slR^nYcN<;0Wp9ke#J>#R|4SON1>o{ZmWUak*T)}
zL>QD?t5$#|sROSSr#+>YAfDe&Ff$>@{#1EUK(&XGBhzCf>+W@QO)s*eQUCXVZ5YBH
zCnH=w2iO4AS)g_;2yBX1dTK;owt9aJXIFp4{@bn9z^%PU#%on_NN}TjT6NGhnMM6b
zB6k3@AOuu%*kypW2%5z*AoNGvRZM_9lApMCJ&XSiev3Rj%Yp5mkVhUIgh}V9n$K__
z^ovxg`0PJ{{E8rJ%K0#QXWVVS73nu`Mxd4+$o7}r_!OK;h#_4p1kiK31neCve;~Zx
z#E3;U--Ak!G|Zzvt&{JIZ7~O;cISI}%A-#Jh2Sm%q)ntp(tI7D7C`~&VciH6iq{k~
zI&c&L_O9Jc2rpp&8&1IAz!Gq_#3@e;7N{C^Z)^~fAo4!ZG_Tl!tf9BgfkqIKDx;^~
z*K?qvKn4-^y+44xBS+i{%7?=hfY2TaH8FH^ok8kJ7%qrykTe*YF_11gJ^(ZeBFL{g
zW4TKXt%Xt^yeo@x44|O0w*#q3K%|IDLg+vy(<48%0pP@lmHbqjw4GNZ{#PMwq{Pu~
zyKH9E91e_&rfE1E=pJDVIu!0dnc2^hF`EVQV|UvD&dONeD-`npl!J%~cq@S1q}sTB
z17yYx{KIL>&%uV5=B*i0vVa&GKmtM0-T-0qs$2&SDu-;wEIO*#jq0GYIYM;ybjzy)
zh+{F$fIq^)_TWVU{F)eQ*KPpx8mm*elSz2DoN^%R-18$K#6<#7)NS<dtk1=DGads4
zs0u){2-DS;y(U$={1pK56anWavprHENQl6=d<om}GLve{6goTs^Ci36(JJN!tvqr#
zuG=?HtJDlESOuUHbydyV(PZD61!RtPsK|7}*ql>@u8XoOs2-H!ne$7QyXgbTc7zK6
zv6Z|}u4hCpBS6LEJmN^+sSBu&Htmb$&Np)sf6tR=a&1McjCqIc9|#ie*j<Q3@~4Y6
zE8p3x6ycD(Q6LV&3`wAb7oCV{PT0?`=gO^mLd2Rd2qj}`AE!F~0gk7HJmpP~&Z0FJ
z3r>L1x~l}JTebu03DvRAd7S@-Ri#sLiHo_G{AHreP7%8(zPh&u_phJN2P{ClfB=wF
zy!>ojKv9N03k@+iKdC(TPKo(e2WvRPC5Un19nm-lM7wr<8bIFKWhLYFuKqZHMIeh+
zX4~gWo=>eibN;yI5m~F$2h+5yM?$49R{k^s%p4B{(muF5DGo)2BX8SI_-2DYKijSX
z8(lQO>=E-wH+bDW{Q|y%7kmD03sS#n_D8W__73CiCTbMA-^w1NveeeME-DjVxt`QZ
zGE}<!9~h=0|4xQl8^|l#J`Ul~U$6Xn6D2atUd@a=wv~6*eJM<DCt4xg!kAjxDaux+
zN%qOW$T|_#K*YA^!I7}kv)SVo(4<8Rc^b$Fob0BrSi6*qoRBfXC*wByGb)!?(l#gl
z;DX2PJrS(rls~I2_vcFoq?kSUU{6R%KPJ8QrTX$_q(j{qay>3WosOJfZ&B>|;ApDV
z0!qT|VPZC_nkZo3n<L<R&j-SXn>~JqncIGxaVyf00N4%M(S~N1;FkXD_;GagfnXVh
z-Ba$-WjjJND5BkT{|dBQHW*{k0rTS;^<vNaG=4aKM1Q=D^Hx;uG=4q3VeEM~c7f0t
z&^Sm-ZO~8ql0Wv{UgINIjPj%gP2?`r3?VZJu=2!h^6-EgZ*>jm-*z?itGV`foa=vM
z&Jf?_sz&ovrp<VRXPZhiBAeciUFIXRAO3Q($o|-terS0&Qd&%+-;M-c-*5`P37M%h
zW6%3bZU~bzs*k1wC1wIRkZ5-R<{YgasIiSfpU~|sHW9N@kYX9xA5tAw6A1R{{`!Q1
zd=~Hnku)mU_B76}3F46H+#4?AV6c`EF#jlP^;(av)`Iy4hwGB3`n&y&Yi{+d&3Js1
zbdDvr!946f<i*~yC%04|g$g~X&mIw}^{;Wp_3h`={2(yZA`e`&H+jJ;Z=<AYqvUWl
zxmb10f)8Gnc_J8hZ=%p$wkpRA_)N<s!Y`+!M|^X=wq4H=cK6V$A>03Ol6F?w-hYzw
zzHglGGDn5=L9(TvoVyu_-|kHMCjTVDDLa_1xY7r#l&Xl^b}r3}Bq;F7tyW|aBzTH#
zusYXUa!dFLPqq+ZzpdbWZbL7}zMjxVC7#5Pc4Lx$%CNacu1i>4FK6eKLryZjXadnZ
z`t7cnC0iT)m**8)DvVWPQK2XXHe8Hb)q5X-IAAJD;#eO~bTAIaJ$}83HN{gmE30h-
z@V}^Wp04J!&MfsbpsdW{b3rH?LG~ma&dxum7bUWYZ~6%;(N!Nl+a(KtIEJVxn^y^D
zZzf}nu$Js;SkkQTgzdao{t3Pbvhb&E@kS0y_WhA8B0NzOEi^Z!sP{AhUYTM090_Ev
zIQHripD);Iue7rSU!S_l$O5Sh?M{GC?xkvgcWApL84D3%>@-^ce3E+~hTVqsDpZ)o
z!>MVvyYkzBFVBjFf#y5AM0`<G=ah+q^gC#9$^4(!qJsKMTB<ro<Yi1AyinO&9}2L~
z2}E4GiJ^?WeJ^hDK%KcYo`2IMi}?0HNrz>f&9(RyFR*v>l6(6bIpiTWWRJW45g(`Y
z=9Apj8o69n6sSP;Z*z8%KQ(gw{yopsx~)WK&*K0m3#aoMLA4B@lEgx4xE><!n-6x%
zY)ROPXYXK1sc^OFr+pE}xBa~43+^4Ex>+JNPRq$3Z}1Ea)ya4@P;DleGNWa#h`$2c
zM?lYllhSVL1CtR0NJS(GvR>ip*vL+?Tm_UI2co;`Cwy?ttlKj1(ZvK<0Ng!tMHW7B
zAl-fvYD?%+jTvQa5!KpZhSXSiqW?>sC@d7pAXfE;=7=gZ**{L71Nom%fgkhb4QZE<
zbG`W-4^TRXttKwmL;=mZu>5brt{*@s7H=WOKud3qpQK3gj&3W~)ZekJ{c1pTa0eC!
z^W=UY`25IsDj^0%XGnic;vUdH{rM$|A&I##?|Pzwvh2gPyEeKpdo}mcVHD$?FMDt#
zuPfy2wNYU>kceq=3M>Mi=w|q0l454^ERF}RR6un7oPEWZ-JW~l+n3#HM^5;+o!vTf
z`t!+_3MyrG#gPfqd^Hc(6at8*L^tCAdCR3EXt}T;t9M@=iw-;6zQUf_Crj*<OE%Hs
z-TY4#S2bmB!`A8iJ(b(ti=X)%3(#XUF+TNq|9BOS{Jto*sqS2Qhr+HR+C3^etTU9v
z`NLE5WaIJ)ifDixN$dpG234zPlVlWZBPG+RR@CUQYk(*y3YS29YGQOUp<0Gf+Ei|;
z{X}KV-=tuBtT2vx2e82cOr2YjE4tlSNAh{Uqo);Eq~m{685W`BCVPT=ptyq3qSpXq
zC{6a<!FR_a8ZIy4OP3y-z--Iu-wf<AX-XA>?VNe$eIC1|M~bRMb=VwPD06%Y*8{#&
zzB1!;ZSFk`AuE!5GM+;8mAti7>Y+5(_e68QXhiJFM9G@luWeMmycMkJ-wU7An?g~{
zn#_z>zV>L7h|6L8C8XqlBeP*gK01*u?nrCS;A}`i@Y(rE%Xwd*VOsV}QMIotF=gjh
zH~$PK0mB|^&(7cG^#f_OMAc^|A(8P~QudwMBzwi!zN>%aUv+&hM5StacSeuAe?=pJ
z@Wm^d6s1M`BFr>lG|WC4?Vjmr%L?nh{e9D<1HR_t9y^-L!noq+V!Lph9R_zY+`g;S
zS`AbfIB_K92J--{>+S0>Ik0SP$15g2>*u^7;}k$`NjJ3v>Q_7*&s<6~6{R+LDD5Jj
z1?;EKE`7h*g}!i&o+clV2pUJ5){|;=Vci9nEMuO2*P^4rlqM-R;T~$ulVIf4%-#}t
z%PD|eR+nbv%l#gxVp>hJfAOB%Y&M%l?IY$Jtf$gQ9*^3pN)2_b<?^POWu^$Q6%YvB
zn=QANQ`&o=f8><ee78W(l(gPP>8)nL#<eHSY|Y61L@8<vxKfLJ|F)V;%$0Qat6G|u
z(b2{2e^?C;7BmQX_Qd6l3o~2zWSz+{lq%>_c)ep%dX@aG>$-qy^~um8MSY>d=%=3z
z%&78|g5$2<zK_*|%2O`7!x{U_E*#prhhMeUmyZNYT%I7Pl^xU!9_U9G!~Z#82;Rm8
zMr}zC#e#BPeIvn_N66-K9In#el%Lgvg~{~w&W&3Jb?1BxL{wX+DG4FcH$<6E&X%hj
za>j4v7y%y3zT<nl7h0u)D{)<~uQPL+#&W}K#_xMEz97EcJ$hRebu~Az@SK!d#=8Te
z7_F>Ucw4eWMs(7jRRuj?9B<ph%I3#)B1B2!Y0&TZMY?1b@9h>cCcNX##n{%%b>JAv
zHNY{<$Yo`exmKOyMi3_I^sVYK+t7}|Y-#(=<T~+_<tEYkjCNZrR!U%C7g@7mePVdm
z`w8oa(1b1itucB(<_W7SHzXsi-7WqoMkg7-Ze$9#*Ec0T!U<8B@42&EyVhJfdbIXA
zT-b_e!CIuJ!8E2JuOuM$<SLON>iC^yi^gK!Nuhp>yvxXbmw(9?icY4!Pl+4ZF!Tk`
zURGU9lNR=KCjAW!Y+`GHkK6sY0}Y|6!1L3^8sQMytnaG_uMggr8nt`?)bl;x)KSkW
zXIzN)ySHz6_0rr1uY_5XR|?zrl_)A0QR;f|KXn5Q7IbnO$^v@l#w%Za;QsTsO}dtk
zSIlt3w_1`<>l_6txJh_ANH=1fDij009tGM+G2Jb!Y_kwljo+=1bR`noi8ujf8SY!M
zzF()}W*XM8m>-&he@Nrf-;xFZ*}5KogCW6l7Pl5HTFdtHGpp~^1|h5yCZ8JE!at~-
zZBL%JRHFIilysRl^DY!!7sHJyPIH|>eZq_--`KP^1SjW(W}_j@6IRBf(`?P#9~Y;B
zxXSiABbfzRCTgDfSyO9cNYh->$az*=UjdI)vf+n23&J=m?%bm5FTZt9^0KT!Ej&_c
znL<3v28+|c(xSFhG{uf`z1y>YidDX==z2++Wi#EL)y5F@TY=)sm2B$8=2TaYi}Xq!
zs2rzb8N^z8GC%3=9D8P{RzhPK+KZ~}?5K${s_XQx9*N*F-i005oBw3nb`&FxEjBwo
zw&^>`Kkda#YsJ6EbVJv`fLC~BtS$d`=aasD-uLo`u#fpw-U<08^h@3P#r<nsW)|Su
z221VHkWXp`TNc&=$RM08E&~e7YvS~s-5ne@U2^f=`v_}b3>V1*t6ZZf9wRlkGf-rI
zJ!)oT@v($q@1*rauEz)~Qkbl0Yg+5X^czwK+u+oqO9Z_bKW|gTEcbq4F`j-~N!ZhJ
z3EP0Yr^m?1)qZXvM6cJbLYF)_{z8#*hD|LO`3Se=*?9+tT^Jll4enx`PUc(2M8Mbl
zo1ZeyV%cC_dg$vY$k`*r|NXU}{m$VW&1TnrQev0JT*Pqy>nml=N%<C6gbYO3QWWA>
z;43yqtSfy=-_|D&dUq1b{jRjO7@1>9Y;h@72lP2;ojnYGQ{K7aldhfbM=3yV_w*UO
zvUFhbovM9fo_4B^G3`pei3>qN*70=jz7*?UHHD!-Oaz}aC_sctZi;_?O~6N*bZ_B2
z&IMVXYi05pMr}uG!{3a;H{n1WV?PRKtnlhsv0+||U?)U5P2KEILc63cR$#%4MVEBz
zhF_(4mk(KQNCN6Xm)4j<d8|T5oP81+=S2FC20wS-Nx*k76796M_(U*Vd^I|6Tp_|-
zFc~|&?$UHjo;9ss!*fNMPRV`Qmp9@tERu+ASb}r9gPsRfbmVmA&xm#k1XPGm9JiKf
zyyfm*5kV*Ft55g5#ov&-YxrmyU`5KSIgd-Q(uNai$zfq)`_^4*;R*(nhWwd|vv!zt
zdv*5CmD!VPW^U%6Y|+&ds%zd$a>Zt^3fv=@CnkGsWbUdpEk^$%f0ZoK32D$&Z*(b5
zPW4=bv#SlYvvj+7Yg)>`T+5&IEsg86gS1a-+Gd4Jb+wY93WAL#qUxS!agajTgxXc|
zo~YG<MoyLyGE&of(b|iwQqu`(-XB9hKjR%@k-068zCfuYuxYNlwjeyWJk6W6o~K}C
zVA;li-m}i~g<VG<%RMKv<?_`ic36INWbCv594lMR$x<xBRy&G#0`Dlr5b5BEp$@&M
zZQgG*Yoktfg?elQkJpJN<F#eK&2`pf_Ku}4gvgVv@9l0^_3_iYrB-Gvgv=5NM3qOh
zCA|H7w>ttoiQ#P;_ifuq@@Cd14I59v1&2*U4xn9h3c-^pBW{qpJ^<sZ-*XQd)jxWt
zL_0UbUExulJkFbO<9ZJX#;6Qpe^qzOJk4H6;u1f0_0GrrPPLlw-IN8r`jSiyxAyF3
zTpN{x8sZ}AgyoOE*KJW0R1xkP0p2z0vTYVJ-YxrDjoTXTdtPSwq{DYMo@xbn!d)FF
zw}-{G{+mK+BmH)S#ipSGgBJzunW>DkTPQPIDk6TCS?(J4xpY=H?~A=AKOCk2Z6Rxt
z>^n@^`gOfejp92c4n)kpNP6;{9uhj*rfx3OrfEvj6?16`{^Y7Isq1v-BeJni*)J05
zDttJWSH-1O=px9V!t*zRK}d}jP$2Z!mJn_@)AKWWH(Zjigd|Nb<JE0d@-<vh1p6-Y
zsg0({!XCnSXa9}oC5`2?;53*M9SsGtR|S$4wlQEi_H;{`R(nhLBM+lOn6u4V&hBGh
za)r&a4Uas^-Up*idygJ31asWC&hMY+j1~AK{eh`?U5Cm*vXaYz=;p}d2ggq6#h7H-
zEw8g9JVFaRawebK??KAEAE(1%K0*!U^w?p|?YfPYWR@CqZ?mJ=4$3`LN&(|+ZAsE|
ztJhQa&s(k~LGQq$+~N-v*Ik9?`VT;j6;3ivX18OswCPO6<YU@g-HJ}oDc5(}&6525
zOUsWZq5FgZMtJ;0fG#Fc`q&oun&NZLb?JD{#@21unlNLJpOsjxx*&BXvrl-~oYzok
zCn;86v$rOu*He&~?PPqgJou^a0bJB|c9A7zACzeW1A0$LjwV6dMk2E<j_SafUtToR
zomok-`=3a9_}bH?AFLQRM<eb0+C|@!(DP^cy>*wJkd|*28Bu5vbF4-A31FppsK`xS
z*(5jR2njHN-T50SN<m=KjH>4f&HfQQ@p*jK+kM9S=<8AI+hV}moG<lle8ByMqN%oP
z-dW0SG2FErlaApla!m}?+C|0-(~n2tNED0J(idU-dScR*r5dLTwpz4yD5NPSlSEv#
z<wPe!4^8b@`PuP|hxiul#N_9Ye#VG2`H-(@t`5(F*fo+Cu2gVqA#JFmFq9hmg`E0Z
zv&YgK!cv!3#<lK_v=zbX%w6M&9X`4M<^BHAiO(q#3J;#!>AF1vWRi_}DQCQ{9Lg8i
zyJ3$4SJlmW_qnC+mGTVD8IGUyq2Vx)PJb-LH3lrgzNtb5tI<z;!j>w*H?4G^SQ<I?
z-da-0R$^fhCAX6ZfBUftUN}bKPas4_g?r6Vhoyo=tm0{+h-EDs$!BIB%)$AOG`7`-
zWw*r)CiW6zT!YqL-G_xCRwJeEz0qJPZFEsH1BH+~%*Z@~&Wc6NoBB6P@r|(H%8lrx
zM{$~0qEW8=gO3(Ir=J8pX5aa`->fBF`A~+?aDb=w%(X31^nk!cet$lmRgBGf!lSJz
zMk20Z9aeWGFqS>R;#6sxjV>2XH0Y%a9O9S_WX-_4vlCpfA2b_mqZ#pLR`218jGv6?
zdVOL1++#kwkJNpa1#pt=B^1J?ExCw?j!oZuxIE&`W5@H~FBExtYu?>^iE;b1`y^I0
zH(|>`9RW1-&NWFQGjm`GNA{FuDd|w*942O-VW*~eqNs{PM`xf4YMLowXyHq^V)*V;
za@-)h-i990!5Y3O>c<gUdGcsISGE==U1V%fd)#Aqal@7E&wC;IK`C-Cy7#}wozjd_
zl3K_JraW++Tgfa4%r_-$m(6|65PTpi7;$U1?g>+K*V8%B7N-&4Y3*2yq*|>ozFMa6
zJ=kE7TDe+3V<ce7T6mU6D9Qkx=mm|rm+==+wJ3`(t6BW6QBSz_?e*JKg?M8NzUqGA
z2bq7?(M9BWecp=*dht+|bp<i93KA{d-C(wV2kZmBT$S=pv%$C@w>YiW!~*x2w2IU9
zoPE@+1yx;n$+tcEjH|tm{nGi#vmzyNt@ulPO;?lh#zwy{eIgO+R_PZl+jf^1spTSC
zm0jB%;VY)4R7QS#-fb=KwC@bKi(4Hv8>{<yu?otJ1FLQ`&RxEFM~@oO&8h=T?&h>D
z;O#aWh8>6$OXk6sE$LUQ|4MILJK5%vM5B+xg`ycg{glM2&$7reu2({`XK*QX&B+@^
zjYdWEOwV|j_nQwg+!iC`Ad`@(NGLf+TrLgQ>T3lsKW)m{90n#F&S1JcZtrzGRRl8y
zTeM2>3a%qnAbHFW7&C4@v1It?<S5C-fw<)3oL!{QAK|Hzwf&17F#G#Wp?uibFv3=E
z^>r82JGn3DhF4PFj9b3!&%m%nEZv+H8*Mhkp2WXSv`d>~J_%!4?qe$;t7vas=q@F1
z5Oeccgi}OSxlTLPTi4NP1tS#GM_WiUBUv}YyW9sb=}=#DlOz)c{HJT!hg?gw`iwzj
zk#g<6!$pZm=>=8jRPYvhE5m=jD|f1;t#ZOO6rbd_nIshHe}2T5GF0C?mDH)h*^bV}
zSW|sZs2yWvWawc|dbd@!luuUOqr1BvsC%BXzDppd_=ZH(2q4Tqec=|&3u{0fKl+k|
zEiVtcaqb2%S#&d8SxJI1!RzZ@>OatufyY1Y>MeCph#LwvOq0VPjWYbw#M>I%oOmd{
zW#aC^z;}*nJVTZ8q_}Q^g2C8+-qufVrjaAv7f~ymPp2Vl4A?L)zA|dj#G-R2-d5Xl
za&TK}4nbYEZYvU|{C3<dXgig-xnN)WH)fZTg87wmK+t%Y@GG|#=Q%RkwdcN9xaXI9
zvb^s<t8N~-1!5YITTos(*=0`l{|36M_wu5R?u?_t4pbF;3MqKk9bATjHF=(?Z{+jj
zR>&ZL`kdkW2d?6_@7>1O>2KEd_h5gh<SjvTWIwy1IhvAptD=y|P0gDAIwrkLLU+BQ
zMStJ*jFJ6-q5RO!E8&`kc0Nuc6CRD`2FjIYskNGd7H!pQYhM`Zmes|kS!xVstn>}`
z6Uq8*RqjotB-*ZFnjO9~GTt|$NS@9DW+Drhh6ffN4PvLe9lIiN?U8&QQ%Buz<Vvtr
zB#pXC#y()0CE<uGa+S4qJKWjCBsaA@f3;nKo{cA_89zMh9gvDkuQ6m#=T*a5yw&kI
zTOjjZ_Mtxz-dYq1Te;0coVj$LvrLmKnr9_-=WZj)FH<J*ZwS_W2lw8S)0p`UcQ{ED
zUzO_wqS%b72|xOECkE#b1LBl@;pNo(t&008o=LtK)wg#XZaTQ2W2lEtne>DyipW<O
z?M>uUb+t7KbWA_@#+4H^w58Qg!qURImcNf({Th##TGRZU!;=oWqo3NpqrMQ7?~Nz(
z^FU;Nh&>jc_rr%1erZC=2pGBD<8SWr`PQMzhtux&W)F9lhx4;B)1@vwTvMzl<hB5<
z#RN8W%nuzj<}_K_GFY(pZH4tRdwCq2FFh@dpm<oMT4Ar)rm++(`JPbBntOtxlx6@$
zg6ZBaUFNj<eaztBkKu<W_~mTS^rUAJ8=Qd05mYwO<#Mj*1NBD};%rhIK_7Z(#y<8<
z;tRGJsNpSdTP~?dTk=$dKpoajsjJC0f^#?n0%{axDUo-mQrgYWERm16ZyNb{YW(X~
zIY*dC`>(SnQ)k=wm+a1ZUVmX~Cef1F?KJOuifw`|IT6V>OcGNnL-qyexf}av<z7cT
zkwpG@^Cvg^A>Lk491ZGVg8O=#0nm}&bzrNlT>Axq{ZHNH+hrD5e!A$Bl<^8NJ(3sP
zj{g+a{?1c=(4%)qZ6#xA&Uz?PUjNr)LJS-9fuIAJh0|L!dnQWV3$D1KVs6-TT9req
zUw_;3f?JTnoG(3B7}ZRZ?RPY!FABezSo>Fm{u`4D!aX2@Suh^;J<WG%%)$THQ2rbc
z%tis(S|Rp1NHi`I5W4<F9eTqiSh5&kG!$JleYNs}TSO>`18UGJ#{kpvwGyH+<=kH5
z3x<OXYpsYqu~r-vzpsNub`c8*FoanA%?;@t6w*|?DE@r~>^2$A7q=E(yBlLp35FNk
z0&1(cJme8?L$XizC2WoLjy2x}!|_-C&%AQ2K827;#8`O%<yOo2+0JKO?NG?J<4@EV
zn1Mu{Tv7A5i5V8#3VLU$wqF3qhO-~IS18{N)c>E`=ZJ$FAA~uMyKh=6Lp~}N0J|jM
z%=Eb94Wz_wB={E<=Hvef6ng=4r=3`@Caccl0O=h-q2O%V>*cX{sm6f^(U)5&wZGGv
zqeCR~6u|zrA|jSU%z2v;x_aszh~fQ69pSjDLjKFt&``omV^37|E0{Qwum%Fr*dIVW
z9C+jR+%;wP-ogF({lMXi5TNzu-jJI(U}e)oa@^j|pgRU1@QyX&(rpeVAzuy>U<l)*
zVE8%!pA9JE7$rd*2~I#0z?cW*5Mt)zkE)G{wR@{p=)U;}Zi{d2{@EvjFi?Y}ecrvH
zuMFAt5JQ-82ZgQ%86cW4hXSF4b@m9?EbkDg&(;E1O3{%OWE0y7j%k;^s)}fxBOem6
z-kH|9_V>F(3R7emDs~HO8NW{@`bFs+(IelEBew&SD7A;2M-X4G5*QNk)_;984`Ia+
z&fEaBBYI!|91tSPN9J?sk&>m5VjgIuk`BDR_4f%cLSdGi#sJ2V@<UL^BKh0VC&apq
z1TZiVS$~y!ocM_ekRbAnm>+#)721-XJs#}$`?BOVAfS0zsO`@!z4rEvuseT-KM<$*
z)bHkS2oVk97NsFbz6zjmB2TuT%%%@O0HJ1H?;()a*ciKO_VX%x9q7K+r~`77)?z=o
zA<(u8bmPjJ1RQ^_hDiUDfQ2(m3R(xp<E)JU`P|9~Y?%>6>K-F_8X~vj9f*V=Jr{&w
zX#}zSqdgMN0Z)U0tUeP1SQ?qs0kT2oUg~!G2JjvU<UL|O+X;XCQoQpRH1pH<1pr+P
z8_4yg$_13lCn0vVCg>QeYytuZ?uX!CujQ)A*O-VS+QVC<w;I?7*tX(HRvyybI|N6@
zIEg?&!syzEp0XOEGISnSVU)L=`5tyKp9!8!^vER*0QZ$ipr-#a^$(iq*Bf+MJzxi=
zo-R<gMEI@#na0!sHia!`hU-&R`w6l2^kqk`LzT71fO>N+S6v?BX;cO*%Sbcj6Anh5
z-J^n7KGBDOIjtg$Oq84+>>qx72;h`vUf+O{!P6I<{FBGuwgZwU^;$N-Gr02Ne1|&e
zs{zZq{_^2DF(m&*do%*r0qL3|1EP}vNthD;2HNK{A(Xf>+x2`@8^~uA_J_=FfY;!}
zY&rCUZMMIdG}z)I>D)<f@Yb~`GnC~a#4urpSG9gnphtnN$1j~Z=`qk0Gh*8ZZDnti
z$t==9140M89B-Ru@f^$pLda`YxK=h7(X*ewfNj^!@8NC$VGcK$kA_|~flJqtUQsWe
zRq_UYb5zR_dIa&FHYy&PU{%+BBK1H#0eukrKZ?s59r}aOWH1<8&}h61V6fV3D`_A<
zypk=CXd|&%9%YYVIvTL#6bUc!kqOBaCBa54H;HKX1j))~Z>7gC$}mX_G$SnQAX?P!
z=$?ky<bz2-Dfvv=GKTY{BP$i2F4F?elaYqSymW(4kbp;14^uSe#Gb*$?i#ZH)<3Jm
zEAC`MNa%2y2C)NnJt*`g%s4*AL_EZyDPgDZ&RYH`xd@jZ4O>2W%WF?TFT>=NkbeSf
zo<x-t9LB`OfoYQWeWbHd1K@}4Kl%npWJ36_bCTyl(<j4==#wScZ69qW&ds~I(|}{4
znmezMdGbb-UHYSJC1A>|SkE=iWKR@mSUaf&Py+-G+ob%Brhoqtux#z!04=M0A9#<F
z3w9k5wjpD{?yH=Ag!K$qk68l2$HrWh-0K+ts(&(=ZneKqh?qp#eD}$Jnl0%W+p}7X
zTWH$sp`NW|w>R`jq-*r=^Cc9-1kW%VSx2I4B`~f*3|6lxZbbn)2ap6s1t-La&oq<@
zC#dWx3I=D;+N7{f1FBiIu9oB#tLIDez%kFNdoH$(sl5lpZbqCJ3`fExRlVFyvd)#=
zbDOfqmi|GM_({}2zs9TP?XDsvdKk`3_w?S}Bxq!y9ktl(uss`r(Y?l|l3Z#_e-gqH
zdkSFXXcv_1c5!+0RJC*C2h?7lm1*uYFmw_rG5tsq6(JCK+_%es(XudoY?GRg;eee0
z^lU5-fzZW+<qF9Y$o|Q!+)nmRfwS~xjc$Kj9WS<kyyx_Tc+JRyH)CikpewVUY^9gj
z{MB_oB>rg#T0?1c0%HJTeiB+ExCN^|p`p=p;(3xN>Zy3Sr-FxNULSa}cp@E2ksSV!
zGGx3z;=6)8saICnnbPn?3lSl;<gYO;@lG$fwRX`VZRys&GTS2;<fv>D==qoLax04p
z+fKfiRt1zLZ(@SWy@}Y!(ph(0wIg6KR%6L}3K987-I$^FY5S^vhVUNuud~orx0KIg
zzH<&am1T9L5h`|L90^l-B#@IG0`=Wkr(4n!4v%~!AKuF2{8ayj(yoEyh}}TTaC+#x
z;>RPQu&O%&O7GzbO|DbF<{2O*dqZa5t(<{&PoVqMf0RWNpN)VncrjQA`?Y5<$x~WC
z;UV5Ipp_&?+)YaXdG+yR4OVFEh_9?BkYVDD2(oCGK9Ip+&K3HD7yCNFh~@AdDpF60
zxIE>_1A_c(uFZ^nY<sG6Y;vRZkuc<YYobxvDI)$ML2ng_TNrF;=s4pKdT-GI6EhHc
zV|+Aae}2A=xsRf`E}{}1&>oajcvH^x3h|1XvSeA~8n?E=J8NSyU9$+Y!&a+aycLA9
z-hNO;*Uw`sh5Lm3q!7W6h)tomS<UC`TJb~t3=?EZ{08df0A?EG#h1i5ER<=y_zW`V
z^3Doad9`&qzZzwdk0qpu8x}#_HTRlg1ulP%3L9OH<IY!(=EB~y#wT4Ros?mjL7YAT
zjW5UZe(KWAfT$L`no_p}TeV&4s^JLfu~cBl`|!*v_7lC<$p^FXr(rTtmQ2)w%=dPE
zGX#teYJKxXDRh{BWfUXB{#YaqnDyMdD`r4jjIWkM%QNz(NlSnZpPA3&b5$YVCe=7j
zTLhgoS`<kcET?s@j(1M`sRZ~qI0n!W;Gy0K2JsOXVn4^`Nwu`QmVyKknQ2s*g@+)5
zXlcOA!AF-W*~$=G$Do9ww;ht_-M8$$@xBc!tx8eAr-70vcue$jA-z(R$*WwpNfqk*
z6n&c0$Q%jT?F`Zzcjh_xv>UY<c*W;>DdH_#3kE^FqCUSf{}AlXIQxoRZh`|IB-*hl
z_%iz>82HCWMA+oAJJSKDuq^M4CrjW|-KTwx+|I9P0#a@1(e~Qe4@qg8h4LToqOH>x
z%jsL}xkJ>)Jmg|zd8D$1?%XMCFI}Tsz~FcWglFXeZ`5kCQgF9bXk_kg(S~nlb>h5b
z<7f0fKA$ur(@6(6p>0Y7!!`lx`WfnVz}>0kH5XbUj0|{VEUVkQH!AeYp#XNqGW6`G
zNY(;jjjzzwcASBoDZbGV4fBz}3*ygdR`fn!aN6`ob6wl}a>7>$N#qdbtIVTZ5y8q|
zs#;r_dWs=0tZG11lI}RdiB(eTFt4XcBg&^Sf3HFiAOX6DK^D7=aqUR<PScGsTV76@
zACtH4y4}LF_C$+x0@F>$`>gkA6qSVQPr<atV{?hx{3#&n!5$96qHISb=8Q)8-W(Nc
zp-O0W@l?R3qgm9kPK)f}1p9js_KROH_k4SVA<t>O*(KyfcnX09+T%qomv#ZI_}TY)
zQ-#kvbGk(hkLijq=|Zm8BXZ7b=o{SvMc-2`utt-W{fI)ni({CAV-Sbhn|0P{p^t{#
z47ZwnjG>e-|D>1qwG4AhT;<nW9d=l0M<2HR?H?Zp=ucm2>$_u}m~8v{7ghu*toia#
z>`jrG1;ROy&08PQ8of0Yr6{hU!1=~r{uOnzSaAoi!pO?oJdIB)*VO5Dgxd8m4Gar!
zMTII0iPCFSuIcETTKBl6O=-2VEzr**Zt$NaeAi#re#5;j1$v9u!t#i%A4f6p3eCmB
z$);dPx2#oZrne+L5ThIUD#?WR<((F>T!^nKV(_JnEqpy62G<B?HI)u56j?U#A1x1#
zci8LBj=`zlX=T1eSA@M=$o%@XOR}gxn2sY=q4EO}UZeS5l{dnVPd4k#vN}({)U0nz
zk^^nF$QO)H?ccZYm0#6ORJPkIvgC&4-yezO{N;f3{E{8V$U(4#ve6TvEp6I^^=4kX
z5^KW`VTzY{<~|dZVz<c+Szn>fC>1*~0lnsXmV%pMg+vK)tKtabHZ(5FKZ;8PKfv5U
z@1--Bg0X?3g8|bZWr5TZmd4|XIahgljckR7=6L1?3a?A}9~>Cx&}x38x!Qqgri3fZ
zTid_lVVqR%8>)i68GH>5r5h-Omz4kBP|MuE&4adVF^~{3s^4z-q8H9eT<ai^vFmF$
zCN9gQi)z4*eS?S4pBMQVtn%jukrA*R)2kO{o-Kb8=#8x6J8eB}AL^-$Y}Y19(m7Dw
zE-q9Eu24C4bN;HPpm*iIlx(FwGC}`^OB&Uz@}Ov@4F`-PFZb8h9GDhv!ZXoRwm}^d
zJkiXWWr^-h6=jRvwm)!ZX-m=1ZdNqR3;3^pb07tlc%YBHsBB$VqhbLuJ$oj`MyEt%
zz3mZ6es;}o$ZPw<QS8V1K{V<{x!q^l3CLHIK)+}4+7sC>`x;LxK@xgw1OnSa-gBcj
zD9cJC<{dZ}E}j7(&jiOvnXXqeYYWjZ!Ay44z|W@4`AUEGpy>x3S5xDC+Yylx%Q&E}
z{*<}ZTzbjwt1Z!L%EA}tw@(7~zMq4b`28%T=sLNXBwyyjb!pwl85~}h{Pg+#*lOwT
zm<bHzHyn>F%3zFu7J<B1zmFRabZW{!6Z!lG<gHrA(W-tRqIf2?+vs$g@u<H5rx}iJ
zb;ghpS7>K=TEeiXXoURpj5@5|DZVRWfPJB~bA7PZ$9N8M5(k5jy1{wop1U2E$17EW
z2H<5_Uw%zU?6<qxen7)8?b`s9WGvGw9wn7iB^q0JHx+FHvR+1|6dW`p+@lLkOlXpa
z1SNbJvTt-;+R6+u@D~~AJH-^r`^3n{u1Beys1U63!lX1;y}w}9ZD>8f-0#zB<B@8b
zOXGHuwrfe%Lv9eKuLy(`eO7c&6EA*t`>ZAaLAGFQD5j5foo3`+3oT6}Nt%bTk<e+~
zv@`vFxBMNtd!(9tTO<3c?tGqmF`ksxi6m(WNx#U%m`mWX^dF>4D62!q-?NG0u)X?W
z0R7zi9;rfD@~!dJRp2RuDZ+B3DDKkPhfZuj%aV^q7UThrJ1{gRbz}GDhmrA7;s|XE
zoqL3kAe_egAteI+G8tu`B7^6*_N^krPL9nh?h}^8E@CX0YP&5=y(y&EO0ifgMkN^a
zu+-c(^Xh#9PI*+t_l{G)zx<S4sBGP*!*1-F)#8C?haz<&Y>|OHLha8C=ONBK(TefU
z0a4+0!g2FnVt@Re8tdXqfa|&ReIqJ1^i--OsOwMXT$%00qwp1@ukA68JK-eBmaXSe
z<=%;rjt5q28d40@$yn6ip)TU30<!xk--GO`)<-`(C4r>V{;0E0hpge_I5z&{OIxco
z*Muj4wW(!*esTEx$Em*0e6aj6kt^jXkAKY%uA5U}`d-^&R(a8VxsccHEGiW(oq!M$
zwK;6XAQ2V)!)3`wdN9Zqd~}@+SHmJU37<lzjFf=J)%-rgByl1QFLMVX>znXO(Q=Y1
zExF?*zco?=hLXdjm5KZ_u8--I*(jL+ULePFHA1}8Vs-iRNDvpBhMUFn*pAOtioQbf
z*r`jQE+pQ<a}QYHa>cwpMnEI)%yOg`?wNrZKM8{NHPT>H0hh@&Q)g>s1_KOksh_1K
z&of)aqevQ4<r1{+TRn4v(;pTx(@kMMzDEwbTH8901Xc%byhp$zbed(ZW>ow`6E20R
zSXpqFp^+WOP=znKHK*)o)ID$WD8q%b#}$NX%9$tZfT3o!yL2SNQ!vbo`<aAURPePQ
zijwbTEO1NnW+3kT8T1hr^xglGV~XfpM<nX4nZt32#A>rsg|T{RWrHf&+RgA#!p&{i
ziO;huNf9eM!@<n2MRSu3!Wkaj3}8|mJH_*19Q9MRQXE}NeVL?v@=pZ^oPu<cLGxeZ
zQn$o?0s1v?i0<QiKr=D7k5(C0O5)+Y9%raa2&SI);d_zWd&)m7@X2+FWCF1_3TfI|
z2KXc+Iz-t}R^EQ~b93&)$S`4KuMA;|n{zrp^MDU3wc%!m!VBa=!UWE%5{8iM#K-99
zFp@|vlJ-!NkkrGcZ(H3CQ}IW&b{=_D_1CRPr!~H_#`u1_&|d2=Er6eGA6EJffzLO5
z8ggw`*RHLNqa@PG{*>LKLS=NhjN!X3=p=bL)3uY_g1TbHL>G%|W?0gYgL(d^^o5bM
zzldf~_GN)&?H)CF^{htDyv$Qrl&E2@xn}%~YDtM61p_#@+$-irT-q>AhH8M>U&MhV
z-FL00z)#>fjQ4H2K)seRCUrjfF@;?0CP<Ws>=8lUiqemmSg|eQpL~)Wnz0`3O0oR$
znr6J!ICdrE2&)WUQ)D?OIscS#{5m2}9@x;}39mF>8PW+efG1c={xtfnf+=-nsLw61
zz?!xXQI*3rWJ7C>ZM!-bhDIE$VK7~|r#`&JlG4Vk%YElXC`@eO(~Q_Typ(9fl9kl^
zEFn}L`+bw*k$$*Dclx=d0<P<e5DCL23JjMMT8c&*C7J82*u#a1H-zp_+Gbo`{F)?#
zP!=>-=u!BS{u^h7_E~F3c#O>MV~g{*uR=Tqiu!1<7%79}uZ6c(dbsE@0<*<d`l*2C
zCw3oE-1ao2C04ea$p3!ek8Cj+&=VwM-2Ah-dbgW?r6+Ck9!QoeO*Pbt@k;?d%epaK
z{%xG>XE3MkTrX169?Wts4}qZ)<OKcByXz;JtlarAyywIQbbv(sT$<r0P-XV_2z$G@
zsbq}VFWjBQw0<>T9x2K-^5}dR8<hN_ROu_N9q0yY{ii5bz4^_r+^tzwCl}cqnI7+Z
zrW4#1t39^pEsmA;IE%}kw)Xda(acMr{%3PZVUh#^!<(J4nl=2=K|Jw(#ae7V(R`Hr
zDUn{V(N&LAU#MnRkyjXO)Q0)QeMUGiJ&UaW=%!#_f_a}|ee^cj!yy`trDx+6^}B7n
zHYmN0FW5D0`Nmk}Dwdh_T8|NJGl+0iCZEeGV;X|2uR1<|i<=o}^lb59oe(WB*VRSe
z991(DDUL}Q<Q0F4$NJ&w)Z2Yg$3pV}H_Pm6^W~c;sSol+!gZ@=ZApZ1$>A1hyk+vM
zbtFfHcot5a-;XUUjRo8IQYJ<Wq>x-k+;P^(r$*mu5(i6OJT2{}nscP`amu6B%zd2A
z_2ymJ$UogFLAZnhuu6ubBXVmz(bLa#+))=)^8aj2#uz~ht9^x?>!YXf%K_uBnlmUk
z|A{Bq=zY8K?7}wUM$qx5DQ<r#SPsAqCN}*qzr~sVpbJCdm|>n@1qjlbSD$i6T<|17
z2rdn66{BNH2V+ErJO6?!q9gx<Cx{d|zv;Z-7A)xhhtvFm13`80{}(t7&frs<aoHmR
zfCB)OP(%Yr9QcpIKxO@(D*azOf)qAP<_(S;9bSi1@*2XQF3%609?{*m!ASC*!%V|y
z3A~OtYRM+~FUFaQLs%dA7ro=RWz$iaD=f&y3ukiE`;+sw^?pN#(n*Pl8R#1<nPro0
zHLPz{45k%_TPGubggm6szx7)H{ZCR6_M)|Re3oWV?g&*e!A1}s(}Mi|N=Xo4jYQ(#
zE@_<)yqouThtt+gJM6!5;MM;(R;hr=Aq;yHE6XZ#u=B>^L+v=BI)5eNdf8e;BT<He
zGLc_ee2LwSngZf~fQ7$jxmDqk>w2n1#?19#qFjYV15rKms2FiVf<bxa_rEJA{pT%U
zLC3f`S0#Tci8_1PXZb07*f%VaBv(PX4K8{9+Vy8`p!MA|J2tG-Ujd*0&OfY;eJ)8P
z0kzo2&-lgo)IIp_GyVi`b1b^GtVmHruF)QQRQU0XympFDK5Z?g7qwJ))kQ1kOm5D#
zX`AKGkJ@Yt454>!zJkn{r|aMy)H#Py*}eT^G!yVYBO4CHvMGN{+93QA`UgAw4>?<d
z`^WLhD-;bAN<i$(JCxL6t7)Zq=f`4PI4GvEJ}_D?_)P@n@8|eIjt=!JrvRyt_6+xa
zGOGJ_uvgSJO-3Bi3X7B@7p)C+%NP(E6di>U?_RL{*Uj6>0E{@Frbl_{@BR79A2gys
zXaKvkOV9Mejf|%XP}va2JNh>-{OutK=c=L7^|>(aaWH@eXYw*Nebx(qTag`z7z`O}
zeE*wa@%Kc4KT=!)fT+>Hp&xqjJpbRI|94*gZ>4|TKmYmr|IgbS=pFiiDq=f;Jjo`S
zLEVqM45oL{tCI2-6Kc5^oO}=;%9WqO=FI6JJ6$-gKp+YPaE&Q!rwZRLTo8N#)j<I5
zdK!eUpPIBXB|kLBN(185*O~wnCENXG<HC2gJF*p^+f4as4n>uX_ss6wvS85}4Ibz-
z-?8}L{RZM)jw5E+*h?FrIpa3~q4xJ3y{#|*Qb7AFs<RE5VdiJ~uD#k<6LCe4DX~Sa
z=ij!!=m)1U!-gZl52k@*hEee~&-W`l@)typAMEHQTcQA8KDhnN*DL`rcuawb;*9R_
z#ZkFCu@#&=rOU>d*Q3;PXdM?Cvo1)WA{5j?Ff?YPo5ckr6SK3%#tSZr#sWdjO3{a6
z9E4ST?_1m#3>QNQBz)Q837BbeE-aM)W+5qHHY$KCs96q$3GhTe<Q6wwuogM;Ah@o^
zJ$}m@ikWsx^q(Guzb6&6)P#Z1FXwU#Pt<=#f%~E{dBDIG{0bY^RF~|0)$aOSAXTFf
zND5dp%$qt!_;{j;b{<L>gnAA_FlzsqgiChFCYYYgMJs|1uDBmG(Z>ra#V^bDev_H|
z&j$yT<N;4ee(F^f#U(rL;U6IvOs@tFSOR1d*Oj3IAB;lp-}0gV415R+T+#SPWwH^N
zo-6miU&LrRRRq%;Sfgysb$Lkd^)TKA&zm9$5mbD1Z{@7+W8c}mXfF~#+!-`Wfod>4
z>W#f77t9MX7)<Y(U3l-En>mHo-;iJMyn+_cI_~EuD2%QU<u3fUkKykW3CcpLp)1fk
zO>J0V`N<xM^%u;`0S=hn(_!MoyyptK&u(yD@Vw^j&^oSYa>4T9^f$XM%8~e?E3hIy
z^edrj3aoOwTre*`NT3CH!^o`;9_CVv)&+s3HG~zcBRu^Mw8@|URx$r;Z{CMint=34
zD%iWGBl<HJ%*zlnv;eBodP(46uFz%vJ9v}A@Ra|2k@BETo`c3evs#eNbar;s5)MiG
zLOK-8b7==&!{>X+Eg_H!g@*j;fdycdtZug#d4PM$vI8yyNeEDA6Iq6wSi-pqGOFG<
zp6<p45<(mfmTU;Z-T<r_i}_IMt*ay|RIq@{uAmt<42To*lz`6Sd1Yp#jyzSReJX@W
zgn`qzs2^bQ5JBb1(FUnM>0zZ{{p?ljGT<P#tYH5b?VAPg^lrFsL07s>nteM|KaGcU
zCJ6ys#|QzczjOhBR8gBb2Ki?|GRA^Hw>T8iC5Da_P6dqJ5fJ3t4mu3UA)OFcpgcj$
z{uEZc55eSsG}Hpglkq{uB#U>>0<Ly6==q_W9RPv{KKP)RmdpcT9XKSy(sTMatML6s
zmAV8FxTgQ{e6~maY&Xmb$$}ny(;U!Fh#&$B0@!oViA|UX!-~;g_d{wKkk;o8#Gsk$
zEk_3t<A564d}B=Px7cAen3os@(OZyX<?Z6lyD_mwz$%1y*dZ*$6DtjbSiUn{Ruast
zyd>ku`=R(?D{;3TtXj-G<p)kBl^(c`0D~V*Nv>h;9dgb)2iSfH^hJWsNVjX8#J>r4
z7lQyStLrnk*TlgKXj${X*~Zu#AkXxWtA(AKNHnkhN+oBj|KO=y7lrQ9g5~=>yF>$Y
z&G(nnd!B$ZS8yCXq!<(mBy~!B&@(}5`2z~-$SR|=yH^8;&bB}9Y(PFc^G^x*aqDLT
zo<N<??Vz;Iz!P`OGpdr37W}h^C9Na2juMj7aRpV@*pJIVO(tU09&u*|tgC9qN(`Ti
zC7vf1-4qNBok|q)>VX6_ZroGFIfL@$b3?**(<Ez)4kGbrrDed66XAy^2V7Nt?-Xh;
zZ{Q<?1DG0twdoJ9E`nNfX;$G*sL1RS4R!0F5+IGI`NukGXD1wx*5-ju!q$(y(h(4%
zaBZ!ZAnk@@FDhNO)JJ*XJrnf)Gk~QNy-^7E{0O{^G6;lA(|}y>3i0_-;5l_ynt>Z9
z^7u`x6n9l?eH#ECztuE?MaoZITfzlXa)V_U2E^RZHBVxUt_;=mT8!!6B|=nL`hEt3
z9OrHvj8f3Xt+`~BcE3g+bYTqqs14Kt7ne}zVj@#P)C+KC<e3)46NPwJ9<O`rv|3*-
zkGGt8Dpb&Z0Wbf#u_?OddF``XpJl<#rfiMw<{Sf(6xEJ&w}*88H?D|QZ&JG}RiZq)
z#WkSOblCAc12gT=h$|oWKm^)tU!@G{EXeFq20K0Sz^N%fkMAj-1ls^UPl;fWANDmj
zK#%v3xbmUhfZh`MIa*|pCdtt9Sp_gTjU{c8XaQQQH?A8>Q!=yl-<Ai$sU0pr$>WDz
z;wl|52Q{1H+X2wY_-?{ggU1r{A>{3lWE0Sb&EEk;wa}xM^V4~NxjrzzLNV1u^TqVZ
z=FW1uOBh5Zn}-yHAhj9G4_SVDpCGlR9(^jq+juRs_7dwQ)$Nd;%#XV`IF*B#!>&Np
zFlxD7gV6*y35-6_Jc>dm%AZGl^InWW6Dw)ogJgktTTpv>$Da%3X+4V>w*WcHuo+6&
z+-}it_Trl#V4$CdaJgikZrCoaR0V#9jX6TpT~{D;gqfi)0GK}W1ZD^&4HJ!O(D@$@
z=w^~-{D<IumSO;^HS=r5<-{QNxo_ZfLh`cc`<o<yzX*{n*;`YE0o-gg&(3^&(<AGa
zi4fxwa0ZHut*BHor(^LCTetG*5hF?%JM{-5O0%@{A+`K>8Ll$}T8t0vN{UtNk9C`H
z#>Wu>DpFh+Zs#CY^qfQ&#zHXqfy&-INuY$^nr=2ea1&aMXx5}_5pdlb_(>wYQQ-=x
zec`}#MWAWhf13cJe0iWY2OZUPDIwV;ySyX7+rdQQ4z}OD=hj7Ys&0n7Ghz28hVEt6
z-Vmfv1lV`-p}_4(#+2l?KSUE8cZ&GBfB|QoN~<YB0<vOw2t<UcblEKd(jC_A_02y^
z4OOd@uD5^9K3sVxc#hgvWi~x%DH2TE8{yEvdR0CwZcptOw(D=Ye7RvQwGqVIZd**J
zPIp4p#m{jSpokj|xxB!}TyP~g?gM%1g#hF>q>(jutTlJG$W(+MQ0|_!eLE|(1xQ1&
z-Ob8dFMIEtMbXo(fwtt+nnRi`p&>m3x&hFi-Z6UnWP8X)M&3>p$$ca{-i||ZL;{bu
zG!Ny;x>lkSA)!NfK%K>dnZLH@$Byu7g;dc_DB*0#K_G@iS?_n`o#Vec`taC!p6Rvr
z{#QtsYHs+(L!YE!4w=QBfp!sG8^3HH$;f9?J^>V?N&X!2-gmGMj|U6RcNhoUTQLSp
zGH1a@hOt0s5D+tuMd<?AcbfPJGIK!-1jE)y`RWmbjhVpnrA{kL`U9d*Hgn^(B2Qz_
z25NSJnbcKRZD&9NWA}TnCy7@!P4a=^K)PA{3@~MTR%B-H%V0E|j~m%$q9oy`YVvvV
zpxMn+NOE>SLuKU%AC43~Sdf++XnEM;%v|Q4J?3MB_z-8-)!1^5;6I#=ks)s=@IKq8
zcNvsi;q7>B#inyBN1~29M)U>oRFGZHQ~%Wm<fm{{|AQ|*jY!oj@=Oz>Q(~zfIUk4f
zC2C7rh?Xqxomjk>yv34-8u)b2MlOhMuc}RzX}md_Zcr9@!>67`e1fO{@p5+sa4mFF
zPwkv<>Kc&9+sF?JlTYs*0P!^+8~KDi`0{~7wZJLa@np``?n*^V8+q@2geh^|VTY_p
zHZ76;=B7uqqn4!zxyG&0NoA30MRjE<0EB(nuR(LG`}xHrc^U5w^jp`nJlAIj9t+~+
z`J{pxeV?Dawc4@Mkj!h;VDRG|M2*=Lr-mKvF!7AIQ_k~A?pr>_Q`7qg0f5IZOir;U
z5x`hycD9!+LO*1Eh*5YTbGnM!hr{<TZ$tFVI7f`nVeX#qnA|$aQt@bfnoS=I6ra-k
zKkU7CP}5uYFRUm<5l}&p8kGZrG^I)nh=PC!(xnAZAoSizXbLJ#rGt<tT?k0;AR-_|
zLJtri0zzmBy@tU3;(310Ima`1=Kbe=XWqH@pG;<wT~^tjz4uycujN?%uuN22#pBw$
zK2>?xEihw+sLAt>SGD^0V3uF>+8X8;22gZ?VvI_vSzg3Ol)9F=%|hSnNh%gr^u;Fn
zaTub}!b*J`2ze9FT3d>D(tH=a;O9N6D1+|Wc<S)Q_Nm3ShYNnw$4QW~F@+}P0nM*d
zVvGBi`cx*1Ybxo?HyjM*bt4I>!$6j@?XCw=-3XWC=<baJ9UETBwslvAtoE+$fq)5v
ze!IK~x{Di|yq(s(cYopswzIl<?SHzFWxQ56`-6_diHj-2;v?w{%8uihzivIqinQ~c
z^Jncxoq_sgEbIh>i@#s=`RWr4Xt}v$vIAelnPxwD;L(^yh@7*(naN9mSXDC}??~ZV
zsEyUc3(s@~aQ{*QAuTUH1)W#VacH`F*h-#XSf0Jhg+}L^FwU=6XS7wNXKji0n(Lzz
zKicZ1AI@6~V#hXD!z=Nu3ER>{o_&wh<6KnH?;dp9-!`uTy_F)%z?^fek#xK8pLL<t
ztpR^HaWitTb>2NN54@f$_lo32a-AR*e&e<_-0EHpXd<qF8QVk|zpj&b8mcr;5axZJ
zyg?{v9hA71L{qC5&fl^0W0%l=KVrd15CcCWL@ORDYBcGolxbzyTvV9Wu=}tkFq|8s
zc*-__J28dlj*ZKJXqjHevZlF0@=T;~!^0tq(A(Q{a+N#>-(T_4zg|X}sMJ(bVT_$?
zX4%#?HiU_Fu1{UAmj235sCwa)R$1b=<!F;`^yFCVH+0aln>>}<adhhg2bUEw&?ncP
z#4|4Ummt0Gp7gr7WQ&!Jb(~l4-cg=3%m;;KTKRP;<oc~Ey8x#x^l{eubHc}I*49Cp
z+uL4WKUX`G>qhApkaWWFxXHnL8NkuiJWTsn8ko~@z(W9mO2+9|4JFZ5QIEBsp1ZjG
z-AB%lqc{81V<Q)!oK*?<R-Sv?0)ucsT=FC4fC1L$MdI=pMZG7zN;t`gnUu#TtXKTd
z0n-(%Onw=TX)n3Gs>k{Z_O3*2u9jDQDABrh@k>0s88$l$HK3wm5H=Ql{oY0Fa~2T{
zWSny^S!6`)-pxSZ(<WKAhZV|roSxw3#%wq*blvegE`=3!f5~rmm;-A=Q@))eo1;uK
zD;Bg6%yM$*u}ATGx9W-My>5^2r8UEP7P5@B2@CXoyTwa*tH;!FRgz_bx9|!7qiI$Z
z&IKPEp5$8=SB0#F&$eaqi-cxiex>JzBU}j*!$#a-RSv2IbE%#HncY3Nv3T?g&3DH^
z>0DrsZq_t?Jvm#Kjt$R@4EWqBxiV%}x5=5kO5b9!`Ja<=z=?jw=hPZh*5e|3@tJ@O
zN)EBe%;hxPfsJ`Aka{m`%HNB~S%il@t1OioNRd{H@j5yV5I-*Px8@&M)eCCia$KU1
z8o*0@xIrO`ld=(Fd;Vx$G7@*7pnPR6fYB|cF^unl$<_W<SX|;u7F7<_?hpY&<joGZ
zvhJ4)2IhXV;o@EypaqFY5>5XkrhCt`kd|OOup+vmAs1Vnbl)M--w&~|F&?z3beMXk
zAUz93a{Pz|MVcOn5$4f%%2K}rsq1PihtID`x7^xw0|&5GPB24v>2DU4`w9`o%4(y@
z8TjivtWI~OyYF0248xxxgaDq;E}v8F=QjsRw-;rl8&ql`RScL0^rC`Te?Zd!E~uWy
z-SUksr-<Z&h7EtZo7MoYT<*LEKRbZ|vD)vP#t?7R_xy`GvP9&qw`{x7*O}-SK`G)`
z=B|FhBE$?G<krO9BU9i(WBZ4r%Nlzl@mV912lwyC8q)FZ-fC04e0VSNM1PteY;yPj
zdVfO@i>K`gdbXOGb-5j<x4~Vzn~eu=`?h=ymelM@%1PmGFI_d@=H%OB5r2?pn;HY_
zoJu@@@L4!RgtYAUC0mg0)b*9J1?)iW){3`mR#;`J_r1JnCowNRdf|D)@~c5FbnYpf
ztG+MQa!ySA;Du+%b17~8VOJnz)@ZfrMF!Z~>dH^kJ*7o_U>Ac47_Hb5YY41>nrngX
zoRfu@aJ8b<tIa<9IZYqW#rNen&F)?0@UMY&eI8k1Ps{0dom`=X-xo!0i#yivT3xoT
zu)9r%@AqwmedXw1RcSmfEhOkEhdz<xc(Yv|2#&Q<dkp9B2%%cKk(MYnT?^M-pJmnV
zroI*Had4HGg_n2Aot>?jHqbPUJA6B*VG>02Ky($SDfoQM$j{)q6<x|K6n8szWZr9v
zt|-^C3mN0FNqu^1({vQ>U+lr4GiN1NSp01u$1r*x{nhI#@1>rlNm-*C{u6l`C4w(d
z!iS?wrQsVB=b;}9Da<b4iQ-Ru30EZPIvef!WvIb}M$3^0)rfYPc7)vv9(aAvM$15=
zlhX}9!8A>}?&7I6zD$$hD-^qKxLSP*igb{J5B7%B#4)sw6n57eeIP(-sW7e8_0Lun
zQZiO5730ndS>r-z`r^ZE9~!p}+Mihymv4uQG{r??*3kf#r;{AT(dUj(2KXHiT6XNz
zl74ZO%Y{y|)J5`8tOFJ@(+78m6^3%1N_c*nEkJQc<N8kmDyXkwjJa$4Mk4~x)>_WE
z=fN40v#iP+b+a#=8%*2_b#vAaI|J|L_I=%UQ1^39o|Bh+j(1mpUQhmEt@X`z2G_&>
znMRkxKh_UDfEt%lU)MkZ`UEsP=L+}2mEk7jcZ{+!9Ijbe|A<Fu+RDG)9=GxImF{DX
z$wvRjI*;-I7@h!N7}a@$PJ_Exd7l?MXVyOR0%q-{%CyQ4T{zJVq!b9&eXtV7Dwy^P
zzq?Gq{lRjL?i#)%YgIIN`ccAdog@JR9n**q2A9!S*7r7NGVYUH^;z#bD8yUA>v;s{
zW)Tyj?FYu<U)M;}fL+0@#Z3$E62m&aUt)l@p`bgZz#{IKW|GL_k^_6~)F`Vy!!%H%
z7?uKG<3Q;4mEC?Gy)ka${3_#BPA0$07~&I=Pr&d-PPtfX#|97)q|LG+z(~65mKwKr
z=2d$n`SXU5^FRP+SM#)=0!gvF^BVp*?j4hbu1nCG2%vV5U$+|ueLvEUYC+y0XRrY|
z!*&e~g6=*Fa!!to@4synupap3M*qg@isoH5q6;{~xdD;}Ne3RL;#E^^-4M1{aru*y
ztsBk@`jWklJf%z<>fkDMlbun$TyW0p4I)WCtU`P3T~M2G^tNUY#8<jjqV?qp<%+G*
zr@abT0FWT6b%ieH#NMq+pd5!e{Ce)}{hg)FsoI@UXa?({2@1feaSes^e5eGTBl)35
zz*s4sjxdX_ARtQYn#x-h^99WKmjC!^Db?}$*~{fWfCsLp+4HJ~n7v!XzqYJBmJPX-
zZbY^+x?^^|SyIC4^tAxeMb2rrFM{Uo__zA)FC)a1-aQ$MMa^doz<=IV&3ni0^m!_k
z4jJ0u7ent#Pz|c5+8aY&85zt!xR~Ffw2}Q9q~+r}8P2FoT03vZFk{;H-h~af<5vFi
zl+HeqJhIi2fHm-&?(TU2dE)=hefj`^2Aw14%2P3Hnm1qGn>L@$xIxA7ar*UZ3$UOE
z_1oKeSxukz&pov6qKKh)d-#g`?uHv<W_j6Zxrah-p5IDah`tivL8_&<ms(C<r_YIO
zrcyhpiUi&@&&J$Jt5D@ElHB5zIhj*vlYSvRb&P%cLQlmLr9)Ej$8)!X#g~$fQv;u7
zO!yEtD4xDDb1;x2@--ka0Ha($qQE!bj{E9XA)C5cu5Z$mct*P~1j>d+T#{p$Z{pp~
z$=!hA)p2+(=q1PVtPjq=jCnC}(m9o?y_%QUs?2*?g}QUWZ`(=nlH+T}?u#PH&-LZx
zQ`e_0-YPhQ2QxRGGUmKWI;UT7d(TVlwSt5EDUNUMEBdJEyPVxsYMxY`Wc44p^gT*`
zZBvR&?K!AB1p(>smtq$C@9EewGbgPw0u6P|DPnxx3e{I7i9hR_Ig3+YFmukgMV&qB
z-WLj*?6qB}J6*Q^0yZKzpmO{EZ2jYlry1!+qREMe8qlqJN!nKyA`(`J4=xq#)y36K
zMxQ@ZZD)7v3d_vK>wbuH-%w+o8T5n4+nBqr0%p5NTz+6|N`mgP7_V?^K-bp~7Kt`=
z`So;`4x#=nH3lH#Y}AG$n`ThqjpE05o&gD}d1Ux2`Je0esc`Hxs>{2L5Z*h3e;&?C
zi8_TT`w-pIBvWL8sDViACj3W@Rj8tJJfPT8rhI$axyKuDJ?EmFnDGQjFMoLl(Xbjx
ztF?M=idAoWS!zx8(78N+vN^|&*Rx!JV)pd%tkvGjm;Ov4Hm~nA@%c>%Q}d<`w~rkP
zm^a0h*T3Y;LF6HpjCw8BP1{;<yUk-%bbjwX&HyifP9t)OPG6b$yU~7Sul9UKD?Y|t
z0MWiQ(4Be(<oj_l-48GDrQ1<{V@xXFprXuuVJ<bP!n`2_cTTVsb9f2tvNp0=E<*)^
z&`+VRyoZ&srF99R2!~2dPTg8cO?})mHvw9<^%;L75EJ$pdRtjiL<}}IBkmAeYubUZ
zGc^yIth`0{1!lin0W;ALAC!4N>WLgg-?i@>Tx?veDtJ)0URpjTS%zGz3Qzth)kWPE
zYvZK<U@4JGpIN+K-+S1OJP;Ttb5WOvybJAI(ye%<dq>`-vf&dFC=124W%tnNX>)L6
zqC(TaI@8WTU?*{F6V<rkRH=z0`uML{us$1N-4i2Z85taPH%y}`4!-WL^%?i-HQZY%
zFZTCaRU3@b_wV^itmn#F+1#7L6po3)h7GWtdpVeGvM9&^RcP_CsC~`AZb>dpWdPI#
zJX(MXmRP*r&MvKPeKJvryc#ri24pwM>zGoD9<1~9*EdeIVHR&VeE6{I(fCR^1EvP8
zLh6QYnMBJZkPl^de}u7*@i`Tjk_Y`uzo{Xt)n;H8ughOK#{=YUm(NFh7LC_;c~fhq
zkSJx%I&4WZ<D@hb<>z4!`L;&)E=89#RsHmq%eY@;@53KLG%i5|YTr+wsI^!rC&2=H
zaQCS$K1N^cw2RZ;_@Wbs+rf8cmj<WjC+RB!1JvJbI#s1iwPia?n_n_+NXRcuywX&=
zwNvVu$!Xl6k2e-X(0T;ir=I+5)$my~TT=51^Yd&wlgAB~5@F9zyoU%ut)`YCoJE_4
zj5#x~kS*$N8p&1x<NZ%h%OgH2yfF?>#${X3Tga=mFbnWbR$lz{aNQf~1@Xj&wxN={
zJFIU;#L`(m0FN+?e+G56moB>$^a{`d$+a*`!9%Z1N|=`V06i*tqKlhOdz=_Ci>6{<
z^BaCyp<EC!fwT9JXZ)^#WAf+;Ly0Gt<m{DrucQMNlXyl3tCG8)p)3vq<RZg`674n}
zh$)N@Z(oI+9Y?GH(pggowWh#P5~!-Wk%dNg#c7SU*W^>eA7+5;YNr(pz;gnE#^sOb
z1#eWZe473lkch9+9C(4Nkkl`}>L(zO9RBS&1FC=6Ptq$BoYVS%#KC-L^SyVNiSu#&
z&SDY}I!awA^2z4QBCW=ChE1moStEiU)JADwY2~Si@=#@*f+=1>16$l9mO11iv8caI
zLUW8$r%7^rLN<%m>HlafWsyXESU7micv+H`4e$;2PqE6~d~rF_qKl_pq_U)X*cXxs
zIh`7R>eSt@Y>l6n=^iEr9qxrSkkvBdiBE2HGW?Nq@3?qrbKooSucRQt1ob-(YjXP<
z#J#4A=k+rto%{ELp9x>lf6Z&8_!*oCzD9B5iiOf?rPNpV&*;DT5W1Vor>U)%8v2UK
zPJKm!m#UxfKE*-@8L{G+(J)$*($LT_iXELm*PC}F+M(+aqYV=)3LA2@;~i4ABKV8f
zgI=Z!yJ&A%YGxmVcsCWM+yP4riFl8Oi#Xb1AMA@xrqAq<=y8cA4Cyet0fo)?kfe)t
z?&*W6q%E21Vur&a$crn%x0gS)gyPlrM3zo!?q2S68=_W&ozc0E`lJ%aQ0WO?c&Dwq
zc3fR2GC5Vh&frQjc|NGNTN}c(Nr~ACh(nn5Bq0wv&-lDDoAxABU{aSH#dp_pMd;Py
zgxmYQnU*`=m*wl6)b#0G+AkF~yZFBM!PMh%y^i2E>btdB_piQixO(}SN9|?@q?6Gw
zXVoLUVc4t4p)S=FBq0fuTV7o>Ys8H@s9Gio+YRw>%OGZW%_ycJ)KjARH;{dM3;Qq5
z+|f#C8tjO^Yg=?`;4OO13QJffXO7e!USxp@>(ESz5Z0GCJi2c+TZdP;zSJGVXP(>K
z`&zLrilIj2_o%1exYYY>r}*aj%j+388!+=1tMv;EQVxq2b<Dw+Xrbi~c#e2UqVew7
zQE5}+Qlab$YdXwez^xT_=pl3v3QGDA<f7qb!Fu}bX&UI;r=shD4ckgHO&m#`%c+5v
z1jj~;*QTDE#r1O0hJ7KS+Q{});`_+L-n*dPr(EfSRnHU-?A$pIs4#}ANoT+YU91&X
z`XXFltkDlA&Ol9dM}CAQH_}8jT~1o39+PO0kh<%+I(rvFBa<eBwdqe<bB_fR{O6Z7
z(qbS&%7L`!DJc$<T*!-LpbRrL$a5>CYLGwjq-IUgeraLiz5O36B(`<>j{y~d+Mly~
zmB?C9b(!m%_3ZN3=fhO+NcL%r%f}zXJ8IK1wDbzyq!fA1-aI0#iyC8!GtJF!<fE)=
z1YfT3)Y}~$)yoggk)72Cs{*gIeY7{To}iv8X2R(_h3)#2Xto-%cdVZKs|le(pDQ1E
zZ5tcnRAr7lxx!5fo=IK^s2az_^gyIiHCHFyfsFla&R8!6&dqySkgOr&fgO*ZVKfse
zCYey>*=?mvMSVPCKc)B3G`ESfGy8`*K8#&W829$O8JuI&Cr4WYti9{*Z6v*ZS9%5X
zM)N0Vk+yOFe1FoDlyAH;LpqAO#J$V%bE{9t=d;k)&qiPJZ_|{yKE!qx;W0j&)_hG3
z;0^x$etSPYh%6KxfYS?dvgetWp<yteX~f0#P^79KYQ~iHd(6ITnQiQ;-N@)0wUyx1
z7{`Ot8ODlvpNBWL+OM8Ix~iR{m`Mr9)l@gGi5WHNJh3;H?I4-ij+@xZ#1<sA4=snO
zWM0iTA5RLE+)}$J;RWj7@PY$APVZ!pnR!c~eE_lRUK;Ha89@+NK2JUa8(lWXL=jgV
zZ+>&71d~U#2tyEEsmj=kr7EQsKN4JjoH}d7Np%Nbl`@zcLP93_xLq}Xr_FK&jcuJL
zCf#XaRE^b&9fE``s>71zWqg{VR+5y-wAC>z8)(vAtrz4hcDy*0a-(#F8qkf#qpa$y
zon8mTNJR_0aobP2w>@Wsir=7~5>j=1E_XiO@S0qd$g}n&E=V60zk_of)T&i2a;ua2
z9r$I+%O|N1RzDCi^MTS|uxEEzGChRkL>A!L`^bfdenaiA!ZQ+|JE$=RaKN8k5Mm@o
zD3ZnIrOA;2IDW}jx+C9q3bHS}C>M&p&60r|C9gWj7csD*R)k~ERH8PtU<zNIbXORs
zc9z{Cvc&!Y3&<kNaf$e-i6oVKeI<+X+@{Q!(ks5^Ft8m{{;J%BkJ8<nkfo2rgM*&Q
z;w`Dqv8l7dE#Hdq7z_%uKMG^*LHh{NZjd}ssq5$nOx)v5`O0@Yv8$3TJNn)%=O|~j
zL7*wW+Tu5Wa^y81R4YIS@p1K=`;kT1(V3oMp`C{OcN--}kI6W}bg7~(gNT{IB?E-o
z&mY3rZnV~7SkCx{HhJ3)RHVCbpzvkZ8}&!n-bbyW0>loGcYzx1V73LkK-sA}+`X|T
zHM+v>Z_@KWh;mqg8$t*9PwekJ1B#xPht<e!*4!s=JO_jBrTdN_KBkPMlt|FedSpbw
zwxjaqIU^)Uu6A9-c&@0hz&djYvov#zDzBHCF4w;C3!UO>C{q}O8d(fICuQe;Cy!z6
z(yJ%eH}EeSS9gKfY$m5hF|8o3YKRAIB_6!I&=TpOueYk&CqdW4KqzF;YK*Gg3PM(x
zVO&(wNL$ii$jP`PE2CvvW#51)CvOQP|IY3}QN(JJBn;}+<T$IjY1!h_CLo4k;|FWC
z7g@TP#VsPaCPdnu76<!CP&2xQLZ`)3F1J5-SSjij6@;>mR>R{$8K6_|gC+FpWfF!0
zF$l%U93#cdDSh%%H`(5B^&X^{F1>0jBYY+X-n?2InblL)weW}0Y~SG~x<dUMD6H7_
zc}!|9#%hxm)u_13P{}qqTs$y}3gXO}Q2VrvO<&)idb-8s(@e?o6X)Ye+}*Kpxm1)^
zPLaCmx-%B*@J7EhKSut*SnDiwP&)t1Z6}EGXv8U=bZpU((kfT6b_ezC*+y@s!d+MO
zkY3<PNE(>SYktv~KsnnR@Pd?}0MPki2j)W9|I*RKylLIJRS}QKwf<t6a>V|66OM8U
zux+59uy)%cFW#Pb@xtlQi<y4BB15E@WL@48ki8VZKYtEV9Jfk>0-!Z!*bkOoOpagx
zaRr7L=6&2@Z(zRkDL|~jMYU?m_!i}c{-G=1c{5?6o9&W+Sy7`@f`>v|0venv<H<cs
z*`B|8eY~Su=Ev~rjOZ)xtPG~!_yDfOhCxj0aWx<ds3$}PCj997Mrv_S4|(Izpry{i
zd_0yS;UH~!2h<?6!y%0K8cyFicQlq{W(Yp2VMc}2m^bYg7GUCidZj%-pQJv$F(h3T
zWL~u|_YtkVcwXi}ZYK`c!q&<g-J6+Msidg;lfg$TV{?CX=4dzGon6R;e`(h`eo_@v
zjA=jA2v$(^@s3J|oq4$5|9Z22I~St9b#D+`cX)nGJT)A|s)Rm%6q}x?iR}lCrTa`u
zHwi@#PJw-)vP9#VgL<e2>yafoXwO4gl)C9)A3|Nxs1Uq}$@vs_bPB~VNha+uG(w?+
zr+pgWt0SN!g`3YY0^T?mv4vAX!0t%o2uj^Lf7m}KKXl^`$lS~py(i<E<n#4V2ek$3
zq8NIwFk){8%YU1z&|9rxa#l`OR%#aIWCyGG@nU1A`Ay@G*6%)=%^TJjX+o0PM~3er
z?fMWJvyGjDMo)8o3s+9hIfO@g=-jFMgj^$5aY#rOgI&3N!$a})$e{EEujz0FG$;-%
zc~m>Um~^EH-j4#=-EDqmE>gs}8ww*q!t^0T(E{Y*1P^2nvN6=Jh!5!B&O{rEBKsOU
zg^G=T?3OMVZD|xL%##$A+Y9kq#TQRTf4LY$pO+0W)o9DJ-gVop00a*8i&mJ6Rl~n$
zS7`k1)t|w@TfPD<XmdB09ZR}ncI2nTt<y2!Rh{P2iu91F6+z{?ev4>XH^@WoaHVJZ
z7Y2X9+%r7I)}U}HW`AqTe}KiNftl>#28r3?4l~b%vr?Yi|FRORg<fi>1350-?({qA
z^;bJ$dbK2vNm5$*-gxiDr0%6GhYX^?X<8RmeA13?LxHfk=wsiMEK)iOo4%9d-qW7t
zzUW7mUkyTdzS}=HgPVDpxuG6n?92Y=1`Pk)i)VvqePkeTbA0IN_TqqO(<i7|HbJzu
z7WSXqFv`&hifiGTBF$zTZ^NB1^eSRV4{t_3$lZ5O;=oUArRWCHZtk@-*)ZiSs4}_C
z2*2qLis6^E%7$cMf9_QHm*;1@@<f+j>}A?(nTWey-MG3BzLGtz(q+&o17{@&)WRDS
zio6xM4J*#}M(D$&*SwG>WVf?NV@B$n57K2Mc0avmn1h?_-^>@$-d}$|6|fap&fj$O
zDfeoy7k~Vr(f*c%mSt!oQnl;Hk>b*+GKJuU$YKVH@<s)17WQ?CT6uYT7cpmeiO9?>
zSJQT!f&8<k@*4Q1P=>4fCuZdJ(Y2nLBP@=OLB2mi_PSciiz=@|Dwtl?J_W!Qqu->n
zM4NW!-jSsyl?=;Pr17q(EFp75dJ5%fmpq9b=hNP+?X6kdU*U(^{Yb)~g3Piwd*{2V
zj^5_Z$V|WBmKn@X{VDK?4%E~rzI0K9Y|kldYr6xZ(Rs-%4#&+V8bZEpQg%Sj@-x6j
z2Y7gD<F#UcX<BEIfzVjvQdo{gj<M8%u?TZ7^l?Me{MHhhpP(Cpnlxz<nyt@;<i2a7
z^9K#y{C=oWCN&P^(~>d0$TW#C_SxIH*c8(v{k&@5Y6-DquQ;<awO{xR@+H@apF`K^
z(oV)4rq977X=J~vw>-nV>a64z*M)`$+Dl$r<dzkIg<&s)ab|kjOCx;2$1kp#4`3U@
z@Ne6z-h-XO9IH&S!>j(a5J$5ht_0GgUeDfTA;@k?4=3f)RFhW`IQfU%Aj{HfX)OX+
z9_G^c_qax5qj}NBRZ{(;s<j8_cOSlpVcmicuDA0Ibm0Mql^28J$dxnBbsqFd8!`fT
zdG3S9sBv_VeFfjjDo&bwB6DZP)j^Q8<1YBh5=^=MGQQ0t`cmh!CD~sf*v$8km@ZGN
zYZx)=ecef^WFi6=+TO}lEwVu;*6n>O!oJ(1DK%xWhx}y(Wl1S9m?cv;==yf?X&-q_
z!2h;e`ukdlTQ|&4G}?U{PL4JM7sXZcXe6HIo`R+gEgql>+ClQw#6e}#_V<g9I_Ym~
zrH+srCOaYWwOwD^iD9}oQ<E02%E>{e&$4DbiYW+}(N_&!yg5P%pODm!KrJRe_L@?l
zp;GQO40BwYZdH;V7m00Nl3$R>nKiv~>0BK#wD&8<N+RZ}GXl^C?!vqbv&cIhLOs)x
zW^eGOP^-l(qjY?2qWz^&Ro_gRBU1;Ig`O<t&MmoudGayHAY}%JN!2}^EHsxUA`p8(
z-H((d2#=BZQnq{z1g+VgdEx0e%l=!bl`pBtOiNTQMw4GRbp<4RnNDUKgBvUg%yG92
zTs<tN&y>*fu?>oCX&*}WYQd`2LWq0G0G`HdjkY|8?$L+DB@&kRi0>j~gd1EIU2+t(
zyu33OT*}Rp_LqNrN&OJS;=k|WUW0e7DK68&iS-{G;E%XI>Job<b3M(gLAPaOVaYfP
z3S#@Sa2YF#)F{2GCDZTQKp@Fmje+#wHgYP9>__bmS=;7R#uv0ub?Fz?;NI*)Lv+_y
zO7X40dJcAqiW@&v8T&|xJF>9+r*}@AJbixNG#DL}&R%jCedc`c<~y&)0Ut4zmCySU
z-dA?fK{p*z*van&0}MWzouo+JT#O0kmDi|zrkH&?QOLyRIE_!Q&Q~uTJ0R_?I^h-J
zTJQ-9uj`76x<2~G1JrjF<JJ}n@WIDHdpFJCdYyXCiZeyFl0F1m{yK{knTuDDYQ>^w
zp#5b}HE6Pge(ZPN!XRGdZ$&L7b(sd4Yy(N}QkHsU31%hor_U=QohfOci<R~c>z`?$
zqUKIp9KA0lAtJcP67h_^)jd_qQxPDd<3M+@^6^Y>B>ZQlV-))*r-1~YG?Gg)eHB0$
z6#s5r>Nb3Yi-P8gHk#tJ_?Bs1g^%NDan|B8e+Fnq08ttX1b2kSJRK-J>*b4AdAHEl
z!#W@c#x7=j24XfDbn$TK`<+O}7M-d&6<ZpaVGnNJRUTW3RGB%CO!Vp4aqZf4?}tVo
zCAzK#EACK^f758j$#|(OsFcylAc%(sqZGi%y+#y)hYp4NJ^OtZd!N>aFUlh?1R2Vn
z6VC3Ozg*44lc;no8^!;Ae0z1`q^5!Wwf7v+=X>XSFZFYH_9{&{t7RsN*-tkBaZbE1
z*2RH-0sjB>G0J!a*<qf}6rcBqf{n9W*heR~8Az=Y7^0NVFo=)(l2Y=dJ+byIFweiY
zqPg<=48Xw$ddlus+4zxbXW1s~roX<F^jg$A((5y!%Z35@#cmnvKH{-C7WZGn(L8+|
z9L(EQG1EEx;$(F3#frQ~Mw!eKi+O`pg^x5+l)|V|oFzhAfy^ljhEvS{AW!i`NGcOB
zS>Fl?cR*=AzW4oGx4($W;#E|PW3#rFysN0oYFPQ|9|K<rR!jtJ7o~dax2&%sUn))U
z|DAWoTwHtrOl{_pI?(yq5C87`3eY))6^|5f7F08<jQ+iI$>Yu+F}%zM6gJC}>hClk
zPtJ=QXukIG4`BY3kK}$ITIW2_>SW2=v@6K`EMct5e`Wfobg!@jIyjma@m1%1?;rg)
zPyNo9+6%{g(LdIbP`+cO{RhwaY0md%1sio}p6}JuNpj-;$B%#{=>SPO4k}ym(?BoU
zC5QY@*aXo0Y5k2ez<N?*V)%V%CV*@m#loMwG|(IQU6mL9QpaE4zJ&uiDY<yHgz2>S
zOY!dCeg)Pm&|K6!;do_Tc@^>d&}RX%`L7tbGoBVt7_`RzMi<RfWk6u;Td$4IQl#Ex
zv-v00z{-^ZnzI(G10ZO4zE$~mo>Bs2Go2TxIRn@~7E7Ie7fI<=Kw#1S_XR0WYF?ug
z``bGEMMNGu&^*eJ=cHzvz>DdBt&UKD?6WTt#!sKr<nbE)5tKN8;)K|&+Fd0*$=}5@
z3dp`gMgEV(&|uy-;jF(CIT#Ie)mHHKST*mi{XUKRN&pKezp6Wj2Isu3b!7itJdVf0
z%jCMKp`;jhzvbNTL@ufvtGvG2|NAOmFHBp13zk1|)K8N1>Tyq7Bc8=t_(nS2Dk^r8
zE<!}Jj&amAEP(<sb0Ws9-B^bL38yc4jU`<R9Z8eMR!6>5WQ)Vq5ZH1s1B1G$cVE9`
z9r@+n_F}p9_V&27<R?g6v{_xNLgOr3<wElC$d>ayzD{zbVcOcyYfOiP^;n@?S}E;d
zs~qy@tdg*s6D4g7(1uwL8)tUVPkNz7$a~jWgdbZsH6C#u-K>`P+-WZAZlKMG3|Q?q
z(MVS-l1l}T5LP1ZZ5zf!R+2ig8iW;e)ru;5&+hy1q@@4-G7_d;l54`gAz)9MQ03M>
zqEI!{phQkvem(K3&dW5?_HT0gmUFx$mUtjHC{pDpebmoa6H4~BciAHe2g)jmpF9^L
zvq~nUX$?mFf|8wl<VrppRJ5*;KBr?!#T3Bf`{I}20l1lnxMfsLS6Bkve}oU~gAG|@
zcSTRGe+wi{MvH~+rJ=BxL(g^pk}mU&SfAz6y1C>#A=P%aEQO}7^Y_^m^0b<lT_Exk
zM7X`u>Uh;Qt9?6Btk9y7>%jq8a9~>k<{uH_J(Z+Fxzln)J`nLBOv~a=YZ11ZPkQee
zV$Pt6u0i{<0*+On`p2sWtkf~{;v;=$+YjthCpI1kpX;C5QY{~802@JkWFO4dLY0Gd
zF%+^3m;qTwvHh>RZ-jcB@?h>uA;SWCLvHPt&7=-|Ia#*lT<3OIb;nizTBb-FU^5pr
z_c~t0$a9ypu6A}{@IYZ0;%&Z)*SygLVY9|g`dZ(Q@<%uxN~=t&of01$#4a+a;=1Hn
z6=4s{))ScNFIslg;<n?WUCzFrK1ry1Aj~TR?*&MguRID%Bh)@=I~@`((p3!d#q`vA
z*{rT|rxjZo!eCK|gr<q3dVVDhF8TLPa=yb<dwz#KQbqpQ!+po1ijI5)r*p)L^a%P@
zLo}^O<z=jWRl2yax8G4#Ao!p`iZ(`wAGr_{xorsC2fDn!9GxpGhFRqWLEYMu5v(2&
z!Ms$@bN|u^dxKw#Q1y5bcHUq6a`lyn4%<~tV{F6x_Ne!4!$#-_eqZTU%8PYQV>p%C
z)jI>HL>gUkCvUdc)EP*odOq&|DpFZRp)Q838L0RneK@vlz(sPB{Ty?!tBr-~X}B)*
za~BJjf+j=<CQT+vZMxi0-b*iM){}nL-}cIf?H_a~Nk`B_OWS+W&yVjME$9>ywBRjc
zcOIi*;IYrc(WZ?ROANfDQ9kadP&mF4<ii?|%W;nT5(y4+Y50&7NN%H4w=JTNKiHn8
zNF~-nu~We|<73~wTil+Ig`N8P^|x#5>Its`=4QiWD&lKrpOxew)pR#6yMV3V(Xnce
zgz`5j`KZ#N!fU!llK*1M`8?`lh{aqxhFCuC)<{|%y>j9+aW(8gcLY$pHb}<2R5xn6
zjO9T`5I>k4e8GF3$VsAmgyVtKtrIN7?7y!MK4&*}@F4Cdl~b@){2V23s!94-7BR4H
zk=9$#v3%9tDwNtFQEF3h9$YD&gM}Fe_ku_Y7*vi*;$ZUNmFBXxIs;L{)#e7YaJh@Q
z1S)uDJWO@$h&VXO5)+!ofJm$}&9BI=k{v!X%u!QVU~!75bh}>rNa#?sq!{k_BK=^Y
zA~O;XT3Pv$m1LU7WPY8kH*4wxXZWd9x^Zj0ov)@U*)W2vTd8JBI&E%a$&R)xylLFp
zYU;`0Hdp%Xj1wy7AN;i)&>e3`YxcayCkX32U$qc*>8qOkm7Qm7@0PdlyNt*d$PSa6
zT%t-QBuz5I#^265<y^^e@*0R^H(R2GbztHR6f<K2nhv{6X|h)F2z->3mpHrBbCI1<
z%a%j$mMYA5k?riRoUzQJ>}X!In2M?;<u)yQ)CU6rP2mfD3X?uUsvpR`d5kleMZN+?
z)}%9JLfgz(6`_i;fi8k2EsDr~TGAd>R_UO$-aE>EniN@-iL?W=ghR*NG7q;$9BM>W
zPo<Wds-J=CC4z7Y?M2l-MZ~cTlR`T~E_s=1kb;W5k|N`$RnUJoNX4*UM~@G`jvlN6
z<~pDH6JGP$vCoE!T|2u|Rf?88rO8PSmyIAq-9iP=W#JxFf#oume(ZP@Au={zdFB*e
zc&Xq;{E39x!`65G7$0N`+0}ma5)Rx$c${o`1Oi#%CYl;3BaI{K=Rz--v1QYTUxMEy
zy{}m&)_5;W)X;|xQAh4uEjXTyU}3L)RLE3)Fc)G9mRY1$B~RVW^>9hEHpC^F%mHqX
zksX)Lt#n2@XumtZ1hQtacw;#f{GI+4JAKoa_PmtS;(cthxBenbp7!`m<^3mNg62A(
zb=2?2l{@=<VZCs#igXooZMGT)+_D+>6aGjxP~51Y%^mU3b>{?fL8Vj>3P7B1tAo5Q
z*YB+r&ywEmk$u`J-$xqw&d=WS-bLq7EfLGzf=F9c?m`yg2iq~ZbNh(BeRJioVWGyO
zq$Wg3NHk~Sk_Y}9q~3a`4(=n)^IV|0yEkZR^$vN|6#f&6J*w|$z8K&l|5;e}gDVrC
z*{h1K9o#u#Jlj<02MDOHh~PCG6gr!EQqx#Cn@YSk{yRfEN&`sQm7KGBYw^~}Xr{ld
zVzzt7;3lE@3*4Y<A3|P;*pvW5Oecnm!EsYDp=6IIroF5A1ghGgQx8yg-sZR}X1?ZL
zDE$Lf{Q4)sujWwmLyMzBvi<WDslw8M@%a*3B@4>LenBU#0g)IsClJ>C`;SJM^OM6{
z%9(JB!G*QBq9%?Cn*9x3TEa+y2k;D`jq+NH>GdxNIa~KnF*5Q7K$;(>={yhzYGY;N
zI+J{c1?3Lpc73n4W^DE0;{)iU#WGb(m62HmOfI^wfV3&S&#3GOmJ+XVxxjQR-vvSB
zBd8~e9e!{Co-;<zk9aO58}~uaf-<>WBy)z$YO@14a~W!w@3!twE>u&Y|8^{W?R0$9
z#>8GYKB$YD)@Oa@5zbOGmPEO>iJ8qbzJs{q-ytE)NAH>@yu;w$2f5)X#+bXgu8NH5
zhRbf^$kD}Tm~rTxnyG}r#d|2oE6uZpldjwhb}~3KdLCIY|8lRjb}CUG1~UorjZ9y|
zrg*m~uTa6zeC2j-%`at68RUK@xqy3x_t*JY?g&;*jMF?!<*n9M&%Bu+`n)Al!i;Zo
z^By}DY+{#LW^sA<^~9JgL}AWwU^&B<nJVpYi2>u&l2UwDMq!w-FPK*-$yITn$)z~7
zHV{|SB>lv$G0f(<uD$h7SsH^HK<nFEbF>^KKEu7AS{A&w>Jt0g-65p#*8&JX-rtp2
zMa*?pFVfq+O;nS8x2Cr^vYi-##}b^Y9YC(Te*69KZ6yLX?;gJ8WOTR-eHGJM*RDy0
zub+c+AZ@CXmj48^pz$Ta)WOFkxEN=!f7>6Vm3QNn@bv_*&_o4zBg2!;-F678_0fzm
z#lpo8YGO&F!fBgT4lx~O+nebQxucv~g6G1Sg60e91m!vhLS&0)V|<?Bp7vo~ecw;z
zLmHoQ$7NF>t!p_PCK|Wf<1n<9@99%~ypyCBL{WscowBqT5WA;+VNbNgy<>d)a#HhC
z=CdQJ?G+~$m>nl}=G1fY+_Tt61<o^f>azM!l|D)BFsvDG`?J4pJBkgzfR6VU9!O}{
zXPr>F`aNPiX*{kN(Kp3+<5JIEpR69wOXlMTt93=sRf#&+o{QIV@W}~!-9|p5ZXwln
zdA-ds;YxAA)!p)W(8nwufFOe~ubw>q^fB}T<sYp%LX8`>LXQ(^J&Q=gmr1K_gpg2*
z9LAz_uEN9F*mIIz%=H^Pljpc1NL70inHz*bcK6vmEQ8cd`EBmYcGd2WlSJ>eL?)Rk
zX0A?S4YjK35S?Cufq1*6(YB>cA?V{7lf!4KF|Vk^?P{K#VoPu$01|u3e|aF=GF720
zjQt~7gEPWDmWvzK8}DxO>D*sH_z%K$>a$++7VXMk>Up-)&<k?|AEw%Ee_o977y^Bt
zc&`!Ee-_#pIBK%}t)QmIuc-okQ`Q^te#(kz+z^RO<bn5R->?0nLu(N~$DNB8*4NR9
zRrUdKaD>erEyTMi9r4$K%!wQ<a{Lecb`!>3F=rhIujR$_vzg1y3cKkXNlnp5GT=Nu
zrSFeURUYld5wi0&G?Q56y@}z&#o30RAkU>!KO95eRIrM27H%VKYa=4(Y9m8~I3`q8
z`8CdMv6`Mte=qh;FfY2D^S>9Z5US(roi7jL@shXC^UZ!Ho<L(e_?QqTGJEF@o!L@M
zm`}7z#YJM;JrtA+>=R07E{37t2DUTXpcDtN7wiZ0EaW1SVf0y@K;*4KuWiz|uV-?m
zDq9AGi(0$8_XG-o0|)`gWkw=D*>HLxu<@j5S%wNs*lSUf95VCH?s*MzWj-4eUK0bq
zq!=%AuZ7l2xX`j`=+PQcm@jo|zp_s<Xf}NOu$&eup08_Fq0*m~s9rm+t}BjI>&gb)
zmE`a+WUO;Zj+xsgR6ZT?q5ZyMT<#S8Um`s9OLyP?sk;XCR#!E7zOb&1Z=!t&n`yRG
zI&2|oEt>6`8cD^XW;%n3OD&j+Pey1-)^vxGx4@C)(DFcg;6_VyJIVp8^<sr@mlnKN
zEH7>6rahR|X!RwDg+HrrR=f5<J<0NU?g~zP0KOzVWA8+?)=0$De=0~HS81UI^+LgC
z)0s-4{X7qgYc<-%$=k9|!r-Q!O-71wi5j*izn8@&jU1Va-)lX?yA_?O;C{d)uR_5l
z(jxR19o)a@Nc@uyqx$OCIXY8OzB%7bEJ38cKTL?>M#G+C_;9Rcz&Uzi#1ZWdXXX{<
zOs0G>Q%yTc@i7Bm&&)SrX=ageeM))n{Za?7&DLXWQdHjcXI(8^@w9v+Jo@rs6a0sn
z?9#C5?oa%JXb!rV>me5GgNdVEu6A%wV%ft#-0OCgozCRsJUEzl60fJB7GL~k)TS`r
zU)yIO+DgGDga`+yiQe9jklNhAnHAj7WUE=SVY#-)?;mwq+&tXmFTGRwrFTMq>Rq|-
z)a#tLQ&D)}Xd``mv;nFWJWMCRJ-Z~Fej005x~|;_7~j%zZ;zvOYF#|9dNLxE9-PhE
z+wGq82Vo{0Jxp^yb$A|&^~MEiVy#ReX*1z1@WF(8<f>gY@?c(5YW2dss&`HAzM-3r
zy6GG@Uw?sH&k38_$)<0sC<VI%w~ghnrHcI_nTF_a7GMDhfC4-8NSLLXMyJi)EHb8&
z+pN76z9@)PYsroeR^j#`qy6GGn450fm&3Z#X;VM6=Ot>KU3$ywb+?c{CFOr}NyrP2
z%zZs~Yv;K+_nED)p1JH>^Wsvq{nOS3#g^(L`NsMO`y*bc)(X=#-PDuOmHBVpHSR}N
zt+%+5$ah_uYJlUnbJMP?O4kkTvAMcpd~E&*k10v>-MgmE`$@|3Ud_*tUJpGHYO$G9
z_r#HBBDn4SHj(W80Zy3f(FhqJhRW2(?2Gja?~BV_@3Auz^M*1Y@%))tS+j`d#oM?2
zqnau19mdUUfJZ-lyV(89uKuSv4C(#L2xj=F5e&m~lCA)y5iz*_b8A6kL&#?EJ#qI9
zEbRS9a0MawAX^hY16*mxii~>?+RQ$9&M2>pIbz(~v~F|}(@;~wU^XjRXC@pt8e&id
zsdfA)zi(eO+o@DnXl)C(yzA?IcqrY3u*MWMI;xW=^N!Mr9`vnVW9!XxNlSkS<G$SK
zuZ20elJJJ!R|7bwXArC7*?JFbheb(0N8_Bbi>`YN_(epOqiZa2neCUm1=m3*H7{`3
z{AK<ceD}**74@gJs*_ne_p?j45!X3Nlt$<mA)C%gXo|pMe~#TsAx${S-1a_b2|Hfb
zEi{C&uO2jnxr_gG-5F&DaMPQ7`TvoD?f+1t+W)m9{|5>Fzpx{B0?(~+1}Ni%H65LQ
zG5$QCA<}1Mva*fMA->LEvj|i0U9&=O9q@0Ctj~5i<bR95^qXn+<muWgz2oDKC=|-f
zD07<yRTFG8+nG=a?fWp6gs1r%#Qlj9R}7FrM~B0MgG{o;=7_?YV3kWs0;&G;oYKPo
z1^r(`gs8AUzYdFi+(<nK)mv?iWWm0=B;c8J=3nD4Dk8NI3d6;aCYjrBi$Hh2Q;Eyy
z8TWfOe0lsY4};)Yar-V-2#W;ZbiXoqJz9otSSV9=&wln_KAL3!2zj?8GF@}}_TRl6
ze)yeQyzkWXUw7aCo_e(%0P}o>!IOBFf6we;aBvRsWBjSVq2!--!4PA>UzK0MmRbK7
zQvBzewhz#smti)?`Ty?e|1;KLDu7C;q06)P{<1Fqr@z|c{_1Yb2LFrU$YB7M?NM!f
zBLD6$9q4aDpP%|~XZZh&RRQ>*bR8sA{C@X@C?bhKe~U%x(pUZ|FM#?y3E*C6TyU#1
z@_%Oh-%I0vJf)o{|H9b+{HBNkoUwz((T~jk-JdMbUu}U7J<Y#ZYp)5gcGx~@{WrfH
z;2xVe?$0d2UGd+n{r|J56emuLJ2^Rd8A@|#`%yIbZ{2XYH~hO|A=N1)*n7`^(_4tj
zZ=Sd~GH8+g=;=TBifle@FO1}8?q*8ESZs}biZBt3;+HJ8Y`*RKkN=$rc|bGhsTjxf
z?GJgx8Mm{KE`(&Q@(}l`@i%n%B>&};d`Tg}+I#m@at~J$wAo5R@I0Ma?S6GQL;8o`
z{B(mMir*>43k*<aM__z2E-<sZAQHX?6%>-C&3h2oPu|B&(fp=!rGnZXC%<<l2%ORa
zeZA`<F#t}o_U%k8QZ!wiMrhRPpE;=a)My$0UGwKt6*Z~E&sqf1FgC0(;Ltm<H7H1k
z>$mBZCCP=xKMv~W$@}`#-+pWM=U@QTgu1p-i)q!bWlU_31P1&}*l}EZH(P0?Z<5%+
zZ$e4Aze%)SqIalda4F4!dABQ7PCSzcyOLA(N#)*IYROB2*V6vw{WL(%QKZgxB~hP@
z-v1y?*smhAMNGbwznO9OM`Rs+<;#eu%E^WRd>C8)?q^<(&Sxv!|MDbi(GHp_mObrw
zdj+|-o~^swoHV&)C$eq$grd%=GRMqkx%x`HoxOc$gqX}Z(BQ7}wXC&^<G(GD&GKUj
zM6!rfu1wsFP85@e<qWPK4!)gx7lt`w-2cpEU{{gX-=rl%z3(?c*y|lr5Rrj!0&LCM
zDmDDx6{nr$-AsG0M^mIi@6P~NW}(0)V{7ZC-<DqV^<xRTH3d#M!+qg1LrkjULLnl{
za^HFmr}>r!a$}#1c&&##*sL^>ePaDjH3aq-zT?I**A*P%Y(-Y4ElYhfX$z~o%g9?1
z?5C%qC{nWw#1-=FJVjza|AYyoEhV7ptR5qA=dvft@b}G@HI-ePT-SUZoSl0j#LqtY
za^#5wu=dde$LW7yqqYZy1WRw!!8)Tv#DkEstE<ym!&Qlii9bZIS0G>34XW|*WOb;(
z9-aNiRFQ80U}Vd$WIr%M)VUUJ5wKE~m!hG8H)mYf-$l0k%_DS-+4D*OwsC#6F&w(&
zJ9ltvcx;UAwD_Xn$c}QRiKasGTGfz{P{40(pnm{uR6Y`@z{9ycX6^f1ODv{ySzT!#
zl5X!=wBaOgvqZ%H6M1{XfXzhy#rL9*0?1$$A!s02{IvKGieWqExBm$%Dh@a|H^{K~
zx=-f?D$b~S=s2XTf-m%j=JaTtrvIDG3z+*iB(QH#2|T~1ukz!ihsvCY+cji<)Gd?W
zwk19-0HfukhCd#Y%2p`;D(WADioXDQ3DXmguv1ZNdHlOKUms{wIDBqa-3&0idg(~M
z_($6-uipZV)n7aEk|@qX#b4>-8e!22&{7B_{`^0b;4hXLP^40UPu>pvhs>_D0Q_Ms
z;&_!<1oT&%;Yjz7){0l;foW_Cj_S1i^5Oj+H~_T(eopQLjTCpp?C!48dn6V?%j`B1
zN8=xB5K@lnU7VaanLEI5%A*e`-pFpSpvnu5Bn5oE%e+XV<|f6L9$(vWO~B$k4Z{I@
z-k5`nNF`;YVVkheZhJTud8pZ3UzZUmWhCj{d`+uJEUQ(aZs0sSxO8ZkYtT^)XXfnk
z5MtF7@U-ZAYEyknDrCefIht*pLk>(xpWVhr%y}BMf%^)QMloRN{{3w?pYhG^Am&kU
z24cn5@MmIh&b2~Err*dt4koz#wNKe(xdY+IDwa#m?-0(a*<LAI{up38s-DgJCO_Wk
znW3LUk0_S-3?G`S(6pglx0$!qQubs;#JsW-4&OOPN+DH27e0nsAA0pMOL`L;n>|#I
z0^gDs*8C_pBIW0?<JcZjzme?cgiI}6VZ}2dP2-gM7#tY;u*vPC5M&g-3>k+dlYg#m
zh2FC+UE&w1y<(^4J9I#XRdPBSf@BqZ3z18Vw)IcZTITTx$V*uutU}v5?KjM^1MDDQ
z`Mh~d_wX9Dgn2}hod-)1--wQ3<@-xrKv@oY2%_@qw);ud+gbcl$VXiWcCGQ=%Ct{8
zxIote?HoTZ2Nv+m8$;%?W-xq$iOJ4>aiWVWxw=O4@(`O`<7fp^nrIjoM(R5vlKX5b
zXZ^`xxh_W-IoU<qxDSz8hspn2tv&Zt+;nfA!MwDFHqqp$QL}O_*#PS{b8=hX=S)1s
z8O_+H?F^XBv;ea+;7f^4o}kpqzuLJxltlO3r1zlRtTW4rl%G^5c^^9&kXErg-=J!=
zvB)gkcQb1|crLU!s!W7X;{8dM6TR0IBnyR!S#RrLE$%wFb`1DzL)txGzRf`#`Gu$Z
zZJ5+h6OYK1?2b+Q21V9U#+YT#{tczwc*y68QI9Sq@0l~~R9Yz4u4VXG<n~<DZldJW
zR&4+xIHxYO@Hd#z=0Db(QD}8(YYBR;g|TTjLehAkNY*(NRiT3TkzeNG*CpKK5RTw{
z#y8cKHC_1za@+knM{oVqe&FbAJj*qWpIqT0{QY8SoEuT!O(x#vz5~$8m?-_EEO7U&
zr`@1Z9bH*utdR)cGhyp7&6AM=xrjseww&$eEes8pxev}!cCVHnZr~cwz9Usakm|1J
z?aS7=ZmxT~$zqBL1jG%!=*anPqu04~1^IGHkO$dkj~lVgN{9bQwxC^9^hujRbnU3>
zE=pQ?y8vz><DCkDN=dWCtcB0CkTPm>qx0h;*OAg2kxOHb0-|Y#gBHK<I3dI!^u%^@
zu0{$FJt30p)d$KQy%&_62yw)Gry4_DcVUt<pA(KAYu-YMwd_I1tjkVr*TqTE6GhyT
zR0y8^w36g>>*g8tBUMFRJIl)7xqFOFQKtD*>P?B0+ub}Sv#J{Vp|tmj5YE@}wSb2B
z@FQ!E-hFq9yH$hy`K;hNmX6`4%EKGik$%(dCS%E#LP~F9$g@GqfIp(`l8EoaB;Rz{
zw~-%*kw<1vYtISFO}O`~RAT2&h2_Hi(A`L7OZi<gKRdQ3jh-gMkh<OWu#&u<_oL%1
zkY`X=$yD;Un6X}=W8pUzJrnRrZ_Ia+Rq&BUe>K5XYOK8Dax4+RzF>Yo$Sl4X1Z+RR
zG8#L2XBc|u>e*CqQnLWt_Oqa}?_+a0hE)Vx=FGR2Ww*m{t{exK!l<hVSq{st=ZD^_
za!<NVo{dPOO47(@oFbSBq;8pkBx~!{;=-wMQ_t{(i5*&5L*bG8oeV$>7nQZgZ$OX_
z+y}mD13*wSy~I9}>%(!;aW=K-d#P^F2JQ#klU=0RfOqk{l(YZO+2@o(YJg*RP;G@_
zd{!T~`}3Pc+#;<_oQvEOTC>&n`2~RM=I5{seE)M*Mu{}-+m^WK@mWoV+OBs8<$ah8
z`a3K~MpcF|k9wGWM02z5BEl9xdP>gIOD{J}@h#v6c@`T=+Re{Fz@8l3E&Q88b^<Y?
zFD)a(1zKfx<(GbV5x!~t+;=*|z`{A9((SyiH9`I<>%E)pG6#w{#rFJ<B-{|!Q@&)@
z5(5p_lwRf;_ZB^ed(oAiZhWir_KKPGp%R-Fh~d3XM#@Z`Jv^DvdlI(X+6A5m)iR5s
zv4heY8?j!t2j2_=R>!}G^%V_vs-Qf@?aDtgz;^aREt|twFCE4P=Y09>$o0=X0_k`x
z?pkQIjv!L{sB31qD_|}>yK!i1bX^GJ6PYtFc}U(5$g#|w$!Rx-p@pjngo8p?#kio-
zZ|PtKNpz!IYgVXYHo!{bs&OChfXK^crCHiMc5D(^tr?BJT?fkyaMEa?>gT=d6X}uk
z?6whsf8b{jh63Cbl8Xy3gL86QNB{Dz|2h>Y<^#L<EuB7Bz|ik8@REI$%jBm_OT%&x
zt9K8o=AlbnX*Bc#VA&iWdLTIv9k|&)*s6q(0&v#clhLg4tKG<Fh3zla1R*PhWfj9z
z@iN%_|7z!2qngUDFbN`zX%Ga#K^a+#qJR>0jEcOBP6rhX4DuR+%4<O~0R%}$D<KMu
zXtAP<5wXEwS`-L{D32rpC4fi~d_W*T2=W>Tph<X);UNjqbDc6Iw_W|${xZMry;*mk
zefRnHK6`(6pDQ0X<n@Q5Rpqh>ci)_CtzzrkYiO1``gCa%Mx8tp`-+?Uep3E`_pW)z
zQ_RM`!;%}Iwbv|?3WMHv5cG}!=$%)lI-D5e(|#zqo6u)kJuB#`U*yDC6E4N$cAxJ$
zu2Sngl$r-g+cSesKO>_<PR6_?qZs`Y?QFXxehGUx41dpg(w{1x$)IBu<%-bi1@Uyf
zyb={C9&K`=R}}XB;mPIq0;0(LWe;EZ`Wb%cka63kJ&$2=B+~}W+#QMSo)f}xyhY<t
zI^oBdF?ah!>O|S#8FsIM*>$zKA*uh4;OW`@(zIvmm<QwlNDlppKfCi}QI%b|Ky_q3
z^Gt{6sU>p^qgZHp>sdXao^zh<eBP^SOXnzahPR5F4m=K+Qret5#;08DzOX;=_dOnN
zTmDlw==gOgs-3bMy6PmWQQXRiEx@l{6+90u))!kZ?y2P-|F}vN5J0um?sLzHfwd5I
zHMtTe9hx)NtjGKW@}pU$H^1xyjgsxaUdrkHf@yy0{-7HIkI-KWb1kEB(DmApaz8@9
zR_I1@FYb)Vw&V&Fyz?AxI%c0lbuBy9ElfR1-o*;a<MKB;sdNwOH#uED91=tdsT@J)
z)E2tl_i>~s_*+MQVDBStFLf2ng$q471|)S*{mQ$Sf2F9?5E?PUc<F+Q*c-m@ufjU;
z!JIc$i?PGPlJ{P5onezlyS;WfnB?B%8K2sc6k_edJWt`o-L433dp-9$$v5*Rw&o2c
z?`PVWytI+UYTdv!YRAU*f2nGEhmv>l&3oNt6;*~m>PvMuS*j46&TmQu<O(#>!fq#=
zT*=&y!<j^wpaa9rKFej4ho;fqwH%$TL!q3uAAh@7ebu6!@KtcMhcjzhb)<?m)u^Xu
zX*^lo7pm$J%7UXkC)VXZo-zHFrWm8ka|;GCa!yWd`fuhPw(+`PoMszWZDvC!Vz>uf
z_O?zW{bboeIpgb~k9EqO&Lb$IsW%?!y17(X75eO?$QmdLkM8vN(t!P8CP>Dk)pM|l
z(`eilOq}o%5qz!rv|91~<qGlCL0ZhHTDq6kpAgKB&LPK#n-=`<iVM)M{LtD%yZFEs
z0p#X&CFy>#4}sSWaJr&h*NC9HCd1FPQ7!-nbLfvv@EYX}E)vv<_QNd!yTP;3>plK*
z1Qs<?bP(vRhZ;csiaq8}VQKw~dkL{yC$fA76F^1Mk`)1M7tmk>Q#?RNf*;|Ig6NJz
z;A<}|7C(5<$jHelVY8bPXWsfxd8c(!G`g{V5w5%sH1#HzKP*}U?#{Z$gpoF;pfTGn
zwV`+cEK%%-3nL`$F%zN71(K0(uY%i6rD0pNs_A6hdZ232A6q%pfWhYUykagl%Z-$H
zn^^;c>n-4<zQ}cd5?uk>&_vdUwR^Zlc@S?AVMuKcC?@}{scP_!y=_~;xgAuseAegg
zg7Qs+t=D>GREL(mbdV=a3IQd3Wzr>fiCJA1eYm+Dy<_KD5`A&{sj*(R<IF^#^M>QW
ze1>{T@_{!b)X}siSoy|xr7%z=!G#{w?3Jyzl^cwli`J&J#&nYp%)ibA-O6mXok3)h
zl}Sy>4eK#mExRCAkq<(IN$=*Qm)93+^|+y)pYQ(d)N||A62pz?7y8&W#3zW1wM4&>
zsm0$|BEN?1gD8xEM$SL>=WvrH$AJ$@QJE9R%+LX!vdI6gw8PES)_@2KUkarh>_ESm
zPDg&exn;f=JJ-sCDPc5z4AO$_TOhe<<0+q)nM+LQf#07^dJz|&qUe&vns5HnYV#{4
z;42JBqQuL|`Ssq0hT2@pvrNeL9r<_^k^xciY3CfuYX2_Y_SIce8&4!Pu0Lv^k6$|@
z>)v5NGJQ3l>^^jDEy*uxAmJYaQEwb=Q7}L(LNwNH%IFI#md`du8p>Q!8xlgAt7(6J
zirLpaiXro|uGO7fBE~*3-dkCGnzSV4O-npuTk(<@6<S}Mj7TdX5(tD;0Wcum@z!Sp
z-eR;j46|05RglhX)T4viE&`=9tQHWX{W&^kVM`?Brbcb?hQIRGD`4^mFY?$4dXK38
zE-g9vGDX7&m-D5<GJxZ(ZOMIb&A=$Duy=J=WG^4#vLH`6fsn&;E=af)YiJV;o6u<y
z2=TtsHKB9MGBkJ+1bR&4Y<Uj8i3DkYeV|S?j9r4H8IT<H;qU<)R_vjmQi&A1F3VU6
zXE<EL{*|*|kNm*?nEaOYbrbM_4n{#*yjnJq#shttl220thu0@B(QuHD5$6BoC3Q=>
Y{@DUui?HekI^cKoYp>sN4uz)v6U~KEyZ`_I

literal 0
HcmV?d00001

diff --git a/static/nic/gke-ingress-controller-application.png b/static/nic/gke-ingress-controller-application.png
new file mode 100644
index 0000000000000000000000000000000000000000..0b2af0ec848686654b4a72c793f42b95bb6d958d
GIT binary patch
literal 150715
zcmb5W1z20#);8KwS_-tdv{0bM9SX%Ev{2mLp%e`eEVzUUQoMK}Nb%wxJah+_K=DG5
z;_mMM>fYx&XMg{F?!9N{c~;iST5I~8?-=79V<uExRqi1k72d5|w;n3Uzt+5U3m0_j
z7S^Zx_kcTE?>yh#x^?>vSXx?LL0bB$x~r2l*um=7E!G&w=N6?_b)wFe=Lw1>Ux`FN
zNk2(o7hu<alA}xfOx}S!fHO8vfPCm&o_?M=s(*g@7yb2}q4rnCsbsIzon2ii0)=fu
zPpE224rx36PhCByF0ddPY0o*ZziNAI^-WbbH6XY{%m&{-qF;Ugjha9SoTA8eT7sUF
zkot9G{%J>)D97>!4H+{en$4MsqqtHb?xuY5ah)>vEidM7Aa(^}gRlRhEmlR2n9fD;
z4rnD6|Fm+fDqewfmeiA4MndgU>dAn>s`Z_uVw#1OdocfMb<=*$NR4CjdsXUd-9Ns*
z!D4vSN$)-4V_hs5*CF`m_>BcVbC@$&R0i*35Z0b}4=-<oaK#7gTvYS*j=4!ySKK1a
zQ`OO$Na<g1NmfNm>_1ZZuiUBAO?KP}=*Khdns}mvwOxE`s}p&H#0tcDw;s0>pzGJ-
zBYTnYo@0mlOxnCLEpRdb=<+ZteFbY3m0Rq<_5EAex2bO31+H!b2k18SzprI)v);P%
z=Y6bOw?e?Tu>bXrDscY&`3xMt)BJV56B~RB2lzz-9A00s{^xC6(APWvbB*;0cy{ZR
zmb8KbaMrSLwX$-A+B&(3zo6UzZs0o08$fT}qG0-c+*Z(J+y(L<2W#uQ>8mJ<S~x+t
z%`KhYT5)?poPXzYOWaEoxP(}_nLqV{I5<K@y(H-Wd_xqt{(YN={^_5uxY<k4>#L|g
zm3DHqdMe1x%gsv<!h8Dkskp19wW#K6*?%Pmeo4^Vy16-v^6+?idUAX6b33`(@H`h0
z5#izG<Kg4u0^Z<)dONzAdvQ5J8UD)TfAV>41+{PmJG+6M9H0Kq*Zi%MyPE_({qKVQ
z{rRh&R$k!$l;jBgSF?Zy^89|n^PHQP=ihk)NyUHP6;%g&SveTI219^81Ihpiz7Q7w
z^ZozFlmC?Xx0L$-Ny*1ADERlJe|z+QC)I&kxk@`hfHK`ce;cpA%KiJpe<c*>`Q7xt
zb;V!({O4Vuqd|D$JpUdv5S~s*-3%~}Pr$F$w1G1)%YJ`uzXrZo|2hNLw`pE_?Giz5
z-FkUT;q@zRuiKkxIA6$QsDkl{h#0~?e0};9EB236a%g`tzeWGNIj9d8ib|D$ibBWu
zQ*oITiEh8bCVPdA{eEe^DAUJ2C4C}!;<m@nlYsPTRh`jkr;xSli=vydy@hB=Zr(@O
zPjB76|MC_V(Yss!&E@;tmtSQgsY2~b465?rWlJ@7qkL3$rqd1X)8!olk~a~%Y{WGD
z&;D7SOfpZo-|Y{Z?k<LqfD#fClBwcY)MQVqbD{_~-v3wC`d1TP3ef**R|?v6eYB@=
zBv5i}H(r`Xl_3bBLgh<!Y2y61jr=P&eNJpfXFM4#nDIPI#&Ky!#AALU5EsSe3%q~Q
zVYly-Nqxsp(;kn$FlY2T-zaM#0+CB4iT;=U{XY%UxbLN*h3N2G7kk*-)1w?I0$qOU
z*CQKY_0RJ8PQpZlmx*$L1m;c8PSrz+L0p5asGff~2aNAChNfqIQae~iOP|K$%k=#B
z^XJd@D8;`tKFvws(J%i#QmE5AQhv4#^z2~kAOEx>Qn>P`jMAsttgqHz{nu0YuPUUz
zi^dAt1&3za1pTuve3^;O=vQg5{Rt@c<v%SpJn3EZHd(1mR(^_reF~M}iV6FgNnO0l
zKUjf(R$u4KEmS_cpYzWb|19Oxw0HC3Y$Rl;d^c|8f7oR@sqcoSpZOKe<AkC={*zUC
z3wsFnsh{G?A7uXx!u)H-0|ltJ<H{duS6QpjgLL*5+Lr%eeV=3DQ*gdKC9^;={=;&y
zu<i7ZhCh(}R23xtXPEKs9mC5u7FFzjHY#5kaf$W{7zwGVAO5HH|NjvBeqHHnadF>M
zzd~eZhD69e8IqUX#LnPtyOEct+OBd@4}<?n+FRH}AQysvxa4zX-dtav-Oo_m_*_x*
zd%=at{X$<4_fa1^O_f3W4h;^_zcQ@rJK&`n<1b9IqreT;CRIkY=hg=Z4!DlqH=Vh#
zfu?|n`lHij^2F@_wz^**VcY#o^~4VwB!Y0#VA1*QzF(VZZZz_K2yZMeE_PURxNjeH
z3tRES_qy5TFG!xNw=<X4g=ei{X|6TW2-DWX$=V9?*P|-M^n=60H&<w7Kg;a4rM|%b
zukz#h-XnQbdDQ~=+Pemj!YZ&+X@uh&|9usT6+2sMU^>0b#by15%2kViZW+T~YYk^k
z;3YW5-Fy0(=e9z6qW7Fu2FSm!EtHf7PO2*Whug*&mzk<ggC934U(d{c)EIWQl=tf6
zz2!;!GJ!NP&(fg_?c~TJ)eFPNsv{*ZY)03Hoh^lBWG(X&lNX)>+q%|(2^H6V<&umV
zd-yIJW5;Qw@~<lMfE4~6>Z;eNPil`H91-O)<Gg=O*_ZB&ymlk32dml9DJ|FM94;pt
zqeV7R;`{PdGd>$k+&0Yrdo8_xOZ0iQU`L5GY*4!&B7Zt!FWIIhawq#K_S5pV`=>AQ
z@xq7<W!{saDkG%7>SL2Vu}!7`J){FoRYNd>^P|~vga<z@qGg7AQSv|obxRB%i-cR@
z(71i}UQV`23^Gxh3R$l%3%&IP_dPZii3E)^dY3i9L@K7qTA}3X@-D>qyixryN0tb*
z6cmeMQht*S#Yx#~xoUoW{8FL`*-)`SVnE69FC9W#04vGVryyCv*JBKA2&ozEyGv>O
zx#j`>|D~>I2Y-(}#5vz;<5^YU1;)A%?>3$7tG7QKm<O!~(x~g5LMM7E9$>Z8mn-9E
z^h@6OL8slvWr{~g50lJb&x=YM>|T_O$hi`O+}DQMA3WmyzP0|m^N9tm-|io=lUo-%
zEwg_6-7Jpq+8G~v=#)#R)zr1-?0AG&2iAQu`Ipa_nS2x#?Q8p~-1{7-b)hkqDWwK1
zc#;L83$QCp(_lcMN~jQ8`Nn=Q-pglhz1&gaAlQT!&~QHATj=F`UlVoi6S_@1K1R}x
z{!5&`!6iLik-VwbANRUC8s`~120!^<pr(I}8+iS_eXGbQcEj*E`ibv-KxYYm*QVOT
z9e0R+4yH-w>t;-_qQz!cdXr2JLT5<MzJN@Q;HF8*U!5QEv!r{y6)wu@1at}i1GLaG
z0^`VEREBI2x!9~ysj@~Z+GRw8&TS967^3SSW2e%D67en<O8#d2+mG;{s^7XT;pOl)
zd#H`>C8L+<Kya5%UAM6^A>YX)nYRMgH?OPqD-@*}-7t~9A-2>?YwXW^r6o+SlHLD=
zpYKET?{>l97@Ow*CBk2pVoL@5nm-=p>ULjhxQPdZRUyyq+^UU>As*SaExhM<wS)&`
z--&t^-3!vrC%|^4FYm+4F!evusTw!+6}gY+E9t(jErjf5hJWEfp3<`j=c=<(&S|l2
z${`?qa;NbnG>NaiiV}bR$;Q^4M$29*oMkYR$uv51E$BKzME#H*zI2W{`PCRlNo-j#
zZ72|FPz0kH9to=&bJ83ruIO<ME%Lp<fUUdgT1b+Z&{Mhg{==nUiCWg-hPZWwNZ4l7
z!|5#LjbihpQslm?2Ye%iB62-t`QZk$fK~A1mVd9KXX)6C<4(Uv<HGT5<}g~1!6xN-
zoDKYOKtl2{dOf+6OYen=Veu-0!PN9a4bDvR6Ew&rN!B{3fx_*cZ`I9<gR4_A%)@b`
zL5E>j!ULwFlg%Gz<&5%+J`k|ceCL#t+4Pd#7v`ez=Npqy?G>emX-$tgwWuG5HTs6N
z=vJm}2yBT`V<5KRvV<}FasHx_qJ*E8UTNDE=Kgwu6>k!gNntmbrron0>yfsJ<#Ea7
z6xkzt_z@M46Twv0dvKlImW&<9%4`OfEIN*Msx;gxp8s(dKcfC3GSs?XT<mQLG@M-d
zBx-^oEcjxP-RexQ&sWV)fZrx5netkweL60_RAXaEq@r<YY9@~lZMnBlXyG}fT5w^J
zCkjJm-66QBzf7O5uU{Hv6XO|G5hZj_2g5lkUs>2Bd*WOYlN<TxF7;_lk4NP3N3OyO
zj(V;urc)jVg!o-4ch-EKt#UBF7m*I0p?fi1HZ~1+k5+w4My~j1Z)L2=OhteppgUcZ
zGqYh(z;D?!aysi&ggDVGcD%u?EL~&fn%li^ymtINow{t9a_PlL^ZXJ|Uc>Bo0sk`G
zT9C@Rs3uVegMkVRJNf3>d{pLmkRivHP*8eMRJf}^oE<_y)6ivJU{qULVAg^Jk9><U
zfTA}~5|tsGL#wFAk<>zhTaz_VEyLRN-Z4{O$S?w8BxE|+Qf?|^Rb#v{>?3)7YQgX6
zxL(Vf<b#Y5HE`dW994lGPuMJ%we;+qA(ivy5{(?eiDs}f<?v*}zv&w9*`=Qz;w&!|
zaaiKundq(Nf9uN6>m%IZ^ow@1^tTFeGMdp4#fSwAT?ZmJcTGg#WehW_`aH;D)e@>>
ziRMypy{^g0^w+2(sO}j1g4`FefcIwuNm^*$4LLe~?<j-*hQdXsEr%OXgBHDJ(d4V0
z$!+2>wd3vYl70F{de`!2bPd(Uf7E1NDOdhTsse8$7&AxbxVGGg3^eU8?N}e?h*)oy
zK~w3pF=Op8Y1^vf{bOonk;d7)0sd(JQ+rK*@_tO#R*x)(xYn<}!`}$UY2thF^jFoU
z30u)iScOIrIeKhM_xY?r%LLB*Sx)xU)~;vA@MOPbeZKbt!B=2z|F@}wS6Pq7{y5Lz
zk<0>j9MnGA_!_yc@aFxMZ54nH$Fl(e2lL@P4Gg}WG@f5L%9@6hQ-udr2x-NCRy)nY
zl7-jrXC#KUcB#Jnx{6Jf3y8$EGj}GRh7y}_#S;4kD2|nm+sZkrR-x?GGRwt}G_)Ni
zDY+G4(3;xpX~7bIzc=0e<`F}TRH?_t9-4tzntS7TD_CR%YO>-%qx-y>P#+T-<0nQ1
zI#?rvb~I<V8W?mgblU&=Vz4~l8Ng>2l^Ub3)>JBHH(gDsO@8U!Gi%)ny(jB_Z+dK^
zIQi-M?p@U_p-J(ZGcqCXq0&g@jMkKMnFn{UG7p}8Y5pk-ZAMhz-m^%r);RwZa7geF
z615c!=4nJaa6?Wjsn}zu#)Ujwt6U|<mu?ALoz(Od9P@B@;Fk^is)E7C6K+S&?gpJJ
zeO&x2lIL;WW2Vr9Vp4j?ni7kg5b|ncn3q=eMh7O2?#jB~+c^Rrf9F@rIHDG-WRb9<
zEP#LXi7$p#PZz7Q_M)1frbLSY9&{03lA1_<Fhg3pK}+4dBYSc2D@bCFFH&jM>jIZ6
zRh|>cxmE}BbHBio0gK)<8K7Nlvq7R6YR!g?0}dNtd<(p5;!R^SD^dNgzPn9rW%t>e
z<%@!B?~*k8`#?e>HikaLkXpk_cpg1Ts6YMX-Us$ACRbsJTy!;tUP;99DxK`r6|jt!
z`Xhz3iWd}_Stffa5zl)u_N<{AO)%lDvQgoTa%IHc(xw3a^&bySVsfDL1>5rtV+$Li
zbNzH_7HS7fyHvITJL_Zp+qT*Up^XEG0dmDX4h@Sbw}I7qEe2>mG7_!Wn;*XI>Mytp
z2_9g8(YBJkFJ$-Ad_9++0TbOYx0`9IpKxs4qOZ_wa^{8vx(iM@OGCS!h13}gh#y3p
zoo{ISOrr%ceO&`F;Xy~PYyrD};J_mVC%X>UhCBOG5?c77fV>xy@I7`bYB-*>NAI-U
zr1#pHB;#|}eg9TPb?@)%zfcue|G~%xXPDLTGcEYsW!NO)6&d;2NP0Q497=hPS{(OT
zsno`KP{J_o32Twa<Pr1J>tEd1Jwlo5^Q6+z>E-u?6BuHilzV?HrV(2>nja22CpJBw
z-B~WQ3FtpfdyPDi8?dYCI=Nk9md4NHYuB_@EYcp&box|V7S?MY?O@%my#!N2C-G>4
z6ebLg;oWD))URz1ARmRAFT?9s&<fTao7(wE=lYJu301e~^cvX6pc>8B+7?^+CVkam
z!xjXC<C$yZ1;S&ssnB~q^=JVtJ3M!Sf0oE2VM#N-cR_!#l|$saG>@>3JEA0aCLbEB
z)RvQC!A)oMGkn54mx`@UBDG|Hc3->|(dsjIsl2d$2rpPbtaG9Xs_|$u31*TvqmvKN
zA9qxuD0(|-VECaFoYD+dR#v@vyKCcS0q)JuMztzb(?nHw-P+0ZzQCQ36EsL@zewkl
z*FvNSjp8h(BKWGXX3BLbMh@F)u`8zZ#HKfqO9jAv<r2fSsNEcL*1H+&J$B=&(Sp3@
zDC~o++SwExJ(E$u2tXH?OSMz_0!p%T+GIzH0LS&Muc83pXFuk*jz|XiH-M)bYA&<}
z#-ug@8t%o_#ffK3?U<31M0ShA#Y(-s2>@HE-kTMjQ+CmSHV?hII+24D+30s63oBd}
zI+6#o<>1|MEO0@{<d=tnKc8-S$#Ez@!W}PwzFrBdP3E_u5^1<OT_7B{4yWL96;<=|
zf4G8%+jK<HZ1mSoRN24*-CYEBw4R$a9%%JA<lX(%J8Mx%4^+axks-av6xWn5G}Pxf
zs|-qc%;)g+5y#cVdv@-9zIxS4;nwjRN}rv?E`NL(Xuv0?vrQvW5f6Y-R~f+fah7|U
zIIo4lh>5Mrok&{UrnPoC2WHhP%(sxxTCJ@+eeF0Uq|JxzW>1Jf-kJ&2%NsvFnNcT{
zWI#3+I>n79N+wGjwneNYhQG^l;d5mOY7d07y-44wN5bNk&_=q#WMLVojcR(9$gwq*
z59zHJQ7_DHK64YrJDYE#R+W*(rlsk^o>$*+5>xMBOoiJn%X#toGX-f@xpZG7TZ-M-
ze~WpffjD6<g8QmLlC?P@rgdsyd=lm`@0~rg(t~5?-OB7U1>=#{wTS?PhtxAOz1EzC
z^)!6*`qMg}4I1xWLU0uagP$g0jnIX|=P^^ix9bt!dBe$fhN8TIk?zf)b=vlk7}b!1
zAS&M$sIe0%EkTVr&Lxyw@AYWZtdO@F6G}niCcRp>Zwv)LBp3g%cUQp6m<pZ@Xm1+x
zhr_<jc1GFw*<2Hp9>7>?UtBmQn!FHknKXv}s%g#MFx^_yfT4Bl;D8uafl4{r2cgxD
z>}al#g$`Efa@ur7=h*wiT#)9YG3#iFWBo;cu?)f2*mGK=k~}}9{=;y*Usrf~xDtd!
z0@%@IX~&;xrg4#(kwu?jSb&!yen;kB1KQ&kM;qP|1M9lxfS6pad#a(!S&DT6c_I|%
zGn=WHHo9Gop^(kiwL$xrQf+6E24RX<W%sSnDRJi>#a8R7UN>tSxuM+bBp{R1pK7wG
zs2}kf7D$NhmT%nb-X7F&VpZ+Pcsb-PUIyM=$|5GVOb0X$(1P)=bG;4@{WaLO*v~2S
ziv?)k`tLS7*hr@()f<9N>dVpProxiLr+PvjeRU>Ejdx10YMXt!@2U2EslEz3MVv|E
z$b`$zj&q$8kf4q4$t8AwQX>&om}0~@wOsY#^EACdUTinA9{RKfKSZDIEl?8Ewnvwt
zs(f9duq8>-So<z<SyJDCE_bE*Eo9H+1QIZB!@2tWPo`~Bgq&!d*i&ZQhE>pj$+(s$
zd2<P6an{@!%TM>|QBHZm#?JCSwoO}T%K762I6p1xY%j(*Pz~eQSb}d*){tc4kz9W`
zq_lv3Jxn43*q$caYHz>(s8*S7^b`V&$|BOez~0ynCi;e56h0b|CU&wBkBD)R+Pd>!
zr#)w<jRUTZ!Ve?JLu$r)W*TS8oPK<L6&07!Z)3)!?{m4=IejhfOpzkB6&|oN(~N$P
zL;Hx^&{AAHkEi)CcETpZzb{S=w05jA*j`QR#8FZmTYtV@ga)d){OI&dp%pxwmuz2J
z-!TQd*b2|VBa##u9ff-sgqkL{z4Hzt7G6LOE+?yL68nyPz{cG%83g5zyi6YZ627Y7
z4)w>yr{g7?ew*Z25buazy!+<E!>#je&*453CuKgL$Di2*`WO&NfwjBR3$KpvuFz8_
zFu>XNKN9l5!P5#yqXj5AxgJD6+wp?!4V_JcJp1`4_Tf&jOvK*cGpWIMn)A(G=9nBE
z*@Nn4P}(qUQh*ckvA{5w7JDId>*Ft7!N8)CWfG{kW&4A5Hu|~X%_vf%*LFLn;df9h
zA>W2>_T6pU$|8Hl1`v1lEV$?1+_@kQ7)w2~K0TdS4rsl3ae{F(z4p_Pf14KlDt<wx
zjSLy7yz#Is!C|EV6=`=t7OUSJ-DJzd&4*Vu9G3cGPVnkru3~wRP;)N1MluYUXREO>
zNi;}8#C|lb!lU*nl{A0T+V?JvA?(I$RQA5;j4WPk0Z!Y>xTo964`-Sk4DU$Dtnd&z
z_SPN)^^vUvbyNdA{s~*t4$~;Ux9;&w_VFm`R!(C;gl<g+`A7Nc>OVw}jL9;iLzIPF
zqb}=t+u=htNRPF9;FZ^2#{SZZbU$yFRYNse{gN5qt5^l9+0|yrYpp{_cb0Twb`{2@
zg{YJ5hETqBvoIHR#d_t$wK|G@UkXalS|V%_&5#}Me{SNnl!X8fw)2_nBqPQ%jE1fI
z`KwkE!>#?#RQhQig@%lXRm72}w4=jIQBeBpMnqlN(W#)q2#brEEymNh{St$hP&uKY
z8^1FAqtqcl%c(r3YotnjfkZ>XhN1InV|F3Seu18Y6XZXze-iI7ZZqW5x)PJK)K}z#
zEj6h5@!rF}ZkCKqK}{OtMd}|HtDm1OHCxoq!hEZMrIWiQpC>qkcb9a1YC)_%Fb0kn
zd77iD<8#t)ZJ05}5%6*fc70}Z@I#ugeqtY&RZ44W<aXDED(aJ3nEKN2ar?$8xS3&P
zNTfH(1|UfOO@F@6mH9XNA-MjoIk}R9+Go$=5YG;+LUwvw%;YppBzcM{PtFFac2@Vd
zBra#lG)5Rk<8}d_!>@!$^22KhlYXi<*XLqKXsN8c1rG;X!OFo8i*njwBJPC;$?S_l
zmzU=RG0yXaHl1*cnTmT|oY{?;;INeEMx#15$As^lYhD{k-VSAiMy92rgx7Eddb;k~
ziWJ0##+dudy|zk_vEbo&VmDr$4i}or8x!k9Y_&Y^N;)&cOqBJBX26UdnTr=X$kA3}
z6&l?fgu`?DvppyJtz3+{@sO9bge}EHr7p9Hld%IDm?Sa?i^3`6puT3{h1SKDE$9kF
zUa=Y>K@GQnU}w|`=z~SZMP7hfL{(?)tL_?~TQ&&3QE*wUF(c)8XBRuXzF$8O^f34c
zb(Y*wg`1J+fnx}%D&47t<RHD=gt??o8S#2Qxo`d)ly|0&TUD56F%UKb?;cNknh8k`
zx2T`y@Rc<mr-XwRwU(JijVvMs`k(_6HjLjDD%BYo-Ve4CN<P8OjP2>I@ETSTO6Knu
zW&l^P<pD-^I%D2rK?nW$hD&9U*F5!$Bqu8??I9#$Y~n4cITOkkECeKR-bN%S77@1^
ze<$Qwo*ASgQ|fruwU;Y~LCBO>JP#nVzCr!WJg43F-hzh}nLcw_eMns(X;MiuOwVE}
zc^^dTN@V6fs<V7~Fra4G*JP*o72Q3XC*zBkO+)^HQExDAvj2#Q)9-uNAr=MFi|xZu
z^od8L=2#%ltFtC?Fg4Vmwx^vd$(>#3gdm9^GAlydB0KM!XE5jG%Ty&Y;ue_9g{}Wk
zt;R?wVX56t8y>8l?z$KBnLRQ=In#hVONS!B<>l#Ox%Rmkk|6T5Mq}c9!sBU@#dZ6q
z$Fg*nOt8=GT0TodvU!lMBV$6X-hz@$Pq$F|Msn9QcC2A;|6tjyJmr(bfPhOll-@S2
zp;rDigGPi<E}538m%-4LRT)P}av4Qls`ly{va@)j$eM<tQq8Ws@`M&wK4E*mcCEmo
z<b})llX^$P5vmfo%o3)`!{%Pc>Zk;U;*ae{UdBx9M&GL3GV__p6e@Z5HTCm}=Ct%%
z0H_h0_+<QX^NeV$K>qZw)SdgNj*ZDSu5~SG_Qs>}kkB{6smnD2DpDGBoqkmD0S?oB
z%377;37rLRBufY>s^RD)+m8x7xv1UVyJ8r0k;y9CP3<~v)ZMg~Ky*90Qu<C4l#iDP
zm*~vWN>V@6=)8f$MP&%uyqbToee?apC<*fUk*U}eKzVc91kX$`k=$K&_3s$(b@RY#
zSM|=15=^L2ug)RRZuU7c%n@<7jSYB}N5Gz+>KbO?IlVs{Y&@x-GZ@4l_ROzGjyIv2
zM)K+~u6`j(Y>FN?btHxb9)!wgh!RG*ZBL09xg`GGmG#x~e&BUeU0K;rF^$y**FCLM
z$ipl03C(FM-<1<cP^;8z0<^^Qyg3_Pg~*Oo)(9VAdv3<j7X8$Gh#22rZk@BF|J~k*
z#(vV4-Blb&)9*_x_o0aCXm+v&RY_d|G|>;iCu2wF;yM0J+EZ{&ixu^=^*oBUd@yT1
zuO9|a6JjNC44UPhx7zW7WYzB{?>TyK)AagXN!0;73bKT;r8toZH^VROR6Y6j4BcS}
zoMxwwf~U9IWtM!WYWB-H@`ZW9udX9x%78!jR1CmH(ZuOEsZc*x0kziY1QArj;M^6j
zp2go~cD$c4|60-Q93Y4J;0~3cnDbFRv*{z0c7s@QYI@i&28?}Kb05I0%y;l#h2v)|
zwrTHJ9UaD(g8^FEldX$!AD7{t!Xw6&yg*$Sd>KBZgbbx-^|vhqre7xEeD>ygh5iLw
zdvY!8>O7fLO?*&Iw)HJ;2IF$9w5CRiB?+U#Bg9?@H9SuRo-)@O(zq&5BIkW^(sBbK
zkT_JAeEcxOYaSPRI4IXh21zNX_8<|gfndh^lKDGvKa#btp3DY#x|69WX_Sk)uP^3}
z`U)z`u(DLrdvrIrt&!kPyeOfq1=OBA*|a5+Jq66ul`<zS^4du|4o~HTc~uDy$@5i)
z13-JqrK-7U^w_dPp3aB2v6|04PvAFxz$CA^$g($l9hy;RJKNNJbA2Hz@nIp)BGV^K
zk$L#6dMVK;#l&-Z^aXgRE%cnspf5bjjh1a_WX5-g#wl#gPX1S<Q(m%#qmslU`;*o~
zt)O3Ba)&v`;b(8MqK~+Ij-x@P9G!Kh-!1Er*!8H2fVox`X7ks@VemfpG)0BQVTYrN
zW<k}-nwX-D4V?MYhEZziwb~{tJcYC0^l~>oL&IuovDyIHpU|S9>-b2N&K1lCgJ>gQ
z2=`^5zJwtqp7u(w#dKqg{A840zkBGppHpi7fITE$QBk+cy>NzgJ%L^ec|H!wNmtIZ
zR~%1NmQWbUZiAQRek`S)W8TomX-yLH2pbCX=Q~t`{&H`f<_jv;E#s2$>}|)JV5u>h
z@Qu#0r}4L6_k7j7gKW-?8<e2$M!9*xF*C+Iraze3DQNYM4)@QdM;o_b99_S$Whjxl
z_{mW@`|HyjT24|}#zvdZ!xE^%Ma<zm+wCO6L7LJk`nfoIf42Fg%{hLf<l*hd5JqvG
zMY?Gr_og_`qy@vS9RpUxpwB?<VDBPlxRF)qsFzWS=@S%CpFVq&tsucZ+Jh}_#Vb|E
z5j&=;Z1Q=N3%|mH_PaQxkp3xq4adTOVE6d-rbH{TX!2xL%#N=c5?b$1Yf!sCz~I<^
zX%zU94KJgbln`|KX5_v6&M3*Hm-K1iZg&R$gTMKt6yYyd2k`y<{mrWB-^;W_t~6Jf
zSH~%D6n+~tz66v^O>)q~YjEPkUTmhL&>}UJyV`gJjJl<4u3TO6L)KH1Hw<~bWL#H~
z0ZbRPPCjRpa98f7?5P4Jf9Qb=+9b^*-+v`b3OwHp9T%DwD_LI-xmoo6@qDD#c0x%|
zu_e%^(gBsfuu~4>f(NTH69={tDdc@q|Jc#*8qO{5Ohc)|USRwT2(bChyRMJqO^>U`
z3<x38nxv&q$%gdB7Zg1`KQ@;IC0kJpqzoB7+$ma98p{7I{{`?%C=r=^g+JbpImKOG
zkpu`<J?4=ribCaAR`ON#<u+*T^fc}uF*KMsRZ%vo@dq+=c4NiKO7(f^VTwzMT)Boo
z6p0|?s`sz=I25?;rSX=OCT<#s7L2bx2fq4^5Qfb8-`bRlN)l&$F90e<5b!Iili8VK
zt^oajlfH>9aaUn&Dm~!ZyS9Fk;)rwFrITh@&`i8dTO-o4sJJrhv9R+SLnqx_o46m{
z;VEr%6`i#F^E8uy`M2CAVbKxcQpL3Hy$~scq93gLBDvqi;Apr2>Vs)Nebg;;n)Bmw
zJ%~N-rNUrxtk1S0Ykp;ex@B0CJ3z-b?(LdgekpBOFWmm3$Vr~!(^FU+{fHU4({!M!
z-xk?BQAQTRcSM#*#0^VVP3CLgEN>;S{{HTEsd2V!WR}PDgKHflti2bW5}uBhfb$9b
zN_?MO0?gFz$2-^x=_NgvqoXn_r~7qOVUk!x^qoBFisNvOdEA}-Zlb1nx6~^cR;sT2
zqzIqTYO$k6R=$B6IYEB8opM{J&p#by<Mt?V0@a996e9!sLyW1y{$f+o>S>|P@}45l
zmt@bj**L@}9W!@X#|2{%3>i?9w|AS#dQtbKgN*a3C&)||0+eLd3RwGUG_Oo9y?Qh<
z4`URUC@23IkLFdpVHPt_l3m_!)jAoxQ%XY{>d77^N`}balR8#7V)xy_4WOK7yE_WA
zmF~Q<YA{PB`TUK)mxwyZUVwVrfP!}1!r{@*K*-fvR9c()of2MF1?43Mo`Sv>0ti)Z
z2FLG(?nlBWVVkC0**Rb^i)%dfdY306HpkYunU-oJ(V7$#6jLx(F5!J|YI4Hmq#0*N
zydX&A&B0>%TK$u8zkq@GD9w4X47~mCTvT;rd4D*{W+&9^X3KtvX=n0dU#_8bD5Y-R
zEO1$NgwyJI97(2#bY}YS_81Bp&iGm14O19fCZm2f99)pZmR35nZp|mc)p;%2$px}3
zx+mjJ+g)9{4r<X3QnToc67Zby&KL9ZInnX)c6W|_<|lQ!sEU34H@zTU{QZv%%JXy7
zS;9oOG9>tb!%mV?GRP?#$Y6iL;my_345$T}ts#muE>V|65pmQ_nrHq}9Q-n}Hsl%6
zV>P{AUK+Jg*$kl)b?-^6W6|qn_WLt5AeN=0J}<sw+nuAw&^^eoUa(odUMf&6=r?yt
zfU$m<{pqR_u`$BG{*FR+OzO0{YtGPtpOJ6Gn@Q67xeATr(ex1hBY#Z&%m%QC&kzEf
z)uum#JBp-m40(t~j@@?Z3cV}G&#5AdMFDI(=#Ae6A8$_N0UV?3JasbtbGBGbTM~HF
z$&9aKA~w&&lOmV7;p>Z?9qd<O!SR;<=ZDXK^BYEtuh4+Vbuz4VOw)Zq)@?fxaC2dn
z&H75=crJu4PX@aI5RxW^&E*cy1J%M1Ia~XA@h|`^8Z(rs*$rdq?G$zyweafr2gLc=
z5B7U`<k+yu!AcsTy86#X8AREuonNEM0Th^0QE*sl*W7b$Cj%+ijuz^0@CU%w8A68I
zOuXiT_H<;2Mdkdc>d%ih;4utxRJr^QxWw~ZUBhSl#de-hgmxs*|2iC2^BhiYQw#&;
zLiLz$Ysa!G^}0PkRo@2IDj$~-VuZe!iuC7B${d*RS*AWK9cR#|^by!|I^~grHvrw*
z50~l`H2AV3s`u<&88rdEe_gj#T2;wsOA8Fc!g!E(ol~tyM?$nQMcBQ4Vo-r2tMTVY
zbLtnn0q3-lP@l~37U8FUB!fLh|5o;opJrH;j#z_gFM@DNAn_Z<iE7k)knSVnXgLk<
ziQ``r)$WBjYRK_|(&lABsnpuqbB8ygwfci<+<cd|<tpC3t@nk@V*EO$#<@x&G_ALM
zCQeE{V|-Nntg=Co=`S#>=rrZCrIw}&i>#k4C7EyNXZ`neIDB^|(A%B0lKpOI6Q5Pl
z<@jlehyEMmz%<7i-aK`hg4w70losH?ImJs|Uv}+%C4*Pm7yo?y_S+9smy+u;Ysz>%
zVU&vu9x<rI-nV4RsnzXbHYn%5#DRllI=9V3XYkcnp&3Tp6QG4h&pu9z0!AaMOS^OO
z>a&-uc{w?O5yHJur?0AcIAd)Z>w+g~A!T4Ed3#F?^Le%9COPb~&=fL&0bb_pW`~wA
z*VGCJssR+~0;bqv=4kW%wx?dRcuQ5xcQQwqr?1n7B)j`e$O(m+S<Et7d$&>Ei%OVx
zo;mlpO<qHv8uRC^EAe{S<9a3f(KN)%!Iai0b%3|C8+mnqjue%@X~U-Uci|oMm++pu
z?AcVx6Kp*rugM6{K-Fp#qVmgR`#<@)?I&G&ISEx6msqxh&gw~WjzoVwU;oLB3=3w^
zir*b}aAV4~R9Yum#k+fxe!b%)J8RNZ5O*SZVuo=TW0uH@F{7mefbGimDiLGM+h%)X
ziKZTNhwNA})F|a7lr3@i6+RfRbK2n8fa-*Ne;%imDxFbtd}mGzDOa_>M1E$5#Tt6U
zZn6H3^N%<}XQCF*WuLO%6%eJPQ|1v$uuu_aa$3k3?I-HsGg5G{9cPqsC1@lusSU`8
zupt_6Adn^d^M06U&V2<Jt;MIfU`xejW*1FnK!1;4@5>)lDrER0fu8^B%trByHNPZ~
zKQo9vIV@1Gu=Z%o2(AV?YZJ(Hx2Klk2;NmdQDqpaN~Q4LHLl~9gkd1HGH+RAay8vp
zox%zQ-o9R!&cas9{MwVWC!LEPcG=Hcqu??;?Y7ld29!9ccV=9h?s{_Leow)DzCpZ?
z#A$aX^AzGVo4c4kXi{eeb!v0^SLc;S(A@wrxF$Iql7IkzP&FU6MrVzwb#e+OPzjY7
zvDeq=<C~~oNw;6_Purm2AkSKVI|_eCHl%6pJ1qTnSip5>>(>U?wz&-9qik3*ge+Z$
zuHVXsDE3pY(P?JIA3eQR({fk8LL@*a_miKFD#N)lmBP?SfMPdkOppt>Kb{<KW~jk%
zeb%Lauus|2h>qu-x91oeQU_M|`dBGgusrL%vd6w-WFH8gD47Gu<`|)yH}M}hUf_}(
z&-%IR=@w+fa$e8>_yc5Y?Mtlv8egKRJ3dcs?YvwDw~emHKh&76-~a5i{LxlNw6|ad
zMnO<wUg<_Dt%{^n{yTkmZOm5F1WI<U{_ykuZueY$y22uh+#lqE=ox@ub=!!0WB${`
zB(?P=KWgJeQhdDR#DT7R(?eu)xW;0-vLGt29>XmEOeD)}eAV#C-DgIm=W?aDz)@56
zfsFM2;1pjj&4GJd@EnM%+jk&%<$+tL7RGI-fXgJhGH2`HU=mY~(V_@*jNeDk;<PR_
zl=+7?6w2{aK3C34R26)<h7qIz+nO)t2AtSIWK~jWWF~%V?!Kw?N@ueoA`mynkf_|+
zmNe_ACZ?myfb(?wiKOOx8rVe+D3;Iyzb`vC#;JIjTp=nf)Wj-Sj7MM33Y}PzK!Q_p
zks+M|YsTo6lg&3A@icD-_;+4^zN6AiQI*yUNcV+{thKlJ8Dah<owa9NzJ1Y#UVTiZ
zT0P1JKZiA>B<OT!#>ZVITr*i!4}xc>Yrdv`o~wF=1RS<TkMc-ab>`xZ=fgNkKl$Ch
zIqj5G?u??D?hit-xW{YQlqe$r|7?!C<6t9V=9!h^cxk_Wy}rKM4!o$$^xF7wSy{jQ
zL#mv>^F6B+-Nm==zhb}_Wyo_oq4c$kERG9R6+0m<Io8}j$+<vMK7m%h|B#Ni?`w--
zWzKRR-fqzLl=(SndLa;M2&fm|UIxefP<ytgv?>&;7jx4Y?j>pnh^qHaEQfcNHhKwW
z6XGsc_qKM2>qp`;jMpZwh5Ukx#@apn{DwW=^^F29n$u$@UeVo2Vr$e+z=Z)f)!?xp
zWcqr{3=w{n{#7+TdGlY~<C(Po<J@ntZ(hM*GU5Z46M<@l+5W>q<n9iKdEeB0^#Nmc
zOpckZR8(i>?HOJMd#k`UCbmUwHi#_7EKjwF&UADpwEjipt^!$NltPnds}gBeF@C*c
zyQuxh^OY@3+mlLnpEohPpnL@C!VZCGy)cfI6x5oQ+6dax$t9=`6JDvJ`NpuyGVaD(
zRQlzd)?hkNO_9*BRdg?@;FFs93zne7lffhusiqXE%w)0v2h#)jFubMS6%Id5iQEs3
zE9t(*q&QEU-+6D>ulPY7AB9;0@p=+RBU;OVt_^ixdZ8Uw_X8kv?1uAH7<FTBt*1i!
zarG*?>av&t7mB|lGD|0jID>*M)v5z<w?_`4yf<cBT0-+fhARO#RD=75HS$Vuw9zOl
z6X}0(K5Fx1U3}dl+q>Ii!iw@>8Sd2Ja>J8h!G2rk3qlnohPx|8dh^>~jQ+i2L1VE@
zVBDCW6D5qzN5Xpe>Y2sIaPX_scbQ3rHS6Op_Uu)Xs-$_B5ZOt>SfuBNp%K=*=yMg#
zH7RXgKiooF(%F{EX7G6RWzaKYPecQCX>FD_I=JYFqEw5}j=ETj`%B9HiZTBb9-DQ)
zYHo)y_{>mtFx>-FZY)fW<UAMTe^^%i;lqNb-4}#c{}kWwMNEc+>C$Y(&}<O%U>8!C
z)qUn#C5!S_i}>~Yuay<P*QfExnwN$LOi+K}lcj~$x7E~=%fN(KFL?I;ow9~EV?<0l
z#+jf0Qfub}&HyVVU&u-WHg*2QeZd*V4_{tvIVExT<EvB`pWL>GSDkS4P@3k~H#I$Y
z!r!}jSr%`rzop{km0irU@46}fYk^CFkv%iYM-g31nQB^2uA`Wj^ohrD)mHZ#d?IuX
z^Dtx%6m+n#(2hJQ_I!J@I&*03M18x!#QKj~gv<wC+*Zq4+F5a*XAh%`G(W5%{r(jj
z(q``Zk`*sr`NWCNTOsBgi7be#Kd1?n?WZw#2B6D3S;O~+r>+HE%3(hixu$4yh2WwV
zNDXa%1LircFEeUVb37Lw5vYg^r}kpPmYbrYfOL0Iy1m(t1;AwKxlUg*Ej{3>ZdA2f
zdtx@%<lMwJZuc{ajz=5V;Zo|}k_LMudWAZ0AF8g;D~h~kN<CLewB>HHCLe_)ftG0A
zbV$^h8~${gg~_z;PJGR(+*^qW>(Luu%H{MM5}V>_xtu4M27GNcg0p^5AzEOqiI)2A
zG}mfizj4ZZSD-!@=fp9rzBW}ATEWiX*Hf*EF4HSB%^F}f0-_lIwrS!GnB@MIN5au<
z-D<j^QjS9{?dm9JZ-6k==LU;!|Hck{au6HVF)eioMTsghZ|}JA59(Rv8f3dR@2xY9
z^eW<p1VIixj*)001W(0J@JWQAS%iFO8Omz^)sq&eG<1F2UWP`zb&0BFr9@#ln3DO+
z<0`FWFlq_@^9pqHy(asU@LZ)cW}p(L?cNuG>6FeBdlo1f+MxpDIWtR8$)dlljRc|}
zF#CH0w$uwquAN?rg%uEd-h*LtGkBK`W|?$Z-Ijhbd7w``T9y0(E45sSfiz6Cb$`xZ
z^#Iyj7JO1~jHEer4?e2Im0k+zC%bAXbo)Bmd^E{0E^uMO&q?y3u*!YbV$8kK2tbqH
zfgJ!r5aUahEEmR|tQpIeYY=<1I@l_{*GB3%2yg{9@lxE~fX3QAu@)pv4XKVfTQ4db
zO6iwl%nl=2lP_LS8O+f&1T#s30U*&->utGFEr>Jon!C%u0(lPkS#DmMv<mo*(RD5h
z5p}@8@azsA#u9-FY75M6fH2v`*E)utg1*;hE5CiPt6{58v@8pM?2F`)lm^k~{qYfp
zha`9HU_ep`aBe}!x)nN&B!W+-plU*rw9nY5C_0|0uYN?uGE;)ySQ^!uIyzR+%^ZCt
zHay+Wag*hO%&aSWRF#yGDa^Q<cna>lcj5qlGkr`r>85<%MQg}PrCvsu0b=J|=!~w)
z%HM789~f8HV5hy<)uYU{nMWmww;0=P+c;E*^S0|<w!dQEbs)|llS=%gmTtRj{(pnP
zwbgSZx5^0u6(vW3Cl;Tm@j=3%>7fWU%6Pr>2Py!sv$(u(1_hlS=oQpHd>Sf-qTJpU
zMK3Kek(Jq+D4MWTXfj{4ANOeba5~LSPfp<R+Fx|rexoIg#%yp^=Ttk+?JF<LfvniG
z&wzDbEwY4RUEGRWDRpYV(ArKoR2|%t$;^=+RPi#d1-FEGFK3jX8v$3Dgd^2jidIfT
z08L655v8nYth5XYv0-*PF?HywNTmL0SK*{&PdAkhvMfHl7IAyo3FFHZ@glcNIj!V}
zO!H(spT-&*^!PkqWVd0?@q!OGgS%$!{4k4KEB;$J0eiG5GtL-DFL#J~-E%QOcQ<cU
zEpy4o7<wjwk2zX!C1QPunS7{;WiB~O$N?=m7etw7qVmfll^5FU###|fZ#Lg%yRxl+
zk-`unvy}`N1%qTxVo01eCQwhBbi7}~>-6{YaRmFmsPY=y_%-njFzg||s1mbU&Bck1
zDyNH2Y<;3<aBAA?a1<v4jh32VWJ3Ghnrf$9m4-8=Lu_3DqZuH$6eq=OM@~`15PQTY
z^#s7W95z^Oxj)V&87L}Z{`Zh-R`S2Jjo<_5L{hn9-o81!KK^7Y5Qb;<>Kp5P9A%d!
zDd;Z+0|1G$tL_)tjJrw%rk$bed<mfgWf64GW)kz3Jbij(zk6rjjC>o;<jG$>BT+3z
zXu7`kIjc=S-4!~xT+uR)_cl|LK1)BR9iDnp0r7E5RX2`TIL$fVk7Gr(yq2Eq@L~}=
zlXDb7%B1k<9!d4eooXBWc1oUD6-{&b5_%wCLNIA8HM}?uGw(jB&Am4aTL|b&aoVl|
zjUolHv}2DdY2<wk2jjA$tSSNRf)8LZP#4DBvjmsttv)c*A@$jb;Mr047@0YtPr1|Y
z$7YS>RKGwP%=p^Q+T3@%)=-FkAyWVyuHSI+6K9~liLc|b?a4FyZj{val{Rj#Q*fY@
zeXN*66#!gN5YCZT<HI#>S{O!`-|Q22e~Xf83o%~_dGPox+1)N9t01+#W2TYVH$|1q
z8gZJ0>>uLWB<jCBL1lLJj<e~uvE<Tg`-nO1G@qpZ-nEj^C;Xt@M!<f|Z4kAXbCfvn
z91XCHe>xUe5Mgqsg<APh6Td@D0B&NF{=I<H%#_nT>HET1Vn4M#K{8R+j55y)@V=pN
zB1R#FqI5xjgt=z(R*<~%^D*hHe&G(o;QM=PUO7*n%eP49>-bfHr9+v?tjCP%`pJ{Z
zl8=Y7OqoG}#es$)9a0{Jk?Jo#vt1>b>2XWTRGe;JNTREb?=IiH$fu-A2F12Gn^R{e
zaTw%L;?(lanf<i*@JS8#9YuebWc)>JJt*~Jf6x5+Bzolw$BRRpk9m#g`!aNA)x@(Q
zyT;Kx!_}o*vPGjVF+cl%R#o^CMJEA)rpBhGFgR$yO}JV7LtNGstD!OT#c^k{b#1Ta
zpy{F1(?RLj@{Oc|064mz+JVePCC?X?KkhEi2?v|NV0CIr`!iKXcRxm&zO!84%S@-6
zDE1z>)^Otxu|+s0HOK{b>PQLa2F5Mqz{x+a(SDQHpPf8RCt*G7QhLi#@%goMl7vA2
z)RnB_8*Km<Fq_%?sm?3W%LzPMY*b8mn(IG!N#b`5j{AW~6-kE_b%R&{J5+FO7Ug5k
z5L1Cy`PXEM<g2YoEw);v9lpfDoi&v$Hil)W&RO%jpC~2wv_?L<R0$Tim1PS5aI&x}
z)tQwQ=FHm#yBKfGAr#A*=TekWl{m$#!qqI2=jhafUyp=1()m0uodV#I{aloiFpKP1
zE0UxjNJnR@&7B?RPf6yYl32MwFey%PICn!=A3Uic<4M5fUY`5LnB$5xU@tRsNcfcM
zKA6)2#bm`IiunHYPSSI^n`vJ3{e5%a%K{=mE660|P0i><2D<Yn5Mugrn*e)4OM6kv
z7ljncXxwcUf$y@JnR#UH^q5PuNY1Gv#X=tn)}-+cOypNk6DH}sFnug3g+L_0c7QEk
zsrT2j|6r3W>ghE*3OmYZ7jy5#P+1Q*Gz0quN~@}NK67SFs&onpg-om}&j2wLXZuvD
z*A}IuuL>AyP6+LgZEEX`iQNDfrjuwdIGY$~CCX#@aMP3V%!<dyA(b=&Ji{hfIhGp|
z@A-D5=?B4%*ie(?Dxr{48qLy8$3BbmVTt4yjwss{FEkt0<U>KM5&n#vEa=*l=AxfT
zkqh<ZFekJC{c`WaQAH2xA~g@%JiY|Y&}y7P`IJCzeH7RfNwDOYaB_&Abii>bQlzn!
zmbCmir+;xYv$SO#*o3|jVVw*bL}Ys*UZiULK|<@Ikx~4S`zW_M(DQZUk4h^ge(SzR
zwUlC8)p3Jn%y7v7WIf;sj0~;}p@aQ=;y$7gPR8^4lngIs<m;1+8oPv|#|Hp#API(m
z2n0%*%CK;E)DfF!W>2Te;71S;?=NJ8^*s0XVV=AJ8ZLAa7d6+gQA({s$w&V_#;1^g
z#xUJg7Ngq&^JkDNYm*}(3caB;^CK>K>w=#l8%?{_Pue0Slckx`62{rjN~^+|VUbb<
zOz@logU*e${EVn9?H~+$a9DqC^~cPw9GtCQM-1h&0<Gwk*6RolV?v_ypL(M}D8r|g
zcU!(k&eSQ-YY4*#26q+{!yRC!BxKj$c{F*=WfATyWYN}EM)|axj>g{{^r)H!ir**=
zvPj{}+&M#X25&J&DmDB6IBLzF>goJBq86se(0e@pd4vL$&&VF$A1)csV@U6>dYRc=
zc{FUKmeI5FWn)fnC3<r*drUwMLsU@dH|b3NAz-e)^m9engT<0Oe_C5x29EYJ!j>t*
zgJxAGY~zzUC;HpJ4pwTP8%;JHC2zV@QyBGQC7Y&%{FHy5ytzxgg}?uO1b-h01-Ifx
zG<V}w_?>i@Wmlf0^R7o~)~vPj$6Y;#A~gb8o#@P_XI8Bg0EZ(k$80k_Q=8s-1I8?E
zwP!WRIa`-QCML=4fg7i#`DC3`kQ#$Sp%~@u?yw`q$vE%#%c_E-b5G&>>Zp-dweBt-
z3`4USV`BmT`pl_yipVm8Zp!t_-r=sd%Y}bOll*DoB3X|I&ht&+{{jB`F972MAU@qz
znfQ(;q5yj-J_g!h#Jr;X8!<eDIsddLj+~98D{50e;jz$7&K~s8Yrvb2Uek*w#OT*g
z?9B?h!1EF&bqB}zl3&BFOX~A<+`Nem5gYtkMtuXSUjf$wfD$3~>xD&GX>oN5J4n7j
zwKN9qh<}GW0g+E%<AMERO+Usd`v<IUPz}jFA&_Ownc6tC+Fb9cxef)0tx|30PLIES
z*zU+TSlX)p)Q&W$wda)B)g(GAyLWt1Okp-)(#LurviA<3rM(=uRTX(5caRQ|&g&zg
zGnh@S1-uc+(o3qaw(S;kTjXWtemJuM2$kRCTGCZZ4m*e?+T5wfCjv3iRJRKc%tjMb
z&|Ld&!8t|azbPz>Er!4uT(oDCV9(Wzp27QOhy5Cn#Th&K{0|QRpCg3KPz|D8Lr^{E
zsbMAi^E&Gput!OI#m36)r|0mfiaQBNfsSFijgNRw;q6x%&#C9)o(EL3)^Lb%V47Dh
zP_diqlNL1Kg4j;ctUG1X(!`US^#IX79@ThJ$gI*6Foi?##8%W}a}{3XRwyQ8T?p7(
zj9+@<9k~t7?=nDF`UM&{E5k9|<R<ndHOjx^E1!itc}pean5yf0ez;~ms?$4MVrl4E
zK@S3Bs>@7w^S-@VzcP&R2i%6LT}!=eVR~Omxq)RGz1v-;w)RjG2rtb(xJ>h$Q6P;k
zh|m;8UhemTW4`;D1dm34e|!=d6+b$8kuE0Ws<>GwOOLrD`^8Y6j(v80xIdR4?<A9t
zj;g9e%vjD(93y&D&BH{UA;yZ==rb{=f({jou(8dweM$$2i=2qGRG&8!)3Vj-VFir7
z$HQ#PhrV)+G7yMUEFpx9%s_^Rpj3UAa8BzML$B>+rnr(uE$j6UQy}<gENSEUjrE9f
zRp-)@Ml=#xAwI8A3SorEWv=-A)O|J%X5HO;`=uQ1EKWApb@r6yHM3URQyGHTw0b=Y
z=pXNwz*l^u3Mpn?pn|j>z-I(oqJ&N#NH(hAX|*yzELh15EfSXcUUEF$$BN#q3qE<&
ztj@Mst*qh6h-hBj%a}T(VL|ZXI1YY~3<2K(lvDoz8%j!unv{^tTg@IRnG_#jrvSQN
z_moj=D)_cuv~aRdZ`u$~)$ZCiBN(rfKU@@1Ds}gUEKNO&J+!FFO04wkI=$Qbx98k{
zc==K;fRC^xNfDlF8d+xK66NzISU1^Tz@ammlHIRo#S>ko)ar1Fa^2hez4<JSn`_6C
z*ev}84dpe&h6Zb0hpn+vjvv~j!Vm98hzFD_2^1}P8ofG(>3-qr_3&@Ny6lC&1cIm!
zk;edO-FT(bX5D<p_x~+IApGJytl0)I-7`)$3pxGpB-bfFLaeUtlMt93p4Mr5IXAw_
z$FLqJ)5~RCeSdVY6Rm|6Z2`eqDgut$lACVNVh4;{(6<Ay-z=HC@!+V{xgg)-F}Eyn
zhgEW*n&c%PX6nX+y~l@!TH(_50zw}L@tAq~e<*wFxG2}PZCDW$K~M=15U_{=1tk?^
zzyPGBK}sZtmJ}FL0j0ZPknZjd5gEFM7+~n`ZoX?=dw+Yq`&sLGmjC!e*J9?ruQ>BK
zj*~;rB7=1Kq-1L}4iz4*Qx3`xtqMyyKTElgtC(GitB*-+zkKDz9Qakef{XFmHz6p-
z{6i|FAj{h;k5#GoOx(pi^*h^ZxXlF(PERRIGH0Bel(}Kg5JzgtwO#gxi5b@MzL<Lg
z#Y0-eWj1AKbzQPIbHn#cnb+i1X}}ek3%@)e=TFPu1^_=3#Cmtm$b1dHf4MFtNP+@h
z)T)t)=jK}0sCgq%J0NJ#a7Wr^@FmBgb%G@mxbM5Ez>-4~7LdYl*_RLB7MXXubDjbm
zOC-2zB8hmBJ!nWwwZvq+w7^MU7NA0ZHF*e|2<Co)-fX;@9(OW~Y9!`+@B!TrDb2ql
zFP~$xGOX7T^K`el|FnX&sOcemb7`Y-W2!mYVYR$@#C|DTc<z(L<dgQRr2s&xT#f(T
z8BQ)GyRhnI0`ArKlrP;~=$HCM?3E_U7->Bk#ch}C!pebNj6OFLJy^EB<tJF{53hTn
z?B<L}+sQk9Z2LnikGyMW)OAQO8las&cVR=cB;3=&qIHt4$q`NEWY9QIYY#ekEN#!#
zy1ie52JLld)7Sgb&2-3M@z73Rfg+_6C%aZ}zZr`*@^T&Lqua~(zMJ%$>Tap6Z8Ci+
zFUp^flCvb>A86bqD3_wMJ5vI6!2BFaA?JhLFe&d>F5NFiODp2I>e`~@W|3povf_nj
zvykhbqOTt*g}O@*_j#@ITR0i(3Q><~6r?{2<$c()TVoM%U@?8A^fhE7gsKxj0YM-d
zwr1J?=w6_|JqAJ(e~ZMcjdQ)ELm2i_7c^wk`M;LmUkrj+?e7udJrJu;m4{=YD4Hf|
zYdNSuPBX2juGoq`+YVBt$GdCMbb7A>Ki!w;sUB1nnlsdO>Lg=!6p3y??V-BOnk%{G
z^Yt@K(%Om__wL*Z^I8|3<W1%Yfn@7uGPI;WJd1eR85_-<`o%|cXN8Pru7+DS(Y8wG
zNZl{BiCU-A=<=!#IX`vTi{n;r7w7PfOxdsoaGo5)lF8YSLPeZLs0Y6&;4=21Vb7K$
zLdB^gOFqlnM*e(6_h+WHcpPX2{<@`H?m3xv1%%3C`$hNVuL!(I<+xbZ_u)O3+}8G7
zHHG)cU4qMLr%)gots!}kWrH#2+8U=^iWCvp??2v}2*JoU#GZ`?9JlLX>$6q*XH1LR
zM@l6;D^V#4`T8W#maD16s$++kkrqxB$L_S*w>5w&(l&tVq;ExCexNiV_qc3!5>4Rv
z#B_?{^cPA8J~eUjGZ)B`XmA(0;Jy)MK%gBJx5=DdZqFQ_aE#?3)>?I`W-SqfXr`jL
z;WR@UgQ*5a6YZNfU!L~RF(%_M8w?e&!ewoq!0wA_>?eVa;Qjl7K@#cpyjJt$KUfZJ
zC)_Cj>P~Kv$Jg`Qf<o!FiC#dC7?<@=KRtix*1I@|)u+C~Vg9d$LtoqpwD)6v|Hh!{
z8noqc=Ia*)s;1>lF+dJrf_allV9JN14M2HT7qRKgb?+qMFpqUuC;uKN77vWRmCRQK
zx-miApuQzUp{|pI?WW{99_{L_k8fVWZ*QB6xIwZ3G0}Fr{1qAUqe~<YN%oi}t-*ln
zPS;_QnQudaeI-zs5Wd6Y4YN1sZcO2El#nlqP|HrZbS0T(xV*D#{`}d(*4t<kz7P@K
zj5g07UZ_|Y9rN2%=o_<Pqc_`|r2bb(y)G6wzVpo$I5uaKsRztKu2GVnjn8iM`6L`F
ztZc*+yp1-@UQwi|Ow*|i&rPpgfqywlrS8WFPLmvO;@yn^`3}3}SchI=#VxjO!^#Bi
zg6!HZOMc_RfF-NhW%j~$_fMlGnc3|o)89NhjYCmeuh`xqMOX1Om$Hki4(fzOTEpyf
zGYApP6?<QrK9u^i=Q{E$B&OtB!=Kr$9!fo!)*E#8inki7ZH{yp6Wbx~t)9KGq}*MN
z1h*3G?9O{Rvy!e!nOLufaM?9Z_obbM=AzY)yp`*xl$xlucF`37QGJzxFqSBu(_&X@
z>BH1F<H%4}bkUC3?2PxYa1%4H63dap?&y4E2V@5Ct;kwemzskPb7(qu0w{hLk=DP4
z;3LRbYXH@$O+MP=P0CieL#o23Y9_k=o$iV4HJ{b11^N!9+^VJG{L*O@$*){BaP6>t
z(PU3f-_J74Y^x$e4jxxIFv(3`yG|-jIr7`a@!WaG_#sj2Aa8N9SX%~UN0Rj1{2x@a
zS%n?!){7y0kwB55W9@!C=bt4kGMKP1o4p-!hhRc=B_Ss-bG}UP^>k&Y&t0X(IV<~&
zXD+;go(yN7YK&g{+?SjF=*ajcmH8k)gjGB&<nfEGMs3+n8-`m$xtS^*!so+v!R^Z}
zZ3m?WUI8Ro;K`VrYSde(Pi3@`TAz`SgwphVl|egmtw4hS?3bunZkWK-y$+}My3Lpx
z7^UBD5H}vlz$FQ4%;U%fX{r>&@YAep#Eeq6Z6ez+0#hr82a$^h2L~f_a2g`QY$XC3
zgJS2+P%+$tBLoDIK5M6n0=8E=xsnCQh}1fr{GvnnMa#BAxYXu#wl8sl8gJwr!nsDZ
zsDpQ@EKLN+cX@fuvcQ7^QUPyA_@zov1T$Tr&+s51o+fa@RgLrAz2lP(#y|l(NL#V{
zla8oN#&N~*x;ur&qf4|O<D*9m5`EjS943nL5OXmi#^3;nE9^snfoS}FRFz>uDqnUK
z#t&3CVE1hd2lKvB^4k}wXt{5P+;MW?lwZSgmv~5GPL?#!*a7nAvNxH+{{4v|0Ck-i
zUh7Hrmbr>CMim<=ZGoO!`CTt=RHjm{ag&OoB>v|Njg<o0XJgd~>ch=v$oK&B+q5g`
z12vK{6?_9WmUeYd#+=fettUL~lXvaV1RU_ZVh||bbu=zszo(b7vo>PgKmSsnbxF#Q
zQB6N6>a8^`+_s>6Js+WFT^*4&C!Bbgo_6h<f#CH>;xYEhn<kFb)h`;(SC=sb1yiKY
z3(cL2<~0PlUKE#NjtRq18htK&qw>I5nHeWW(P>Wfq0eS~tA*VMbG$$7>(6Jj&P<(Z
z?8W#0b=4^ZX1zudw`AOYt~Ix_H#*0e^f|mv*~2XPYYe1G7(@=^w|<@yYqVbYmX6t8
zSL+m+rYHe@F%r(#@gXhu4W3pw7#?8&82jnukHEm2!qw3wYh_-rLK}XL_YKBduIf3C
z!7vP>SSF`r<o46UKut{r3Mh=PaMYnl?R}{U+bxphDQw?Qim4}ghCrCj6fyXwjAZ^}
zZ)--6n>%P)m92|P#Y*Xid5g<SzqotZtIECOTNx8F{Oi@Jxo^_ebFC}3l6HOU?UmDj
zJ)Q25HAA8AyHA$#R1SZg^!<WpqVV#U27S+`-2#<0pS;<V*eA;EJ0TC-q1?{)Aj9Qv
z-9}p^l2c)>eg5n;lCq1=w-lQv)t}DY+vnb2Sbw{-)iBXR2A#3bUK$dV&?VS|uA@2v
zNgs_+2+*G9ER@RB29A+&Ayf7Go?S+h!DJ^EXF}koTM(Ijt5K1ezP^+1s{6(PYg=E;
zK56l~f>>B~*s7YXb-P30!{n<iAi*|_i3#adZgtpQj@<RjEcmt#F@D(^B(atbrFQ_*
zaj@yo*=NE1St`A0iT)1|_RN?Z^-3QT@eyl4qD_lXF)g1-ka}(^+)xV;>!^=+l+h(7
zzTe*s8G|Y?H-MYQXxvfd|9_inqNG0u5K2BPEH<7~=Fu+#eUI1H)KIK%ZymaBZs=yZ
z!pB05h6E=ZiN%xk2$ys>17A@`G{4S2#^0=8w%mC%$JVvjB;<7S;Id+xYOhc6X=1a$
zA=l=;tTMRdp5)6Kag~wUL_d{Et4y;*j(+am6`t_UEaz3c=!1G&C%*S+t~TFhZd>ae
zHo!J&ohI$y94fgGAyLx@q>09R8rlmTr#+Ps>r>o|A^tUqCQi-5<ehz#oIvyBak=To
z4#CpVLki(xKfU3=GorKJpA<K3+(3<r<Sl%veB_9iQ{2&r?pUte|7q`y12g&!o0DUS
zo#SJ*<NO-qCjcFo4!UeL9($|inCnn?&W!c4o;nCk%<^|qX->enHY6DX0aP2LPJV7@
zK$E9(r9@SppB0{wcJin__LiGiIzzXF!MAnMgl_;3h{>w5*t}HwF^VsFi|=^7v2j)c
zv@%G}e%?9Q!=ztzHLKnUlOao!C;>t)kyyE;hl-yW*`j)`2$cst5-VA&If?@HuWsMw
zGl*<>!<lFLIj&Wj7OevSFm6e<>8+~X8$(xt40>X+=!1~p;r^8W=rf_Spe{&Jx?C!+
zXO8W6vE#7zawjaS2r!NYxbBE-2HbghD>JWsJwmZhL+Cn!)?xXv<#eD(#Vq}}+#zrB
zl{Oud;i3;Ps^a5r5jrj`N`#$U*NN-yZTcNzimQ^|he?29b}WCzTf{+@H!;_AF(f>X
zIsB5(b%8V8ZLPNrbVH+9?ygDLVf?Kc+~hF5Gdia$ow}o<+3rhi+mp$0m!kJ*$*PZ!
z8*BDQ@*XM3r(E(&vWCS$&#`#9OFaFaTX4r>&E7E~x?^`OWEACv%fw7^#uT^ER9{Nz
zbemx^IJIE@(dnBSgRk39H#~QdC}}f(M`owC-taK#Y@k*%+d-<DA|$sZZfVjOuC$o_
zc+c80c%oe6%0#fHNQ%}onv}cLvG$$w^FjjYaky7bvR><k=a8q)J;0lgD{=70oCPZG
zCs&OLoJ5tE`Xb|i+(qw^OR;0I!OdTG#=XHIDTa|weH5CJ8Q63OPEabE@Wy@9wCoXH
zBq|az*?W#!2o?^-WPTy7b94}&d!4kX$8e194^!HvSGn2E7LEx~bM9n6DVgVa#}@68
zcb3+77^)|Ez1)gOY4)w;pkyJZyR;~pv}0?){;C6QE#LUn($@*iM*d>X7=k4OweBdm
zl*4G|HeZ@m#28ukk_Uyelx56;t`n1fa?h>RYSD_khtJj=hm0H7?e43VFIGK3SE}4m
z^NL(#1q_yNsUrTg!m;_2HwX}utwAX}rcQukUm^6(1(I(3M0zcggr;RPJ#`ZcO~tA?
za8`U#0LqrHwJ&o>37l9BxIWOjUifGE#W%_L(@UK!KYp<J5jQ(k{wjbEc>uWugstv@
z<qv^~#djpA*6DjKB}9>7<h}m!Uziy&Cy58<>)R5UmRsZ|3$DEb9F=di<P6wUw0fUj
z_4}G2?b+I}A&Js#0r<&iPAysPiQq-zd^gfiN>$f2>C>bEw$VDyLYYi<6+k+F{{i5D
z3mj{&RWb@Nclvx@hxA^5unM=XP)e0R2z~29p;bThk&AG0sSZjIh30qBMH`8TWwQY*
z>71~_#IgZ{SjYF<(0v>=-)iX+;G+7K7!)xcG>P#}2ESs`dRvJtq3LC2mv|AsXT66l
zgxl?n+N#S4J+=o$u0+ER6TvrP06dzZ#qO}~!quCXt!CS!=N9QK+aAx>U!wCF-n{qi
zweVKSkRCM_Nkg@Bd___w<o;$PCoCvBJ1!Q`u{pF}F+XGikir#%+QZ$IOqs+Gdy5d8
zwXspjBj;hBWXG)|Hm!~?*Y5$G?|_=6<l7L&$Je~Og#B*80Nzu?W3$!jmd&8nCBO=5
z<W^F*R-kYcZ78^(`FcNz7Yp2ex>D4uX047(!a^@378Jh(z(HR>e-JyL_C?|Yp+5{X
z_CS^Y5h%#>$fZbp$dp+dI6Iyb5I&+Q#a07iEuCu0^p?&qw?59I#hskIzheFPyEK8E
z-Ry~W&+XZx&1B@n1>qEYO6EUUUx<{POYZ(B+ZDvD887!qk}Swo_P;$I0DY4y1Cc9D
zED{Gv6s7*Tu(i9NKGV%lnJ`LvvUxilsA8lzIvu&2uH52hS-}%t8mekX&c--WRc>q4
zRCyd!JxP1kz$lY87*>>ck2MBa;=ZB1+Pe7ZY?vEIc1zeg_KSI^uOdfOxK8BoYvxQl
z1<;0Fk$D2!`Th~5!B&$RJS)C#)fGn6_O+55NhKtvTOH~KS_e@JV^e!C8(|!CL-TKH
zqdYOuw~}Z2;6lCVdasAlB@HbS*Yg@2l!Mk6ysvY#L6wN)EOS!hJ_mn$NIVhT6JgD(
z?Q+m7%z+;A8l>fC;U^JenCLz5Kb^j5a8zPgT42{9e46odwHS7e&Cw!;CB@1Wqg<bx
z;4yO;9n`v}Qi8cLqk{oNm_Y5eH8a51Npj3tY)IvkGS&jcimuCU#V2e-+qu!jDiD}b
zg54q{z3(Hmtq`|`gu!z+eMP};fSR=Z=)&1+QbCAL^^5OkmS+sG1YS)ZIQRNi0TEyu
z8_#5H706zPE}W>Z8DJ%u7Q2%6@~EJku;p`i;a=yzN@D-iBKc3^ACDwa4muTdG#0SR
z<l00Q+%_*igvgih;v*Q)ujiU}@1-T~I+{td(-B3PUi68CrQpJnryWKHY{nE*%V&v#
z-Gv%|oawISJEgdCA0C>c56~hXdst=;B^M)mje(Sx3H9cIry`(e>w+={W@Hm_IcIAm
zKELp;Ku}ovy;$A=np(?50=|5u`*3CkfCOfVUKg!t&o*Yx#iXRxG~I*u1gcx4tbO7c
z{JHHF6z9L-WE0oU8gCZTl(!C5l5wcHmyDc|lb#9f7CgnsE(&I@gwfd@d3y+}2ymLI
zfVh&5Jg_>+UE1q=;+JOy0FxUblPIif#a;2@@);TZTw0=^h4}sH$VXakq^AbLpf$Qh
zt}9Y~C)D0_r0j#R8;g+WW=bDSOrYfSF#R=+Q;o;B*FQSVfclk@v`I%S-vAsSU}lrU
zH7u6)bZMQBKUjXhE`o*qJ^*#;N06%OT}=k9Zs^hSR7{!I+vIr#uP0paee=>P)6t6A
zZ=SU5o-{TQ(Yt44i<*#OIA2t*;~0FaU46I=5W~^QWZN^1-@YqinL$rleZ_Cy5S}Da
z3dOeN_-v?+^PbByQUGIVQa%$l>&;g4WfAt)x@jCp_}Mo1iTKHW+g(9dhB%4BHX5|w
zs!Rl<b^z%Yv<eILJ5fnk5ie4Im;gNhS1y!g&SjTMyx^;i(b~BeACP>6&O^u^c$T0&
zcG@2{m!_@Pb7xI82fvbzR@L40rjS3bA1tlU`-r<u!eKaROp&aU-EYViR9N}ZC?WYi
zj(AV^x1G6raIxXBMPBJZ3x?y<Qu2c~4&UWgM{R0e-Z)H6MS+Z0<p%ew(uCcGnL^VQ
zo$G4WGmTD4(l{hyeuW*;k(RU3H;BS*wU#m&zb2OsC`j%XZNJXb`!mQ?Fh1k@>&;8F
zRSFj@RXcAen8*#q(Z3dKh}BH(<XYlPTS~B;D_neP*_yQvE0IZBNHOY@^j;5<<`dPW
z?>f|SBUc<+ww26YWAkx}m5;N#_A}H4hb=95-U?0072UE1ck_+vGpc16@|vlBKzCja
zm`$LXnLN$gMKIr<d;C7f;dJhciS;!oOkW%n=v}*j<fX~|qCj={M$;_7+?r1v97jL3
zObJ|n{W3D)n8`8v0V_PHYZ0(Xct|em7BEOgMJQ?5(LdIWUi^HQGC3Oy(e$1U0d>Xv
zRS@aDjv;4L0;gzL!3y%V?!|Q_xMP&!B3E)=urgE2eOxq1PGh?uu=3e-+hve|t|+sd
zL@&D$vOWTVWihq?85+p?^!7|1%xo~pl;b1hZ9)B)71;~AMibG<C-P!YA)MfIkQQ(>
zK&XWJ#_1_Wev{y55GvbFOgydcQ?b!Nhy3S*{t%b%($wgYpBtW6`2`XBbe!9=Vcrm*
zWLh20E7<{Lwpxw=%7w%Yx<%t{=?rv|r7DX4kcm}rcaaS}BEB6un$oYR+Fq@#SVFV-
z@=uUH@Z&YtGJ$K|q;q&cPFMZ%{Lz%7;&I=Au!|VGuGa!gNIEm;4GZk?*6lY|IP^3d
zq7Bg}dl*0(<TUsCF8_tbZaQ!lklrj6_-t2~6S!b^L5=V8ZTA9!gXv)P@3AU{$b0Eo
z1xRLLSPP)Y=%ZBhV|}8pQ?xK;Ibd5`KqrJUnMY3dava%HQP|A=*%lp8)`ijVLP9zu
zyJN@>ex|PW7R-cejtRL2JxK?6yQt9aAO3V^eX4ud?z3!D`a0O>`2<yLp&&)2P*3mQ
zr9LB(NrvQoadsipVt1maw+$I9fKyJR171tMPd<O);;TuXT4PZC=M*zbO;e1NT}n4T
zj?i05eh?V`S$pi_RodkQ(SrqZCP2oQ&8S@HrD&(f3Lywrv-m3h^(IRD7S0{ldhW^I
zQ>Ck#ua1-0NdzG{A)5=#!y=cWHI-(!ww(;!r4U1XY#-`_kxUe8+5FKW)|^*A30mL1
zW^46e)lp=>sO)kt^jD!t9uEg7E`5;^J9;0HuzNV)(PZGy{pXPHoa>?_P~W<1pD{Lv
z;{as&lJI?wO#I60FG_v<AuJrUFqT$FczF8d`8!ckrlBv=;sD3A4hxp#{*cMa!eW`e
z6LKgC+YRx^(rfpU`>aFS0umTDJs|3$HxsJF4W!vQ#6SWeDHG^HOk;=@Y{JzX7P(xt
z`S|gzrxr=#W&?os1hfRvF;D2TUnXP$C8$ahl6%Fe_^MnX`z1jsQ|T)qE;(9_9w~NP
zv!)1^A!C^gARmP>MKDUm7;xs8^gd<0coWy+P5@*@oz*%R`FeZXP14L$mhUU^RtBM~
zZwF0;E$h;Yq1O@nJHD|5*;4#}SQ){VYZ1KG8RZAF(JVAOqOmp|&?Do-H0l2mr3V_b
z>kW*rq?_VJsjs=z6}+mu^yW=G-W442PcB8Y_=tjlP6jwq_Tf?j=niC&t6=3h;z@Af
zgDq;Ct9q)w4RSa5=*&uXfM%;gs0;0MXPMdddkO*3Z7X2ZSlLw-bn9*Yg@pAI6`W)g
znpMD6^PSTs;Z3(}0~BlDc?g|(2+#@s)21=szdb>kkV^1a=3n<M@73ipPFpTRtSURr
zgd8{T0|28D3v{{4cQDJ-OVW#>U+HDuF^t5@3Ik;7%LX}y^Y3Z@{E>h9bnK50dU5+M
z%hHfN{<lTWpgn&Vs{51yyl|b?b#R|IamVr|Q+W=hxu%?s&=LqP%#{OJ7@AQiLgsXo
zm^(SPLDm#-Qj&^U4iek{nP9VW34R+w0P#h7h#1n4YHX$aXOXx+sh<4xkFLog0CcA^
z2w=uIo<e^H5dNRT1(d~bZ#+;I{GMvOd>yKr*vS6xxBjnH`7;pVKb8(?I|H~bSeS20
ztaZRTb1@eH=0yasiVve$b*2;jq3i(1Z>fM~`n)YRRCvwN_j_{%iWvkmDh(a?hwOgq
zxk4Duf0j<R8yPhGtzVNj!of#m>`ds-{fS8Se=o!vd+Zv%y9Ny%`=IUpd%v1}IV3a`
zh`Xco&++|P81%0<`cMDrN<t5IjfCIanEQV@%>Q%SGC07}^dHO@uKm_IVUht$Beq?a
zKlEF_mX?EyL?W*=q%PWT51IYeW`sNf4@wVTAGG?dUz1nD?%`6Pe(mpVgxjw@H0(=z
zo>58i%*L4g_g3|xE8xz9h25PmocgU5V)}rSRKc=w;pgmsMG*h{)s3&XZZ3l`?x@7;
zH)$Ty{H-MtjOYB9!2iqdsXfn}jJbaAUAeF)=y1Jo>-S#tA&!{2Qlc=?U1%suOWWwT
zw&&dW<jQ-Kq;uzg>q&3Fkp-Ihp?wqYwSV*5zQzH?15q$h0Pi<fwg~@$a^ATKIT#Il
z$&LTyqW>|O|MN!v+rV6NrBXa8I!E?fs|rqunEScw2(g*h`LVzEn}SrpuO&~s!}-0(
zOk2cW>DSgu{Z~oQm;Pjt{=ttSr2n3N;P?6e_pkqc|NrB_%i{+u=E(bzp)db~FZ$Ce
zKf&3W>*V1AV`K`?(f-~FfwgrNjODeKXpiE$4h?One^32;=g5`J6&qy(6Hh5S`a$?l
zPxViJq!$7QNtA|_`!^5LI_{VK>0b)^|7>ahIGkc0V6;ilQ+Z>i-@9YuV8+Pi{hKfT
z$r1n07Slg}SMP>*5xn0mX6`=~ZT`uptYZ)0HK^UqKZ~{egI9I!xdU8g&r?NX$nU*k
zUckAA-!}!*_+UcFctCp`KiY?e4`nb2!hJw|X3@*)2CY>N`)vccQd4yfSWlAAjPn0I
zb>#m!^<+|iOdvtlt%35$qXBi>SUZq(v>hL8si#wM8AgE8ZS+{RLv$R!LlhW!lhUsN
zS~P9`0;dLxed*e>ZIQtxK9_&fwtWP~ls*ruAkm(l8fOT;B0P_i%Lw#jxUdsG(gEaB
zUJpiyz^0_9TZpr=6|6#~<XlH=qKP){Z&{gE65wO<6AxA^*P>!=hFjVdKBx9d@wG1(
zw6dmvjA#~=f_Oj$*%ye)MW{MWer2Tk>Ra{DWTF@3ucoVIQ^ciD|IOdPaC-dKwO3}q
z+VHy91E1C*Ph!Mi0~OXr;W<);bfCf1n<(NR|M@WpYB^TWr97kz66Ra<Zh)-nOAY1|
zczFHZl9I&=s;E#lq(14tDsbFoTzj%>y8DCL%ovL${dk>cG*z0;a!5D4e1mVTsyD_0
z2{C;ZypCOFz0K*C6d?SIt+R<4SpwwUERrSHY75MO;IjmMkd%jKi<xJIwsh+<@<w#c
z2p0l;0$CwQ!eE`-7XmLYyyx{^)$hy(tKHt$TRe2}HJTcBV9UL$NLEQ<JScb_5BK@`
zbT|ALv;1eDIND6PwMc`OO?Pdf2%XfJ$fsMe?Giy-%a+jM%GHWiY}J5}g0;w(XKb)k
zW+(-?&4neylQfw`xPyYUF4%(-ApG?<SEG6v^c1#R8_bXwtw9odbVU)=VM<I&hJFz9
zE$7XTG};4UpL|ub>i*8%)loD`S(^wkAr_e%qGAY6H&N!M*Et;g+b;j$55Z)DfDOnG
zM*w{ic7=j!V<p`zYYA@@HanMGQsA{+H3qXY5)iDc>*;`(vD+&xFcf8!0}~Ht-LY;o
zqjTI2#CXnP(S=yLa)Sb@*4ddFC=zkfAq>W<${m5+Hwy3x_<-)v3btC3>z9&SK1)>z
zu6Du!XmXFS0;sV8H0I4=E|5f{zqJNjK*<H-Cv{3#Hc|Cf2VaR!3yHwlh-K$Ne1^G$
z#&yAS=W(z7gFn(9oJZ`m_}Wp(qs|weJh?;%&#ML`hMLGm&#R@h{PrOkEi;t+WLJ56
z)*X=ReeusPH~?8$6L36g)U^~dz`Z$Gmc**bo~${aZ7q?#O5SB+>BZ8P!eR4JT~pca
zb$IhFOCQOINA+aii#~3=uRT6HT{~Nj|3tjmyTQGWw;JtM3P97wFFlEiu@x(|HkN<5
zE9Y=R@5aZc8un*UQX<}u5L_d;;2F{n18Nh#+3Gtwb{C<sAAV5UfR5DBC+6NDk9s+k
z6646L22r43hByPzvn<hI2B$;N@!5FU1ru%@S^;tqPUSV}8bB9&8Az<}x{8xBN^ufd
zrn1{@>eNbCLxziB+CcJWr*+Cznkr=tkU7_1P6Dl&*4#PjfBe*uB)8Wg47H;+=t!J6
zd7wPZhm{k4Z=}Sp66Y!nn%en9U=#tJ)z5%CHe+^kLPQZj6Z|2tADw1J-NK4sik5)7
z?07J{3M4TUNguBE9xE=4Ag+bH7CW!V%%R^=1jhQQJX;raRYq>Udj1bjg5d379IEl0
z_;?o|=?(8Zpm#V7&{vBTzLXq4hKr3TG^>#dn^)k6pe&v(mnsE)8B9EquPw3!4j`RJ
zPML%}Jsxyt4THHzd~3dQVmes51Xy#%m`>0xH9C~VqJ>)S((d==Y6?(u8U$!|^8BOo
zi9N#Xkods%47DGroi+PCKYY*XQ>5e+lLU;rxRjDi;6O2KI8Un)egf*lO}jwQxu{g3
z2|Q@eDHQ1RVUY!rlyQ@~z@-#J9S;W&<`8t6#^7186E(mbr0ma!P3_MB*%k{(V!s6S
zMXV=|?yXNXt;Ed$;~-d0Xt0a|CClb0vohD>AvniUSB;fx=FC{U?CPU~q2x=Pc-Wg3
zZ%8<OSeR+3Nz+06cQ@}g1#X7?crdRo=H@{T=qL)*pZ+k)m55*iXRigE29p{jfJ^D>
z$Jyy27pH#s7GilsxoAKLcQg;uL-MVQ9;sDWrTgA`+5>LTX{Uz63Rg5Jy4^Sec06?u
zl)<Sx!fx&t0XZe~`b4ASXrdo4a&aJ+&LsTVhaOQzm80F2%WyFdE!y+A7Q*ow)fFg{
zPF5AVa|$DcEc)><ChQ3oEWbRBEX*8{ilDjkx27?V3WvbH$I~bC)sIvP&sse?-^1^g
zMaJE2yhUgf_fT0VS6XeHK#Nr@=+8(lp|YcMYg$<=2f_P9SoDIaN=Pi4v(^+G@DvwF
z=p+uJWbi#9wSZHVLaxT>4K@v9to&kbt{HN%uiR2!z<Dt}b(nu|gfv^6>)RpKrs+h3
zyHi#J#_6aXSdQh)u#k;~NpH3iK%_phr`nX-%4EJ`UCMk1b<ahx1b_Y;w?l{85p44Q
z(Q<3<@*JdgKV_xog9u;RT+L8V+h?1QfkGCo)V5!qVA@BJ6<TR=G2G+s-@W~`yWln4
za=Lx8wI{3Af>)Qyv_081t3btjNSNA02l(-=qmLU+6q1dYrdBYQ(F7og{1)LrwGIV_
zyl5tu)um#gDPvAYCYp1A?2*r^Uh%3DdyJRCrP<xm8V@db#s#J_5%rhWU6S(!ao#0K
zcj{QD!vz_aKG5ivI8yqmpCv|{u?C=f>x~2H8esCk3b?CcgQ;UzuJUgO&^T^)1F172
z1s2O6jJ1z3z!A7!A@Dhz=5TNtWU0X$x_K-g*O_yL-O>Pi30*D7e(vfkJ&j|oeDSx&
zB7Owdf_Ey|1K<A8J^Y#QUXH`CM&(+?@FUQp_jZfLI@cw1Y3@q#fJVt`#ZnYbz(pb|
z9gOo?wSd&-8_Om<Xsq+;!7k$LxY;amS?a>YD|x_5MY_cw?yZ@LhdtO>YN%suXF9h4
zWS_TNfk%-QSdMf1268NIF!rJdj7HeE2BvNMsK<w$*F7=@xcEoTG4?x)pq0=r;VMZ`
zW)EV36C0{Ssg*a^`T&j*20Y46;{x`cV+TU@mIrUN$ZZgTvoAlsvIor@5b*&7!pVRO
zg?fXPULS2{=IIlLe#HZ#I75faVulQbe;*y_xC?gZ!z)%(?r@up!Bs~kq+67xQld>a
z&%dH_N+|0|mt#aUrGt1%27A0yBqHBOo0O=Kjgy&-Ghhe)909ifNy5kRUJyUeUx?v+
zrJ+1&UAzoJE>5CKim*=TQ5!%lc$%YXndcY5?1!CRKo9x^$rD`>Rp2DUfO7*wG9|wl
zmt&?6yW=9rdinDZ$6|k`QMkI5lOktzLY%tF2MbOdtSNd|j90KRR6NYsMEv&=LE3HC
znD%`#y*7iPgveOOVXtqK$lljO5h0@s?L3(6p`fBQ;Ad69U3Lsh0a?J&!Tw`!Lbz-!
z2;DoSco*(RKlzY=dG%bFDgo?%P9ZUk;+0N{t8m%mgRQw}oN!KwvA%S<6Pv@7+swLN
zyg&vgL3iRi5zol@g@n`7BeU9h(2dIj_;7kP6D)7->Y_cE8fOgT=A7(6x(u(A2N>8a
zhrLx9bsWT90)}gXw>|Mz%jTSp?2v3>L@Eg8!=cc|@UJQNu-EoGZo$G3xzUZ_|78P1
zT}Y^AjK_QLNkg?UJ|{UNh5YoIcXYL*p4k;>X4R#Dl;^$@r2ja#_S6s@vCVpMz}J>=
zP$h!#I38LFaE=1sp)_d&B2`XZpA66-#<H{t2nb|RN~$0k(#8UAA=kX!z~jgZxjwS|
zfifvA8WW+3>z2#P(pM6e4*K-#S+hz6x%n#<k8}pl|9u2OetX=r+;Zd5Q|f&(V)DMV
z<HBs2#*5^F-&ub}dKqqYSr~ov_#Ini?kl#<g_+D%iBB$J-O?l;SP6v<{nqP$zxPa)
zf*lv3>d(e8DIp4<a>^5a23YFOy%Yas8!{N;_1)trsdD5yeI#zgsYmwB4PxEID!xu{
zA&YIF0p#zVTCnEw1I?Oewj9u%>SIIaYSXG+B)rlzhV7S|f#4O)L<T-wVWOw&|Md>+
zx9d3WU6{W`^0)4D4%dQvij?O3(>;yEdh9d&!2RPheh#{i*ZtaR7~y)`>u4{pzuk8`
z=4-g;DG{67!<NI?kI=ZRBR=<`r08BQE0ob2?A3JIxlW&3)#jYkfA<{mJ-7sfgqPtN
zoF>GdvB^WgV^`yaXB}ZSI?FH2-~C#(BD{}!Ns>ZB*uVVM=eRz*@h+|MS<QY7FZKi2
zaE5y9Vjiyi3}5Q7!#bYw2VgP6b7@UP{_@wsM}oi|2f-{JHTBDF=}6pG<@GO2rlG97
zcIzhg8*iJOkE4Xi$z1=dumANw_~YTjkyGBC>DXg<a5vy#Z1Yf$AG~}uh7tQrtvJs(
zEDjdCZT|Khkk|0t>hOUk9n8=5*E-1jdmXmlo16c!4!B?)nqJZW?Pol@!Svw4{dI_c
zu0X0EcKLk;ORQ-1K`J!cV3~m3A!4wlKPS9JdjB@3VU`3TYp8I$>#xOT2Qu!z-b6zE
zk{@<QZwJ(XE#1ye`-=U`UwQR_S{z*H%v$kW8~6^_s_Q?)I;M<aB4cVFrO3ci{nT=W
z+v|a58pagl(;-Tkz;U4xgb2|9FmDXNZv`McPR+6ffa1X_yDixq@#1xmQ{)5XD2A*<
zP*qp~TG7QoX%+=sI3rf!-WcFm@`!18l|eve0z9TvT5cq8SVJ|SwsE)BTh+Yo{G~x|
zw6Qi124473qpGaTu!+^IKO>X|0Oy)=ItR$<d{o~dq?C1n^-pyPDJb5eZxkC>`WmTL
zDi&v-@){+zTbzA~EP1zKp?Oxu>YFuDAyj(eSkLaTJ*v_T-NR_{8;us}aUu-gZ(k)`
znOZwr&&(i?*cmc&R4uf3<zGihM4!!hO(hSr+6}d+Q===2GZ@+QK-l;{kF#sl4Uo;`
zvI#KyW4F)q-`h8pVHt+qK2yT!UJh+!2m~a!tqK}>ASzJC)Hq5$7jJp~n%b-?Uowgl
z7J7uwl9uC^-muvxC#`aJdSU{q5fcfY2LSE^i0d>OgSC}Vb^<Z%(5I`=h`g*M%6@*}
zLnP+d^*dsMGE&q^fgeJH;7B&7wb@-$`m~qT*%$~=YiS{SmCU>2r&Nc#D|sZ!p*7|W
z+qK36rx;;xR)MO>*imgT@E}H6<L02voU;kX+}R36EGqk}x~0{Yxixa2@zUA5HGlQ-
zft4Z^8i$2~hsWD~6pq?*dJjd*B{SR+V^zgmX3F>anSm4ji_;Ylj^pm`E<7%$p<ypY
zg*{4a|GFa61O0Qx*wZ#b_A^yqxWZL>B6Jx9%GF@Hm*Sgo*|}pmMaK07kdPK)wN2e_
z<J;<6FZShwfM=)()|-Hx)?Oe&Yxf-}o_D3ux=LRcN|u(0*$4;ZeOqqlZlsT>QJG+B
z%2Kv&ZM(XmGn=Lzf2YNHiEuhpTeZHI*({gz*?ZgSLsj|bDlyPoWeT7aadZ7Us89G(
zI(2&xp$a<9h8Sviwd_|LbW3*1HHQkEhdK5?hoKz&g=>gir7z3>5itMvg?hsP>=N?(
z58+=|t^EGKE~8q7O%XYE0hF+J>Ha0C<H1ZgDy`eAE+APvd>G8gT>*)3AtM6LZqGLY
z1QKlO@hDzxZPcX#k((%w5SDbNPjWkp{U)m;<)|zb4s877XpP4e3n-o?p#FizmRoAi
zPAhko2H22`NfT=f5)s#Qy}d3$0f^@VxA}No5b@Hd^pNaDK=<>-$!H(~vh9Ru=d+WO
z<+n!Jq3oYRJx=9Hn7mZ{jcN)zo!?GFhD(&ur`B)emPYi{1;|D)tvC+rE0H!ka<vic
zoarMU>{<A%=K5?hdQaVQO@367tHc~%Tt%~7C@EUuf$&x(uuHC3&XnavRe$IYE6Ju-
zWK*zP{DfIKK4LghFv^kk6odX-3qa-_W(?J_h|+khrVjG<$n=Wh+;BsR?gC-c`RYX~
z7JqCM@!u;A4qV_l?8Z-i2hvk3pcat_Y8GR;PfquzRsvoUi)MYlh5ao-Dg1x=I7U_~
z-&eq)Y^vQx#8I}mN&|Bi4S579zvZx;zY7rZM@?8tyW{?Zr%dR_@nDZ^zR55560GSZ
ztAJ%fC5l|t6l#tE8RylHUO>FKg=%sYY{Q;6Tjer)B{;YzR?pTKd^kED;i-of`_S?a
zW7+dON-n*c&L;{eb%leK8>hu1+<e+TC#1bPYia|i5@W^8pLUuH>>Q&f(t0U0JlWcf
zteTI%t64Oa)<l^#kFnRYnZ9*?cx2rnE8wUWE^IUP^<i-4(LqNz+(_WGVv;HrU6`(J
zKj;Bjg4GV!B5TkCg_k-_X!^Y`K}SdRwfW3b54(9mxcFCoG+yVt?#95+bGXoCb9+$Z
zTn>?w%BL3(du4>xZlr$nPLMNKdXrVP<Uy1)*Ei=MYXCr%u9$zt)rSxa0KUX+I`V|?
zWV@GR>;{#Kpb+67tDKlnJtTl#_qs)_>AN>tmkP{yFK1gU5(LIZTeI!n9+fOc<Gmn;
zU*LEKLlBtCuFGU>g8CU6TV<}z(C>`1!PYZjI0#vo!g0Yy?+x^7xSuaE=fc>oqEWVC
zH~h&)eHot3Y}Z$(5{(ruFPe(g5VUi_1fqRshn6?DIM#9RzMOeKZ*c~ir_{uVOK#cW
zXP&0X_*U;RcXXN722||vgE2bqaMkF-T29?~+48j*$t-=(o#UdK>-%IfkAAuH|2AlX
z>3G}U6u>j(wMRT|#7fj*v6XZ+f@eR+z{sfMZ6K{MTdG`S5ZDj0pC;5-Z)|FZCD%?i
zFmt9(+~(Z=?BSB8&S(Ah4EbynkMKss*dQ=t?2a#ZHNA3NbKITcL4Kh+2|EKdrd=>(
zco3LAW9;+|Fc`vg7r=Ky%ZOO6rxE-sT1q1r2(iR&Y(|A3l%J!A2!04M=wpmt#V%Ef
z6lEaic8r+H1qAS_EJi?!5##9*PR(T)Vp2M4;{=U01G}Cme`+1FklwDMIb0>g0`=j{
zvnAxy%Kf3s+co0eY8<^)vso`nH2TIu^F&`2g#3kc?Yl>nTRw`YOu6nmn<;H?CohCI
ze5$c^R7JxZzh}vHo|%=z?qEb~#72wNul2927(e70QCG%?6VQJY`pYA@jH3e=D{uhA
zDza_Y#+=em^J@Sb{eJ(WXn?YHfBpu<54C5h4uN8(&q2joqVchO|6NAA6;M@6xpS9Y
z{cVxKglEc4P*KAgzTWoqqA8=-KLA>9=n@=qj=B7SM%5rz7T;n1o2N0DQ<!39rgdi>
z5;9(#@$0+_6-|N2<1v4({5HoZ@U$dssk|S__samMP<bFnT|BE*>{lSyc3J*A$307Z
zxy`^{B6tN*{9S1vWZUMGiw};|*Mb<02RregN`e`scPnKX(m?}hkkeTG<S>)g#-}cI
zok0F{seDhWKp(1hJx0F0iG-$H^(9}bh@4S>k`<j>x$}34%H@2>DX!FTWxl$z8X@&T
zJDl$@h5RK3aPie0b|=Z{+{B=*7jjO<ppki9Y^%0EJ!~diB}p@4tkBZCi*qdOqBKh$
z?UfMN;4>TqNm;~SmObP9aG*=UM<Q!TrZ2K<cP**q<wfeqmDIEV$0!?{zinULmlvY6
z0CPYl3vWGCE1N{bq%SJ$=;A_ko5?j4#(P0!-vqebB(p4bEtr8HFl_x;=^l3Q-|3Uc
zLvO#4>GbL0uD(0G0T@C<SbB4G0az@wZn(PQ`$95YFzYi{71W3%X?~LZTG(Z>v@iO?
zHgV|(wUuv6j48R+KzpGO#67RJq5vqB2RksJ5DbTGWUB>IF4zKr&*JwB2<{=B;P;=x
z$OgATaX<(SdqHPB1Q=|`o=gqoNJDhBgDv0TeBz4B1>!tVk>OJdU8lMV2T+v2PO_Lc
zceu9zV@nxaHf?bdMy@suAa#54;$$qxM=@j)?*`k$qOsCb1F8;IjS_TO2~AIW4NaMx
zqmi0z`+i19ulgmQLNh0gjq^d_Y?ua{!6Lths<itL-dLV0&$2H?IokJfqp~L63Y9p2
zoPJQbKY=*e%zm3?Vs=s~DL>aq@9q>)S*ymUpiyOIxm0$*+ifq2eIG-$M$TKB83}jx
zya;Q=6cD<9<?ryPKe@QYWhi9oflE^{49aJ5*t+Q{UB}rG<}3)66VWe_<^Oc{rojC%
zKrurUNI|j51z*l)1`Z<5ZkCdoUFS=ujtzjF4}$bvA837NU^QT|+xu(#u+a*6w;%9*
zOh7Ec3a#zW@1;Nw=)F{mSof<!|K@t9PZn>zvUU&$bfvHpnxZu)&zV)o&ev4P2X@<O
z7X+{e%kC4VlOUoikk18!)Bu!NND(sCi<OzAbK2Jmv_=Mf1X{I+Sp@_!Ug00d<=}Q1
zFkST#U_WKEH(T-H%wZ{m<l?8SR<0s)YO|>rY$;LPI{f0|ZHnW*y#OMK=R)bovUG2g
z&erBb1)ve0Cv7@Be2EuUPtO{^aED?rsb_DTXj$`;$$07%hO=)BHCLv!sTLoCG$?g!
z6=w0{I_@pELDH}k1VIeM>g5O${`DA}R-?oHCdcXvSL-9H__zLY3*>b{fOlG60jT)J
zkF|dcf<EK8z(S_8foJ2$O4*d34VY9bvi2$3w4y~`6G0$#T4XMt9zqJRtA#VI;b>4z
zGCs6gt8=}uf^9PsX%(I9qS2r!yXvXd#pu5S(bwJU5}4WP+yJ5Ofpfg3<4(WOY2Yc?
zrlF^EF;kw;9YEyxE2V0tb!b~tmF#=Eh}c2mgh<Jx+_uI~!#2jZVawP&0}SUmW-qP;
zbwDTH;}j_`kZyEi>#os{wLMJon{JeV!!rb0X{#JY?mLsY*v<*HX<7Z4<DNRUoYkML
zI>0?@CC4`tA_w11aC1J@&dQ>%pk>}vF3|aUMrOVLbpsfVb{$1Enbc;ikdV^ZoWNN=
zz~3^+$6|eB!5bMjFn0cZptSuGf8w6o@D?zd_pNH??U`S%0;L4(xYmO!TG(ljG$5iF
zdp04MPpO{Dw_4UnCeLHLswS{4oGKLyzY(t29wo%JvtapD5&<2xitYdLXmA41F*X}9
z=@vI<Zko(9;KRL)9>wOktUgBOyrHFkD*n=LxiHBQ8<YqY-Fvz&N(tG1Ak%D`fh`)6
zV~d6g<l{r3)Joh>*VD@sm-f`v<#c(joYCSh{kVX@Ho5>MhFFQdiunr+<Y1RuCpoC7
z4gqUxyY`4tf3F|&?C?n1`Rp@2?S4`HMe0{C6Firua>1>uJsXAAJb+4$%c&(=^$MIE
zhVvh;K5+QZck9Sx40D;9#b7?NCVHqO+mP|WK${C=$}qoK+j?u~LV1n4%^<S2RQN2f
zi@3_P=~66N8|UJW(C0E6G&BO!A`aSZ&uR_o0^74XYnF}{I6S1bSGwEE`J;!EJx%7r
zn`@hZ9YN=Xaj7v{|48L!o$9?eSL$bm<owIn*^Vv#{Oa+U7gwJ;YnV4{C3BaO9XZAK
zB!7dH<6&SENQo^$3bJqCOy>+Q8o?WR)vFts26`r#xvz|IH~Vtb`E>cz!qV&T%5hl@
zm}U;SP|Ekr&(fryRJFb(?_cRnmFA=oP}&p5A6a+0j3(!qa*L2%y*Gj&d?hxx4cb&h
zYF)BLzQZ?B*_yRZ<2b=2i$=4+pb)BgzLIAvx?H*hstW61IgeJ<=AO&5snI!GH@+kr
za^7?US7>BSdwsmVB@>6DjBEvi2PIcw<Duzvw5a@90et_{Va2)Ib9pA7wDtyh2HgpF
z(eqTE*4tD9djPj_@q;GME$tVh`!)b0FB<6BOi^}@y><l<8gFQ}apGi>nV%PLs#%*{
zs}D*k_D8bLoU}0+9kC?Pu+DRs4~-m$6MoswO<&d5idNUp$+ZNG9#8LIu}wzNxz3#B
z+A8b>)P^+*)<FStI-PY*Ru{<IIk)J9+6zIQz;Y|f@P`vI+gYd2?NnBr-sr;6ZeWZ?
z@(Ns!%wH7=oSfXq!3u*U%;-km<T8{mV%yV-C|JI`R;r?L6PM0M{aTE}T2lPbR|KA<
zz4Kx%H~)$Ecr=3a?DTC#)*}N;R76@wS-LaBK6!<siS4OU_o08SYCs+|hLYP}N<Ouj
z3v<xKN~)080@Hle+I$vNwq}l|Io+|ApKFpSY;3Cf>!y!j6b|bhNx>hCdzyx!Aa32)
zBHLcj(w&zHqt_*s?S4eKafiqcOk#F8TuA-pavzqC^yst8&LTji=s-dk%S#N*5^)lt
zhg+V14xI|lFnGeQJKfFbwewZmk$oQ^9oAI`(&d`<ce~#R1GAO|xe!p`XrM6^F(NRz
z0ssJhe$%IRrpOy)Va`Bd0ovFNe1#su`Lw*;&&;x3)M*EViDm#iVWiA8lUZ=d{pHIT
zYm`cgR$s`0*h|SYCJwm>Ezy;Q!TiJp(h;Pf6(C_?yH(SLhOo3R*!0Btt$k0Ds7y){
z=wn4L6|G0+3<H2QYu-=&N-EHo>x@f!z_5C<QYdr+9PKV;T*!HGAq^166at3E{sX1A
zs64Hg)gj6{AagH`C@^&&cs3$9@M12_qTw>*zO=LF()J?ni{sRqqrEjm0J#KZ!?s3`
z!~6NJZ?kT5$2*R|9UecTJlrl@G^orQ0fTjCdBu;jI*zcx51^7`obRfuWOH(Q5Z>5|
zj4#sE{X|eG2KypRadW0H6m|)@pO8CAK#A}Q*0STp$qeRiw1%QXl{6wdw2;M8LOO4m
z#V>#Zyx}A5dCTHUCs3kafL4N{0R?O}gB`j6%{9J(yr1ghm@_p1ic#-XO^QQlK90LW
z9n?3atOa^)koal(b>eK*Iu)gz0D7fg(p4ynu6QS<TJ<sCIR%nAif!VoDdbq9F<T%Y
z53E`;&{)BOr{FgPi5!wDkhjww*iTq8W*m2ZjuSwlQYXCoZj8QE?@Dua0(dP>BR6)U
z#hQ#|H&%0$$5p!3&X+@H+s3jbFGf3q3w=H}_gAY&UYtqUQsN(Nwgsy5XuwxLIq<Ze
z%C*mdw0g4NWA07#%g(xE(R)ztGXHVM;1H;GY===r*@9BZ>9J1wodlhi&(FDr;ykNV
ze5*4hZ}EdsH?+S{gucy%*KEwohxZJ?H%>6nmbvSl`$@Hu+YWF$a(?G+pZ+ZoAr-69
zOO(e}&!&Q%!Uxt)bsy@$nKRWER~Xur-+L0#n$;fHOjg8}*=ko#l!ewBRqY-;<J%~q
zOZ1J-DSiL3$-p%_qR>1N_JlvQk&h=2EoCwTf|4R97M_t&kb+j~*A7M8K@SfE-%v3N
zzbvM^6lR3}Vl@1n=WEIoC1Q28FrQ}LV>a<Gsvp?e#v#sPB8c!>#LwRcX<hWyK^c+v
z8IuLmg8<1AU>K^ILaa<Al=?2oO8n-2((Su=7z5}70;Fub_`bgl-Zgdmh2#mtGkY-O
zegF2I_G3Ud>s}|^sAI&VW}3gPQDjC`n<AxU9pZ6baf7!>au1-0XdSm@Fqe;kJot_D
z6sa*lA#Sd)U0daIn<D4DAIqz2t!DiSqAV&@uRQU_Zny*>fSm01SK2r_IjwEdE}VkN
z0GBC_l&syPV|n|r9nzD-9dTu)9v|K)P{B0A9OU?s<5i^pRCSd*d@eIr;8FC3(T8`n
zafeDwY-!tRex$rm^Au#lLN7ZYx9`w?Od%l1>UDUD&d^q?f6t6f7T0tJ@;s;}*)%v~
zVtJSPZ{SITvKh<U6M&W4*IEHhycsk}Hj|cHT`GyWa%h;K3U2@h`F0X%#ut~wqWB<Y
zg;#tac3m{?=a6{*f?!Y~FU@27Yj_Y2qAxvbh3i?W*QzZ6vb$PD=tw?5&f-nF$Cy0L
zXyMLsA3wBwo;KY@o#<<ZgR@0<{<g6=t%dxKl|L4rlqe~$bY2W-7_qo;E#JP%0{JNJ
z+Gtqo<sm}Q`EqM9kC-o;D>tF;VYo~erjZMtkrM3f@rD0rx$q>fXv3Odk_rUw&KHf!
zohZJT<+^C|dp7F7hND5bu;-Gud+X#}s{ZFV7#Kw<S~gtE{6tJZ?wc;0IyTee1OI&d
zCz2Aai>`1A5bad2xnSSK(2+^dc`c38WSEm6W{2?fKryV2kzbsQ=@yhl4JCi3_H~UX
z#%4%Oveq_p{%L&eo;*H$^GfKc$-EKA@?50z!PM%27C$<Br2>LpUlu7`iE&^!uvX>F
z)LqjkwJ_M)zh({Lk$PKZ<7>FvZnBbP({3ng)W%xoT)=;Dy5@9HH}-JZ`>XeI<W>En
zgG@g|Q++GV>p#P*?zl>~+->{S7X0t?9#G?Qc-qGXYRN$=yspv&(=sjrI36QiI#9U)
zUWU-e3klw=1(6*3hr}}0&sbi*;-$X=m%Sax>k%vtY?fmRp*3%&_U$WSmzNxYmns49
zp2Hzvww@4_e7yvP{1m1P5Ax;>-syB8*R_-tl;TZJs$<mMexn*%FKR;gDRT0Ni0@IK
zsbhu8Oe<UMHYFEl_5&K^H4-*nTV1H^r8NLjq0pS+gCI%vlg=^XaY5uf-9UDll5mbw
zclS*RGtaR{3s;Rs>?AUPo=tZcpRW*1JFq~EW&q6vXaM9}ps6qe!K*i^#W+8#u8>>5
zVG;LYS1+G9_0l1ueEj}11|a^pFVl?ULhYb6x`1s!^E2{_J&B|c?yXSws=LG2L8tj$
z+Ui4sknU>9NRJMXDSS=|Bim0h%FqulAcEA%MsD{(vK)%sSVIq9yNYVfS(Z&b0{mry
zUHNOd>{oxGEb10(vJ={@kZwuu<VFQTT}3HR0Jl^_t}E0nV&suyjp@GRb7g`O+0-KT
z2^a=xkh&5AF#`aFSr2MSe0)@)VC;Zl<(2Ib)Ry#IibHywxS=Obb_nG00|4omZCsWj
zc+&IOgNRzsJ|%-G?RBI;LxO%>0i0=E9KCRmWGs2;C^#?&;7NN5{ih$tGj1^NE6(NW
ze{o8E6UNFfu+yeEjsj)!cA~B63qKkpoDS)wr0n$;t3tks(VQY(_OX-EI%##|<?F}+
zB1w^8efcdcP*N_F0N%5<P|>+yYf64X^KCg}Ll&HMlUzY&$Fk=$fg-dU&-0uZ7NX-Q
zkyp|ZjNxom>uv~!^%f5K!%`4o7g30`Z#458mU`GMwNNJ;H&$X;^X{1)*XL%cR#y1d
z8u1D68=YcGM)5S!1v4x-NtGp;bA?>V!!2_HtVKi454JL`Zqcxn!=J2P<+JMgSX(wV
zYrR~lc>{ec)S7KyjB_-JGRYFH<_hN7*a8(f9j!Zm8Lh(z_pg>zm_1cttys<w)SOWt
zVRYI-bk-4dD^BK&3N&9Bs8>nyqaI^0r>S(J12KD*<{B^mg#kOY=~mrWUM03PaZc0}
z`(zKjrMFkm1G%=bl^adnMXj6D1DPwP_~i!WtyR|_+Qz1JZ|;9ydgixScIW7rnW9fV
zshal^&v(tD^rhRo=<>Q)1C=KeZf?iC1ESPFUo}geTF{_s{95(MO>dNSjMQ1fk7hs$
zsbvlTrg)}<2m?n^Qr3Gxm=0aISQ-}m!Z=f2R_BryN65R0uIM;6h-^hphcCp8zOi&V
z1i7IPs`A_JF+0z;R*?j0&PxoNZS1O0$5T#on#meJLSF9@Ynl<K$eeG4ck$H%6vlBV
z5_Xy-KcmZiq?;5V1tZo$N807LbMG!Gy9mN?)dc0XYx*5{`okA>D&+e(5{u>(uCH{R
zpor$CYSmD@nEMn-qz^4!LoT;t%h@NqJbkbR3yKlad8ZV|1&vTOHO0HNQr2oIm7n`r
z1^aS)9lP;t8M5TmDY~Wxj4)?=&S&9y8XOg1K-4(<b>XGr?4>umOKR^7ik`)opO<?6
z(U{^kIV-W+x<6(X)SIrT>Dv{lk+R-oHm6KDwx@U!mDhnsdo+{tlHYtNiUhTAFzq3<
zv!sslufyXLT2c>#){f}*vRIsEB<Xv1bP}0SnIv8waHT88;0e-a_4+)J;#=XY%_bc5
zLRH@8td;0YpWc$A4=--bwRM&5=9T~zc(L<w>MRcnbdiofZ%^3bpJa!sSzRS|?leE2
za7s&+I|Vf-$+mqt+N2cvB-_EZOq1dn`Ts}RR|iD3ZtW|I3Wz8Y0+Q0Hv~&na!_X}X
zB1o4EDM~0MDWS~JLnBDHbPv+fjersZI5fX^IOl%%yZ6ZVJLf-TX7Abi-D|IR#q&Jt
z`+D~LETE%;BugZFiF-p<YdaUG?1ki~uc#uW@^fR)O!%w@m^(R9Pd_Y)!zg)|kFrjz
zT>C71@l+I`YhD2=AuE((Zl0PJ-=EjXbXJ*^pkBPml(L>(Bt^)%5S0I_8cB$W>co4U
zGyye{*=Z=Hydk{UG0KK;-5nnO%Fh*+P~(WL@!P@+O?c@!GWfVp)*M43fN1V#Wi)y*
zkG<yBVit}rQl=-xH$hlmXU*x@P5VJ9FzJ?xw7T)M=gqnuz|ef{mFC=NuXO#nqJxOq
zl>a8ltCXM+XD&}B+|Whh-7G#8O_{9<7xT_f3sEhbbkC`vN#4z1P+8R&2Z-ulE{1_s
z$ZaC(4i!DQ2Gh5O2<Z+lVu69g)n~urxg!N2i=hCr*uqr{B$<>N>sa~&ik!;fG)}%c
zj5_#~nOt5$hVkOOA0vW_!a@LakpNBlbh*#9<6L?!^D+@>@B8qH2gAC03enxtGJ4|C
zKNXkq(Q0mqvj>cG8iuczm99ibi{9yvhe^E)YAYsMtKuyH1-khVOjNUlzHV;r=!+1`
ziNu@S){7h%n&lQ_5su_0%>rPf*1DED7K%Wa3~NX6SI~@q<`TEL3<LyG@gGx&Pn4cr
zfspF1uA91t`Nan}xLaAoRosE4KSZ9#U(a589e{(+v+6&#tYxzYFr}EJ?rw>+%(w06
zl13Nu4|v{u@lC-2f&E8D-)_z=-FWKR_bHp)mA8U9Dtc{<mE2ghaWad!KPsR^;{Y;&
zh>=uVBR^J&r)*47dPT0U7GJ<?2Fc#i7-BN_hXk;fD9T7LvdqQ6MBQcSV=+Cv?av6*
zMk4_!*?VNcGzAuvv;H$%)#N$MvmIKoBboS&Q2ww;v5w`Y?BnFe0Na!&)6$9ATmulQ
zjc+(E*5;mC0XoD-oCS4w(KBjDYSGl_c&<YV3FJd_3;Ywtw-%ld5=nft5ddco?F-Xs
zsRziQ&)=?7K;BK{VJMME#=D`xh(Nb;ZV(S;8b7LWwS7dXKU^BHnrq2pD2p&nT^ebf
zI=S(4x`#(!uRsO=&@;BPWfaZH7S+KgCs5X3nNAg?vdRR~gT#HWRCyCIs_Gb<@wBIc
z6g9?M+gz^0Ic!CN{&;rcc`=lwok33mI%f+&ZsuXDG0d-5_uYGLNA<-|>mmE*-XEI_
zO23bW3b2B{0^Gs!N}#0Te&FZM_tC}tHF_@GF#86a+SIS+IU9+|xF6*?SEdbpj&_b_
zl`e@{3ew|?rwRCVemCX(5J)X6)fp8m^sez-I*15)=cm96|3kQ}QN?%Ot9fZKi-P*G
zYGNDit^VtT<i>60_ughdA7MnlwWDSy;c&hQ;EWX^WZt`QHzVa7C;h~3))fg$Fwl4k
z5pbYUpD=j=m){)#JAkyKNt&tuz>R`1BE8H+a;z-VM&d?F=9h|%BU#K36?_#Li1B07
zBoJ=uh@b$OzE~kGXCuu4G3*Q*(3;&`0nr}TWgarZhl9Q!IV4r-vOtVpq^9#g7=kU9
zWwX+zHI2YZ7{FQOzP!gsO1c~EDTX_(X&=5;N1mdA7H~Pt{yu68>YQI0K@{K)aQjEs
zt+N7(`c-%zd=QG)B05KWO?;_HI==IgIr%Kl)&0$w$5YM)&SbHNq6Uf6tmH)xzm(z9
zX)#s2N-0KaO3D`+?ahP|)oU6~N3B>r6vppFSUf_7=jazaS-DRqOtwOmPy37LFzsFd
zX8yX?)&gjkZZ-C?yj1YjTqZJ7jWuc_FweBe3m{VB#C?SKdVpv<W9c#oR)RpV!fF+n
z#jt!4+!pz)CfYQnWJtgBvaeN}Dy9)_@+rs;mm4<_cUaT_$?f$rEiI*PYJ2=GK`SMJ
zC#&U{ec~(MMi1w5c25S-+XB<K&Gm{_VTs!GBg}(CUcZc{F5Rw}h3*cf$qfC>Uiah^
zAWRG;E3zq+{_20QvbN&0T&i*3?j&RAq!+(Y>+9;DrFGe@lA-LUQ<IZDR>Qd@9Ez|v
zm&F(g6!}g@V+=-JDGGM$)v|ZkrGMAfqoD@iDuv3Gg&Vu`0ZI4FZ}y3|5bvh>bQENp
zaf1dw*Ld&s+P5nbIzy?>3i7_H7^rG|ast1N6{s7kTD)i;QfDd<I!~mQ(WSJaseQRt
zNNg5^9Ck~L%!tua_*Og)CU>*n#sL41z}$O2f#~q5F8moY0IR)Q!+P_L7#WOJA|KEj
z#G+zHNiUH{JC8>WWo;dUqR6IRviI)H<tfX8F2<D+96Vpu<ckIIByV2OSZMS{8M4w%
zXR=QM7Yksk17f1@w$mL!y?spEz-EDmfaQuDddV&0>Y#df7=;k>@|<5hSFuQirZ&JV
zPkVt<V0)nI{enjt=7G4uuQV~kae_(mzNZcF=$+TBv}5aK)_Sx8DlQ;+PUACexJbR7
zw)9As$U5z%(Kpt+tXeG0%p2!hW`sb+ky$~ql&SpXvU3pZTl@LX3^p$Sr1}Ha3l;$9
z(tl~8V-?$BoM1a0^-6=-O&CZ)PCb|i+!1)yv2sz&(&H#JncWxHyYF)=zFc;5Ewe_l
z*low<^w@m@@b>R0fWq`0o_@QKcnhSL$XG3G8*wD^Tz=q+x$jExo)D(3nAcCjCiXEU
zCRT*InabTmW^tj%W~gw9b5dk9qx`MMWSr>*Slo(^KwjN@FYiwNjHIl2LL|M*L&U!8
zFd5s4tzv!-6g0}SK3)ASWNI6GyAHruBdfJBHj&G=A@l7fAbL=0Fg<l76LI^Lm3mK%
zUEeWreh;{<n(aPC*Ir5RhO<1BPn=nf2JXu2=C!RPYXyv|kx<okBQc9~)adm~PnrcZ
zL2hEk+!)Et!QvsSt1Yl0Pf3RB3Te6SV*EUlrbKl6mauCs0Xe9<y|#RVi_e!v8$W<U
z#f2M$0Z)7VBE;_oZ4~Y6KTTxdBEtu?#zfm`$v1bTb4(+mcUajkiun^(KYjgDC|qlM
zD?&M)4lAs~(HqzbxFjOM>|E6qH6R34NX@Mke-s43!TfaQ-}-B`Bq95dm*GWNtZY#M
zMjBbU^-L47gB5wS%d>jtHNLTZ*K8zd4j#?zg2FvfZ;?ZYE-hAaM-{RRqIz;J;1O8P
zX`|;cka?B+3q*AlzjA2N+vDLeSUKBQH7-d|Dt=LR&j)}ama3QlwIG6iQajb`Wzck?
zBd62)27???5l*eeJqdfu{j52bC-fW^8@8KkUhyNV^p~*2eGh50zNj=y1?^p*uZ{=H
zWp$pH5Ie&L{n>~hm5xx2<e1+_VxMr&Gq|Xkkol_0s{z*v349_r5Eo!7ygU8+=C7oB
zBJ*pI3>@s6mT@p=1<*UL0UcnBj3u#U*n13nW3<#}b*v^^Wx)RO%7zwGdFgQNoXi(R
z+{3=>KKn$@BYIQ?sRGGDBZD&(R2q_U`)Mw*oJO9H^r~w!v`nNGGizV@H<&IIt2B~j
zUC{Hj?68K6rcC<+fh_|tsQQqpTEpC_?~_-@cCu<h&K(2zB|8APYe*&%N$=SQsODV>
z&JwnYX9kJVf|}6*!)l0{S46yKQLhk@!C{z*HvPS_9j^#UuwP|;HjZzOcA%%aN-`wx
ztrb{TWRcZ>0-l7TakmJTmP!)l`M=V<@spWlL*8b<OZ|L;yBG$UAeN(%4Qgmx%$ag%
zM*J^P9~mAtmhCL}x58b`vBj35Nv0N{j2Y|q5?M6z{29c&tA8WiT}%CX)-THU&RB4a
zbj*ph#^SrX&vYBZ#lR#_?<<<vO^h$XeL$Mx3c9`|WGgDZxgB?P6Sg!YYz5h2+^+s#
zDrW9)07jpdToN6OOiM11=eH1mQ*S*@eV)`aGHM~EGaq+bYjOeb=J0PTProvTtc_x4
zTm-T5@HbFle+866Wq00l8j)kF>E4NWVmO9sO2xKXH*K#_)lC2`l7u2Fu(qjBGP0+!
zLJr+aCh(EhwHzp0zB<No+_Bf=N^!}*DRKp!^V2Zn-7_Pho16zRQ)Qi(2mv&Y?nAlK
z1MiyE2Ly&K5%u`WHwGOjzkdO!fuF;0Ad&vnk#zfJ$&2ZFUthc{K|>X)hL?@1TtRw7
z68Q`&=m6-c`!1Z<+3ddwG&Eb*Sy7O+OPL6HJAQ@wtpdo+kwifI0zj_gV)~aRcAvZX
z@eDsfG-Y;-h6sFalNJ+~(_}wO#QTLB`#vrPAWYAutcC%Ui@JPTux=9HfEZ+20=KmW
z828dO40{u%TCl~^H4=rc%vVdui1H}lY25f}FWrwVciX}5BtiIvZ3kn;Ir+Lt?A42$
zo#Aj--wYfVqhI26<JdZk>;x9h;@95Iy%K0_KHkB!ELROntNa#bl-xW;ogl=b(hXi9
zLK{|(IZYyT3^XR}QiJ4gf@y^W+c7KO(mb;9j8O+QKv?KzsmQO9Cr7B+we(Rq%*ZNd
zywMRHd0_6omd@(<mESQa7O-GOxnAhe%?01gFlvc-G?1x&>{%@JQ*|)FFBD)xd|7ER
z9emdFjq?9pVEZ@RY2)3?{hqen`4rt*b1gEsrcUD;^J+hU_T~aUhZvhIhL6Ax1H6;H
z3Cm}+!#BvMT;BG_L~P18HnLpk$B=+HX_%600BwcWJlFobE<-6#E#v_5o^F`T24FNw
zk;ZB4G~}05nro04%1<dMRrex?3rwaA+8=)7FHQ_l@7n;Qx7<c$$>ey=!h=RryA+GA
z1-{Z?Oa}-9VOqt&71j%YvRlKuJeD3pk&U>jvP?3}^7FH6W^DjFBmm*|HC&#&;bD5Y
zlD7VmP?i_}Ck#~z{+e6ZrhFz~5i6k!n{hXUwPPR|ZJ_HcVqOQ4Wg#ZjUHEKoNiqCw
zEtX|0ribT#P843l*0;)H!~V)k9YPR8+BppeZuWv~tZ$KgsdS@-*&(Wx8JrsfhP@HX
zFd~wPCjnQ<2z&NT9|VFH2K@Pp371%(Q0+>bJdJ?+F&!O%T$0>(&*)L%PXL2UP-5<I
zM&xR{!~A3#yDO8_gtvR8k95jKJiUP4?vFtolM>Jr6P(ebeCjDQA1?g^WJ3fwas`zq
zm5<oPZ)X+pEmvd^UTa6t%0~r4H5tVx)^`ro_&M<TZoS{#v&_t!w+LHd2~LLjSQ&ts
zB8M6KM-A9-_AC(G=Q7+~SMTR^1@DXc15{-N3&tMCqmu@I@98mCLBu5is;<hQ>N;u$
z2K!`8GrBy=me!M@Ou%KXT+aBQ<oh6<CFaKNHn{9P6<hq))Ud}f81%w)n&j(C=|2RG
z2Jb(6c;BU-^^v^HfvX+|A-{%PVdve)E7Mw^qJo4z@O6!Xj^Sg@PKcCOw+JYDPpVT^
zalVEWdxI>1$K~3K@4dA8Br1oXI4HIuFD>XVlX!^Rqfk~JVlY(oV*MF&mF8H9^|wC5
zOV^y@V^bt@G<SGC69d*TNQt9Qp4qAA?v)rd$}k99*1SsDrt$<H^antFeWf!YYD!NI
z<z?5%R<Xv;%bLJ2Zwh=`$Sg*Blci6-RelH2p^UOF1Tcuwx60{8BUGlN^7CJ@xtv^G
z9|rhQa)^p_XO=S%V<kGA<KEvph+LD$-NjKvU3cKT5K&i0O8Rjd11t3~1&ms2(6OGe
zP0^XCayEf{-Fl4S#SO7s=`>eDp~VKjL6;I!T`F7IG9RMNN>~gL2cK&J^V^a<!4?pD
zOTZN6emg`ZXDZzCdo7TIjPE45^^*&*Jhu*u`&G6Y^R4t{&gYTms~|n`H_1zNR(U_J
z0ysGD^7=aN$lyk5<+~ipQGWJHfmXPO)yem-sYe@b<Q<x_thl>gpix)-0qcXawdiN9
zZQ(Zocbsqh5KGcUM%#baDN(igx|IvW(lTarG_Ym&C@}=GB7MvjqvzGYdnVWOoG%17
zb3Lja0ZC!d(P0b(q4-{iNXLL0z@*Hxk|pX`JjVb#C<b~$4NI9y_CUpQJ8{a&X(Y>F
zC?I=F_dtWm9k7mq%<kZ#bL#0`s&nq}Pp~Vk3{ZmkQpo(|Qa1Z%S~7{Fwz?ud`O8!m
zS_g&`I~^k2KF6NVfpma)tn)7cr$wa?fXsxB{F$Av@jVCqC`UWb6X7A$ntTmwkLFLP
zlk)|*bK-=W^<seZPOJ!kiTGx9aLxx5Zmq^hs>EZta6#0ED#1X3z2*6khs0#NX(2Cg
zd$hEfh)Y<kgSiQ^zu!lkL)@*G`%=@<HXlH~vl_$Fi!ZryAz-@;qArnDgvVOWhADu*
zdP5YFZXJd@Fvufg!s@8;wBhbp)O(g^T6!4`KRktCFdhAT!cv`n+*@H5Kv0AEx}qe+
zs&2)~KtL1jqr&FaiQo7f=pzg-s;kRNn`;g@K_s<t;~>{dK7x$Xi&;>C>@p@d_<%*c
z+0~|uqYomzGu~(ktMfY!guBtB86E7(#Jig2Dq%M<p+X-KhW8QlOb*~~qa{`K{E4ii
zZtv1}$OMz@b*W(F$O$3`xy|EO!88Mwa+ceic8EmRB0SD=i5#!2wt6N?iStz$COp!N
z=+aG=yNX}LI#Lj(Dp9Yci6@Q#qV)qHY)eDpmKEaR&SJpl+e>XkhTQ}tbwCT5l=`+!
z!fBYPCH4diqfG?+zq%_!-7MTrs0D+8?a04HV*U)`DsKJ}qRmK*A5{qmf__?u;8GNo
z^$Gz3agNyuJ{}_jDed5m%VzG?`J##|cI~q&Yj_UOBk;}?!@jBkI6*J4S!d%Ts>q9P
z|1K{%{hRLq;KHQ4W^pS5h7)&eBv=~X!Rvo8Vp_AAi65kz&PV%Z0*jD&6{KC_C6lki
zh>>&L>w4Ic3zCQW*di^KD2>;b@Kd_f+Q$MwtIBp1H1v<G%-=v5nap`LWz)5Y%|Gme
zw*Jv4=gnNToKa50g1P0}F_h|GjFyS81D4}(S6I6@@|S;n5CV_%zONzlshP@~JHM?2
zoo?HY%sjJK?69!l+55zchu}sj|D;)@J$e7m1r$pbQZFopoWuG?3usls`4{qj3kS!9
zhHbXz0hSZJqxW;@#%}Sb-w*J|Y``Ku<s@a-GvtM9&}?K$>3##Ww`ld37P4eBBfm}Z
zFpEiJckvYs&76i--6(*4e+Fud2mRv!evFADw2q?hi-YeZz4`OxLFWqV@viSSQJe=3
zMjo7*-w1#74BS6hl~4?`1mG6u{F9YW4Sj*_PpSoKFi*(i&PLXXp<>TP-)umuOJy~b
z=>exb0|lRgeQPB@#s3e~x<m`c*9#hqMr`6mrsMAdS#Blu8NgOA!)UNrvRRS<mQOGs
zRC!kPof5_V9XI{2f7P#CxxQO0<Zk^30qf?!_-${4W$$2EFCwJV@exaQ=TxZAx+)qD
z05j}+oI;3sjU_n$1lI#j9K$Im4kZItsMgT3=jK@_NXo?`@Aj`p6s;6eo}Q!UUo;2{
z&fEAHFg8jToP)~5Q-$)Za{v+@xQL7ty3-Tn<NnE`&?&g{Qx<aq%wrNWvgyGvTYhU&
z;36)H#b|~7JpI^F_D`1HeW#gc7`A<QD<IjSc4wVd&hS;|03HjF>~L{$Z>`wIKr~N(
zqz(En644>{0_KN(MXrP8yi6Lefnj(2_DYyPOPHF1_OkiV6Y0}KJ`(=Pa#Jx9AwMNP
zW`Tz)QnT@qA9J(6^PUn}7lEN@8fs$h{d$|szpi4IFRdH%kZN%NQ?HDzXYcnYDsakZ
z?RpC@$0w86=@WM;R{C#*<LmhHV}7iHHk<<)0yuZJhJ5-Mp5A;JxSGS-<By_eUQIjD
zAjsCvOIWaOK?Gku9CIcF+|>s7!*)cc{^>1x68C<VLS7Z!-tKBMoB0+a?-hpG73RY*
zgj+|s(D!Fv=X~lZBlboA^$!AewL8Km*3Sn%Ns1W@_mE-Mmj>TguMS!IMSATM2=hkG
zNfY5MB*Z%Y7COz}iY&kvl2~y7J2r>4!jbcgwZ!D95*NmaiHPQHTM%+E&z4%UgTx)7
zq(GPPLg~Q@?vFU9HdpaKwEa?-F^)X6dSL8otzs1q%qX2WRSaW7aIA0JKRS?X^?GOe
z$N5(;W!2igg{Z>4Hq%9q8We|$WO#%RildyqeBeJ_1T%^0Fpsq|IO6cJ+-=7smuFL)
z7dUjG4>9etxKmL8W@DNUFr((ONWL@g=!%&(4dMd)0qHfe2cU{m8zFc~Zq36oZ3(fy
zwaCdk`;AxulcIyGR-mDP8)c2Qb7P*=?`;;yew>QCEZDX%&G^Uj@J`gM!b*qNs;naa
zaEmW%jwUbv+J6&aOh-{9>L2T8p~L*;R6ItaNTO7%Dsrq{<Sgp}djZY$i;}jN#c(#8
zX9~cWK(S4jnRiD(8L<uKg1EV^KkZag1Zv-@lmkvvT>`8_STLh|R~do#I)AZRqEx)9
zT<QN<iBt*SU~k-_Leq3hjp_>(=D|;gk|#<_+gtK-C69JI^>g}u1XrFOU%`~b8}NCl
zs|3!dQiQBM?C^%6g2mrjUv<ZIfx3c%8|DG+v4jUB^AD>bANkI@BZ*R6&9@<{wD|$o
z+@H)>0a=1W`x^zPKLKS`D=;=%Ewvy8;w47fcpE=DRyw8UFrGt!xGly)Cq2df?%5AQ
zn^uj1TdWzWp4c|ma`H$6p<ITIcYN0?GU4<&sFh%25c#Y5RbhNn_7|Ri-g~M?y%Fun
z=jO@~d>6wC)%5Z;^l{ZXVrwEh^OZBJdinTOw&Ao!X(|v~KGP`v`vc~xm(+{-NiTt)
zzgfg^*4ki9?mu0cnF8Pp$44%e|Mv&~^}YY~Uo}Qw0AP>W%u;f+KIMJ?=NbRkH~-@U
zGGY(`$nM=2{L3|*bp&veG*_^=#bQW8_y7Loh3ok?G)Q5=xjk@B-@E^~h_g=<E%P#Y
zts|v{|Lm{)_jQJ=`@U+AV!BLbbN=#~{Pf?v)qO-j!z%z=@(~Cyab)@a{zGo7t_Kv&
z61t6c8S#ismaXB}B>#O)XWuOV?}A848>H|F`kKFO*8JB0_~zaK{l({;*!X9c5&!!@
zUuR6$M<>YrAFL%G2oTJ>)01fb!7*WAFHgR)8y!aE^55^nZ<hVfuh8UN1bqMOPRS?#
z;226w{G*<7?eE(z5JtIvQCm%|UhRdR1K+cYfB(od1~pyXhtnGR5Y4k?X#TR~xi^83
zLT(j3@0H*0BEP#?1;PzI_;}n4N%<Jvz`y#2Gi}Q(_<z_(9q-wsgnxJL-~a7D0?EJk
zi)Q+N#0NlluAlVP+?kvEU#?bS`6BN)B^g}7Le}OVyknmLmzb>f-0k18{C~f;3QT|O
z&=H$i&ej8`QQ_J4_rIQ;uM*xxN$^5uaACFneFx&(heuTY9g(#Cp%DA;TNO<>878A^
zNlZO+>-ozH)>{F&KTE#z-_A~x|FR&gI!T{C^#U~vL#MESzxRYOznen~gk9K}X*MkR
zu71OaP5i9|1n~*IL<{2T7bo4neZ+O<5A~>p&h}kRexcHT@Pa8}qz|L^Z=b1$^1mMJ
zpVzOzaVoN+kk@kQA9ywOKld+pY{7rBSIT4duYc(c{H>o0mj_;rI}2HO8q58y6;D#a
z<Z*99L;u#dPgjIS155JyEnn66zW;xak>9ao^e-)dfA3@<;5gmUJLp^gP*eDOcc+fA
z_h|SZ>Oz09?cbTEgdW%$ScA#O{?@lo&mbWSwz>{x@qZ8i`1auvk&ux4s-|n5W-kA}
z(f{*bW`-cR3o*eW|3AO=pI4qv42m?xj|cvNa|yw@DESB*8~dtDY$02{?>{h&fj=rS
zG5VqS|G+xfKrYS6#(5$1Z@%#0)F8a@9AXk!Gzwq4H1PK$nNtD9f5~KWLx}~?Oz{6|
z8`1J$@wp2NZ~T3SYbNzS`_|3f+h>+%{^~V4IFn}9+IBTv#Y@jDWBg^Ye6NB+Q}lV~
zYiEl4{MBsCN!5Bafban3x1|2bZz)|l-L@E~?=$}W^~i;trh?jbq}FHGr2o3|nlJ$N
zWJM<2`K_?bUvCQd28sK?RcGD4_l@}PU!7+4AF-t7X3y<2D}=v!R`T@(PC9B}55EsB
zqWJrJQ04>RoV4ip1OLGWG)Ssj>v^9H-qGO(Aa$caMhGJwTjct4G{!~1I#8kz3y8E9
zW3+Gz)`tt=c|by^dB|MG`w9kaI_Y!b^&DVQ0Q!JQ$a0eH2KG%*eL!FV!OwRXDlHIL
zwHUL2du8V~<m!F?0hl!<0LI$$6bZ8d-G(xZP_)nTH;F8AtaqZn;*LNw>)7t<QJ$n^
z5-T3NQRP5>-Lbn*kQ}vFG0+`;s<r2Q{|sHz%yYgUk-NOk-_@oz`;(<F1Km`Q!Uu4#
zU-31^`>WnZK;ic>P+^fPbm`Yq2NJIafMP5P@FcE)K$rFz$E8SV8kAy7n}bOW0H5PC
zx7*LWvdJPa%+{UH#hKrF<SwBnh8GRggG)d62z3g%tPpV^OWy+Zy)nRWwgp{)5+JJC
z0y6dYHp*RDzuHh3nLa>O9tAyRijtZ%w1Vc_x4ER#OAM=A>RA+Rd>njw@d6`&*nuHx
ze+uTTY_qN2Y~fyK`XF#y%(Hw4kf9cP5)IPgfofkm;0ourp*#(eo{IxuR~3*duzrot
z-}bG4c#7AqdNY6$v=)E$N)s&nfcDy7?7IOLQrsG_5O=g(;H#i8F7!eD@)^<32G~dE
zy<3>P=rk#BcX&I3?qx=G@xG=fPyx3A<a)7s88QvbysBuIexrxe{kU0xqNxiqB#bUE
zM)H8uq-E6$)y^a){EECUM~4dxZd~G?%$UCvP1IG?&iEm&=+Jp}hy(Y#;$$uNqRY=6
zDz&djO@J@HdF|kP>brdveU8JalVb}?VOJ$xq|!1NkF>#}vyPKqL73w{75mg=v+}UI
zi7&f_ceogp|3r(xa~}v9D+64TmIM+gqb!;b|JVi(X8+{~0LN6J>Uo^gB4PJ{h;9iO
zvA6qv!oCsTwVff>EHfrYESGy6)8_>l)b#7dsIs;P(@~?Tu6Y%U3EG&}A>+Mw68<>X
zcQs9mf1K*P{r9`+TYX(^$_8jt>I1b3pcHlZi3tp@EPT&lus<CPSTy;+uo*Wjv6F@3
z2EOt>>!s<px2}Nn2+m!_6TUL6|D2=$fF7pKLeY~7_&@lUHvwyG1b_xDfdH3bOG3^x
z8@6c{M%l-8+@aO4R0$^X4I{*P!eVQl^|-wDA`F6@2mJE<$(ssJ_q2Cvxw>m-UG|`F
zpKFF%=36cpwPsW8Is+-xF(7QUD%l!B78MiE$~I>eyB+eCNr<Q`pLUiCNF)G4{7=?Y
zd2^uv??7QNpzP@KWg`1%L+%^9Y1WT%hsFUt`zL6&E87xoUD1pKi3_o8XV`DI>^2Ht
zR?6Kp+NZ7)E;<L`4ax-q+P^T`93%$T>YSvp^$6k+1{aAKJZJ154;sf<c9qxPVT4Ho
zBC0SVC!lXv@G>>VD;6jQ$9NSiRGG_Qzl^qH%juZ}@lV+E_5-ogei99*+TaCvkI0tN
z0TA+8eH}_X5>>!J>a(uok_T!6=?z7mASPikDG*uu?Jgj(hokwe9s$IMc1`Pn7ZN?O
zw8D<~QN7i(z$gc7y2J3tOALbd=g5<HC7^xut?qb-OBg@}Y=Ew4A&@J|9-pLMD7*u-
zx1<ZLe!i|p{3wTEWG!5hh_5tZXS+}L1M0ptz{RCdI=0dN0{7LbDq4`?w2AJ~Bz;ql
z&}3!r)B$lZYNx|#^0$Fzbm~hA5;{aDP&p+R3`+uhfv-@Ez@xpi(eA=vjt+sLoO&^*
z*d|cB!}j=D5_{tK&1W_z#ZrJi!DKx^CiuN&3Rqb069Tc_M;k!S0o%5`Fv(`D)VGs;
zVRZ^<o%oKbLmVXaz5pewTh;)m;#~!#aWCo^I>=0O6B2*>0eJTt2ciHD_8PQg!O>BV
z0NMB|Iq$RU<*LUA`xxQuf;l0LS3m|#*uF6t+he`v#U~)~jBP7eH2vmI*cG6vqG>iY
z^9pdBvB4a-hrK{tcnSt&sxJeq&eb(=+@~NPFR;lRI+&3P728e->6bb$_xbH7uyj`h
zP$1*(0ZdoiE3ormgKDR3(yt%DjD6Y11w&0sAaz#M?#ObQ$VY&0;Y+d7gY*GByXG~v
z?K&`FfX?8j+_1s$3~+k{Euj>#jvfMrZ_D<8W(1aih_Zdxz1Cfu;=Ft$fPqA!JY_>}
z&5Wg&R_1Er91QKmo`9C&`%fYt_kdrxKsrDS-fBi&i$s@Kq5PxF0Lmb@0Yqg2wSuZw
z_NRcz$QN){Dr?}XC2QPwu!bXUm(yN-UE#FEI6y6EpCn$3#~3nN4m5^#&6hqpsc51x
z5?-BvI^o>{hUSu$Uz@1Mmsu`w!f3)Eopx)(Tz?@SxN!hUcagezFr)!BX7}mKCEw2Z
z1?4Hw*PZW9fszuDm0vaS9bM!0#<qRam;^lA7oa+`>QkB$WU2DKW*5+3F9P%${=lUg
z9dn1TGNi-~!Rrw5R9j})BOuRC09e<vV<}$WsiuWq&T6Gv)|_m6_tr2PE4UZ<?R21c
z;?^o+7GT#)+4f4<*NuLra!<-F*RD4@^&OelzdY|t!O#2*?D0N6E5|}$gY}`tS@kbq
zII8wT-x&N_qmDi&P@LvdS5dEgvQ=w8(_pV7W4r|B5Kqlz=XktYGXSB3*#@Bgl4j*#
z&uof;O;=)AXDP{|9qcJFYIP}V{hP0&cWx~}d%$ppH*4n26CcLIE7cPVpS134FfS(r
zED3^bW*UQSLr(zJh6A`A=|_qXYH_h#$UNV~k_##Th$Q2IiOBGJ?0389FF?(T;ye1b
zfSHZsVDaL_^$cH%e70Wi?b<#bL|SRV+Byp`#VVim)o*DQ(Q6Y&2WWzEHB(8T7I}1}
zj-Kp`c3yXCKlsRFp<)lVP+;CANdOXad_Ttm(8;1v@%cYH9gl5y@14~4Z7HCAY69x2
zDkW^E*pF;)a7L*+;`lI)17Vv(WZ~KcrbOq+lf(@mUGr;f1>NcPb=`Y(i3RbI(B!uA
z>Wi-%aqa|xGIe<Vouur#)9|uN6>i)yiXmn6QPdibtT^dR;ZB#L*0$3^kp(uOHbd0_
zsO1rm#6;CKuHH|`ZbHh{4X?hCIqF&BZgW>W>Phi%udIt*u`se35Y-+23<kKVe^>{b
zVkQpIhuK<n$=%prM)x@TAXL$NJYM_T-*<udL9KYkap@IG#r+9Es~_Swm#KKhIc=-5
z(F&I9OEdQ(O)yh5d~8XL-I7m)mFoyrV3`)h6k?)+n@u+_#L^0mDv47ATwrA#*D5S^
zYTXui7Mj5+p&3~KlPozokU@IXtWR9#ION#|6p*Vq^wsYdYOha8T6+7uvm>o7P;fH2
zQpUB)^AOE?)SX*5<-*kuMo^49sV1!!z%P5@Q;Ug+T>YcZ@>jPhp^vpsU6ZcG6U>$l
zaKf$DyU2bZ(~vVVv`XD;TBAuRGpa_ZpWR<(H|2NacU~MQc4V&qz(e2knE=X!uV;l)
zh#wIZRJD*lf3O7xS-22&5m9NLnCW<7e_~dntF;;VLhc%w8KoqtxhXVLEW~J38fjmK
zQ?OEfb(Q5&Zc-9W!Z0*DN>L`!6#Q5Lz**`vcq@A3kLpTVT0JlKDPj6Jlyj_}?=uox
zs^sWvG6VGjIB@T+*VlyF)(t34n`3%SD9zfBO{<7DQhF-p32SxcSGoNeKFXEnjb7gm
z7>flF6i{~GJ)*x%`)mx;6fj+i`9<wxXK9=$)V=_asLF20XCKNdgqVt_K4tdPS$m*z
zgw8iY`tE0j3GK~}wT@-47F^4oCp5-$8E3uAS?eX3_dNGe+I-46PM5CMRsZ$N92)i$
zfGiwYt@m~dBUw@`{_~FawUvhl06Ph>g<Ic34|yqzUuaLy1?}xUvVp>W(XzhDn~_Mi
zk6fJ|I%C>H2h4j3{_A&YTBgue{lH;**~{xPRTKDaoggRU>%I6gPEI08i2a!fBO@P5
z@w_iQ+`CtLujTp^0oS5+@_?eQBw5!d0;Po%RfX@aw!BYyqmTo69|RfL5{C;94?}yL
zdS2W|Zl%E{hgWx;d(a;}yx<4pOWQT#Q>&31oE7%^KfE^&0na~2J3khY*TkeBqLkq0
zOc?Gyx_fJ|JnA98r7^%~{?r*vlaG>`1bG2z<j}B)Q6|l3yMde$T8~SK&>|?giPJIz
z+c|OgaCJC&gini1Rb=x)Nd<q8eu^Q-6@*>|a@EcFt*zJ9XB2R!ZEIG>kkHsvuTZ16
zhI0#habNF+7V>_D+DvNDM}{*C7$eqKYvi}e#B^9aSzo|{dBU$quU|0s`IsIiFUb7G
zxDT~$(%@LYR1xz?htVMb4%CnymsstLN41S2TgwO^DH0Vtd3>v^*6Sc(Zp9)&zUzm%
z<?SkrcB%gykl1)=YGMiImn4Me_HAkaKe6sVnE|8;raownC^+BnDGNdRyOZ`-c{>`1
zq2*2xZSL=as{=_^SW4&S2FA#ytk^5}bOAoxD7zHw-coh5%bzEg*`UWE<b13p)&+=h
zXmX@b%{zxuy(co3TU|@Wa*iHAs>knGVK?JM(M^2Lz#-<D*04cC@$UVpVbPeU`<wCr
ze}e~|-AX|*o``30AL=jdofxFAuTL&kZ@pSVZe4W;`gqy&Yc2tsc`X$_vb*!q-=xkO
z9JN5$OAt%(aYG(2^0+zc0akM^r=M!JBHoDpqX-=sMgd6y_N*Eo#Ts1<Vv>7qWPMl&
zl8+3PeNw?;ojg&fmEl$gr^3LVWkolfh;9Gs+6O~eAG_)Vb;ytOJ-~jZh2kdix5uNp
zaoG8SW0I-6LVg+r;_!<%!o0n5xHfiz-C~x5=Lq?;3ihMQSQDdkZi<s|39Fiv*bf4+
zRJD8&K@ku$CyTCEZ>i|^IwvcTkGV})9)P^bm{|t~8BYnnHxuXGp15eExIBBflU^fo
zr~Ua$lG{LiGHe<ubz4)m?{kFHFx0E?1ha9gO6(KYJh&(XQr)8ikEn*ykyp_78!VhZ
z)TtRNzm7y&;O=}O-ODeZ4YG3COGyy9)s`CB@iir{C9X->3hsSlEklOc$nGs+_0dXf
z*q)o_=wq*5sjM<NbO^~5JxQ-yDA!B+8vdpN|CU!G1{gLIK9wT9$cBu}QNv{O<w;v;
zxw?l-B7HW5dSTfN;NfRrU+*7D)fq-H2`+rCVMiK~6J%?Qd+e+b_heBzFtQp@DMYK{
zWwOqJz=nWIvDocr@OWjQ%f#$^Fi&ZTN;5HLJ1_D+?Ie8Hd$O?VZmW95oUs#vYpuOM
z0mg^oWn6!mzy^{)rW+dLK@(h?&<81X!1eNl2rNVhws%HL(Abi{Lk*>E5u&Ud^jjHK
zVYe4Gkfdn)<ipK<UdDwzW#lDQ9r#vpnYbP0&Y%V9tA`KXKLwgHTGO5&2_;n_t;*2X
zMLW<*X2XUFb>+`}r(<{vkEGIJg&KQE&-=F(lr(X>doSyyFU4MT5@Na$vY6u7)mk`7
zFb`F;c|Xh$dIS0dg^G02okSBkI3!1`4D80%%T1OI2tc(qkC)@s^0l~;(D=$&BSTK4
zp8GHP^4u2{7>O}^<%L8hOXxmVfP3k_lR8ZB$V;)yyxC6`^?kwGnOadI!vfy)rAKpV
zReCqgai=x~Er&D1+hQIQ26u$t1K%T0Md4=gFMG+ZM<=kgJb2~i!?<dQGGgcK`3i+v
z#UNNG*ierc?6ieAHx2G_*(A?>755h1p~~=dC)ijeBduQ|W6MtMTY7iQ^BqjkL5$Md
zsd}@sT-@?*DvKFfhDKTUw<t{RjjukmHQG({?(i4_81P$@;yZT;LltX0mOq|M$!%3G
z%Gac}ZNWv-m#dGrPXf!^x6<JKP7+SlqXlSPiyZV&noeK!u)d4V{_)z+ZecEFADBh>
zWXVyD6s&~TZpFBFs~euzqk<+qdme5Q1Pfnbmp&rQ$1)o`1)@#bzyy6N&-o+E*q;_+
z5Gi$wgLfsahs7Gwx7}RjaqSJB*z9A16MrA>0v`v?8?q=xm-Iob>Xn#GW?O|EuGt-?
z^YVS3rfPT><<AEOD{)rLN1By>%1l5MINS?;Kq0@ywfedGI(`4aQh95b+Z#cS$Jus|
zqpmj2LKEvotj6h;jV~VR%y3@c;ysqB^VZ9+oXy~e>dJBmDeBH>TYnKz+)WGTT?xGC
z42F7}Y(&Tr3P8{Gm*|M?+_9{sNj|o8V6$~lJx{1f&yho*PxA}ghogy+qoS9XfMR)A
z>Zfv%_I+HQET{e8z%&RMsv~`lu%1Dgc1r|Ka;OkbqJCsN*r3;^86Y*1rNq%y)y@_-
zd`I1+kBGH})I#(l9Fe8D8~viTeN3R_^T@~PqlaUQWL4s=f{-!AP>;9V&Y=wS$_Bi@
zu165IHgl|ctCPd!=!?UjvDoVWKv!s+w#+g*#EhnR7~_@6Ym6`?zQd!4X<6;xqSJ%-
z3=fOs6-}Uq)J?qJ+jp-UalC9*4ml)Ca;+k+%HVX2Zey`@=P!??!r`Ali4`!sS05{T
zD<aFNj74Wx<)@ggWD|v!k6|jb?3-QJmPb-Tr!?sM9DZ5OknPmY!`wQE#TF8mh~6vM
zM2sjr9!`@7V~YmBgqrfv<?16H+O<T;`c?T(LNONS%)l+>o55^d@l6#gs$N&%116%#
zIqeUdsg6OSPl9mZfMe6&t6C$T-reaAza9u`I+|ODw@8;BK1lfS&W}Qje=d1t)=OpV
z1(!DJTJ%$BtHR{cyU}T5{6VAwyIrC~spS(Hn>Jy%Mak6EYliCK!;idmbuP+L>kA5O
zs<mRn^fjI=?8zwk+p)Yg?<$xw({w7UhlSP;JZu*ItC2MRX`~c2q|2fLmis<wQ*u|}
zk<PnU|6{bD#J_j4Xz8RcSK!5u<|dzPH)k~v?Q(T~mS`efDt-xjnl3fLQ1jf442&LP
zdqanjJ`p$Ec$q3=#nGD<?`@eU)`U&V`Rf@VJn6r;2m6((!2>NU|1R|k{qW$xRHu9X
ze(IJPuKTfv^2xG=*vuvydBp{UQ@gQKmdTFW{zrf=MJ{zQy+mL&u1s!@etB>fWK6g&
zPyO@lk8xe1%~1{MuALsT<AxGR{>i)){MNe3b(=B}yMhiST!$h*Rosc>ZPY;YQ~mj9
zT{#~rlp5YkeZPkWZ`8;DdzPbk9RP|8z#PW&54EX_Gm~9cNO$yhT3UTcTqX|n+s1Sg
zmTPss?FR=B6zgWmuv6;1sZO)Jr#PqJV~G`EwhwB8OwsACX&fo6H4oe$=UwNt)sNPp
zp!aSs0vry1Uc%Azi5!rNc$ehreLQkYM?adZ%~Ee(^s@?8@oeL9^$BxGdm2lQMvW#r
z<oWmTMr}ZzNNib+AG$9aqF`t!y|NjCdwf;H(Qwa@R`O9o4XT4JnIoHL&8BHJYJ;zP
z7HwhF)4y4HYVF!%<53?LlglgQ7@*z3219%?k7T=cm<U8HGY-_Y0{vKQq3~h-H#$bB
z6y_QEK3*NGwcucxD9gjor~{rmHfvFBn!#h)Tr3+s2e8@6uz4?r&H;hJcp_r6bfhq{
zLXHiJ)4@&3!Z7xs>?FIjGxx#nywoEc&LUWe`!G@2{&lf*s6=-6?v235$T;?ysKv*m
z==Of41bOzglsO<hRu)dr*&~ljB^u!&9-~%m$fmQaxh(93G3rE}-RQC&!Lj1P6#j)o
zWQ;(!;cgoBl{7uWHbw$9%f&7AKH&oI+bIWKqJ<1w$H(Y80(63uX$!}CbvXK{hJQ<H
z(jxq1gx1@xne2NYaYEoW$S_*^3(uZoO%p8f`i9tEY&z=cw6PJrMEgEUPhv%CH=5z8
z`rcYM?Ha!PWWs>9zdYGZ|KW!R8f_Hm>bH0WNIi&dPVSN}?Ke9lm~+%u>bwP2bG8yu
zt0!f)6H*`YLG)@RLu&A{V@!u5s6FTHt!MY->0mfF88veRkeAWcbVyRbJi0W<q#jo-
zL7#W~c#TZam}Yhn>(%2Y&7@<qlRQQFu^qqslfcX|qU^o~m`A)?d3iM>l0koWZ@BK5
zSW3{nu1SvWZFvmgOEVBasYC|LZWfiS&nYHjPbe4#=lZKIpk+jjZbIwAzq1!qytD)j
zh|J6@b*`3^+0{vcI{rv!C))*FIBN1W^Z>kee8EVM$>Us`$--3;l3#*BCU9O=i%o9@
zd#1w0=`XLPb#MF2xV(EwSki=X!wHbBH=p0U!=J!gGnJa9?_OvZ?<TG++hKb5+BO}C
zn?Xlchxt`0cfMJaw9C9D{MMvQb<}isIpW@GLgh2n$xCd7)yU_hdYPew?d{T#glAci
zrEdBhzn*i(+|{2m@Il?psHEq9V*o-FQd!2v@aE2ZuuWLN`i0XkW~~?`1S;9R+cLIH
zk2zEuS^QbYy>vqiGut9L&wb5I&kGmMI~84|(DJT>^;bx{`|*KSCRBM#;r*WQE59GM
z4h|~XK8F=lK1^GOdIr>Y(nZ9y_Eo403L=-@p`a&hI~Ws$SU=~1w~i4_aWQyCzEMP%
z9TTaDbk8r#FGWesx#{C9(>KN1o4~etx%LSRibD;6D|NfSP+K?r)VOWyY7m}RzsRpF
zf-CS@ok*{<W}1R9VPD<*HKCaNcA5-}*OwnA`qW@(Q@r7d!7jZ+)F>_b7z_;gX@_UC
z#sAdCXEWHutu!0*n1G>ctGR;YCH+9Vl{9J>GzN^HMY#rXNG$x!>4*`agHpd4p89No
z{FHeJDtWB(GK>UbYbC5}zHG*CypQtsdw{^^?#w5XYbThhM(?EC!+Ho7mewc0SoN=V
zP<>FVhTvzYsY~N1s@Z73^WX1p;2Qd_`Qv5F7cdFoMzvORJQF$!k0kvfjh@#=Gqt|}
z+fz(w;d_)Hoo#x)%uoXY^<45fsBv)GLr#b~6loXeS6EAFR(1~f^K861pR*<V;;FBJ
z%5<*T7mAM$?pc|5&TuG?r$`kEF4bJ#+U^$CuvXdNZ3mWk;1rq)nKM4>r-L=wa9Sx%
zD(<rr&^vTihAC)RQOQ$KU{aKlLfBBiZXsrXX75MH4vVP~vfsbsiEzx2`ji)p+g#yG
zRa%R$(pH`bj)GhEuNIEggpQ~;Bk1p6@4%|Rd)vT=V~yP{zpRF?ynkp&$J~9d`N6DS
zXx~Q`+Cn_rxhL)DD5>=7brvzIV1L4#Q!5Pic*w@s)|1eW+Me12rYB#Y@;rIT`2CS#
z143j@&Wrif>Z(R$#2+$0wM3h<ID~a5dN8qRzv~%9Y_K4=<ZQA-H&|2?(?^D$is|_D
zb+t;pZ$*sa!nd!6e`=fB@#GA#D+3|7m2ysZb@<W|NX5d@Wb_f4Xz|V*ng)cG^eck1
z2FOZW!@`#Z5uG!TBW9-wf7w)LRs;0!aa-qvcQ`!zNXM+CMY>`FA6kx;+Qf_+{@|kO
zNsAtlKI#BQ6?dPB1B>YSJ4_<PR(dX`tiZTd%Cmhn-1{eI!L3OZ8=&~M+ok3U6R(XK
zW=7Tlm3Pf{HU$(C`w?hv<<h=n3H0$4Ssw1Tt$k$B1q2`Y@_(_+!wiOARrDY@isXx@
zy>gvz9DuCwDwLr#0)5+`sdC}HK{k+YuFVD|@q9H~BOEyWiiUwI;Oej2t_(H51|;DJ
zGoD$`BT6>(m}y48(uGueG5baH^lRhIwBLQR>AC5(E-gZDe&{(`+prAv!exswNA*o7
z3$KF)rBo5GL$J!z(3ooUBUml;PH;C4jIp9y*tI4R&*OFsp;&i34?=-9-#L%CXA_9@
zWbThm9g{TqS0cs@9(duw$8*9*X$jt>FTUtDwO!~kP%wzyDjrT8*M_t<eE%GH-?8AS
zd+YTl-JSBCl>!WO+Ax!2RBStYJpB1Vwe}a>!Sp>Nw2I*;`t#qxD-xsk0_7)IC8+U4
zaVB`4Qmx@}=qBg|_#Y4Y10}iS;TQ%(?E_X~vAsj}_S;nOoMJV&IcAXE_qzN|pxlPn
zj;cmL7eyMF3f4g<bmy^^wa>K~jmgc_7E+HEGtrYHZ$)=2#fI<=qv2ej8|kl+-gI9f
z?w5)-GtCo3t)D6sE^hVI7#ty_SeV!C3G)?oOYY~(Czy#6d9^pr^sa<((8Og>OAB<z
zUc`|eo%p-3cy??Z!(JG-9b9z>`Wbjz$xV%x0UIo#xUDp2jEDABxWapDMq@lD@?6{J
zAdjz>UsGhP9_Ey*nFC4atnp&CT&}h#SXhT1(XU>1Oi3Zx8qJ^j>3NJUOJQIKimQl$
zNa1rXw(i?c19BYt+E&dZNvL0ZdHDLfnu3*g-iZ`V7fKy0V5axtnpEZ#q#pwr><TNH
z*hZ5E#+aPK8|d4bJ-X^wq!((wrv&5fJT>BCcxYf2#l*fI+weU4`Q}|8V8d>q)_@<*
z70pI~@4&`zu6^Zobx3BOgM&%6;nX^ietJks{oxN+78^f)4OD2^{W$6lQOTSWWeX$J
z#~Xp+#$H)XK;f1eWqFUi6Le%q``&=2pqJ)D?W_%!b<wyoJF91f_mg`gnpFPBjiC$k
z6RSllbdua+7mSpb7#80c3>~HLrY}Ym7bX|xxkt`18(R!{XYKc)23=t)Y&_6hO-j5}
zB&JyWD0?ZWOEgEGKA|}GxjSI32XgaLYd$W48Z)g%Na#>S(_b386%iO&yqVC&M4NEY
zt0Rhm+>s#2g?L5fmD!*Gm|tV&gbQZ_NlX0FwzZb<whp`Iium#7yKq@2iE&gdA}a(~
z*4wN>?ZFS`cm}(gAU_c!I<+f1Q1Px$1_FwDw;CL9nwr>-!;BR^riNIqo5`>RsSL$}
zJKmD}+0EwJVPL^hS`v@^ygQ6&Wg>vCP`!z=2`7CVT2P7W68lGh2C`|XH#t-L9-xgI
zrQ2ZPr<$cJc;(D|L$cn53}1Vf{t_X<vj}OE;(Sp49u$#UuJ$p_-2#F8U^4l8on2l~
z>z8^~Qr^l!keci-TX%(zRr$V}!jEKjDCvO6xZ-$@io#6@0r4LJ8RN<*z4RsMg?Uk#
zVe9l5?QBSO3nb%t&h~zPLH^GDRivl{eKY&Q#tW_|m8HNyXw+^Aqt{Y@RhV<ct$L2q
zeeiZzH@-K|!q(li3i>_-K2%|<lj2PoV7#EEUiOMKW=d_H8bXBA+^7){cZtidl5wZ?
zmO_T<p3i7(`L+xKcW1!NR(t3C%Xd+^do-|PFz*XznNQ9vzNN^mvoU%M)8Ro;I`>L?
zXSQfV2S}ho!N{AIvn1v{<ZRIOFV$We20`68LU51_t|9M*4ID!n0GV`@#ZVmTs_@w#
z#4P7Vmfn{yeJbW>co&mUw&D&`87e?RS2B@e9uy1eb`=Zn@rHGs{2Ma)ZAOb%077Gf
z-rr`ZhQ%Ro%>jA@VIJZI++W8y@!2gXY^h|?z1wTQ|1ggCE!*I=k|i)jLJ5|?xd&1v
z0?QaNvVg&x!zCN-qUl5*1pY9wrUG!|$tS3wICJo5a4hMygFrCH8xtY7n`Zx^QUxV;
z=j)>ca~!x~SIUdLU8lCrUXT2aArld$r!4mrZCc)~aGq|W;H~TQFMV2LkZoOaIZGVS
zLi<`DrSGRc0LF*sXmMg-(txN&QkU=+Y_Qn<v7aL8OiUV>CQLXCO0Ukz(GK_L=KHHc
zr>36saLq$6y;aVF-ki}GeKT|G;u$_n?b>-u{Nk{$N&c!>n_wOTaYIFu&zC$WLhap@
z(1z;_%5`c+4$Z{U3GDAwaiLMAan1la6X>b$to{9h0EdWsBI-)`Q+=h5IS1zTR|!7n
z^Zjl8zsU0(t+<1+*L*7G9JZ{cleMh8ez#b<^b#y@=q?dwAapaykRG7E7r2eejxKdu
zS}xuRcSCvJFbQ!j46VjW=h)7sq+;b-_UgjEsBfms<BtXLDYh3gZSa$d%*A$MXwx^-
zh!ct_0n-pjJKnDE&cZMH>Z?Tpqp+lXM}p$}73m5};{IE#0%R-sam)$}W;-(gWy1BQ
zxacAoRe~&@{H8}&fq%XQNM}67z|`Yp>dI0OMdn9n&7Rv)_pyW(M3T`zMQy*nOrQe0
z1~-}~LPKU@#>H3C?lX219V?hK)i`UidUkjaEdKnk53yExxSB)V`A25^>peMo%~S=?
zPriQ_qt4y9leez+B73Yt;cyl0S)}YfNx$v|FPm@Y>;{&a-zl_`gWTk2^~+oPsw^<U
zYwe=k&;I<{0FU%5!WaiIL_Nbi&(U-WfIPGX;Y(1Cckelaw62u$Iz^PhE~hJPr6Rq6
z45?J;JnAa*y|}&snM`4=>2*!=*iE$}<Gqo>CwS}67q%t$P(4m-EDC7N1bdzJD=6OV
z<5eheS@pUl>z#KS@(m&cmT@GEYAG5%@R3Ka@n@Csr5x&dP9sjI{UrN5?^?nc4UDC7
zoLcH?{JL>t(Szg7y8(prAS+v9PUMN6&NFm6pF4Tf*P=dI7>V9Xb+y28QrH2ey6~wR
zQ?aQ4`*K46k#W>_5zB-!&mTitnN`*6>m~7|D3RAq4O1RO<RG~>#qWe(R%Ltr<gB2t
zK2ka93m)7VdZcrtpA_+l!S=Xw6DI0GGQO^OI~Ci7!)h-@#gVp~)ZfLJ_JSA~kR(-z
zK`_kd)cG9FQRB6G$x-1&7XW#EE!_B<0{-e>V;lBSBHsBRGBlqzqE{b@09Xn?{&oZP
z@jGF<B3oTNU$#R0?#Y`*?;~oNt)&e=&U%4Sc^q9rFOCxKugPF0_GwWm&~-{j4Cm#M
z?1SOj3u?xo^fQNmptWL2k~Muia|L}UV|8#!8kJv>?U*d}HL;6nJ1Z|}F>}^d0uUW8
zUQ>Iommc0?w!rg<pFlQ<&2255^s<Q(i2MdnpVC}gNSBWHkUjxVguDUBji?0$f+XoH
zf|Tew-iXLpD3B8qj%+B^r5?W%u=W~AJr{+`3FBTs_`Baz99kYufy_iz7w<ma7CZQ%
z!I9PvRO~feK#x7pTOow74xYouzG+%e^9vW+M6<@AfM>`#9=WSdrzkMNB<j9>WskQN
zQ;qk|RtWC(Mz)Rh146!<AR<x0U$tXyL5q8e*#uV0Vv==V(z1^oIihtRgqzT@;Lrn5
z#j3PNj)Q)k7P$wvsE#{&%}5Y&pn#4yC_HFhieRUO42`JWl7#mI#L=)-gL3x~;gMC>
zbEOu4_4JiaVO2Kvj}5(IK<;GnXP3?7>6;ROd7y*&sf#FHHdkc;=2=k-SWGWxUI1ev
z@*)ur>n@?rExkuWIcN)8KEObqeedba{j|OB0MWzlcBvDkIlJ>bXRnKNS1aGGvv{Mx
zyIg>MFqSBO-b?kXXmJN?j-S|fFJ-F3am^FV(Ash;%-kC|YehE?Qr?W=eBM6Oy+|0f
zZ6$nSYk={CHKeis+2nD~p-2P5O-xi{R*Fw_Y5VoL9cdr=nW#y*iJNhK6?YAgETW$$
zszOmM{<!H)>?LI4E2@PSO7A!1_r{}AT5KWK%!M$#8#^l0WsoEF(cBkBZui^0Lho3>
z86S2DYoo+`fVy140Amf;cW=&N)R5k_vFa_T_Sh<@X73-Kg#H{Y$?1#ht14?r`-KrS
zYS<Y%shE9_)*oIxnplcbSi+P(-!ges1HH^+e>9!w>+KUI0(dqrp`__qZ`rwvth7n%
zPhzjkL<y~!LW;w8!SEzvK}(0Pb#Df>gDv(6bq@#&%UcobGyMP_cB9XVRwh`s_AcTO
zNdAB#j%;7?$UN;}v~4KgP$neq3eNp)Js-lSO{B?+Z$&lbCb@cIbb<*cU2#;lv1`1|
zf3gqMxqT;Ch_L)JFqX@;-%P_v-rlc+^Lq9%Ux{3>!lujxqgHk<VLbiP=_$8^`I7A0
zn1Mr5aOcqRk98!%B_oJt365G@px!h{aza0#kicbpkdn|6J+jYL*Q^>$gQB}x_84!m
zndBR$r_k^?eI*)=(9$s~u}}2g`Y@$w5HgtZIxt_&plM8oa(_I}piF9#w?GRs(PXCD
z&q;W_+9{c$d4B@{L@yN>i+MLmKM|bN-eIux<^X9-)@`U)5Lf<p?_tp&w1NZg!K4TJ
zoUX&%gE7)^2Kz`iGl278-Ow?z#1kYW-9O6rM3vI5t8w1yjgxmDhTJJ?;%F9Js<^DB
zGg;fbUQv8s(%eEX{fW-P;qAGHJ0uinLh<rx$P)!8S%7Q7L(3n+f;`Y{u9RL>preph
zdJHBKaJ_-^2DU3kv}DDy*txWCE-n>e-XM$|j(s^8Gd)n8^1kdEu|Bm|n1J>=@g(V{
z;ualZyE#9Lq{(YjZ|=cXzF&=lq<lis|D)`?<FRhv_an;4h>UC+W=Tahp+(%XBZOpy
zRI+YlCrNe#w~?8dnVDTi_RijWbKAf3{XC!b{eC~sulsra=;iUk`+i^Jyw2-5kMlS#
zH?3;3FzODa7OoYC-`B)H>fDJDf0Cp>{;ug-l;*&*%i+`6Q8tB}xn*#j)!<DRTI62Y
zn2P$erWE_Nt9sTj;jvXpHXIiN4odF#=vq^(BxKir4mDBfDtPhS*0$VUG%{|I*t|`v
zLqj)GT^%Byr0o6k7P{&dzOX>MNtp)ho0US7OYv<*ZUateD^s|-$Gn#JMDbi%#NHVI
zl-00;bKDkXI}^~GVV4D@UfON;MRP~aS2`ji5r&HomcIn;7^df8#m0efrgJmME_KX#
zKgrO6_i5J0ntVC*%A9%~vW0XyB26Tl%%1{+c6w-eN4`saHMOj3dcQ^N%b)@kW#M>9
zXRd>527*bP{8Tz~lxwDJ|8jsS`fL8ZJxtGJQ_ki?lWJQ0zuG_2K`$~a&mFJewACY3
zKA+U=t|tDv2WoU$@stnujZ;f=I!E3Vb8v-3zA+)jtc_>TdOPE_mo+FlcHY!GbnYh?
z!ELm_FS<~mk`*)f1;kge@JKDvO%4coRf-I~I8351^O;{8+w30Yq8{;Z<u-duSazGx
z*KSQS{Sp?3X65hv`crG7&lI0o)(Pky9S@%LdeSHx%RLCLbuxLvt`1izsdf3SgK25t
zi2vEngAQB*x@Wpdw=i8BcgD|KFHdjW;?29SXCA1?am3$1|D}fR_L;&8YiuKH25Pes
zh;y3fN@y)|ZYB}#fs~$4X`R^h)-{V=tb5^%4R7bs_&Yjd4(z2|pYzO*>kcTl^0}OA
z{TZ$esODK;(vi*LnRc1Szh>pNd(3LbeC6iubtinOQraAS%P!mc#nZ^pWytL)026hI
zWxz5jzMiDOUq$D42LH7V_fNPGh&%I|D80;=_^LnMt-g;jVxnQ(G!Oo{6EWAN(ZuH9
z96WhKik5Y<Iz6uG)LofRsaY|3-!Cr+T04lO=#TI<O4;zclB#IZv>JCzPV+=2I`8wE
z2uN5nN5NS#H(viaN|*%*4saLA>lR$ES~)*uP@on?>v~41-f@9PAMOWo?jN3xEb^wH
z@F{)C`!BuE|J<!Xx`0qGbGH=cJ6G?H?jQ<Wk1q4qG%osr2d}V8L8ktzE~tp;DdwCC
z^d`8m@@8_tkLS2#@`(6q#LBJP=a!%DGGALHT$!QW981ix%AI!A8xEccqm%JP|JwPO
zUPPc==-Mx4piRV+B{KafIHiO!>6n96TTzr>8AP9PW~mtkI8c%&%T^SmIa?w~(N!||
z(q7jzdT#OFh)|u0<hz^T+PRZJYSd2dp!DQ(qt=hrT`&#f^YycP)hHWvqfgv6tg>@9
z>6zpv`iCWK3AJ#URE67#v&m9fA>R~Z1lJD;q|Q^kwaWd9?20Ba{-l0~sH=5}2TzM`
zs`FiTHUFt5wR<p4gpnihIP@2n4W2WZAs6NJ#m_IFJ%(}FPQIpJtbO`drl~-p;n_eF
z8b6oyM}b`Bv0gD>R&NY<JZg9+K<j{)_5G=I&(_Q(gE7ML1Qf=qW#sL(k@rFB*9=Vf
zNDdyhjHF%jn|?pNx+bX2mTl@LkRv-j`BmsW8PBTR*pDBv%BHjq)5N24J+Y4|XdPNI
zzw5YP!_R97isfHFw{4t%4IkgHnA7uFOGW0jveXRw)CU?tHZtoe{w*A`Ewdv%p^_vf
z^jbH{Zs(gCG^1$xuUAm}5g5c^0&muFpl)1iON@L?d*=}-=efoA>R9!g8HYOEUN?)l
zVR+N8_+#kDbC)6)T%ja?=WfoSsQ2d`WS$1Bn4xKkT!Xe&&_AD2q(sT@Xe>m$?eLMW
zO%Kloeuc=WBnjP#h2-z6vIP_+ky2e6tH}!;HxC&HhUbb}To+l*nJBqAM!#U`UwIR)
zb!Tt9Jy7Gm^SVe{dM}e-MS{18@*;ky_#}_B-e-SD{g&dm*_f=8=YCF_JC23&hKw$f
zGH8-kuB8h(u1zhKYJ@K;hW>my^SMUz^ma1^aYgp&rd4Z$3#!Z?G*1P-yEbygkH9*n
zmuoJhA1*Sq#Gm=7Mm`ChS&?R#Ad?7Rw^IJ;WMF>P*8>uoT<03O*z_f<lMWHYO#|`+
zeboI)9XE1iM{kU3EppiQyeV$N+&pa-XwTn3#=sj|959}ieeb1TJ(`91@VS*Sh6OtR
ztnECw4VY^VIF#>%K+N6IG`e;$nf`gJs;}}d<E+*fB2(w<v-gNFVX3o9)=#N!QcH&F
zsC`&U{#E=5S&7ZcM8}wfn>iMJX&nT!zwca=ou=J;@r^@~ZN>dT@L5HYk*Ei<XH0{Z
zq(^qXw*_2dp%1==l!Px!<2R6!EycE;`HPYUUpc{=tc52^Vd+rx>^QYFR!x#u1>r&6
zq-y5)EbjBY=+=pp%P-FbnIV6!UBZp)MBKIE{yD^Z7)Z)_%5DokxcH)V0fj6-eDB1{
zMSGTWr|%!dr!>tZct^)D7a#vuHy|wzVm7ok2ftY4PuWAmsx0PXZt$W@)NY_;f67w}
zB;fj8M8C5Tuqj&;j1A<1Wm;#M>%q{3x`9@Hw;^e8Vq&?+QJ*E-l-&_Oe)3`TY#RFs
z_=tQL;kmT$6|Tzu1y*p#O_YtTMHO^Ym#}I_`M3><*<LJ}5f^-acKpv{u=x<NI5=rO
zuj5Ya2Kj=N^>i>k6oSTy+5RHC+)?z4Lj(+xcoSaUuKv^Pe-R|YPT+5sbH*%$g?v_&
zvbc61qCoj28K9(Df(BlCQY!Qxb$+@WlIYc;p_3L{eA@e8(Z=@b{h9XUvrQIHCmM(i
z=E0ZL5d6}U{bIQf<5OzgCcePWmq7RCq3pj4{Qptwhc7|Z5S`-f@t4Jhe?91b9Qog3
zl@0}<{I+Rgo&U%8|NBq>$9JW9@WdtK4TstOVj%uv5;Bvh-ho{rJ6c;UgM8loKmH&N
zUz$@A87zcplMJhpU1WmU_={)!SGb$j0pA|2J;r~W%=7R4;s^nB4fxb13R7;d|JT3#
zSD(VI+T#!lhBjbUj`wf=A}g_)y87_4Z_D3$9&7<Uf{7+fz>?W=;e(vNj5+^(;3)BA
z`US}U>RtXj=Id7d=1>JRJ_NPg|BEQ|KbPpgSJ*JM(O<3OfB(?`NKUm<iC|EU&sb#@
z8eaaJ@0JOzai`GQ5jEwW#ME=p)Iy>t32De9zykFnKA?2|*7PWw5D?jFnsCjQMZ;ya
zAIz~=m0R8k7^NE3zFF5dWA0jNsp{Dn>(lp93Fys=%r)&ydSekS{5J;3?Tp(uLw+=<
z?WQ+=5UdZ=Hs`kJFI+ctZG719?)W_$#Jw2Y9W~OV$gX17nl1Euv$_Jv_ZS?<y*u-4
zgUy}CDuWb<1~e0TUfht(UT&NC<o*urlwn@0DS}Ni$Lv+o&Ym~PkLvEx&e!Ut$nwH<
zKSaA7*P8P}<^Ou(#|*{qvoUW8l>Lg*vT7KFTz2h?#)1^)z!5&Fli3s1@pvf)k7~+x
zM)~6fORI-Xz`#m=(RgaPt<uD<k<X9%FDCi_E=|5tWJy~SVQ8~veU{9QgZ+z14Ao-_
zrCV;QBL4QSzxeuA`B{6`?yi#jSPfDA-aw9XRPeiu=ZW&`9>0psd8teJAzPVvj7GBh
z8Y=ArzvZQe{FG7<q>{n|>Tul?q@mvodC|SrWqWf#N6iONy$57TQ}4uG&x4}w5&NBm
zB5NX7I!=)%V>cPW#k*uFjhxT*&>^N@x8$y>RgemSw*4&FHd^MiTt`&kd%%r^6{T%?
z08F(^VBR-GId9xWT#eHJHR^=sMlq;1S*}gBJcoLp4s>J8c{5rig`rp>UYQ_;LE$TC
z>|=|bFY$;Ja2|L~cE|XzXx}_oYeV(Dz&l(q3Fl~Egvis>r;|VPCO%kr8=)lDLj=uQ
ztAb({pnvcoAc664H$Ncd13wvafXy<QZQJkUwW}!5)CDXe9PKs4#VVg$HK7|SxQxP3
z8xe`IUd|ao`qzA9!7n(oAHCZ69J+_zZ$E)<s}Jc{<2U}fVtc&xzQ*KQ_J4}yIBoiM
zyr*ft<-pl&G~s8iy5=Lp*^HJ7@}BfG%TC*#hA&afE4dQuKf5*t-rW`2SQY6kRaBkL
zdPpkfu&Hi2uO5~hxLC1s)-$K*(U;=AGBWMHGZczBT~ZNdyyv^R^$H&Ey>%(WW9{2q
zO_^)jdG@lmrTvJ6=#K%G^)%;|9=p74c}2^Q3u$v}5*pdGjSL-JQuE(@s2}!ywet^1
zkL+<aNi{NGmD1m;@b-^1ep-sLE)nIo5W6woW8o*nzB9!=*rUsj%0BSltqI9@ZueH~
zy4(4)_i1kP&m2*gm%Tg9v--Uf2k&WnMO<A%Z3BcKeR-}hn_ZvM`Q-fvOJ`wuS39+)
z50)Q$2zN59=&n7|+rRIv_;J}o!dCCfEIqT`&SgWV`QYIB(BVsuX4Y6!S5xY{k4Qby
z*pa`>GOVhywx&Fop11e4QdXS^BY%8S9LFtifBBTMx;jmcfL|IEgigiBNX@2Z&+)r%
zDGY}YC_oiFw=qKG5);x>eXIF&u=Etj?`A`DFxN}JigMNi#NQk-vfltn^=b;AJup{q
zfv|A22;2=Vp(8jG80wujpJIo7j%K}8;sbMogl>0y{yxyfo`a>G59G;iXo6FbO`@UN
z!#2T+HGy#V`7C+{1hS{%ex6B#zQgD19h#gJeX#cKmu+`sJOWYX;d>Dt+fTuDs|Q@6
z)V|ZvX(Mfp;0>Nn^HcX}qu}$otXf*h@FG>l;kNw2#{7Q%?dH?Z0tNLPxr5){$a@wS
zKi449*GF7-R}j77diu8LLDcf|r>Dc7SoGR+f842bNArv(jCSTl3h51?eCA6JU+?v+
zd`Pg|dLuB&bfs(1XVj8oxb3Ls=CK_Mrj6%ZlWP*aef@!NO-JaSeh!VHpfcVo($8-$
zW#FVfI`ER<_6%mOdA_grT+?3rgncWX>%F$l`Q~5b#k<ryGam^@g<V|6Z{FU(_;uye
zgjq64F>M5t8NBX4n4$9;9TDQElKLT<t5cIMl^47|)gAj-PfSxnvgdrEtIX*M^M}kF
zSGz0%4>c&Rr)F!fE-lCTW?SZyO7hw304Z!-M<~xC;BI}MpWK7$RFz@X4^zobRmH7O
zUgi2e#XSOR6MQNUoG{6vkpzEkO~L?qguZhwyWt{4eXR6dLyo;4HE)<L0IUA$44{1Z
zsdjMuP6M+)_O#;5U!_xA5BAIbRKKr{O4TwweXR?fNyBX?O(G1a4xqcSM$cu-SalmZ
zDWoD4s3m_;w`2C#ICa2L710jQj<g#P$=O8i9Mnp}<)xquKXh(pF1v}GCF)*C2h_ZV
z0%w|B_n(&cwaW9RotW_@4Sa^Q8D8=Ij8Jul0_6=8!HwbE%ha(@vq;-c;;prS?J}TG
z^%U5Q-e$=<y*5MdP!hz+mpeIlux~fj2M75hq~N+0w0`SyF7RA>0Y<0WhiqJhtL#@~
zG1T3ko?de>m|7dUI@K!Mc?>_2-(>%OmxN$-y0iHc(+Z=>REx5ymEg(5dX}gMhgsjB
z5I?!z|Jh@{pk*ab<#Wx(J++^q0nQI)r6P@~#*1xwj&v4|w|ZF>EZsVaoX5|1#$V-a
z71sBDsR!4^W*a(5GuM)ik9~K<^0F<Ra>xh5_qXaUtLhtvvv#&@^gEUd9y@w*-<K2<
z>(r*yU*eo(F+TpWTh-dxIKT8l$Mx$Y9KN9+<VMoeV@HqPh)Q?K?;#m}=rYon!4Yt0
z^tNb1<#SUDI_AvlxgXA#y2k2mVNE(yZ=EVydeLDSuBee27I-BkUvjHcscc@A@shC;
zr9z2|nJw*kw2Hx<jy#17nn(5P+SdjO8GO=Y>J@!G4T{!Sk5}nCJ<5xXEa@`8$|dNy
zVz-efR@<Yn*hFMpCi2+hTc&oUAuG>uK4ae~wR>mAt5Qtp{zt0!f3tvprIBvcFOfs`
zNzKB!WKilBvgpJ|NxLZN_&N_jSMkvFR5hJ`>Tt)cibQBwIua8iCk@E8_V@E{Z#^a8
zloRxFD;jbq9jQLT9_T4eMRLXqMRnbwyF^ppS&%4W<o%ff72!e}4K4OD>;7#{e&K~5
zGeHXH1$@&+Xz4g^-CT!`Y{J0cL<hLb&C!)%uVL-m6tAeSa^&_u?|Z+^AD~1MNq5Do
zQ}ufhN@}lt?3R2iFF1Js7q2DCe#F;&y}F*uPAX&R*2o#(cPAJYL(8617=E&kti5-o
z_e9XVW`9`r(WV&&r5|5A`B97yM-v;f_IJ{(Zd|YUR8Yd?YqRn7(F5UUlia$GcF0@{
z$<L#Mx;VTd`waUD4KwXs=p@r<y&9cFNw&_S6s%U{a`$ayA8n^PuwU-)xRExVcro8*
zxXrB0!aDI<)Tfb+ip=SRB}c1Uf#GlJjY8@IZzP4E*QN|Y)s8wWO6K}m(h=v3Y^>)?
zbqhI55#cACa_K+snX|fTGaOto6}i?oqn8_E)l}y4Amh!ulj5TN&f2zDBZ@8dW*Rmt
zZQt6Zs>YQX-~H+yZy3uNs%s^3cYa71$7AUbzMqiW&^k9sNgmtJj@bUrhE5u4$;Nlb
z9p3v^U7MM@)Ff^ME%6x^A#ut!P^}@6NdTtu75gVDu~4_@29l)}m73za3*{$B&YOYL
zM1n3@{|b7dsN{dd1r?u?00r$IkJuZcig}V3pwxKL-eW}$$hDxXZ8Qs>yC%Gk#GXx2
zieJCg5HIu{Q3pxW&Lvq#Vh<!;88VK8Ux91sQTrL;k6q<T7==+q=tPYkA(Nk<ebmIR
z^^r>D960a#?`=^q&vi#?Cf~8Vclq)}jenX$+x0tISN%M1kjj+jz7`i0^p(496KwK{
z><z1-zMNj%&z>R==KNXIc;V8m0l##y1XXbzgF!FUVTyUv9c$ILxHcry*Tamt$#cZ3
z&@NUMg>Pm;vZQ^^uVTaY;Lh#byItdRfu*DbddqTMk|I6ZgJR_;ep=5dew2%frj3~2
zY+5eAq>+{P3%kf2Sevx$)|SL5L~hKLPl_2cF#k@&So4{5XRtBSIx@iJiYGIAV%I8f
zSo@sCr?0y$O>;p<IeV{1YWJ!J-sG#VJI)tMC1D)eXoK_BhT#aFnH$*B<Y2uESL>B;
zW7i;cKvX5}!@*BF!dktdkd5@CLU$VZA87)@*tzvaVxyZfR!J}N2n9<-SR=Ftq^R0r
zz@?=;TUC2P_jyk>G|?M?@w$KV`TQqdsFlkdSw=USG`g)Ike}sO1yYNES84Ec_8Z<^
zq=Hc4#s2_nb0cP9%u7CI3#rFGzI-0!68Y~cB{w-hi&WHU1AhXc{K)Q}PW?CsfAfbw
zqpbTPSFZ~1BZsuD#^?7BYvvq;rv1JOP1k=FviQ0CHgA!6bZ&Keu<v~!XI!vR)a!fL
zoXs%Hxw=!GDR(gB1xwSfD#dywbvjN+?g>(DAA3b0r5l%5%#@oP0?bD41EtA;Om?Hv
z+{!rR=X7UfdZu?r@7ye|%wUMuWpu4SOPCc-TD!fW*QkV5R18p*mwG<K)OUI1?HN_4
z4y*U17}3=B_5p_OQ%rsbr>=ge3-6wb=fYGBpHYliP%5)c&ApqR<^0&TX>7V;Ql)}Z
z4n?Ro_pgxp->>%n`fiv#KAC8Hq?169$!Uk1bzi{Xncv=VrX|h?%KT33?>%pk5a+{J
zeek~@KL{#fPaoA@xhM#O-Y)*bV}<8T#vQA5c61?-gXTk2m6mzrt;)707~xuCEEs^2
zN?bDQ?!KE>iSY@4l+RhfOQN&snw4owbwYQq>VeZjNrnd<7m98$YI&yvU|d%!0>RV3
zfxKqBbw~JlV~a&k)W>{ZyOK<Px1J9^Wk#zUnp*i0nR)YHevk~`;~s7s#Jo40?3XB2
zR!WX+3A~aFxqbXu-m_?#wUAe@J#fr{+|Imtu_p55MLV#JOd@Q&VaXZiE!QyiLCrqW
zA#ex8(kC&lrMA<p)rhP@>pbMi?BWA(*)j*F!c+5s%frEPvLr^FI-r#y`|@jhgA_|h
zrhHV)FW{d&>orU4frQDUHZfh-!W+8YoOeL6<LGi{?8x$T54(P!TevILhx~npb1D)f
z4t=@m-G!Eg`6NCen{Roq6AA>ZEEL?CrIbmx^@~5pu;01)(?&>e1>61>HiA{h^mjY_
z0N0529+#4q6$7cQ00I<n*bmvxw?xiue&i=w)RM=J8LW*hC&QiMv|rltmfNKw?b$Ge
zF5&dUcaf!%T=3V7zyGy{v<!*4e(8G9O7_E9{2a_(v_A@2J_0W3d%Eq+O7cry4Sk53
z3owYur{73!o9^rk9$1Mj6vRn@Em5*Vn<q-X8w#S7=ash9UC(H+RwP3Hb>6d02QX&K
z)=#&LubA99F6k^jE!H<Pw<%ksU-GFatwi3;#-FNbFQ%?=-Jz>=&#H92$CgIy3YFX$
z%j`Cvo<vNO*;34cV-z+@aev#X2>VSCNypC$cs7yX6)gXdt#pZa3M<8u|8{P+6|2R3
zn6=@eZkB<0&p69%YDs^LP;H)+U4bG-ut{4`zn5jEucPn=N1kDrhEmpA#9tPR{x@iF
zf0?6s$P0A<B$!7a<3g-y3>WvjPHl^Ly%;i~?r(^A6#@!GLY~0h2uBOuY+rsxT3)ZY
z(DOMh9mnYpEarbkK31Em<IgL}u6*izZ<{IUi9&Q<05X3bQ|C*~sSO48?39e>Xc#DN
zwLa||?Q3#sX<6K?11Hzh=38CmgfH#RMCFY<@wfP-t>TGt+Fw8AWLtH+Z$}deR&9$O
zwS&8L<YkU(OEqi5f{fSB57Q3uoI$I6<<S>9O(mH|MI61N9d>`(ld-nD&DvErZ0eS+
zNoa7s?ilVv(Zc>G3{UGCfU+BKNMyDja_h`7Q~fC6^n5DBXdf0xs!qPu2At#%U%ib&
zuiWah?b4MEgG9bjsP9pBrW9yk^?{O-q5vNBF6gP=EG%e@6ua`$SI>D}J@~QtR5M}J
zlaQKgs>re8o&qJ_+HCK=<EO5BYIz`PF1b(T#lYDYNd@NsvPgcO&cxmtrekGhu8NU#
zo`aqk@+}j9+A0=)%&KclNv^K~VK{eie<MFew@ypRxr0Hg#>Yo*r}a&V%d?vzYjtF4
zma{8z7hMY;eJWYoe@!VrU+veKe^%ijsm`}!t8VFJ=hL*XynACbH#dGcwavdMb7tCL
z761HsFQw0&(sNjPt%>neSyl-@vl(CugVD16$z=!jHYt%decj*Ya}};+lJg4M9`l<2
zxp%$0D6TBm@`|bPW<;LSusy8YhMv_&ZQq}EhF@~cbk5iNab7Cbh&^LbuChMLVRM$N
zeQ1U7YAD9f+K)JFY|Cst^h0&9$pRfO=Ot>+|Gi585|h<>M09iZOSexUBY4sv3RQU9
z3j8H%OG{&#!^rInlnjmv1XRhnZnt4}L&#XfyTQIIfbz&9^!<H7bUhv`iHUB0KNZkT
z!kc;@WPzeBi{|r&cY(m|VUmP&<e`;FFcS^$sjHM(U3at6phfGdFml0rtI-U~X?J%j
zS@-Wt?JjwgzyU-{cm3A8XOM*V9_$Ss^gu$W+SsNhBJ&9XEsw@~9;f8*{!O6hVhnOB
z`8ED@_R`xhr*qKrPHM3KMr4A%2;>W7brd=_fi~bR4v$Yv9(cl+v1Hb6GT3t<HhFkQ
zl0-j$&pT}%4sag($0|3AbT9|Mw)-y)Ab0nu>3ls(>}_9}qIL1<lAFa3^QsH$dyIWj
z%`7qsUpue%i#r)iJrf(B$THBMmmE4sdvtie;6Bsz>OZiA?g5?aEJ3k_t&jXG2grxl
z(uIrT=CeEG1%r0i%YB8WTAEU4%^T;({kk%2Bpsw>QUSuaz~r*I!jd=hO0fEtSfo^i
z_v@`r^1+xiUHfkgKRD)=^EomUHG%A3JNV_+RW>1Om(cm8$zdV%?i?FS(Q3%~&a8R-
z<ALv@9P1OG4}R7suto*!nd$0qnrG{94+ppIt%jOCZ&kz`xzn~>l+Hl>qgQ8?wc4z$
zEYieeP@wbKJVlR{@y=|yl+A`HT1V48zL2N3@BhOe`Cpi_+qD1$(xz%<k#Kw`e))%2
z=!P8tHf(b?zYtj(grhrb1XLMCj?-Qlj3Q4SEKPk{1NiW<U|=BC>@L7X)`&}-1I>mK
zM-nU_wlRyY^hm|`7vsHaInRWd-mFLlMG~JU<2|>w&d>%m-^Bk^&tFzdsm-rOxwi@}
z81FshE{0}oAlY6X^kasPyKyUEPnUNX_%PEFDDyZ~(`e>^#?trGBP#Etz8*p(`zUoB
zxQc<S4Xl^$0Vp7|i3e+@J>ff#UQsr`yM=%<dL^HnhS!++6?04NUXzX_8h;S_vaVrm
zrO3!{Ok&2ltor$TTbq>9g5gJ7-MqK8)i+$ESv(|n%+vQMy_$4Njg2g*#xbIMPJPcJ
zjpy|PhicPeh%xOMo3)K!WYe)#XK#OGl)Kf>5vcW<R-w<y=piBAJFNk`>s{u%AsI}=
z!BxhbgS%#w(%b>vR+$e;cMK;sH-<fXXs6TNx#ls68LF30=;;!N&7?4`6aJ0pe5#pE
zT$1>6@kNBxE(Fy`=`E1P%R_p87;L<35GAsCa4I^+!5aApboVF^>)H={b;e%vGoRk`
z@Kiux;vXMFD*Aq$z8_?Iiz5M`Yd+5^1h_WgepH4XAq}3I0lVPr>9$0l(Ue4Rw?h!S
zUWD6ub5;zTut+Kr5pzEZ!sQS-<#^AVb#Kq0S1L}Y26gfJ7M^|{WINOT1LQ(1c8~@j
zPu-|IHD}<t6(iVR9;mClmmv=`vKdxQUZaxS+ib-^S|P<j)e^B6U=!Fq{gLf?YnD*G
zV4i=MUgytW*(J96aoe^biE%m@jCr_(c*~f>&4ddMI(F7H;^JiX_CfvYD>*|F=GYF>
z;wRjSvL_^y_1jDuv!5<7nH;dJ*t+?=*_<hUF{m+{+gfX`@n-4ACGq195!>~LsV&#W
z7TvpV)pp(c`reY(;nz&r;!Js5NTOn2XXyRp^txLXr~a}x=U@5vKSQ+EWunVO0Vo;n
z^0#t|z?aWKT$4WtrJX$6&<4UpzqIqMn8j&~;}!H+yfUChPR=Y!z<*m57?V3b%GPB&
z{fq9kNe`m1CJyg{ux4OW%Io>g4})6Z^~4n4vYqP|uy>M=%9uBq%!OFlm4fzdgah$w
zuTbL1?n?J*8^yM>{v_;uuV^>|WD#8AWZ=?`n8~qz(_2@Tu}>x_I@wp;&n#={_Rf7>
zoe#b>cy~ugk(Z~aD_Pd#MoOV+{dOSH!WL=gXTMl3C};nF5T5^dakp!)Uoh<>ElSRr
zdvFy*a=@!>p?vxSm=mQ|NM+q4sQ5ZiK&9u2b~h{EKd<mNGC$`MG&SwMr<s3_1Eu<x
zeFOieuuA49P4qOsU4;nqO1D#%LZTf22G^d$6yo=xx6hJ2ncxmWq(#^covC*(IRV57
z6iX|wRh;ip|Cq;h1t_<lM8_YS1^v?X#lgX_S0@aCUXXt-ue)Mw+6;{Igr1Cjf4d6Y
zhP>=1NwK&S<bPT6|L@~yt9XB)*ufsnL%5ElEviZ))gZ>Fe$EVXL(AsqtB8-FdF|H!
z8G`@**Z%q4b}6X$hyJh!j>1L_qjfjbjbyYC)jlm?q0}`fUc?y%_+uoZ(}}n~FjgcM
z#@-S+L!A0#N#{)4+xtJ*E^KY+DO|rXeFkT+XkF(1{_YkLX2y%pD}hQH8}iE7SN!FY
znQ!sjGX@-&nsOoma6%G=xsT!a3;!5AEqVe<$#ci*+VTEl+2ZhJJ2#XbZC?df{Bw8X
zxFNRBLczuu-u2_f@xQw&<o_{DAzWTp|1!_}ub+d|3*j-4Jmf)mI)7u?%mjTqIC|*N
z!NHBM%ZC5dJfG`7`tF{3f9-O1j3=9*XUbbPT~B2>QI%uzM?+(8-k4S-D90y|lcOYv
z_q}}lS_+q<Ozt7P(`+1g+*d!WJtTTrv@_w<@P2dd!X+`}ze_t3O~DOwA!2rtm+Tfw
zCifQ(o;^cZmnXcyC*g|5?Vp^t(mv&hwA(om>VzkhrSWk3he%gfw;b&132^%9KmMwz
z2%ZP(+-9IiCC(p>>;BS@Mcm%vkGIWvEp2CKH#If&IH@RXt199S?w<~Mp(B`G7F<V-
zD_YuuM7Uko!o})mF3y83tHGw>{6TU;ck?aHl0PqwGX&34Af|L=0HKh~5mg1}M?X_>
zej*7QGKOxr|9sBtLx+FaK6^%wHh+(5IH``~f>4%r<NEg4P6NGCkMmo-z(059{!((h
z<arYf+?E}(kccG67=;>Mp<HNiUaiW}xdeqpMP!n>oi`?a@!<Rc58*SnwW0b|a9<QJ
z@Y6W%S0`$0eTqQgzWAot;dfY=_G55g>y77|J37Xd?Hc#lMO<;;P)i5+Ht&kwkb9sG
zP$Po4e?n6lJfA{~P*mNP+TU0Z%{@J4)tqIdxPQK8M|=&mc}Y`)hz73Dxqp-NnVp@^
zve`}7!{}9<AC(g=t*IFffp7O$gfY$o;a&Vfwx4V(<HaG|9~AYXJh5}9A;ReIJf%F5
z{eXrN*D;WG>!g}mSRiKx1?*|7w4UcyG`L1`<@-q_$DncinXT<fG((F1p}~BdgGCyb
z^pfv{GPK1`i!|XpAjfRrAduZ99qQA>_5Gr02#-nTjwDWq;~X<DcoG&C7BbCP5xMS{
z+TuL)+8W<pq0a5Jh>YU?KDx;JY-Vpp;{4&7pWyfR_s7J=RmLo6F9bjJ#(BEvEAam~
zsl1ma7j<wSzj#8Xne=!mNfSL>1Fc&OC*@~JMb_1Hr>PR#!7Q8?1xZfqp_oL2N^e45
zWXdN0#*|gTER!wszp&QF`BQ38-G5Q^<_$SKtJP<s828vNO?1r81cDPW&hyOGtb%_8
zqdhbF<RQ+}rTn6~4T^55*fGtkxV{q}p|(PFQBmKJs)h4|pJ_M_ytFGJbgqU9`vT)`
z-A+Z)m6A|2ArVt}ba~y`4Cm#~zyk+z%&)^Mh8k!FN)65w98aX?1{j(TTW!fM1F2ZG
zlF$HLj|tPmuzAuB*q__l5+YxSY?I@9tZzeVlT4wdh;0^b(7gdU?AhH%5od6GRX4m7
z7qFLK6p%&a&|nx|&MR=^m=zo=g>YVeaBN%bXk=uh26~1+wh7mLXnGEL*>#7|k2<`P
zp~1_~as9A)@L}7xSuO1B@@X*I2S#hmxTYj)*S-y@>gRk|&H5v3d{~XMNylw~-D-%C
z=HKBD7U{$k;!D!+K%i*1mNz4(Ro)=VVZt}OXzq(b@uLPNvfa=0Xa@Vy>&5P}{em(*
zT{s>+A8rp-kn$fx^i2pN9Y2-`7}a<hy%9M}>2ALMa4ES%s{Ej_tUPf8%j8Ul+a{G(
z$5(sa3*{g~uf&un<ux{*tGdA2a${5boTou130ZB(>BWVGH~Ha3QWDAewedS`qaXKL
zhg5@IWWZ<q5w@qvg?7?v?0eua$k0A&6|s!$F&r)i?!)M@43K>_0P)>Nk?*ZnL^|?*
zNU@oqe!HdLv46{a4n-S9s0m)#Hm;zw_r!EUldp@SNoLferQ|0s%rhm!ON-Cn^-7?S
zbY6>Nov(MA*)+mH&$c9L6w&EMq)$G(41gFwCDN)3^#LH4f*Cv8BVfu7BWy5k2RlGy
zd<47hU6Oq0dnSws5sv9-vkpJ16eTVq4m?@)l1K{YDOm$(=Y1IfV6I&yA~*`ff#X8J
z9CA0))YKFnd3kEY2t*hXGb>1V)dVeB+l!>n^dY*wnIreiljAFRKBu<sR2^A9ZuiUP
z#{F?2t6v2dfOkMP5`k^~?fgjZ5eh#qDnG*5Zd(E6IvoXX44mjLOTMY@<%zM?U&Dsl
zq@X-_0a}}4xkC>Sf}_6yXKOI@tB}AxTQ2vE)X;ZcuULOl&M8>{)N={RH_<0(VtTW5
zA?g{7RQalx<N_O4iU~-V%UQsvb1hhFRTy0d=?E#lyl%r~$N0zO+|u}}Im4AcK5#r$
z&+cnR!W#loF8&J~6b!=dJ|qVBk6+QfD<@a)UgC$s%F}==wJX??MQ8qjJn&CxcQzgz
zt=^UW?X;U_9;)m+?#QD#J*|q_RucxLeWRDY=1R$X6IaTJcZ)#rr&Uqnyu%y_VQX7;
zi$PRiMUVKIE+yBF(94|iKowtB_kn_2nU}+4<dxe1^eY=Ds8lBc_mG1RI-qTSf}_FD
zC8Vjl#BT$8i4c=C5rS_pK5#PNu3f+FXuoI0`BLo21z3620=J02HuHEr)r0c;67ZR&
zBo{zGiU^pjro{`c9mHy1;-7Rax@;C@He9Ut1WM|cLSpjfI3l4es=;S%ic)Wd&r()z
zdWZHQglx&(VG4@od%|~r8@ZyF@p;p7RP2|^k1CX2IHi84Dqf`ss6(RySd{>SUQdj6
z@=5eXsMIf7@E)_(ytnKda+>C4T`qVBNPK!W=6bL*_!v5k30w#YBm_NB?4O3(+)2;V
zlS`~M%c-s!$3K2kp7`PJC^c`-hIQS#^Yi#2RcHMl$-fWdji;2kb8?^osrr?YnH6{M
zlSaX=s(XjkqievVW#JV~4Df1mDh9Vg%_~&5Mvv|kmUDWbJocC$edyvRm)x7xKOph6
z-EKQ3c@jO-w3*n_B#3P{wbB25EJ)IOvDDgzlG0rv2F9IjH&81_oxzjHiHV%wl`S-a
zYeFWDvH=upA_jE}ep-lw|A$xE$Gul@d!UdER5#s@S@__5_5S`gHM;jfuwn%Wjk69;
zWVoz<mWfYNDgT2m5aBqJYyg~tVQ4*m-Splp;XR4$bLUaUK_bvP^~+B@K$IwJC&AN(
z8PrMih!ps;<g}ptbhz>>Qf;3$SPo*1&OndzE^mX}J!2^V=iZ>EKRXPiLUN>hKSI&I
zG+gN<Zo+nulsnP})HAxw*m>wfw)rlW9!@g36t@SZ&*~<&z3-PAm=}YW7=CmX3y`^d
z-$LsF5$ytSti9pE!e|ilIC#O?R0N(-m4NgzE}A6e0||B0M);cdgxJ_y*_B)2CHwFi
zo>F_$C>zn+7TuW!1`wJJLe({hF}q`&qk~()@A+#qjbD}l0rA`}K-Of)zW?S`voo5l
z5B#T<#Ohfy7l=`f(z&@HY3T`kxU<E;#W8Rrq<wj700jkG!nVt9DtXhT(4W9xD!IDr
z#gAt1zgI9;Bxo~IHHB18Yc@S3Dy7q*(Sz0Ab=ntEBe4fs_vr4OEI%IeW2pR=>x?vE
zr&tgRr6Z*WmxF$&-9@A;MwWtpA$<n~VW$Qvn_M<7S&<ais&q^|9?G_d7(PlFeC*EG
z?;L)fAY>rOm)owg{B_H9I(tYc?3|<r5)5sk5Vd?^3<g`pIimcAnK@pQhp&=v@wT5a
zYc05;)NYDEY@g(x{QdQ2=rDeK#qBK*J>VZ#B&kD{>M>XP6jZp5da>?J-SA2b5zG5=
zc;&6yFtMUz^^oecQ9E2v6t{gtqt1Dt;&r#5S-85RK%YU!9ykXhv&S!NeZL_|l@U%N
z83_gC;m`Ve<~<HbTr+Iulz5Rz!2TA<E?4^13QnJR3YsTt^fC+9t~)x%J}$8Zy+eY!
zr-q7=Xc{GYyH;xdcxEiK^ID7B+v90!!jr8E{QfZ!*cY(}aNcEQLJ4QHVEq+u`b$~r
zC#UdE(_(X)soQ&?bZI!mCE?3PR?Z_M05lN8WA%?&SF4KGJF!al(BO3rN8C$_NQa5{
zMvplq0uD8R*$}gb*tAe-fYjCx6vz&}17(HuXPU!7G%bMXGnKJ=F(&HYTHVPCaOM+-
zQmI#0BdhG8SJE`YG41j_2|Gki{ZH!83Eb2We_&u@VzQeG<cuHK#}j_8w*#)f^<CVB
zhL@4S-P)(=U=TphCVyq(Jo-EY6ICsjt?|)*pov)*z~XC@m3sVR$xghi)oJLKeFRYX
zyv9SjZms?h&&VHe9L~n<J?d#PL})Td-O3T|V)hW2GHEjIqWv{z48Eh8e(egrH>v4H
zh@Gp6_PW14ji%U@c^cYB@k(}E!iQ9sjhx=EMGsgm{TOPCcES5NUCl^?j^!c8BbT{=
z$lRTd9--{`XzFQ|#3CD4M`l36Gu%w{KzZ0lUfRJ-B&91AUT#^yVTpS{d5snCoL<JA
zw9Z#3XJW}amM>rFoYn&F?;5rfX^WsQh#{dY&uO=UdfQ{je`=arCnYz(N~`m^^HWHy
zDKib8VCAv51e2X<ZZEduS11Q!dTB#FiQXPRpVIzr0Adu~XUpXtgblI$Rqa~r%!$wf
zQ-XI%$|2e;=n)}&5$HMdzbeE-z6U2I*|FN2h`(J0l#W<3R`p3FZJa?^C!j4so<7u@
z1-(?Rh4(7D3kc0Ur#v;eFRPu$Ry`w%IzIOva!x}*E<IAa6p=eh%LoxZHSF4Wdb?HO
zbOLrjV9d$?R1*dy#tNX1$<R0zIiQsB$e!|u$3JH09s`csCCB(h=lJ{g92HAhfgyMO
zSh_#};t`X&R-Hq{y;7JnAW2%Gr8do>c7yHBV~)@oqRYogD#Zm8oI2DstEHq?-#1k)
z{)7YlWYVEfo`Pjb3bDCNnF4-^E`{G7vuwnvW&7J+cb>FbI)5Fr=W2@%6p5aa{koBi
za^_JsNTK-v#|OD&pvcQ=^#pyhWCrzkZ_G>+elSntnh8U7d15e1QltS=$1|Ki3c|N2
zpE@UFL(XEWs8Llz#IDqy_P{e~)%8+H`9^st7V)+l{y4b%u=r=KqSr^*(0$8`Ku)>>
zS%K@zE<X>{u|cGNxN5kDD30=r=>vswP9D-b21)mfN{LE8b;9a%B*)8wo~oT?l>38Y
zN5ij_aw6VL#b(eW<uB_$zDX@_<U-ub<S-WK^-Yb0>i8prq)RfFI)qXz5#FIdd&Ok6
z$=fUL!k!P4sGcKA6AN|lRA(*mUG~r-`ip@VC<dwB^^)VajJt&gIKv%`-sOQC;Msv3
z2&FVk=ERc6?PFu_BsWv=OG^ikC|s_P@N~!SuZRdNLaezqwDU24H+xb{RXl=q(AnMN
zqgA1qL3Kow{<MVhRnjixh61a9_ArK!cbn0wfL&up6a>g*8Qjkw@DbI`i<ZbxFJ2M!
zK7ZRy%p33YiO^m`x_gv|@9$3B>EN~ITjlGrSMGmhZY1>EX^jp!R4XEqcTZuo;7qNE
z>Zw)fme)`GcUJFM)=8wFw7P<Azq4Xw8cKh>7E30nctCWN1FN?3QDC&@)Ei+Aa)EG`
zOO)lD1F9t5%8e6n+`hz1Ui;vQrqwo$(VBkQ2VE!QT4Y=llE=@+nyWE5@=N3ghI3=v
z`z$U-=tOZfR`QpS*@h?d>nw4rpX0cx%Hvs$e@)nTMh4^nol=if=cvAY$-2q!JgqQ2
zo>KUUispc*ZY(shHCUC%m%WK-?NgYKC6PfRsGm%ySDXp;zB$rb6TqrZFMqyqG39eQ
z1Hx0N7;U5ResA<r&i#s7bT7o!QQc4(*&kML#hMey;pljsWG*L|0_nIwiCln!jA!a2
zBEmb3uUWNHP%TMVHKrq@`ye4CbURWs_d!8&*bwzqfzlhdKfcvUjv2@PB7QI|vwn_8
zs%53gokVSG>BTZ$+rg=Ca^p#4SAJd4$du2&^lThx988}Bjz1bbDrSvt+Hx7vHZR;V
zDoOtx<{_&Yjny*BrK*nM#8+mjolDD=e_S)9+GNx`{nRqFiNDdhcI{-|h-z!na?s;S
zu;Kaa`23VRO0DG<`$x#Kcy@=5N@2ehFMB+LTTXS~B1qk6dGWw(B;2fwaUS|XR>)3>
zA=&^}&o6VIsd(yq92s8@wZTs@@|p^~?q{$_z4Jtm-eoC1T<;Y-UxilAfV<ooPPLKi
z?$<oclQgQ9toicP<P4K!-0vi7)1VqFg~r`cp8ZOq)1R>NuO|y3=ct<PXjp_^w|e1r
zmP#ND*PmZ@$R)reJ(H_GRiWycWNzjebYYm4osGdQ9a2=W3*x`7Gg`JAeSsfp-Sk~#
zXODlvNO-Kz4qTLKXB5;7V%1mgM!;EX0CH+JrgdQ1S$LrgIq{f!gBUdcnaYGzs&?@G
zNT%j6vEH5E0>AP^A!0RmM`FA_nv+QgxM}#tKtXD6i25#|L~Wl>t>@Dm#UM5=T33_X
zpWX0hprO^e?^dCE_|CE~TRm7&YS{Y^q*HcB7oxI{U|#VOu5Y-gD0|g*#Eno()!p`a
zt0?F%pl}85N7!a_ce&7nEyxZCQ!d@<_Z?DAu92UC0Lb@CU9sDn<eC{)wnD-4ooPn{
zzigpE4x<5gsYOod5lj-(H7~yNK;fMHmifxrjKJ%i53sPpb<I?4xhbjy_O#uRW?_YB
za~k!~q+Ydj=*Uw1BabHKFMccx8SY4B$`)T8A?DqovNLd_bsm;jak|<e;GL)Q@V)U!
zv*Y+gZQt*aMuKh8cIMi*pd(m;&qBzA2)b7chNfQ_X#)O+@-(~RQ_P=7fNHez?RrAY
zhlj-9AAS<X%Eh0q5beluBa#&0qwfexvGmjh)*=NAuMbZg^W$%L24G)zZfS2)>cE$s
z*@|sf#k~7#g-4?PUF5zH8e`f);5%|yVfO~tRHD?LS?XL>rj=(fazQ-m&HrheQkH@0
zRmvG`RSv}5nOISJ^=ufyMFe+1@_`GGU-^JHAD?7KMtS0|%d89+lv2YFSRn9gNd|VE
ze&AUT83eNw9bXbwPCeC;5QFHc(o0wDgC#DHm>n3@5$&G(g(Tv&wd+@~RdT?7?N|b?
zTeYj&cll}4flG``9wJP}caJUp4v%t6IIabG@u)zPxyckle>Kbb@JCi$LD3<Okzq&f
zXo3{XYqhWh=Z93c@lT@VsrCvU<qc6+evFT4B3k}LdHrkt_X|(pB2!eJc(I)G7t*#t
zpRlz%DaGo;#A|XF?Id_Lc4YEX88O}QivX#8t$-WHj@$4)y@tQJZtgMLO~l#|+Wgo{
z+YyT_`jo5>TYGS&VTL}NGSB!hZ63Il>HD@#SuFW-LRhr1xmj5HP9@oV7rX2xuaz2c
z1=bgKd&^a=jDt@tBWB^OQUtw+C*LV(JG{NGB9X2SLEmk7nkX<n=Ircobe+B@`!12o
z9pYERBqr~T!ybb#l*>?2pj7Sb@4%c3IfUDy<|pD7AB%@|hMS|rqYSA$<F#W>BEv&{
zO_uA8;ZicWf=)Ie20<Z&(e&1q(EUt~&|^~^!^v$m3rDE!Ay<2znwbM(;i$W4M;`3L
z@dR7gOkU7VbU79HU0#<h_q+EAFyNCqtR?6>EilG3%%d&1S}#8XKu-W(=7T#5OWb73
zd633?1A&O6)MeQfF$=SYG<GD@QLV4eLvHJW_txqRGdlJQEk<e{yfL{LFN%(bsN#1F
z<o$Y5p9#X?Rkf3=3T!s;X#f1lgEKz6PakSQBOO{m^7V|7XWz>8scA4^d((k|3-afJ
zh{;W-->2L+@zw6j$I-_39hrFoye+TeK1XH*X9RTt=wU{WI7w@i52-STy}W)DL%+a7
zR$cSfL~RjCL`fDscf#*Jd{0k5T!T5-oiqTkT%KP|p@{b7u!a7P_OWLdJn1aCj$#I&
zv-~k!BX1l{;T5Pc8@QP>0Gx1}mm)lKloi}oh#YsZ8C-L@Ad0<BS{jPw1y-TsQ1<TB
z4Jn2Vh;}TSUzVsIpZca|mQ;j*2nJxxJGXpq|2|O(@Cn7qe|+D3Vb<KbyYc~mBhBFr
z`^mL~D1a9pg9CB3RN3x0f33kDHZE*P^&+!?p&Yg|zm(=7G?@zbud!AR-=TRmqx8vr
zD@tX43UHg36bAcYT86%BOZFnhbs^Y+q+{ylNk#H8NlzBt%p#w)-m($lr9&f1zQPb0
zM#blVx@VA8P3zZXK_+>8BesrywaTPv^3E>=omqm=Kq!CB3XG_$?RI`&uT-WSqQ@f0
z3)YD(9ZY>iA2;NwLt=a|PVh>KpNBhFe)OGV{ZWiOAwG}uAvNn{JBw#az7)vcCk53-
z7c{Tu2O>%IoDnN2Z)&DY@w|`Jt^szttBfUs+T7sgMQ_5<ZC$&5no4%i;ndcGds(Ia
z!FJaLG<J!d8IAvH7*F8j6{~x@bjuHSZ(zM%fog3dcpDf1+W1=iWx+?UD7Kz6;rFOK
zctVJ8mnWS#tqn}OO2FGNs4rc!n!2{?1prTsj@mE4HJIK<D2}Qbq&!9@!_Ee2TGmwx
zdA>rfTQbUT91x3b($V~jrx|6l<HIJx%aE&Xjl8PotZDK2VHWr2o<&42;=ieVZKiD6
z0Wgpi=@O&=G9r?^ymv-<4X(jei|h#v{Qg~qKoU2q{tOB1g;Lu5GO!31h_2aTTU-0u
z<b2+R#WRkG72z!la8(;Ac!hwe_m{_z!&hIRKkslRUVd>H`hQ+sy)?k@mIB1$m*Fq{
zX*RFX>7GbXie%{2GV&KjO_%OwPbpM$M!EhJnIz!RJD1ZeV*s>xzjA&(%+@Y+$FR77
zlSI`l-+|dzRK{%lZwp~>N$&v{*8t$<dTSmh=WyNU+{ZL)m#yFUXtZ$|W&wp)W3@TK
z{`DWnq0L-`(f$$4Os24)D7K2v8lEgL7T6?dz?rhyEGi~8`q&Ox<EuVv1wWS%EeK=m
zTA~!QHESIW=1>9XMN}aB)AVYA?@}wYY_J?mKy}rn89{6cmX_W@wkC#%&mv%)072DT
zOS5;EqJrJ!Ab%p-LQpyZ<;t9-mvTe?eP*5kDxt~6UsPH0wwiq;PhgrTEgJY~+=-@|
z5fbV*5?+dfPg{}DU2ar;K?bG9&!M#jg_EjiGIo)uaLu5U6AV0bXhRmF*T;v-tpUaM
zHMpqf$3AKbFv}|pUU+i+bbOhEwc4B^%RB3Vrm};*#S0*%BE6noyv&@4&*0Bvwj1~4
zgi`3h;edmAYgZk5p`gigU%qn)5Y*JYWuq;xgg*4IJ|_Ej*95UuCiOKpw0mI6A_T;*
z(_HYbh(iSDmjzW1og0|?JrhNm81I##IN;%D7N#Ajt1nEvH;J-8<;5p_woivq?D->T
zhB@l!q@~)Ac~d=68~4%tNPWZYucMVr`3a##Qi|#SDB5fVIS69ad{Cwr+))Ht0QvjK
zP<rHFy%sA=F7l~XY`f9gg}QV#a<PiNf=IT7=#ldKhj2~~1LkNyyeun$U0bP#@YUWL
zz*ruuCdkV!KyVU|o@e3H60sYzHwyrUf`_Fh92Bm`LK1h|$ARN5()>(wR^h&XitI6y
zcixkIfZkRDDnr8>>|=?Q++7ZEea)Mp#{N1*9_hJGJrw2>W&cF7EOiaLUkqoQP2sNa
zc}UT+wkZc=iq%QT;-gjczH+;s=ao;<xzo?pcxo~5eh19=$;#VXqYi0sce<oe!g1l+
zN5F6^R20t9NCF~Q`^RO0{-G!cb*(1WOjDyB*II6n=Cgt@iNGQCX^BrqSHE5wV~_c?
zW`v?AYXa0UTc9|UrQZ0@$y;@BMelc0F39^2bs(Mnolq2@D1PYpI{bHMezf#?=?i8c
z=f7w(Cr~D(y9jBBJNxaABPY_@RfM3%*n~RAOuFb`vAS=(l<Xk&F=gWQp%XOslj>x-
z;_oTQx&>B^W#zTvd+K9tj7-H`ekFZTOJ6oZVSS}hHZPKXJvA?h>@p}#+OCw3Q{kn_
z8+JZ^f8^+^I@CB-6kttcjW@8~lOtEZn?y6L);LvNB%{%q&b1fE;H}o0y!9UYycY3{
z)qt1B&Ywx-;*n3S^BsCr&4$8~;#vtrdSuVyUePRuH(?g9er<XjJy|*ZJEDg4ED2Kk
zGyolsB<vCT^fxWOrYHLDfBGPgu&~`K7}7eSdbOc!haUV+mV<_3B`wpWrkfir7Y#aP
zLr{Sblj58np!(Ze&IwZ&yb9E7o{#`h)%ts?Ic|46lQ=qFH4drH9>rh>Afc*`Z*tIx
zc88iXiSR)D?{20fT$DZuabMa%w^A#(21<rTQ^_6P`SpXTe-se}wnNJkcXj4%345hs
z${5ivO9_7uMd0BdGqMBYZcoI8Cq<J{!toheJSJJgI*kEsZoBE&=*l#a9#=V}S|T0!
z2EUO5s`7Uwi6?QWl9564lsy}z`^XAh3%JzWW52XP%%s-PHj9_;_N{+zb_CNq8k{qt
z>V$q%N=itA-<F_A+630~yG|hbLjfWj3d5xX>Eh6nF$^(^7`CmZmT8Qaqf^1=@1__T
z%H|-1(6M4PE7105EuVda^|u@0A9G;I5AP`<X$ZuV+R3S+-`z3(3DPF1z`%zpEAD14
zELibM3NBBMrvAQW_2-8=_5zjxp0wrC>7v5IW0Hd1zrt}?Vt;%x`Uk)~@Yuy`pB`tP
zNmqKSbp4+n=r<ocT95!%dd*~e-#rHOjN<p5-(N`oTv5I9@S;xW2xJPMuIb{+S5V`I
zVU<rh>!JlrULZYGvA)g5mCdZ|3NN{S#d7V$pX0;O--Yw|+(X7^RzE{Ce?+z9G^}G>
z*8$1p+wh{5NzUxQ-AVrn2T9>Dk&d@SnQ{LW)0aS3)Pw<{G}o8Iaqi%GGstj8eNa-s
z{Z|-}4b0w9`V#jcXqN@PlGw9n&wvmuaUs$h_ussHJ^J(K`XN=LBxf4j2O}vTSeP9;
z?bEpK9IohZFG#9VP;Irvvn<V;HX}ICE^x0S3I3oQ^Jy(7D@EhHabWNnIAJ7hI!l9a
zACEQF7kCSzqN1tTcGL~bZ;{A<zXloY{Q@zFC-nU|#{{5k?-SFbXE2y1oXNJ*ZbwM}
zV4}YR*3{fWJ?;}AEky_vY}winZq>pa5$3=1ZX}oG?ju*RBNzsmc|Tku3Cvsxfj0#!
z3;ja65%le7pi{zA+J28b{*xW$hDSpWjQfaEh`Gkk|Hg_@M&Y@m;Ax3TZ7ToT^1lhQ
z(r$Qk(6>Nzsqu0!5R40Q_;IA8A){eS9X&#Q00d8~Pf9m&-{?oQzr`#Z(eD0jHuUeT
zL%N?3=zVr7oJs%w-tWFTeC`6=gM5DeRD%9#Q`5wZ-~GbB7xg+dG;(a;6~&d*2k&nB
z_E0&eb}e*P7cs7VD1D9l*5hjChk4t*gl*@)j!DJ+L;9b9ri@d$&gcF{{PH_gp7_W4
z-*K(Y_irp{S%QZj%n}e<J%s4qzZIgdy%?fSL-s+x?fa2Kw;w<rJM2lVL<A*gi+5nH
zbf~!E0QCfXe+)of;n)ophX-0ftU5R#&-fdAyp8BWJ9C<u2g)-Ftj4Ykxh0OEJP)-4
zSaD2>rV?w{Pf!XncHVE^ym<^a$ac#QxUN@v9(+apWiz;>lS0j;KN`&f_3^s}b6@I@
zjORMHY|yf;Jp=rz>dMwQziZEus*~%lQZbw+g#HlBI%I#1&_MuF;A9yaArZ;jYe2*K
zBvqmoeIDOoid(UHNi}Fm<-ct$w+UK=+E)Q()RPmCgJyOc`guKjZu7J$_i5t)SVTFA
z(rpyBn=us5Nj^yDztgVnq7=iP<9gJAcETo<ov)nkg3GYT3C6KDG$5FN@O!LBY{UmN
zN~DvURUPw&6HgES69vh6^$qmnDge}CMyh#B2xp-IYSC#IXMZN*s}mPwsL=#ds6<;5
zOfkL(=B7BY6~OsqaW?|aGd{#3xH2M3i5&<Kok?2qw?@ZVGNDfab^9BlEk!T)2SN=+
zInC!i^NUV@v>KC(PDMWk>LA@&Taf+o%I(rCTFTe_Gg{K~xgm6qVkr15k2{GC)OxHK
zxj@<8BAQL^Qcik$`s3BcD?Uge=@BSN8DN)&8!zbmlw~9yt0x(BDm{p2*m=1|)-v(V
z=nY<9&4cYZ)%`I}sbO<0a*sz$>oRsQ_#|qa-+pibEd{13S=cieU$mp7q*N-UC8KLo
zB=z7DSdeaf%XG;BXyVc@*MmKSz-zSJTQZ(c(?K!Reh@w|qY(Hb1qH0uP>`sRNW|Y@
zbdjgh`v+xQ`Vy%)c-0snFaf||uf?d%^hBhK2OMX;f|W$Mtuzz*U^%E0{?at>K>gg(
zh_=R8vlLmbqOJrPT|HstsuNSY10cg#3C-P%NTHR58i-*Yl~O0@PvDVj?ai4;kxD^v
zq!Lk%c;|z#2wpRb2{8fSVNicApYPYeAnzaOA$Y}Be9kECHBxcKR<c$=y|i~!=-|)u
z<NgJL^x~DeOi+QS4c|u?IA>8&Opq_s{Un*KM_}6lS3pz{jh^^9BSwc>pcc^}oK9>I
zpz6<rp;*nhwNlziNs0YwS4yoUG9H3e0@>5{Zvwwm{6{BY4v?bSk}nF)p~w320O<Ih
zDQ!&h_^FFY+wB4p%I*EHt&3Z(e!5<!cj?_^<W>U(Gd`kBDgP7T)F8f+0WC$?E>-`z
zT|V3yvMbxs#kPi*o)F$izc<R~B$`aWaVi(#bqVlQ59;rZ(2=TNY~9PfM_zT=;yneX
ztrUNOH+RuwR!o(R7=c!f0U<*6es{_f|4U98PzPd({N=%n-rg)bV1~rtqj0^Nt~lrp
z)isvp^EQX!t7Ug11UYb7sxOriEe!yboyXtVeL|dX>o45bhOM?as;Z%5nQKoOHa~!{
z(HcNlWf;_ZUz$v=zJMZ3Os(~GeZAV+Ki7ux=R+|=Q2VcvzjZrKMR*g;YRUf~pebar
zIL#y{;)hayj6vuL2=wTey#kB&5_(o=(A>M{2}|$I=zb5>0)Jjhct?IKC*B4gnPel|
zCG46Mkr0mxP10`PgC*{+qy<NP8I;*8Z%mNqKe3qR+xUPmN{!+%rDT5jf1JH_Tvgrn
zFHA~Emw+@PDIvAlq#)g?gmeoM(%mVggmgDbm(nfWN_Tgcz@7VvbD#UW?>(P$-v8Y0
zt!u5hW{feuG4NY81JbYh&DucWiW2k_t08vEQjMs&Tn<MGLXh68ZN9a}5IDL34VTYE
zQJLoS`qo6`D&wyX`SzHV$UK%)zm<+RrPm%<ZKAPrO@hsh3{31Vm+O4EA2|C!SJ^GV
z%w!7y#=XL<C$m4`bHErE+p?RN`70t-!yvuxD;T`i4q#nU*isY|Uxa}X5WwA7o-s+x
z73~D(yTmX^qJ@X1&%CJrr8<M(#jSO~6FxK_4a>_I7}BTo%)d(jMp{1lcK_#@GA!i_
ze6#prY^@_Yzz7<C-B>lg17kQZxi8%4Htf7lztLIZ%cYpvoFUfwfRC->;%^zr1G1Xo
z{Z{&mM>|*6c3NL(T9ll*{1rKcIDo3nKLcqUW=#jt-NHz6F#tomdFxg<JO+$caEK|M
z+T_0D{2lwy^=||x=>>4XVMPU0O79fH!3Not!Hts|!1wOPA*hA5P4L|#n-&R(ePEbm
zXL_sXOM;N=2TTL5&Xh7dkzgArapWR-`Td|03X=Otyl{{uTfj5(2kG{7rOd-FzM!Q4
z`~iWcDJ9^xiQ=#i`~c?z32ZmJpEV4B)&}7Fr2V3+V;DoY4zv+lK1uh!yJ82FzKhTC
zt^d*kvP&UgbXRZXC3n5jgVC^IsII+2f$k-k{etta_L0&*DxOOGv!WA*gev6d<V5Nr
z!}=io<4aV~zf$kA72E6Zo>#7UQu{Ep+y@~4dR>@|Q1W$fO_#ErMSpB87#B3k;*I?e
zx~1v2r4hBahrz-afcvRuMBf1lO2jaCFNjgh#<Q{(ge3rweL$Jq2d@tX#&lZP5v>ED
z_=;jo&Rc2l(@Xvp64gYXk7Jbgm)%B^PYKaTM|uO(ya1^;Se!^Rr<-M1Q?xo@StNET
zpF-|mx<`K&5sM=j@@mHlfiwWaBTxNESkcsWTv@VnCJIp0VH{<o!HRtQ2Q&6u(0O8_
zfE(aw^V#L`y`!^pxAl)dXp`>8V4y?evSE1LYhT*bYCEvOo<av;tnpnyVX>RGy7vTU
z8fydAE6Dppn3ZKi#9j?BqROxpZolL><(&DbD0F2^_V{-;<*hlHN(krem<K`HVq6U&
zDDW*0OjeY3Bo=L?xxf3&WuY>AK_cYgqC<3f2bPDMAcm{l^rIO-j72mk2FJ6YP?RV6
zc^s-yNkuOctdU{V1Re49QH&%-D2f+s3+(nR1b|;|x5HI-yeD1W?O6I9mjFQGk3P%*
zj%P5S2hu;FhS9y--macR;Ffv=msynaBM9U-Y?sF3RcjEAeJaukImg}lY}RZ8JLQ4L
zuoGl6!yjGUY1C+pu8)CG_*c5|LKHO*$yZ-nnIrhE(-ate=}?>7^>`J+g?kf*K_X#0
z#^Zogpxbj1XkrNBKn@58Fn9Na^Eu#Na3-D5Mx7f4T!q(zs%N>NH5`-$AU;P&Tf%<r
z4Nq?=Fv8<tKG+>+EPWUg1+O(waVjyCq+=xR;m!6dcTe8r!N@=cpif-H&#kv4AgyW`
z^ghjpaUXpbD#8B4c%EMZge7()ORj|+iWU%DEI(_&5-3N2+j$pMciY9=6hpC{i{Q`N
zat!mW>av!M*Y>)Xtu8m}eo%v^`KnxJ08|bGgUfYcjrJ%KwqQ(OcJdmMLJai=T~inS
zv>`Vp%<v!ZCVAZzlIrM8ZOVJGXL#0t`~BfIt3;1D@?#Nc6`RM>L&0lK&2yN26XXL|
zAJ0zj_@>!f23dsTcqIS+=Y90*^VVbC%RT+qmR|V3z7Bfd=tvTUG-iQFuc`#jlk~K<
zY);C^J<?Hm9>_Mlk!sK^tP(2jnC87poKmAHcN${hvH$i0D6UF#1xs_qPG~Y8kR}~w
zgL1t?Jm;$#Q`ciWhpWCc09G?$kc+~_g^A$cdn{o8)N-A+5`lp`zyo&><;YvB%>8kD
zbvJ(|C`iQHU-2}iVwMG9XiI>)f&rX8?e&Qrub=-4Hk$dO)2Uqa(O%~_=s=8C+HfqR
zpB#rT4->SsN$2Gjg=>tNJy*I3-_jmQSc3?5%OaC9iZnM8rkjRfpDp6^pF32I7_>a{
zkK}-ksTLD>ETbe2TJu1{9zT||l2YOk;_g~ALG+i{3>Hzc(*}^>iV?%BH%0jVh$boW
zalFv`O*Q?xxaBTLXNerFQ{eLV?Q7@UVf@sC+$OWwWuD(^KciYh|4K4MQjv+L{TH#V
zfl>t(#)&CS6@`&fA%`u9vV%WhfXh?4&o~DFlK#2;A|3Ga3RjI>1);ex<XLHe3r$NI
z&8KVXs{idgY7C4;c=QxHHhR7UV&&!NA$)p;eoEcCrtPBQt}BN5G-iPoW^1~ZJ0((t
z2H_i-l*N`N0u)AB?)Vs33}E{cRHa`-7<%C+!1*9-8_jF8`>G7PYZxi_-1FE+!cF(t
zjZ6T!jJmT?5*dRDNuFwI{19&+FZphR>HH>vaTAFy3-@3bsj!zvNsSm>MO_3bH<Rt;
z@#if-bc|R;bILt`!G{*?|Ly9IWoRJyeNTR;W1I1A_IhT_a`&b44JwY$8Wnm(6FNd^
zF6n}zUjvzlVF+fC&<I$Dn`L>TG!c%ZON|Y<lZ*Va1)+!vg)prXhl^T6zpbz*Qvi12
z!fz^dw|8DY$~+k}Wb<zT!9)+T87CZRaEuCvPmpu;xcvns>5?(D3RsLyT{_n@MI9;J
ztLjH1{o;|M$AP64fxSc%{R+8zf=p5)rIK)b$hoLXU{e^NqaT2O=BL;%R@mis8ZCwu
zN^MHf?S!n(t+L|m=Oss)c?*k~=Lr4pkSHyFOXPY@+?}?nATwKgbH1sOhZw}JL!Upt
z1R*`cFcHGl5w8N0>@DTi0PZMNj^a)4t0oo5k7siW367$7T5FS>B{q;38z9P7U>jNa
z=y*_=pQcs!WwwR~dvnJvWdnz0{beR#p3x7Y?2ImJ6de>?a@@@cA>3jL<u)aO!-4iZ
zls!zvj&{5oEyq>eK!L%?{0Gd=rn`M=W93QZxJ@id`t|4^OQ7FMFJXnkW>}cO+z0N~
zmBr>kx~cvn$`*!wop&u}qlXDS{3m?cp_GPR4i-<Eq@(i`D(wNH5*+IQA@6#kwI#JG
z=js)^_1PQHl8nNVEjAvD{T`4&W=6-G49NK9A|26!mq`U(fGl=uYH$g$G0Co(F+RU9
zZ2uU+au-vv=IX#+cC3%ArsK=hsNv1#{!lRYYEX~fa|lCtjY;<}m7%XG{vs8_j7wp5
z80QIuxc>z))`JAgSb6%g7T-dcKfO=@=hm<NCvY)Xr?yJm<VZASt*vj0)Ns-i`EMJD
z$nhuSDkm55&EWGY(YIoaZW8=^$U5@2Q6egj(G;ep^)e`KWUi)ac0KSbvfGHw&T*kq
zakRgjX);9m5MTb5?<9^VX$l9L3V8#PRiQlTo{){_4Nq=t7$GlANaORzufLVX29u-l
z!up{4;^3h;t4<_)Yz8b}J@x4Es1%kgpbZo#DC=m*8*GM!n`D4!X2;`NnsV88M>`R~
zH<lpb@&sF=!bX}K^PHQHIl)tj=_QAag{Db*RA%I62$;38Osz*yHQe<M${^w8iwKEo
zilUic(|U{joI@-rQk@r3m18%fz2qMX0r?CXe#U%D1;d3(eszWFs~H+x{UKnmf2sEX
z<?ZH429se?nG}kvR?uq&&6>+b{VTIn>2$0<!aio-7B$}(lUNJ9{T_eCAHE9h9Ak*V
z0YWfIOkOfb1sRbb<s8otJ%X<yPj1=1nkx%bo?_yy=BGzX=snqC8f-9Yl&j_@U2sK^
z<toBeq4Tq4N#NQyyY0G;am1Y|Cd-i7d4@&vo-)%FA;{{L3SpR+s=~h9j!4m5<$k8}
zRD{>a_^)+i^3LaSI57*sZl|r!J=gtZUR&+pxH*s~jyJ*-w$oxhLd2qNTs53i_q{-b
zGU|mtld@GVkXO1Bux#Whm+d0>2_>E{sLPJO=sXX7NnoRGOWhTwzxx_5_#-3!3^E2N
z+FvWN?m&9_*d}`!;;B*6XVG~xd?a!IR@N8L?ph4ABQoRo@)TMkz0j`x%unBz3CC$|
zV=vp(5N<s(S%}yhXn;fYWO!`TVCSKwcP+PRL>h7{ZkkitXP4r7ubSbD@VlwodyF3<
z<f3JQXqGc8%MA?~-~7pZ(e&8W-Ofx%xCg`r?=e_7C{tWh21nT*d1U#sJK}vL$QKjj
z7F8=u!Y8*v`fPsHrF1mqe-#CZS`$%);(u!1I#pP~8&i&vQL3cTr?5!2s*o1=1i9n5
z73O)ZqWJ;}DIicf(2(B@{aJD<$oX6CK(X_0z(7P088!92Edx1$;k4BZI}(T3LaxeI
zXKA8MxUx{nHfy0>S)6}4Sw}7ca;lA*Q<j|wkM)k-Vu+HYWn7*nfWEIbeDGeNVd>`@
zG(dVf59u9(IHFQAP2PI@y6rOC;XNSN=Ym$L&=KFQ_Y3!Ck3kL-gIa$ezKj*1Km63j
ze+93Y_NsxcGqHj3bN3lnzY#b{kQjgQX0P46Q8URhR7HP2QaETEedY0f6rFq%JiNnd
zIZOVAZP2qDE3P8F;U&2qKiM?d8({vAFZO7c){e5z(Y}QXlU{=O17dIC8a!K&h*^3p
z)f&*!kShjdk`fq16a0G8|HB5ymm^4MCF4Exie7%K?;L*-!}*%c+_hP<`k*SUmENzJ
zrLW4Pe(gX&O8j-WElLEI^`s<MP_ta0ScAc}H^xN|do&kQdu|cOZ}~N=JaO4E7A&C=
z?2ZHAMZN3~GNh;YR0Q{cW>MFzV`rN%jO*#$d21sO?O&u;lFzYAwqr8M!PO>ChHBc_
zg7f)Q@cFEjWlEJRj5#DcMWiqjx^?F<#Uy0gdmx97Q{kB$)M`BU(y?azvzHcj#h$cC
zg1=mes>SV|f9^KfZKai7&SBh6PtF0XDmJW(fT7p#h5c-=(k|6tT}7!5;-K9Jr52ui
zWhvMW<s_uh7fg<P^qlR=$<}N3>uinFmz^VlOSOi*^mMrHbGC!-$vcEI3?XGY{=Fe;
z$qcqV?-A#Zen-2Nxp&kGs75!edo~<M9GMI?x8|;gh4Dh4+z!|#E6BQem%Y)slzi|F
zQG2wGEFQQWVR4WP@6F3Nu2<TD6Be4!VGx{BX$GjbOeD&Yf~nMTHcG3H#a#1w$3Q3*
zi3}aza(POfTnnSKM<(`K7k-M|xq2X@`yl#elgo@Y(jp=0Y1Ed@N<TZ+Wv+zT!^d`o
zmBMrLGZ!Ulm!VjF1luxWNB^o#5@Wy*iY)tZ%-C*W<Z)4wd6;NN43+@G3FBH6vtz0Z
z(Fa#WGq{<;LiHrmFRk=NMmaKE7#1JX&w5@k`r(p2F-)`CV`Cq_k@-Zg7#T+u{Y0rp
znxRTSL`?vL;$p*WY9uDroAShUkU#S6)GI^tBd%2}198#tLJk4Cn{ck8TII8>+N-Al
zaY1YaHEmexi4YN4T7ph5CTi&-)w1TEh1oRTb3MMq;I391Q4`lQCIo7Wx{6bQw&Z@{
zFTc11yZX-Ydc^$lQ|x7;Jg+S0E$aO_T$Ku^Gxv|NY!!%BYN-MbHWOsxhzgxjuOGSX
z^e8mrvn0bvpCtrw^N-riRMvuORwDVk3{H=MBmjfrlPK<%t1i><2Lv?~y4eIKj$GFq
z=;+t6VwMWl?C1KHTRGxQ3rNYM!#!JGL3Oh5x64g+fOA@K+SAHH3U2}=L0f*nTkXIo
z@6{_KO%wiWz%Y)WC&}^eIL*w<a7Y?bNtifoB}&)nb<mNFA3cRhJ2K8dFVK(_<909H
zh%=m-wkkDEey}YyYk>wF<xMI(Btfq0pUKqa&?L%Jr3qC@=@W7tAv0fgwMToc-~RkY
zG32kf+nr}^4M<%2u=4!ZuI=VRJfnuz`)Q2~ut=|&RDICcn@&=4MB)775l&pqo7Ji<
zf~20l6lWIdBDY~V(km3gr_eaK?bM22!K>VnN5?3DYu+n)g&{PczyB=yc}98{mAt?K
z@eu#a$xF+kv~f@rK$MHsH?>m1!WgmZ!ghle^Dfl&@&<+ZD=H1YXieaxgi_;z7+W(?
z!5KO@^(*s>u%`=(OwCE>Q~Bh<Uou14?Z1D}r+>ImZA&sZ*q&3lEYtxzZ}GZ&d~kXg
zzt*<kkix$tvIXKkdxBVl6}R0}{)Ho&oz}6eieFTu7zKlH5L*!k1Kfac%cv(*pAaQ%
zlPVi33%%@n&m<3`7S$%qejYkP%YrBEwq9yg<(SWW-S(MrCzq@=g3OJkTme6+9VGaV
zn-_pOND4lE9^qxmUU$O?L@Egye3iV#nS&J}BdI2kH32es`+*m_@xr8HHsv}%t-0=7
z85}N#+c>~W9nIB1mpjjRmBt&yWmccJ{GgAWzEsI1l9SRx%_IBxF<~OA=IAd;d3Eb$
zOq07le(pk~6sEPD;1m8&OueuUFGrsFHw{*bzQ6gEb#M!loOSl~<({?Di&m!`^*N_^
zU3^;Ny_BTl#kS6IEgp}N*XswxH?kWwREa#$L-&2XaSy95FD7jwO8Rl-$CC}0H@>EX
ziy5Q9*MO*2nB-{yB4=Uwyy5rQJyorued)7i2MJF%mIO6R<Ed;82MUx3)g8sdP$2~c
zrrc&W<WGh3FL4s6Xznkc$xNgk%S3dF;cy6_?fMURW51EiQ=EZm%)pFAB~TWRZX!Cz
z)qFL|Gi%$<4&<*csW|N2iz>w?slzknLV5BNDv^kzs3B$dvU(3EY)~&A)!NTYSAXqh
zMow43Np#i!o>-((bN;BOdFRS*ec3tfqM4nAW`T}$=3T(0d1ovAyT01TTQ(UV>1TWb
z9$IwvQPiFhc@)(Q1z1eDd&gLuJMyjb@gS2v6PW;#YtHdvv>dK$L{bnc{7f9`!g)+#
zv8#t52%}=Mly(b@#6%COE!zxc7#2K$4)$`(K=Zd18?7<U07>yhIdDNCgs$}sh<!_~
zEZ(vu4(SRD_cz{>>tFs^aPBT)hMIa%cxrIu@LT(DRL7hMo+-z6F=!Ye!oLcM9damB
zOrWyt<#+7Bp4%c&OUN5UmU*oD*ZFTzIoFpM4d_U+Y=mrE`q`FPzL+z^I0ZkO@WjeF
zO0W#_?X3YU#Jc<TjEJh2f4&G!=*&znbX!_2K-z36@5)Ti5<n?YVy3x(ZhSIuqbT-Z
zL{loCI>Ka6R_|JcY?MvDdE8{%_{ry3KeF5+-Z(c_gD>MFdfRuuYgEj1*Du@~1(60J
zD<3YC2fr8AAZXqV_Wc?0I-p%D7k(HPpC^_HZ=r$@ZHUTLkvs>O*@V$$w})Hj&%)>J
z*VBut<sZCji{M@u`6;L=$oO7?43Hkn`p0!p3%+MsfUBlP*yEWjtCNw@(2OmPEBF$J
zb+2zxeKKNmcEUTVgY$}Un_K+Gf_=vWRfTsQ(kUrQGM(asm-*hYj_l-@g%jVgCmoGH
zp23bKb7A<l1}nXaAy`qRlUK@7aWe2qNYibjx&+^if3mxZ@10cjV+F0HYE`4#E@|io
zqEA5!D@`gh)3=&Yk3D3Tb)WkBVhJg8B-2n-aap~YK3}O(nfVALO`dz42G?ivdd5kf
zZz5eI<$Wd4%h)=hU5jHFXO@VJ5x=7!TvzuxuAh7(YXOym>g6aBlrK`js(z{QDCrD(
z(i;>J5%^5(<&_F3q-IBXWvXC}$|!s?9MG;0Q|zZTVd5LE0Y$!b#j6%a8P|B3kKT*E
zh_>xYztb?`vOoRhaO3*`-S(+q9H#{g?wTEB_HuP%DZq<qlXVR}k)ft@S}dFw_3`g=
zqJwvb=0W(=EmYu(lw0Z7eP!S=H2Znj%%)VI#Y&h_i_zqUWy7LwZCD7YoEqYvsOG%9
zNSCUo_C7<D1?9P_W1g13BFx%@TE7QH`RlT(_jw%9{oC3j)fG&~dOdUz3<@#&Os!=D
zlz#^>^*&{vG>=?V4X|+Sw0y0zL3IM)sYl-UK+4~A=^h;fCkM{|-=lmAMhyH4En8nW
z24D>bgsebKDvEv})*UNq?V@{f9)#~FZ!(l84qi21tN-Bbzm8I{o3twlCf<(I*w)9W
z{YmPvT+bD65FY_6DW)N(1jU+684yRt&`Nf7t8e$@VFxymkxrm%e(mMH7T=`gxKvZ<
znMqdmsodt%jIIG<v{PcOCj)HiM4HXR$Ck$!<?T)s?LEp%nRRPoqvZnWpeI0J@G0-5
z12`4BGwASFUrOe6+dL#B($v^;Hj%OjDp_e^&n#G8$oJj!cO=)m{Hq?93O5lBK?{yA
zB7UC3v<D;{SONYg8hy~rBp^e@R8Yybg_~Ih@-4Ha0M7HcsRs%--D@?~Z{NTsUAj+#
zv`-m%cZr3LFep8Zy%A(RLAN*+&+*Z<Aq2{=BqrPUcti`<MfPJqrI>|6BW6HR=6c$!
zt!lfmxra-&*ojXe>O#d=0u3jR`!d!7yHi9achJKe5*||dAxxXXBMbi-=0g!lNbaa=
zHokzhz{K<MH+p`GWK`Myei{Ol7G6n9_6%M_Nv(6Pe^Ez#r;#D<X`HJTv2+{#IcjTk
z=}ehaSU6+H=%jIeiWt_CiSJ1bf(R5sc;)VGfS@O|{r=RXfS<{X1!!>W@B)fdT!iIM
zK=;Ea6t}D7B1!=9y#2O=m_X+6w7(hD+B<JXHLodMGI*;}MFh{|jt8r<BcV)A#&ir!
zQ1%AGFO!-3MVLYp@AWKT6xbrwtqe~3e)bd%Fx~uQF-jF?K>Ui(N8LWfp+?!hH2~aG
ze0v+z>ZBv^wN$7AJr#n!^)XAXz1!kT36ydPkWkkzk~2t$USCBlTN%v^6H#5ZT*NEU
zP-}~RXH<*rTYbR~Z5$g$TEprha~OW%YoKaTazk9iYO|$}X%Im`FnBOjihrFeD!08s
zh1z-;StUb0g%tJ(hyYuz!`DI=&?e{N03;~`o&RZtuy8$Di=O$@UQ8WN%lKCh*X|o=
zahi~95YbYObWnov&2t;IJGmJTG8P5G2d;9UmI^D!F6onu88%A&f>}d^SBjV@*T|xY
zRqpk=Q_afu@K*mZ*AgB6Ov4p@JbA7qel288W1s{S!gaP9)ZnTLEB>*^UE_Jkl(y5&
zqzmv`^H<KvUM6U~)BZkrR@a)}v+bQIB2;3Vi(kZW_<~S5o`jW;Bo>Cy?C~j3W!oJS
z-}n-sNiQ6!be926vE>%$688>le#utL^w|}5yC)+cG6L&Jnz>A3sjV-Z=?X2d#>(BA
zjb$TKlKGSoocWv4$tLld%PYr&qJv~PV#z$it@-0GTHdaiQJnBb3}R`R0zJ*x{X62E
z`{3mZtLOsHzpY&gvf<3=bJ<_$4lsJ771iY!h@rm7MU-?kiCC`OIN`)ODI*wLW1(RZ
zYP>z4IciZOtq8bblK(U)P}DhGFPV>oQgduw1|T$E9fuKdxjY<?<q|h2g2f+bZ>r5v
z(AGU}MwT1)Gjf4&?@PTI^l>A-(51!As$6AHzZNA+HHWLVM@=~Q{fGjM$RWpnOujQm
zz0gCPOdM$M)@HUJ2DxY9TKkn!OsI&e&;n@K=vW7uu#UE`n0Un-LZkaMBQbbi!ZZZ}
zJG`)}z&d;a=n>MDta2DC91qlR>_CWA=Yb!eh0jslkktja7bF0~O{ly72GGimU>pc2
zA4|G5Q0_10kPAgE`!8C2)2&Gtxl7IYNV)T6S&6NkJ#X6>W2^TttjZq62x7PUd5b=J
z<n_KvAj91{e;<yPNA1a?D)huTFVQrNP<PWv`WZIXd!pwCGNcn<$80NdgLbnj$kdI^
zEnLIB`!A!02~RkIsgg^0YranR&H!u6^B)z`v?6joA#g_Xkjk_rH*+g|73t9UQtWW%
zH)Xd{N}pS3BldJBeG5Sx)r+lh^f*RWSTJ37(y`>bs*z`s7bgT~Ao``N>;#A&5l2vD
zDNA>Hp6vdSEqftYxW`+|lM;HK+z$OF|5>51`RuZzh9T2LYg$;g^a?<Lowo`IH&*od
z8B+Duds;tN0GL<@w#7Y;nm+TC0C75{8j_Rv;Ov5F@Rpq)?GO4Zy3#RFv@{WUCR%CR
zi=wyEpL3r0c-l47_O-yQt2TqPI0T;GSXQ4Wj=Ou8$FD(}aQ`R}A*GvRIr1V33KO@<
zJN&M4-vLwkBHfwjNtD24N0c2jJWb_ujs_odXyh#nP~2iXI#+|1)kaXuXji~%6rDQM
zXYLdG1;n8xc+~S1NYL||K`NFr{iFT=Fgn37AT%v$eHFBPQPSGcl=2rN48sR*#@pd@
zIp<(2ov1t#`>)UqImbZ_!<#6HUm@s(TZ?-DtD_tWS{8Z-@Eoi_fYw5t$a2Dn9e7~!
z9Xkg0ydS<9Tu2nDNEp^1YjVNV|7q|!oy+(+IeI|quci%slG5~PMX%#e5CU{^JhcS3
z{rU|AazC|6s{R*s=_=y^8?G2;vUzZ7NkIvFj7m|SxdKS7P3WzmKqke7m3ax2IQ&ZT
z5fYLtDDNy>eHgHz9sK$C2`K5CO0*&|q$n0+hj0OmDi&v2V6z@3x=~^|Q5({)Hw<A{
z@X8bf0+I3}6`_UM!8_tU%sv))Ni6oUg0`23AwIY_5o#V;qL|iz>QerjU!4Qu8?+EN
zzUi=9B0UY-nBrcX)hVDn@g*!OSLWCUQuP-Y^myYmzhZ(QL&e6!zET_fORVu5uvS=3
zEXUtp6nvDS0#QGe&i7uX;tm|#11F$>37dFxnQCS(A=+fYfH3(+jX^H%6R629@k=$M
zMwom;HwuU@U~j)jK6nx_tb#7Q3a{UkTynD+knf+8F#&AP$kN-V4oikqjBfkfA{>cc
zh%uR-M4f3+WMp`+fjBY(r4CXbaRW(C-#C8!A|2~zB1Oak(|oZ!NR{-pV{!0i{J5}U
zE7A-%aj}kvC8euHn3zX@c?kk=eZ_GyxP%w=yrNM?j~bq?2o3z|R+QOM)WoJWe@ub@
zna0<}E0$L!X1{7o8q-PpxMn^VmVaqQ%jdd&p~=R<R;4nN0@hOB+xp0te;928Vi!e@
z;z8N$53AXQpN^t7-Pgy94}1+HNxp)Z&@OdANUx~>I~cA<*Oq@K_`H{~LauD@;jba6
zv?Ih$pG7GGwx@Wryo0R8u9-HYo`iJ#NGn_ei9U@B3t`a~WhPsIC!dyXYV5YWRj|GN
z(+JB}wNpAcsq~lIs%uT-_sVb6(Z&ik?hK#xah&L@X2c*Ei~V}Vb;%_rNd8iq5<&Rg
z-h9zkf45I2Dl2G2iy#T?Q%bxBrIu0Z>P8Iu6VJJzg;(WyXEhvZvWKBtqtfyyp7leK
z3O4g7k2U-!z{;^IEAf2u7oV=66b|JhYJ8=tF4%sL4k1wVf?-ixMs86FvN9UEmm;*-
zkeqJYL>tA?BavXjFQZ)b!or;4%_kCzG{_2I^Sz-52;QdEN(M>9A`&^7+D3+*Z6X!~
zieSCR29^O`JfSEy(sr2k-JB_<@0$OCHU(ADtHaQr`#Vi|<c?}0Su3p7pqmkasLX5^
zyiS`=l}D4N2E<2ub~9j+WuXDxM(CyK(aL*Tg{-9~$>W<;ayJQEH4Z;c20@PvQMkaF
zt%4OFj?5yJ2v>eU-!hV_7{8sLOhX9pDR5|0f?FefF$Zhe!_Gw)#q7);q`(t@rAEz>
z{<IHyhwxeoRF!sUuXP{{aau<e5|j@vPUaLMeAJH)%aDpkqv?<eHhs(lwTni!ykOog
zK7hxeB04|WkKkd(R}f1{#l+nlkO|4;3?y>JSbB=(fQ!U3feNv+WyUo5NHGQuejnOC
z%cg!p?9`9Jw1pZy-$EU|Ed|o3<1H{QWIi+5z$V`58_D(FKhU6QSs!afQF06S1V@^s
zMf<pSH{TRC_g+&brKE`B2!EmFOJvo<#vj(dPljWM0cIBy6%@Re0V!Wz`)nTvBr>JW
z_BfFeLQiCx<mj=5;&$%!`C|_pz2rU%eE<n#_3DuW!ifdnn%!1Msn(6$c71b?`~Hr7
z|9dNRE)}1(xU~^jruDl!IJq~_jP!~c^Yraec5;yR;s>W7MurKP9jVI$b?6Q-8acWI
zN=7;|x6RD*07~z%#9GkGs)JAzx^hWNc_o!O)=(Rf39_389&*qAhho$@h*}Q6IRwyB
z*9wo}qR2n+5Hy?lFYUhli>uetg37LjYSzukMJ6VfYl}$ubdw$CUx>bx<AL={ceUjm
z=~tMrH9RiM1>*%R*06n$D*BizqkpP<k+m%kO@xd*(kGQ-E_sUfQ^-u(AO>mbTO`(k
z?KT|ADsbW~s10YT`iEr}w)@WTMT-YgKzXgi#4>bmWIXbJ2`}9wk(wdk;XJX8DQX&?
zl5h+L)zP6v{L;CfVD6F!;ZvP{9+WYLI;5PWp^D}q)?9fU0AGM|+FL*{V{kC96z-X7
z=oGsjz8a_)Xd)$qnD27p7A^NnV<C)%$+o_K+y_ywE*KOuBFR@xw&a0vIU1hbM=cF)
zm92`nqT3#8sol0Fc^b|P<1e;gFUTu=l$q#O%7BvWV8p{;GaPGd>0>N(!+2Fr_W2vb
z*saGc7fB|9;2jXhBZ|uOw}UvHXh>!C941j!2p^`LC^_jmmZM8nn~T0dJ?B^`9ARs7
zOQh1!YF5!qhC|soCV0Sc8Qald#SI_Co13%&JPQqxFS+imB=J7b2&m0scN-N5NX0SK
zT#TY6lfmU>QTIt49e2HVdk8Mcl%O*AEN~s|b-7?N=??W|@a#|x!%U`YU$H%oPZr)A
zyJBZbtE46nmi$3&9ri*f!B=gT(M2nt<=+FjTCI`i7B}jB#X%SQSH{y0yADtV;~|pK
zr{t`bnVE(GU3UJ8(vy9L@aHjJz+a$C#(1|o*Or1lW!Oec7`Zz>9F}ac1>D6r96ub&
zwej_eRGEoA<%Stt1Qsb-74HL9ssRZ5A_4_nz5qDjZMwAJ#iOyCgFgF|w3S?h2)xAr
zi8~UHBx>CTS^)w-#k0E#yZB?k;v{GncYtD>uE@!H{n`rIfD^6cYBn1<mWKSTAsg0%
z$HKwiCI$_iN{Cwr#dEt}q;b{Uf+ovCpk#oO2KgS1*oaZ6F27@)WRV;_h=Fx(zb;uF
z;lJe2gWJR~A5`o_Dx~21L?k5SfM9`saP@J2e0+G*E;Fu{u{nFtu5^3%+5t7TP;LuR
ztCZiH00~q#HOqedOw4$Tpq=f#izn$szKl>t5~0dEQOUcy-_V<{7;z$J^-aH7SH}+B
z+|kO?s1~~~LWKgB%T)CitiSXLcq+5-rd$mwMKkKW-agwx+W4Nn&WD^BM%h<}F82wY
zQ?0CmaX1no;6!u3fJphBCWF@k%Y{{+{bJmiw&3-1zSsTdtUEF_W;Yc=%xTRs-q^;J
zB|AMb$MY~QGzO^Fmg2v@z&p)vV>HlL$SSVJ>~L$CbUkwY!X`o;p@tc;_d{mJ*7Y#d
zB*0n`Jy>b)`!oO@U%Mz&-%?heCSr`=844z>Ox~|wVkL?Dn8dGjERKCp%(>JLYRxyj
zDysSEaVhw=bZE>u8(i*Ryn4alZvf?d^S7|$?}8uDzc}FmK9^<w#fG~wuoy=bIvRrg
ze?uZN%w7@NHfgtM)$?ZSWdD>BikSGS5T-K;x4Zw}LO5W;4g^|S=?U-oxsVE$W!GF`
ztVA0`MzNJ};a>-%2UGgq2u)4@xHI%|Z6F?N6i-e2=U@JD<6Ox=BW8N@GKCUZwB&qM
z$$5&mRYWFeX#yVq(49xWO5yeYehzr#2hxjxpM(m8kcu8>VDIK81Ev}NT=Y%<ADtrD
z*%4q}eg5z;>;P_l^GY7G&ic9&g-jVDbnrp-*_uZdK`KYsV}PV?HoFpta0afZAuOAp
z^Up#3-^2Sq{v@Uflm_=nJeORS;|1*2(^W679AHkfu;bu`tF@lmKkxhhekcF@w)Y{I
zXJ<aJU1QY&uBK}Xt#I>|fbJUzdTLq0>9tD#^Tqu8dlPwvfRqmON6EFzV_^Sk1O3lQ
zb<aXA6=6Oy%%u(X&%O#t{`1oR{>C0C>4TgOW=uQq*kid7-wO(~6m5Y12VI0`Ku`pQ
zFayYO4=tu3=HjEF|NJ(GDS;NDDzZ>D-|50kROr=zenSN2v2bE@BR~`?GyC(u&^UQL
z1gf@$0EPcprvy}O&qNLjD=Wvs6eEHz&i?&4{qx%lC(uHocy7?_uS5Lbzpy{PZJ|O_
zIw}NK=wXWfs|S7m`9BoFL?9<8_bpN+SIt-0`?_=`B>rEFB_Qm#DLzPl5IFznzi5A=
zg+#m^34E)G1k?YI-RFNSkN@$}pXSfe1YV4rH(CGV%YXAxsS<7}KeGG&$i;a;^)U3`
z{PKSa$wUy5VX8PF8UV9pcsAj`(5QK#_d`7<*#*xDpx^Rqy%hTL|ML~-gMf*@xxEb>
zf7z||{tK1bHcXDn`a$8p5WSMpiELT`w^-0ggrKhUzjzsExS)v!&!rlrOg@a!`L6@y
z-~TCsVDodD*Y>;Bhu2#F{+Iv9w<6w1K;=m(m|py!U&{X}sP?_cz6kuk51;?n{LUcq
z1^OE>hD3bns&Osj7YmrqO~0k;&PHz9+=m(nCn+jLf9bDHwD<6BeBHhh`j20Yuc7Z>
zzWav6_xsHvX3l1H7x%yTu@4KvSTQKY@I-wAbn#Ieot50!n8=YIu04vSDLB>5;bjaP
zeJK)#`Wi0xl|`1+0rx3^6azK2;O`Up&jWJ<b06mi1+b^)+&2bOZ{`Pr_-;}UF7@)K
z9(m=HV=LfYA>pUG$}Khds+Af#l8&qyS!#UY;WHUbIs9~lDhFV3_@^yMpW*QJ5&pvu
zBp>1Ug-m*8(i|S`UCjnJeg77x;l59QKP=)(lOK$$a!IgEPNm0h=9HyyrafH7Dp;s;
zG-`a2^k!5(MAGy>y~;msM#>q9hL(2fh;eRig5Vp~{V<%C_YS+K=Nk66tJ!2-%XI@L
z50&r7Yd!LwTF!Y**59JF=MgM9g`fYoPxi+(i;+~SSH^%Zodq!Ft8%}1hmJ+GHu|y5
z<j2QAtr{z7;J%*^deT2xN*w(;+!|xx(6T``0J(p7yXPF3rE5v2IP%j{;WD7HG}JA8
zEj%_OGgUY%@+?_3(u#HKA&wsAe?HLv8Um3ld>2M8rb3NNq!CsB2bdpq4vl395enLa
zu`4fs5PbOY7Bz)c@Vo5TkWJ3QK1FsJgYw{@T;&rFmEd1!@M@LY)fOH<?@lGIdRNU4
zGMtWR|9{*A96mb@4k2NjTc9F2)FA_Olq8mi)azE+ETr++%%|w&%f8<@!t#=PSo$to
z{8jDPr!uPIlUni1oCm&(h3+R#T-WXMY7H6R9RgHtE@S@tSqBD#0ikg6=*QF)-_%?h
z0YRNmqsx(K<7)RSB!o7-;ipUcT(@m(4uUP=hL5VpBncla;Y)~IeV=9h%5^%Ic6y|J
zpfpcbe~PmH<zM3poAiYrTaZiNRxPbMwHb-nW_WbGWF}&gXVt9u(S2dr@QhM*4f!zV
zKUf~VTra35(9@~BMtH{8WP9UhH)MO?O7E7pi<5lEzvDHZP2_fHxj^VV)9p~d%t`gm
zHO#dzj2hY;&^r4u^+Wo5csl1lr)$o0gdIhzY(96d40pu_>!d{YK|ijBHTqNCh)JHa
z4Tb;X8U9}%hVk^5#+XT2JVu+IWu;4^l~3(a=_R?nL;P|sAQHotZRlKK0E|Kvi7D{v
zYV~Xwkd@SB;^|P_-5(G3z5&lHh3d<Y$(>p|C5tt(f0m;5%{D#&qr3ahbtM9&hcnCf
zeVk94lDh0xZ|irR*9UR(31f!r5B<5Hpgpxc6ouP^-p0PW3W^S|6vVX9i|#$Vrf=18
zh5LKc2^DWqNjcsS^Ez!2{!m0XBr{M{_jHocmF({yz#h(*>m^*5Ad82aWBcn%f|J3(
z+R2sSjjGjctn2OLr*1?<1eKf=LwH~t$nUp05NXtQ&WoY+5Dk34kwAAeF68xrx=b6%
zs`mFyfE&+{EVry__*6_-+Oz3>v9zX4F3|p(DY~7SaNt9J7V68FO;2id>DT%wg_vJh
zTdt{n|JQ8w!SyA7ge@~NR=Kz#F|%^r#x3i_=;c-{nq5a>S$+@rUz@<`eRXe7UNK!L
zSEt@SCOP@>M5$hSh1t-%^Iv26iesP&XisNnU=pv*yBa+a5xBjXTE%Z!>w~Guq#zEx
zN*3fekV-(h`+cH#d~}ov6ru_C>vEp=_oC95pobfd%$W1mXy8xdt>ZVJ%ULZ?lfGBk
zABbg#&kN*XOt9kLUbNmw6MqrjwW-oO5YLC!7nslYyM1?g4CZ;L+~T&s{<PO|AzAhN
zx!KkD?vZ5@tQ71F&RRbPGamQr0t?+rPi3pc%QKO04j0I88Xn1c!7m+Oe0vQ~zkMj7
z&>J)1L9_lbwTXa?NW5CsEE{SPaqoS#awmEEgxzn}o?m6dt$rYll3%ogIK1<<xy{cW
z0~`Z4VWM<#$t>Y;raH6C_zC+Sp>;12)a4Vdl--v+7U>#SjN#d-^<VA3-=Cmrc`n9y
z+`XIASxpNT9%4a|?MRIg9YH+WYkq~em8M6`2W^m`dk9tTq!}ESnKk>AMI7p~Ud0`o
z3o-d#_-ggw-O&1#xx@vH#ZH?`jT{vk8r9tqFrypwN5SqH8j8XxWzeZ(=QbbqsW2TN
zJ>Ucm)gQmU`7WWWtGoK7sEUB)b+qMViL`iF$NdHN3BUU}%UqMEc9-?+++3mgNS6I9
z=ql0a{?&u(&)w6Q3_)30nZ-k;HaSpn<cS|`oB51CK9_E6^>@5OktOM2BSX-f`N{D{
zzr2yqu9%><W6thiq3W;f^(4F~8w`F$XNo|TPcp2hCuO6I9LV7tr+BSN+x|m8gpByV
zk8D_@zuq0<R}J#X^%3pu4;kwHb4?Y-z`azY{6d;opgJ?|j63m6S+LbeLPBCRiTkbj
zP?})CM&7{4NX&HgTgiillgO_wMpG3gD#J)I<Ddbn9Ckvfn3$Nw@#+tUlXZDUq(q3F
zp`V}UH~OUrk|3YvW?@WXb`jkJV0JG8o0*P3v2d5#0w1n5<jEz9=E}s$IKE#+<AB#j
z6TvuYO?g}4euk&H<sal)prjy~D6*Qwef==L(JWoL*7fHXta>jO3rn4mPRr)1=_Oa&
zC#}|q%V?7Bm-hKO?E>tSRaOd4v1q+m??}R04!S8+@9ENxlOAi>W=7DmbT@T<ZItc1
z5Xiw3ZE<kW5PzfL1&@0=rJ{H(3u)QnezhTYDxT~&e!qwCO*FRRc4&Ak19gj-H%rwZ
zn|eF4j_TvR=&D_^L^mpP1hmo3mxG;XdRZ}CwR^gL^?gVMbf7_|`>Q}gb1+K&s|*^`
zj`(0UWTg$wk#y_1#~Zn&ZbWfLudnT{yx6%(+?AcK9F0ke^yXhTm~6eCf8>qe9e#7w
zS)uKqhnjXuO7_9@wv<8r+;(y%b$6zXR(JFv^`Jj-AD!$mIxb5mqvmDot_`w~0V!44
z+n=mj&0d1YC@9@Y&+uA=t~Y6mKsW0W&v+gIkIU$I7ERFv);D1j1Hk#==?4QHfhbx2
z_v;wXUYGeq8yijcCa@{O4u3R@yqinzKPMqOyeh)(<!P9d#3P~14|DbOwdUhn>Qyt$
zZobynrlAKr9YjKfu4>P8<4sQ~<OYf+mX4j#!(4u^E82*f{v5^%EHV9PfhAj$k2>k`
zdrw|dLjOg&p<1E&_Ui`v$39&4G_vr4T=r-J@_+8eQicc&Ha{)4;A9HMK5cO={XTVH
z2t;FYN68!m4LZb8GcpO8H9p|5Gb?4lfhNU@54QIgn%OR>XOu(bSA$*&m!PHFMos}{
zZ^=s(6ckcHw<>{PCk(Gaq-9aK`2Lgi0a`shz3qi&VOJNIj<rMMt((me+9Y9bAz1JQ
zN+K^3IV)*jR`_gudV=QL+Go>O&54BhsHs>6E79<w`Q+VMNYIxCF&xneZacdX1@s-8
zy7xIhgI4LDa6}v|OCW0HTOH%!HAWu>)~xi|S5zsxtquOnRTN?N5RGze6xeK+a6RP@
z|1ue%_$aV_4CVdTv39ei*s0dY#YGKqRQcl#+nn!SnN`Y=XPMZfFXb76EvBt-g_b@q
zU!|Jgj~}lZclrKEIYjH8KShgK&S9q(ve5bwH;EbkOb81z3eS^OI#b<ism#m8R6H4p
ziNyn9Y1P`B!kY%!W2wy!WHpG@?t=8{grf8ze5I(=(@{4Rqm_?hV%1RvF63C*7WjYg
zxBoH|YasFFKe}sdWLXMjDj(AK3eSbmJxuR^zamKTsioB)#o}nW^LV*fz4$44+TuA<
zaNa;NZ{OKdo!ICel?E5PWU9cxz!6|{W+KozF`@o+i)s)L507SrRSM!iCZU7xvPgCY
zltVHo)*V(!ToyEMzQyR&Sd2YooNfE&vfiJ_Gw_L@<Bv#1r0Z!*TmGvH;cWDD-BH<N
zucLsx6g|a0o88<);L~^?A;q+W|J0IRMQ(c1LT=0rGs|9Fw)bbK7rX!!evc0l3o^lT
zDy$~sKd06(^{|7N^S4dwIb^Yo;n&IYCBxBoO|D@Gq6lkEVSzGZO)rX#&MF<-<DY47
zZlrt1&+$9$5*I&t^iq~tqa->~VH0TyA4zH2RQeLh7abuq7>gW_WT<om*wVfL4d6#8
z28R;=NOGv+@Xdwy&~M$JMb8uFRy6Hs%Q@G)=W!oNk=GqB31hzHdQ#IPa*^Rs7Za$s
zb(oj8B>S9DsMU2n8t0M#N0hSBRQ__@qD$TH1S>#P7>k8ORt_bhe5Ckbm`S+;>w!^n
zS8OitOKE=VO7+VCqeW8gB|+Z3rJ#-Y0L9JIGs=0clUkIDd%PvoiKRH&SW^A-18nno
zBAYAws|~sWNBNoF^@>AjT)8yKSZXWCHUcv01+)(Oh2VgH?1HTqyNU0pg2DTdjCz<!
zuJuaa$HqtzURP5xPa+~AI(loNNBAL>zCJ#1ThT}tIT~NIl);e@@u2NIQ!IEC#3uzZ
zaZJyB`wILM9|5;me(Tvf<)<xFKUfqgj9NL6)NMak)Yj%xdR@MVZ{g&O9a#q~-=Iix
zeu=f-xKC|NWTi>@`Sif0L;=0%@O61s)7$Lrp{T!u&)1iy+k(-!fr`{I2342aSV?XM
zf`V9>G8GF!IRrw5()@go(GBu%Bb#3v8O?ZJRVPw{_Yp!5PbAcdPe$1VJKlPzkS5cA
zNg(nnNXHg?mP)+UI-Ga$^H=MpyTx42xB2!V|Ke>;<Ov_nCMequp^}8kC-dYAd0u}e
zHv(PO9j;F;M7wBuoh|&Wz+mr8e#sWTyA+F@$(F=+0~Ec1G=JwmlU<SRC&Lc2;@=$D
zUdQW6k~lR!sHLwHIy3*6VCrq$s1rL+yk+qCVftwM8#&>h8Q|p?Vn*_PDO$@=_m|n$
z&7oVumzin2S9j2?s}`O8r4vGSMmp&G(Ge%p0e@{}{c~(oCCGc$(IwNZ@q1O&sZBYo
z!Itt_vJWi*RW!Gujc&8&L)d5x){4#rdS>1V8(wcrqdG0hm*1l4!CQPsNr8%PY9HSv
z+mi*nAN}DP$LM_ineDpTY|eY1#1p~`9Wk!NnVn!YVyPQDmyg_F@sPpl^}u=>&5l5?
zkdndoejSG_l}f}<wbVkD=INtHkFM`-4&<G8n$kFof*igF(W)*qc^aL$UY|0a?fg`H
zmkxDgies_3wHdB78_F5uz#F6LDpD`jD6z{|OjiIkg>2q=7yk#?6l8COZT>D2WT3XV
zMh7aEnj3R1sVcdkR^Pv6+B@OPpU0Ly|4i0K&wUj}k-OQFLdmFzHS;`a+)n!JGPA5#
zLJ1*J2l+i;SU(FJ)Ri;jol9`EJB6gB+DKrKGmG3{;@J*Gdh@Mc{QhyS>hfowMO00q
z{ef-1EpPdgUed$)sCJ9j-J%kSrYn>4xy9I`o8Y_66{0JQ1Rlo~PpJD2a-%A5LcjT&
zs`lVW9XACt8x-ZilJn>8<~j*&hPoVUOp&@?td&35dorAm3w7&vgN_bY>wDz3Ykz%e
zYt!rH(`TL3%8`n5zc1btzZu3t?#vQ2?T=l|9Sp5U36vPc{!SU@PQXwy@P6#WzBopL
zzbkEBPzLYia+*3$F2+1jYYsLksTqVA3s2E0-Ajh~TqtK}IZgOsSWec}bJc;5nifhk
ze#e5Dd&Oxt$S;TezRaK2E@D5v-=%Rcck%5XuU6Itp*HIhOQxHax7r2y0ZFW>NZ0du
z#k4k>Mq_Gvw?;J{O(NWlVV?JG^j5*h0;Iiso5*jXk?YTz>D96_@CSBr+m#}sd`M-U
zr!}AWHHg;-`0<e!mS_`^QdLkCCxnn+s&@aK|L0I3aGN@0+$ehB2~g9ysUUh*Z=fX6
z-euNrut?EM*r<HB@|vx+p?pzgY-UC;Yri&>zOY;V>Z?vBV1@PGGN=cCkeuj8OLy9z
zl?E#<dv`KV{_*zYmt<%F<ruCn3O2=XZyfU)Ve9Dq<QMHK5dM7gx`k4UXcs6^TmCAe
z=C+yF`R29t1{yil<oR9TDFpIaKtQ0tbRcOwOZ?#$@%q7mB5-+NjeDl8K><`h2;a?N
zF>SwF99suAQW7rC{&Y2SrX0NA1n;|9s(wzJ`3ALmdz0<i`by=k`tV0=y~l9Gh=XQ?
zOlnH)KP3AtTK$j-C@5GreCl7nt;<XIx|Vhlv(-W#RrO0aPx;*Ei-@ub%pIs>%YR?4
zL>1~bx&`&UFy-8*tO!;9$_AcWt;$^4a;hTNw>k5qm>w4w7giqP%ZrMNVrf<?(|;ja
zj~YTg5O?+6{o*SNwcX9Rb(>&UJuH8C^WBNZ6J8&R?Uj0oG>=b%a<n6nFM!C%@FZ-u
zW4htB5WQ>GyNDAd_wsd>FEb50RTsOQq*n?Cq%4yiXx0pRTzC2I_VTrMFD<6uuQP%S
zkL{-fgR*+1F%RQwpNE7=`8KGx4#QEA56zg!w52)-7r8iP`sovXJX%Y>bCuh9xj<^z
z$R}4aQMNAZz~RF>>nqZx`z_34{u@;s-j0a&^xesj`H_>})Y-z@A+)vXu(ct%clFsu
z4;U&<v?vbKi-#<JDCm*6qhf_;9q((dCfQ}YzRwEytXt{mc{#^J31xW6MC~``{WF`K
zhMKHZtH!~AK56pV`LybRN5iu{{9*L;Lw7#CI;zYqJ}QInU;{N2btzrBSROtNBU*V@
z88C*o%zvdMs(>0<H9)j9#!oZopwr+?oyJ6ONcCO(>iO6L_1iZ32Q7kge|rI>;B%z%
zsIq=SRV8`(y6r<O6n%r~H`cQA^6&@r=aX5f*}1S2m+31(f=kx9PE_D~Ttj90cSxhD
z!I{e!+}H07q;5p3u3KoQ-PaR8d^xkC;13G@tZk$`X%lZ-aV=SAzx3YbUTx)m=*ikf
z<T;dzL7TC6=$3K$O-LcyYQ=A|4tvjqenrjxShn#<-;EIbSHE{Zuowl`eaRhS?O5!^
zgwU>(hG;KW&Q(!6efJm=gF4eob&<=4U)a+{m5eL){}Ah-l25+Y_Jz#Ge%-HHTj*Y1
zz&~n2kNv48F-!SdcVZ;g`BtsN3%B^xmGmjHldVwkt3h$BIpw;@LX}V3jfQ=mVq0A%
zH0z$P`xiE(KYx&X#k4J#y0exSM3~h*IXI`2g6CNh_szd@61{aZY9(rGpB6W`e~rrM
z8zuKZ{^Orj+!`gRl)`2Rg@JH*RbIDeub4p8K9DA;?W|?{RkzAKhCuR*W~D@zf&;%L
zkEl}M8SSJJNRID>A59j8M6{64q=ZOwrg*q5wITaSp)U-4)on~7BQxaZExLR-xxnyn
zDB`awpAQ`ZDBXzDXQQQ?>iv$8NYgUeYK$?z`KWpsAdS5}p1OWPnQDHb*drn?B*f_N
z-`=_GkXqn>*CNa^X^S(oo2I5PY5Q}(!*Dm;q?Yj|(nI;jB_;PzN)gnM&swjNwRb()
zH%Q5Gx*c#I_S_g!lpXO{Po+E$g%fpU`pD~M@PSIEdu!zU9;f^_o!>*ObB?0NAthco
z4<(Hmmg<(TzMv>Qd!`1q0H_(Lm~0NMC>p~d=u9`IeTv6qFc9G~?zAR(+4aD9Lp=1p
zgSISSGEYO{x<;}5^@~V&*>@v0-M_Q>L(?Hx2uxf^o(7roIUkP<?^1BSx0(vFKT$a!
zqwvSX>C5c!`*J?H-Be3374_(#Y1k8+rlr=@mNDBWr2ZxVF2cR^ll?nk)R|KrXw8=1
z*YEVm?x>;%DX$gI)rE1!NvpRbF@_D2x6TqDt`@9Z{Z&3yNrOvCO!AzgZN=vx6x^zp
z%A6(do$t)0u5;cVXJpcA5|IDQ-nyL$_OyBe(a+N@J80=tNj^$QtqtECckm*)-$=d|
zq;{6VN20O?o(l~r%rCi6J4C6Br{xxSErsWq8G=zaIL3l5uqreV5fLqVqNz`TB|;yo
z%&&k)J*MIs#g-t+OV|jmLqnhx78b7VI}D-XLQ=uG&0O+?T8uvNYr*z4{Qb`S%>dP+
z7}eCsi1NOe?W`8R_niQU+~l3w52Vg_N2D<rTV>q`B_c>iK>C6?b}&(#K)`JvCM6X@
z01*ud2--C(lRzwHee+ET1of+L&uAGKLYjUb%Q9xQ@tnD1<(cE8%O^e;4@-ijnCJU*
zvV93`3A^QJD`LZWq#Y(TsQqf*z+wR*&^?W-q)%>$y(#=LraAe^_hC^;F_pmzP(yAu
zJ{Un`yFAwZ&dNjHKKeFxQY=)kN_Sb-D}>>cbk_JV*Wu!dcT-ybWeKaT8y{DrpKU{=
z9om&sF}D28T9W|QOw?A%6?MpKXa<CvP!!><JfHjL9cO1(O#AT;6feGQ#dL4)zG3pW
z8YRplRL3HW^kZyGD-}W=zaYW7#ngD_HS+Ab?%QW8)?5BQ8kY|1$xP!mG5G|)TewmD
zo~SBk&@GMav=2U{epw*C!K+;`MdRW3o@`n2jj7%zvF%P_SQ@I2%8;;k9w+)mKD%%9
z8TH42aGdG>d&1nPm&e*VNpwq}!k9bh(h3GKTb~MbQ=LDz4hg0y#1WNHg^z~P8|uI6
zBxb-24s!Q6`d$>2`SJR_Wa{QrxRfRT8TuP{92VZffR}`i0vHHcb)|MIC#lA_*>8(>
zYh2|>vICSFji}W`NA-^o6rTT3pFuHv)xoSj=Cx1L#lMqHgVdT@Q`k(1lQ+r6Hme(O
z*;BQ2-E^QQ+9gr0Sbvvz-o7(5LqN5bWWMA1ooe|Ld0uCSQ1wYyy|8C7T!dF`Sq%H|
z|KjW|!{X|qG|_|*sDj`Gf=h6RK=8r|?(Xgo+}$O(6I_G4y9IZGySoL~Ir*fgr)TCq
zx94}kQ+4*)ves)G*vsq~FyZ?kpwx3G%w55$ba=*r=u`A;`UUj3hiN2r{oW!T9wwg}
z;a6aY2%L?bUF?ZW2%{H?*S8Oh{AIOk#PKY}S6e#(VIsb3SwdM^H*Kz>oP&!WBLy@`
zd9wlaf48&%$$|U_GDoM1D(wH^o$s2qf^Tj`AVL20m2Ak6wEnD6BYMN$w0Fj!@v}L(
zEIjFDw{O+g;>YRSs^Z~k4X-(A4v_BZV<h)C4L`!DBJPcrngU@R>n7`wLRl`HWzP@%
z>e5_9G;)ez#Q;n|1PT?>EIugXSGkJ$942%blLnE?4H(7_c2*DwG@Y_Z%zXt9uS#Pw
zQK4gTwQY#Skbarf-16DsTizFO_+LO(%1vISyo$k}Zq{2Z=ZPXxM!FO=z9z-IISb3w
z!6Y8XYC?8G1TA6B!v6{(Y>zPw9)~s#r33GL6VHXK%7!R+ko@NoDQ+gl=~+B+E^e3U
z;a*87jJSD4A*rtw$VB17I)7q=%|NA-$RgJIyBf_2iZ4}v3;)kbTFJL~<MsZa7#%+C
zFAWw%i{KlNvi>GNjAGBbqszm7ra+>R<pO_D2J)F1T^n1+TtDa`*U)oc4+dqW=n2WR
zZ=it5q+ZwAboq#`d+QebH<Xo2;bY@9TwwU+Gl>aeU2wX!@5<F`PT}!}kuf4sNMa&p
za<vX?+U?dr?EYk)xI(R&BEZ7M>DCvXflt_x<2&BMjIvt?Plk%TgT08g=i{X=>U`T-
z2+l*(oku!Hg6f?u(~Rv(Xtdi!P4!mrqc9!M<hy8v>SGMHwoWZCr+)$xYibOKFn+O&
zc9G)-zgq-KR`H-Jx0{m*;Pz>uFOm51`q@XXRvwBv3qh|<KoyYNwKry~ZLLdhQN{s*
zS}p}S-8Qx*unwUII)^Ut<0<8Zn;40_BfXGq`Rt)PXOlk}_jh;uLGHHDsI*$xxV@fJ
z|KR)!O)Rd<!DBv?dHRA0$ZXGmhMq}hwc1#E|3|>82lNW-*A<$`Ao)bwZ`~}LT5F%6
zv#A;+TY<o}i_}DV?R;*x>v15tk^HT~npUA4DQ*{S0Ekz_-{Jj|Y*{FMC68%z<QkW6
zApLsuT#i~E{pe(l@%kkDo5Qw`iEncC!Kv<*TK+O{#3bt9m2Um%oq|GtXA3H8trJ!Y
zlw2vp-DtR1M$qdMl~EDay-2gk+5bqBZ}X}PVcEOQI2mL~EtKK)NDgmY<6x){<Yy*a
z*7pBBHOJzV*BxAJN5;WeUbSRpx?=4NhkhtrW3)*hU2nbReR$eeuAy49fm*V^mix9j
zYCR23)=3tQ<~y<~-#CL{FryWGV&YFdy2D;I>Dq=eq)vh|6_G8oyKPeTcR!11aQTnk
zQe)actg!ytD6RP3C$r^mC<U|7Jl8a!fPlWJhm6ZLBZd*KLD6fP=BG`+$txVKIVyMl
z0f~5(pw)Bk*g^5iY>t4^F7ihRGp-#USv`^Lgm%OEno5J~S1fg<pGwn7bzBR??p<s)
zA>_m})6PdicgcZcxrLfx!AU>DZn-@vmlxL%p~+pCr^Y^6(!gh^T56AxZs^a0^zhw{
zvPt`PBe<e(U)Q_!j5A>NnBXW{zh_*eSRh8FK>5_O`o7`Zr?vL_aP|3eep0<^(aVk+
zi~UrcQ>oc2!}{anDl6;OLw$X4xyK|^hV_<R9NiUiryfsAVS^ZOagSHf+PhzBJ^b+S
z=NL;RYYV%i8!;lG+@G7XAKjo~-S++IKM;a322u-ll@m6NQErqPHRo+tPaXnf&DT|S
zsCz7a&@i08al-o4$3BaD7K?cM!CA1NYvZfk@JsnfFXhB6fM41Lo*|OHStkovZ673F
zfx~3#F<So?e7)OH75ITcYY~-Nn8!+j5J0f+L5yf6Xtjsk{u<&YCO<Unh>YZNgb}bI
z?hTUNooQyvO%51uRX(7B$xTEUDurYWrv@6){#otRP~%s;hur{xSkD3!hGG^6lIcE`
zpEycdhkmm)PQsF6%SP%+_S1@6HQjVY);Z%9T%`x??R=tN?gkc_q1_<A$AUvvq?#jY
zC!_KGX2u)lubW~`hliz{`FY_&7w>a953f}ZVk{n}`3oyloKGIBQe}D3;p^baOTu;a
zUo=<s0$sw<BiJY~cT!l;p16x+_&(%tm|zy#0C<luPQty~klwdqnn&3fX<DsccNKeS
zx4*fuxVV|BvxjwjOFs`@6U~JMv<43?Ow;^bK9ZNY)mxJ@A*g*6ubUb!zF4S07T$kt
zss2%H6+zqO%S!Rfj?!mn^~wt2c_`}@W)5K)fBon}C694ctdf}~vd&}Cx7J>meVNR_
zae4EW$?GM>$l|#4xWJ>#7qK6*$kA3p6P~$@#AyNjdZGs2!|sNXsEZu>Jy~fxIo1<7
z)G_EoVW18)RQ&D6>*TR17DE_C0#Ad#<Q6{De3_du()(Y>rq0v9m1dKtW?G$_)fBF7
zu%*Ehqs7(whKUzQrIp|}Td(u;=j&GL_2yQH;{8Fs=D|>~D$Tq7(E@5EoSdA+WsgaS
zU=tx0<X%3m+|)Sh#`N@bIW~ZG()$Q)KxEG+<M{k|x3!^nbOv6Z8smBSCa_84J{U_L
zX|G}H5N>1cGoBBSqtJ=jFbLS=-ml+m%^mdBSuTP|-$jvzUA&@bg<)mZ_}Bxn4q(zm
zD%O`I0A4mJCjButfAS#UkHud8IQ#_Yk8=Pwn$YtKf2I*O#S3ulQ=Z8?J>l)M039&o
z%h^NO?s#rh1Y_IG6&!I<t@$h}1c#yQTI1ID^(j%@`lnsg!1D%DdY}AFy2(7ZPGPI}
z3s^dm{#V3pEv&N_4RcdPe0iV<fjZ{WGcak`+HJNaMPmReXOZcwi5X5RHABRHlT0tT
zVn>@=!*@L{+fqc!j1pDWnma#)bHUSfEPgSl@FT`Oe}jx&KRaa+HhGUyhAD1!1p$8<
znO<oSOU5<)?QI#7EaEdlG=qPgK#yuvLl3P!3d4H{(SXH-BSA{bdK+}5tBk1cVXfJY
zzqGZh?<QKxKI4IkI>9EfJ3p~nw=AZC1xRY%8qRkPWkhKm?Vf*bQZa5*0fE2BBikKc
zY@oLmC=o-=xll-_@8MYKYP5wD@?p9(MHUG)T(v=DL{-e>?!KHzdP(``m0OQXoyJDV
z($ZfNzfavQ&1mhCt_$bA4=^iN<_?-Oy10K}ig5kHwws*5sqjR@&2OS8;C|8u3Xh=+
zxV4!1EZ;dsM^qtiqkdHn^>p=&@#9YSg-2VF$@V~A${QK9s-=Xd`7I@sFQxhG-sAPw
zP?g3<LD%+>xq|&G`ndziDK8hoUIj1s^?2I}Cd`7KB;bift{=@}6D0(>X*T8;*hnG-
zz&vbbeBM`!Ka%E3YgHH{wtqrTQoSbq+~taDE^wUEJ7dnz{*~>+M@HxYZjlczkGGZR
z+`6=8<|WYC<imZyv1>G%TIl9_oPuOd6X&w~7upP9nH_PjHmm@7gbX9XWxi8i!7V7`
z!f=33JI?%z{$M*AHG}8+yk?5K?#CzFLk2S{lYUfHG>BnceZl;bu*{fJn&3~}VN8+L
z)7$v`GF8DF{GSatSO^w7LT2cYk>hPXO&p=c4fBF!uaE+J4_{}{Ysp_?m)xY9{yLRk
zo1BFR;@Sn2u+=mIq$}98=IDhDNMTWUX5e0rF%Yfs)s3YQe4{<A?C&GK=n3aF9a<Kg
z+d$H^Q8&6h%8*Ns(lj!!u8~oMAKKc=8@-FCAoVU$nEDKG3x7C<>6Xyqclh5=`mW;k
z+|-QH%W%{}Q{Y%BY9a+^evQgY=h;o2glv;4A6LTCL-*?=N69(9fCO1FlWR;U{BDe{
zl6djzI>GO@50H_~$#(R`<@ti>uI#3KS1M0A2brg_U8P`_qKH1{6*uF~EP03ppMkIE
z(FC!$419^4W3&zE&2hv;I*zF#!`>*?pNG9UK7UO88w-dD;+?u%-p_U#PNZR@?vZd1
zR{$g=IiJplM@Z<h$-nt9IZ-%aCSC)O_0Wm6sZU3TngF;O;G)q|U39X_Qcxj$d;Zs#
z`|`D6Fo?J!0I|c^vO~Tf>HWFm{%TfR{DyF<_-M7g{oPr%M2hQb)))}tOfpmq>;VzL
z6><Vo-MJ5_8VTbYY6pl=<ZRN(pGntzqQECY3xTz?gLR!*aNEBLQTgv)1MDO~s3*|)
z6&!!vZ=~%i*xJZz{eqlis#!nHves0t)hY%YZaF{-{Ev~qFLAH^f1n`bp%EeqR6wW7
zhMpbQuaY^G8<3yB!5YD&(}<#9zt3%>>DUE9q#0l!;?u@K9Ef!4w=u7@nL1v7Qy)aD
zAanP9l{GMDQt+_^cC{#4zQMggM#hB1lJh)n=j(Y)-ehHdchd*$OEq(~bu`q7DDNCg
zm9L8K@q~)%Y*+jg1`BZ=Zwz-T9Q&~GB|Val6Z)d1f^%_OuLqo1^XwSKB#zPS>S|R{
zA$X`(aumw}^l`GjVvz#7s<V4%d9QNl_cog$2J5k<PP9+gQ)s{-Pq<#Z=dhy|fg?p6
z{h=cw@rm4hk}QKrcZ8V_`LwoxBae))F6N7pUlertpDoF&!RO`l5XV^zZN(|)IlBf^
zO#`62kg`aiV@<5fzb}*qyW`Ii)PXWKu%#8i3CQI9xj$xCQtXqZ++dR5L-yI7byNRr
zLvF=g#>U&N`yW#u$>C?+Ed6fxf^Xdg+yvaMzK5FEc$~WfR9VWCTTR7oLWFaFP5X*D
zi5l@bQ*kU_8hS{8bsVeZ!iSHzE9;jL`OiwcGWPd}b6(VIkJ?UxmoIi}{blbb7O32r
zoK^`{{DR-v7_nV<g2!t*=aGB`+4wup!K2b9I~#Fx#!|Prb>?1u<Jv68s|HK(+Zu+n
zN+l7yU&x|nKpots_m}&VS)Yj*!vV3hXb}1FRktGMs00PImHESdK}Ie-J$!}*>CdOX
zWn&%KuN?vSD>y)UW`#=7;UXa~ZG<d3%+GUYJfsg0hRtV~%zA)q^?IZMmPiO5BcJq5
zdoHW_3~P#@KZvdV!%8e-Iww($0^=r@!=y_zc7XJ%`v%`BOE9gwTy_c*v5c#=YmHxI
zMnyr{?H!hjVZWIf1ypf9El?fUL4A17+|hW+6enYaaDA=f-Ia|E{{TJ>SsPxQ=)_{_
zqi<^`tv32)eswFf2sJIGBCoFYqbR`8_M*yB3fj68hV<E$IfV9G*Odp`4Tt6p98oDt
z6C8|=7l4#)RkHZ2$C;9$T^9$|yGRo8`*wg|2m55_Y8IQ71s;+8lIG5~=-B%;VI^sX
zgKuXrWI&;AEP3nyOw|qMrv{ac5C7dGa+xw5WDj2kRG4}@pRPTHPr@(#J#K`@$o)Lo
zbrS})dihu6b;<8}OdoV#iF?$NpQSxTUg!PVtuXI<!E1Ipr5o~5<y-^8+;h`7oy5*z
zneY|myU4Gwr8tq<mKyDXstg8*HJ#wzGdUi}c-%1pcyy@Quwep~tmIGvZJq#f83!RD
zZ>Z6k`_Wuw6X}SIqg06L29^6g5dBaH#NvEd`C&O%;R7sogF1;<gFIa*lw4dIaCU?%
z`v3t^Yq>bXfXL+77mj1>T<YQLvNMz@opAU4vt`Oso&%>CSZih!OilwL>~sSZ)_*93
zW72_LYX@I6v;{zuL&C$QEM<)x<b&cLadPrg+dey^E=vQNjgRfEE}H*W3e%u5c&ox#
zZ<h7g6qdo$4!+r%PEsgyO6J<Y+B*Ch&w(Ox_b!#MQY|#SI6H#x)P+P_q}y6U%Iv=i
zeNzv<XIhLo6J^K9p;@XW{UunKp9sC~qow{V1g4@A!^;9T1R_~bB?4QO`_!VqHR}_j
zQ#C8VE|80N(BsJPpG2JAkH?%1V0%ruoFCSR@=D+OQ~Nl>mKg=B6W$?<I+*-9tJ}<o
z?sN8gSJ#xFSqWP6-;3&a0Y@5}aIfB4x}A>MTdD*eyHtPaTMIL``)r!4pmUj&ca=h<
zD;=NJzXLmK!%sAvZ*7G7hJJz;=F^-L8}Fy?RL~&FoW{0ZC+>85Y3;aI<RB@OA+r}@
zx*XJi{8__&7O~Bd+bbUlvew@M7PBPceMKHr=@x4I3dhQk2i0zY){3WhMG}Rz?eBLs
zd_Ktca+I<|lAFI$U0YBsDgIWB40Zah#=ajkmi=O+l9GtZwvKI6YO<$YwQ8Eo^-aY%
zfVlF7=bDR6tYJ($?g=Sm6>mGih*pUPX^lXFFdU`B6}hZk<Yc@|d(#f<1N`<(<%;X&
z9!gdXt60cKFzf&y1-q5F{(3BJTm#bI-OijCZxbYh{;h>_+#H83@uj#Gk(_M?Jqj|Z
zN$@Qj<ky&T#C2VgSn}~VO|=@d`9r%1;WSkta)RE5SHMsx(#Zz4VKD?^E0^Wri9x<H
zwqPFf{4Vc@u6(jgnF)~Yx0mzj>;6O~SIA$v94E(r>yJ}q{T)ei-dTGE$G{@XKBa0i
z0jD=|rmN}$>6yfL)VHc?Kh)G!iUL}dC=z6}5=KMn@tC4@1gymUK=1Szeno|FDxUF^
zp<zQqXp5S}W=rzBSm1r2reKO444#Pga@B;Q!^3(#)z765%N*9+U-8WuEZ7>?Cnnd;
zS%saMF3{f?{=^)uzEPYhZ+wVDUPs$`Q&0>Evzn~VG|BIW3Cv?IJGG4F3vaa3|EE8Z
z>`=J9^c<PFluSGi6g>o|Y*4#)Wdg0(ABwu^(>{Cc2eLvJ-wS2n_H=^IMj`fgoqDC)
zxKGAX`$>Ls#=s>V38cND=#>1xhD`dUZ%#YVJaD(bG|rnv7J*J&`qq9kPz1(>6u--@
z*m`|V`!dh}4E$Ts5aA5B3ztp6bm)c;{cUHamV7p$I&Q`WF}gU2-uwoHC=Of*I@yf7
zY>6BQFyfLYehd}^F{J)gjzw95gt*mb<$xrxQX^^t$$iZ^pvupr-<b|T-G7y7emDD7
z^uG8g>!^oE?wdCNHHf1r=(|rd(~mrA%N8H5$6-KBXQPlI?Cf&`ww|uDKb}xkJY33@
z4-gNP8)oMwWoFC^C>YDt+-HIS7Heh$<)Gy;sScck23arK37%B46Evk}R@52+y7h>u
zUoaW59`VkyZO&Kv3CNdtZI??G1N4NcRy^<G%h3dGFK=C-`Ea-B@z+0JHB;1H9SQlP
z%dV4z@z6?Hk2222<)Df!@%04HoQ^y)1K5CFP!gc8?jmRV_0cnAOxRucp!OCnBj&-5
zTt%a=!?1ooa+8stjqSR&Fj@X*wM?C4<LSO;fg=vI0`hg{vWi-G6?-o?mQ3TG>08eQ
zyC1uF`PzA2We`@|H{zn}Q|?4@y{GR5J^PH5<)*$}1z*@x$SbdCvQfdw5~eh=kzVhE
zGithoFDqv}QAzdUo7?hKDr;?=dC)|{q0_lsh=*Js?(Sp(L5d;2ghpy|i6&Z%Xab$4
z7;p!2B#j;H&EnB~j^+*xUbE+u>q3jmC!#tgw`+^#GHcpE9e9MY-h9I?2c(Vgzf~(y
z>mc4s{}1Gxkk+Ov8uzMaPMxqb$_qpEC)-nsaE{v06D}_bSi|)xae?asN<(fUBtZet
zOja7|%#CYu9wn*!{eET!jZIKv@(>k&2N?}99MI_$SGU@SR@KPV)>TNr0gDR@9hG!&
zE-hx($JTx(HDt}?tucjV^EM9EAR$-uHuUHUB9nrzptnJMKU>ieiu{T!9wr%-60E->
zdxXF%)e!%R7kyn#h$wU=;Rk-6m)-RPhVG9&CU+V+Z$p8CD#|qQ+o#~7h|rW9lbsWJ
z{s8F@4<QwyU$A%$s6GNwb$d)<nVe#Xj)jRh%MJesx2Q-nl@CT^ZYhbf3*g?0Pds;;
zZwTrQCoyjA?^E`I0ljRUD~&%2vIy^R=5aaDfSUVsh=NrJV|+8;B8+lcudOFMgH+Id
zt%Y9sOD}A$VaIVg9lgxv#+{kIJU=n1d~5u;7QXs^>iX7Z7}IsZgJLXj%~=mV1GP)s
ztt5R;Ox^djm2|$j=ke7#J8s3=c&;U=hJeRY<Js+&!PO(|>5tqf1Jl*V$$&G1&4wTU
zjh6K!zn`1J=}K#%Zg=1X%ZrE$lvs^F%hKE^Bbde}dA@_dY6@oE0GeE#?Wc-5QbElb
zm_O&HEmSI<y*@KkgVmJ>Jk`3@k`3KRrEV;GJAE-E?jNJ;qH#3R^u8FagYO_{EN7W>
zx(>h_X~7vK=gPZVeKnFDF=t>#_y!1H{~Orc_IyP`5;xk_-%(=d$c&My6O2g6yx>na
zTI7aR3xJZ+#JP_jqqC#dBI-8ni}<^Bw4d`dshjt$wh?~3Ke}<)Em0w+kvLP044ru%
zn<!q%sSO_dszt<tfi|Wgv_Ml&1dMa|OPw_1fd$zpn)bRpaQsmu0F?Eh3f^EEv5hQC
z9GNB^WYI!&$Is1e5fD6QS?}@N8f$#Fg{dL4KV;sddh*z2cQ8*)+zEEZQ4@p9Ap6=N
zErMD~qL<}H7SHN7FV>;L)ec}?i?*q#etX~y1$N$}FD}X`RJC(I9c(_uT~(t~*Rg?4
z4WJ66IspBIf$uCp@D&P%pvt}4-a_Y`fMm%B-I{iIzxMx~O#R8qH3Il}D)c=y2uv1+
zLCdsEtDOPyP)jiGQ?ox_s8yP^Z}K}6{#)PI&j9^LA*S>lhEKi_MJc<LF?R4AjP@?#
zUBNc%&3I4sVLuOvH=yokUH_xHRJa4Kh0*%@T_(aTI7TO*megOmV%&;(hd2wL)1L)|
z-1!-IUdYCD2b$$W_d=JP^lh9BP-lfy`BCtI_@tarC`3fMHEz;fgyDOMU-G4c?cMpK
z1mcm#ad1+l!Hl?2Dm-}ZByVh!V1e!yP-|TRdS2T{;rE&*-Di`wDgd^|2+VAk9D|K$
z@z*sLHv-Y3ScFchLuS+XWB=+1@4)sN7nD!OE*vu<S3S~Rt6W0xE7eCZ@68EE0-Jh^
zC-ObRSky~+G#hP6fzc3$lfs};A?(H8iSR8J2Q*leBqStCrd*`%wg6p4T2Z4<xK`(I
zsMH8Xlm|3+GbcN{``&+@U$WA-mq5$g<pyO5SdtWq6e#aB9zFsi^8EZ<wS)sT+3(Fy
zrT~om57Vjqg+f)2^trAA|FbH`NPI45UV$LQ_*rJJXLl-<ip*b!)zhyx|Kd6<7eDXs
z`O76PTqL>nZG74Rblx@keTa9#5P&ac|5dCkUC#Mc+z2X!$Q`?Nhpu$#A<8UqK=^xK
zT&?R{N?Lbc5qLdXbHhLh`kt7x!ZCj7eP1YJ?2>KNNefj1HB<=c){?u$0+EjBt$#6_
z9XvQd*<h*2Y3OlMNDC+<+e!sZ2dcB%QR(%*Hzok5O{#b!X6K#p?>VMvcX#_cZo5j9
z;J1g7p^l+cy9oh~(sa^3#7fH27Jgyq8n%w`vLUE+Db4uD*MPuT*J5}#AK8FU#Vm#7
z$0*+4OXtU(89}*QK)-(*DW|)?ymGEAQ&wHZzFp4;6mvm!V#p^>73(Yh45VF+M8=+(
zE=tYD;T!D@(OYis&A7rO^u8b0KP!Iwk4accd?F2yHh*yy>{eRIN}WI2zvwD5OR2<%
zrEjMlIxu}HOA3?U(BWQ3J3+$zHBRX4e>O1#6pI#zY)g?q9OrAc`_UvuKY+a!RB4t-
zVICkO&%YhTL0kazMA7CFB`l@2fG~6Nk9_+2`dV%}clM>j=gp+#U<{ksDcj0FNEKGt
zD|_zo`--#uUmnKmu~*u!fI4NGBC;FGbS0ja`DVk2m|pj{*A8QV^OrDe1%j*oypt9~
zM<i$llZBEW^91kn@Fn%aEP>kavaKKPN!%c42K9R6SZhpl)2oRbFDi;#nXUeqR11Kz
zOKE9<T^+n_c$_+jq4pgwZ>4z$Ul#lHpjgg<0&Ie9;k#Gp1A3JOy;5T(lpBWjvxzvu
zr-H@{5jHv5gyY#*{Od%y*MmHrEaFL5y<({m^}4gVzci>wv*Cdst~oAqaLEJelsF?b
zj!tr+(R}xQyUDG_K9N2-fsxk;H-errH4k}f{BvsgXfV9}7=4^tSO)^r_P;0B0SUuN
z<Xz2CKg{w#a%e_P+NIc<>CGYcspboJ%ED-qdF-_c^p#8(JOWk_0ygvb$!FI#j|WG!
zR@d4k7|!d*yWcq1>ZlMQVc|hLjaFC1geJd_=tuL7c?3{1f-DVkz-z=<;C8(vgihuG
zh&r>C78e={N+S0ZhzAGITSkZ_(n$iKQx;GSqAU#~n~cWxT?+;RbCA?OvDVFhRelMc
z>!*+fbo7VktZ#WiL0?K93VcuJd}7`mI1!x4m>{bpCpdQC0^qk`BtCaGa9>AS;5#hh
zhl|KKQXR=#X4_wQszo@YjpQxmr=Y9#rNf$+rBC-VB+w&hA$&7xV(=Mc!L<uFdZk7O
z?)sK1Ky6q=g7TA#7}wvD_6B|RiU>ZVWV!UReKq9_3>{bfPD5+W(|+NT$c;z4a}d3x
znwK>H;<+I^|GPd7ajNy$u_<da5@>AXF~U0(sk1-boOUpiDUMJhv&Q1g`Sy?dVt-Lf
zaP7n?M!t`wCFUbpz?o<-3ek~I$CvV6<=eQ_3{DYfk2L~eRi;H*p><q?g&DBZBN4UL
z&<L#HH*`H_^U?roQUS`(Jt{A_##+n|pn=LaV}mLSQ0u9AxRbIli0{_SuE&()?Kl0}
zHaryd``P#R+P;dp?7RBA<N<ff8{Qxr3vogUVyuqP9<U=@DfDyYo0`yi!v2D33dr60
zH;fq9IRZB^uBfHb4wC3`LKtgC)Jjwq6Ei;fOpCobq={P--hj~vM)^2l_p#3K`2#$d
zRHd(L1Z>!HwQzgB2{x|*_y;jo%~r^QrF9lIqn`hgze8cO+mT#p@GPN~pWJb9v-RJ7
z%4;&6h*vROs(|4F5s=)sO6t}13EleVSiQZQ-1^-<ey`swI8yh8#@!700sbveEzWsd
z97`s%KsW1y!X(}VJ&Zzf%6^yS6r%_8Qe>yB=pj9nfOTYSONNg2be{4~i^OcgvE}0%
z{Jf1L`$?!Z`$JYz?UP60Io<3?Pp2#MBNH%+W-t;&JBJq7F)gn0_uILmuqpu$OPs@=
zWI0$>u;B~xWhT)>*~YH1q2qe~gy9dV`8k$S#i*PY^|$Z%?1Kjqj<55YvR_U&*ro!j
zocf`A8q4Slh5KP@W~M!Yjz9lou62CgHOmBX2&!8E5P<IjoGeaC-h;x|-2Mf$jZ&pw
zw&O*7q~ZDARStLo@t=L?^1BL*_;nm)K_!9Uhg;n);guT7PITXxX0n7&%OmCgYVMI6
z)*QkCty1@q#buB5ISThW^aD(3erQ1UGH4`y+yK_scJpU=&Ue<Yaz0QSr$_$aNsi@Q
zoV&X_(eF3p(&;k5RWK&NEr`OJG~kSJ6w*!^GI{{Cfx{!D@rm+RzbDj@RPZaFMuX^b
zE(IX#1gd|4YREU2G@OlWL+;=O`N7z{8!XMrIwBsVFPdp}bE3@WHx-IgVYbBiY>^3w
zkp}EWlRx#D)Kl36UA*eQ?QQuPfhS&Xwalb`F>3N^B<#;Ivv+$@wT(~NiOG~|L*LO+
z(-{pmB$z%er!oe(u8Zv<!w`;RMvB$(VrBY9)2;q!g;F(^?%$kFC*wfEHuZ~XWT)Nx
z8hU{H*VS5*O9v30DZov~e7@^uOMAPzG|0p!#A*KZ-0&8sdu#}GYk}Ul)<YtLJm_rT
z7dsl>cg+D4$w(LIKtZ`HzFklV2La2_mrrhUbaSP&WxubxW&V<jE{&>4WYI1fl;yrh
zbzke6%4`XHE$TiSw5DZw#?C&PP-(ayJ~{tR|04DqUk3)DV=n<5P9a<#0`FvM46CPw
z*+@Fy!x*9x@vE}d#7SJpKh#F@5L|p@o5&<pD&%BOy3N8<x12&V$7LfR+;rRfZ4>6s
zlq_}C_i@8D_|(v`BIikdXz|E47QL(BeHX&lZ`Qqb$dx^tcGSI80boX1JEB+o??x`w
z6ljXYpO$JeofwZv2X_bV8ml+A<PRFx0_`o^n|>4-6sI9W<i&5o9J@6+bJ1DKH;R@^
zA2ie*?YA*W_e-(a?H~B!U~TX}q^D}DCXfsD6(ji;?l*`to&30g@DY$c+hO?9_8_mX
zL?!^>Lkwed+`i5W_VQhpaLI?9+K0f^q5B-V!Q3x);QWQ8`Z`qKJhr?>l?K#RA}x4X
zY_^oo4PzfYlexu*Ur<VWLnZsxW+ez&P<g@ZaWMk?FsbPk_+lag-?o8^>6j|tfsOJJ
zw%ejDpja)<!GLk9$EpG!ILY%Jj~6C_2t0o{4t#O<3BNi8)b)Do_Bak(nEyH^paJiL
z=?YAKr^(}l<QOfb__AqZnu}|g(UGQr*JEWGf6Lst=n%}<2-sz<EvKY38tdw+58u`&
zyvq0s9e07&>Plv26a_nOs!fdCZ7!`%!TbFVINW4aYg+y^XBrht)Bm(xbo)mYR8pJ=
z>0mLbBqCB+^`CY1_3)v{95nCc-)4vAQk1AX52Ff@6FuKO4BAmqGqtwe_4rY_8N~aN
zE_J6Bq=)Kr<u!m3rYrJ=Imzw?nEeA6E|#%(vv5^&(xP<&xOEB(hS`25A@|HrDvZDO
zkWH`_j?8AVj+_O>@$x#Y(o2NaA&&eo0ja4pNe{Zfbrtt!VB{Dn+V*co<+1Sv*FUp8
zf9M`65i9jJjp!Ho{*h_2ierAFtF5=t)KIxw1K9xJV}0jZQ+9Lqmo1UHhGNf={_&(K
z{i|XhPM4?l3@zUqpf!HY!LHU2^fQOZ&iZn1LQW(GK#EjdODyKA;@Its`1cEe?nbQH
z9(ugO@?@zIh_eTrX$-W%yo5R(3$N)o-oPS$>$A9vnilE6kPT;Fp8^=DJPO2F#d<5v
zyJx>(7<lWJn=?-V-Vd~e0n!VoPC#f+G*%N^c|kz|I?sCRVzbj%z)OntS=~~U$UT&v
zUi~CGF)?wNI3hSW3M%jU=>cacX>G99cnn{y+9-UOE|B6~7li?n9~eS?=JwPHOCZzc
zen*01;n!gSxZ>o->+JXCY;8g?Y##vuroWezl+-0~AF6CTmEyZ>N_Vo6RCakdGWA+B
zAwUmQGnm3j!u=Z1OS@Ad&4Pm+R|;dl?_5%esp1}Q^{jPGxUEa_6N`4HMpS)6Y}2Tl
zi4nN<Xa6Jj$_Prx=c1c96m@5OIrsfu)xy?x8^AC~8+klB;wR|B)v(OlP~+)L*^Rk(
z;2Qr1p^fcXj7`~GoK=^0`GHfq$^P^$Ek+rRnKu7SP<hyeq?6DcnVl$$nbu<x1Uv@_
zYT`F<syDw;PtwAc12yK{^X@tM#SPY&co=lgseiRpZ}w>5Eog%cnM@K*)CPIKBk#c<
zS%CjBOKtwyc+XS@`j3HJ*q*B7^H5(?*D`iHthIemb#vo&y0uymp)iX)AG{dfXVh~_
zHbczeZIK{jh2VH(SRdkhUL9X(Hj>R`GWnwO+DPD)bm5vIa7!cg?viRm5yHtuoKyJB
z%9D6#q1jN@G{9w8OW1mxbU3sxd4EEu!C!2T4*O|OCm|Ftg^GPLFze-v7DJXr%|X93
zZwH^~sGfpaNHl;Rad67oZ;7m^tHD+{_Wb1I{^EJp#_4gd^z9SvPvtzN^Ty^HFZ*wj
zX_(ocNR)*`UUrF|^8tPUAWyw8*NFr26ZZ=BqIRIo*{lw|r1xS^tp;zlMb4X<L_X&C
zu8IT?6N)fDc~qho0L*>YL&<qV*kmofFLUtTT6Sch^XZ@ml4%Sw+sDx+@wgy`E(-HX
zJ@!{GK)ylJs~KvMZ+v>N8c9*ky5ij_rhuo%zYn-3L;R=Mv<<Q>pF}`ltpvb?Y`cQW
ziCooMoEg(N9K^`dh}KEWXFk9Rk>ufVyDE@964K>ZnrXx}3tS+@OpaGL{!}|$>-3up
z!Q3?On~v!Gr!V#fubl>_rQvZx3hSZZGtj}mBX@8!%AmP2i^m9L!X6d-=OM1^1$f&X
zd1#m0MW=gb1DgvYfx8+9qYcw(P@e!J&%KrUC1xlnUkAle8Ja=IBW>&#9}MC+E3nq6
zIAJ<Ny7@okAncf7&etWh03<j7v;kuR6$Bj5j#A$czMrSBE=3JT69q_Q0p^#z8e}hS
z_|Ukps{w+abM%`@IC?hA`p*agjzlL|xGhoJp&jfC-+$SS!$r>rtbwro6+mXgn0#o=
zsqmk78+MT?v)Ds#y2^6~#}A3oCKB>}5h-YcUg1?e>n!7wRC%Dxbv=0_@AvtThF5*1
zT`o{>%bJ!k5bXMlT^a>yAOb?;L26nyrMJW#(~aQS<*$|GL~ig1r+L_<Ria8O(%F$h
zXC}=RiS;ZpB(NI<|G<(*&=x44_#PDsoE@+mY{Xi2ZU9`|pK)W6aNIlg-ID4!p^0}b
zCvXsb;1{_5Sn^9eo{Ci4+zVJ@{9dGv9d^*Kh|Ja!u7NdI#0bomU*+ocQY2oFM0|w7
z@QcquNCa{+GRWKg(SGR=52_o|T7V+L&q~FERz|)r%&+p^l)Ip#1RQJ9?#}bJkqp;B
z3uOXea!lSxud&6Z*3$`JA)UuoS64scj>D|4-`4=DAwOOOI@P@({k7qMKqe&Q*g_0k
zTnTs#8bUVLEFTt#I$@iy04_GP0>wmTkDTqt7ZFA%fbC5B(3Tm{0XAoGR}E$Qa?3<O
z8hX~tJfplCw)LT5ePI&VnYKuJR8{mhhVCy;M&mTuc!_Mlzl8*1MvP10=a@7FGAzl{
z$NTtmy#ueb@H?Rn<!Y_`)TNZ8`+cwIus2{0;S96PS2~#{U=|5K+?IW1?8Y1ds}e+L
zx+Nx@x&-SQ`pQkXC+EpWE_Lusa=%s&kbaf5q2z1@1h{zMMBYwS#MkG2fGUsPQ*5e0
zy9*;>CV?)x{nBbXZ#e(?5#K~z50pV@;%g%MRF(plp-?E6ig~iQ196J8W54G!dHXt~
z_Ah7y%}O-*&AOdDd)~)rG>P-OWYwOAT!yKhR<YhH8n8*sZ#&r8^ZA?fKoSMe)>@g9
zaGZ?7DFU}m4CzV33Ez;_)OD=10c)_;V3Tol#`2AzFEONhf@3z!v6bn41ra_t8aak;
zf~#kjFouzS8J;YzQ2>V?atfQ|zCtc|>(BTd#K*8gf6M9D&PZF_h~48^x5Ua`t{idW
zjOau6T(^S8C?vg37ujA<+q*g)uN}vLI<FQgp90j<k1Sr?F{Ap{Kl)btE_@mFiVFlw
zFgM6CiE!1q8{&}Re)gzZhP>Ce0OWuys0~i1>764Bot>R)X69C9D&Mo+Sr>pDojh^6
z^h0(8>H@8!FBWgjNk{@at}x7rQjx$W+e3+8Fa`YNKgVcRkUgC=pT1i>hwj^a6hY<}
zn76(Z@B$T`k$zrsyb|jldUFf=H<`xZqYNFjG>~_q)u{tOA*=9qT?HQ_>86f`zW?A`
zv1M+MP_L^0G-|=;I1nhnX?k%WWWOzCpDE$?83VEppV0vdt8VNff|cShLFTP3O7SBD
zM~4qqFxCowuAi%}yPc+Xs8>q$nj7T2SVI2E`vVYK<j!ImjzzWp`jHK9`N66cJv=X<
zs5T%EurcktCjel_!ZOTkA_MVbjO`ukWt0BvfQAC&>K3Np;`^d6&_q9<>=Pq2Jn7QD
zO*_&Y@OV^v51VvnFV+w(T2CMnV3qJ%i_{tsbDH{7pat12EY#fKCD-aJt;UnWS+~H+
zxi2qvuj%FethLV=-vzQcuxYA1WiO;^p@<J{mfWl^Wm>d#3oQY8D-WCh2->K$x<55K
zQ~4P-0$&gk&Q6vO@f1AP)W3}S6`Bc0JE!JlTRI6^sZ0g>F+mGir@ny61z@P21U$k9
zypjl@EZD&SfYerkIhuAn&H=b9nj%6vA3|t7xViou3ygXI7YB+W;Ni>geQ`jWGEyiA
zr$`1B*%o-XKI4Iicw)6?zhcJFny2wbBX1ZNDs;R5So$s+?_bLj`YR*rDi$e-a_|;<
z?BK_W-TMFTjZdV#5z&OjO(gW>cYz5`8z+QNsaBCV07)l+9dPUOF%s?@R*D9FzKVQo
zK?~q$im{S0`|jGa+xfNqNw_ZpFV>g5MYuch6@Z%N18(JmgcXIp-})D*6+mx}#m9V^
zXYKE8vj2-Vej_b~7|ZbbB~*@57H(xG0Whkvv0LKGrUcTo3sAtmt;c32DfxCRr_!W6
z&!PPbNs8S1+kzK_BjoMk82t}oA(<kinJD<W`|*P(Bm~BHB)>cM-&Xn)WiPSMWG-L;
z=*vvZGE0cCh!h8)5_L53OpgHf2;D+QOXgH!=Dr#O*o1~M5F@OZhSmLUCHet{Kk_XR
z7K%;z>#vv$sQN!30My#0f_%w07nJ`V!k0T?Bvy0Cq0zmLZ&k(@JjEXu)qTY~Z6oq%
zMX04;NE&|z-sQ6S7!_F7ATZnFyKPJX%@yyTGc%ikj+P-`pQlp=psoHfSw*J$s;+q_
z3hjWv=Jm%oo`5+pIJ9WJ^>snHWBIP!_l?U2i+XxXwj+8p{P<uvVv2?cz;?mFQi3c`
zJZ-Pz9!PgP^<9a;nWWditlcercv_oH@Cqn*@@ccW$b&l|FV6`y8KIRgvjDq^>IFYx
z(fW0-S-eMiJ=;;Bg<in|`9v`oAp&)_6c=Lxb3`t6QiF!;UL=OUbb=V)^}r~TZz*{7
z@PHW0Zi_QOuUF7A{C)8`U~$SNgHk!oq)979K%BRh=l^|v9^FSQ`%XWJLrB-sZmS>V
z9*8M0kc;GiooNK%xcI}R$Gh<5{c+es1~yIrz8<SURO;J6Ia~wa>|{g&2+h!fE)KLb
z#n>$12UktUTl@!8e1%pa><w6%L6v6%3+e&=F=wV{1Ka56_!67NEz+mWv#fI(MY7$*
zU8Vzd;mmGNNSABT<qI?fQ`Kh!d;Dl;P{}eX3Lle#dg*DZbmPP80Q9PekV(Ix7g@wi
zivj`mT;3FAEs(U979sB-sx?UG(^7`Sr`pS(9of$*%E8EJsEzRCBvV4|D~$Pzm%fO|
z27hcKy+ZpCO9ZzmeM=Vv<AMibYIrHhLAr&6&2iY*{fESFK3FLPyv0;kUEqM+{KKK=
zl3I5jVmoL|W&n{1Xjg)CQu8MA?LrEbQ4V~yrR2hd2&C;Y3y40gKrqn&Z%S#O9S>O)
zGL-WvADeuGweCJwp!Y>4pWjwgwb4j+wopzxjaWbX<W!~T0DQ*Vm6a8_;9Sf&*1n0^
zS>>j_&dPxqRCo&G+qKR&`!qq{Od3XQ#22C0+SVzTzE(o0$!6q=NTkdfsaol)qec8!
zNS91YzyubJhz*YrI1sseVcAmpWrV;6ve-mCYMHd!tVwH|nYzYo5VF0?y}z7^Ao}~E
zU6QnKzf>Okp;7r?ReorY<8j5{vqr1F)ROLZVOppR7FtHhfG6$QB~R^}C_?0-4v0bK
z=6j5bO2EzFH1njOyw&J24GUIDGN0+WdqBJ)YH01Y9M%M>Y+`>DaA6xR_O|{(PlyU9
z8IW&w5^@e=JVH3Hf17ctlS%vVVfLI6LkzzwZJgVw>t~gt)uUCn;^0K56o-N8;n+hm
zuP}-C6)K>8S*n<h67+MR)vy8DG;@d2H(w}7GF8n*2KhFSXGX0L0iEhUA}}Q=<h`o1
z{r9vO5LK^5K-H1vY#(m6OD!&6<XEtCN8O8k=3<RJvT*jsqj{ek4itLl`z=7aQf2^w
zf*dAHul0J0k0+YeLER|X#Zy~yLE!LeNMtc7@p*X$4YGf;^&g>T8&W!by?&PyMbS1q
z<6S7<@9DCeNQ>0>I-8St56Ha<t$m>G^K!3GSEX0IURu#tOVw%z&1BfGv@N@g`&&>)
zqrT`sxptA~cm4U{BBD?fjW9%!s2rxd*^&qT;%TJDACGPRRdfFRXn#crW`6mzhJI9>
ziJl(owg4Vpv<dUeIycD_#bYmpiQ3@vR~zv+Xgn!roAotDH%7WRc$#{^e^fGv!fVZ4
ze#XojX?yPJ7MX)K-yW?lL&f!%*?n4s^y(o+b=G-<e^0jW12Wy+F7<!##B&hu<7ICk
zCD_r^cWSEWWyEMgeq$LMpE3ZHDTqC|rdY0(c7JtfOk&a129RQ+H<kbB&E-rI3U_OU
zsjrsc(?u8l1enx#yf|M=5VoR#-i5?fa`Y@IBT<P4*!8hFb)@~6t!LfKDE66rZ3g7K
z2v?3>{`4&m`Y+*iKDnf?`nnXT-F=0KkC5cEJ8e;v!uK2F=cd1Ny$Kf|Rc+Q<^p_^F
zSUukN+Xy#Ni!a+cNhP1Dn8jbpmmS)fNXU5*L^w_C=_*hO-ph9aUES^kx(`SHN;iui
z6z&apn4;BHbzfWh#6RK`C(g;71EuRF{B?NfkrNodo%u8Te_#+UC<-^&^C_Xz!*lE!
z{!Y1?wbt_xwG}!ov~|BEUSj04i;L_(;Sl)MhC{-6;)w|-(iDk~JHuG~ciy<{Krq)_
z#stpq!M)R0z?&cj2BwF2U=zs8i24AX4*O;D53f@;C7t)9P|e1;=qNfK9|B+ChY1DB
z+h+=KwP+8g5&-<4FF~k&?2(=SO!|MqC7Fm{tL{jVXymG`%L5Kh6QI?kwEenJ|5X}*
zd!?f7$Y(`k<!=4WtzBq8AyE8E5mq{uC`+#X*;LYvDLt9Atvv<&jp{9WnA9Z<G$`=J
zImj{1RqTgTndRy9fMhJhzJQC4##K%uDUn$BvA>I4AOA7*AGvWt$35EOUNQI3-ZL7(
zcd4y}>Q@L~C%&(g&oAUZFNJ_}-$RLPsMc9vr2%1J`~m{u`I_yX9tRUSu#F83A1ufE
z>64U&+aBDHLxh0Q4iSp!(}j{CtONzSE2q@=hAAC+h&*>~i!K&n42fx9(TK%|a+tIJ
zw)^{){2P`5#B1`lfPkk*gX*bxmbRKDZ{Ws*xF-Q=&nWbnrrVjhsE~QEM}(#hTk9oK
zR!g#`sk0xFX~!WRWp%3`3O2>5Cr?u%S*eyt1=q7t#|JZw#spb{7L$K;VD^EbwNt}^
z#CLF$X$}v=N0M&eKjvr+PC6+Ive$Pt;uhMk)5LLd!lw@}i|!ao>?|E)GBqeL6ugOd
z7}9Hr)&AG|C_)Tn?d=OX$aZ$ez%{Y<^{tLIPq0wPk};)pETX_~Wc0a|c=dURV%za_
zg?liKleMw2v2tyo3&B_mW9^KNOedgY`Ae4l6nR_~TN~Mue3knCNb_IobwGSA;`STI
zCYIoQwL!LAKx#j&lMxD<)C&9A{D0a*{)!<L$$(y~$S@0#=0!Z8ildY_xj9)DrStY(
zD>NKRVD@~xwWoK5TI|7K`litSZx#RqfxR+SYPD73k}ZzduM5;gRukj0Y{Ea4K3yvZ
zU-e0KL^zmrt&3-NB3<5Vs=~=Fk9u9+=Ory_c8mx3{$QTh8Hy~MUJL{S|LepBK4T#2
zFn2&B#M&b*r=RK@*;!q`v>~{oO5#-`?eG$xJV@Jg`JcIsSU$W(7!X5$oG7{3q@=Eb
zoRvhAxs_h~#|3u&z%tWf%^G4!vz0J4jL73XbZmTKH+uYnn7iddiO%f&pnTOna>SmV
zruY^ga8L3pShS6A-;n;(6#6T?r~~S?R<XKw?5NZEJ(I_h&NH4A!A*3zFF02b>am`r
zbcH>g^`9;YSh*|Uj<_Ho#OR6cdt+M<Is~uLEj{q)HsZP2ZD4p_E2n<&SJr@}o9qa`
z;qc|e>Tur4W#gIB|2BF5`sV+ypjZO~D283#b$J*MSd#Ly5Q<n$vIC{o_u-aHeq!4+
z7M~n2AoJfsIsf~4tb_t6I_vU*P0Ng!-<JT5!2CdGG|aC<eu0BlX_qujeKP%ZEcgtX
zj&;p{G4=mCo&M_p{?Etg?*IfTaeQAr0kNth3Voq&9aGI=TJn~O@mIkS*TUwc6ZSOC
zy&)s+LZ|S$t)nP*qo8Et;~j)tZdfGQy)XuTOJQ}jX!p1KqfH)l_S=yE{x8shGL3r$
z#0>3)i|^G~zK6^UwdP8U5$|npA{S}?;5t6OVlk|9V&L!qwDfEhG7&Az#oGm!e0fIM
z(CKLtD*5y&Gz5Y#OB`PiA-d>C?|D&lQSvqQT8-A_X-I%c^xqEl-4A{B&K?+(GONO4
zOnu4Q%M@g;`Jk5E#7JLCVm1jxjdl}5_^yJl`|Zt%mg&6P{COsh#h%keTZb5tK4<%D
zrSg-<1MFStOx&O>%*b?k1B1BvO_f^%420AF`)l~WeZt#B2*l0yb`{v$kZ;<c08Dps
zmsU)gHb@BCKdP=lW10B9sq&ah+z4aX1lEmfdgim&XwD(hDVAmZb+&0?3UjFt0iZcZ
zwVFNq0WxdSW58>4P&$fCA28oYwv!<XZF)%MPY=7>k81~%x^z-2{r}t2|G)jRf0u)g
zy^uFv#^kT#nkT(We`&|)?2_e8hEP{j{%HR9#tU$bJ9)B_O;g4!oa5%@e7=I{A21}S
zrB5?;7cu2j1ZzIU?b{e>hcR*}nF*qOzsw!H3++4je7NVD;&p3$;qlBi195AX*xDix
z(sg=6LDO^FLgOA95XSo7eytLO%YRl;Q*&OOW|R`}R>#@qc_K3tpR-FeRs4HjFKPUq
z*uCPM;@rlb3_C+s^Dx4seRBH5jpU+x&L++owo55-s%R>8JT#M&UG}!0x+8KXeNoa}
z`Z)WGk2DRQm=rx;{|a>+zdIBKF|pjW;d-o)K}+oa!}Rn0vlx0UzdZ;k%-^%8xw(JG
z<?pR*qo?4Sn`5Co`Ivu%GP;gv;6xwn`<O1jy<xaFJSj=ZNd)2ik1g;2f08wC3`#KS
zuVG-i8#v3~bjVAU=1{sR%k@+vyCydknEgIF65Qw7<>kay+!ern&?5LAxf${Qw8SI-
zJk<)fcpMgNz+3slUmt;mG8Mw4Wrme26&+f0=w(OQ9BXHmj5_A`XUw9EK)66{aIrHY
z4jg!rpX_!*{tx>mkiBPpat#kSbb?)(2fkPGo&7Rafua{O`rVUpIuR@tKv^8C8Mxhn
zIr^Wcb(9Ub;*4^0#SJb3l-K)Wk#Fi%n%&nqHpL8{9ac59&#}66Npl*QpP-b~hL=tU
za(8Pa*EV{??C&lNZEb9_fapDJx}CgWe&GJXuNMx0sBK_mWTb+gg-f;Bk=Am#DW1cA
zj~9qs^)yRD9s57-K;A-7Km<aTG^U%}FFn=$F`LvLeH0~_RV@7Tn6|qqb-6tia?E&&
zC{MlqdUt`s(cs?-Rhej(`0@#WG1K_0c_i_laN&QDa#_&Y!|be}Ap>yk#&KHhaA=3}
zJ88Z4WOjKGQ*$xn4EQ3PvY*Vsy0|zmTVGUaqF1e@(8JR1E?<zJ41nJ$R?AI)bXU_&
z4(5QiF1B|cVEQ7{x!r_&L*M5BBJSkl2S9q)<a$N53>ZmHmYctfj*iChczIIE=f6|@
zA=7ze^ZNDc8mCjO#&$kGn8|q|hc>Sl2p*tjZL<I}uC@nazZ_3`aQ#V>ZE=YOl7OXX
z)oK_n*<CLw?(Xjg-6o0@so7b(rDDk;5Xj}ts@G5{sdz#z5S;b>GWh8NXwve4Ag%s8
z-SnlHNM37ehV|zSk6j=c3&^Nf0D`orl*@3}pKZd(0GthGp~f^8{qqQ*Wbh`Hb8iDE
zXvH=_1IW;N{u3wAgYwA$D5h%kdf}+lYAAqg7#|=Am#Ux!U?E+fx#}1&UVQo!XmQ@t
zsK~Uz+5&+8WMY)buGjg-+jaa6yIS!?y26uFv20BWq@Mp}R%L-6?O3A9T;5iH1nw+7
z+<(zqznIp&SF|0z#D4nR^iGiq`}mdD6(55o&z%D1tNW&1hg`k8v>z7hG+R0^DOT+@
z4K{%7^#UC#Nf!@Z)(02S^c;07)obY`I2~Gej`^jl5wB3Zb?NgJ!n=^%7>}G{f)YHr
z&=h4G7TiQ+M=<*ggO8vyli{X^TEj@tpRVaoHxjYG*O~@$b_V_DddA0IjF5^d6sU<V
zSAHH=5%=P3e7kYLZnR@O{>_C|&KUEMDcoB$Ih^qHBSBqt(7;$#CT_`2epel65%`Av
z1L?;(9S(9G_aPA<7=2GxTE$0FSaMcc-43t$D2o6zTOJ6lIq?K#xLzL>9+LT0+91}P
zZ}#DY<Pw_P0c&Qv4G3WT6TZ1^XUF6Dc>ZOf(XId;GMvG)I*wq)DxWVAT}~8y52TMF
zJk&^Mwxx2pRN4Quv9~7y2?7F>g5&H5cR-RRml+_ZfkrMhecX+MmeB!Vo+f~J2Kqc!
zt5~}o;&3<<ZoAc=RnIwJ9}pNQCn)HTjtBT(*;U6f0L}%7J7%_+W7wBrF`uEKG?DN4
zBSu4}P%}g3<MRh4{s25lY6mG~*Xy4gf$U$~vRfKz0I^L;VwH~h&wDzdKC-v|Ko|q`
zRj@{tN<_fY4SY`cmnYLr6rQFhhB!bfN|(wzXz)(PJ$^r(*Lh34h;svK`35PTII_vG
z8mH{;MnAIf1y#D++)jGwf^G7a&T9HOye4CK^NQ_T5fX%)-oe6{^}a>&wOwM`LH%Z%
z>-|9=w<NiCv&83pYl9}u(^~fRSQf`IzmJq+aWO+1CYa(92FEI`E+oI|L>LE<b~FkE
zFyHJ|&%8BBb^iK~)8s!Q*0BQqTw)N%X}ReD6BIO=Fcf6^xI(ZO`0@rPQf$Sl*A4?6
zQJP?i^F2;<wZK6g$qZb^+C8(~j)W#(46%viEp#UuuF7~EH9D>up|9`5B#<3P0hq!<
zk&K3uP{jT9fP9zDo8!eqAVSr*py`iKBP|ig_XV!HPgGErN?{HGl!SQZ?}h=CJI|I=
z!+N345~nzF1qPrfWJMP&i<Qgsft_e5cI`>2)z#tR?2M3YQ={2291)*OL}m(uQqDhL
z^1Co1BBCfK5sq+>^;@U}AhdDvhir}o8}WHlE+8%fHty~JLD_r9Q~m#c<K<0sB+5Z4
zBPuJDY&k~Rag1~9k&wOj4xNOMEqjk+k7I91lD#)YHpe`+>*@3TzQ^bL`(4-Py8h`#
z%6X0F^YMH<?vMNZ{t#XRW=cw?Ffyf<Z18=%ogpy<62775LYmTiYPr8QW~zGv2oj9G
zu}|fqA1O1(O|}SJjqv^-ImT0bFW9`4U(C!yrY(Y#b)zAJJ;;qT=E$>go6+PD?d$Ym
z_J$^pJh)P3nU>!+y>Ip6#`;eT?(Zd(TZmpwXX}R~AC-USBw$1T@#S76imksSuczbO
zwLGtv$`aBa+l@lTa36k{*$Zu~m#KXB$^=*tU%};-yF8ISK#aA1jza|68uiywI^WY>
z9p*2ZE>xcYri1w<eks@Rm_E#3ArcF#&=69c;1ft{Wyu@v-AVh}DksQO1gU<5dGtv>
zL|{wc->U*qW%5sj@D@i2ay*$8mF)vlpG(tZp?c5KtwT>GcS5XE7E?Ku+sey?1P4;w
z5|_&a!Q_B^0cnKUONyOR?yJBR;B@vbUJN6D#uATQOE!p$9R{}A007L)i!fb&7WvjM
zf*ha4tx(?f1}yc*08k)y1>OR*H9X*<wbYwhYLQ%9TMP9tT?`C&fByd3y<NYzS6<&<
z_Y&qc1FoacfO*$vjw_MSvRMnVmgZ(+2AHKEmH>}0(#{>YnC1c}n(--??F1COLLaw7
z?(@^<52Iz!6Zm{a%Q~k5u$8MV%=N&9!L_Bt<`2JLcVT{i0o{LQw4b=~0pF$K<T&<-
zBhaZv>~nfF(*DzCna$Cr8@&+hK^Oa+lFHjllg`v18$_MoMT|8sQ{=q3{OgN!0e1PP
zGm^#G=@<W%th@Bu9`6gPo_pW*e(A*U5|_tJlI0jI>(lvDrGX*k9sIu-YET(&4nQm&
zRsc+J!}Za~Q4!#%rs>=p`aUS!|G5xUHh={y@L#arpT(JI>5aEb9o^j_qgyOvpR()8
zCF(zh7s4a<i&FNCaY~WjpfUk(aB(z_xufqMa<9u|?o<VpIytdC33f?T0Ul=$-!kKq
zq>+7iz6)%x2HssI&!|-hxcMMMQF_zGVxrMo#1qKKl(h-Aqzbj4I89YRk_SD^2Xn-L
zJ=BPB6zFVS=Lg=xr;YW;Z!4?Me(|4`NR{F!@4Ztzr7#VX4LHg>L5|DBMc$W}H!9C=
zj9i(CcA_pX`#wF!Hl}sry;;=IzM16SUB9S6RkZnQGs)iT7<Y2oz18D7(_@UCZMM?E
zGzl&y*fUIQr9wT4rhtD>mKj&TbzgXZtWmceq%B{)q(vv4kk*BMLsIJFEqz9*5N-@R
z!l=|!XRl+%0O1kn-ZA+xM$c;uc79^N3j8h;J@>~tC>8D>WJHydSjs(Tf7%%-vsTGI
z1vwGDbQz!QzyI)gN1#j$WBIamV$8Na(;ic5@4K&q-nW&*J~%LMj+sSx$i{vqu&-+J
zZ_F=YOO7*V;(PRl(Mo1I=~>upgo3S{;=KZiO_mD7J*U;dv`CWbQpxKgJAS{gL@=W@
z!SiS4>6lHCR#|9=`7b(a6BO~9$a!>9$x~y?zpubg<L&G~v&SC!Gn}Q6^C&4XlhzEU
zZZRE|LdWpIfGzUQXnnS>K0BJmlwkWe9Q(n(`!(zUQSw@1<jPuhvKJRdURfvyBqtAq
zdR>~c0idZ4q!d%zkTh=V>1Sg#UcTdSmi!clba7zph1o89)HkaFT7>IU&NGgyIw1Ty
zP1?3gRLmu3P<r&+k&2uY%O~*np<Z3Nc5AlV6{LV1YZ-?iu`L6H{Uy^D#?0A>@ne=(
zS;MZt{@!kpUI^KuOqLErNc)@K=My@9>Ou)3-VNr<yg+28Rxde}18f7{fGH2Wm_M`t
z={(VS+Eo>h#wu$ngdCO>aoQAxgAMQz7vRxd$ko5qPDeKujJ5$U&zOTOOH~t+k!zX2
zx_q!ML3v&HHn8N=vIgfvmN`g2G)4rAfs{i=+%gq8>F5O(@Or4onN54XXYO{iFFWYD
zLOA0<mIkl;6(Tgrh3<9y@udBW4$LEzH3OK;*Wd4486C<}g0ZO;mOsBP@CA7c;K#5;
zyYDPd@={n{0x#BQ=6z`>jKx_0g;PSjpd&h7HADIa)mP<L?fw?Sg*xVN*kQ&*QK64+
z-f3I{PkBD+*rB_`i2X!`<$ecKa%^F3p+;3{*hV%e0H!fkgL|rBFD&6h6Z0Cyuli?L
zhrGD@R}}6&P0XHV0^ZC|J)M?dgYL>W2bYY6GvcDf<j!mm+6slUrjw)C)b`65LIbV<
zh0;pRYN7q=a=p!NpH%JQ8THC^-!XXf$I0@^FyVem&eHVRfGltD!;K@WnT9FPH!Jn2
z?!to7V8HfFwRxI(Y7d!CqfErZ>S1@Zs#>-JjnLtI1fwOd;|%jh0fVpCv;hAuic@cT
zs^{ohV4+=RkI#s%JG&i+nQL~cyV7EMs{QW3)H`o4=G{t*F)rNgg5z;g)Rn!@9(@v2
z)%J(8exxst`-}rOIv7LvTL7lL86pu?wyTk9Fmx=tn7%V;95XJ%_2>S(jNi{$>@=WI
zyWJr?^l4*Lxorh8zH`2JLW#Wmd;6Zf-wc%dc#{MZUf$l%6+vZD;Xb2&_XHO-);Tg#
z&Om^xAX7emgksk{eG}ECT{`61r`>3#FO+U-TZ?_y??u%?E0SC_tb1mc*`-@CG;Db^
zfsSH-)n!KWnlB02%o;g)yh%Tm^x4?EaK^NA#0t!HsjPwUw9_dKS{Ai7%4#mEy6@k(
z`#zp(`bKkh@s%D@e4pXdtZH03`f@I-;;uCJLB`%72i$UJ*Net;CJ7iCy65*`QC4No
zt#g*qiyyDGsFp=rl=ySxzM+ZVJbm!o)2i;IO;%07Y!1ENe9W6Xp*j-Lc}2gKq0j#f
z)ic4)vuPtI94e|nv|*ChaF8qhr2UOn&6`>twATloBKI5}s&bXi7^aw9@jkic3JSx|
zkDVhZ*b>@TknB*zcCO(b`u^!jzi}@?Xt&dG?Lq>CV=0G9=zQ9e>N<9S?d!8FeZ7KG
zrN+XNI10$a+~VEt(7g5FCwYE5EQY5XIj=dr8d@5TJQL+Lss#9>>zsDyB-TWljYDa9
z8saOO1(sZ52p3h-wZ(+WG_KbE-nHBCm=wQy^34P*(~g_WX0td+kgu@XQ7~65C{A>A
zxGKbSke~0k_re*!XxgJHaohxcr(WGjPhQu!$D^)={dgyzq{4G?W7Y$rzMxDnS$;#9
z)OitVKDDHhQ0tLbj~#>D5%To2&sDB@Yc7%VcIE0G&LhNs<m!yK^|Yo?l?d;cT=NWh
z4WVkmj6TK}Vw|WMSrG(h{dER|6s;z^x4H|emE`$3g<ktB*j~oJj=1dUoM)wlpL~6g
zErDPW<FqR2ep<=7KKG<(yamHn`sfnH$#E)@Lv`3nXij9fTFIPEX{q-SfBf2*A^(8`
z*hRIRoqQIfv*Thc-=I_59J*LjAQasP)(EwJv@j2sQZmsr;|TCf?j_%Q{=SM{ye~~c
zr&EYPx`h!O84ZJKqOZViFWgJ&hErrjbLws2Jqv{$nM{%?yXeg=vJfOgSwTJIPfW!8
zF5|J}uHswKR4QaVgcQZ#Fb&auK}ygFVx99y9OvCj%8Fkr_mrE~CafES^U>Ik;_}pj
z-a6g{VcZ@P?7}0q4#4$PM&gnDh~fvS%cLUZ`7Pws5Z~Rku>t5^NGNCHNk3A1Tjyo#
zs)+!B=Ppy&R=3dRsFrp8LWmkpr(DD3j$k1OsiOpb)Z8Yoc+3Vr{7_w5Ev(%rl?bA&
zHtlQAuwR<4uU*z9Ce_KF@jC8O;Ge^HW*^#k;>PTe_BIhuAA(@Xp|YOzI$poQ>0QLU
zl<_#a=-Ymg_h}~q;VG}j0`s|`#~P%^#2fZ<Ax6d;E2Gbj`Z}L^qX7=xRhDM)s3)&K
zKe3e%0R`Q#gIDRmvGDN4o-^3@DY?KY@M6xW(R*3l@Ki<;9dl&XPAgrIHx0}g<+&?x
z^Lh|#Y%W=puRi2m?v(CsZ~Z+u${!K@y^*P<v(4-(+A{Yv>piUX)L5@>d2W4gV``$l
zr$=!05mnRf4zy;#ef|qM+~M*g)Owmfo)^Scc(?a?SWh69i)(oxJM{RN@mb;`5&hds
zc>nstl$;-yv%$qjbbC*zu~f%h^6)-eBW^%1>uuP3U$|vF6wc+{`^{*-S4d8Kb~f*L
zmFe@M7P0B;q!jDn!dbd$-}CA|j)RudfIPGN#LAA|P7N&Tv;M;aF-z2t7fZJk1nqjf
znGRLuyvDEwp-v0yA>K^q5?30pH8XKG|MH<P-Yr_s!uh>Nk0DqweDq5_ob1inUW}9k
z$bQw>7Uo8n(|pqUmCF%NHxoCKl4nZGi6sv${aaPzD>m$+9HHfX-|oDNf^zrw9v@cN
zvyJbqvsR6qNoC5l*WwNdnw^lTmOB-~=iR>+SGOjAXZofn8Le&~SWsahJp=aZi(R^y
z^#jKJGp)pZt;5nSt3IltJkz7ezR?>mi+*O~h_VR9GL~%BUSYLg^;Uhox4%3k_2Lcb
zHP{aAb=VH{1Ntt%w~&#iVUl;+r6u>uk&>+)UX5fmO8jI`ukL9nl=~SKzROJ-Sb0Q}
zsxw`vp23JPpGej!i&(GeuJ!7q{yRT-$(n~_y-Rx?HZv>BDXnCfq$u6}SHjs-oe%N@
zt+)^3<x>ir)|JU>EHaNRJeJN>dKE^DCqm|N9Y)#F7(xy-^|a3XA>$@TNxO);WM<<B
zBKY42)OEwlo`h1^WzmKf4F{{B;eukHne!gq1IG-@$p#)3oHD<+SS@-?!^u8~IA4~`
zYkWqE{~)7D;h^&rOoi=7)?7_CsGA)Cd(`rXoQ9I9DE`~d3qN=d>^Przb;$*augw1<
zH3%yWQq={K(_NK;QflDN<g|XY`|PfG-|7n~hGr&9IsJgAJ<kRRB%oEm>C#$zfwrsm
zXeDnwBSN8Hg%A2kxyb;Km^rjlFZr`F<{oteqd5z7_fM(1*@)kH-+w4c(JZho=D3CU
zJ~>K3qBxQ1z|6fy$F_}vgE{?D0_*WdYM$?wN7L?`!HDcWe1ceAk1Ywl&6AxTJ_5Ty
zDo!harr57OQZH_Tz7O*!y|(;}q7KBAk$lUE3aeyvM!K0?<JnOj@dV4W)FvsjUtlh{
zJu?5IqR-8U92e}{F+!X1LD)@&)N~x9?E5`=^jq+$q?L#=yiSk8$Ue`!C+%9ov@oGR
zq(ihdaX=(uGvotxP~l-F$c9>sRoSL%>4;IG#-J_AQQRcRZY7r&t%S+DlWONmcRFr9
zkbP0uddIp>ADxi-Ndvf=>QFEuU6f~~H!TSc9JIlNAUlfua`xa|{A7fujK1_#P>oZ~
zZ?s|NikRCuvrD!oOUgVO3Ca&XZk>M&ANWOr8i!h`%zjlf57g!Dn~gw|vrJ~EuCBMf
znlsN~)vF0bPDwAOsK!y(@Rf%YCZnlymBR~%etdo^k4u^MM^k1V50lb)^qX6%A*US*
z9IcmX^7fLZ4Qg~Dv}n7?iir#vaz33+Qxqdl%cg042$fABpU&z*m?l=HGxv3Jh{U~@
z$h3Z2=GpAjUr74>K^3?o4ui&Yh~eTlZg>_h@4WN*@1R3O|H;dzR!`5c=Sq|)l-aG`
zxS#W9k(*f(F@wn}MCe*Wnp-%HqnlxL@aLLog4;(YwaSLmv!pR&e%72N%KpDG{<W%Q
zD!%(#kjJ^c-)V|CxKWJd9{iWKzK`Us4WDz^Oe}d?JrG)ry{THE4m*C7b7}7f6Ptw@
z*2s11`Sv)Dl+R`Y$-`{9Gew^;#5bDdt3*!7>##}%8NWsGJ$X0Aoq>?**}Vhk@a*9k
z2i8-OXK~X1jV9{mq2<pM;Z2_<ds#W`a-F|%jjTk$9jeMXz9GAK2qBz%E;c2tFE=<y
zV?7X+@0985q^{T@z1bdgrQ4R`Q^++|i15ui+#OX;3vbKO<>^+qcj=_%YHNcdBSjc@
zGgudOp1mQZodKBzVv3fsL*bGiHH`G&)8rh28Lu`{+_X4qnR8a`r)@LyUn|P2#H55P
z7tPumw2jj^y;u<6cRa7Z{KMsP!Ve<YvicBj*~}p_U!wlG<;1?uzL?@=xuKO|i%C;K
zRnP9+7Gw;0XY8Ye6f;!_nQ0yLT_NI>B`j=ucA%6V>TFTeQ7EX=mBOlgP7ifJko`U~
zSWrE7Inf+2#?aLa3n~PwJE5`VPjY@|+I~+Qu+UI!UWvA69bXU|l}<Orx)$9q*WqJ4
zC^_g^clzx)Ftw*Fy}m)5S2dg8;@;YLHgIS%1}sub<0m#rzDdk@L*~$>su6J#+6ON;
ze*Ly^n5%h0I?R`7zUy-AKg4k<y8rmT8;vgGp9dBZeQ_g%%wt@yNc%efMq=$*g^ZlB
z*17fjF{v`IYhLaqJ>EoFxZdq6`tP2a^HmDL8@^Dh@lS5gk85$j>H*%gDnXd+@Ur1F
zzTv=ot)xA?oGpmTLm9(_^i-yxA-LKv)PK`M`I}_(-I;Bfs5lQrv17Gc&r`D?6s)5_
z&i#uvyyY6YChgOEI#|w6z3hc2AUDF}MUN_jQvX{P#TDfxN%oO6T+u!Pa)m`S)qYEi
zp|Mo_W>Mo=jr;BEGVlDD&|mB)EGr-61<vO^>`)oeIwlHbN^)r-C{6Pd0nUE6GNNs_
ziAj-N)%)Y-I*RjI@m8e<p~AymsvlN{)bt!vZ&>oxaeB_Ko+%F{4k!q9an$ejV;>s8
za5%I$BW&=deKYhSnrHM|7~|BF<?)Vt&j4q40WG!+yILtdzy;$@FAmq-kf`k0Y0tL#
zQ1sz<<vJS=kJaQTs`<p>e8~^4sdjvIhD}pa40^7s5-Txrm6RYKVJoK}IRF=#;;5bv
z|F#Aq5}<g)sC@f8GZbIBFi&P4E3n_BxF(33w4YjgvC)WiN=rTtd<}`zahXH)l})X_
z@P!LDxNlUqBUSr_v%i}j?ra_gPYf2Oj@Pg_Wa2W>47r}KT$a3sJoAp#kgd?Terz+-
z)SVhwpBT)0##Dm<-?4D6;vHmy<z0?JsF%nWV*a-HLeGCipSedmdUQ<#Zd{6Fs`tc#
zi8-q1H3;~TmD}r5d$_<N@dedc!vD&4K*}Q;hyPVU%lh2QC7Kx0<@TGolM1ocJ9@*T
z!}A4BrcikxdRFfAro{I6{Jr2ws!lJjbt`iD9avR*A&r(h+&r7k*rGT@jOh9E%l>aL
z`!Aized${LhMnu*bJ(Q%=+T**ND!ayblwts^)pDuTt|xyDR(t=K`bY=Be=2pI}4{I
z(qs!M4Y?wgEuw33Q<r_i-WP6b8e2jKsoP&q=J+vE{`=m(Qe*v4KudPG33hqls(Hcc
ztbi2~DX+4}9c+VraZd(Gs7#QJby+*j++T8+(|KjP_MAlfP7T%r8LC1dK%hIlT#pmp
z@Po6jvUs>w<z1Q|nIOZrT+!j{@T4`3W4$~@R$hON6!}W|!NcHXIFC~@(v6n$ZN%+n
zCL{~BZRcFac<I!6W840`lsld-#0-rWBd+L`6Bh+jLl!V+uDtMay;vrY$i&`P@F5`)
z&XXMX*^gQ7t%!O(4U==4`hJuI1@+JqRJ%%Z$u!m7GD)-MY^+<u&*{WORxMl#iN4Dh
z`w=c<d}Qljl0tK}vu}?phVvRJK`X6`dBE}UlD`yn)#K#f{+o>ve)I()JRaw#yxtLs
zPPn8%!%#g{;r<owI?L0k!MWzo&75kVk88#CHLm>if-m6_roC-=j%cT4h0%Oa<Ga&i
z+FH@Izx9J|y|0APLY(X!1X7)Cx{0>v%Xn>BTVP}?RKMStFYVJ}swtAqd6(^A7l`?*
z-}*PKsXEf5j7~mKdC0Qhr*m$25<h9AInVhN;7j9`!E=y73c=XL3pp1~bOZZa?Y9yW
zav;Sw8Zwg|vf$oDHTvG@n`7X6>O&WRpA5AT1YkvkWtaa)gsUt?^vM!6Vn+#i3&jC#
z_&|$hu-|H<s_oeFg+pGl;8O}ihZWl>F~w#eC)l+hR{MUN*FrsGFF7AMC8N)WYz?pq
z${~9nA{UkELHrmK=e`i7HpvU-Iwd?Z%usbV6Uq4$%Bq>k>v4<e2qte?4;IGqXFlsB
zVms#E8|KVpSzt=jWj4CF0JSg^&@w2z8Dilujs7t&mDZfC9yL-<LhucGKd3?NWPk7A
zUvSXp4bytMld}P8kA6o4nfzRx4JHHI;L$5JvJUJ$oy%I9vt4j{E_eER_L2tOpH4<U
zal1|DA^1DiAbhG3os$uWNcP<SOl)MT!(N0|@H#NRm1mX^y`|4UkTrP3ahGU&qW4hY
zGuMNT;{o@j>5+O`VTYbWh!P}_<uRqOhYd$fT%^cDcDn1g+u~`bt<1nWeW-%vayu|k
zqF2Qgvg)GzVSW^610M>nQ|X5MqqxZ>W}Zb<9=}jaoIiy*YTuzR*c+O69CmH8Sj85F
zSGeps9Xswz68D@7<dpX}oL{4Q6}NBr>sw5(nP)boOZFA^NNC6h+9Tz<-$Ue6ROgWE
zOL7(@D0XNKKUWUf&f(PFWX!;v<B+nfzR!3RL}Ra%fT4^CCc*4t_X%=P9IRQLo2iw5
z<2r2FQzIXn)C8ucy4xvXY3c4DtlgP%0@H^r&{ew~I#MruKh4bs;Bl9*t|WM#Upszq
zkf116WA5i<)Yt0$#^mUPK4U4b^l)|{LT$t*Dj{t|#l4o(&&k67%Ds*)F(e;d^lqm-
zM4Z#|{A&Hj8hh(eF5OE^PkrG>*N&F^=A&9$FW*HzUl~eG6Z!G&m$&bZl6y6|-=%>&
zV(twu-jl*IE7l$`#gzE_soHqmbsEAS`Kd4zfskNvvzR=p9D=|?d6dl^sdV{-o0(9f
zEBN{vQ+k5diQc=t#wSmNnQ8+S=M1jTc#FX7GKQEdahsPKgVU`}rjV)1j}<OgFO|F+
z;uYc@t@t`hcxQBuB0>!nsOvxScLhqcR)oh|EQU4pu6GkytBSE!w|vgzVF5qgO=8z*
zWF1N$*sMgbY7W<&=lMBW+P#kwaj@oR8j8ZD6TBu!b~u0)r!JzM(q8#Xf?_2-6lMm-
zdOH{7BQzd718!m~=;n9Xhl|FEj?w0q7xc2hw%scaVU1*tOnn?CE<p`(yRQtS*{qRi
ziXn6Whp)z1O^r9c957&L&IXmbMxJUxxFw$|z0v8>UYNadF@25QN8WI0tV}8^<{>fZ
zXO`ZyJtU2EK>;YXZE7~CAwn$QGE(=|%yu$Udp~IEvAiQ^yY-V2;+3-(=c@t9XQ5B0
zkLhl&l-%ijaFm1AfVh7_i${LrZShHpY@t5WMz%?A-WKsNksMJT;daY_zL4QQfNtt;
z`C!zCoKI}?wX6FJ8_(QuTpsJMr;IhFaekVmrtjDsS#D*YQZOqv?dpbJuQqkX)I`Wv
zO&ReYKv&NO+*n9Z4N%>{!g31TcEaSAf!D$#7?r9VV3r{BCfkW*#(h(Ggj#W^?zN7A
z<xAwiAX?dnl_nH~Z6>6{HnQqx;!JPqa~%^l!AZ)^hCse4nqCo+{yQGZM#9L^ppowi
zBQhg$jMIyQBK}Q({1t~q@$h1<e>O<Qw+wC3<IY=881E6DIen~EDwtz-^p&AD%Tiz@
zPC6ceqCjd2FcC=#PplVz)AcwOLIzgzo5)a@J9t@Cbm`U%(biO<9fghH@%QOo^>5R}
z$2hF=lAt9d)bInQlk`FZ;eA|nFm?Pwm)C{C)RkWgO>~9<9?SFF)ZY*Ogo;QWaZ72l
z3vIOjUaqA%LXS?UA00U@1kYnNM6AXIRPf|n!p+<<(>O(=#I+`O99pAwoa|<DH`-ze
zS8B=9bwPKb2G`ZLzuVraBUfIuF*EVqsz<d86Rkq=AehfjR6frekLQ@-AOqsUQ<yLt
zvaqmf{xG*;{^1poqicFgnm=i15W>pHx{Hlwnm7>uu;4DOZlhOJOW2NHwUs|lofrJh
zA?|q4(Gu6vx#H?{C3%n%=`Au(iiU8wl$e&<<cU-Or>e@z20hC;dOb5-^6*}Bt(@Pm
zJE?BuiD!zc=TPA-Iz$khdVBkL;l@8YM1RPG{)~^41a9syXMA8c%6s(JOuebK!r6CT
ztC^cSCf7;Of{EVq9ZqsVI|WvsSDwTOC_elOno5p2tPg?vq9c0{VoTEJy-PC_!7J!>
zC1O5|1te7D{F++}>Ft|I^Q>z*mdbDNlgsCTjr+uDpFJ`_sWuBB1Zd`Tw347P@{1A*
zt!{Z%zWze;4On(VISw?eNZB(j<z*6BZcDf?S-^GVxw7K}5$HR`PL46tZv_C|=eU&i
zINX})cg#q7%k7I2xS(}cQ;Y>A3#Aq~T1p>4n0C%MFI$$}Dtwcv>M*xrAjm7S3sZDt
zA;Hk>vL7iEcY#gQA&q6Zt4>Tve!6ue#hxAQ3W-Ct@|cpq4rO(`YIB8;zQ4MC6@=v+
zgOLvnn=QvUu+l@>^kB=@#b}f^n6s>t`4q)xK(MA<`yMuUd)l~e5pXOV*dOsE&#G+C
zlm{<<b@&UL^_j<OKt`W4=$>~B@td&YM!qH%Iu7dHajIdxJIBhjDEw^T0)=itYL+Ll
zy5*Cyy5Hw26i%<(6Y}oitTk~(-9gk#QiyRQ<}w|Bz1|?kMua|k1L2b(^@aB_)WJsa
z$EWyOzjlo+p&#XrD_@)^JXgn4QGcM!CR7E8xRC6LGn)A8zda_tW1W<VlV0i;k7?rK
zDRm#TEfx_VvlXtQTTID3WW&C9?SeNcK_M$=xRlgepPIUYn3Hw&I$gU4J1ove^W>VT
z)TKHFn8m9X$==%$s~p@Av1G%{Mnvbjuiw|IHO&@=BHC7{5$&)4LJx`PZBihLTg#&L
zrN;+#73cM>Uw<SUl7`;apZSq&BILY&NZ8~dcIj6JwY+bI(|JiW4>iI0(x>vCBN%M$
z(U>Pdd7LT$i;2oX*(m&XSNsGC-y|8|!MvZ;3S7YB01M4KGns&ZlqE_7T>3M_p3G1(
z)Im{w4mgCvF+U@QRj^V82ZOru$WX+gRB8}lQfPt>nM0K+^=BFnh`$sxngvi^N`C=}
z*0kl_)hu2VHF_VK7Y=tZMqh#I*vcXkybc$rjt>`;byB+gQ=kmti~9cSr}74k>_~s5
z_-6&#HlM_8s3A$YW<RbnCCpOEZ*76WE|p-CW-Dr^B`Q`~n}yr{=a+yiN?mGnAqe*A
zt^--}LFKfFJ6{08V^W$)8P|cHRjJbaw4pSWSMnYY4k2BJZT6-6=l#fB=%@DBw%kK(
zv8dL5S@L9)&aqKHn3jjPWwRAlweVV9J1aRDH~%$F4m-$@RWJ*P84erg*)1U3JDe?Y
zuk*|)NMtnvFE{W!G;8Z5HsmjSrC9CNSloIRuNXx1hf7UKmuBfuca?Juiv@SuVv>_%
z_Ow7()}u*_ncbqzacvq}{DcZZ%YdwBeWS9pHH$M(c`c_X%1b6x)?etAvQ<U)^B>2C
zXMI<kd*a>3d(51p`*dZ5XMch&Ufc0{SCJxDBMC8U2lqA2ITYc4b(<u8I{gCSZavz)
zrR5|wX>KolZLp?hy>X?3BAa8e#O<-Mn%H?zAFZeP*iXjo`SH3|BgbK=zDkt^X(I+-
zIE(1%Q#Rq|Y`Qm~*dpzA(CS@uSWfFWpAr!AgE!d4jDPmBh1XXx3DXk^lMuDQ{iE1S
zM4t6GvB!*`W}|Lig&}KS`<j0~dL0@!TsW5GZ64%K|KlI+^H(BNDL)6iye`{s&lQc8
zHa8>*O-uH~lb!q_%3-dP_Zfq>jig{xzt2SHltrs0+sw4iti3EjVKD8s%1*^0xDctr
zU>RJl%`cj!>I_W8`sS+`%K!}52M8iM3lCAk3L>WtYA9xmsxvGhWshP_xk=74&mn2f
zbVI^dgiGk4+-Y62_II55<TTQ83EPT0VRSyQ0Vk?vsbN4KeugE<UH-?ZigGTEeLar(
zHB^!zcTE8u#GWE~@U^^txy$o=Nh~T^qfE&jKWQ=A{2Aod!t&>!1#NjjNeDAe_8dm+
zF-<GJm1M7i{#fbH45G3B@dPw(tmU(cwSm*f>q3~*n!3u;%ZU-M6KQtt2qd^eJ<Aa=
zdiR$mMUvCF>Dj07XJ888c#ZSsMi#2bTGJ1%=dp##bD;1%lX0T_B_ZhtuhDhWbKaO7
z!$^EAAs*3Gn5)f)z?RSYJ+qubYB<Sh&dMb8nY}~bkC6C}v<y|XboQ=r<Tu;@88>HV
z$@w1;@ye6<%C}mhjT*bB4WCQ0mr2#A29@WzpZLx0)yk~_P+wz5(0^Qj^ha@)*g|aR
z5lt9=o>-{N{^C*M{!-@9S{nINRi)<zaSaLO-ANEuu`Zp4A*9C<uSpn^eb6^(R^_Ib
z?%j8IFvXkKStXwuI$~uC*tDi$ZR`8T{&%Wu40oS=ahJ!kB>k9PUcL%rKeMmpsa<fc
zyg?8Q<qxDCyY1n&7mpmaU&3Qkx?hxc|CZ;YvpspvQ~e|DO|o(&&)><s=+8GiAjzvS
zxS_HuVxpmcgPd=hd{|RX@S3y#*jusF6%eNf!Bm_9B$D<~T2Qxd@q9&jgHRd|Wr@#u
zMGfOfW7EkhTlD%sDZ|12UeLPk8uXHn3L12hwfu=ll}rs?O6?6r3+L8Ej92C+M!!ds
zE>{DHJjnND14d()_jP^u+H6E&a~qZ3T8IjTje_vrpkb{%XibgCPlOZ_MOqLlk@H$l
zTL8ZtCzXYKC&#(e-hnQ@nKf}qFw+zRtkY`7fMC=vwC15dt(%Dph4VFF5)U+msPJ+x
zv*%)L1jA4U0YG+H^Cjl^Q2QM&ayqZMW_lT8fYADiJ!I2%`We9VRr?%hc`E>lKZ*IN
zBHb41dD}yoNP+zTK_f>I_L>Aa*I!?Bi~|?>5wR<4j%Ar#;ndz@9fq|IaDhme%1CgV
z6Ch03EXJO)nx7HkpCHdyl7`%cFldvrrhN&ZN#yj@HO~px8bWt;uCG3YvvZ{9t+Qxn
zoeyNDXoEd+YWjlq)HttVIq!?an=5ccoBYr?H&i{S@Y>=V>>qz+NA&V|q;;4tsKi3S
zf&@=t*TgQ3ilK)jW`+xai}n+rs||xND^G{0hxosY<F79chAa(-M6LbarwCtLOdxzS
z4u8t09z(y&O;059fNPN2`u9(EtG@K>LSK+ckfQ8fmCk7uZQ{B!9rXA@0q(4n7(_*A
z52>WjMHhSGJ^N#%CN&Md;OpT0>#+3$_sXFvJKyzdw8;&>AFqzq8RoZs5MZzMgPV0|
z>;-OB7%W-^ojuzkbQ$>|u|H|dmT!x7#Vt>{w<b2|XjQFe>q&)bRczW_cRSnO<5~Zh
z)sY9;yWP-xK^{09PSfPYgeA=m%!u{$u85%+b?zYXR3wU*Ze0JPp1Pdw8Ky63->)Vl
ziu2AUrT11%ieP`AOiy};eB(raW5q<G*h1lk@xy{~Dr=q7`jkdGZm-)m8AuWW^{Fr3
zUI{Mki1-^Po;EYy=+P+4@71|rCjhXR_gJl{!^*uZS(tSw@ZFrjPl3ORf=hVE5pNq-
zM{q&-$@|%PUrRQe@p3^GCl0B~2~NNh_j*B?%so|EJ7AA-7u+8;*yH})8?%a*BtKoK
z)f}2~TP?7n!E~ba8odlpFUTo_9CD1hj&wBXn%=p1AL#&ZHxys@gxj-e(i1nu3rL<S
z$A#^*?mr0hPfl(>eG|*7W-5Tv_h@?{B9htu<2uY#4^qVZMH$Q*9{I{C=y9X4DzoVm
z`nKu)o6lTleF)b8i@OrI;?`J7`Nx*iAPtq9Ix2ltzKMzP5j=pF=csWWip(Frm8f-E
z*G4_Cl=3MhAf_C3T})g&GtqRZ+y2g0_&s*~*K*a(+h&g0(asPY^9N{NO(dRz^OR!@
zaZ4^b0xfj-#PA#0@ti;1<l!ppL&Z=vYfiS!5Q<9I1n@?2d2e!trtEu!jlt|X439}~
z)6xF=ov|$MG)l*sWaL;b5X^ho&2M#bHah4()Zrv}2b~Y39WQM01~z+koBARm1<l#)
zS{0)pW7=$CXG(Mkuif|3I#b$=0(9ou3is*9VaGj1bgO-OS~F%(hq*K^@}_{FDBt<?
z?}(acuQd=ts{|A9f{hbw-;3PE<?N@q>7kD_c8xikv+pD7{yJ6d-ZgQS@ztn`nfYMc
zTDxP15<(g+1G}_JhRl%6CTQ%<yuc5v5-cyGM65ZE_kFIYrfd5cE@nIWdHdN<^!?zu
z<E-gN+xWR5$9r>MaJbH@Ur)P_tKe9^tb>?$0+St6=|zPYzRx#(rjOCVO?q@vtywn*
z$*WkFWJX!J9+JARPl&ARi7lXU#~IpUZlKQ@AlglF@aDT)?QEY$Vbo{MxHf8VbNw*K
zYl4)XFb|sYFF&ZtyFbzzWEVK=r`g>3u?CQu*j<e*(FIc}ib{RHVOhIa$O}gz%`d_6
zWwwprrx`WZlMIp-)bH>?sjQS@qXG2)0&+7KZ&u!ziKG$KPL>lTotnEzW<h6@lzg{@
zjw&7ZliQ7JS5wV=(X2UP0Ai)9>z}bT!+rbfxsi#^ic--ZIHc(5cUvbz?%(w2zubVE
zcF!t)M^^#>!I+$We{=xz0rrBXHt5Ty&29<^{k(wqP4%g_0)YR@l^<uUz<E5bz+av*
z0{#nnI-M0pU4n-fw_&-feL37FM{M9{a6S>N1K~pu3`k|&1SQ*xJ)6E#=&$Kb-C#W8
z)Jgf3<Y*2OFE)On_}u;|R=r%ePeordW`oBQNa$db7$245Z-nU^^*G&&X&CW^HVR;Q
zO**RGG6QE8$H#PchP%Eyb5*_s#5Iq@@B|LG*AFd?bdJG6^6l(smD3r%G%anIa}<e&
zv7}@`blkkY+>m;K_YyK%51PS+I-f&yd@5~fMNwjgS!fL~>8D(X12xAzD624J`MW3C
z8e+gQpJ{+&WTZ&``th~_IC{#7BMzk+b%e7hJ;KX2u2!>@XDNOjN1HBb0wU#3mgmxG
zHd(T`{l9S9y@tczcc}OW-L>X8>l;t&i%ka};=GjkO8~##>2M*YR>z3@U>EdOs&{%z
z@{C^RhYf*zNM%GS8giD44x9G#Vm8cul~(AdId|xKQR*9Pr}nQ5<<-88n~s5G=K3bW
z;&;79hzM`)#mz=QZ~cjFiFV&qT*{etjIfx>YMk=fBVl#brb2eKs-gPvjDi-*X0Gtr
zUCzROwjdS%gXv0CD)bXtqaj6j<g{2?E_L>tb-Yq#WMT;3L&Ewq&ePVqUivZGfQ<V<
z|Lc`Jt?ExC*U=H&`CcC;DnjJ+CiPBtpQ*|JZle|33wz_97y3w}ekyLdE;~`Bt`~7|
zu$wTeQchHaGxj-TtI*idVyeY;ZZ^A@zQj&{q#e8A5qAd>AXKu6P?M2~@_VnX(JFi8
z9yy68$2EZFZ@7AfxrcgFmh0{`=Xl=mP*zt??O-6-!CxOV8)XR&tnHoO#t7xlm<L(R
zb9z_*QbpDF><<LO1uy@r55QmP%HqCOYF22J15;~Pn0OT<@}wOU7z@Aix=dHUwoUE0
z%st?HdSLr2$b0mT!FhS~Uf}qh`s<a?s&Vfpl{K9Qi_F&onHFo@_bO6e&jzRV4)&Ds
zj%PmqJ*p>$-TxW!y-GFD%Nra$+e0<4F(!M*bN_~dNQlmSCif6jEPS{a#z^2%CDnY@
zlZDp$-E(=(hpJeafsrD;&5Cqv*n9Dt5L%YUDZLS_!6wY*={7GM9>jxYs_Ah9&*vm5
z!er>X<*~BtT-l(ON8ng!T<A{J3VL`OV$V!gW;G>9#jF%XPvdOH$mR<lUj!z#7Qi>u
z3TGye^Id{#$QDhKimo@g=o&amhSFLB{->kQ?ZotP4O2Sw>vXIN5NPP|qXFWmIY~mm
z425hDVH~bOa!hE(%(%^me+*K0t6l1MK&mUFSV;&zLdE+lpf3H2Z4Y%K(j<avMgmTH
zkL+;kIEO}1?siOtLU>v3XM9o^Nm)<w73h2JLqmW<49T=-9E*$Pi1;>r-teS}(ClPU
zr=SHm2uqIR5K^sLF>pT@m%^&gV>v#!&H!>%%Kj}DvJCsd!{sE!UQ?h}*`Q`dWIcX;
zP-9vTI)Kn5r6{zu@1;n|Fb0X2bJX>VRP37b-OrCV0naFkxnxl;^dmsC_7$5S>im&t
z%wM-~o#7yirkN@6S1YN=+J@!28n{VsmY4V4NsyV!Mvv*POsF+y11q56!H`}6tu|%%
zT&0PhzH@Z<;lVu0<;9=$XS<3fo}M3NIPdYD8QB?;!6vgSQCcm(Di7n=%4@T0WvG%A
z$FJz>3O^It*49(jqef6`0Hp0$T$|z*Yvea$a=$%_e8}0r)W&*UWpJ1(!n{6+u-n#$
zrCzldt&l0s%c5@lycYsbw~Y8HcATTx0bnv{xnvw|xn#fd<{lba!7D{!Z+S2&`@{>B
z-aaiEr>gYdiq(U>(IvtzO32#X!TJLFQyC*Etjsa>Sr@Ac8y`}hHCDtK>-A_J-6&54
zBZqpiYBGn`+YQW#VK5A5y%u`lc~T0^?Xwh;BwWvU-Ep#EFC!*Pf@)VKNY)cz2Qg=0
z(OCBRBG=j0`!ESw5BC6)Gn>!u1+pHFzBbFgvnNBZ%Qbtg6xde>uU~MeLcbPV6<4vJ
z;x$4F5>?et)rRE8DT6|`z{Z&Dk^9^Zh1FEQ#7@ntwX`NrT}2<cxlvv*io#T}_$HfJ
zR?s?VATiIUEZBH;@XvDQ@<UPV@}=681cmOK7j(9C)o<eWASkk*1j*$I=&l^p2&g?N
zucn#QG&mF~ruq^aJ1q4!qs+O5pK-ArWUNR*_*f#zK*jS`toaTN988$dabfhhHn(Wz
zla&%8>7YpeM}<7WrAutLWL}6N>a-7B!QGdW5=0_+WW=tJpdz4=O45?4#3Tg4h-zs@
z_Ga=iwv&uu6Nr#0vj-wi72JHT%1b5`%h~bFc^q2da5j8cMRe)M)1C`w=!e8XETTJr
zDOd%033;@Pc`q(##+KurZrBlSrK#z~T)sPQUQ}J-$)=kB!9p!H?LEnzaqqJoI%m!=
z6ItSqIO})ApYALci6)F+LANCqWkGdC7y-jc>hgWe^3D~sYUZV2NkDmGUo2_{LWN0t
z`GFjr+KO7M64t0prh{_hyf=*}+d;VmQ>8|o4DAK4V$l}4ZkkmsTACXoji*cP*-38S
zfmg9PjgXVWBDt`L5C|mMFx<s-VztX%jpq*D%=dHN&H#$iovR0?hn^H3{S8PKxlMwp
zJJb+b)jZWMg7pi40(VGt>MGgBB-KXxXRS@&ezk7z)NFO@#A5`#QcHgTHP5LDZ@JtT
z6_XZ&JQnn9K0W+`*&uf6;)LSggWj*&jpQ0W8=XI=$x=kjj8Kj{5Acna&UU(p>@K)e
zRxGS<4;$&kw!m?r$shGrL)?E23t!HaQ{XTl)l=^3QP>CY>+P%L`}RIJ#8$t?`%#8K
zp!GAxo19^X1K$g0Blfe&ey$fiD!*#aS5q93#X>fa@g^*VN3%_ufM0%OlnR`_YU{$*
z5LT+(g+#iApvAI=MYW13v4w2+8SMl{KlqvYFJV<8UpP781_{hm0JDD=JFTo$@uml?
zB#&wxQHQ3?A)QMW5;hH{S7DZ84V@fxTq6x}bsToLBK+5Kd7}YmiOqxZq`p_gBtX!3
znNr0D{(PNOh|p(zdJ$>ot+w{LX3-erRA@6KZag4bM2{mL>%z$9B%Or)?fN&&_O|IV
zQ_80ARTzy;Occ3bEdFj=ExLj^CA~MIMe^fE;vBOm3#6lD7P=<m(ueoHIuL;jXXe>d
z#UNklk`~xjMIM?TEt+Y@4}l%B!ndMF90&%X{L1F_%9*l8<EN?n&Jd(&e8Z8VZ2OI*
z>>ZrXBLcUUg7ub8qhWjGOy8bL+anrl2CJ?80$d!c%rbRG=4;iu^-OLZv8UDvQOC*@
z01I`icDDrsvRP=9E4m^|^7qbEiaD6BpVBeYq{EmH@{h7<jTOp&#r{bf^zjpWwUs=f
zbCB!Q<{QliXI+pzyL@PWs-U&I$g370F_f&FXP3tLbMeuX8HyOc@i7_VNe2~zSD)Ud
zm?)>EA2b9fwlNcaucV%<92n`561+mRF?o}f=IZhqpH=36M2wl*lKn>PG0wzU>rEI9
zol$5a351bza=T^xnFf9P7nEqEES1e%MPzg^4?KC|f`<N_m=M_}XEe3Azmr^04CtX_
z|6LD+I5NL{{^zj(66v=$6`cWmNI3Xl!H`Upz8(+Kp5unhPla%r4P`;NTi=t|r)H{m
zJ|XcrRT8z_0JhJ@l~YdfG>(Hx$G=!?e*Bra{Wp$E_*wM+q^%^`1`(R_3HW^n55CcB
zXDZH)%L}cKv{P$Vr=Y3+#uP4rXLq59v569p!Y7jkAF#Ahv&v!KpAn#A-^C;2D<78~
z?FlH<Wk7wc3G}-vlax<yjLzT>dR_3B%ejoc$BHWgV$AVO<kZYH0o^}$?|<E(&l<&O
zon;J-XXhs1s?Y2%)bHh6Er^e~Us@yaxy$?*u<qUIP4Z$ii3jhxEZx2NkDB}TP5Oh#
zdoWeWOFn;yiL$pr4|)y2nVk<*#f3)~Q(r9lGi0*%EzF{_jJT71ntUE&fy6cb?5_98
zmeZ8uh*1t0uKA|*@E^GU1s!YtrBBJg@C53QHxv2`#N&jXE9wCZuJ*ru><~nTeoZ;H
z=4)uC#ql``;;|f|RnW57Hf+@$BlyRK2|Ry0tI}O{{Vw>+H3OfEI+d8S?iJ|ZRsw?N
z1A#b7cFj=$7Fht^wmerN713R0JTN7&;v!Tw9B&BKVq1s{JdgJYzvtT0{?C_J+{C6=
zbOE;%liz`2M%;&CZ+jwDp3^rprHNFI*;dMzgo_<)0{UHn*=M{hsyEmFabbk9ZyOfx
zA2__#K`0Pj#^-uiY(ByPy6)gQG;)<Q^MPy$KZ#57`}lFd+cS7GAby$vT(uPRA2yhz
zy7U?TW~*I%b$1Q#LOc-h+p;2lLXCfvh5y_S@oI6VwqT-cC*L~;4QPrDeh8ld$-mYz
zzdFJ0DXcl$Zx1m3{>PnxZ=1yKE1reh684Qf^g?&~^T>JVN56PQ2f@-#`yZ^iHB!x%
zc{Mh^OZclH@KzLpho7w6q)+*eyZrO_Hu>BWHDTCyobSYra=h$v#jEqTpXQnSuupdx
zwu(zOZwveThB9=(D;w`p|Hr!j3sw8;>i<#Pg1_4@xzwEP>2Y~f`2Xj#|GvV1`zk~J
z6(GMzVp%NTJPQ7|pZt$S`0w8eh=QxTUPW{l@BihaF7BvKo%%oB$Dc70+)-*1Fc4q|
zgI~&PCj3X<>imPA`0ua&-!Bh5a8YUku<azUEWvLc{o^3{Pq!%W;;pK)z`VH4U)AM*
z`X7K~8~Zlz2)bK0kvRJE5$Zqx`@gPyP3tl$$!@XR65%mkIpS0Q|8RGL_(ZVGKZ22e
zKdb-r)vFnzoMxRu?dqI^a_fUJHawz?`&d9V)JPRa<%5}>EbL#O{d*+*-@GS&X@bFx
zkU%)$a@%4#&fBLiU1|bo_%5Q{FtAiOJ%1-|j0LRZG3OaiV=6t5l0>hg<y3(H5dalB
z%hTBb1AsD6)iX6P$o;+C|3B~V@5d+_0$`iSUz|4xs~U-40_`C{Dw46L7b$PlYdJ#{
zAkI%&)&gvO7<jaOV+FW-1(<t29wtR=3Ig57m+<)xFtubI3_C3c14*kykqoPbZCu`G
zhuO;~yjGJYm6LWs#GILqB2+pKVe6wMtu>CTZvY@KySnnZw63rX$Y6d}IJR76QU}UH
zmB|fIIK8o7?8ZDN6&}>Aw4!ky12J^$<L##w&AtR1p|BsFQEbKlF2r20Nw?=a$epKv
ze&<`c7npxs01}0;g$k=FGdeJ@z}*wTGqGnG+<-u1hW?Rh`}MZ5I`}11JD;B#kAob0
z${yA2@N(;YVQ7d{yI#Kf6CuzN`^g^nbJum}_gIEZ#3YxgD`{qx(wqN_CpoWv*|R4>
z$k~b&wlK=}#fOFrkFyTzo6Dt=_6wkvJvP{7kn@%S2JJWm%KYl0bhdVA^d``C+L$y2
zpXa!9>TvFIx;HWbtTuFl1PDU+7ZhExyn&mkh_}}rF2fHL?3&#2{t@K9|8hzc-ugnm
zQAP2h79e5D&-~BNaE<$5)~_ZCLSZr6<nts3`Rzj63;NQ5u{)hHoSUphJf{8kf1g~m
zWC^|tI<1)i>)OCa=_~q>08{37+^?E0Q8fiVBHMf6QwZMXr2K^nv;ZhWHx7Ywp^myG
z$U8W8cY(n0E6M9q0OLJH{_bA_4PY8@zHYc`dVhQAL=B!-HN`)xt-lxAzkgM%2U(l0
zkDndza$VqGI+bi9Ohz;_g_-dJ=U=b)AZ6v+`_5LR4ulWu;c^@@uQMs_4BA5+cieCr
ziH1qKb?0Zt9Ndo6u8Wz~nuyY1qn39Uy=<BY^uf1>?2Op}j9&vItT2fV{W7+2MgRj8
zCi+@JilQEA^dp@G*NR)UKUsp&nfu^a9tA5>yEg}(3{!3NIyF3&y-+P9*z?_S8y&+q
za!?j>d;cjhlK|6GEI@f!p~t?R^Q(TnVq&uTF37t!Tn*n)Cj)*0<E^0o9A^kWh!)bH
zmLFddpi=n5=PuK%9~?+bohTf*b}s$G)X16Afo=l8jP!n}bP6HyShcH)g#qzWHAgY^
z9VsKzm1GCnP~rX9C}t&w->w-@j|-cXT!t80^O3@JG%HwgE;%|=^|)zsG$a$Efu?r+
zcF+GERS6)qXv#F-M}@x*j`W3V>JHUBgeR@BI_0_{09k}FzE4j`up7v$YAIdgk~Qx%
zef$0->0i*m{r?!bW-nc|qAz>-2-JIWiULocky*g0tOWgC^}6q3Tl=2|eBrL!^CgYv
zXA^O}mS**Cdx5T_KyBx-$A&pmc`J|n@;VswJtl(rrkCEdnbE~aV>{^b(6TH!6l^vZ
zg$_HpW0F}Bm{|N=g@9FLFi<Hfj~fxS26TV8vi?0#s_9tdzx($!_SZ@9clcYw;epd&
zlk*<arw9Vjs{?M(e)XW5<^|p(S|zVh7q}CMp2nbhEwA0E>AZk#|66_i;?@NKdkh%k
z`C!UwA!d9WW3Gd_&tB}Z^?JY@^#<5o{2o?HkzViThSv3QUBuywZlviP9hx`8$qZ<V
zB3MS#%*25eaHV80b+xKjwcP@Qb0aDA){_<_y%`WYn<wvs2FkxeQ#pe~V3p_UEr+_2
z_uUdhNr)-w(8KM8AdGsc>D=r9_-9s|^|+*+{=?PSAqW<L126kE74;K9WYhp3z1~91
z`LaS@{?;>>;^ms0o8iN7Q$Rq*?E_U^m4rjrv?opnryUg^BD7Iun0G;!$^^HgM#W$@
zRfEw1WRi|y61XByCTIjzsk#8!5Yk0e95n9ZHUKx#POLx$E<98aVaV7VGzeCb*I<s)
z{z_g^4bqdy9CU`AcDnc`Kv_}%H1AF`p123qSFGl^&!kxnBKwZv$nu7x6}AD)pl~t>
zmpIrn&>@o_5ih#^XCn81c#C747bz^`LFDPi+7|uIZ_-%Pi(QOuC9N%%;MN#IBXv5<
zz!PR7hSdY57RUUriB*>T)D-!;R6w8NFlBzp1KMfk16jd3PGd$gs$+GoW$}$BeGGg$
zKBS%>4pJ>0Hm9dB>N^9w2O!doUz|ov2{yjDj#K5P11)7!_DE=d_4|p`LsW(J%!V&a
z$Z4%uXtQo$Wu$1+IP>6wQJ!-GmVN~=%QEcDI|{b|(SG*#AzIe$6zI96vW_VzAgcg@
zb<Z`E)D+1CJSgFvA5VEf^K4{V-f{^c!%_nnOtTS_K<Fu0nTOqzHJ#b|{Q%HA9}21w
zV4!azYVn-s!T@&@*G}U+IfrKqDO^tQC%N+m#77=vR6mfL3#0>|02RrNMld37{14J+
zWYxw-sUl|$YHt;I`_}QFy20{8{|^uOzu&{B(zoXJ*_$?gOtmVyk<}m*)AiZClDu0{
zw>PXMe=i-hNyal{bXUevEco26+lDF>cYyRYjSU8*Ddp_Qkv<pDmH1a;033Zr0VirU
zi-JRY6s5S!pbLm?msoUa%5wu1!722z{V7nSRq9~4RhVVOK4G!V<nk)L*`OpUOp6>o
z1&dwV=pHIgv%+H8S7pxe)Sf1fRoAo;Fh@$06Mm)xN@6Nly|pVZA)EPHmE9N6bh5{G
zfR<iVtf1q{e3HMP{J1gjLz!|o{{?7Ie5iD&gOX!To$Jn##uK{M=InowO@yUKkc+?s
zsXZP|kGhcVwY*0E%y<IMMU@=(dd9xlfhX;E4eH%-PM0qXAI2C%pM~EiiUx0@{Qw-8
zRlLp+;$^`cx6fYzzrcV>+s4N|sqca|UmjXM>FqX?(-K>lDy~(71NxM>V|QI#cmkq1
z@E^$J|L&E1It4{f=}dw!?F&4>plWK9VM>JJejqPPUw$YuC~F0Pk&OjlFJK8eL3?GB
zzjl`gbRJL>ya(1AC^e6j+-z+O4aQX^=YiW7u+dF;?B=Caq*nmbrV?22Fliw5DGTz7
zzp+<Nz6L!j2g3$Zz-tUepTAJMuAG@2K+dEIw%9tzEkg3CywZ9@TSQE+b{@>CfN)d*
z(vuGK_Q9tx@t2_Yy%PDJl{FWY!YVQ4Fd#qIS_}qtT+Ec$K47guX@?V>yWXJj2#?o1
ztp}nYtAHi6(pfAkBInh`cq0qtbz+Ky{#$|$CiCiy#2IrkY0XTSpYg)(6=3FekB%B<
zFCv!?STK~=b*n9|`xkbANEBx?A>OE4*A8?!ruF9@K@vz_mC<~V^2j)e0563Bca`Ux
z0ZWHgS493({tgPf(wDQK8K3o2C3?A3A0O{Borf&R^VF*-rW33_JwcL3RZGuKC@dv{
zra2qtc{B=EkMcFz+~6^g(yfSV&Kc}CXM;lj#W?2BzBe7s*&)OJMb~v9Dpvm%-Ka9b
zL%m$qx?uGlPwX;?lp(hTRpLdF+R6{oY#g&MRNgdF4z;y_o;ivc(Onf64XBt50?_DL
z`Pl^<Yg8_kn&3M(NJYTOVN}#`gw~Rz$WChqTks{_Qs47MMNrP)j~D=5*Fazz<BY6!
z@B{}HEDxC%J)x@!nyEGqg!Eh=3EqvFzcjGL5H_o#x!DM+hrWiBZ8^0)wrSz)9rX%}
z&&#ytAchKtB>dl$K3oi<ZP_1}N;vRxi4JBXG>sA+hc#?tREJV+B$zSXnl%o&=FM5E
z7A2BSKvu7*lqXDJj&PM(|Nc7oA`QlPt2nYHR?>kb{Yn~)wmX^smad7*Wr%n`JaE+a
zT%Qi}zbd=(cqrF49MLH%szK`5QVO9I$}&Vw$2wVt&oYv&jL5+tYkWz3X|dJVsbOYB
zWsONmqNq3+`-q5So60iI#QE;G?^FHy{T%p<f4uK|zt8*J*L~gBeLX}q1gMd6-_PE+
zV*}wTtPt<jAEVL<)?;~4BlrS9rM<d?qqRo(WUV$qq+KvXW{}@Whhg3RaO?Zi+tUPr
zv7hA?lJ`j<IZ<1K9|f4hht22cio;?|r?QyGnZLQWWgUZzDOnO?2l_DlN%C|MUWqIi
z$fq%R&21(zvA6lbAN{uUouTVp*WH^Xm<AZ`WW~3#8zSe*eaG-noEW*zy!?T_TZBH~
zZ~uk!gT5})RjjhG{@=#{@1nMvIHw=I*mD!9;wUk=hj`siV~A9hTt!Q?vD~mj48<&`
zJX$L$=lr!Q+igf|@QEPz^R&S6!=;Rt5NNS~lA8qR=Xe9>YvmL-fAi_s_?MysuMa)N
zr9ZEdR*w=2YLbBjR>HnDgwJdPFZ~D5cm`^o8bE^L0rM}SqI0+R-#P+SP`C}8DBsrx
zIA0FBCY|K`G1w+2s5t3MZ4|TJFc4I9?z2nV{BeOo2>sBwoBM(CSLxX#KNeeO1SXG1
z^t4^)%SpRfMczZkw1HRy+jfP*Tr<+luU34El(|1}E8>*%JV^kZ@l~>1idb=&&#2f>
z^BIo4!)-Ge=4{DyMRck5F*Tsx&pV!}{b%G`J4~|jE9`|PUhGjBldKELX=%MtHv1<X
zp;xKwP`x(SloYK2D(lR{AJe5^401#{A|Oj=Kl=1Q7h^cd7QV@Bt;?KRj~F&zDkg|=
zrc6D0n$HI890iVJ8-IxEG`W<c9l@jQ*<1O1@M%d@QHPn9I}`v!aOeqRwVtIaliaBK
zR*y9L3mecQGADI69-6Gan`3c~$6p$igLmO+q-Z!iWJ?!CnWww>GWD?esGz3z3|c9S
zCmy0Z+AkfERbit@Q9d__V4UAEOg(it0`?w2J7SgEskC!0hWAH#(9*qGi6H3}kq$z+
zvF;rQ2Opy&TQwCWSqFnyp6vIxuHLaKbZIR-g?T)T65Fy4J)0Oll<Jo@d{vC+5qT~}
zlrT=MQu1fog8@%U;AA~%`X&To<aMfA8_LP_-Uk5Ie(WfLAXBB?Aa7@W0Ps?}QAG9j
zgAtHmxOWsh!+OBcZ;x&3j}&{vM<G)yNZQ$I90F!TC7|Q!u9A?~lzSGZXYT^C`J#Ha
z{IVM8qK1{486VyicFTU#k~IZHK@g(Acsn|gvHAD2%omnBRQoP$8HN5<jB6qenV&Kp
z(a?}t?}bSA)YD+@<*Wac8oYX(R*gbD=u{x>-P4!Y$DOoU7)mPCfXM?rIc^$ZWRQxE
zC>@!h`1(QVtrT$+`W4JQe<DNRUFXJ%+eV?a>oeBTlH>t4g)d~#u4TtW&s9qq-n0km
zlrT1K9wXE9JQ{W+f&6&_t1q%^w4;zAQO$#X0nq4dF<`&44=1SO=5UTh>BCNe5Gd=%
zQzn2$&$TJdPfqI*v)U9?4yA+<7>VND$@r7oRXmEo-O~zkYI7j#PUK=x;Co4P&6pz`
zGkn2OiEHyF2+nZ-Rm~DhyK~Qw4^&&8nuQWYI2gAlq{gqhE;n_}zd<Hh1d^Nvu;@Iq
zdd+%f9OD*W%0Uog6^j@s9`MiPuY)Q2Jea2eXnaH0g-=+qI)v5tOYXn!XSrdrOPu@e
zgQX`_MI*Kmw}Iep1a~1ZVk)8r;%eSM+`d^D&GKn6Ic5d@n!O;Y)wB3qgJ&q8ZWNaV
zBgxp=$8*!kZo^>7k%*w~&+%?qh$9Q9wkjIi`bkG(n+TMxrm?@8YfxZQ%@?qlBrxmQ
zjfvsrbL^R!I7YvKrEOo8DpHvlr>g1>=2;cia91AegH>1x9EiN4!k6l^YU*;`osF1K
z$P%Nlh50F9twwG-UinzqJ%6_BouEyrM=C9+Mc-s5AmEq<7mx(1k%;+}&ub`j488oR
zYqG^NIDN`%!F}zz6Ix+8sKG+(P5PFgI%~(0kZZiRRaixEzOxY8BsUMy*4P_DVon)s
zA{mS!c<b4JglKKh%!?5|P-DIU%6aYUwai`7FuC2R-zOk)Lq=74U_f@G^uAm8qo0Qw
z{Nx&8OTMvlXDs+2bkZogN#RmdFFKeiG9_w*VK&yf7x5>M5W^ZYZB_9|;f;4qrrMKM
z8B88$AI5eyDK(O<i>Yc2@86jQqykPI$t`HqnCb4<HVP1dyg2-bnwU1C>ND0!{}P<(
z%G37{Dq+Mr>j4jrYC&i=QgO9#a)J)|y;MHA*_hvcNrwaD?SucC{G*otuExoBDb)*8
zNQWi-6nq^{v7U)<PE0x?QN3I5G4+8Cbfpfh@8WjbwfgMVK+KpB;qraXi+|SEx-H|=
ze<{>B^A}gT;+q7y9sHYMirVOsW$Nw%m>kB206{h+6(gqEQ(>Vio@YZb-6eF!gkL99
z5}P#(TT+wxN4*4MOOFxdn7fWZ3N)qE-8zdXU8f-PyU36~!A?e772B$TU<>{afW169
zZa_1;Jo+ej?0R>7(ga?>RBb<2wP_X&tc!fnyVBGqC^G2zxGonMLSLV2PH`A%yL<Hl
z(dQ)(K0zL*I+$%vFi6NeDF2|BQw_w$4)Q{09S(JG$rZ8nuka*G+cEXV)<BImXwCB%
z0lUGFPDL4;{cg}^p@YqI%D`j$uEPs1nflzI*#*=2lF1vuMnT8`jO5%Ay^1yE84e)0
zWc|f-b!O%2Y4*fpnq$!W%t*twV^1v;;85@~-d`iyqNdal)lS2}i#SH0CyZ~5&t)b0
z!jdnJ;1w!=+DQ1opsBczJK#{+65sccMSklL2Nq}hwT@>`WcfFucV+GKXZFGhs&4=<
zUzm3maIuXl5nn~BGy&jdtER^7)&v!5m$|HZ@yAab!q@_n%A<%^-JpV1LA71L@Gb<$
zOJ5^p3VPukvjzRoMekg`e3rcRWcM4zJm5lo=Vyl^RZ`!2iv^jU*2flr*HW}AIWMVm
zj*``!87aEWPmO1S>~+0n3r79=9TB^3fxn5@5#gc|95Cv`kqy&bj~_#+QcgAI8Dx!+
zJySSsdHBGDuFiZ+y7l>Gh;A;`5m7F5=^kPo#JB7ToT6JYCJhuST8!1k4$i2zUIhxS
z+}nacvM$D#olkzPbCLpLRr+i7&xS%h(ZwGA*8h`nYyh08YnFQiySDjwyCIznUILqC
zO>bXHuK6ZZSPTMceNXJ0!VdD1-@b&dr7eB;8wdGU+t=k~_&Nho>&LONSl{6GHtcDF
zWuM;39T6VpN)-Di;e8#%>F&}mX1prgSA%lPC&#tuX{Zp>zyc^lvde`d&Z4SJ=;XkO
z3Kjah!a$B$a#NhP8MP+?+a^J4FgU5sm_SH3bIJN~$4fow<5NhI%194){n4Ilk^L?V
z;q+YJoLGGYp6u;f@~f22R}^;}Xl?cHO(4Wglnsd{ql3%4O0R@npW=K}m&h4{h#TGh
zxH%Q*%(o0$hn-xRkE31gZJzg~AF|`xxS0c6R{k#0#*j_{?qHzvf%6b06wF4m1wE))
zlLK*>rl!5g%;01i^sj6{FJI_-cXZ9txXL~hCC)0+v{Skw9JbolzN^H&^>JuuvXWaO
zE_jOW+oZSKxnB4#)Dy_43Y?EzQszCB)Rg)El;d1K-w{R3e*zr~2RL6hY&pHdFcdd*
zlAb>`<l=7^`q~hP5!L8?jb@(#mrU;xk*cZ)-Z6j-F{5_@h_u2<VD-S+IBomE0BMnT
zf;_GL8-zsf0y083mlhl-+^)vCwi?u$(wH>$uX7AZsm{$Ub{KXK*gDfGX0^alr8~17
zo-X5+0NsP;Ab9Rz#iP|)wHIH}KSez(c&`@R%Szj%mDpgOfSxhqF8oURq-#gFe{b=r
z%#RBEbTj|(ry{byt@ghYy)@EV*daS)GuHS4XPfobY`UOOW$7fgaQWxt^PLQnkJ7iI
zmqWXKyPOQ%p-owb@bY`WPUc#fIk2wG;9A#KbS>F?fioWAm=1&2J^!%Yep&_M2e`br
zhjSRj`w}I~ps^MnY^_t|DuMI@9b)izUVf?Hw6b}Rf0S<4>kwZ-G)Ty%vbQaz!}~Ph
zMnc`0?F%pDhvM_6M_Tw((MUXW{!8L+jA%H9C{=fH1wpCjM*4fOb0}LgoDVChEq$?t
ze;)P{#e&?v4(%+pr)veD+~}qZSdxbdg;ua6cZM-&ey~pB_I9jaK}h3}kb=2xoD%KG
zLaY{Uf6?fM8KN@iI4Oq$=@s0dD3muH{V(m7{O{i`E4~HxTIU^7$twum9ijG$z|u`Y
zbpfZQzpc-u7UL>T;vS?80ZZfki|iHLU@{k(6>rqIoK&?CTty7XItHx@cC8?EQb_2y
zUU{tG&b+xmU*HUQyEZm&>BnD4A6m-bVO96r8Q&GiGKiAQP-k0rN=5D!uT}7)r)zvP
IU)w(Xzalzi8UO$Q

literal 0
HcmV?d00001

diff --git a/static/nic/gke-install-to-new-cluster.png b/static/nic/gke-install-to-new-cluster.png
new file mode 100644
index 0000000000000000000000000000000000000000..fd1c75d5d76823c9c3082c7c33f7e9b2b722737d
GIT binary patch
literal 201085
zcma&O2V7Iz(l@M#6j3?|Ql*#Bm0m@pcR>&V=^_vay(3*hlMd36qJmWEO-g8?C?GYV
zgx-5^-{zcqpL@UOjpu#yOUNdBuQhwknwd3gX8t=&LrwnPod<Vr+_-U1QQ@i9jT@NY
z8#iwE;$Q*4IDmV^Zrr%}+FDjtLs3?iUc=Ge(%RPI#tpU@yARFEZ5o7~&3p+;-?9ir
z-^)@ba6IPFqt4YOdZ=Ja<_C(+e@r%bs=$C^iRwo!&M;iw8idKbN+XrgaBy@a4-$S8
zcJ!d~+dgfl&#|K$;ta!1Go6nUGwZqQMla%fLtPbjsPQj<3WjC>&s6xz)*qF)j=%NI
zN<5i4FnPZvN|<YY)n_;Il5jeADvta@m8knZb>Qm#JX7Au+d-IRRcrkHXYH}7@<enH
z!CR6`X?VxwBNg$AB-12rRB{sP=TE2y9xq$oN-Cn6Tf*}7`L1EquNA3zXo6LtvC{oB
z>oo==MJI#Du%~5_U|feF#o=o+JQk>fwW!>kz+j9W@g82@2;s5-%)Hjd%PkYbimteM
z8hW+gm65VDro_vl-)sUO_$=M3(M<ub`Sss1>Kdok!PqRivC-Ld)r1j*{cbgG%TL$4
z+4I?1ra$Kv)rqW0eR|M@AHZ^`g`T3Ns_G36;27ry=FJB;ZUaX*fsf=(s{c8Dc9ZSK
zt-pT9xN#%Y`Ud8|u2BQNuU{X4&vl!>zi-8c+`tC@BL+V1Ss4Gm8WWs#>)*$>dx3K|
zWVB@!6@hPUGe-*xu+tlRXJ5U;$G{J`4hs5CH*SzKUw>{YYB6mC{f}8c*K^iWRS`9_
zx8pW3w>P!mcDHl5?&pTMyC`sIXW?u@?`~%cb`o`$VEF3_QQ-LcXC4Onzb<jMkzmkM
z)u5NPceJ1v<mTn(Wstl>PfsuIXl^O0_4L`lngjnyFuZYgb`a&^adUIyb`#*XceLW+
z6A=;N;pOMy=jQ^h;BxW+JDa$3ft?ut?&RP7JhgB#bF_AFwzdb;U-xTbYVYDK!N71$
z=zm^+-=~GU^?xXVo&Gf}V1PW=XL$Iyd3pY)Z=k98^{=8D*6tRz`cJLx0G<IfB>5f*
zKNA0|!T)jUKP3OFsosAz<rDb-HT|zs|GTM<lZB(Ky&XW*S@J&<_Ak2seez!o#d)sB
z{$ITKo6&#$3UFHTjyTW%%$nq#rI+GwfQh8GeyaW)_y)x6`h~Fw{9*h18#umMlF_v$
z44jj`q4-qhx%<uabnIkix!)l+A!!0|;-s{=tk}5uG#L%)n~FK~?-kUP5}9Oh1DY|r
zaTGp)-e<j6=oeX{c3Uc`wp7=yE~vM68|YOV=y%IN)*iWjF81Wilyv!OHs2Lvn4X@l
z#(=><kM8{wgh69y^pT7i_6+l>G`jZ<44O~RB3D<JmkI9?5#B`i_75TYfXX+a%vpZ_
z4hP+v=%*GtW41cFwl|61P~6l<JOas*(x5-jiy;FE^fTQ6St#tYqZ<P~Mjt(Wc&g=m
zpy@;O=Ou8uI#mgnMA5R~x;Y`K5GY|Vai*_}5cUKe7o;&G-hsdoL6UN4nUrOMX$~1G
zy{qYro{2wjx=<Yo%i8F>e(+3s(qHJGI52^a_@~y&c@GjFLZi^~9*4p|tA_IN+xWHh
z_3vh<q-bXln1vfRH#mO3Q_&zrKLYyjcZo_Cn!otaPZH1^m_&LK(%b0IcQMezRLRL`
zNYIk^$0A&&5OFkrAuk^~*ZdScm!4*cV9w9wi+E%wqmwb5_tJPb*}*RzmP66=;Zdlx
z9>?$T@$obYb{6#7K#$@7E{&v+{tx}j;=cLvTvp)OFJiQ#0H{C5LeIUdY|Pvm>o*;2
zFVPeJ$@g~nb8%D@ehhjI`+w7tq2Iq3%w5d>K}~-0InH+#_xJZ(wm&QT6Db88V3+|<
zjQ=ncea!i^8vT>(u|II>i8M47Gq~vwXDhBduh^9>BSOnV{~$okh)GZXV6XZZ08O>U
zE>6$;n7{{(L_g78sAm>vwNx7Ofs(W&_`yd$Xd?Qin6P`wd7`4CPi6lkgEH5Op4F@I
z96fjFSpZ9v9MTky)(}bu0(Kx@CMEmxAGo6e7=q46`-bSLKX`g=C)fl?$<Qm=`)m1B
zk)8g7jgr9(Kv@od)-0~5sF3-k^@kBiV}37;??HR}?{FT)16JViBQsJi^mp(97WofN
zNrmq9QOGHyADrm3DC+Uwzkbag^Pm?EKnL(|p43>Y8L|CAeScny9y#^tA69|BhlGhr
zF0QVEtk0lf=;!~vG(G)NI|t4mv{VD*CCBfd5t`r8PrfviDgmuj1GmlwSciWQJm-i9
zkG~dv`XtNrhpsV!MS@)D9-L549zFjeq%{!EE-oVaND5*fDBAgx7Qk_ipcW}F1O$Mx
zOcV4cQpCV86S98ZM?c4J$Zv|Uf^~h_1krQp1K|f0i%d4)rJ`Gm0fz(NVbQsUEqdzo
z4*>=GC-VWQ=%l}m)fY>P2vbIM6zDO^Ycwg*8#n(D;t$cOSeCs>#xAusmlwrn14DH6
zNmG{y)knSssZJrd$ny%7`4K&DB_TB{`Di`A?G**L!|5r7sIBiEyh1ye>D^m7JO#!_
zb!Y2v&DmJh#EgkPQ6y$<lGMe7)#g{PDVKr9ofNO5PbICDPA4_r8oEfq?fc_L=}tpb
zn-}WOLU>2@O_hWOR7fmB)IVl=FI3DUbU9VlLR3YJcEv7<J4Ga?HqVNNBDVzfJwMVW
zMXow-hFmo)ZTjrW9<`<#*WgD};KTccQVd`Pk<&WNYSl=wsDW4$?T97I3|EZm_O!Sf
zT%Rd&MO_NHQTyhJeeiBr2V`ZJa9UO?Kg0HwP-iJF@|A$vvSpWv_uR!+ZK(12BShWu
z`><P~!fE`|QkS;z_2-%P_43}rJdFpnsir6h(zYqBXan97P@#rkd@n|K^7CTtOLQwl
zZ=-zVF1P`*J8SGRAhww@Dn&4=J~#BeuV?50r(*dB=a%;@ck>yIe68=^1&^#ps?%{0
zc*r6jGIZwM6PMfv8j7MT9;iROh?cK&0$<jFFWu8oj~0UWmX$N>urn^kB+gq4Hcy14
z2u=h|$1uUQC#-Ja$LHN~HFtl1@q@hF%OIjFh<y2@S|`?@)uHX4P))SdWeqcf-l*E+
z-_OAl)&(w30}|C#e&;&|{RMvJ!7)uNmyL@bZR)~UGsb*&yID6+*Gi(*nWx3P14YNp
z<7#KyLhC85()ik0MJRo0x0=ondjnE*QN4Vf)Zj80d3b-~+3C1dW^Mgu9cR$qh=F~r
zB1=lUs?^2)ror@SVya!$xF_cBb{j!`C!L=-b?9%;wQoxuK##Pe<NozqO_PnMtA(>m
z^Kt5%x`r+~V!wA!TCnMAQo(iXB2~j$%E8}RvH6?C568?lW8`UZtxz=xU<8{BNyhk{
zOR4sf)ju%s%n?Y>_YL&wgeZkqXHO(gml@rb(%tHkj6Ay=_xi=aJ?sT{PecdA_i8+r
z(yNCVzb?kyK5fP0sqwoyn?4kX7wa*mJQ;1iTrl$9fz1y(pFrWX_ce7B^-RO&Pjh%i
z4c*eu_J=l`;?~$~1O~*NesN`c@2Z&Rr&u~pUmjNDl|&CoZr04zxs2!+l%{o@H23nu
zYbY&~AL2?CM!m3Ojs2lzY#L?V@kQCdH-8QOjLL4l(*$Ye?>t%FdWSRUu!#BHGPVV#
z5zc~Rb}+e8f5(n8KDoEPV>dIhsG|R+L$F#HV7;WTh;X1(iAwr`V}8+ET^2a6e75Sr
zS5l2LQ`>P}Ad@G~?MId_aQEORAfD!nU;~uZl`_7B`)&@nE+EXxG5d;ttN2KaC8-N`
z);p)GSGx2L9|q5`l2`&%zP|r{5-tB!4Gp;ScSvofoiIXG)MSnR$iPc#IpHBPZf$x)
zG<0%iQv0ap3af<axJ6N2gp{qzbvk8=rc%{+NqD;W%4N&vT;~Wzb{Q);NCBUwJNdEU
z(!ZxjJ?G>tZ|#c0XG91sWjylvy6u*>S%g=RY))OB@`7-^GCQ+IMHD>3Tx>|Ol6vWK
z-U=o!AyrBW-FG=mh5US`th#|e=4~l7H~fvHM#9_Ic>k!nHE*(*KV8goG9!)}k9BR&
zO{ifrsu`7#^|VJ+-6(DM)3`yrlX~-Mih)UUD6;F<?b)CW`I;@y+eV2Ems3gp152M0
zqC&xs!(~nMpVe4ROEt}K*RI(e{qD-R{c-oaF(Kb6^n|y9RGyD&|MMudaPwKni*}3d
z3Zt^``;r7K1sM{1R5FyQ)Nl3{DtMmN26DUqy4V>Jaw>Usl&W1DSe+&^?{k{-FP$7R
zvAU4#9!=m%9O$noT5~D7!a1L3m4ete>{Jf&UNFT|z<HV*Ce7ni0~nZnGNw0L6{ej4
zk*!(DPwmfUI@yW#OOr&-37HYF#2VODCZt+^)Xh5uG-wuFzft8d@V4;VV%4<o8ST-1
zn&UO&t5xpC{lTXuF-@+s!S`K(OAIsw$7){~dB8RrkEX!GpEr{z#Wudj8F(xtY&gT0
zytW#bT&I29juw)T7YBlqwsRv!UK@!v>)5j!b!){@UWCPSrwk{*OMDk-y-Vviq-C7C
z9)<?N0n6eZin?j?q#j0Y5VYmtr?I<UIcn5xtyj`~dD^`tYD^(?tx%g2HYF~`-aB%Z
zgwyAXLdc`$tBWi)c*766qBwc-5gIqdteV)yqccj$XtB+jDy7&MM){Bi_p6JeI4@1h
zjnX#!?yZ`22w^bkz>{oECN`Wyz}_S(f0m8kVGvo#jiXkQ4)W~Y>!jkjT96UlFtBfQ
z(coW{2rLgZy>|lR@tq|Hh|dqYx-_VW#b73$5<3-Xg$_{<NL`&j<x2n?DBxN5#9iyL
zOl_A3X;~?M*ql`-RMKtS;(j#>%1LgR<8-}n|FpmMbM4<0VtaQSl+?@ec$UfW1sq^H
zjYUhY=@t=kkP9VUn$lJ~=Qb#+51(m4_C99P+j|brZL&*!5j1I)Le9_CR!bi9YgRdc
zVZkhJ_ctWe!-JLT!x%>>)@XJ<w~4m33SU_{)kE+=T&GG9r*Wixy+prvzYnGA)GRz}
zI9{RM+FL3{s*N*!#K`n3VJE*I%K5&bR7LgJaoeU-ZLmNQOHYW&><b;ln2(;-#X;5y
z(p$jKj-5z-tdIk&0ZpUQPuZr9f2bD+3n*VEE>URffti;$WjHNOPkrP4h%|^tcnm*D
z(X|YHb)565pFU`B!0bN$iTUijk7?xh-w^dWzv!y<vbAzlXu$q?<Kkxao3L>QsXM=^
z2n^{fdJmsLWRa7*W2^|XsfmuDI(g4B!czuRSisJy?4n!Ti6CQQ&0Pz2@Wk(C=a+M(
z6-~;JI5~^gQI)A5^ovTHOiZQD)+;8n=PPU}TxE4&kw~EyOp+SLDB;#VemKaLO~q)9
z1N>KrXD(8R#boC;JgB7Ut<Lc$(1hRBg+Y<AFJR8=4ZyX`h;WNmd*8j(Ufi>*i|MP|
zu-o^E`+*fsPk8)tj_!(rl<XCO6HC0u?rbPsUAo)Uc(%E;21oK^bsgBfxT(UDCQ%Pk
zUA5dV#aTh3vq2=p3o*fgWCSCGd}gGyozzY$`N8V;yYH>?6Yf(htM`f|k{5xZBo4<C
z+crprUZv@}f5+rKm4C&u?kxtprwf^{WWP~cf|OYKuI;DsGW$_q>=YXq)R5!aTCC{T
z0gbuTLTvYDUhWrwSMrk7q$JN1Q7k0k_<+ZH_X*&+Su5n1VVZ8V(JF)PjhuJHZ~ox2
z#E0uAe=ds;tlkuo`gsxZ=J@$stwEF?Z`ts&I;^jXRdS*9y-YGGZ9UR<Q!HGKs7V0Q
zFl@j@z0UfJ?i81={K`_G9yxk3aku&n>Uad(xb`uDPdm@26<;%<q|6`2Yh*auDhSb&
zyEo<iN~_-J+!Q{VamuXO%G@@ufhrz1M;SBKeL7piysXi$E=8Ej*(3esZnX}kw^e7r
zxCGCbjI4*q62F>Un8T|za*(qLI3CL3b(z}-)51u-!lKzd=iC>B**CnFPt+0iSEn!a
zz#TO0D^<o^W2Qc>J4L+08LUI9l3)$TTzFewD9=p(4pcDCP4c`4dDb4fNnuaa<`%?k
zD|8yx%ry;VUDqKMdU3f&Q@yt`F!m`xZlKs^U}o`1DZBcjV$=QjR`v8%<A?Yp*itgn
zeC@Xz-Umn?gqD<FR|<2Vwb;O{;Gy!d>BD~I%>${U?j@wh3-c6`>CPjcejmv)quG?^
zG4uS_w*^y;9~||rWd`SIH`lHvJoT?DG%j}eP;D8;Y-!d>u&=9Je`29wy%LFH@x?!J
zjNp;C;SsSYecQHs53j~&;B4XvfsJ6iKv}y5+qW8a?JJb9ZB<d`{HZfJu1nHFI^e7k
zavGNEw)E1;-B9+*@HrgkO_7&*SLz(r4I<glD{p;2P|&Q-2P2i~j`8L6-Tx(Dtup1o
zt?bWTJ5Ou{c`edi;&-uTexi$11pL(<0yn^uW7RZp9k*x;qRk^5XocR+^XIZku_>-a
z05YGUM{Aby<LOV9LA~FE&p<(ea=(@`-3;Q$^%uu{06!^W(!Tj(-AaKIE?<rrOtvDg
zA$+mv){K`(abBELqiAsIAoavkpW}smX{-!x@N2$c7&(-n2cJhmZ^{L*&SFJLALQ;E
z4sQVd9j<ZIfnYQa<F|$xJxVx5yzbGI7f%wa)-y=kZWW+2jJ2#6%<$Myn+bLk4PGr;
zGyicOzZ3Ye2K=b#dqq59zrL0(M7uh@%af&Zbz~N>vf`oMtj7BJDT(D!sv?52XPm^X
z@`^0iJ7j<V>!_!HR>n@R3%=Jda>-|c9^`d=0b~hMyCxP?%wJ4h#qie7Qz(Vdyx1~&
z5S#J&C;`^@jlg%N$qPa9@Qz*%!eRLwoPBqi>ApK&Sf+<Eu6d7Qhf8!?ogVR3Ll~n{
zrfLK8Ky$|Wp>?azD2;e?TTf2Z49Oe20iu>Ci@_C1Y<F376|%)^+70;fl03?u+I}+j
zlDaj;fzu+@|3&P`n=}0&tHF7)vc&U>WAb>xge~oZ4tYkaVX51ibe$mux$bF&t%o~m
zK^^%OTOw8uoOUoLB74Hv;NEJa3z4O?=%&4M(_E~%eYMNZ(x&VOO8D|6+g`rA$Ym%a
zVuaJTv0<?^+{m%O@aRDjR`B44(U)M1q4_RlV^>zgi?_!j)ki~tgPicAI79o)tG%L8
z;rW=S>~Xs0V=ninb`mG|)|Xn<TN~#_@v8K0!)(`S<H@Se)&?bWRyn|3sR@UE!e!@m
zj?ErOt-UJlnECM|@ynRWA4!@)HCjieFe@WU4udPy_e3u2hy14kGnl4%$|F?Pq@-*%
z8Yp`GIGC%+JTw2d8kwDUTC7~h&rAZ|D#c11Ap~}|G_3~Zh1s6lQr@*c@jGs#t75zN
z{uW8wEdp^~&4%-3c`3)jqH-nTMyZPx_05kq#kkFyY%T0YTE4&J?$>gbH1MZ&vf?gH
za($XbWded5_QVX>`#1wjfdvlZ1-9Ji#nCh!e#JbS(du(Kh%7}=u!_XNaJOU1miLkv
zxRb{1ZfD_nOTj%jT*agk={i{pYUT$Gv_63q*}o4wAzdvLhbG*gzo*2Q+r^I+Oa(W5
z|H4~62Gvn)wlcU<kh#f{{>W?G*|yv4h%nO?N)_+Hc2I+Tr9G_Nl<B$p<>3GhBNt?1
z&Po3uZO?*CNdG9wniVD7KD{<<vRU%AW;R1SJfj?%+Hi(z@K=;il|F0Z2h|6>V?Pr|
zi&mybM&+iRC*nIiC3T;;y+o*6ahE;3ddZrS(m#iWYx_aH5$E$q19jnza`ytBgoXJe
zmJYwkNZ)eHjH)s^nKZ$x3AS4E-HQ=|AdsPv(L|V141R~omV-@R<rxWXMNkx0XAj=S
zrL^g6P%9=(F>%K2O{aDyenE1Y03WxR=7*%sW6G<8L|q%&!Ed&x<LT&EUD@w>*-1hS
zsr+==2_`)jejQBl3G5CXgwz{@MYWHOtXkECgF=5SUy|I%g*G_QAFvv!!OELCeMRgY
zZ(oKtRgMOR`K4939^J`fu21@stzt098QR;rX6pw||Fsl*!?Edg<)PP>7j_HlJ$TzL
zrcF_2<1Xg-<k`asuTPY5%4ULW@y`bC^C#H5kO@hN42?F5)vt9r;;Aeq$@})PhIK9T
z6jE<H<h(iuRKMn+`Jggb>tC{|1c_srUZ1vz=T?`xaMt56XP04r$IzOqLg8w6uCEJe
zlK}1TvR0Jwf9lVTcEBN+?GuihZU}R2c#e(Tj7{UL0c@z**c9qT_9MxZKz1@B=Hy~*
zW)9K@&x&hMcaD~%u0&patTqpG(EOS_$mlC5q^pT2&Be9qz-jWDkvS$&eWY26vR+CP
zMNnLXartZTmp;M|&jN+{?6+U~opMB*F5Et`ib{j5<5hrK6t`-ZGN{zJYGwlPt%en1
zP%QXV%rmQnCA6E0S7BTpsM2s!Az_8flL0^4fK~|i<;x=Ptl>|R=89>DdWt~{xC^(M
zAC>I`Zkh1LMA)(Z&XK4~@>wC^d|Y_bdM;<T+=NhLvx7|^oN{9@@FwHF5!=R^pVIdg
z`h4p=mKxInTPa$+W%pJ=36A}5NCxzI%I8q394R?y>M^wvL%f{FZfc>?y?UgBZ}>vK
zVmz-tNvC$PN8iP2Y*K92Ao>07usg<I*}#|U>6@4PMN3bXK`|{-cSyEDEgl;=Qa<#c
zz1ed*U;ZQm_!e|nt$Z-uWq^Dtw0ncVhfoa$CBcus$4CQC*!@w?>`ME@G(1O?<WO(C
zG|x>VTzg488}!LRx|G}NxH_B}J|;}g$v)=^IZr65F}on<!Bl21`rdN~UTCX7)jh?x
zyXd>3p3!~~YvBwM5(pcgIa)66lvJSh&TN8Hn|LG}8oYp1oVG*@gMvQ9x$Q#^TsYLn
zXyC5k)RC=XGBK6`4q2U5<1}4%@UCN4N++Dd5QXbnB>YgvqD_J1b56}k8{Os1*f^Fx
zxOO2xD`?Aw#YgWc!uM<gv8nsgI&Vgd>AdThL>)h6e|9p2*^H$u)}sAA(dOq*QFjWs
z>(|Rm+r#NV6|F+*`Yrm8R8-5;R?3x0;#8U7ns)jyRa?V=N)p@SD`4Lw5fr(LJEg<q
z>ner~zdB!%A}M^BXpv1V^S9*m#LLt9JX$B!F{cc4xleBSDlqP)Hj0!T?7JOE7nElL
z3O2Q-f}ac$S1dj_mqU8*_05(u00hQiPI{X`zwrY6n9o@(6w_Qu-^CkD-s6IQ{8|mA
zLTL=EnZshtTvmCHU@mdfa{XZtTHm#A)sFhxF>(@-ZUJ#9maJcN!1`PE?m8GwPh!S-
z1B6{l|CvLFWp$<0Y(b@=kW}qeSq@+AZv%|kg50mUtWkQVwrk(`dzDO<9*5S-Hcfte
z_w|9Rw+|VtZ}xukyjo+G7kmHLDdU0627!47{jK+%vCM`ZO)7&&1w-kTspLmlKTH`S
zi-Me%G6zVS_6lq%y6=5ze$Gx%hQjgV@hX-Q57M$~Z5qjrt~<+IG1?6^rZ{h#$Blwo
zA!nO%sk7e65Sg{|f6eo~d|lr5z~lROV~%z$(4=O>f*qWPw-%{&9LDpBNbHieb`fi9
zz)Ev#fK6Q^zXhwMx!1{8h%N3B6{)h<)$EDGgS_taDMzSb+lM-6YK@Um<+S(a<ep{f
zQfMgYxnffG*8`sPk+1dPWKUHKPE(}y^Weevjh2h+R=*Oa%8~2m!U&Ydc?T80<kW<*
z2Bq3J)lRz4Mant=GK5X-@Xl-X3%Ia(%V*0AjC2`QmFGH%l*6m19VezD<z+Kf(Zg?N
zns5y;#qB@e8=xaq)|;mn=b17Z+vGYGKb{GUQ*=!;s%O=WGFNS#+mowTf{ifS6qSX@
z@@@aPMNq>SEzU0vbtk#v2p~vU%JAYw#8#_(HFWn$kT2T}=oXWV=si+Pv`{I!`y+;{
z9-3Vw3k9;m_hfNlT5L?p<Kz_`>UWh$NgWh2P%MXGZTw=SFWJUSCD)lcqD-yBhN4hd
zg*-j1COJX#P3~fcO&SQ&N|Kf1@h!j#dCfJT++waTSlwJJacdq{G2l>y+>!yZ5I@GG
z>Dj;zMlUSw4#z&su;kyAFBW!|+tv@<`uJ7LA}0f1EQ7uSN>ycP<T@Q13#XIv*&&~%
z><$w&MujmdtCdoeTX5T!`TV}zW4?5lz|?WCgQ8fBFhb}OKTX)W^l7mtsyvk1HBd{<
z)7A_^IWL`P&H7e(beM4Sm$(r|WRk`SM-UCEf2d!_Dfq?4r_z%cO4T^Dq8HWyHWJQw
zwyH9w`E}ctsnML3TIE82yYosFl+u5(@(RBIQC2EIru_8-^Z6i4k%30tLw$q#P!bWp
zL1kh(Q42nyZ*GfetjEbFHjZ(u{d$PmtOtq}B0Xn2<J(=G0nL>C6$!@>spQC#N>U-c
zf!=!fsM3(1m;B_qq^>-Q|9QbB%sRcpV6PPEo$=c4`KY{(QL?B}=Cwqr3L)qFMc0b9
z>CbD&v>5T*P3}?&g51W5l<iHKrS*YLtx1MePu!T4V!9%oE|WM__wFc>+Ec%6yS)}{
zBzZK5xz*nZR5qtq^lV$mspa<lAm!xa3Pv5Blga5z^0XsIW83aF`*=A}Tsc>j=57`U
znpcEk(JiNT9Wyb(#U=4_<!yZugew_m<ci0^iLil!&NqL2`ns<}3+utFntT=$boEgj
zp6uSq3bJ<?H0(fy&@}1=m>*zR&?~j*^~Q$gS+TultFN-~`b&~XlJeGy>-&L?xyM6y
zQZ3;oHRUu{1IJEc&Z2h0RX*R~-rZatQX#pGr=q@x^=dSWQyfsLb1R6%o!3F)KbA;0
z$bdaVTk#u@dPgFBwVtwo*z4rt4{4&G#ag%IBt18eeD`wet@pv2D|!6CEP{>UYQq&6
z-P(xKq2CW;t`hDK=rbJWbl>^3tS1g>_gL+ElWA9#ZD~zmKzXDKtY~9CtM*qLQ`u`)
zRCnFZY|kszLyO$oFZF<Z+F*h!aY4NT#0lxMRZEwKxCo(;!?<%hPWY}^;z5{8=Uf3-
zMj8;@%=Eef#i@*abDm)U>FR|z!LRBl9YBo<Ug9P^^-nGP(=X#}*P_(Py(>s@p+uxi
z3L}Dp$7(M(?-MX9Z<l(vICcyOAr7XV6m*%gT)Y~D?=r@{=r=6aFzLeAV@p)AEp+j<
zDl<7M)4}%^w)IduFK$<|%uuvp2M;O@b*dQ@$ys;mF1ktXX3KqBa0;tsu`YW8g=?gr
z-Y=+JkfD?sTZ#Jiiy5c_;WUKCQ>gH2V$nD3STUFrhnjSjOX?4{sXbw_hV@yd+AXrA
zZLhh~hLa^0ogXzDkMgmU2)~ufem9)5&*yQqUNO*mAxzgXst}V^)FQ**n(GH6dtqBk
z&3xlhOAi&q%l`Ds6Y3PU#f>|^i4|6{t*!Xg#&E=5U*`{I#V+4$D+gw2$ds9ix5``<
zM4(tQj`=AUD9Q0pf_8Bp8jq2EEwTjyoMC3B@w)T+IxBzq>B^w8r`u#CXDKGT;7NGf
zgN55_h2wSU-RH)ayZ1xMaJ9^V;u%^{;=1o@mvupUBAcA)$hu?)CS4&*QR)YAm}*)y
zWL%c7!#+NR?dccnmGlVI_f!;C!N4)xW1|v`H^o&o)@l+HydR9p|D29P(0#03fKQ^*
z8$T^aF0^<|eWhA;msd9^K?kv&#$aM_rf-#AxlEjXUFYHN%bb;`bpfq@HB(0HZ})v%
ztsYnkSAEI~pL^!OxmDLkp6j5(%tjh*n|=EH_i7=Hfv713U`ZrU_no*nXmV?t8*5Ej
zP?u|s(qB&tZXY3)J8ECy)<V1jvQ6NEp$uG^KH-DoO(|ATEGAWGi!1V&r#n`$k-3Xb
zUhM0lcb&L7l7!9-mwH6E%s&3FJtYa}O`b8hn75HR^q5bgse*L1R!EYdv!d!^v3<d<
zdCpbhQ)={Wjd`}o>tL0ni*V;4>*T4p4_EW}fz6J@RZ`mNmSQ-ILCaE^$l`7iO;ZNp
z?wVyuymz+&Jy+vEprY`==~9&wxUXs+zP?vkX;3GbxmX=5wLXB1>tmYvWjr{U)M>#6
z^f&ptS@@fPibzK4C+Tj_fFtXm0X9VeoOY!o23Q}`ZF)mZbS0P2nx#_ZoeGNAJ$%4m
z1!NLnt)?rIsf+k)Tu*`+-YJ${+c@}h2il0&kbr>?4F2I<WnB}8sa{(^Fgr^+tc~6A
z9hGs?5lvnIS7TU`bM|YKLR+Q{`>s|f>$!(=o*sXD6|xJ9%66vd47oM2VM67aI7rVH
z(dDJR8Wecj&omEDmu3B_uFhXRSFq~voZ)v<c=A|XaGpCzv;G(rjs%iZv^mDPHGH=f
z)}t*meGVbh$Ip&-$H!u^3k4FhT9P(4V?aP;(8!V|sF^07U`KZZbm6g_y(vkryBc)k
zB2#!Hzh;*DD0zUnH80JCdGJ0o6^It15-y9hLvcR=>uNrTvce)_vF%F{3d?G;EtEi=
z_2EfmWeU4qT;Si8B4!_evXKt@^#=J_ru$a43Syzf9wvaSt%Mm(`A|o*PVQ*2r`4c(
zf6q5fgHV<q^G_Wk_uFGOVvnY6S*pX087w=5j&)j^mF#n&D9h=+47a7JT}yXFhqC&H
z#skuB-A<_#y@L2io3u^9g<NM#T#z1pCPtG0`0Pi{9txRDN5e+AkLrzmE0J#bZmA#v
zRf4s+za*~WoQKX)FM}RL_M}^f={T(=0IPfNMIaAT70B;67%bnY7nxhV#O)c9ZWg{9
z?0R*&aVZt0-_^&rZi9EDzF%_Zci;dm=B*o~N$b8L^JOOC8wnTWQ|iqleed`iXR8Z}
zi)u{RXAv=eU%pGxx^|Q!7v2*Lz`_Iv)gaoHmkW81#Z~+ssM71!0gmyuy;&kQ2wU`g
zyDiQcxc6F<{Um-U74=vCFYRR@HOHZzK+!nK#H~`Y$E~r9-tDBgBcxTJZWiRqTA8;r
z?mpmkg=&Mitj6z>EY<}KkUELO!B0RIt)>Ba22}=R1Je45i9kT0NI7|ZlDPDH-i;L#
zt+T^P`_Qa$)$sJV9-N+ULeuM;VwzY*rLA`?z&5q{CA)08MijD%mn1wzx~6c7iuUY?
z?9Zkcw4A1Z_mwZ*#*c@`6=c}1LEN4wUS<(zx6@at55yeaE=G5@qF$1uZG2oX@az;Q
z4jZE71Pg~gCR`%Yesl0IV+H@)Skb`l9RYC;yOt+mTWl%aZi#Iv&DjSd20X%fi{e^B
zzDT#VlIwbq2z?AKM1=lSin<v_2fk=m51#raH^M8UcWpgO_2;pjF2_okr!gCNu-{CR
zElaP9BvG2L`<dv){KOR=F(+NfiO`{+$m^zUT}js-xcNEsV$o%KSJHk}39xCn8Arc9
zRqGh{h&410O4Tc%HWH&JEJw1|+3GT!Aa%gj*2}{tV^1FNcp?RwOjLl>#^|I~o%pLQ
znjJNXmC+GVHanKcM743B9jkQQGfR1?*~?3X>gM;24N{DWZx*`G=)9!3>!&i)o>2xS
zC?(D)On6UzpX?A@^Nq@8O0zpVqlTA!fFGuha*6p}YH@?gOM9PeZ?qP_V3D)k^xT)N
z?$(SBRc56q8A_i^kF?)NlKmK8Rx|sORA>?JD>8A3O{RomgSAirqFr!FmiK!wcfgXE
zt<bqeW{s;FK}_sFq#G~JV$oK*wjuDX#zbGU!Hi_OY>+)xH16w|mOryJ=yneY$f@*_
zw_7{jA;aSF;$;4+nije5IVGpH1`F@F?_!EoKrrTLB*o4Fx9*OQw|zlPSkiZgi(zf`
zKKbyOxe#G`5P|G3?PsQ)J$gH@`{G#H-fQI2=l=3$KfHFm!joUDKfTY%8!wtmU^NU%
zH^ZeN=Aq=&LbTUgLAK)5B`K?<JCpiI)Wu`w^&8efx@tgnW_!ULD!nRG$4&S`y8+gd
zPYAhURr7iYk)6tUjv{HP<p%=K1(Qjp>+;Y&i#2ymF&SZfEnopuGX!KR2eb0q><-aW
zkt7rrKQXZ2wWwvaHFGWJXwNj8zs7mBx8;V!FK|{T+<`b=g@v=&9}e-ghVk`B5S_Oo
zT=t*LdU@td-G@?P7<C&Eh#zWI6T~t$2^CJ7RBpN)&t`v-66Ws^!X~y4qvoVj+cDs^
z7xculB$d^BB>re37DM?))vJzQU>aaARl5`xjlgPN6*RMS?Av8xS<>HKtv9Z*-#mD2
z`s>}^>olC|IANp*G&Ne1YNe_1C@?H=YI^fg{p7Ggb8<XxTXCe6mo_aZ?K<Z0u&V2Q
z7&0<+u^Dy&Z``V(OP?@IWIwtR1LC{mR*=$xp%O17jpwiMSyudSC5JuDqQsnu6C0M~
z1{QfqmX&5C_Tf=F1j?BzJse;ZvT1^AfU~gXi}uw7ATxObi$rV!58LW)$wjIXr_6IT
zpYJM~_5{VeqV`eb1osliIV(<<0GmOOj|uMG*lL#w31OpCe;2F)I2E3uQ{Us3CxKpl
zb#1L*&TvU4JCY4QWcZ%0m~%S0*1xn$ci|5NU(1Y%1=a`A_gADS;xl?B!`SnPYH%kX
z-yNuU%j{!(yBK%3qNbitdLI5fRD+Q-&J@j0aYjITMXz1_+ZWDy1qM{A)&U=5Eb0|v
zfP5MeT55aub_<Y7rs`2$U-pQWI8^ZN%Ow+9?+L#Bf=rR~;oSEEGNB-^vyEzO)^6|4
zT}(K=!4o}s$WU?mjL6@zVoxem(y*&EW`Y-d?|_mOws<5@E~H<ZYX)Rm1B2gr1BJ5%
zk_XCi4go!fon4f^R*CnLR!>4AoOYNvrtW<aA~|Tt(-PmR;WUPH8t&XNM!sreb#|lu
z{f+Goc8=7Fg-#jjv%<-Cjhjk65Z9?2XkJ%4TQvIORQ_UfI0o1(6!DNx&)qya^+MWH
zm)&i7!lY~(&c-qeDr0AqTd6vWKCq2GiXZ~LzI5Bo!4K_Yv1l!|nH!jj$Hrsjwy{W3
zl2{;fgUgA<m~;opX(twKRqHh$bw{^;afOC8X(7^<k~%M1dE#U>2&eo|3@M57>#I*s
zN<~u+n}?$M>gjyQT+O{Y#e~(A^<jO%ZVd~E;%BuEXYNzg!;PI>>mlloeMM`w>wzuS
zH)+tdoIDnIB07eH0Yoj6UO9#V5hM5$Z;!Qsr<|@qFIggr+VSI2A&OKZSS<SW{II35
zD#|c2JXgufbplvl8-Y|BNZAa&bl=#UPo=m_r3E82J)%5U0TQ@pm<Z$5l;3WPEr@7!
zY$tUUR_+kZPS5)MBj@JBjAMfC^5vEZtcBnc0%+3e!CwYN4<d``?d+|Yi=s-D+fniE
z(rAM4Mh<HtvVQy+#jW?t=6&c>TE(pR@by&zK!G@Hqm3x>PXD7Jm07P-0x0=jT%7B3
zngR)Bh^!vSBR3*1FA9}!C>G-zazTp&yEo9ZKd9X17ar=P1TkZ}u5IU~z*T?@eRw4{
zqs~)PaXHdx19RBQIvnsCK$?wrNkse21Nl2%+ZXxnYl~AV!@#0Z;*R}IrQHsr9{#co
zA!E>s!VWMFG+QAzP?|pfaW+feucrUeY*6jwU2{|*_i|PKOa}j?g2C916&YZ^(l<P|
zwrUxL4J`{ke{a2u$6Ca?{V*V{rtSSqDBJm)y#h95kXt*9r&hq;TSDK+wde?U?;>73
zIfoZYJDs}wdUhne)PCz*XYqlqIgSM&*uqkRGS;rk!8{>$vmzl{DBWf%B4~^F3MZ_u
zGc$76z*{QbR=;WAJ5HqPVWugn<XeNrgzXZ14;k%}nqoHYx>iDN3+Xis>4Uj7Zj8A~
zasl~+b{E(Mog<qZk?T*<qXMTxjj60-B#?He)-_l7rS;`IDr61trTMLysTKEdNZAeD
zsrq(tt7t7_Bh62O*zbH|gWbxjd8oEH5VXZcRtkRa7WlAHIR5ccqsr#atu{<y^;21h
zta#~-GG@@>IuN2_S}(R}9?AsbzBVO|g1M1i6I?4$E@KVq?DaRS?UV)WdXe-XiPkM;
z&o2WBFN{{W>y~pI?m?wV#dox7o4NqQ5~GV~mo$CCbe{QLM-}irOknl*^~Z)us+feX
zcios!3xleNFJ1nEJr7CWRw=(+4`f#ZLIGHC#x%CcSmAI3GMMVPYip~TA0X*i{kb&3
zh9F=S`>QPYbtw^!a-J=6=XLn`80qwWP;A(|=hSp}PK7#kTD9c%I%`X4FuUELfmQ+Q
zsva-t#;c0e9POZuOcTA_npy9nnHeDi>XOo#`4&ySxE}bXub8bzuSiDNAd8XGu-eIw
zG?NN5TJ<U+OPjUH^QRe#eq>+1*2wsmW*c)`=+d!$(tY{Hv3mYhoM=AZmB*@?+nVea
zE0nCN$})VdoVXwrnV@mQd*?UXQIOlzSyy<buy;dpsdt10$h!LuqmSyjSHa_u+LQvC
z=FVcRvfIzSeSRIew??5XYHydj#XXFGG{pRTIGxUn8A>(;^-Z;}qLwdZVz>zJ<16#p
z^JyMIoW1k-Y2Rn3WxioPx}Sgw*#>)T`&3uD398o0j&<WrYsKsDF6#PaoCeJltPp1|
zSsM%Ur83y$szzVdy$S{P8bB7c*a~jH8Ujl&Y#z}!?a6A-=5oL68)z#wAUEC=@m|wM
zL=_Uu*?jnS@rLlXjh>qXuY7jcUsf@0MFn5tWBTi@v~DV`C$|P+Ej1pGmgbSPM=ofx
z5e>$YJv;q)EClx|#b368-Ge6Od~2laEN#GP;p6JToHWGB!&u35>KADfDIy$$BA5<U
zO*;oOFS2W9DQ%s+4}QO>7UwqVA96I^k7j_~lQb+v$T&1a_$7*)oZ#HSB1vO5yE&-#
zI+VDj$g{?(n>p#OfxX#Io8VYk9yU1#=eO@#%B4OrKs1v9NIQ<VIH|6*wC#Kg<cH@L
zqgbj$8H#{nMJB!7((pJ%Ao4V|Nh3!Njf8ZZoWlH(_L)0T3c}kRUmg(`NT@^FT*@4y
zrhz0(K3MD*jpIOb87g0iW)lb}hQmHZOFk%SQ{n5|0ro=mKoD=TzrrT@FVqHB0Dzw$
zz&uE^D(B)?Q|VJz>9+t=+A}*eRhzyi6R?J<PBprE8#hn((fYEo=BA@UY{pQ>W1L26
zEFY+q;Y=j1btF}Evks+H%0Q*iX!!yErE{sPbmEZ`hHDL!%d0gkKuU*92s3zZl*aGu
zd;LZ>!JQ|rK#G-FLoBojLJz5%o7-`7WuF+ZzlvhkPK?K8Y}%>|TyhH^;8V=x1f#6X
zeL58nm6t#<X{J`}J-c{DWg1KtZp*96uzNc#3~#EZB~sVlB#_Ckj#Ae5&yMIdEI9`2
zrD*2Xv{d)?oJqxkZqJJVB^a;#+JM?wWWW2!EWsBAmLuinsBv%=t*#k_vPTO+XsLM-
zKJ;?mTg+`{5vV;Gv6eciSUVW^yG{~MX(vBInJ0dWs{rzFJ3fLUn>H}j^N6CY+*{1=
zaeKZ1?44-bc~;F_NTcpIG4gX|Ze{u+uSQW_1Ad$e7?2r6GBScNQGQlj$i6lqFPdu%
znB%ccMc3lxIJ@fcI)v+wp1MTgtS+<qJ<y8XwPy?%$t9T5E!U;i6K4>RMP$R!JGHO~
zH~h7&NvfQI3gO2UGq3!uYXga*nYN#v+vw9r1@kbF#y}>3C5G*-=J1%BO^`uuP1#bu
z)FcqqUfXa>!*&I22^6=jc*-DwO;ny;*o6YbJ_Z%Cw_#rRt;%t&q}jI~?rd~jtbQ5{
zBuWnOMo#^6YJRjXG#E@NoR<(jAn|rZj5`I+f|1Mxt2^&5brIXru5gi!y3y9EG0U4j
zcD|g0<<^dcH!5}_z@GL*9}@XV<Tq>2H{B4$R?cFD3r8&m{jr5VXS`povVm~|^Nf-%
z=Qc{s=VR{I)9@LL;q{A_o&8!Js#k54yDMg_6C;dtrMrXgdf38Y841h38}+d)rz@_A
zcei-KU7J*>{dRb&6WDVo-D{6(^Pau6Spfg0*c66UQl;gxNw?`}uGAT@FF0mX7^t~)
zaSI#pnv6}GW3w%NH(}jp(xL=4vkpt3l!H=jhSLb{)qh2Wcxk*#_n4#FM2Sr+#ivqt
z(hZ6WsLhinyD(IbVhLbz3P*JkCuNJn?u{;82ZJCr9@BX>-HZZ@(N^q+$>%CS4RZ@e
zNOh;}QiR!*IAB1xUPcK43H?{4HMKh(RBe7BaTN`=*ZS|uzji@8i<c^zNri%F47x#p
z%M`^`9nPc<0c_1u(051s1}`m5y`8FI5T_ZXMuvKtv#{R!Yp(Vv3D6p!%t`woCusoV
zvxw5Rl+4EN>lG}orbQ}(>#E1`@YM^5>=RSvL?C-I*e7|m&b0#9LTF&^NSTY-5eW&C
z;p(dD;g1h;81z#VG%7%3#~g(Bf688jSAzwH_@Sv^H=Y_jzykPo(&{gm`1(DmkcUX#
z+_m59|Lz(N!hHIIrT#cM#W5Cw1o`IJ8~718$EVCUEhj1XoS!HNo$Zr|CJIJ!?fO^$
z;Nv86t!;(M40>UJVm!Nfqyku#I9+$&LQCi0dmeV28P}Q^g$a7E?r?CfbUc6Q{k-wX
z5uW|Sy}VQ~6oTv>Qqkz<uv39)4-on16TL<qE~eUJVOI{R3Z;i9RX*Y>4&;(#yFUda
zGI>QZEI(QYn3fjpvZ@vCvgK!Q{R_<SQwczr=+d4tqX!;DKKwbWDp<eTKxwUVhm;6C
zeu6?7w+m$n>eFLJi-dW-O#&1?Qzv$>T5enAYoP^E@VXK$Z>ufTiHfDpu{p1|77qUb
zPvirDEp#%|H_@a1fB-FkcDaDQ@c#o`$p?ss3|ke5{Q*#9e2q71M(ND_i#z}8UNtg-
zpxkQ3P&)e4KT7~SQpm=S%8KXBj=F#9BL(P#gK_8{`aXCq0c2-i@@!GT9~fW(fJfW3
zzC=Yu^$4wDp`Q>!|4T-olIqf|@WUSl`r^76meadVA3gNuG#a?c)97zc$kC#I{Ediy
zy3RDV7Nq{6`zsuv7U3Vse}De<#j$e*deG87-G30C>&*ph=6@Py4*>0YZed<0gMJtt
zcl~9WpT7;UyOOX}SYiL0<FWxiY?io0m<GQ*{cljwU3`qdDbzD)YK!JiQsrxc6d(ZN
zNC^_jbN|nEKYr5F!}@-9S><W{MKX&CKtU-53|jp6Y?=j0cXq`v)&sCR>MQI|fNt<E
zenf$;HLQ;rK#e->J>&ZiY}7wn;q}k68js79rBKr*_P+n_>0igZxj4N*VYe(tW1=4W
zA2GWRlwWsofd58>jzws;qlY8C{!C1<-yatGwu2psh7>)9nbcoQTOVM^(?G{opo0%6
z%g>7qgIwrr#!q)Z#U4q9lggl*H2-X+EHePHXGlXsBm4M5sT#ciJW2%Q??LKgXfnF<
zKQveY(4?WEp_;CcY$F@n1=?|_GX4)XG#{qCgC2tC|4?08IWNSUi0}s5+s!Bb;DpLw
zj6k8akG%81?p9zv{M`+-%K9kbx}4&%6)6wez5&wYLb6RbIOw5m+PMD)hUHtv{DJ=S
zYs33bQ?UyfItFQBqE*un4nWIHzC4$g@6@o!a{hzGWCTd$$BgGFTw_?!yqy4S8ap~{
zTJ-!ooPR$H0Ei?4I5n8+KR}J`u#5Tsm%07-zxSB0>*@ZCaeedUAK;w;h!8*`_FSVR
zA3^_wlD(^nF`@JJ&0@V4TAAj>0WiM9^j%DHnrJoR4KTL8pS^B*FVUVR1n`5Fgyyk1
zZ0Hn*_Yv;j7{*VZ+IEcp025~TNsR%_Wm<!V3VOB93I@CnF5&$@z<fW-(t{FK*Vk>;
zB1lQlN#k{PQ(C$|Oo#9f{byqWCOez*)0;oY0jUtjEwp;b@KfX3BK#R*yG-%;?elA(
zyaGD;x)!=e*N-arzdR6NWp&lDypE6Q56=VexBM3%-^$8L!1R;epGYwQ!{qoUtf!+I
z;vcb|Fx7tongcxiN1!>m5bhnHKbR`ZYy4Q%t<iq1z8;D{J>9|_^6AfNL{IlmcxAwM
z$<qSta?T&n#tc8NfvDCRmTVm8Cz_B1Q1O34YyV$>=75%){Z-5OZ^i#_GWQs+jX*pl
z6pGdi;j~{*+<*Mq|J4O>>oO35x5I3sz~d6K-mw2+1oVIzP_p<l)E;;&#h=a4Kcn=a
zsUemTIcS#=dJGyy`KWc^fg}#+Nq-W|N1;Emjv#vgc1ong+i@;JAS%_N6&J7D7YMR!
z0+>#MQ5Er>b}e19!M7cXyN4$LAfRGE(o5Ml9k^^W!)p@)U^!E+VQR5m0N62V6NoH3
zW7Bz;ruto;!~qB~j0?FLpkCDp$VR)7sPM}8Nj#Z_{?L<o4P*!$N*WJ8P69|XWUMmx
zxS%S4eG9n;p(5k8)y5Ae{F`R-l8o-GpqR&i;yB^gzbF+fJuY_NwY*sl#O9C2dZ1_|
zalOGqiY%qgk-u_~ahvhSJ~VhV?Q>*U4d<>8+V-Gz^5<hNNOOeN1EoU<0DUn3?}FTM
z8h{WO0Be3F3(gjt+OYAh%#s&E0#MM+>gJ1YRD7mEVymA&<p{uxr7n-n0DQvM?|wHt
z<mpf*P+|!VV@@n>yLFlJn5DmPdR5@7)o9iW#H(vu+b*1kAdZFO0Kl$hD9-|aU9XNi
zr4V-odI=vW$4kUok{tKh`_64P9vM|{)~(fDSMe#D?{S=ItaTC7pYqdV7B^pdx^31j
z)rl-7w_Ti$Hq(9(Ue0FV)x#N+u82S_0?cq|K8Eoi0DiBj0R_uK0NzbdG{u8tkdJc3
z-!gHOCt49p)o(<4>6i3gcOk0>Nqtk)mNX|gIWTMNG3=fh0>BBD>GFq8xF?Ai8SfU}
zmZ<v@g$haf1>kiHy#S1z>{S&|vLOFZ_w4P3bsVr6HA6L=ev|z4GQ-K`FIQ0iqCW(&
z15~+--r-4jy-_*pI%!*>YS~*<vA()`XOyRMSSw|8<#h!P5QS)Vs-E&JoCFF>ksVa_
zX-~OJ$_Xl?KsR%ExG-rw=84<@fKwd+YvlH*A90kSyQsN1oJ3wD8OdM1d02gQd3L1v
zc_ENedj&+tXvmInf@zzj{|vGRR6N%KkQi1Ec7b0{NfxjX?*#thK;=Ji;1Z~ptp(7!
z0u2s}u)Qq+>f3t1Uv7nNd58PXfzY(~kR5O*VE^0XY|yuvX|j-^q;pTIFQQPY#VoJQ
zTC16k<T4>dk(6C5ip5?f?M3r%tLHqyX2DLToP+@UEJF;K2?UUcMFzH)b<(bF)^AA)
z9U+|R0j+50^q_geeN*MmQ2wq*f=`xM`Jxu}OTIIpIDAD-eCMgqUavs?T$EU`G0D|6
z*14M{wa9|qxLK0-j<-s_fM-z?RGJGz@F(a~&Fsxg?_I^x8k5@RL(KM1MDyn)KJ@OM
zF7Wkbtqf3gi9dKF=yA~Av14`yR5iww0x$)PzcNHK0eEktX|OySl*QD1bKV~xRyQNJ
z<nUms#=C2FL2GPacNSft?>8f;yckC^1r;H(p5-0w9tQ?K&kl%rmy?uY%sFn}!?EYT
zhGbW_;fsC$;J*5$0C5wWnlOq6s2m4Rc`Vt9l+Xo6OB-3xEl1gI$54xzi9aWOAj_O?
zX2nk9`K8?763A}7W{4MhNTXuCZ1-yKbYUu_@T`*-!{dO--gI=7olYT~3h{WGVK*xf
z{|*3cPIwK`egWLHSU#DMPhSbQTYX6}s$+9&qu`)GRU2WR$64ZAIM9`&<851{f%wo4
zK%R`lrXSpC-5*lV%sqe480A19vH#(0QK)(45I~*I*Z9bYDP*@|ZULo)xRMSIg0R8D
z?+5rxSKFadK?Z(@6`2P=;{m0gyT+72hSbEqO#(#`8$>ND4`{HIef6qb0Bi^*Yoydk
zw>l!tsXyga($Q@$fyj11u1HkY^)Ld$kU-hx+#t(*?gB8C&H!|<j!MurxgG$uBLVZd
zrl;Fcp=;!^KpW)+Sysjlz&e(fI*qA6SxiM<V^Y4a<XSYHEILuymio7S{gO_IKWhh|
z>RV6`n=S#7!nb+;LeC`l1Kp0up!>K*((Sd68`aa2X#vbCN&1$Q)j+n4HEBubkb{Qu
z<N`2eT<tM6`M0sIF1Gw=Y&2fzTO=e7f%?wi#+RrJ@7-<<OTY?#oLMrzI2d))R(-4k
zuRNRsGB&stx8xY2%B=tcKa=GI(5X~b@-cneO-#9)d<B4K<rLZgka41otA1VtNf<CJ
zvAeuY01>gCjq6H>9>Pl&pj08_huMg}l}r2Wp{`ImU*Xap1h*~j4vp_mVp88ECij5P
zM4quF2_K|iW6*$y0Nh_yy_@}(_Tr$#&m~&&^o=`y+7~L2*%Jk21b5bU9<5f11G!>)
z&Qx5eHC~CZ+KyWf_5vokaF1ZwcT`f?60bC)q_B3TMWQ|ez|)gvSd4aNUI9Aawku8g
z3nwc23(pSKH;xsiE&I9^mLotw>aP=^$rjp&f(VDU4~xg+rHr<_A5Qyy=5OM+TI1a}
zbpG{&6)vTh?x_Empy_-Uu3>exmw6Q=-d4t>tMmQ$F(n7%a5}KKaL0>me)7qUY_aA(
z>7tr`Jfg?=ePdX^r^_r_f_(MX<*%l_^sW6j_3O1}(8mZixAs)gr;WL3MU^8jv%ggx
zw`U?`Un*V!(O}vdpE;^&oRyaObfI@ejp|3N-xuPiv1#4u8x-4OST1h*5DfGYPk6*b
z<EbW|86|3DZ0l=}i0lC1JeqU)+4ZERk@nMSvKO!T<`Wj^Sk8F$tn(6Hp5Cc1S*}oO
zS_qC4dRVzuSk>Z6*RQg(muRUtEq6Ht9%Nzk=mmi~c)siJQ$;Wr*|SCz_0fDytZ48Z
z&&WK`uYC1#asmvJ^VJxzKB74Lx!D>f8cW-`@A~RRo;n=<X)4|({-z*pHf=@9t%G-`
z4#h_;&u9<;6uo@=NLaUkrbNqccNKSq)qW2I{u-6Z_F~k?%Z}pAz$^6DC;$`(eRpC?
zTS{<Idu4HV>elM=En!9$BLLQ}vpi?5o#Nf8l^10h>9&?=fzrtL%PZoOe46}1vznrr
zZ_@(tqlO`|{35hZrsh5ifM>T@c5;}9Lvdeu#?RiD5?d3qqqB%Sd?(06zKdnmCcf4w
zbqR?+p=k<Z3;q7Ex7ifd2RuQ7vV$ceDS3`8GO4J!?;~SN9PevoV^zOi_sB~D+GgS{
zAj54~!rvb;WH;BnFCK35xx~TB8&>m}e34I2CKA{PYLf5pr3(FjguQiGRAJXQs-kpv
zcXvs*0@9^)4c#yxDIwk6Qc5czHH1pXjI?yu(9O`z**x#}e&2h}b<TDEWG>k3y=Sd;
zuXW$QcxnbbZ{kF--ym-Fi<;?9u|?ODcsp!Tx}On(<od=~naMe`zq-NXB12I=k$Z*p
zF=L^2F%lk~);77YS7FhA@7ZylAgie}j#UVTLVMUr`x(+ynJdA@KC9sewwo+S5J0$s
zNA<$_l9OB@3_BZ{!K*(G9u_Tx9?6pL(*@>2a$+ZwBbB~e#p(VmNqHP(w-1U?5~HF(
zk{^Qxu`|gP#f=2Bm1fc34c}U-e{Bb#j1f@gw&4@IWO-sR0L?J-XJ>WhrLvZBF?~E`
z_gq3$CRA?Fjp8tu0I(6=tT5ba$Uo7}e5C~(fIPA;h-BJNh{Y+_?XavRcXyK6zR%}t
zF%~!jihRX{5vm|!M9mEVSLj-;1Jw9tzT&+lbsC=?TcuSk)zs|KZiw^XL6=V>6I|b4
zlD|r$_=Ii!*)Oy(o?k<h?!k+?7iF^}Rh3@}pQr+f^@kfT>=_?-W>_Dv;Vbav{Sbqg
z3A0$3vxO(&Rwt$%-ms2FwlV$0El@F7DOsqq9{5F_S$y-7OVWok_<PL7HeudgQuSz=
zl9B33R}5(caQpKN6CX{9)cm@gx2rN@T3K|(SS1W{S80<z@eNpSooE$|<l77>IszaZ
zsvYCn4aT}dNV^z=r0-|}@NFNUXF`>mRkoJ?5Kq4e8CS<pCO@>4quj!p)=6AZE9mq9
z$x90KIm|-|9p@Y}o{u#$K<>{BbT{ka3bV{yJ$Q7j>ui@RNAdophhyG70ce+6BU<!b
zF@AENLU@zb)XXZ&nOh!j+aEFd+uf2MEuFM#v@W6?$zpR_(DKh+&rVhQ%>u7C*2ykZ
z`(N}&@oT?cKIs~a<(Zzg4+Z)DEcmz#XuR|>#518QgrRk51l^3k)%rk)a+1`-sDU?U
zvlp6WWu8tcu2iKn3^WbL9dXj0{Ur@m@|J9bhAlNk!`d!N6(tm2ys_RVI|t1_l?yU5
z6+H)Dqla52h%(2m$~akvebi~%DNy3L2a|oDOVF#5_T3rTQ;GJNL=bFzIpasj!!HsZ
zh7&SBEWD=*jf|YS(rNgw{N1R#=ZNu!Dn^})`j@pJ=s!z!7Arr3Ja7-yrVoH|LwfyN
z_<WAWTK7ygpOkfX&t~kMO$&A6h@DE~B@dOaRzD>QQ%rnjmfn~bJfUdNhmB*|hxrfn
zsqxKgMwg;&0ba$}`+7s8zXOcWiNQCO4<6FXwTBK({XNjxmMlwE(pcwbJw6!As)zw{
z)3e%`aFS<nO35vLx!x@f1$Z#$^1!3x&?av7g&A6XX<puMaNc(%^jdagD;5DEb@asS
zXyFObBK>6SOh}~U6qGrIt;I?B#IA;T6=(j{KwBoo{IW%|tnO4gf5Baf7_LtKmw^-1
zjI;5K3MUU6>)w5Uiv-f`Re<&EYUtc4GoBu8gAkpT)4u#4=0h#N3|t`<y}w@bXHp>N
zGgJao{d~8d?;e1)>yM6x<ZISqi^wX>8E-(VhZjU^O#VFII)pzgLV!AI^TTe-nlDzN
zB*Oy)8iRI2M+D$OCpuoB#*12qMi5sCesO1p6)%&E5Yh^nFAcY!htS=v0SEOpVGb<%
zv;cE92z?{X=O3*A+h<WM&OGJ8YIQOe><oo|su)@^jFXtU4iBF{YUH?_YOJBGcuE9+
z7?Y;;e;(WP^@x!Lo|cA2lcY+`@Fm;G$mCgfSUYPkN;ouyp+?jcTP`^_ErwW=SBebN
z#;a%Z+t@<{i=|J+ibSed>9roTP}peF2$+p`gkyDGHSxbvZc2o{BDBTi&C=HioHF(p
zVkDQ}SvTz`QfA0^C01i)|N91+Y@LkiC!#SJ73VAE+CG&$cc@rySUmx9$O~&=pBrcS
zTBpI-U1L&$S8;>&nHSKFetlO;Ii`LJjS~FYL(OOLvU4kj&87L7wV?f5t?<|Q8}W~*
zzKQsF8x+oTQ`$Xb*pN;)fr>i5KJr(L8&PPeV3t<Ma+>^-HuT=?UDTsxD&G=!5uxp8
z1wU4#T!shKgBCUyk&6nmd-e(YInKG~bDx1phod;}cfwfqjisDH$x;#tYf^LKa~1;o
zF6MSz!X(V$SVq?nl1tZh3THIyWcT>V=R8zVEY8Xc?N*W%>TTBH-L)-OQ_i7PF5M}C
z5uKtN*oVBdG)c{^Be6&UFJs7V=;v_eocdqfb6H0;{b`wGYOh-U@t;J-9eqk<>xD*}
z_!810KAXZJi+xMozPKPa#u2N~zz7n@skY1B=ATag$>;vp1h&lmVM>4g_9R?<_AjL>
zGEo4Kh(8+FJa;urZ%%K<#MW3U;aWcYjS*-E!l{OwuXj|cTGu{}UQu{?LRS{_KI~46
zRw7&$>x|2SxParchR3KaT8J-1r)6UEmDoKm>_*v6z#eDpr+{XfK)%e_nx2k!kLUNp
zr=%?(hzlUI94{Ev5Wp^J)65{tEOZjP*)Hn#Nf&`SgJ!|ZmnE+_WNyGWB)ehf&y8UN
ze$Wb3Why8(b4&AvwfNM-V8MUqEog*#te~wX?gJb{Hj`%kBVvbQ=Xg=W>-Sww8}-gv
zYNp##yX2u<a5}LxFV0o~N<r?4>tz>TezIrcv|q$&o2<&=YOE`37osRZjQzANBesYp
zP;+vF1#HsBFR%Eg-A`Zzx3nO)A@>x^P2`ZGg!{3vZ6mkf&ht7!D)(}Vxlhy#+|4((
z!SbpPd<$Qm3p;&Kvmu!#MyqUEa3A1qS1lgkz)w-R4`T^irHDG-;lfDqFovB67A|iP
z+4g~}U!qR?$r}Rd5WcY1pdz<cJ*Niag7a?SuvJ58G(a=$6^+kTr?vZ%hC~-%!l@*2
zwa@lRYC7;xbjs@2oo*tV4QG9Pw{RBnRZ7*m{!|lKnO?-ppAz#N;&7c+aqBP-Q_F(f
z3LWS#-^)dB9FXsZ6@Es*uiYONU84CLYElPoC-xg79Nj6F{<UIBM9kJPb@Evgbg5##
zJ*~Q?_b*37l%?(&`J<)JMTw<nwolNP+?I^0ddv9RZ?Rt+QwVIysc<+eikaPi7F$?j
zS>yuUMB9iQvXF4Wu0dON(iUvWWd(8JjiD!0({BzhQx}doePEa^C#;lZ++A$MW2-0x
zs}j~7#p=H*Q&E;aiURj-x<9&_Dm27F-YvSTBaTox>uP`yE#ZIPa6ef#nhrmmu$FFi
z6s2iOJ$_B5Q)y4JW5habI%<`OQvf+P{Z0*6Z{>^L%b+2g19o4$vfMi!n+wjAf4jv=
zM1naXuErYTM`qMvI%zn2MlIb#S0~4Ld)u+UMmY5Ray4jZ11{pOavOLcT7h*01?b>a
z>W5nrQLe4Jz=^)5N;i=Vl4UVxUd}$tF$B;^*1{O>*EvCCO_{#nV}caijHbbDyo>@~
zCg<w&9M68T=Ue9klGM966I_{7jhpc$+W^dk<w%lR<-W0Ph^I(t`0~H|XR(dBxuChd
z=0n4-yMfw{5I!sM@8b#6-~Vf6t$6B~kH2DGSyM=+I9q-khFK0#lO#xK+G6ID=#C<O
zc&63VLH~FTxaU1g&aqZo9VSD5+$%0LLDyobpI>%9pF=)b=Abf^v!qm~QNBj#%5!aH
zg}Nm+v8p9ZlktE(blXN*@TEpB`yYU=B0R9*6k+^#u8Vz56@%yAKA=f&lckLG@mMvd
zel)+Qt2y&@utDu)7rcaE4~USoEDy5SowBsx%lgLaYjZO4d5oO?s8v!xX{n2WP^|j(
zkc2B1E$F%_b(LIP0i>q!x4A<s93WIpb%>s>GGV9a!aIXvX_{uAbr?-sMOdJxHG^U(
z)E*<+U;)LGK2Y?`rzc(Ea+Yg>_hH3jaDrrV@9`7Xy~r^VN?2}v)5VT_bVIWw7|%-*
zv_B(HBEM={^fF@a`I&_CFr>~u8l0o1+X8Kaoj+9B7sk=y#Pn20V#l?dt8ZEh)-8!u
zVuTkd<?#=<3N^=5SYZhKL}Gn524DUi>BGMo+bfpcBDPYM))fHW(qu{WDaEp@2Ub^3
z6%HfLpRDSvu@gmJDbr*`C9i)vBFuASUyf`nLAuhH(<(kjnx+kVfrXh=b74Zbve|h|
zP-fkmDYi_{lV|dR{+bpguX+jnv$7fpbQZ3f6tgqOxDk}Q+8Hy?%Hk|W4v#pdh)tKu
zTAhwFWc!#{f4{@=6ss6Hk;3Tm{TV&LKwz10-Q=L8k08;>(6YhRaTtddVgALhAPKbB
zo!ZH;^d)HVy3gt5(6xiSG+tHIZQEGPe+pc;1%+ZW+?msz_CA`qXQ?eB|7_iyr&P!e
zt=*M<FNyVu->=&0impYp1d4Lh{N5Pr*VL7k6IXgvB^%t+sL}w%S>RvV8+aBUHgi`z
zO?^*MyH+Wb3^8b_zmZk>6EI~DJ6LKNsk}+ee5h=L3}5xlUHbS_z!Dpye|H4ArV|zX
zxRZ3nG!>-{dXp#i<@HjPQO4d`H2@-g3fE2RA=zEtp+6|$)Yn1BohU4s5`gy8D(RYr
z>m+_#_gK$WkH;6WHKwkCe&MwC9yS%UK}pCEWVBYhqMR$v7kV!SvW_-OAkIJH>Pj7F
zZHgvve$6A;TH?VUQImN9X+qoyR8SL`KZUIVel6WYNvN=WmTsaNe$JoTGc+Ae)eZ~9
zHFbtMNUAS|&Ip~ztlQf^$1UD9ECkKLMBuG}{b}d}ae?U0*2evXD{_~i_24Zp+gUpE
z9n6XvgqBt^s_Fu6iDnBh%s+K31d8pldDr3cX83qmv=SS<VKke0(-eWPx@YhZLIz6C
zLZeFPzoTUbDE<;j=Npxhm&#vj!a|!ZGGJqZ4`toM0!0JjK$n+AqM;hSchwx6%{63B
zhPLNt;Gk%r5=&G3QpY9(W1X)%nBHd5)c(V^Ubr=IF_03Gius(<BENcb<9l>7<}1PI
zaBEFBg}aX0NCvaPBZG^G0*c`rNCgsaxO2;JqYL#cKhhv9z}8j^wLsU)M}1!d#%<B}
zN=n+z!RgQF?5{K1{A*h+Lwk)u+Y}l%mW>GO#I)zjeGyEmoV`W<AR$NQ`<*S4lJTGC
z&i?vRA-_1zb4zs6uyW68;~0i51@3zn@`ZS~u6R0EEsc>YGE};NI?ve+au(g`Y)4md
zF8{=dD5np^#m^YUMIMkHle^tQAp_aRq@P}qpG0l22Obl7@x_gt3-4VSaAq=52Yx2b
zP)R9+9B_U!@Lu%HqtOf>nDxpi0dsO7cnIONUEcjU4J;5?<NN+O?ZK}GLYc(UVC)gg
z=)b_;GiAn+pS4|cfm>bA?kfbXlzd84aiPg$glH2@7|OV7hI@K4`*jA1sjmNCW9K@@
zM%;!fCrdwmh7Lb<@b_!UzcEPmr#v`aCqO&ahc2+EKkE){)vY#&>E$n>|8B%xg=rmM
zqJNQaB$2TKe<rBHN|A<_@wbNa*-kasM7JO#U9snz`mfT0l6LD{m=6z^>30(UT<i1D
z9mhS$8nHt9|H&F?$^=@!vf=UNCXw<guV+Q22b|sV_)K8_{-=>*Rs02dl+}*=e>$%c
zDi-P1luGN<mt&4#j`^Up>`=&>{zXerC&7(t^)}W4hX)IXFa#?N5BgJxX4TKwnO6@q
zY`#`2wpNm*mg~x?W39SbWz>bg&Tr4=fN=`V_FbLR=3PMfm&o8>_x>M8eOF6TEy1a9
z2J1MFTRtEAsZwgC-{7y7wGTI#pP-tLloh!IMmGGl#h_Ac?b&13RN`tj4RTNBSk=n<
z9%M!Tz&)eo-6m|Qy;-lg*V`X|sMgu>9#?eC1(1K5dZcHqaMFwNLVDKHwZ`z`n;gDr
zwn8d$Z1l%D16Nema~QJbdpCA50??G}mo-(LK;FL=_k38-u%7qR`3GmMKTSSU20d7X
z;Q$A+f{>Q-af+MOHOq;ivRxkSGtG;sFJERDM*~R${0@BKR{VQn9>xQV(S6$D-;JPX
z-n4|m4+rL1S+IoGy-lrTx$d#41hbY5(WAMR;c}PAe#YG2akhcT7^vq2Os~W}OVUH1
z=8>*%l3xRL6byKV!@`dsR1msKkizqj39_j7T$vJOF4X@Nj6aUbgHQyRdr_6Wb3+Rm
zq0*Y-wPLf=F*$slUm(e@kRVkVyqg#Or~ydM;z*79;O_Ob3wF~;Y8T3T78P*l3Ce~a
zS*_dsJZxniV?$zCyS`^v9yo*faLUDDLOJjy378I?yW)9>9~JmdlZAwW?Ey5YR7^Ax
zJhSE%&AaU9rP#V$whQ^wJY^x+(tBwtE)f2-l4g(&@|-w@x0R$Y_fed^9l@TuS1i1%
zzWxSM>E6|F0ChG%SK>hOwM5}iv?dhxoCCv68Xne5q$_wD8oz8o2rO5)GDB$i{focW
zsH#x)s!j6w++-gFPFEEftS$bw&KA)<FgpeQ@FtPpBgqShin7F$DQNUEv8nm!CLc>7
z&W1JeLDZ1iRgZ0XLy1Jiuut@D-ATMC*}d=sFTzz{A!e@NM+^lt<cg>FlIno|)RuI`
zHmWg_<aNu-hD=21Hk^skL+*dZUee<rKgKx{T$X3EjCLS5qo=l!h=BLuHbFwT)n?2_
zN@e#89dR~fLu#R*##*fhDRp~BFFd<6HDcy{RbHR7(~lT?KKz`?jcm3rN=8n~Brd~O
zZ+=-+F$dD~D)y#j`h3};8;H0%pomIh9z4)j%qIR+>dI)SzCqP=cS5B(aBd(yXeB0;
z8CT8V(!+NFCMekY(`11PEJ}mvdwga>bR!~A{#Vi+Y<C40O(4)rS<_2Y&~<bx75iN!
z5PuN6?}UL&?+702;c;wiTmD7M`0ZYv9ja_=cjY;XP|1O}3xl87VDi2x4Uj4(*@wv9
zS?^u0vY0XDd;Y+QKb(j>m-3?t3XbuKGKgzY;YV#DL{WF$^9;G-`(UdLu=u!HwHp>V
zalmKNUCHlL4oaH1H12knZRE9r#m*bCcmt=Qv?UycI`zmK^@pqI_nW@`EL&_j%)svS
zK}$hp_||Q-F5C<X4<2EI6IXW&({Ld0mH*_ARF-I;Me8cGy4Td?|0|%KU^+x7|2h`m
zOPq{-FlOIaehBxuQZmyeG)$Q6Ysz?5NCR$nhy<$XRD>UgKE@9ii;C=u8in~7H+D~1
z+yt9#Sk5$$tz^CWFGfm^HwKpCrv$Q8eFT<}gT{Ggo5%atKkFap4#)SeAp^A#iYDuH
zN1%!5mszSCVpl2Ih5XmB8vkJ-)9_K(`p!y43NFRIxli;mn9Q?mQ2V=><?)rTbsOy9
z?W~w`vye~}?5Rnn9I3mnIA1%%tDV@9?jMwe+n!yBuc7om3n<Z>2|Efrm&fPaND@QG
zFoLQZM3p>6YW>MjhIuC9(FV-wfH4p!z(sk>c+U$mApS{vh0PLXeG|u0<=jwWX)pcR
z;5_U0G(m4i096sbtd9+dM`n+_jSATrN)Z?cd0om%H0T{N9T)kjnFr7kem14$rv{-y
zFOVmy+~}IX$zkN3eWwDDCZ)Kdf+Scu$L;*~vfRv;Xz8e=b*5HM!y;mWOQYGm^pTuH
z-xD&~_f<^z!s^L;K4x9q0ytgloxYrobgcz_eg8RHq()42Tx6lU3-LO}&>pu!D2<20
zkl1vcc3B*O*HrOR{;U}wkm26Jo^L)i#4r%c*&Clul}6T@4%EN$HoXH)d)q<Vv>@?O
z{Efnog;^oC8A$do`uf+zkdnnV>Ud5+2P38OjwuI1QXc>`6x-Aiz$i^^8QA>;^vICu
znrN0pz9N9ozE#C_UOI-@__chWvvf>(qw<L^scmLgUI!=^CtP{Vw|T;JRpZDyrF{aX
z{yjX7`v(3Q9~RuImJtkLTbW~s`YIqyUOJqM-4`<L1$z#Zq<;hMv}qG{r?`EHBeZk@
z1P6_ot^KZ);;POCNM~8qbp7Cr86Uw48dWnh;OIdo=wz&5GINSd+LvQd6WQXGX71FF
zn4JHLjds1NqA*A2kCn~ejWSN*1{3X@Y%cKT^n<6sIDzYLH4haWZ*64?M(`8d9zjmt
z`4(33GO6EH{;%~jP+l$y3CzYJ?+ls*Gmi*bV?AhP+a}rU#zr?BT{RXLByN55iU+Gq
zx3{bj+hj|1=krZSBRqL^mBnKz@SR^V=d(h2oi1}{qNxlO(FH=;mv~Ei#o7VBpnkV1
zN-i-a7Cz1cOqr45nH8HHYB%Hu0-FF_)F&gwg&D=U7)bX1=HsSo&igT5e8r`(o-PXK
zgj+8EZrcpYw*y5VO8}Yc7C16rpv~Rl67Jd{IYuPppBrBL3>@m3Nye#klE%{Fyh%+i
z6DHdvJdFjbOLH~uHllGY{W~pJo9FY-&(?sLH)&%QK|3V!fo<(Ay`#2k@?I63xq?&R
zuaIH{uh92Y#RW%e9vcv-uqK!wFM-YKAUB|{TY;=^FYbp|c^W~MWl37eJE-4hk+Q0>
zm@#|bf=TRSg+Z^8AMjj}0eC4e_kTgbd@x7SLuRyJJz)3OByRd&@ua&{hpY;ryFiv|
zY_6s1v1<pHW)rusv)6>0IR)(AKZdRO#z^OrwAYq$8{FntAIL4+E60_xy6mnSeJQvf
z&PkdR_yOsJL_*o`Gcvb2Q*LDPN0GDEdpo^0`{oWXUeWUKz-xBX1mNcOYM0Z*?N{|K
zzc?L?R&9(=OnD7{CBPV3sir^djGvtRg*yA@C|emUTvf%sX&d#nil-a=Wv44my7g)q
zXx%cFKip)soEc@uviN&KHKy{vo%N*9bH$ml?cF8LR|AsO^K+0&iD8P+`PL6o6;oPW
zjm^Dli(=NlTpk?&c_^$pK_f|^ckA&;s+3ylIvCJ^YqUo-U}XG3ctqoDu_m&z)tMe&
zl)$0Tw@cL)Hu&}=to8fUj@lE%Q(6nWmkdLJXu35&qqo{5#(A(Xz%`;q62mnj){~aQ
zz+xp-tXcpXA>A!_GY5|l4pW`8UvVyUeiagt6pa;58k?-|<UTCJ8At&gLti@6{53{p
zt@SFlTRlj6`)jD24`**Q1yR0rKU+S@kpu|o*;qy(hdh#s-!B%I{WS%G1OE7Sv<yWd
zx+w7v;suvVW$!3`h#$wlc;}>fBt-D(N*QGR*MzQU11gaQDLkC`4?bTLo?*q|Tmrwb
z4}CFQLgeiv?YP=&H2Q^qq}uU-k8R5tIllN3X+k?=4BW81`JHAUwt4@XYAqAt5>1N9
z(ubzF%QARGu%|?DnD{`uxpH3YfN!1zJ>p`Dt-@GqxJGEr7n9v0VPSy#BP(poGt$Ez
z2*#M*Po|ME^ywlcdo&{ue_LKc6)mw=o-ADIDOT`phq}#DwVDX*6y8{UDANPiYkWHK
zVYa$ZNHHOS|3=ryS%->q_vFHl01_Io>9iIt=aioSpY^Jt(-=qR9H5y)%n%j?e>t~Z
zAmMPa+uP=_8y_^D6B(1PQK1#b(neO>2XyoFneCX@X{JvxA2Rt+MsijRfHf<`5%Df)
zs;}uI>4i8?o9Ddwyl;G-gr<8|u>q8zzePlUxkn|;=a1fQG8dV-1jre*=nmj}j26ZV
zfW2O=dF88%sVpJ7R>;JS1r!bZYeT96#S`lJ;Rezo@k8gQy&{>OX4&?eHLqko`g@u!
zCtsu;PW*wyx&xoQr)i_5ZQ`V||EiBU<E*6CJ;Itts4-Y&fp`=AT>yCmqhi}<QcPLj
zcWv><Q>g9=W1wzu48SWK9`QzG;e6(J^;eYV*EmagGE3Z1h=z+rPB<&ZPA$>&*SD*b
zkM(2v-YseAu4k)43DIVz_&90tjf|A9DwMR0vV?~rpH8KmtzX%z8<h~0_J*D!u#JdK
zO(loLO&dmPwlFtF5=OBC>?1uxd)aW+qXXzL#BXZWH1b!@m-S2u^|4*&>aVGk-B`EN
z$veR;!$WTF#IZq0oBk{m*sFvoCT4dX{ntu9GqZg-4kmMC#>oWVMfT6U+vP217JEs?
zR(w2w!vU;>Gq?3#b(+AhR4$0Ql^O~h>A^lK?971B{U>>r<7FJ$yraR|I&^infD#RA
zMW4nB!pqfd9{?SMI&zjS;9~$oE1m8@jx_0ucW(2M*D&wHeiN8NnOiu=^?;@27O^2d
zm5~>=FHsQqZ1vcyV5x-u$R}gGTBPO7TY47UhQNx9#GyHKL*5bpSEGWFzuBjfYowE}
zIuqT2<CXg9ZxH3-wX6lJfJp6yYfmafyYcQKB%#F$MY#Edvp>!?sarDeU+&J^`F#6=
zHV<@hp=2|FqhrGQDed_QYW{xOTLXq_)!j7kG6F@>8IkaY*wocKz0iM^GV@00{%jnj
z`aF=AB*7Y7o~qcBF7cUUqyvvjeNy3SF$MP|gnu2S?a3Gdi?WYp7sbgQrCcX%p8gx9
zCbb)Lq>gB6;mx7=_Ml109e>2iMEX{Dlu6ZJMK3G_!M-NRJ#8IKUEg<yk@6(*E<`xt
zf^}r+P9m%q8?7gNakwSq_1o5;^{qe);XsWmJZF+CRDX(Ry@=D&J*-@8Ia34b#1nIN
zPxf(4l3M=YpjulRH&$A=hZ|yP)6eQme7<}W2Jz56$-P~9MYBtNz<s&;FWc|)Kku2J
z+ILVkDRJ#lTTMVw&11MGHeIhP@*&+M$L)vRA1BSWyRjFF2Bny5HF+9vmA28+6XQn<
z29bqLGT)S~o{5{L788Q+O@U*Y4&Di3*SfFUjLpihBACwe0_lgwIP~SrUg+F_y}rIV
z$pR;U6AEy{S_*LrAHQPXpy~W2k^ZLUb@RgrI8e3DFJSslYW54TR_qh@HwV`_+m}>t
zNORg(jEkdR*cdBjS>HaTr_s+=da?b_Z+=%*uaVu^QYtQTui4RfeV9jxowM-V`v%zO
z0q3bPR88BrV+T~j<<1Lnp-#EyBxs&J91yu*g%asxp(NpYAAc%SG3B-(T=JeyV$M}!
zDb=g&AIYkDUFvFIA}Yp$G&7vA;Y7S#mik=|ER8vA0rcnXal9i%W^eCezpZpgw;cgc
zI<F;u9?H7KH2A3}OvU$FA!maK_O04#uzw+5DE0w!)~+Z%S1*fE3uu3VJ%YX=QL~l}
zl^Ia%xD)G}c{~h{?AxPu>Gi}Wh{{diALeT6Evo7{+Zm6D6I;!Nf2(oMfcDy(-`SOU
zd*1G#lXon^ssclTE}>XLe{)sGW$T!Jdg~K0%Nc9HhK8B<A3~Z=fCdOxNSwbGBQ?lz
zc!ZZ!R#b)@v3s~o4{<`VNBRuFW;j%B%A+u6@EWCzJtseOAF6}fVDZd(X~Mx6#w(qk
z`-ELWp8mRck5jz+R-G;?g1Yv#O1>E(agP51Hnbq~-5cMkttl)CWHXrIiFtXsgpe6!
z02njlwV|3kVIAyH1`YwtXIZM1z?t4R3Aa2n(74;R@R%%L2N?Oe;NXJgpOBez`2tJ@
zP2zt(b78U1=K(!>0<Ro7(X@;o)-BRR!m7C2yrAJ8Bv2FMqZe;69o6M;UqYO>sHvTP
z`&9*0FG-v6NMcdW^Bq|etsBvX_TqNE%31BA2nbA0X2V2AK?1Alz#>J~p{?sws9|EG
zeYA`lDNBS@?US?p8wn5ozU*m{B1Fb?$sXjdl_wP}l#%(R^3d?qJ{=G8^^y<sM$L1k
zB`(#mv*ykcF*s7#o4(^^ecP$}>8*ID`Ml9Y7+0E7=mGy<Zvy0=rQb|vi3^Hk7QBi%
zy%{55=`P82jDV!3A4<DK_jKsgH>%8XYFZ1p%RjE6k_IUNipUW_5iKa*Ce)1?Ju-3n
z{(7d;F2UQ<BMTmIVR`pQgqP3UmTi~Hx34+;qQeM1vW@j6|BXi8)A9vdEp6B1%9M9@
zq!e-%Si|vZ=95MI?cqN}*{77)P1yT!X7B53wbm$xuH*#+)j3+eJ@MQ~*Td%F^Z^kc
zP1x-W-B$h&+yRTPj^|w(w_d5SIn3ZBR;oP?;PL8Fg?eb1eAiYy1rA2~`4Lrf?fgQg
zQ);VHhXt-}*SSr*>yGr+w~0R3+KS*eROW}_7DGmcOd~uuT?5#z_xQjLRLO4X7l$7i
z1HNR57P*;ZknWwfpTO}Y&$5rmIa+vBE9z!8YY%{K%cGtTBWVZ+2*ZI4)LUHfT`Eql
zSmRxxG^K=A*t=ZUez_wRFkjf-8JQ%tSPynw`h4*8(3>R-P<mHS9-7SWl+teNF7@6`
zv89W~KT-iflgolmtOTTj^Ay9CymiRW76xc>RT3+GY+ir)=+qJ%EdQqo-vB|X3j6y>
z%x`J9nBu7Lqki@`&{i8~<IZj08y|sZu-$Jz|B326kQSFTMGs?)!vQIUt#F+!pWmt9
z9y)THLagCtEQzeA5=E>*oYeYF@B41WFn=s`hlLJj3a|09r+DoY58_cDymyNKKxnh*
z0aUa}i50&&hg}@y*rkc0-#deUTvcluZ)9d&Y{`gW>HNJf6NOVDR4qf@%Hi(8DLmC!
z^;=rh18H=~y@8Rbvg1K<ef|~v!?Z_r`WAWbO#KKRd1Vt%n-{$~kgRWL2QGhXRGLtZ
zZE>l87_b)0J##%tKN%K@5QGrSWz?<xUb?V9fNP&i!~}5;fubyk<q3IK+Ys@tBJC25
z+HOF}<ogihqn?gPP3M5NwQ%mm9~<W{yI?Nm*v_;PAMtxm94Y~_)B}jt4>x-KXy+K=
zl03MzKL+s~75gt}3_yfbrvrYuX1_C?^h`b;n2W$1&~DJ6!q%qr*b#zk2?1{a?a^`{
z-_V9O-#9t4)R%RH!Uy>UCC&EUiNmonL@#z^UD7{!RsnWA0WVlDGz-naNyHS#rI~sq
z)#FEe8lRgc4W{T?$ZW}o)`U0}PMK9KrJ$4fA~OTl1UG`r-o89kE!{?2-l&cS*hXBD
z9~)2w3!cR=6Q-VlIRlh=LY)H93E$wcJ~6vC46wd%lr)nG8oVy1p9_;cOnULNC#J*h
zMV5r6azZ*30GVW}p0(EB)T~D|l^{|mf+>7naQ4cxb!#sIf}n!6#GP`x#i{D(8DW6t
zs{)+IamCVD5;?Th82e*E#D|DwJQhxbEt~kmMGa)tSyE+PtKXt($Ga2L^{`?q=@2(~
zlb{0!Q)LzGS_{Bcg{8Y<zM-Cl07M$U=hfevl)>W@xny$)@@?6}f2GwEIMy#Jjcilm
zteFO!41_xB&<7uqCv}auL~JSh<Gy5gQI^*|EZ^zW-i2=<uhWH`6Q-tn4Y1~9{1lM_
z?nvmHM)%fB6-t9SbpvxYbg4K^Xq_Nx5IF}Ri}qOWO}yg%L62eyjkuFbq;qkRjnJEQ
zj@a9q6}vZvunF!W{VIkyW*mNqjiyffj&}HNZ?TVjIQNsy@Zc{Gj{~C-kE6ldgXN2(
z%2qFYuK<!4CfLuNSioUwWs1LzCx6JWy(|W&z9{Cn>$#$J)#g)=OkVU0lb48<d5L6p
zKEqqiVtS4DBH<Z(Wo~#Q2Tr#f2G@GxIor#y4iTAW^c_Ff<AjwE5%_<sIY07Qv>$h2
zB!*J5Ml0ZTG-4@G(YZE1k7IZ~K^8$b+Ovb6lQz7-E#9B25VYx~I)@6AuZbO9b_uq;
zM^WOydm$%-iW>YgSSGU-yT$Q+qB7mfu+O--|M~bi9qs@A;iK)#-}{~`i@&r#c>Rx$
zQUA~He08M#TBL1KMEwE%|Kk@h=y9VdhSe;iP3iylb^pf&fE#&E_YaKwuS%P$j603s
z|NSa5sPCWt4-sH6`u}p9|GAtP_KUIR9TCrOx&P0r|M&BJeeoPm`2Xh;k_w5`CcC3W
ziYppplDJn7w@2OH%K;=dxnL+SzzFb6l&eSsUfxIam%JH|=hJ49pzet9!26r<rPfd0
zG5#E>PjB{ryq+rDZG0h@CrGs06KnS2{x%YTUNuzJ?4BW{02Kc!&?aGrB4fo^uQJyH
zkZCqf0N?>iRTJ7d+o))I7K(y{{b|2e@hlJ!GYyjpxLHTOzgkP|22jR4g&ZW`8!wL&
zgYFn4098Q{pxTTz@AAiao+T@}3n2A&Kaomm{?f;Wwcl;<kV&1DqrSkAIF@OC(l7Y;
z?TzK}>uF<weSq*GU${#Q3Iy)&86FNA&(0MpVfLplAAZn#%mB|%^Mp`#d-7po%Fr+T
zU;rAV<g<873NT$9hl>CP4i4Z@9K%Dfmz`5#{Uh7AIwK;#iTXLT#?Pt?jRo_Go+D|x
zQ5H+r5lgun1ek>!Sui=ah?F|vNnNj}@&XKx2E*0Dzq$W>5{L?CQKOpeg$k(z+W^ol
zQ?7eI8=tqG-jnnJxbqRfqepzuGkLw=c6&%AxHUAQTNJzX)FD2#YIya4$lR}MGVM4l
zx_`-0IlUxi5|jXa0Bgf6zaH<2QqTo3dI+ctzH-%cyZ`}a4p>i`Enc5p9@1Vd0GuPT
zz^m0rHvnb|IE)xo<}i#QVwblU#w+oO^18n$1ui^Em;-W(I2c?IO_7to3<9wi0Bk-2
zP_*O2m!NQlXw3jfbAkKG(;DC%ut;9pQv&Y*Fi1)Cd}SPTf8PD%y7T+4UuRm@yyNq8
zaA4?h>vmymR}X>4f+xD(SH>rUxNZROPGLAt6ElqVs;-h&O@Wp=UGB6{AXd=j#4&M*
z328-Jg^LKVTFK-EI3ZA(ma2_|DS#Q0N25f77~O_n1N;yS0DKPCck6sr!7cI!RgkKb
z6rdTo`T$?9<tGyWaLa!3nmanj;d*6=Z%zs*dU7+i1p(|Q(|JM17iWM1TO2N>|8b|M
zeZ8ou9d`g=|AIH(dNIfG@xr%n;KQB(PPO4-i8dRhTgUTNKteovZ43~mG~@V=eWY7e
z-QWqG#r(WV^KcybZ;Dh%>{75|e{!?N@E{hFqZGJ~Ck#x$1|opLUUw4R8+ro_w%IQX
zcSD1p>UY0Yt=U&gy@wbp!I7&v4Ph49j^mEOg*)uVFu9c>;bqLn%b-V+Cr&|~P|MbF
zEKge$4~%!u4VbtmofxP~If6_954+VT-##O!TKSoe<7yZr4cobzBC@ZX$X}RriPT2r
z%pE)@+5pY~xXr~whVWqGzv~GNBp!iu0;MQ1+fT~XiCZq&&5CwGYqKkh_}5aJzh~gE
zxJ>C=#@7IZjn{@P+<OIqbpS3OdSc?YQ&KxJp`-sU>WL=drdlW-ujT8r@v9zj4QR6N
zLVxA|w&RhWyfHM|LJ2{PYe>g4&H%0acxfLIkXz~BDn&V~174@zmCG-fdmL>SC1Tq>
zD@yhNVlWa&&*~5It~N_X>B(Ty=GGg{QF`X+90GL_x<SChM7~J7Sv{@;xFppukQjEq
zSK|bR?X>VWMFd?$xS7xpkhcN}@kH4KVL`VHK+QZbLvhYWT4MgK+W`<TW)H~rE{r9b
ze678cUpjEfh`#_Mbv`5ey&6Fg0T?Kj#(rJ8u~>J0Sy8g$10Obez0~4~($~!~(#ipP
zUop~TE&2xooEi=?y>(!|){1YI-P;1{2L=)fcAOXb=<n|(zR4dFDs6%9RQHYwVeskv
zTcLhbGh2-DG<v4u!pEvHul=$0Av7xS%S8rnlZ57Lz(tPy0U&0CH!TN>FR22rsQ#@u
z8bEIGn<T#nLaQ4<JWwqGrdvKvc0gB*rNaHo>iujrIcxXx&@a_(Hx51k!vyI^5T{gB
zZ2cVYH90Fp;che95#uH_sXuL97`K@Fcmf`Gm8hq{D|;nWRWppsH&b;D(6lH{;{kk|
z#~|M1)*UHfBhHgSf{!U>J1R1=XvpXLD8OP)+&p);ao#0%OTl~IxhdxCs#A;o*#D^Y
z5}sp%X#pZYdDA)*knQl}J3PnzE+r_6ZXHm&clwrhGAw@dHdi#Gw{$wZ7ugE^M-b(f
z-yH&0B-;~kxhR~`cmLW@gA*Mf<mKzrm<61FusUUv_7c$SR(K~q@(d2x^ie+9X2=-L
z0d+@GoR9N*bK$i;*d|S=$64gb7*g;mu5(`@>_#SZAK-z-?cO?>Yb~3(ww~`A4i>WC
z18DMaAP%L-^VCa+jI4=AW`va~iZ+`mDQqBhDT+I&W*Ye|&hQ{WEvR2G!w-mA*u~r1
z?>5^h7iz|&X5F+@_YqR-&iPlVJy_?mw>?5HUNRk|T=6yMF`YF5%Zl`BD2`MV#j6{1
z1VFHa5?RTbN_E7ZxSipO3v;jM)P|{{x<)q>*#o|S*p5{Vy4|j^+w-~B%<4C@5~qU%
zuoQsK$@?!;XvRGBghF{Y_jlRiXf<&6Q#0741Pi#rzAugD*w&uwf6bRVYB_~o^iouD
zuKpzt_$;K9O<L694GeDFmk5CG!IfaSax$jE(`#4rOD?xzm%_ONFzpm>{6k{uLl^Oe
zA?ZdvkwAo)j0X+Ie3&497`0(j<a4uAHtk7Rkt{|_6;}J1FD_7(q7+8}Tju22sP3D3
zlF)x^0Z6p4N}tM6=Tn}3Q*Q)tmm+P+ZB4Is^M6HN4ByF#Tc|%bJ4q=Sm05Zcd=?41
z&QiLyc{qcRitjDzk9%qEDJ)Wb3mS7t`NHKJz=ceCTfOuU>kXr;&@dMde~9HZ6Yw4Z
z79~&&TWORB_L{8roaLeYrha~Y_sLvA;)v2o=x@g%%1rr%e~+~kiY9zhMV_kxjM36C
zBoVn@pAm^%!Z~SY0;R?wtEJl5PRd~|Rm=tL>6xhVM(&C-oKMu-Wh;GIe|<*2gx02r
zQpBseM#|qX*!!69mDT8i+6tw$kuw!;G>bf*dG_R<!ee=$h&Tzi@2?!+PvKYLxp`3t
z$2%+}RRbgt`a2+7Vy`W@Z3AM|Ae=*aEq*_A6P{KqaGW_cL*Ntzgu$&CJHy0l_JsWN
zZ#X{grtOsWN{=DOqK#yg!lpnMWYTc<H1&ZqhVRSR*{e<b8VmoD`^P7vuhSu6Gf^^{
zHGRc;FB{WN#^+rdIA<D=;~7Ucr<4GBL-L^_OMR<F(-HrSVY8}bT-{1OJ3Rwf{!9>`
zMy;)-lVt(yCgmc%0ctz4b^H3lvXWw_Xz+5-S&2=Ig>miQ<%R556+B_iGqRR!L4!1Y
zx5ALb8vU@WcRadeoLRggHyvTaA=%-QT`xOI%czYoTKJf$g~Hw~w*?F!a9Q#ao=dS|
z&XuFo%P5G%bX$F{`A6$)CWDAecqf5r&S^fAt0mRn^D?StyVHj#l_MttV3}6OJwFVz
z@dx@f%$a0!*^#bjw;8Y!I>iN0oVZE{JTxLjSTUe)XRm&#VGuV-)wm19m2H53BeaOe
zoN|r*gL|2?ltx}5MU<;C#80IbEJn(_NjZ2<-%~LCW`TEg4W};l#vS2bFKPkmelf;(
zBIx@mt0C%GB&DFIv&zhADymGc+H^yx=UE)so@FCtHD!6WSa!;K(d**?S5sKf!)XE7
zeVtUry=WMI0xW%rIo2+A9`=kHr0=Xf{>p{NTWO~lnmrM77CM*~@5K*tlooEeM(h>M
zSBt+A2s^R<LWFr`_T=$$BGU<_yvUA47{L{pbDZkzX3~$&0ur{H<753!WSfgWOQv%A
zvW%$KCHbIY;KsRZPSOOTjmU++DvHe<A^D7(d*;kie%HMH#9@YUyc2s_7wIQIbM-H9
z_HC*(lmbc{)|Z!KnUX4wL4VR2fdbN!pI;Y!@mx8NfTYQPv^3>Bf@VRVwl=yCA3Ah!
z5Ji}RsUiZ+D4zQ`ib!c5w;TX^bDDWf7X$5L?5IdL2p_Q(Dru<rh`sAfaWLyZH%8@N
zCqYWOXeby;(z8UI8)dF)jcqCQG5CGaVTznoXHH<qzfFH^>lPO3O|ly^$pcdQEO|D$
z#}`O*I9;*Hq1a-qjfsA@h79+af|QY!Qk@IRCba7V;a;$2IWsr=>R)BqmcD-21CBvU
zW&sJItmdJE$b&HY<JDWh&X@p32CJB}{nGs0d-KI#`x~@9mcQRPS5ICF@x_@9b}NC5
z|BB`B_}XIiGKV+j42s)pkL+A$`%jKXO5#Y-)arh#`iuuZ{o2&6aLWMZMY(E$eMzXz
zl<p6Xe{G6Ndw%gvVGF<j#BoU#@N)ZJZ*vUR<C@EtumU?$wTD&=@t?6g&=7o6plbBH
zz9JQX@7{jKvIl=M^!fRH#)x-`c^+@)S5@tk1ZM(EoVSz)Jkx8SxgbqpOQ6dyM}5S$
z%7BCAH0^GQJTBYJCtKkbl((}crSGOv-2TqCs*h6EklWODUxilC?vtJTNp66=cFg)H
zpVP-h(<A?kL9-?Ase!@nN}}weSq|o2nDeIB4P95(HPCzZNUi`r54soX^KZeOx3+cF
z_|kjxRupH=0cJW!xti*lW^-7<)Q!9xzKZru#t?o`0cmuEaEy5N5SozrM+eetfbhwT
zz0EnL3-D3h9dIcy%T;aW=QlxszFsVnyL&L|ERu?`N=hgSRous!a=sN_MBTOZ+VvBk
zweDX}FJpH^%rLYoL?YGuBqW)8$%${JHfa+}7~X@m{9Ry)ybf$RW`TGkx&uiP>%&$P
z9W|AuMc(e=o{XaC?<tJnKc4y=E*td8QPr4}6%>$cgD>0z3(0S)<y^T6ea4}!!RghJ
zf4ojrg;KLxg_q-4@cufXz%Ye+WuaQ**<GngZB$6w3mxL`PCo-Q&v+-Lve)&W=~Q#d
zb$<2>F%J>6sK=UZ1e$rhSbC|ggO_2HAU30vTrkq4kLo<0>>fHjuYG;VsKhAqPk?c+
z@2bkJ^kkxKF>gtKF+Y@YxO0?7w%|D1Ootf@5^UJ^Rt;%!{>sB^ZvyZD5d=XK!U1IN
z@qQr_!P`ujVZ?LPNtT?9DQloAf81&e=d@l548<EJOEljVEJ|lQZ(<`S-P4}Qh(45;
zq`+L43XbmG`YIc0K?oq{uyJ3eB`cA?Agzl$Dfl?1#D{$Xo##AJG)~KIru$(p&TUt|
z0QBd{6C0wI>@S7&YqPBR6pWapG97YQy{j+!e6|gJ)+2u_DGNYV1e0fsgZlvD&IhfL
zKFF16F*d5=Z5d4s*-L>Xu@vuo0UTbQf5Q45^iRF_G`&kyL1PCpPD;GI;2h7wekfxf
zb>Jr>TPYBB=v}x^aU1xQubvtn;d>c^!5tNbWhJ#nyK3OZ&poP<<?)?>L_@k_gap7b
zd&=q-9Dj7AN_QCfPaZe?r&;$%P$3XDU3Svdj~r#GP;!i-fEVZ817xbiJ)$W=yJMNU
zf6_aNeVHEd7a*3G?;>C0@5x8GnMQnb&UA@9zfioP+LNB+CZB36?JZ~JvGrffX8c1r
z?hsHuD%yedtq!>u``?!pCd@q@2vb&3)(D$79-Hz4Zv=0?wpR_vq?7bH+KMI7n(K)|
z7qI+h1hKfd+2+CKf<KN<ShfN)gKJuJ?gupvl>P5Prhn^Z%kpZ~S9{}ClCR@x`W|K~
z8|t>$?q?0-47%%ZKx&x8`;z~l)`#8sY9}I)ktRs}`T+UK``Bi-6c}T~`Oo>-L0fx?
ziu(&s(bILHy)s$FqK~-fl{m7}dkv3}q&_A3BsUemPoc$VzF@7<CDN6<|0$%<Lrxy~
zyeI&-rn7xK*7HZo>xmR+1!aXW2x}r9-RPo_E>jdcNlp*kLuc|*aYKV5sVE2Qfe6%3
zjc?{uM0!8RTxx~n-eo<gXGE&teX?qi(|a{IGc|bSe2TxQCeRz2=0rzQprxxL%PD=y
zlZGUm^X^{j4kBAmIZO;Ea`CdF|2<pU2>)dd>)E<!Y_Zz)CUUvs^%D6#Z?5B2Z$#I>
z!wB}mxqx#24pr24LLx7CvP{g@7c|sZdE3_6wFF^GjainYX{OMc>XN+gK>bRZ*@{=`
zcH*z2xN}1Oi>P~szKUM8fu>Q3JGeycEmsTa4&Ivbv=&C9B@O8+@%{W~vkSQM=L^+e
z-`k5dh4LwCKLjq=<##M5DE0bC0o;Fg34gv6eyI_MCL(Is!!wkV)bL0y=As;~8RbSq
zIjYM`y^jo)R7V_tX6ZTLjyaPl$v7KZ{(L8;lo3L?X@=MDZt8{I`LJ^&j3BSP>*F0T
znye`O%c#hH5v=jk3mq8q9~9yvG^OThV-tgIT+6KHbRL@T>~qdZp+f6SMx2=ir@h1(
zqw&9yq)7mGLq3K_`_6cYnVcPT7ASiDY39!y^u+HpaVpfqLda~>+TR=2Hl7@d>4zO~
zVy1$>^JESrxhOV%XPwP~Zo9ZP_A70zrf;<Y>|vNl{0bLr$2piUNrEZ7ZWOsgEE+9f
zdMO{abwMmn#u(UyrS*})c*;Ks+q~HR%rz$;qSLoXdX%bNQBAbdp75qYYSsQzQ2kJ-
zG<#6vC9vyK+cHO)G2Qk>6h?+dIUnY1u2On!;G%Is+#2WIz%v*Ck(`q?{E^;ynonJX
z>iRO!K9b5S3QS(Boly6V=Hfc)*Xs&bA91H*X?|1EWU5n`AwAa_)v<YAR+?cz`Cm$N
zo)`-;uQP#c)!a8(dw-D}HwrD*gW^Jc>}UpG8wB<FMhkroI)-FsbEN>C++tLzwtH)i
zo(2~^`E5tSYVVc4c=49{6lrlU%>mcJq2~zcTLY7rLEEr%p~a^}WBE^_9Wf24+?lVf
zW#c6hDcuBy){1a>z2$`u+%U4qpKg;1)wx`XRwQ3@W=|U~2UKTMm+4E-s&vc@r`{5Z
zYvCc@9kLh*_=>Am7pQVbLPNzJB{K^>LL#SaZ|R;n7W~P!Yu}&Dtiwr2qBW31ImRjx
zb|9{4d)_~{J(IKTPD<R+5EhP-S2*{gXDK%=PX4DpD@7`KHzNsFpJ47wx@D>BB%GsM
zPKmLu^_Wj7s-20hbKuiv2`3=CpQArw>Knk<72Us{OAuiDkHbMf@PrL0BIwVpT#GH1
z=yvPE`tl`CY+b+Ax4f6A5bC&onUsEHWn#^>$&UZ`y0c^NT5Z})S5q7r|DIyp)T`0s
z5<%u1hQ%05Ud<4NNi2IeNg$o9J3tWYe$r1r*!w<qtw+{qcu$48bn3+fiTMRGtX0qd
zCWK$f>Alb2tJR!YMsRo&5dI2CN(#RWzA}+yUp==SzlaIy<26`LJ%GY~K&0nh+t<#3
z`zVkCzPWz+KwS(U=VQqC>mh+DQi9)xUpnNJqic{!+j%cR>-!gp*Q^zU;6;U=D;PC`
zoqIc1S<1Jb|Jmjs2J1LWo%u78j7WLQMBFs5_^yv9d{5ge1Dt*#mxV#lzh^J<m(L>4
zR1$#hkKgP;vf^>`91X`PzIg}LL!%yg;^3hV?2c?wZuP_yFfT0|M9RLKPMN|LHaHcq
z&$dx;Dsmb$i8)(sxn`}VvN=~|8Si9vRKIvozGp1arD5ksxx&b-^rYQGzTsok(E@QE
z19PN+l9xc_>a?I8e=3tY4UTGe(LPIcem}L2S#EQ!r6yY@pU0mjHPf1s@P@?9*w?B5
zDf$gJmdS{IVCZt<h*Mh=fG3;gkkGlrY}OJ-^!<_+9U;md8OzeWRr^vIPv?-zLlh9-
zyTr!^tlu7Nd){+~Q?Wu&+#81!eNJGGIxRdp2$jKM=l{+;C*>zyr84<JOKTd^$0oo}
zVO%5`3rNgxQ`2?)qfiXi9Pf40$#82yI(NrO-H5a;FK}n1uliyz)c(O!V#}V2?FZ(K
zRyicdXr*UOGA+7}DN)%Z8!S%vqhTgN_C8Z!j=Owh7Rvchd0C!TvHfi-7VkG?MuuYi
z-4CJ0DJa%?GGyn?7x~@jBAYu<=JSTX5c9Pj=8G%R2Ezp8i4+I+@SpD4>8`sOH*cIq
z$GiT0Y&a8PM`<k2&|Vfwf=R!pO8$6n-Me<-Ao4SK@mZKgf)qF*qtOzhz5I79IuESY
zZA;|UbWLeVvcxxN{I_@Sqwkvu?Sr2ydT*<ozvD`G)$=Vi8Iv0C;;Ts<q&3wIf*`o5
zOW>pwSMDEU9^O652V|c@b4R?sr{i39vmoXuew7ms)xMjfR#fXqV^BIrSIp>$5>lEo
z2vOz=h`&%2d$&Zot>_?v9@+0?=;T45s=`h!u0qi#K+ishU-L=<g7enk8XH<3=0UvJ
z`|d>b6TzYB0l~iWDt_L$V#%CCOJznT5XJ0+6Q8DPaS}E_EXZrIid3HORi$vMCA_Qk
z=1k|HY7N)8;+UkG8}Cp~=|c`U5-<w`M@GLvX6PIDGaoW-*CK@8h%-|v;%Y6I@+2ur
zGiRt5<+n|}dmP#$$d}rXr&<;wAW}#b@A|(L=4&lBSl)vR#V?=YthHQ9CZ%~FxArPg
z_Vm}%1U!n)aogo0!^XupTSJPz2fP*1bEWLV<1@BhsP=|gO(H*fYEimw5le;ve_=5S
zo6i!2EF|&+VfrIrGbfoL2jr9-x}H5~bf4bIl`4NA6uaptqVIXa0%Kw#<NZmVC-2_s
z`pxU={4wyAE5lTXb3_pr%{=Ap+6l`+Y;6dG(bK;6wWwLv9}%&5^G_)^oMHudid7H#
zRxR|yoc0`X29`C@;sVRL&XT`c-wS;!!$A$6pOUW!2XseREDP*$dyCG__<9ClemuTm
z{jhR~66W#QTI?Cg4cqPaGbZ8ug8#0>{{Wd9J)`m$)ddV^os+_;=Q6IC&c;5vr$&xi
z$wbhsOa5;%wiS)~2&^yO3t*)MpSj6?sh?3fPo-2B9+Kp7Z~^@xPxSFU965)6rofzF
zU=w*Q+Udq%L8gt4G&Y>HoaqX75mmd7;B09Pj>+NP|0Ls3qqIfICtOB4PNT#f#T~^g
z?6r*${=)KqQTLW{QLby>upk0TgVLQUokNF6NeL*OA|)_%cQ*(q;SfqGN;8B=NJux*
zLk>twcRlB<d+&R%^}O!q`}=WzTwK@LaUB0(l@tmgR3oppEdLRF>l^=s(+el<grE9>
zzc{~x^_%<?Gsk6Q7+1AgnM0e$&Mip$ZC3GA{ZmJ&t1b$k*p*4Dv5G{e*t->pD~96X
z!TW9J_i)4=dx*DThs2PH@~+CbrM0J0KS>^W(Ia%9l~3ex*iBHBezJ-Ui^o|kC~jBg
zb~&rGrjd^Kky7nQzsQ8+q|`X|yBzoF+D1_cmD#;aKFscQ$!)_kV>l)+UG;#og!0CP
zJ!qF5!RfAV9J9Xeo95}jooss5rmB$U^G+~@%qWj+a!I&kZGhPcN%iVX2q}oXeI%o+
zY@t*vs9hzg$-bS378M;dy`&t@=qKzT*=-x4*A|z2OHVg1JF$_Za1;d2MFQcT<>phG
zyOtWi&_Yw=Uf(TZNF$5Bvo#$>WlWooCuj8|rti@&N9-FypY#@ydd_%hI_i46JG~p|
zOuc>d(CB`vrF?A|7oRbaRSNuGdl5x_!ai~0>5T`E5O@2`IdQ)bL6*vgPGflvqnmc}
z)XNoE=z6y%gz_#~&UL|F3QucgaG-xjI96T%xJ45G$TvyTRZX$|18O-<<x?|^sa5iD
zrn}EWx<>W()${MuVMXi@XPS~96*$w7<zLlLvFVFvSvn7^o*&DJP)d-8QKh!wg(rJW
zcd&~02v<5lr}U8piV`zGn`6k@a4*i8csgDYu_GUW_AV;68cpkWh@11!^MrOh3pr%8
zXpX%z4!S;1TTeT#W>|F?nl5PxN1ATNu4UZSyrzJ9n|a5Z#lvvKrfG*r4ub)Ac8AGE
z<rMlG9xt3Sj>YgA4Qr97?wt>D*Uxf-g#DV0p8;1WLlp~=BbwP0GhA30<zwo!N|8bq
z@*G*<=z9yd%R(u)P1V^vL|cY)F~N0h1lvCR)~zL6D$Yo@fXa=SHYXVbeAF{NjB@}S
zFG+4#bBr>s>BgRJ;dj+3alMpq@cJ#O08goH=J{HfRm1ai>-7F3gr_d{OGUETq!Bvu
zgu%0%(jkAtSBIyJmk@{6%{A|ad_kya3qqC_#{1X!nOPF9?owxi4%X!~)V&{Vw#1Mj
z5o&0j_c9=aSfB4CvDpZZO+RA#&*(Y6B{08d>~0F57{5cyWuGA|5--4q71)3SgLZPA
zRnU|txQI>+B_z8Po|mpvVgofZYi@0yLdCkquVHuhrdjsa3-$eBs))Op1Dz&+EjXXG
ze^s{#+gOt`&6oJCd8z+q6L;w1sV8@N@UBCje2ft)KI6T@e{3?qwpKBYPB8U=Ta?!h
zZ=r=c`>w;ZO&lzb?w9iR7wajewM#IZ8Pek$Ye>-bRwm<~Z$C@&2v6g$oyeNM$fk;e
z=MwKiFyjnjf~eL73M!!po|h{ADx6aMxb2@DR}hS+3bDI!1D;tH$nZ);?IbIlv7b>0
ziV$`lR(ryyS)-E-cQWU25DCaAREdcw|Dh44Rm}fUZoLcdCKZE5V*E7^dQpZt?D3`3
z=)fy08QW#p*$1wZ+}XW0(uyJOBd_7$K7s^xoN;)7Kh+v>t0`7Ee?`WJd<2)j8fj}i
zoY$cDtJZ0ybygXPtbY{Axtgy!RWBEt=CX2e<(Ze&=$5LX%1CFJ^CsMUui5L6qq!RE
zx12rV<&Q4@c2WbCj@q?-FY~zL=dr^SU2iBjYm;=Ces%x$GJik)s9dR@x?qfK_=uOk
z=NInQ8*y?aZK62)9i$7wuJY-E_6FA0JDv-R{BdyVtGc*bd~;ii{IEo4Z>QVk*t?HU
z%?@X}*Ut2SGQ(b0)BSk=;NX<Q=4ZRAHnn(e*4Fw|S|g`4d;RG8zTBCEarREzmr2w~
zkHE{WUDwzi1o%w)GLVRNJomxj7abnvFjI;4j5nk;dP%g|yE?_VReNf}4qEQ5cv87{
z*IK>yHH^i2*Av`rwc1+aKX{L=pB0Tp_!fQg!2k4?-aL=SEygR){@&ZXI2fGa@RgIM
zNvsKZZ3*j9%fmAz<H6TD>Z6M<`lP+(%PhRjBx1f1xpE@Xx1Ep!$F!ag`Lc;h{<c&#
z3c<<N?sZk9pye+4w@8rRCYsT0WzDyywKbbqt!o$qp*UNKxl3n?BPU6Gmg&-t1*j6T
z?RU!I+C(t7Zr$BX67hP;X#%uo^I{DrZPu|C1?74|jsp6zi>H>6>SFRF*;e)`Xkn@i
z4Md$kBEm#>r>QPgn(VTitTf$r`%@e5eV_Td8^XikY}C%;gv7xTg6omjmQOE9#{_X;
z>g?G&Scp$At2faU5-oxyEPX334NIuW-StC8W5DSkl$I&s!tL&2JK1wROt-#9RgosJ
z4cWmz;rM)e%4Z)H?T&%Z!FOLO^iH;3Oj3^53tmfy+b`-5ZZE1Q-8UwvlC<TN-X}E$
z`@wNdo{YA7c39KgN%AcD&+dqbmE;qOfC}h@;?Z=`QCck4rmu#TLuj(vu9#n}>vuTO
zVmRInaO2TA*nMfD$d!^5nr+nyF{_HCaxB)_i=--TvW!n1-P4BS`_cyLx>QJHVzxg_
zPC~d^g4^(KKX_Fe9?W72%RJmBlBJTo={zkuyU3UICXXe*!=PHFvC4^WFQ>Rt;plk%
z71df(BiAQ+Q?DsC1oJrwl*a5g16?0^&xT%})u=5$L`2f^B@yI6gzaEeYK=@wG9gWf
z^YydH8lx%8B#xtctGF(^PcsrqaMFK|EJi53&V2$%!|o#v<ze&N{;v*Eq2N7fI?Ru*
zey>T}xV?J$3}byH9yO3)1%L+as(P?6vIvnVzfvwq-CKV^lW+~iS#0m91UZ{Mq<u=C
zpMG?#&YJLrhb?bE<;SS$E>bc1ZKWUTY-CC2w~t>N#+>j=#-OegdTpvhsH?1Zqq!o?
zKalZ;t^2QzA~L^O_oOzIr7F$&tEt!JAA5Ry7k{w?Di4V?w{BEk5@PG&<z7~3aad%N
z+oW;aS+(XWL%7~R3{NqsF_(3zaPxTOelLK~WOu+W1O#jLEMxHB+*L$pH5pb{Q$gf>
zr?O{FeQCwW5#uP7#F3*KS4(Z=d^1fjQAi6JetQ5iXZi8{iyI51TyTN=$u!gVR}#1-
zrFj?t<BO+Wl}W|hu|)7Su~nkC^P^w`q9iI!G1hyKdrKirOM*UmZ&^k$YxPh2-`%KK
zJhJMbc2Vga7*e1!Dpy2@U@HtbqzDCfBwj7G(-EW^W-KOLcztUl&|xpg7xb!g-lTfA
zSTI{TWh>gS<S_oOd-z7DL7)W@q|s)c(~MXany_EvvLrY|X1mOkZo<a5Rs%236TYoH
zrN?YN%sqE$Ng_u3boVG-?xBvZcP6WnB;Cy~_L`HP{9`-?Y0-9aNv~zvdPYkdmELdH
zwd1u_a=$*!lOiNIrB~6v*z(kdJvl#|^J-Hyh)vCMAG1mneUDqOgh57n-nE+`;3?Z1
z%+avg-})uRr!taiZ>6R`O=BV2iD>bAhg)|_RWqBfrfwQCbvO0s?Ok=YV%4XAg=oC|
zTK1P5L`ODmBBp(Q?}}HubCe225Cs$;jrNN4Z}7y_GSJ2L0QTQJ%MT^=G5oG0h3NzF
z;n|8vs`m1O7-nqxi~T*WubB6TBldsg*1M<4A)dMmnJp#OsoQR8((YwJE35uWMVdFz
zl*W6_xBpx+4mw4c@bEN!<@q&Po=QALcZhBCRQ@Vy1F3Iz8|en^Q0{RdG5g*Xd#mFl
zttKf+M_s9@YujE1aW{RSGdWdEBEr)@CRT@5=oCaf*Id@bAN7}Eeke)irc@lSI-JxQ
z#7fqTtNm*i);6eth-PbKvD@SI_URnnS>BbrC9lUU=mh$#i;R7(9G`Jy+}76vq!c|p
z{i^BEhuY&<=tTGXH2uRpQQ6y?Hpg{bDs-WtHkhm30(o5FWH19I^P!eat@&5je%+hw
z$`<m^l@Q@(>{RQbyCKCHWc?)lHdJ~<aXik@fa*!h7$@C`Xqoauv&?cv%2-9G{$yX%
zH}=|<`5_XxR6k!#3GrgZe)$@!Oa;k{^26yr9+oWgd-PS<p_|T~&n^&8Nfs8m>w@%M
zLGZ6kHjhM>SzE`{DQ24&yZw6O8T~VvlRBrEaPz@yf*nD0Hp+?C`^B7Bk)pE?gMy~?
zHMcmdi+#skw1v`H?O#u~et);WKG8Y<i+-KjhcL@zv&M9@nznhKCjh(J?$ejN+EH&@
z`e~}9Juma)k$2*LKvJW5_I>-O6g|syPxF`#g8{2ye4>@ra$bv=BWrV(?IQ1#I4Z{_
z6@e`@G0rw6gS^Z@NR7)=D+G^KOuRFx?Q-sBSL0xHZC5Z=6oQ`GbK0QCbjj%e+yit$
z8ZxPwuPK?EsqaNoGa*m=@(DB4fV`vpj(KVIjR#b!$Gl}JncTQ0E-r-jxB(M=6=Bfc
zTu$8_KN35oldmq**0-20UeK<|hL+pDVp5xBeei|oTe*XeS=s2`pe%u0>i`Z%nRI=j
zHGmViuk@;S<4R&9?;oWO4{z@B(FE*y0EB?JUpW72Y}}im-Gp5nA2Ya2yXTbEu%$k&
zaTP-3S`8)?T=~4_NutLY`cX-(9G8UUu)=+kN7pXqpLS*1rJw}O!Xg$0Th7U(NZg|k
zyGojKYI||7bM4|r?Y!%;5w^}VR2tn{J<wfUvXF`H<`huBwl)w;(Sfx_HUXvNU({C2
zvI30>iN4uX^}bg&u=rY5^H@IO`ud|6TuVo^OpQq0KI+biWhCVC-Ukl2QQLkzgVES?
zU%v2i+VZ&P2g%0fyJbU?84$YVs#Xpv$Wq9jnJr<+3WBdw_sOKM+5&}({_uN;V#&uD
zas6mZGuR2WCHVs(V#u2=MEfj|w2Bh<UR9hNak{5u2bcPf{9Z(07LE(^`ctTXH4XAg
z^|r`Z7DM7>7m0idsOgeVtM_hEPbtInhey>s@uH0Dw+h`CGTJJDGa}!j!lIP1g&s_d
zi;|HIgqNu&tK$fs&M6ko0vodP{B1!VU)6wOOJw+t+@3B@>#L0;kZ_!0sJ>$ZlYjIv
zM*pxTF|N6@X0_kj8EC*l7i!+cQPnue-8cd|D`n=KYEnqchdf7;8m?;Ai3}3tE7-0N
zkZrhQgv{-)J8oyn1mjJ%;BZs(sP%?RaGrcXn>Glk?QF}Gdl-T@j(6_%ZOu`yN$+tP
z+EM%?EHk3oS?`S>sv6qlm|0)!kmg0shVw|Qn;%d>Kd+(11>Jg0{I&@M={PQAU(`{3
zBtE_kzG<)P+ZGs`$gW83XlZH|=!B+T^6tk(K6e3jNR=y;#Ef?iq+k&scJ+f2CcPfA
z)5uc;i5+qlgPCY?##5;b1dLf#p_O!EyuQ~Y)tZ*p;D-}0xb?a@<rarLiQXGCW}yvl
z_XMWXE>^0L`cde8=cG6R9#0rcaaS@@7SXkVTRGh2El*WbgKoiwJ2Lcf4|V>*OB|F+
zN9ejTw%rOcU!Ql9>A~dM5M6q88kxv^#VcYApov5GGsYSERdUF`83I*T;zrv5i{#$m
z$yxok4oe?s8MJj3D+pf@TlUKC31MYX;@ly{iiI59<_R=?kpa+~ecj2TS9%!lekn0K
z_>S~j22Bg@Y};eDls9pf8BUPP+~G53c;gqtS?##eJK!A&7D<=--d@E;vs|}%nMrHj
z66x>!?ewv0cJ&kYgUvMec0Mo9sw{?!=Xa<WTT5F`P<=CXxH7L!h9O^y49_uGe-FCC
z{JMmWU*Dz(6`m>9HnD|Yk4>}b76H+E1Yt6P@mbnfqE(^M3hlsS+YS(oCEp!?Wg;1F
zWq<dJy|ehh8mbU2wNhhHyI(Vbf}wZJr9v?uP3M(ta=IY~_c$hnB({r0R5n<Wx(I(_
zbDwT*`NwR)a&s?j{}szBqjZurCJ#x|Qu)S5Oe~I+BiScC9hjOJU6&1Yc!~dA>M;>F
zxeZ%mfjQ?7-|(Pk?LuU@uVM1ihAuqZJWW57a@z2moNaDy*thE$ThrG+H5}!-5s3TZ
z^39ui?<Z%f{toPm;R2ND1E3W}zep{{-_>JJxIMWSpb_gObE^<*0e2{ZXZx?T<9M!B
zRSdIIWWb1If{P{RB4$7w>L^y#4hP4#Bh^^3`oJ*XVx6btrdbwqos<uiK^W*n(7+9C
z?{2Sd6GJT7CI!!MCbMQt|7~8)OIsa`x;D3YJ?vq$N%3-<Cj|3)S6=NmS}jBHh-1QY
z&_{aPqah`0a^6+K>7Lj(zqUP26D)g<BgU1*Z(Y6`BxBi(A<`Ng@+JA}*ZZ8fl-83^
z@iBKSQ$7xPKO80<UZzNGvI%*Uh*xDR729)AIs8gM-A<Q*Lie$>^v`Lm5gQjOOq-F^
zipX*JwYPr=XR^c=F=wDRFqkgWun3VcIjTuK%u7CMZ6S@LS#;{-f#0whasQcDU#Jw(
zbKd9K%If#drl9Lbptvy6a|aVvT!$(O1*P1{El<PvRJn~nUcy)#bGy5?O0>pazpECx
z7Jr$uA|+xZ1QZw^KfqbC%0-G?#tGZtR6zxqO1=DwLF}_N&?#D|zx@rQ5pnUB#mMb9
z#rPIG&a`*-so~GgsrcGL^D*XLIi-pZ+I4XU3;MePt#PNJM@nD!&rFQz7^UKR(N3^%
z#y-Wa^>&PobuN|bUo&J`#;nAMg!|qzvK0_BiEA6z-q*`TKCcoVk8vUukq-z9Ec!UJ
zm>@#3#r3PV-aV_=p}|Wf{K1)ogQTn$MVtjZ+;fe$<j1rY5w%2Vrj6Q;xJT-MB7*0G
z;IK>`j_^!FhRX1$5RIY66_6ya64oD{;nh0rpr5z9dibS?xYY9=R~*B40}TO^;g)Ij
z_%t44leeNdZ;rmq70bT=Hi{NwsrV><F#iWxPW{@7b?D=N0okRAgE$sh*Jf!NW$AbM
zU|;XXH7_~M|9<NKwtS0dwSp32Phd2z7F3h_$(#>6-D$<sm{^qx9`!WfCBpzrtDj;&
zMV1i=bH@u%TPffT)-90JIBc;TGR?cAmlYpINL_reQ^zQd0B(6~jfwgIEQtONl2k48
zUTh3af%@rgfl+boV)Sy&FUx0qv;#<0?>$fBY5G##u)p{U@A(<&7g--q7f|oFAmnC=
zcKdZZx?Rqh=;L5Vr6KsRn|ANtlMY}~Ct(VD^!rx^D$v|JzvCsZAZEAlro4bDFa<A^
z_H#KlrX=qXyA3WHu7*qer2Ve6?}xMX+8m<h7W(Z@CG)~=58|NTx>yq$LG>Rpoi=Zb
zy2p3sKog3}+bNr&=}Ikm+y6%WGomv>+XXP}dQI1*+4O$$PNAdOAmFz?8{JonwJ@6)
zC`pX@9AG_u0Flijr?xQT25gVOIp3Dhu!Tpl9|WhXqdty~N{N`@5@CAD&dKiM8S?JM
zvc{8Q*w3NYnbSz?nh|CQbxb4}u}smlv-0kN|NoyazYYsDGNTzBTtX)~!X^eBigyXp
zskQj^r)Br$!LMlgK#kckawKO`LCfFR3IC!h)bXJkEsE}x7|J|^{h3`c=tnfDQTW^7
z_~F<8@<20DWE<WQNiDD9|Ib(+|IgyCk_tfqgg+n@B{N?HU^Qj{1x&NDN+m)Xjz>k>
zRSp;#&r}1JIup&>B8i3?0QAlbz+u0v*QCh$q}FK9E{&BFo&bZB*5kPVIuwZ{{%tv?
zOXdD4UFf%LDr)@6m*I|s?fe4d`m<s;(Mt(VSbBMlN(X%&%>+(RtSfun{a63~MPad~
z1*7X-gvDr@vCmeO<FFE&9OJLEjnaXGV`PF<I7&&`7a)1f0M?%%;Izl21%pK8^%`XR
zLnKT*bO|4wFdAhy0U+jdEoKokqyWQHu7(pE2~#t0bF;YE!)n4;Fow``@EOeQY$Jbt
zVUHER{U0XFUxcAxY4L}nl~yYOAzlCj9lnwsAjtt-Im|NM#tJ`WAF=X*_z2udO?V-6
z2Ye+QDD{g_gS^KFhq=ak7S>A&piL6%g?b!{&m6QVjX1M33-96!&j;=RgnuY7x#S}b
z&#a2wQbk-K=S;%RjV~mNzO^lxr3#+AX_HS2&Yc^dX^;zBKNkK8FGzuTBt_RF_LgeQ
zntCMfu=h#X)GiNxWk(#y{+)mWs5)*Kb+Jy1>?O5~;yd4On)L~e<BI*RHJ59sf+T9h
z00{d6N^Tov5}yVLC#_LzS>#gecLwJZj<_5`Chen-^$+LXVANSN!<&FaHVe=XUzYz`
zd9S7+3f5XmL0ICwx>44;{Soiug;z>Hrb$HScDF)3(d?z2b*<gDNXwbB>JX!Ph(Gnc
zf_E={#hj;FlnDMwwvtYjf8Rs>_H&h!g9BqOrBg_IE3jiB&+=T1`efz;P~#DR_fR;B
zSJKcky^el2^1b#YS)`hbC<Pb}qIzK#FChuFUD!Da|6YXt=k4ze=m*!Ls1&2K{m&i%
z{t?>(Fap3wA>`BC#`Ic4Nz}-XfJKjPloF#k0O1l`15=omZ`+Mj36UyNmj`B}&vozs
zWYo|yEH`lnAVnkCvVHm5rTPR$LQyOxJP3kE1yFd>&4vj;5(I*9l<mc-wu={DjO3Z~
z<+O(w0z!sa=WB)_-vK`5Wtgu33(BoKjk@}Y_wjF<Cbph$S7#d$V%zonw5=`Io0S8!
zJ>R~g<K$K9U8(vH8B+>7nto5?^DJpRTQ>tvsvPGFJq8X9_k?rWc1uvme3Y}p?j#Dn
z4+td*6=F@0DeK%Fz<FY;2bLJ+C4*f0FB5^;#AqzfcyfaG`W(Ni*jHfulIu<)6vopD
zKD-}(IA*{d3tTyV7hgn`uc9#N^}wR0{C6|@3p}Rr`H4t@Bq8RX^UWcD(RZvP!o{1w
z8-~6M>N-?(v6kam<|jxw{&LBQVvRmUn1<lBfEhuH0`8XqZclsNK^dHG>PLzJRF4&}
z!Fal2R{T;wTQ)onKcVr;+;cIGuJwBM>VXQvw!Unh!>>hhL!Hbr-7+Wo{b(fYCfBv_
z#m@e!V`l+>=&2>;h?Mwzf~-QsCHJN9mAJ?F6|cVs74PS}B?5TwuIn#kPnKW{W)+gi
zu&-9DH0}o9Omu6n9WdJo>K2hao}H_K3kbAd4%$8A=qVk>V2>dCZ9FNDNkDOri{F5g
zpy^EZ<mjUYsYz*BFCsZ~hO_^6d+9SKnUIx@ZG~`I&N&A^Q31p&g)qsBSGu*H1Cy;e
zmMbjkv(&-@;%8F?3r?-^7v?`bW>^Za4NAq`!rJe6iLOSgzi>_66!Z~3F5zxrD!nB4
zKe2e`d60Lj#Z#hV$#!W~v$xe=-OqNJn#l5<cT3q|kzb4Ph8o$KYL<P>MwPn%?HZ{=
zBhS;^Y$VaAbk5#AcZ^rZZf9@Hue!TW$k^E*85i#Vu-v99$bQjMwz}!p(zu~cH}ie7
zP5~?I)bckC-qVhVsDSPFh5O&f7xD=L;+=YJ-5QoMNT$oHY+4_a9H^Y&YMYpMiw|K)
zw8;7N()Rd#d%GcrGwqX;WyafjJg91gtEE2Wtnw++dXu2^i&k|eOa1xjpyNKtT)0m0
zreAO5-lEGv9C@GcXsDiytOR-f&EUyf$Nm(?o&k#Q@wmlp=gLOAwSI_7uGa;bg+E}!
zX1gkME}@U_DB?Cc+!<f6w^dI*pyjR}u@8W#wuxni`{Vq5!FA=p5S4JcY1Yh2wsnuJ
zL}*33fW5SyPtuvueD?=gLVLhu+aprx?%E5mL*d#vCO^tp$#79au^W))@yXITJHB9$
z#vI8^oUAC3I=KJ~t1v*U5uFvNn)5#ovq&`(;(rH1vl6psE`aA1Aux%4T83gbIi?zW
z+nm<Mq^8#Ufe#Ix*j3a|2uuNUUSxTNYYxi$q^DNqnY8haf+utdb!6+7p|9+hy1w9P
z#pTCXya4RP+-VfgW02O_13MdK4j~S>jze>$O;`HyH$!U4+f|htPCtFTih_CHl-+sn
z_cV1rLb`?8xs!o6VK?X!S)C6oPO1%A70W-!M#x*Wj2P4ZSWlE6K{0{M#lkj&g@bjK
z#^~m{rV%bWQ)kjHF?Ams2?;_PnAZc5o+uLXgw4my?#WqDOU7L#Up4CZ7;ko~_uZ)<
znEdfz85e4Z1LUp6r3jPugK^_(21$q1$reoIYxj%-N~g-5#?sKz0CI|}?J}>H=zSep
zEaYlm@OeG8%g)%XnD7Uzw3QlcnRsfxVzkrEiK@TVt7YVi)?0@R`tKeYTGgHSlwX?M
zHkpza<-K?;^;%`y=mJ*0vK>HsZ%k}qYo|H272OcqMrM|tP-dK(M<<O-CXmBp)pjAb
zG+d!#d6o=QA>g95v8NkHMgJ=EaJj?^E5eBTg8r9H@UHh`&DGQe^D_jWi#jz_@+Fih
zrTsO92`()W>Gbs|IbNF@U$J_rE@Q02!UL*ZB5uBX8lAJ*&IFS!k)`%!p8<-LbgRYH
zU)LqxCoso@!<#LNOy4_YvyCN~g2K;nwbaOI#m%lfH>3Et0w!#Ebtzi~Ni)R_E3Y$#
zwz{u<X|9~N0?S%_lS8NRv)Lr~0|pwc+K%RC@mdwGD9bb93CjaJ^7I>5<>S<5Tufbt
z^}Rn^8RQ2ujs^x^P(0YU&-96~^Anqz5s%6%w`?|J9T<n0MeTn2HX|3I(;FJJ+%L!3
z>>OsyYMSdm?o(jqSWQ>X;()r1bTpG{##Pvr9i$yR*dY1Hk%miJ!gCSNb3xcGfY`${
z4wdqUrMJerx2gZ*G&kr(v}y)hC8iqc=c<bD7EY9*nEVa}rbkZ6(JA;-kO9eayPw(%
z6G^tk^T&X}g9Dhp9tiqvu)BOPY4SHa*;&{Xp?U@P=?BhBwKDAif=VP1b&11g!eB7l
zS3Zr#xHI)|G*1v*=pP+DHSX@)lCl0F4!EI-(hS>gx|YEvj%}6UB+r~bsJ-aUzIOul
zsW9Ln$Kfvpe7SDwKZ$hMImJ)BRd`cRV7HA#Ve36ytc`$@?lt2QifYPc&CHM?Fz=BI
z0{g{h5uNker6`hIQT5cTg@J%8m!cJ!5KOtns1+2E^?kh2petj7^~6&w>ul3DvMn-r
z>?%KSse7_I*VKg7b-|HTO#*pb+x_s%W5Xf1jKLa8+3zMMZsg$|qUAlX41}SGX~2IJ
z=>7KcX&6|2E-bi1=Xan{yPRUcXcICgA4zqgRcf#2ke5h`9YizWCxvim_fO5VN^<<o
zb(tHEr+?3GesbqXka7M)6BpqbND=NAq_^Sei$WwN@AvYXZ#y3KUm{iIv+*fut1NgP
z^|GGMbqvr6s)=t`*&*IHRG!Yw-X5qIW4>^DTiEJkFhJe)exQ+t=&1gr^~87oUcsG}
zEm4>PSqAQW^HhvFt$pKrL4KbmW3!6J(Jl-&-qo6bY3NwlnzNR?<{~XqfZFxS$^x=9
zB4SG$##%>IlT7aW(NL^-h?`heOGP}32#-X8cs&#*iAOejZ1K}nB%o%J@fV>C8$y6*
z?3TW~`jvgNB0Ax~e!=aEE0ei+vjN110NpukA-MY0`Ivg5cwqgM-PgjFTi>p=jax=V
zA3l$(^}3ER<K+|x#h<bc|3q|aNM7W)X%o3~ASM+iQm}omDuVvOYuEII3EzUUAwDhg
z54`@hE2qs16I598IVH1SmXqDW3i?yn)$T>n!2@_|aYf{4>9xL-KL{pj8~d!#NVJLt
zSDorXuRMsSd^#?^=T^JgSo#8Cv-m40wUJ;td*46Jvf?%<Q6FtrsR<_^t|XoFC|kLo
zxPLdghB=%3`+$EO5orj}4CXy<e+B$*Wp_kwo0YyD3GGa5?EUl<xv)wb)5nmOM!+|)
zsPUNf`gm~x$jR(dD>3%%%9b}o>ZAbW{2o+K%C42>5?a|Ols|3~(C~7Ka<|65zOr6N
z99)!Ua!gwCe?+FO%FiY*@9j;+$*?df4L3h=4|$Gj6{<ZM#|NHq-~CEc^#I_xKW2Hq
za^=UP3V6ncmv9p6Jh}UB&*ggYxBJpZj4Y)f9yszDZ#~WOL$P~ZSV6X<O+=4*X@>bZ
zzc}mrmNUr>*#j!$!y!_`BVej{f{5=r%{@`_WKzt5CHkX^8J%ZOsmpr>D4-1(YDyoV
zpB$L9k`j8BYiyScLdy+$o)nDUZKXidA%d=Cdc+UR0ovu>zLTEA@?#Q{-+um%g>%&d
zZ%HT4^M?l)-X4b4JdgL3sLOUbcer%^xIgQ#i`#^=weRc;?I=FcW0<?(;j2p=^N@<;
z_{Qlq|7G`-Qyu@I6td^jP*X~Zh-d8dt>cR^ZAY=qb@dl%t)-`-+4r3Ljj|PL<c<Sa
z+7n%U*IF5d?9aBc*!^~v2P;M@B4U+R608~xDqe1+jK+I2wR;TtnN(xDj91Rd)uem)
zHVV90N>h}&hI;y9Vy?^?>9I0;{%*+b{=FS=WpL%l6#vyDfVXaLX96M~{i37z2|MkT
z{sWwt9@>+KXCIA+D~3(lf3lyd^xPwezg@HTz(GgY-gS7Iw~?vTK1%G=;OsrGu(9*C
zgC}#3??OY9#Bt<t?P>`5%9vICM#3w9Z=+1#jgOocepg#N!z$sBliAbW8jE8_^2?2M
z-a|-_8uuIPZ#E)J-3jKRrrYS4mD^{Je4$J6Qd|L0^R1ZrEx)daWvjD)F5bI@(lI$d
z<V%qj{89>4Lci5sP7LMsM*1>cHC<npZuS>s;PEjlq@esUhcavT+oGsC(Zq7@wh}=C
z3f^k+d)h|AUM*MUn(*33a*(m{bkb2>!lg}Ln<(BQo12%t^HM46n|T^DN%T?(9E_%9
zHI%}?wouPw+*7ymT;uZkg0SU;?rbLc*!z>^g^KfU>9kKZneBl>q4zmyIXDZ|@S6O*
z)s`7kvjCV=Kk1(P2J@N?w}CKhfqsKf<?KT~k)sZ!8ed9CvL2OLeHx~WO@zxVcV;R*
z<vS&Wo$nqw-*-4m`>)j+0x@GvN<LTD^b^Na{kAxV_<?$)%dzq9+RH)Ud<V(t><T<L
zp*CEo8A~vUU3zDBzM@RXzr@Q)D1APGNwbOR%U_VdrW8vTK=Bq|Gx+@r^QOtdx1mu!
z;`4h6Ip;w~dI`P<qh+hv!d(uUlq^vB*t05(D73X(GD$2tQWtJ24qHfnCf5CK-;DsQ
zA3RFv%<RyB6dfH?H7^G3^~6`?B4c`6NuJxDXVYo;!ga#D!Yfej6n|RnD2RW3(Hoh6
z_8Qo7gD}yKltjP%6n%(P$me<3Q=R}%OL-)&*`h%a-%C%;<PEYnIcPIqf4yU;VWyn;
zVc7%NIOOr7>z_z}cVYQI>&{NZ#EeokV4GSL0TL0pndBbo{?)%eJ*(P#fm{Ln>R5$(
zVf^-Tx|#<e4ewAa=k%}>8ZmZiqLxV1-c8kdqH#YSheBqEQ6)=k7XkRd3m#49Mm)g}
z!?}|P(8oRp)F4}U8RD<<eqbl<>~_#~Fj>H$bvCXAzeW1PX_)QiQ9%tfDkbt)(8tkv
zTMGGQ-zwXPm7g(3WM<O1PcTRVNj3Q_d(Q_{d<C?h65!-!BwNcxphC^?AKm>~O(4xS
zx?YujsNJu)*hBiUfeLTbnPY{ZNBym1;Z;?-LjG@msN)1Ohah+BwOsGhEm8MpHgR%n
zG3|z5mfw$Q6rLXYi}+d{*$L+e^yP8lonB4HSD1cVD(kbv#j+FrMV>>~^mWRvzNkvq
zPkvB@wd%v<uZ5F|k&oQZIKSK*NbU$P>uTlA&D->y#ae)hNy4WdCCkZvQ-U;_V^Dk(
z{wq{+SoQ>_Jdyqtnci#`NMmq@uv^3B|0Z`~=16(ELl+YvX^A_LKa{Iknl^;2iuYlk
z!t_4PkQ09wJuohL#Zu(72^*3h79)!*7kQ&&8Bc2Ob9C;8Ow-Xxo!G52cOWO{tzVe$
z{+dS=du7_OmF2tt(J^>3Z_=%JF22?~sJygtI*cy->lXPa5(xTAZdcp?g6HZ}ar5W<
za0a~i7Ik5kypr6La-VMbq0b;02w?tiz$6GiNctm0ZS(%vR4stBmyxw_KKE+rdpzM+
z$O5z@&Y8%W!U@02-ws7PQU(sFz?kc)XjU~nw2T*t`AXG?aW?+PM;qI`<beyktYkG&
zn@NC<#`8x(kR&@_R-JXk$I<w7b10mdO<l#%(A|N|xN4O#xh7IKUjxb-nKrP<ECXCC
zg*{Fhg*}fUI28-D%xI}C)h5s)Ny{GK{)%gujj#L?FO6>_GLkKxPF&_m0R}DMv6g$x
zXxH_z9$YTio(SWd50=)Kb}5u5sbWnvllP1XT4r9^7GxfK&3b9&H#ZxZsny4Ym!yFC
zGOX!n$f1Qn$DbJQ)|}Vl#v#|mPA1+I$&)Hi18r^ZE-RaF4_9U{<%Bo-xzXhdc+bT0
zDa^y~ww!R+7&6cqR(QgnFYO9EK^R_7(0?P^Kzgzd`*l>;Cnk7qDQf6;;yz<?FsZdp
ztKUBPY5^5;a_JbE3!90<UMgURt~=Y@&AmquAYnSPLi|n7E*F=WHKw+?e?V0ocaPcD
zztMj-$89d}IX|PwoxfjO1!#hx78$kgFrTEf_W`R?YKOazZiW~neZH;3wKBu8+=ll~
z)tcRLnqY5K$K=+qJnR+|-0(wY3g{(8vOVktOZM*hwhrLlOo2C1u%CDlH}pavd@nLx
z{FtLJj`5V<ftIUSqoq&7e?MjNB8pP2tAe@7yqC<p&E^!y)ga?^xtlJW1@>alOk*Wn
zs7PzHo+sznK%O9^(O)>GPuC3+w^+ODPra*kx}dU=S`$BWs2m{{6e&S?^q2J$AKJhK
zV70sT()2S{@|4kA=l|9MNTMs>_(WH|QT6pf<i=+QVe67T&SxjZ@(4$lpXdcnA%@k*
z)bh`sy@EfED8IIZ+hz=<NJj&dY2&8nZ!8V|)elYmQbJ=>bY1|W`~V9o;HUelWZj;o
zj{;isi2e>eZmr0M08`EwUmOctUD9K1TS4e=pM~?X5Q=iOWce;)^G=VqOtX;~Lq25O
zw1Q9ex)FAZ?Re}V1DOi(3_qhy;pH<G;pNMf?(1}=Zt5w?+W`7jql|0lP@~`D#6W=s
zarcs7$=>+(_wc<mmNdQn1ss{R{yCH1&g13e4*j#NI2h2A5D!<S%(*<DyQa;aaq6I{
zA}MJdwMUq?K{(xWpQ}XFTTzI*-)!V=Jb58%4R?AZd{qHp@Rd#>AIw|GKWM~{K$W8h
zHYc=C^=4DWsf4_Kj~lwEs*Jz|yOsWRc$;<t#!+XnaVh-CyFV05D~PPb#@;UE?r9{#
z0Y#NJiTj28rP+4-j}p0rfjH&^g?rh3aHo-8?=PK86Ljvm&)}mV=20U+4O`B(8nr`k
z)XkA2+kls<U(EZ_Sdy9@;iG0Y69RTB?}j}oljojaERdG75+>2h<*?9)EkDl^tspGy
zo3NV!QER;o3O(hFJyHXEn+=-+)m%IU2BmhMiw3-OkdLuqB(u<!Xy}Bm(zGGKg!X;Q
z#*1_6tJ}xPPqf@-RYnXRvRc-3vXu5-3w?XEL@+ITsAz0N6EO0f++_HMBT+22dZXH9
zQ;PiSE~}I{SWgF~+wA(m6Xed}8)g6hUD8l<2Z&cuqpcBZ+9HiZYlF(nTzdOd5Uy`n
zKp<9Y3`sihiU{I)6jx@W`erkFFM7vPitQINoC?Ut^%GnqDO>@V6)w{9_T$@TNz8b8
zm;<%D552x=^7+=)d$p-#eM=QnLfq}b@+x|M{U*5r*w4y!Exu_oUwPnlPU`jjz5vFZ
z$4dItO&qO1Y?|T<R8JTIbt#Svn4gQ{>_Q;Vg3yFnenjOL8RUPaV1rsVu<S3+G2EVb
zU*dD&fN3!kH(*{uM>xZvYzXqpZ8C;zvwVXMDN=LfJmIU~XB^%J8!oixF5`O@zp*G9
z$7}n&pU`dKnNh3stBd5thzjMo1-V!|LCy0?x3S+6{=X8@?qzjckqf<Wwc+A_q^u8O
zldy$X$LGuQMER5MULORI_yegY@k@#1#$-KoNBTG+y|ml&3~!N0U!ORJ&-BE@dlMT{
zZ5N3huiEfx*z#F6v>(KhoEMvQ85Ad()kymF7AplboYtHTu)Amg(ee7F#Ob#C4toWq
zjN~G>E8on#k%KAWK&%qghJ|^z(yb77Z|kc#D1?jxlpsLR?Qa*TRdQ^{`W*A6ytiL>
zY?JyrU&W+>36CgR(#N$s`KomP0ZJ!D*|00aZC`zuZf-x4O3Yhp@s*>{m`%lZrC=Z-
z@M)2hL99`0cAkVQrgq`9xMo)0$u^DR8JCj;1ZuMdbbW-GB&8N3nI6JL?uXEjL_=Q8
zfQ!jRY?4Cn(pM{@8;=pzlGs{buB3p?-7wI6F<R6v1+Km~wk;?meLZh$hHNxtmgPwH
zVm@tK1PtM#?*xoksw_Lo#^%QHJcs#1@Y`Ux?M~MYu0NTLm-hwUH#)uCUTU-RVFmyk
zxcE@hAygR$!pJFnM7h0WNfuD*f8cWJZBg>sy-*$@JXBFJ1Lt4un8OY)ZKBg~b`Fi(
zsxhA#M5I|I@V4EoF<?3Fkiw&R-mkMK&%WnaY*eKpPL*|#VpVu?y51qxF`ZRVIh|1A
z{b}!sWr^6_@6F>UhB8+Rspe2`#`i15i3a)D9?cErirhlm*(^}~;GdHli@cOn23be2
zBRSeAw67Htx{GLwQJzW8W0~0seApGO79maXL$!KylFhx#Yc&B6Nt8_mcVOMH_ZO7E
zn`Xu|bD05BaTZ2<&AO=O!)yK{>)A!U>*gr(HM5f4ez)P9T0PIXRAmG<uubs(>1M7d
zU!tl`93;oHNLq5*k@TVsW(PCv!84eD*N7Km(B|1VR_;(;>xUEU5N~8+_u<DrXyi7p
zFJFoX>eUW_Zr{H(^@94Nr2)J?ognklvamU1i#4rW=tY?nA2{A(F^Mg1Dagf=xI}LO
zeWs`yWr`@0f-LWKkVV;-6JrFTINB#bX>1WscH$F5vHqeEw9MWGh#pyavq;(%q-iVb
z0zt5w?rMb4z(se4%{0f{5ylt};>}1EavoD@IKO$D?19Hxern2Av8NYr-Z?lh%geS*
zEHK0oNS@GBPNAf%kbRoGI}-tIw&SJ>xxId82e(ncxY!Yar!7DojMP(}b|uTFcZ=6c
z$Zii&X@_|IR(@Y5P5&?fT!ZFlp<kC%blqbg3;<~hUYhRkI0oohOV;aYI>v4CGeP?=
zk#w~L6nxC}KpZ6qmU(u#L5BBayaGt~D(2ciULh@29y0to2GU(o_Wl40i8G?YuPRWa
z(r~;!%03uBf|&+$`*PRozNSOg@c|ozV#@~8NFhx%J?#AWcFe&xmGRZd%6Cqg&MWux
z;RSb`WMx4r2wfWQ`15#QCdwbnzcS_~w-il$A&gUl>DIxt3#kiD?e}NJ1BQ5(nUNja
zH4=yR!r$%SuaBM`*;R$H;mqMt+{^N^QY7cIbFH_>Hm{v<bUGcjTi|#l|CY#Z{s871
z92l2HYi>`TeOb!gGIw>FUe!cM`mRb{_b2qrS?}I%{S3xo?#yQEmY&r%LW**aB_0qh
zuobed9oNNzs0vs&#Ef;#W|d^OZ~KH}8DB{{h7dy3i~{Bj&G5fjV0Tp>2WKl7pYv||
zUY#$jm^Fo`7i95ph#fOGD~4D*EXOo6<*H^<ZB^&luu-{~lU4^_d9q?Q$fj8bXPK>i
zWfjV;ljST<G^5-PX*La|N~taGUUuhS?6Ef{N#iw#7QS;xnO#`rY@f(*7UP{T`?|F=
zXBVH?&P6uSr{hjSZd1&&&CHv?Jsqc2s&BAnVbO6->~e7U(z(a*XFHya#*8wI6Q);?
zbzl6rF^()7KhA#sjnn{fwaF!fieHYmZn?{$&wo&%d7hwBjbB68vs!XtW+42Q-RZ&B
zDF2wo)USb+v3?=mb7AtZte?1#OL?xDhjb72x38&ZFMX}k;0b-oW2`9|F0sG{IYpL0
zLSWGi;ncA_<;Z^X3-{kvUqW>IaOqTDHQYx)D$t^SY-$M50<^&f)Y_-%UeD~<N(l4B
zV5)vi2|UdGnE4l5DX-TVpxF2tZEpR9Hf=!D&bC9>3!kF3ojmAeNM!SB35hs>%Z*DO
zZ%spz<m_e>fudssIH5{RBz}ri^-VkJ_(kj71s6iEQD<mFqp*A@x{JwioP}D6b(o-$
zO^Lpq{+~yizD*k}S;u<Ke-9!uFOgZ%=83H66Phl%Mf+ORFcqpW98B_(Q0%oh(9ZL+
z!=m+=wPLa%V}W*t*aZKuon}ZUjAR)Rh#sGTX>01D5-a0TNE96IB>E@SLPhA80)mG1
z<nL7jOj|-ZS=H=W0ly^8Ku)ZxmbD(h((3J!2pSiYzhjb83^2ZMxjd#hR|pQZQd$h3
zb8lm&4jB2k;P$Nm21_Kw4(p3G6>%M*Xh8-2vstcboVEhLANFu%n^e90aoBCR?AwcX
zbI~#@4ziqX8$N3mlK&AK%U(bhG4C@05Nr!yzpib2_|uknEx~wJJ2ZHoC>A^?%@D}A
z_^8*7aS#8H5OP9g3iB7kB)vL5dd=gzL@xf_RE|kgO+XX<5&Z-5Cz40u>aE{p%p)yg
zXG?09?k@baw-PjOF2#y0Ij9;VRGubZ*w08*>*U){<DDz7F@Mek6;~a3d1qy2-{Sj8
zInL6AhWtg5^<z2BJ=D7W)$w=|Y5%h3;&_@*eng#DM%evJdTV=6b$#?VZ233H=F|Xe
zxL^lqi#6=+M<M4*^@#!Oj)Se|p+T;d$QKLl-}o*fvK9946Z<IlN;(N!eo23kb~1S7
zq)gL(%IoeAuogdH2ME>de~dsBiSH{uVgboYr+7!;C2N*vFV$lY+dj4!UAPXtWI@`C
z=&{Gog*ldA$Vvir{1s!lOtny0BK-@?v>?1iUBN*3$Da<7jMzBCUmz+EqYEzVnCT9G
zHqrRRxJAj|IZS8!De+F-T70PFgyUgcfe|xJq}0?pNZjkPrfv%B0^Jre#?xw$MJJ1@
zUf_xQX;9qxwQKE?J0gtY<GZq3GEdnJr|?u^&DA!U=5<jy?($O-8<2M_)>|q({sTP8
z`3YlcoI&@4$kQeTv}(OYmBT5B4i<D;bLmPtp~?%|9N38>1sl(0aPO&-h)Y(~tJ|Gs
z^~0n0FgO|^y(<EEbdjavAOrCTUG<Zmsu;HY2l=J*Y=y9(xmfHGszQOoyvY*?v5AEL
z2s0JApB=f=2<d5OvOMqJNj=nR1ERsq#NBxP#SsyAvz0PNjkH9<l<RnGkp$i4(}I{!
zoKR3W8&c7>y^i$uM$kVlEoK;uPOa$05|CeEE~SB>Ki&{|f|%_hQQ3iIOs=UVgpIZp
z#AiAhnZe%#u!01fMly6O&4V6q8iWZ<?;UuwnwMUa9~nE;eX@B&6O#3hyQ`}_MqNg`
zs#OujvK}^^G>Aazf(Jkhcy|?HGm-bI@*<PX2`uMD>ko#NKLlJ~?XHGQ@7mbEyTgqU
zD(&R+IPOJ+U;gtx<7A^?vi>>yqp~6z7UTpSrHvJ0*GqV%ggYk_)}f})Gj(bs;D7qh
z(_}5SBC-HE7U#^0u`VB&i>G7c_S_So>&?k=EnRSNsZ?ussqA4u7`*DY@UjMw@AbuK
z&u{OGOCX4@4(E9k$Ge!`hrI`GJqhk<AY>6fX+QNMtZ<K?lkOj5HuDZZq`7`x*R%|i
zw#UfwJDS`<Nxx0!mDz^+G2-eu)U6e`Q4E*Rd@}?PJ4L3lt_Rzp>R55uR-2~bseLzG
z4RC5KW?o^wHaRg>tk;N!HIioJs|%avuH|y(R;!up{v(AQ>w{6(>o$+170ti@pW_hf
z#`B-EQMKHAWh1QF>ZcD-8pBhRL2K1Mjm61NFF?7U$;|hBNiAB;>G($_wxR;#pH#7(
zJuv|7a0lZt;@S5PbdO9k02t6Rqoug*e_xKq@DzfcSbGZ8z+?xqBsTDw6aMj{fBdjd
z2!y_U<rDih`0oSm-)A^fq3<vNLCr8zE&9J#;P178O8^mKoB#JK=obqJ?d~xDrv?80
z0_>n_h4&q+L%GTl-UrwhN`I@#-`WiIAK=PZ;WXm3{z&BCAi)3Yfl%pN03h^mevsh5
zmDZISV^O0pOTx!JgZcs6Kic9SKZwvM*tBK;zw*%k10|Hkl9N`*7q$Lz-{2qr_4gl6
zxkCSU>HgiWLHN;ukuZFH-tLtD*6iLF0OgiXE8&fO`@dBMI|x5KPyi~b8+Kpp?;l40
z+Yd*ua%eq#8w`h16Z`#R+W!p``QDs<(EMO^C?C}<u?PVMGVLrL=cUf?A8BsdK8lTg
z^iOozzyFh*4Ewu!EM(TxEciBSWHyqqFFs2?RrH~t-9(w<l&kCDTd6-6{k;(SYe<9l
z;peSFs#<pnWSeXRJ|2)%UdMc1!1%{PuF_(oFiRgiwr6K@%bq`(WQnA*nR-@eBtiQ3
z+Wxz{2D^w>f4_rdUVXY-ZRZd0foik3Z~gvDVJOkT;eV}K$U(HBJq~XFS<qJEAFI^=
zzEqHKwO=2SSi2y))9+pRb3p34Xgaq}Uh3I{KaSX!j5n-?Y8>WNYD%ukMr;u%h=@@`
z{4>cvmScuCNQpH)&)~)2nmr=2b}eN~JM0g23xbAA*RVo`ACBfKB&g{v12mjP)q|10
z_4vPwOOHYM=)D061dm~~Sv;n8&GcT*=D&OHKhJ=YTi?W}6LeyVg9%w{L~H)JtF0-~
zXWrG?fZ!luq5yOX&6VYEH@*MNWm9UVLHj6}Nx<dkU8v}`+dM!9JE?0p|FL*eXhBd_
zgsXOI8=Qm)vNdS%Cht#^A;>9Kx`qXsQ`aYq`7OOGs@8_}U9|F_iYeXk7*%0+!-of(
zla=OUDrzN<5lc6it^U~HMmJEOU)3(;8Vr7p@#ja#|0>}x@3&xkERk3?`r}vquw88z
z<tZVDg2bo9e;SQofyV+W>=NE^g1usu=ai6QjHk{2gXR8*a5}(kqGQx?I`MlStP+n0
zd5p0)%OPBYXY)D!I47)G&}UL=hur3i?L_WyVf=9n!bQMxI7Pi!tt1UF>mgrW-1}1j
z2NMZbtK0At^1Y8XCll9mKGXwAa%?WIKa4-1TmOLQe;!tOi7e0(GO*D9W2+oXqxvHA
zYjnQTNV=`M*B__UQ#w$*_141HQ(~u)h0l*E{@8wlu3)zlpc!@|0jOT5kV?%zF8+gA
z*scbPzd%Z!^APMM66Frhrx>C7x3bayu{-~J3as8mJ<h7n`upzlH<?OAkjdKB!at6`
zl2Fu)bN%v6=T-N^m_I)fff}NJ$>>j3T74|m0LP7~&syz&?Bt(usE1vjef}-P_+NHr
zX)y*ckElT8@gwQSmw$W<c2FG=p_3Nm8BI@a{1dmLv!~EMkAPc$jS`K*YHPJ<tv_`Y
zSOHl7^^Bzu(+`&aGLpc1-u-Lod*&he@DQlDhXQOhTRpf{E&w6=+bCd-pE)?7;{z#w
zJzeV$VJ$+_b|fd9f9|eyqSdiB)dX4zQTrJ;g+&yon*fE~N&nRKr5+F~S*V@bh!Wen
z_SrrDI5}yEf}qNX&URG=yZA{j@551@R+Oau2?wL~ECPswpfM`^BTY;HuX?@bXBaGw
zq5^HET@3r3<J4MyKVIT;r<I_1U5ENZaJ?QNgz4W?_qc5*^d3Yyj%sufszQ^@y#PEr
zlfUZrb{~bB0^;AeKz>cv6S$MNqT)gRfYBI{pQ8V{WJfOxrF-XyjDyI3ygZ(hI`};!
z)&tABC;gst{fo5F-Mo9)JXnSx0=0k=c}KY&0O@OA;icEI`b6f~K;PN^1nd;8#L65*
zV?YJc*)T!kNcUv!`icw{A}a%6syEpi%0MF?z|HXo#P?Owpml34_+p!b<$U9+F0FNE
zKpr0t*g|QY>}Ow7(|XPa0ox4jP#O;e@4?1+DJ&=F1=vfG3jkB#fKu=`7ZV2d@U7rm
z_kfDM6gD+zZ_2->FW&smg?e|aMa*GKpi^!8@Mxla4Z73^rdMmj@hlaDapLAX>zt^?
z&?wen&@3<|<9Gn3QW05xLv)VPCA9;@0M+7%e%eWZn7ju{U$}!pT>(-7yB!J!Lp}#k
z{m*Ny6U6rvCxA27i<1P&v->K7qtC*S>uP9)Aprd>NNfczBMO#7(>aZNB*U#jGV^he
zS!}{i08F<KxdQP+5d?s7Ezij{N{@+yE2r7Gkp~_MgC-K)1Z371Kw}c16qlJXyYbJ4
zKM>B}KLG3mIusS)#-w%va5xh|DSKo8MIQhUo2V0>+T1`Jqta60l|uy@nQUAJWw7L0
z4!hX0-^?^)I@&3hz8-dHx^!nAnc~ZQi2!oZFNC+?BP~EWkYej8N}}HB(hDfDvox%s
zvQHxa+95=Wb7?X~NN?GU=&Qn9i3aO~4!5~F3h0~M0Z#Q3O;UUCT)mCtMp0!;P7Ig+
z0s?qC5HZPzqTryxHsCs5+-c==8Hnu(FzifDA=P~VFh>XRx4RMZM1c|doeII0W*R*B
zQ9V0H?p38Dd;o>*Ha%Vk3Bm*~3z7j~<UEzrSTQ_QSuJzJUg(SpC#AT0>R}NG3k?xo
z0>R6f&lqwD_?<@Q`6EhhfSMRAc^7bXYTlRtr~{7kL0Bn0@45SAzDL2HYwNKz{=9)i
z;rfW*6Mjhg#W2`8g^gzh?>|NU7`($?L<pj{jlV2d*;v`2X{AH(1r{7`3@_gMU@3U-
zk2-E>NvY5bSm}({nrSYKeG)$fhy?cfpOxhbBcU}?Mn?2^-GR*k>J0knT{o3&<U5dn
z=B9<rPoTBw0-b6mS|$6i_{Rvx3^Y~Jczi!F`Dt>dCU*P)(PIJ3IRaD~g2~AR;Q7OV
zSr6RtN|e~?CfW~Jnc$c%6T*GkKCI{GW*~KPP|;W5zS9ae4I?5y0Am3&l+o$Znja$x
zW-nj{+PA47pJlN?<Z1P|=g@tp)}A`4%QbbU&Bmo9<vg_EjP=sUALIBi`)a+~y>50U
z5lp9$lo5du6|DswDg6lP*(vNthbGr&IvM;!in*8HVr>`OtH`rKtA0xS;hlWA24=O#
zK$0X_;XmC(EoW(X1XQiAG@dl}FEf11%&R+SeSW@$0(p)|Za^g1>5#fAFA)&U{Rq;K
zj8g_^be)v56?vmASa_6owT;|HJ(bBm|00k$c#5(rF?Rw;=7b~3hi_|yZ4%DRTCu9B
zD+4FKH$JjWSct0aD(zxPHRPMR+rsvF%zAh*HBo%AVDj)D$!L?1!aR_Dz@viJnyIXS
z33eM`-3&&C?>dc8-xtFHv4!D>Df-waQ)XZe$8_Kk06L4}yf280@8)Y1{~ylYGAzoj
z3maBIKte!Ty1QHHZX~5sK_mwxC8Zms8$m!qS{RV-MkIxilrHIpZ_g9=``kCa?~l(P
z9&<3)>{!>@tM*#wDtEHM@Nf9?u1qB~foA_Dvl9&O>(gz}@}WP5pBp4=cP)jJ>cs;!
z{8S9CQPxX>!wP3hOCVLC5JF32I?jGt1}>c&L5yd8t$x6PS1WmJM59#{NtVAVaEZQw
zSn8=+=R5;&;F}_#cY_oqaD#%dpZjw}>tcM7#W(Cwq3hCX7UZt_CW$VC7(yC%20AMA
z2UpqP2-vBc=$(yLt<d;kGBNyU1}}bUH#H$VG;M{F3A|%L*C5?*zdJ=qrk{e+CwD(+
z9f0^-+)FQg+7zu7EWC(pH;>NIz&VsuazLNuwO<ZWX#?R+8`5zF7}6ajg%e{`9(O@P
zNw&hdT;+i-{zL(PqtY&E=a3CY(XY&q(N7YKAdZMXtsS*o;V4PsZ}IecqF5g>I6DPY
zr_kW^q+$79fCdu_brdM(>MPP}+}A)e2tUeRB0T_QMJcbt=Y*a`r9Q6Z^1it`*~5IC
z_8Z78!2!Xg$QL&-Nq-&eX(>?Qp}GcakRQSK1#oP?Zr8kM_WHnv%^}y}UMyv3yRY6o
z*vGJ(EgTO-pl@_4$*{<Y;gop<8#6|N4lVaFO0B3wFqzAkI)J4A6{q$9H0Dv#y6bxL
z^02~m85KYHP6!6^!(rDlP@cHQPrAiMm-h&Au;0%S0x!h!lp$fW`DO`;WPaSe@V&O!
z@d3HEi(@O+nWPG_T>?-TU%lSoJ1lzPfD#mkP77<IPb)8}oItIQ98LCK_mppXLiZGd
zJ`Sl-DzGcs;TJmn-JhuyK0LT0pyX|#MAFlJi|Lxk5AKLQo($~5TxFj)7A8Rp3z~$7
zN`^hT4$E0TaV0CyJq9$mgq-2xAG6iMxUci=M`#rlbM3m@zeig;d{m*B*QFI`GduJw
z$Z#z>@A~@A^RQaiYqXhI?!MZad?T|@X)2Om2x*RveWTk)W{DBgpLYl29EmLi;s)Pb
zG~Yz%Sz}H_VGG1AOoi!!JUql>^~%7e5X-xJ-)lE;qThbtLk=5qJ10frtm)MOT`maJ
z$DY`m*#x?_K=99r<jlbpb8C4kGD*jbkG{0<@m*=L<R%bVdw1CVjrA&Z{}S{EU_r6j
z+-t+lAq5vu_G74>$7D;7ALU>p+A5N8sVW;rzC#s2004-KP^XU;!NiuK)6@ef1Db~x
zeLlb5$xYZDM4S@K9Uy(4to}^4Lbnm^N$K4svckQh(8ayM%?2cjZ3)i`$Cfx3yK@}Y
zkv!RVd*XJRA1CeC6z&g$xx$azU}63X#*LnNaRZksvy&kDCXb!XBq#bU{_A2mOW!q+
zFW;u<fylhtPuFy<=9sE#qep9NNCmhMeN$2m@P0QX9JYl1DxR!S@3hWBECm+ou9$7E
zKMXp5keVPGd>p|!hG`QDQmjj<6R3433`#vGW!KN%WAMj87p8E%W7SrC0X+P@Y0(a4
zjZePpy{51g9r0-<Z$Y7a+N*!1bNoPkzJ0gS+x2sS2&H``@|Pivfl`1QJ%2G0Qd5df
zZ`ZtE|9SLL(q5IR=|W(+f+D+W)qbmV-(pbMgu|ZsUV=+;e6tD-IYELCx(2r~0T=w<
z-;lBLgBltw8afvte<Eu>4uO?n$aWe&fw}GT%D^Cdr-P1QeCoHLYr;E@KEGIGB=m^k
zkB+lGAYmS|cdu3Q2R6ZR!@F0XW1D}SZ9mVHPYV)?uucMq9{WORkTOE7ZU%w8iqOt$
z6cQ}Lo+s5RQ&6g=lwcxp%4eWG!A(aH2jqzYE}7;HrB8#sqq(LeOf{3fzgzY$0v0AQ
zA-@DUIVKwaGCONqgyC014#?6v-kB|uR7_TFM1#slOy_iVw#YeEjqf*8YYcfKHB!1g
zbde(USL_>)-nU;620qePux=|K@uX$zk+%OB5GnosDtV5zYef1WH%VCP(fSQcd@-$-
z>x1t_R<+ysqY@G-`>Dh4stP1I%y!jjqAOkRsWQAUuGuEpnkA5c(eUcUj8U&>pu<*0
zIhUeh;}Suds=%efRr&0mkJ=OeU-_&GbvyN&i-NuRWD>=(T;J)0nyQc7B~lM@L&dv3
zRdaT6T5*+*y(!lE;t>TUd&VC(pU8J2o+%#eXO-zb(|3U4AJJI%5sDlqrgY5Fquv8O
z3_=(%Aaz@*f3ZKLR9>wNvfTFgrTM3<Tk}(JPoQ)&)cW6Iw+A2R_cZtizxqO`Wc!;c
z3wvvtZiWfz&VkrAv4VNK!vw|UI1RQ)hn$fR&enpv8Pd8+)(?;=xrD#E)5Wm#c!9{m
zgX(?5y-L)?sQBV{U(~sWy&MQ2?R>k{Mp-7%o|eg{*qZ~s@XNKw9#_CQ&Q3sm{cJI~
zm1r?IMwO{XkJ+VDY*f}%PDu4yzL>@QWkd_N&vAbJQ(~2jFQg%C=KYYVnP2<PH1>VN
zae~un>ucTeVQ42H$NVelF=&Ux-Utfu=x8Dpe@zl}j0_Si(ea#<wEsveeQy`5SmPgI
zFT2$-CtTHOC}jWUjb>$#>7hm1=zAP8y3CY?`R|}Zn1Sl(?8~I~Sd*Ff_@ByBh0i0P
z4__!=C?$TL-91j^>avSS`OZ|3uHgv^S<N#edzgRF)71Z1tb2~W<&?RVI^g8Pm|KwG
zWuKO}@9ef3=QQeIYoWbhpQ^A|XE&jg@1j|G&$5?)gKiX?nfNZ=&n*=*42x;C7hc=j
z&abO#TbHfI8Vjr){FP+SrNus)1$QXPI>sA=E1UOr(o4>Z0_J(7UHtfabtevA*=wFV
zgel2RBy3?i{KzU$A1<&<?1wyJ0!ge5uOGF3TjJiXNaipwwOR>t-4&b){?MlOt_Jb=
z_*kGz2pHOlwoBL*wYAw5DhH8=TbS-L`Z62uDq7_Wh$yy)P*bNUqBz5^22pd@EFH#K
zzQ3xz8SP$2fj0?@jJedD6IMD7m@ri#p*5Z<*ZDQh+rH>L>cu1`z~<*9s$5)n3ENDs
zQ8siX{qS60k`4AV%lDDBW@QxEt80&9B<3Mkmk7;{VhtqPKGK&wc-XUxZ4^7yOofGW
zLQMBNVH6T`N{#Gmn&w{jb+KPrVqK0ir`=rrJvZ-TP{uyn6<I)Q$T@mQjut&~GPehP
zNZTWIIfzr9y7D~C&0+0zqHBJZHu*cQW1Lq-@fd+AdM2`YwzemtG5!+^+x{zLGoBme
zQQDP^$Ew2u$8V|Xx#qYCI4LxIU7weC2+NQY8CWy)RuVHAcOjmDOi!lhV%H<*Fu_JI
z*-))Ong><GI+cU2VQ1m45;r+)`>>u=B90|bZh(ttVwv*7JY5#{ysP(g`6x4eGm4ez
z1ikCU3f|}?%a4ep_ZEsIc|#k$SvVzJWarXOJ~SnbubEc;>mHL)*bwc%d~O$HfWu0{
z_N>t+_jTr(o%G9r+Qx6iJ#L9}uZD?8BB9ZHM0KPy#LltS7zxU8^r8hKBiF^9A6AW=
zu?jrxE<Cs6Kg!^8lZB<xcZ}MrzaAgr0_8&85_1gO4a2+-Jg(z*@{PXHG2p*ZBIBwS
zkYFRAv2G~3Dy?aG0a+sASA->-H4yPfa8_CH((Nn3*4_0O4`8$PFD8;2siJnS&W~6s
zh!vB11!i3ba@qz7D{UpIJiaf4Ut8{(JKVL%+)7rCaR1?cE}J@7QV>V`@^{>kaGjZp
zn<&T#;@9aK==Pc->2dNRADW$(6)0E94|x*tCQ~Z3?&cSR?xOu8J~o)1eA;85*9G>%
zhVP+fad+!h>}AAeQb89mGj;9{FK7JYb46de#e)6<gFf1?yVbro%8R6SNeHp?Gp$!|
z$?LpUi_?+0XtuUY7|pfI8)XUS+vAml&Cgw=SeI1yp!`BVt>jW%<=U)u$etpSD$l!0
zPBe{-fv~M73fN1OlzS`>^J+7<J&eH(z*bgRbO#Pe*m}yuiwI8asL1AcEN<Zxil*95
z_q(lIFYZOWPK{l-x;TmPctsCEq{_&|O2(pUW@@%3uI^EK?C`}$>a~VIN2g)Np^cmz
z0F?Zl^m^$66hdpHf;dAC#VAp!quV0#erNBO=kBBOQ47ht?}rNwIMS>Ww4n=FZQoaU
z<Qtw(<;+Dq6o^$fwWtlLN#0CRqtu6#$)e^R*mPg@*$wc@Gxx2yrzUDd;v%pT&sL)?
z9Xy|54SzA>wEQ{h{n^p3=uUMo6oP>BzH8}74VAPz_)C)5q}7bWS`g%<1^P2I#8p+0
zJfTuJKIXxc>0IH*V)BHd)yKQfWqyb!ToUV(G*MToo(C+M)L@5hbRO3fJ!L8?jIUk!
zgvSi48HwP3`c$B{(?(`i@F6d_toW3fuGM?(dpv|R+w^MZX7f6gF%=I}5fKwFPa*z&
z9R~3tl>)a|3P?S86koxOtI{FW`z=&aF?632ErE)TmQMQp!pY3dk#WoyVEp{Fnm(DG
z6IsnX@od}?x!7u)oVID6oW9sP`Z2fbCPP)Q`g;BcEm>{2;HNdlIF2MES3Rd(b7Jxz
zTaVMay8Q>Lp`2SY{ANy3SdSqOlfRSWE_zbat9aRD4YXF-n2ysiqcP>JySRAc*(19q
zv<0T<%I*2rjEr4??rRvzIEvKK65~PiX&V;bqx+Tk7G(X?u)G5=p-f|%uFht%JR537
z^@=h!#nz&~kGPS~L?=r%?1*bz=B#JjDtpBskJp~5SOc#?X><~|9pTxRn(fdh)R0tp
zD8J=NpO-R>ckKkq>1ekyc6`1|m=0yL*+|$WJ9JaNa0Xo-AKD-%MW;L7?ZgatgF5-r
zHL0jx`{^8LkVR*;e%|{9r!(Z2Y8bkn2#!?nQk<ho{|?*LjzQfHG<q>wPtC9vmIj@4
zvU84#J7vpjUaCypeK+0!wd4B2xf9coUzA@5HE}eF*1=@TMBl4O^_hX#JfiPXsh#5+
zqI0IB*CvJOsBy5#NpSB)=17Ih@!Eyl)#>o}u6JETkNu?>qNH-<7EAP)w0V;2w6P^G
zeGY%eR~@D(H&m+8@qj8{PXuBzfAVe#Cx&*lznKGevpx!yAIGhDl_R4YPSt+IKPsJN
zv&0-ULs@aOmIXzY!zs>XhNYP*8$5WliCo(XoKYx7zOuit$pOaO3r#%UxCmPBD2q5p
zr6>;KQIYCLEER11HLK&hKNz)Zjvew#HH4*bnqxa0&hyjk^`A(}+gm|Jm%;}f{1p%$
zCW|1%Z7}CK^1ShWsiXADQ*hJePEgwVYa+kjj-7~tSTF4~YEfV*r~+qH0q59bSdf5Z
zY?U_IFGE5UST-(H;hxmgoTx9b6)@g<=EVG(??4jiaL9<K81uj$s+t%(s5#4|Xu6M}
zAGP$otmN`rw@(!n?5Qe1UyN1tLPI`2?LJWwGKq7H^S-dgB5&H;D`PNca}-7pl+(Pa
zu49H_+t!fN#<`;)S(Pv>5<lI|=bdcB>>gkZHk;B>emUcYI^91{-Wr)*6Y#NSy9XW1
z+?etk<sIpWB)r|=Wn(6j?k%2yBQeD`%oB<o3RF^zK<8%KOk8tTL<RGoyhga%{1_O-
zV=dfGy=oGs#WQc%PQE(exJACXKZ$uVl`sAKWk;-iMIN>b(Vfw*kqy@II3iMv+1!ig
z4;_n^S8Sg1?-J@oN+acB@#fWG+t*)_KbI(BU*Q`swkB)V?g(0}xA>;U`q=WUFrSrH
z)-BJP>&L!N=!p;k@yQ(P&Wi=)4^;JpD?j^(?VCB^_?O`kvgy^A4?heX?gqIvERp%2
z%2nateE#ex#Y&7sTq-8IPSY{E!5{0dCQ?IIAno-LR#1uE#e=|O^S;tAI=hb+6=stA
z#fVsdu^D60bM<lGqJcqTd*-vE=a)&lg(}0c9$DvBVhi~cJVaCvzPsi2>omGID~TgG
zD`(GK*+*kN+3i&8BoSLFTE=vnwc&k!kD#b?kW<q?z?QxZGr)^HlR&=+xy!;-NxaQ$
z)DTr*%)j=NaQsTkTbN%Cx(r%TUz#Dg_(tJmyTZ}7uZYR08+lJ9zIgN9r<&Ii6FBkl
zKAm?`{SUJXX98SYt~dz<NC_n(C}HCQzfg@DB$ibyUgKLgpd3F6eNh}BF^t}SmlgN?
zzQ72t$hIa&?aci9tHfZ((O@%!g?yE{h3#E{z?6X?MU6*I^x*w;4b2O=q^Rd?I{4E>
z%G8g(mF<)K@D!Ogyve17If{Dt4S1}~H=_z7eX~O|*SBhMV||dK9?~&iAnK<^Qh&MW
zGAD^DiTCM--IeK;KBx0^0)Gz0$ZncOTr4-?NrdhF5xfS0Nt^UQ5=;8<(u#GN&U=K0
zoP*SXNz|bpj@{<Ltq{${+7wYgclE|u=VnqJC>1Jas~?I2(x_ZRn)NFdn4_T&Rz;}f
zQ(7~sz%^;#h1u@@x9RTwcal7dnx2aDw!Vrdlt)5etwn2%vkD@O6%$J`264v1s7h^~
zoCgFZLW6<JoT~{jlbb&ncQtRe7+{AMT^OmT9s`2GYqszGkP_Mb!|?4F5g%L^TBH#a
zIkuA&3bXW4MrrzrlXaP+INwN6=pq;Pf7)s%!6lEB9~W?HA9E-TB-!x0CmXr?{yN!}
z*CZSjO?Pn2s(<as@%`NOQ+7$iW`Um=pFE`GHu&x+KB>O!Cb2g3cPHuDLsrrDx2$2c
z-><0PeJfP@0At9>yo>8phr;#8gbiilXG!cI$@EYY^ZCJ+>MY0h>fuoABk9?#_Zo9G
zyn$(617<`u`1aF>WQMbq{o><Cbdz6atY%yXmbqpC$m$`}POb-Kr)x=p`O_WQ+6c3<
z8+Ba!WG*y;JLh7POw@<SB(|~V?30}APp=;GRCb(VS=Sa_ST=jv?z+sGyNXB)KP)A`
z^1&h=Gf$C{6gLlMDdDZilnk^$&LvvouWK}e1las4Z&R7^NzA%e?)hnGD2e%E*LR5;
zMma{=@!Oy~o6x^3vuF}hrq_#YyM}lvYq1`5^r-N&W8CK>#;UAw(yR2jh?IOF5=ozQ
zkt*6xUglHLF3(|>MB<P``e`9CZET-29hV|2a{I<n1yBVW=KWA6A8@$VJ>!yk$gTn9
zF&i9kph3WyM9`6MK<c&5XGIYy^J*~upYsVLG&6JwD5YrMeHhyU!+8o#c~ax7zb}bz
zADr>Pi@t48GUI_T@^57<*lTg}nu9wZ3_^a{K`^?K$;S?~zB@C)v^HC_gF^IYr8Q8H
zr9xGNDObie7m#>fn7hRWN2PtYxf37rbA_k*^OAom%BIAqA)3JW<CaJiV{@hs@wdH?
zsgX-Q?|j#UF4%Dfh;+OaWKoxEGByFHv2ovZriM2t?G@QMmn{pddi#kk)RC<blu=T+
zqfOLo>n_J85i57;z5X8G3hBzCwcG*~_3L-Vc1I6|dXB_iwP7OKn#=9=)^QX0N~9kr
zwvs~xkQF*=dJ(V|`4D=u3+KEeDo-&@9c4%`QY$0yIe4+}Y)-^@c<z}Q<xL;+_+(Wu
zwxVHD<uXMDI0k$rMi8p#Dz7xx-?k5Pr|MAZLy#EtiBI}zRNU-g7esQ-{`TJRePIsP
zC|=Ele0{l6DQP^zOl*jJfbhvjvYRUoF*oX0re|SCstG8Gbh^l+Ct)N(X&l4gwG`^}
z4%7Eb3>8mSsUKYy^<M?1Z8WL$moMkxA#gPZ(BGFgU4NLYyMX+x(8pml$zBt~tvZMq
z)?tlYaPRAuj3s@W3g0KgGK<J1e&rBi=|eQ99*;fO1PO|O7yu>J<fS>T0yPsue$cSc
zmX#*3c_jT?6~<X)IbN-qPDi`l=a)x*2WJF1%VpMhvVZ%?@vVoD!_bBU#iq-v^I3;G
zWARq8E=USpGDRD>Cc`1Ud^so%f?)?z8}u+Owoku5ciVo=bb5pPj6T9acpkUl?OomI
zu&09|X($0)8jUbx0s(CSEOOXB$@QxrD*a20u<94dOUgK~_q8=b$dW5<S0v~>8spw&
zc5_tNY<5Hi5Y<HXGr@7S=_rBv!+U`tHQVxYdDp0JLZ<ddg1Wh!-&SBA5rey1%B43x
zZ7K#6V?y0{ADT5)Rj(FPemOt)>u!wXkJJn;Fs-kPG|qyF)j3ePFHDEKD2PBfI#R;|
z>6B|S*WKp&c3d&2arTiF#saQ;Oy6CwQLBo40fOSVYAd>pk~nE9fAxzxq5Y|Mj!5~$
zlKw(U?jxk8AtEyrW8KK#Z(#9@W0OofXo;byC}*?Zb)dba94Fw`5fQ<My=;A|>I-{B
zpx5`gjr-`LuxNSh2wuT`j5Z$hMAPvOo;wruy3uC$0{8~9!{$2-`(Y$!BC@uTRqV*-
z67Qe{73?xzxlLoAd-qHJWms+g_%u^DtOb=I4d9rhxhg9ZJ1`8J3i_fk+W6Vvry<AP
z`-cpi6>TaFXK{&rF<Lj4L_RTqImD?iaIqxwfIcVnd*u}@5zVK1p(S%?_V=<o+L3dQ
z<<_Yi4`u&K`_Dj<eVQK1>fZqa*}17ivE`X4?|?}6dneF}f$h%NU-ez<z;e$&g@dSN
zCEf_v9d+J6`})o>A|aNsur8Oo9h&PvJMvrgqu@ygaL&cH7*<sq$RD!fbi6Apxbzze
zFeXqdveR)%pq5p3RcN~kZ1vz<NWxMhXD$ZbYSZr^UK->!Of22xch7JqA8_HzH^@By
zouyeO@#ut{+>uLS4pc0>mrpuaR@?bp&Erjlh18`EweFAg_j-UaLyO&Q?SfeGL|%I#
zAF$7Zr|EqHbswo>ORK*t)-io&Ky*U31b}67Xysv_rfSFzW~@t}S%wuC2(RV*#ChOB
zBNDgSoaH#0$aiGV0{bP1ZD;^<fF=gJC=H&l846VR6*DY8=UTJ!3lCClDm(h>u-qih
zX}1w5|4a?Fv|6pH>>CHRJ=7k8E`eQ0k33wy*fhp#nh|j!!{?*Nm#9=q*vvQZvP)=j
z<L$Ui^Vp`_XNpN5bK}v9gI$(pBhb;<Yzf0_-0MfGe+~VV;4ssXw6BC|D|a9fs}Nws
zA`WCY@|p%`@A7_c<68@J2scUC98(}p2g5mDsnU4-J)sHhAQIN3<h;-%smpOqA8X#1
zzCC9UEJ<COChSR)Ri(zFVRRu~{?^|6;>K6oL(A1KejGQPi;ygPYKvJh!yL<6*fQpP
zVfol4oA=$sPY){-i&yu)BGGaZ`EPhzmy@DD=g>-nsP0Kr=zj7Y`IT@gg?KeijFB2+
zF?PUSy}NgpgDcV@Fyf?PRYV3)q|Z6pTzoHIpfT*uPwOl}Z}&RP2as&-{g^~zvYACc
z9=iy{%0-^6Gi4kLgOA$~&Zp9~#oQ)d?i)RXD4x~^ya()yQm!~ZUw=Pl6vW%x)|C*k
zZayU_q%pyZ@8e#|F1H|YiNcDP@#0jykly<cie<PgI`Ser)Es5PMFu1PSw~2elL6_}
zM`7m?!o_UX1TqTb2uAvZ?nuOPYSHR^yL5-@dZyaWRs(&kfDIwXXmwMCnH*CM>Eh~m
z6d$m~(10>-6THU0{Y69v9F#<B121RY4*#chQO7Y=b|3A^!*r;Y`J)Nvj`QvIP;x?d
z<jH2H$gi$OUC*(WznSO`n|LkhNefg|i*yw*PIkB2>vx}Z>gDwv37Mn~pWZP_B$i3k
zW2(}Rslmv-P}*=#x8beh_{6Z>B`7NMT8hbhAhU8-op<w-TUwKph%-gl1aTqezQ;GY
zoY>@OLaXd`L7g<$Uypt@oJN?d<H)pD4!kte{B`kQ(xVhH%dYH3@Fhn~_mLr6+;U2J
zbj~a0C;Fh?kOYOs+B@T!DE~<bqf^pRI0wn&{naZ^?=FGwFDSwS+V(~JuHu^p8WFpW
z>H&ARGKT+Ra=_aRXCzH@S<1v=;|~`!WrzC8L9$_qyEG?FCyfznO{p90E`!{pPHCF1
zR}CwRKCN6ioN>`4R(F|m<aNoDF7PL{OEs&j8EeNkb*^Ur&Gg<mo}`IO+4UtR)zoC4
zd=6QB3IsW(Y4isZ&!BG7O6k>6#}U*Hbx}()R19_ztzl0lRy~i-y?d9PnqwB#<$OxZ
z1fQx6qaE4RZJCK#h|j%OdCkI>^G5fvC7x#lV{F3Ae2arNyBHdewE<p!1QAx*r&+Ai
zjHpG6X>vCIeqkYp=Hb)#AB5RY`p>To1?rmjh>fHQwxu%pS!XhzHCyGL3;h;Bc2!-)
z>CEXm7g#PVi<k&2#K`1O1?e7@q&^{wk(M$|i5tVwM@}1aOXxM!UA~GZ>F4~wo#x82
zdtx{fUFFIZS6{H+vNY&si|c?y;MC_pd7fd>F#p80cjXrui;W4vhONezQDq1JFx(ar
zn}-g2zoV>*o(+T@fEGqq=81zOQ|X?KDIG@vQ0`>^xXN*4d%BOO^I5DG8xD<*m~DM`
zPVPUP5K(^7m(~Ew@(Adg8L!tK1TD~$SwHFy+afpgF4$SBHZ(2`VmX+3phu4rI0!MN
z)mk4$Fmfl1zKtuJBbhLCO;gjweiAC+4AuCZ82y+NpVe|wSNf^d<%;u$C8XW8B)@1>
zSd%<a5GgRvsNz-2V!r+7z)n<qG9)&-cUYsA<}|;KBXW%9*$nyi_%YF$Hqg{&2M!4E
zc0Rfvs3eO0AkA3Uu2`gO;Y>96m0PwaEBI9-Dz_7Jbvn^3dPIV_K|Np1d|ll4<8CWj
zw2MsvzjuhmH{X3*mTF=h^#-!R#Gq=12_~<Vv3#;#sjOa}e26^^D>NzoC)HBGoBCa?
z&x6y(H&?9of=M+cGx{*cflJq{W#dtSszw9qnn@fv(s!kVhW#&jh@9-=pkj_$pY)$%
zI?XNWTeyA@j8*iG*-YAu-OPN0eBwD9-p<BQLQpZC?X3XIs&n`j^3uZm)YQ6{d)di%
z(3*XRFn-Vh)8Dj$nbr)y!#n;0B!z`XK3<>>h*1BJBsXKTKfUU2cB!^II{9L(wuAm7
z2Th5_Fi+6R=Lyu|*BgGj)-ORp1f$QMX&OY3^vxSfD-)ihgw4J7VfpmTGG+#wK&UR$
zx;ydabi0*~>0kkqyZe{>rRy&%)bLgPp4N2_RZ4r@#1h&G%?Bq0iy80uL-+R9`j7lB
ztSw@Ee@urNLD{Q1pASi9R2VObc5}Tf$R7({Rvs#zt5R=_=J^8sAY4jgIks5)F7V4k
z+j7CS`nZm(cg<!RHTA}81bgkA5R?03_mzt}quNv&86v0LeDEMupU`=DKGS1)pUy4{
zh%tp_dxuhCpzfPygm56=S5^;ScM&=AY<XdVglgF}|3QcW85!xtvIIKrbiHG{55}Vh
zqNnq}O8rS>RE2pD#3cquku#1u5D_4Z?v8ZZ0BMm*AID{@>&_9t{7{zAASR7-cc*bx
zt!7tTH5mN1E74f*koF>w>y%s9(o{;)lxhb%9UHs2FbRx}B)Kf??nujposIDpgC};y
ztcD#{PGN{`<jy$kp%+swX+X)zM~BSZan*w;gdF>0Rcu!c<H1mnPYa?zScrb$Ggv)m
z(6F^(5Xr_|Fx7U<#lr>dCyxKc0tg^0Wq2511X~Lgk({YeGlH5mn_WEckPj72KE!2-
z<d*NqY3=k+rb4w<u}*d!IKx>M#G0Z+UJWFA`>F59M9r@BMj|k+ro@UGhOI?ZOQlgw
zX>*m<wu>`K_10>K0hP@#3CcDuvn8=>Fj7xDKM`zTd`-4I8;;Jx!#7^`Vkm%Vus6Vl
zAnXms$$bQ}IgsGTM6pSnO;!JF)OL=;=?AoX|EqYGY%&8^Pk|VZeAl)mUJwa%If?kp
zu-<$B;wio~R1I_j)WfZ_bdvlyFW|RXmuX22drIJqCGZ3Z1A#WKa()0E|6Hb#BR@m`
zIsmiz3`(}r;fK^3xCF6#U(|*<cb4&C`~D|ovBBmisQS>IeT;7ouB?593>#8uBda*E
z`^w(qSMJEIBI(!itWEZXm>}TC*HfkbB@+bLe(i_e3+(BP5P#^MOehF-7Wir6)MTG^
z=;6bWGUZ>X0-Va%2)Hb;jx^f*tkJN@-c;KUob=;%+Jk0@_*hP{`R=#@zYI_>C@p`B
zzjgO>?3`&xp(ii$psAH0EjiGEB;yUHk79{BsC#^!+4X$x*p<dNTe%lpaNbqxX-J-m
z{m?yjiEWROb{2WxaVUTatKANl8VyT9cz_3L^RUh{fy}7<JLLl(ZS_0@@)CFVO_ht^
zoUrXyky=bUp{=wb`)=~_qjv7+<qE!mWCRH9#%^}!4+8GYT8>Vpny0_En8_!ro2`67
zeD&&^sL<BY+~=Y3Bc2yVY{hfji1a1;M9MVo1H8)@Jd;0cO{8GCIEdvrL?3U=)C0;@
zeV1Q!XIr!H68`>>MKz6aVZih9N)95nb8_iw8pJtsl{0fjeU3vIrB_<{MXA=?sy;J`
z3zak7KvOx(c-aD{iw6^8y+#;txNW>V*jdBR8Uj4`xt$YRUcyzm6qv!O(Z^;C&zoHx
z!gIvoPrymcPHE{t6M)<~Y(8!oG?ew(rbQLtMOehNY(I-Kn+aZ6;5nB@QRV_~#1Dy<
z(mw^e#V+<v+mYUHOO1RFI?B8E<;4*m#)=Cd;IhH8e;&T+pTmTCm1W^AAP+%R79xgi
z5$qna-w)-F`$awu+Sbv+e~~TbPwE^##RC;|ahBLLdH?2LWBhCUR#fE@N8AEBOWBZC
z#;AGYI9k~A%MNR^@K#b*j<Vh3upev{B5;5&`>#-AFfsVix1>82{Gmr}@!K5{;ltQW
zJ92#To^z5giGP0$Cak6fzD`uB2HTqf)aUI8C^#tSq+T{vbPp2w2AWzJ%rRTt{@UL|
z$~zDjdWyFwAg8I9CtQzj^l^&Ge@61}rGgLC8pco%_a^@@ip<m9<=Nrnq2Os>CeHgC
zSz5A@z`X<=pZSGKPVrbMpa1wf_%8oLw10mb5P}EBUMHj;G%er#$9HhLBvbw8d$VCK
zU}yjR$KU~HRnwdxl6*vp$&@_!C^qegf06UAiB>XNq|pU5H8l@r@7S?q1NSBU?DkMg
zQl{oXBo?qpHHI($+1_6xfOoGz$2ro5S*o%0$|bjR@S|~MX6--Mqx{f6jKIFD?gKvf
z@2KSVdQCaujPeq~qssu{_&4wTjUp={@P!@(c)3P{(C(IFHQud<S{QLbSi`dSJsp#1
z#i)Ob(@C}czu(3GF1D8*EOrozOrPKX3c~Y)u+$1Ty?-Z6oCJKk1&CRZ4|env;cWc3
zrF5mhmoj3+yvEEo^mDQv#G(K31OY#Mx9Qri%-rmURsZ=dE$0pry*`w9wTq`~P_Q=B
zCFyU&!^w{!3x9WP_Q;#GJ9PhC9*}{T*dVZ$no6<HBV0rvz=QPC^&eXR&k$k5sj;`%
zc@NNHGkzXTz{1f*Pv-W6827=^T6#Utvn6DCdnxj!L-!eB144^+LVg4S&h6tGe;w|>
zmYpjNCzxR#0h>Orq8*o(5uSZ;+w#yqr~){p0)F5Cr*IK3S+aipoRIj}5dVEv8TsFg
z67~fUXrgN8zkmPh4f(gCGQu#rtbZMAK#A+<D<p3}p~sNz$g?S*r0S0*pcGOi_lL8^
z06#m4ta=*CDk_5v7sO-+3zo8{1FW}bO@t0tHy?XCEJmaU6SSb#D~tNKNhnDTm@2AD
zkqz_;srzfGe+@=J4xf&I!`P5jzxt)EfmTFXh23Ko_P-wZ?~x-)h6~-L9p<CS=4-wV
zK@miO>L<53ke1UJiBk}sf!|g9y-I7Q5Q3%Z1=6{Ld_j^_RbadMf5-bD#wFrIfJ1ge
zXMXPRzZ%zPJ|cdzKws|}1oHKr3tRRnZ;|oteO7M-0F7?03z8lZul?obLp8z5?n!;N
zm(6C-yLX!kq}a*NZAcuW8#`5YaD6Xk=Gx$i<(K1Xw;uIF>Pl~^>}Mz0@j3Y#bEY>?
za;^Y1d;A-csmDz7ZJ$2wx906rGmAw3^E-X*?Ar=xFN5>|$y@w`bz9Ap@T^-)_a9;K
zQ@>wfi)}~Gm#@;8Kp-8NcCK({bZbm-)L4-a6riozufRX5^qAFKViZ0&0mfZ6dje%m
zPwHD!fdP0C^kJ;k1V>(fpt>$6QZ-bMQ)NBuHdoM=e?w*cwBACfzvM3Zhk=#({qG5o
zojw;RxGkc<`Ie;4E*_J7r7|pYdt3hZWGL?oC?&Gqj{s-#DZ@(dAEu}DhcL{SXe`aX
zo%pXJ`yYn%zo#Vrtnl7Ub!PHEg*g~&NmV=|4dNiNc}sYLmA$3QcC0c@o4}2`b-d+G
zVfU5Uj2ocIsi|m}DSx0CAh&FYAD6vs0b5DfA7*~IMhVoEe>=w?C?;?E8kP20p-cop
zlxozUe;q4MZR%+L<n5nECQ?VJSB!euuFLiZhNaDRw4nH(^Yni{(kPm41*LsCzS;@R
z`J(@aWepJcr-?Of+v4--EGx6=Rel7Ue^jjajHTF7GjE~t)>2H(;PLtVQ0w$Gtp&?;
zgW*4@7-Sl_&Yd2F>i-1daH936(k(9F973Ykf$BB5Ln>a5<W$%_3HpCZoq9z~m>f*~
z)-aU*9@PJ~ZdMDsJ#_y-8f1DPZ#j!brq!Pnj=aLMq4^&+`uE4=e@W5Euf=1AuaW!X
zZ?lCsLaw;!E0|H9?A;uf|3ljUA*Qng;AmwO(IFnC!Fxo19^*g-aOIi(-Izacr5{o~
zb~1OD3L$stZLI@1`al_s4^>nF`oLLRxZ&1I`Ij}D092s%Blg=GALuq5>g>)zRK8&C
z+v)}kuMLERmNoRYf`RjUs2@<#Pc3xu|3F;Yr*!kL=l>s*7LWZuCRKpyRX$hHt$wNQ
z(%An$)cl{12g)sac`J2y|GeilSs(@MpTlnkZi|qW6hMyy*d6l!SloXXp08=ZL5+&s
zylpQ486k|DtPePoi;oZglt<x~1qBxjkq_<ylT+0|7xxcS(|(f>U&u!cG5M1SX<5UT
zFVz5|?@`7hy+8h%(qFn|zQYyiPa|{YAiYj_G!k6#r?V_CzR)H5_kI3{F0%1{ZG)lw
zk>lV}`}U$VfiPyu&(Ei&`V%2(In9BdAg(~Jc>F(a=C6;Gxbkf(>Ua{xX^|a&Ql_+=
zkC5{JYhLiavS7PCKYT1jAl?!f4gYw&a%BKLa>vOhWN!<AyZ7UPyP}B4ewzaT-;coc
z(916&U;fDVbU<_d-+vh!2pkkQOCU9f{vb8LLaU(_Sbv-qht4!I4abhC_z&i>AJTir
zfa0;Sv3TA;69ODK0s)#aBAq{|&b#-u?!ScmQ7!{6C87f7IP(AJQ3dDt|1s$rv-Y2q
z!M`W{>l}}uYWElYi6VFJ3l_(F|M?&>-UWiS+N>n;4~+Tn+v5K}hK?ZQU<VA1;G2I#
z^Au0!oEtUC?D(pg21@%U4)?_6>{3C@f>#C!??7Ud3?_6fq8vfP9VF4T@1P2f9OUIS
zRIh^?8LTH;<x->erGGFU#1W)$pF*w0b@1({8g`p5f;Clz^2~;@@$4T}Ks9bNuD>2-
z?7zJdbQ!jE>Wwx`E7uVj!l0j^vTa&{8Kx|?i1r5wU>WAu8b%_{e_tTYwo(DQQB>Rp
zYW2Rolls32oMahrviMqTAKFiCgXW=_a^xP*<)VGs20<qrY}F^*)sCI`&jM}A8u?4U
zOz1CAVR^{A|J*btoB%~5(Unsi-Tgu<$rf!`zNhW+Cw(ks%3QAGpu{xfS@Ze0S%S9C
zeStYIXF*VliU@J>0d{pTDAwa`ILza)t43R-grifRf`U|1_NLQCM_}ZCysG_SnfANr
zStB!SiTq^k6N<@B!@-av0Luz0^WL^ufY%V8)K4}dERM4n?}e9xLL;{=lg}q8qQCte
zTkjDD!qEjgk?Y~f5w1U7CgUA|2e96g)a<pwlXV~70>u2Vw)u(;Ubkvi)_APw3-Ys8
z3kxz+hwgFN{dkdt3CFN<ABix=a|M&0m#$xwug>X)vfNe$N@?QhIK5glzn3|DQ<(C;
z&*hRIeKOzvGO5}RFZYFjl0~<zs}2Uy3Yb7RBiRhR--0=)S7fVQ<vufnbmB*pc`dU5
zFe|PC*a`8lJ93qG!kqIgs4%TNojqxKW($glMr$f=6c{qb)agw?YHq$cK*-Cg5qlxa
zl^?n&CzlEOnw07Sd_$6xRU!w^(X_|MWfM=(^rFr(e+M$)!Ck5+`&R%{l=T?kMR#2l
zlGvskm89m}(G*^0QnMbA`uPAfkJ{L=_Lw@z((z-tEpiT|DF;R&a_8mR3oF)YZ}f54
zBo#m0S$Ga26)&#7-WPz^O7;uGYvlZ)dm}ME)$SXbS^8+)Cw0T#;mw!J953{=?;<Uj
zgGwys+0!lof>3g}E2l?}AoKbMbLQbk27LHyjd(e(VgL1{ao0$?IH6Lx<2}4=)h?zY
zGMwmTU8s&!X8`$OHn&<exc@5%5k35{Tmwo#n*~8BaD+g^0;Wv5Ua{d#Cx=gkux#Tj
z!00!cz6s*+GOPHm$dcf(@pc#l*Np6?C?g0Y6!40|l}GkJ2|qv|_84;R6CO)*_SkXG
zN^^e>*&NNfew|V<c$So6bX(I5@c2K)r&_6Fr*S^5ca-Xc_h-`J6a+0U`s-bB?H_>F
z0Zun-PFg#|lCQ~_YmGposO6fXJ8w-jRCa-@*e{HV7pgE`Jt9kzFys3>fFeH4_^j_)
z;wGqvUUL#bM`h95>RC3+ct5!fyi2l+EXTI{%QZ=jTQ8PtUNz#V7kQ(x&<4`?b)2t(
zqE)rC9q3ZD#+V)eQVa+A7P~JzID1|Ev{m8B#&zWCfH8LZ($GMMsUHB;z5l2^(>G=0
z4}LEy_P53S4>+lTX+*{Oc#m`p?7l3*QN{ays6ZtedVG(hNZ)K#<n{O^D5z@R{iS4b
zu3?-Z>U)qj7w-W||Er?yyoBcc5c{^dnw0BAx<(Z?;d><n(tx7xh_&OC??oojS9-e(
zKv^yQ6Ut9oY;WP6=kVarx#wR&$!~w9=XhF14Jc6D7t}r}A1GixEEn5R2OWW&`U12y
zRCTYOLskIu4i@(hGl-q_%0!ZAQJP<En%pREhKSr$auVKVS{iX+7Un#Bsy05~F`~_U
zZ~8@+TjQn?Ro7F6uX0Hl;(jon*09``I0THFMZ#uOxTmlAZI03NV@o66VJnso=jE#J
zwH5QhQJJrIXd<7r5Sjp0xTJN8uX-pdh@E-Il&UQN6k(sbsG!=0Wi}>v?*6fe^DFSU
zihpD-_QRZHoJ>%jTvey6&Z%&A`b(EI4sU5Qew9?F2>aeU?4MsGUk{?evjzGuJw7~Z
z{1I}e2Z@bd#;u|pbTG<$aouS{DgA-fYl&n|-U~Hd*}Lg{yeyazFE4wbcGlBo`et3t
z*HaJ_PmFS7<d(-Le!a4JbN#c=x$%~YG_}S}ZmXy264jgT&Nx`|J_)A?q%gS{{k@rH
zk5)T(z3O<V9)jsLVBdy`ARjrW5l#<EMt$7pE@qz%A$4M?!PS{Z`Wid_?Aef8@EWpK
zX)y=oOKF>w>iVQR-({g^D+0~LIZEnRu~BmXK{>TEJZem!o+xPT;Y7vm&mGrV+Ih|;
z{3@B{vEtdSgF-cLX5n3rVWqFlXM+w8LdcGr?e;)roN!077!|VDkc`U3bN*sbFMVR|
z9oeW^DL2+DIZ>^AV?1(v`8B}}7Dj<Sd9&YTpJsH+qGv<x`2A>P&2-suPVitqfPaS8
z_Tt-T{rF19Dpu%v3yv*2^z{Aj0<oX7Bd@v}mVZa@Ha5M+weLCjx$7ek#-kf#+WB@I
zMbk2_sBI8H0Ho&^SbAe1rRQ(>bkLCF@B^@kmKuO;8>-U#@I`50n&5@j6wt$?kYsa`
z;uQNZ>pqL$^U;IKFQS9`g;vvXn~pv^(4iB#hDwA>z4lNXO+9GLa>TV*`gmYv63EW#
zn0!pq|AD9@Wn6*L^DvhpBd}s^0-yZ1AIe9j0gw)~L~(QaJfr<ud6z6ev}%fP@bGf;
z9t&(N?DQXDpq4FMU6*m~wk5Y2?Yj)QQ3xHV?zV%f_(Q@cN}c{8r0)O<=cPjDi<^U=
zi-`ulVs?t_K5{nU5Y54Zjc3jEkzXDPCH9Z6w-nzE<!C(o{_1#9isJlf3InjUXFNN@
z&sN25^j4_sl|<n6!pp~N%nAH*&pvQ-azZ@dTG_M4zZqBS^d5)1ghwPPZU_Q6%G&^v
zz%gYPG`_RcR>u^-Ozsw@|6F`+;5^8uNp4x$$5bDmunbpz9xi7Junc(TuPZYJ{<KvS
z@{U{bDOnpKa*pULPp}nhR`*flo(fk}k0g$LQ4VI5NZgnjl*)A1d-u(phIG%OiZ+x=
zo_#Y3Kt@<g_~&*iq`0vMkr3Ge5ZC33qAIf&qDUmb#)vqWe4A2`2r3p1Pr}r^atwzh
zUAhWiifGvvqX|%)^~eFK#c7~r*}A2{HK8_bobiEKpTgzW*?5_cb_pnnE}R95(1PMZ
z*Mpt3DmB@RnSw!oGd?X?<c2#J{V%8IKc*}v2NKaJ%j_k^`8}@UF}J3Zt4j4|r(S{U
z-7S6gBV2pN<C3Z&W|=^G5Y4=bpRss4zgSdU%AAv?tzJ7J1OSrz^mXpVo|kCYvDz~x
z>!mwgmDfu&NDxVso5>afgoZqT+m9cP&JLvn4F|-|6zY5<E#jofEaSo@0wRc#>tMl0
zN~+_Y-GYLhz=qH=y?ThqNI241IB+mvCCX#PWX`$hB(gZLUXW#cxu4X`Dthr_IA8CB
zQwC0xpy+*MxFOUR0>!h~{<y^XWCD)kk?7V#6%yY~e0<p-dCR40X}~eH&FUoSx{OOF
z2<#j*i1tu>^({qz`d2h(sAGE*q^nSaRs7{AeV7-J-yDem0VaA|FH)Sbw_lqpm)UP1
z(NRjIc=YA!l8%@KY5F4EO#7Pu8dN+dvg>RmeKv8*beS{~2ov+TdDZwe!#Pr0^YXM?
zY)J3B*1EPjLsEtqj_v+_jL%^%Hw87Ox#q0SO~-aP(_pdn)Ir&bi{3wt?3EDlng+80
zv0kS80;h3NHhmNPr>%oJkF=m+qi+Zyo?9BypU?!xmI0>&T>suh1Rd%(yNzx*0V|1{
z{6AlhR!(c*{g~u<FpnYz9f%`LHHZDO^Xl^JzgGb%YD06O(HR7IEb2e`*t)YjI)TnM
zF_nnhq_Bc0LhLKQY7S|AcEe~e+^Xm%AJ9tN-y^n~W?sb5@HpAW^<M@SrH5RGdHL!h
zP<?FhhL-zKU_$Aqgai@s)`gBH5psn>>eMjsGFabMx~R$ppS}QlTs^sUIR)b2LMwx`
z20xW?mVygwyZF2>$A$wbjJ#FcyEL=#$ZLM`(|9}@Nu`7LoumrqrP7}nupvv?NJ~jK
z7fx=8RJqc4t%e3itkDG_`!-;GQ{<fTvMG(0XmDXWnbtd4j)X5xR11&ekF8sYUFe0D
z8dB*WXbBt{T6(%hR{+F}5YW5i>uQt7Qu%7u!5Py(9W14+mgTuK<I~F@Ca4C&jtAwt
z&RJg$SvV2oNH5k~<~+CFjE>ErG_UxTuROX63dJ#PnlJiB3uA@G9R~hW^P3jpLXS>r
zgL3CCT3hfILP$?j^L#GV1x+8?=TvACJu6NNz!G_Xr+*<sj{H%M!4M;72J|r_OxZB*
zP1`@tZX%lh8XexO<CMBWmEifO_QXCexot`d2Z-~xwAu7z@`J>7xv1@qF}Vdx^VDhF
zgulm4%0WiSIn;NH&7QvTZqhmasACIY=Iw=CimR8?4+C&R<V5%1VZNzT{3lD&atiw^
zP@LF6c)YT>LT>4EaRjBXmJW1*0cM%VWJnYi&pIYFz7!Yh4^c}(ggDV13P3`J#=EP_
zMSI!**dU00<Vl-;@4l*6WXp?QG5aSi;l6vOUz^HdoVh2PQC{$_@XBqISl-kgT(Ds;
z(09SF^imDJJ8PYP6qqM9`*J(h+9Hpgd<bbS)u0){{2cg)t*L-OO*PbdgYZx8vndj|
zI%9-IiVIYu-P+0B`@A^G?*G0p+_Q^>jE;#IGW?U#K;X{nA$W>jhCXwcAbFtz5XLHW
zc<a_^{_p5H*Oz<(aARJdR6E`N8r;I}!7l>gF}fLJ&UH+|8ceIs+wLJEe80Yx(6Aki
zF6jD*o;~n5f5UB{%PlK0bhsrq1@EnDnPx`-cO|M}G{tFucnisQ?*@@*rE#e`|L}t&
z*#jgN#5Pdk{V?ancV0zctN&~#nLF+J9W2m5RZ`xDHd+%i9qxO%M6m$E63Wy+L63Cq
zSL0Q;Z)yCkkye~wV%w%P&^96gqeu7rmnvesZBHj^n-Y%Q7jd(Q;Qn*@dVX3kz_*!P
z04n_fJXv@8_<d3XfL*@aGg5q%F-~!{Cf5!Ch$yhr1;yfSy;svQz#%Uoqf>HNkJqvt
zfw&6>un_DGz-7VWc=Mw_f4kfDm?pzxCB+N?m891UGk$&wCC-~DXa6VVIZ^$?2>*NW
ziP`pw_9P_&xnUugr0r_g_vRP53&1aecZ<&7gN-!6efQtn4!%#eYG&*g0M^ngn1hxM
zGb~b3Nf+y%aTB8W7Q@I36p>^3EyB)_3RM(xC+XHX+x*-Z(Nw6IOr(J(47AA+iSSu{
zGM94P2(BS@I+6vKo49sV_SWRY>Q8|N(Cx_X>h!(r_QeC>PO5uwod9Ft@Y=R9VaYrn
zD<A+4nSBN5;7d3{S1fq=O)3J&0|$>J>nwN(1Ttk7f<F>e4265ZaI~gQ5P8w^0!|eB
z_1Unm>()*BsxZU&3xIK@<`PvEnzuW)`!P;+V=9Tm_k1)f9PWh_mcl&>^nLZ4GT*Ds
z(POgbo!ZZgv>R6V$`p<wDqO<ht&PVo`c1C)DStdU_GrV+jNQ0y-1ROy1xE0*h7Ij9
z<{IFCm@g+hQ$6wq8rlTVkc`Zu$Rzl4Kiu_t-7wj><8qIuym3`zmx=rY+D*3tk1|z&
zU*XSPt_bu?N$-`quPd483$ICFF~i}C%t56o%PfFcBjjp&TBqjy0dp7btroJw14a>i
zlZI6wmc|#(NS*I`0em`rF=@y~VL|=@94k%Z#(idHR!6!5G+UbnO)O8?;9Zlg&x%-v
zL{4DT_0#xR9z9ZM=beZYr!9*f!*7iD;<7G3*3VQggZN8BHkLhbwmTJBKF3dCye}Jc
z;o6=r{ksf%=nwA-6NN&&Idm9PnP{0B0lE2Ja-$rB&v>Ue4Wi;a;uqsNma8GRQe_f8
zA#_g?%NGupQ+ENk(6wYE<KmFgyv#UzO7qpc7IDc42Z85q;4|mc&lUkXHm{EV9CfPx
z%`^dURGh?+@(o3^Fjk5sTY;vXtN>Yl7^N`vYw$Xf%;8P`PRb^%K&Xm|=r>kePJ$Ya
z#YX({_~s*{!C)r#Fzd0KK?fga6p*n^#d-+{m8xT(R!<77^1>ai8g&T+otU^J94_ql
zAQ2Xdpw3!W<|Deo6_cVvp;NtZ1u&(!!szQRUvh<v8+sT{Kj|{t5F}s3xo`koLp#~O
zZfWeK_0Qw(Z30VYv!|Qz{5y-uSzom9xa-H5bbwnlx?iyvVRC6M(cIe|RvH4D9`<vX
zq=WcG)Y-HlVbs04zsD~b?+*mKS5?c9FpCi`T|ew2Vx51$i#)z%+*$Xs1pvDVVzO6A
zzD%nG#TEGd5roaBo%be4xIRJje!+u=Z(CUc^pM{D%MFYjI5$Koc~Z0vZwy+gpA8cv
z^Y9->n;?XT4=P)F5uXP}rNaU3@F0&47J(~Z@|dF};B?4j{4rt$B06~=9QzI(iFyLw
zUqt3LF$)Sz8$He|GJhCe%{y=~J=w$`MiL)F*IAW$R8o!Ex&Zn!S@+FCOPPsG8xMgv
zEI9>2#Gpfbq|-U;0=DlCisYT-u4`O++c1^?6)XW5iL4;jQojg@3|aIpd-Icp>;Rk%
zxpSDuYDUD(_3jNj_OtS8&joZ7-HCPJ?s~~(Oz(G{hn;^bThr7fzXF~Z^XyTn8-AUr
zu8FoLfqhTNI4F?O?Q4lX*U(`<0G4B!CEEr5D$$Y%erN(0)MXC@*Gi{=;?NLf?Od}O
z4@~Z?U?lASn00+vpg>E11EO6S6QeiH2N}CsRrq$L5zz>j)PK{5ujx2(_bf%FNmQS+
zcU>9XjhYXB4&ixw^a!d5c;2Ht?5oC1d=N<q4pHa?ZorbTu21)qS@pT}K!4jpzi;nw
zCGR1cvAPxM@OeC$;J2LvzVJcOJ}y^)oo)*+T?cth8Hg1txPRIW_=-M*QXx&v(MEW&
zgsh{M?pxC#f%k|Pl;K9uAmzPklVRoQ#4kvlo}fb)sHRzbDzfmfTWCMT-T$5n-$G5$
z)2?H|FJ1tZ<dOLmX9JFYMI@EUsLBC6PNzo^SeIVu7$86OE9V$!faYp~B7JSMs9J!$
z^pP8aTg=dx!+z-v$i6m3x+I-<6v}%fU8hU+4vUJppk`8LXt&^R%IaIz9gDC_Qn59w
z(bL?Uca~N$bwnq_s)LEDOlIjnKZ^4bVkZAIa`b%#7&l;QBp&-NR2=)!2AB2zbw{>Y
z796IlOp$=QqqfjM<`-FcC?%G;ga~l*$oE3!J~nU>Ig8kwUq?B3(byGS7Uiif4MFHC
z3_h_;5UZ@i<2lSRP`-eCR+#D8_xQ?jOavXiFQ1hN?92ULDe6YF1c;eG;LC$|wYDoW
zQ2VkFmGA%or<=z9sR$Kb20%Al$12VO#Bc`I07qHs@fqB|ONc1eQ-x8yl)6q0lnkVm
zmfq0Br>ywZYgpeo1V>nTPlC@C<Mir{(XUINzvt-$;1J0+q^OMqSET@fXc{kT!4Z@e
z?AiknEJ7R!{^?oT*QO%i#`5-tyPOVt4}g%*orb)*f3XED{itqp>>HqCDxm=J3LR7d
z!(B?##$T=apb_eQfl#?02*K`jDlYZFGw5#>ER}4hMPOTEmildMX#2^AApevU&Kv!?
zpbXq-C~Lmu=XXw*bp{xvDMa{s2%w;KNts)>9~UL_;?4p<OEqRJ0(jUvoB{}esP50D
zq|#6!aMz$&hZMV$h}|MMo78leHx^t?Lm-t-QQ|}$%eCpqK|(*+<-#?v2YdFv=69U3
zDfXUalMKnU)nZT@WcMRD2m?Ot*>Nd>)A`^&L^E?g{xwGQ=x$6(SW%du0JMrTPOG*-
z7js;bV__wnrF2bSXOs)|@e}!T5QtW90I_clnGgAu$v<Cy<HZH#(?%<b(3JZQ9XX^l
zj0X)MaAD8@;(F}m;jb!lNWi*pE)V)e{lqm@;x9fjh!oPGI*Gbo!}~7xv+7b*G+7gT
zaViK7N--qF?EHu0uqKtA<j#YZgE^iR0r90^rTO9!E@6y;P13Eql(J$jdb0NYVNSnn
zXekYqK3+8f?oZz~P)d!R)2Sl39Iu(5fMfA3kf?#Lqp(3L9ocL8cq5#VHt1#EdmS0K
z1Z<0dK*87tT)MVX07t1E#D~6N|J0Vm<C9FUeA3ZUMTI7SlvzrEyI7(~rMgO*^Fk$b
zM~Q64-0S`CUkqYGpCd}SnS8q+eBppRI>ffpEBd^B`6%F9aEQp385Q!d$|~wG(FtwG
z9T239ybq7RNMbx9&2hxdp;NW`|JeHKu&CPgYY7SI?ruRskd{WJQ92|AL|_<7X{4k<
zr9(hcx?u>(0hAQ!?(S~*o;l}t&inbk=ep)EE@sc(`>Fe0_gd>-;hxRF(hY7&kgbGa
z^0>BO<!qBYP;WJuy%@oN0BJ=e`i>rxb#hoA@y%%h*Y1-nU>jSwxgkaJvA(#V1phIZ
zdQ#btcNNb6Fk3K$REPmcTQ;ryPeJo^(u{1aIoN<qzW59i_|+lfH6juD&9Xh?+hb#f
zI>o!X0xTEeUTMTHzsOW(DRd9TdOz{Wu$OaSk^9OnC)CvZ-TyE%A`=>|`-!9OG;qz4
zY(aCI0j*Yb8T+7Q+lBAh_|BgxnE;V6fOBNR-6qQTLIr(~Ge54FO-bHceFUY!hXiZz
z6<c%12yw|VHv4g;U$W$=b;txYZ4mbWjYoOATn)MKbR?C0h^A1XUBdLY)C7j$I=s#M
z^3;R}`<=G36`u}{#+4<fiC0-epRKzpwQ1$sy<F*9u&j2|pmphON!;{$haW~Y)&JV3
zFsXdF@8!E`ttE<z{Ia<GYo`A9K#~}mVR+x>i_1vf&cwUgZI^)>lXri{N$!N-^k>3D
zvsH@sK%ne2zPM){p8P@EtZRqMOrW<}qxT?Gr-5<X0H?I;1ZYv;vW&lqR_T&<teS#!
zqaI{KjwwP9Zh$lxx&NUPp@k195p}g!-7w#%rhW-a5LB_Y#uVbu>o&v`vU8htU5vOp
zSjLZ~sUf<a72Vb70V-y(_1HjDu$6F<tG40{yx!xNwXE{GCeK0Dvhg6cB+C=FrRC48
zbI8X@&gTf5`JbEGHYWX8c+%^(apeZ+V57oQrd7j7CaKyUoiy*ZMEwc<*KFt2$zA}p
zHFjf#@DTzVBw*!#%6F%jHRqhw*f}V#ShX9q!D7R%TBsfNGoug0K(ntc+6$j9P1{!V
zQd;3J&=2KKhHDSsBM4%v8^}6HvNSLo`6@n_wn_efPgnY;?XrizUs)NGS>@xhJENe=
zj?VCUZ3R@;$Bxj%L{8o8fbq$S97S!z+DM#Ed>Xv*=inC|^C|TiN}Iw@2ZT@<$MX7W
zW|&be7^UZ=bAK|yO6M?ohG9O2Qg`nsO*3|6{~mVl(?WSj-`m;-oP*WjXRO0*q`Hi@
zz~<N5qz-s*=B|G(5IZ7*jGclU!@H{qY{_KG5r!%~&G5>ep|5q@7Cat$A|G!6#%5GU
z-|ot7eUc~sW93k&>0G7ihX9J!j5qKXb+%pX1{=Qt{YGg&t;f~?UvsC$3dktl5e8rg
zPYOJ8{w{?|-&NP|wG-{PvhX<whH7Bx)#c*Wj6$p4KXL3aIS04fd>G%VLNx<RDFP5{
z$aF>8^%m|sksRbG2ixC*0rduu+U%u-K&ph!glF>M3K|gEt)Kj!e3|;;z8a8vkf3&L
zzNh&0jUUr=1(^Ht?0{4tZu<<Bc3?f7GT~J*)z6JjdPC;A_;xfLe`ZMNPHSo;Z)POT
zTKtg+nwSzK6gb?%)D;28TC+MY6(roi%v9C-dE1?6*u!Aq;qer+^l9dWp-n*mXErBM
zWR}18y%WHxiA`@%Yz{RdQNTAh`!((;w(|^5@YBM!@qA_3aaun}6wyh{S`6h96gBgM
zecy@Y_r?6uYiP;$Kb!_JVz;!QHU-}u$ET?fV>9TA<1e-A1VK@}qmUMVCEQKDNTi^8
zlEJdZBIsZ>H!vB1n%TLUyF@ScHShZ3d731>5mz(suQQK&T<vc_3VE$@p$zd^z_W-K
zJZPuypgBMLoU3ak=0jy$D!r~<0}@a+)5v2`*4KDyBv(g11lx*&5fR#ab8jHuDrCYl
z2J!shJ%_+QBBN3hjGkqf4>di@{FAWc9hG+C-`Emmls{2)BpguOK%zMN$h(ui73Zl1
zG%QR(%TxM?l%|OI1)1R8$c_z$__WP{1UXM4Wad>DUGX6z{~NB<QaV!cV>w%5!?N;c
zt=_@%%IMP%sujP7UwxVDMeXW!Y4yX{UjzHR_Wn;b?{dSa_FwcIqajjtDjZ?hx<^AA
z$#p$dP+6MEJytx%XK#nQJ!?Sy5O*`KhaO8P*iYAKpz)|81yn{yl(s*emUt5~ts!!Q
zvWYhZv6oDQ+rURJuj%`mJdfgLEo;(mkmbh1Q$4v37%{v-HVv70Tx8?)()mFT&L0p&
zvo2AB^Sou~NEk|fnTnE=e(CG&&p8T~Z`Oo^zqnW;^7y0?5&hm64dqkOXU;m9k|6f^
zUD<n`LtGNqMm+NTN})4Y8=pacOj9Vn+o73ufnHLDzfYu}xm~Jq9;7~6!P<fh`rAEO
z-zZjTvg<U}avtmo*Xss51R>jv7a0qxpwmvzwt}3QD1)6M1FBo3xadgiI;goo&8dH$
z<vjp1kB=Q-;Z)bTc;}q9Q9gP!+-5{Js05ApV>AJ^GHwOtLoA|lJvqTDHyZN1(0Eo<
z#U173?h-CxFltf&Rm<N<I^^gGFj1{l#o3r5sQOLeVwR8z6S0nB`V+uoLxY$6`I^T5
z59c!<)GGRhI)Pxl^!KIw`9D{L>aY+#Nbt+A1w&VF<)XNKYXM1>Ki>I)!T%qV5hf@h
z-xIo}G7t?fs2>8zqM;FW+;=F3q0jX($1mp;TyZ!>Hfdjo8|$B!_hUmKcrUX_J;_c{
z|B1{kDoG(`^8WVs5yL-z4sq(0HUq$leTr+3duRQh<i3u01pbQP4+Yzshl5MN|JNnd
zF~K3@-_k2Av;%HhxaQ0M&`BII{TpRG-DH6LFX_Sz2I3k8LmBd6D@90_?sE$E&4~y6
zO@9m~g3V_Vg8-W)^`_<?ScE4(-^m$K`Nu=?CIWCZ+<`yw@odFEDWu^Dh%qpkZ!Jgr
zpB&nMeU%u(TCwUe^2b|7K;FK5^Z*R){mh~i>JVWsdn<bOiwR|7P%KJZAl&KWG9OI4
zFyo&$oJSa(B=6d0`ZOEX@RZJF?8W1gZ`8J1xhOuHWxF^4(b}G$8>Pk{F<dmtY#nz0
z+iXM(60a<B&CN|U^vFY!9KcMm&>y}fiKf<ziC$Y)u@`4~X_%6A7fE~Jxe^@Ww)J)$
z6(ogK|F{n+<UtI>n=iY8{b|>MrR^v}c$X5VdV|$!t)Y4CVPs^BTV_YooZk4Vl8al=
zrsG{IT-TpB(Z4KHGyicZ6GjZry@2R89{Vd7*OS3C%4)AQZ6b%h<7jFR9S&9YdL?TY
z4SOSm@6+GjVMnx7b#>w^Ar5`Wn<;-HC&KZK56f)gCj;{X^;_@^;1%{~D290F%+P^R
zZk$zP*XQ}?%m$NpOr$Y{Qhw+e3-fp$9^9G^xC({%-To6wUVKV#Frj|<RNNL&nxa#M
zz1jG}9vR^mzes$l)xfaQTWw%ZA~*x}hn5WMIOXqQ|NJLkvl)ZHq-%HbX0H=EeJm8P
z>wSyPkpnWI%JbPL`oLVOwtrsGrKLSSi=*{WRPvuIkB}S>8D8mj1*uoH<y~;+WSP%l
z54~&k$?yH)qKyxwx7VP`{K@1kweZt_BFTVfEpPJX&HcjiuCDpU%|asD%5m0vf>kSe
zP*S0)!^47qj0&QLVStQvzoU1o+K=RaEHWu%90cEziXcY;$Oiv0HVB3&17Jq4RR%u#
zpA1nNK=NE~o+tZX-{loW&|<$-m;Sjo{a>Ld-M`uI3vR<A*Y%&k%>Ug)$43OM+B8$|
z&k*I`cgX7hzW7D-KwoP1|9E2aXMd?DDBCs+{?`SVOQC>qIn-)r(69Wz<`)}a#U==)
z5C4xhW-<>*mpLQV2#E}Gv3Xlo{q#1(6yTPa2!nJOD6qF77?BA23!X;6rJ{*8CZbb^
zDPYCna)R<iVVu}xAfh+xyg%KQ$-fF9Vl(@ZzF|$ED$ojIYB~gJ?0YD%eU>!Zz&ZtR
zyZLl~+<Sm(q%z2DUb~Y#du4gnj4r_|Fgh+ej)1)9CueWojsb>ZD}U;K`1t*|eO=a*
zc&mjnOxk-0C>+t(;6q+s9(2Mw*JTJ2v-_yRC2dXEwCTSC?&}7085;gKAYv2-X}eEe
z(f0N6M_F7<MBv$~Vy_H&sfgMqd3y!z;>Zn%5S(Cd*tWAbP<(3lE<q4wh04Bx50KF8
zF+j5f+kdec0ZY`QQp~j{8#+k&vOoNu(Bu8^=?+M1FZ-;G<)H-MTO7;4|11t&=)d{T
zd!!MP8W{Fon+7P_Lc>Q0%ofqb;HSGOh+_&Mirt6|7*Xo*2~4(rWynW|+IUh`5*X#V
z#AF)wpc*4MG&5xaLkLk;Xanu(Q;MG!Dk3CGH4^RPq!9ei5OA421TG}L=Zk0ivLq3R
z;w?p60Ci8)6Y$@#Kr;_Z*Yj@UnKIdA@3H62$hW^$V2QgPDkXwndN1L~_C{)I|2J8{
zt`8W@NR;bX#%D5TAk9yNCn8D^FP+xz50gYt#Xa<uygl!qPX)vC1FPH)z31JGn^ifi
z<>ebz>*_$NDFyN+#LeRXeo>opzF=m<J)yz<m!ON+Jg7(5!vHoy75VsNERts8q%Bg0
zbT1wdlyb$>PLqu66sIjWC8YKKTCTil2t8_g36%d1^Se({SjdNuO|)Uw1FunDQON7$
z8TntG?*yUHe;IuV@TWt)G9x?DwBv)Z|8A=$)tLX*-Sob##ma9GY{iil=?5g9JpeKa
z)T-jMzeO|~0kFC`Q}S9lX(J$up`+oWYQj@|{K-p?In>;`nvrx7RL39$3S|lic$j$Z
zzx-QkS5v9H52Dksojqrgyq7tRF~Nmio&hEaiMEm3G8BQ;ZGnHv;~rKtPxS`PFj%md
zk@;2^@t0fx%~P$@8x--<3LhhQpUy`AY8nG>iFgF`S=j?sCs9Oum0`y2WkKr3%jw+@
zCEmvcNQ16~g$NWywZav)l4R40fWJyX7ld5V6wngU;!@q-Z}9h%X~NEPKy$<Q-VZa*
z5~@wX+WuKqS4$b>knQ~+FMykQJfCN7ugMOI$~q`bL30Q!HSjDb(nZOHm%rmG+W_8`
zFo9$VTg3VNZBd@=Wz2-1cfz3Z#Zzv7HS*R2@a?n8o1QznARklPcL6v|u2w}LSd7LT
zCfqGeAuRHA1-J=_);mE6TD2h{G5MYmBWR?qKV)e?7bE%ktOiUn@_Cxv0In~03Adz!
zOIA3d)act7%1PpN4(h0H{#7m8>6FoeeVxUxSOjDxHy9|hAwxc;pp2T9$TdlTM%07c
z)X|HB+MvRsKL((M!AF|CKA^&tbK*;KYScCRrl6=5QEQvFOJ4@A-;aMq`J7awWlJdN
z9g$3ldE8}NsatC7sQt~oHx3qK8xuftBNqvGv6N&AYm5#)$7i|wfVMzt+VZtLZ7v|q
z+x#)A2AiL%4T3iLk`)R89Apnc0M0C&vdW{|u{w^~l{Zu>ac$?MENPoEHf=rsO$TLS
z-UbHYd1{sGLBn-DM@hXFI8JmB56Md~%1IZUpthPeLGUhjv!qF)miD)Ot<XUA@Q?~@
z{cXulx7x_{-M#sD5jM7<H;3Bkc#a3_sn5>KE68)U1>H|U-Ys7IxzZDrvtA3JAY}yz
zxQzq|a$0tsgX9F*m)k&%IOW1jLi?s?3b9)6Zj7%Oed<2=OTvh)1jH36_*B|3w>4S1
zB+GnLDExhNP(unruzqBc(sZatERSFelDT?3GyCWa;FPT6g2Hk|$NF!;Zs-f;jfKvG
z08}(N1m_P;R3hVEr<IB9LIO610``xa&8C|ICL?s@K|~G~fJEDf=+L7o)(3!uPiTHH
z<|_oJa(OR3WzZ@0Fh$^F-|V?<n{NvTgn@ZOkpf#z0b34Hn~wLd-IxpaA`c&$M4$hF
z^hT>EYbICj>wBcTA-;6yhv&R&thx{{dcTj(YhQzMs+ngIMM2%taCU@E69*t+iF!U5
zL_nevCuLFDyTO9g{*oI%l`SyLu7M#28b$CsYRTN{Yo^uyGz?F+FU~IrwbrPHj}rSm
zSyLQ3C_)B8*isYFjNHUfdI31nYpwo6`9;<gD|VmBKG@KB%1ZjSssT}*t+6%*;{U7~
z6hM9O5JdZpThEe*okgK7*KM>Xyn@-F<O0V<g9c*^OSBxA2GNirXhta(6KsAg#m|{9
zj8%`&ckcG+#%eUi?|r#ZJP(#*HY_l@_#Mw$#$B{_7$v<gHhbPj>=X8qV(B-J2>0=F
z-3<Lbk>l|?d>)gdD4#2)VI*$DOlGtqxX;gPx_JW2Em_IiwA=GEO^MDQb^*fjJq$Zk
zBFBUf@|Z<O#iktUiQr2bOr&G5X}KVH=7XoZo~vT>FL&K_^4YFyX#0Z`WH9hBR1rjW
zjnoUt3(C`A_sLSamU@c9n)RS_;R=V|7bB&o^M+Ovt_hcVJBPfP{cS9#G#k=l3kRp~
z(Z%1FaJba3)J@y`fbUW?amJ`gu96$3F?;vl%-&x5<QZp^?9+MS=m;9U{fPepAJ?f~
z%ZDG$dJy80W80Nw%+L`H8+{?<U9f%`91vW6)SvQDC_oX_a;kLWG!)c!8=fEiv^e{V
zbTmQuOY6-YN4L`U$sf{YQ|io@5}SJciX$`_RJyagYo>F)YtL!k<4Xpa?{%C@-X2P}
zd4aR>2>+)$Eq)oH2|ZlatRx0~rHwkRg~(r?R)*m2!KC&^4}FU75h#t92v|6I2loQ6
zT+?44(wooC7+TX)B?*t0=hM)q(IwAXtlxKun9{Tf42yd*y;v6DLZ6BA2CGWZUzCdn
z|GqF?4nqgBU(g;Iym>&)wUy{M!+}%~54?6Rg8$gEv~Tj3zh9hx`&}~<y0fk%qA)v;
zD1?=JW_V$UcBhjGq9R%T3K*-Hgw$tWT`l&Cv|`&Qib%xqVB;c=67;UNhbWxLey05C
z49{t0$WYkOzETGvp`mC5d=?**T3U;(!^xRAipp8sW2M5aWJqzk9*;*7_d~{fjvkhn
zA^}eHpnmU@ig^S}#H|0~O)_-mhy@in0QEuvLWCx#tN5u7=f^`jH1n;nJ1tdhH`v9s
zaiu*{TXU35%Pr*Hy7>+`CfC00xN)*6N-yu2&qDHa!l}@HVnhu2+TfagvI#&E+oXU=
zY&?%roUDsY8+9rU4jjTOLvaYaIjWz%=Ee-yZTY0zdA=g&(__XsismIa$`DpF6yg36
zl#(Bwa$SgwKD5KNx*$d|>M}J@1%`fb+W_8)c<WXISB`jhrw0r>40AM~(^#I7p}|nl
zbuDW?sWiq@TXU%759gilQ*S1YWcysIi^l~|=iht@s!h|n6mNQtajhG~aB?^qfUiJB
zZ@c8-U1L)``JFY)i5F4QP1wmj((^{CMgKK3e0k@RA;V$XVRljCJ-z(xBKZ_QfhJ5+
zyM4#VZlb7<I_#446lEv-h!ZY0amN>LAlYKa0V7dFtG2h}J7fIjU*$;hU@6aphsO-~
z=+f;7ER?bD*Pv5BaIlovCZj_Q6Nc`N3F#YW*~Jh|Q+C<yBh?tvJ$Qwn+Xr<rN*v{E
zBibNzR_E~8Mbh03U<{>|rzR(R9=^sd7%CLu5+);~f15$}{adiMD2>~<Lm&@`ukIAe
zlJ}I_9iv6Rwn(HF%N3+vpl6CDLHDdpIN-Mr8$nyHV?WBe&P-M%Ku2A^Xuzji89aHN
z9j%kyFZ^C1oV#}EbL6q7DU}^1`gfYij6hX=pQC}N?+RD3IwRwBtUa8MpH0qJ1KCrK
z%k#6OxS+#1;pbaP)kTerp~Tj+ueAos@>Fiu*wYVKaAOAfGVryEvy1Y~srRz_fu0Rw
z?t4*s4I&Qq(N)2a9rU|i=}8OC4Z#aaT}0EqT`JG%l{aq|C2ukfJ7uVebB>=&v1cUw
zDvRKGuBkA&*dw!C{d)S-i2T>|IoDx1G4)yD;KJgaTIE>=HEQ*@TTi`&pH@HbcVC!T
zb)QekP<rWgSh)+@?`b!UmO2q%02jV2m!$|9Q+>coZ)!4sY@7j0sUGl7ls|Tl@ZYd@
z1N4dVn4p`UMv?Cz3{%}KC>(zaCwQ85Jdn?|tMBcI1KnL}Xgq7@iQ8O%S{UYk;z)ya
z^mxQ6irKy?W>deZ@#km`UEj*1$rXu|P4TU3uG8~DRWUothZDTB$r-<NA-ivTUFt`F
z?Y>SvlgZ#>;#q3!KK?lQK;JNXGrD?ScbK@n-p?lKAY<&swC2$purq#mWZ`g?GmGSH
zGk#MZ|GhAH1iHNcux7kYC+2SbU;0lp`ep-94LamDKzzPE>!ech94;`5rNt<~gS(Y#
z(!E+m#%FO2e)VgbXW93hw{us=l2%v;eNqn=LP`=bPQdrg$tykfU7!C=KKbwmSx=|r
z$TpNmc&Eeg)7J`veDC{FzP!#;pRO|OYejJ>!FsW*S`~Qpk*@bftXi(%gJw-m3%6K@
z&<{{(F;6>?KaH*Qsq|YT=US4<jMZ=}c6(XV5An|%-=a$c?5P)C8Cr^ZIB1ilnZ?*S
z6lbrH?mYkKOXxG)qTVD34l)MDTnNfTv<&JdYbiw|-9fejMs?b7`OQy;p67Zb4>C4Q
zY8yvogyvcGKWEj+$LD`m_@3f9-CS)P$}N-E@Ou9@%%-yA*<^v&m+Ew%mf(w_LBJ@x
zWTq~A9LB4KHgLZrmF0_4rMi;E6PrLsk7#JyBZW&Q)#Zb3>{}xflfL}|Mz_jmikm;W
zAAKP@6*-|<nt7HA5)Z*^s9?#sr|Pss@=n|J#?-d=NI}2T)$8^In0DYOWYlo*`-e>`
zg7O)o^QpBUYJVF({rAhmk0l8Ttv6rCj+Ysi2ySbyzCMrd+IYMDOO1b*ygyIehzByf
z`RbR4yk6;FgmaTS$Qt5u7EWuv%Fe9NTwvRaF&38h?(w{+qZc+z_fbn9_gz?wrun_4
z1{fE?s;@~BZ01ODoWwF=arFSo*&0qWiUo9DUqY|h?#9ANkZZ8bB0iQE3_YQ;i|Ltk
zqBuV^=X;{$nXV@N0#n97ZNJFF5if*PY@RR5O?hJK0}9_O_Apm*m=ggzxe(RVtE8!}
zavLPpvtt-tZRCJHd#&m`VGxzpBM0#**#%kmP;^xOIP1atVOtp_v#e~RC=269N_&1(
zkUOZ?MQjuP?^9sku1<Y!->tW*&qnP|Pmx*vmfYz4x&H>b%VcyfL~TI>fAWLV*R)rW
zsGlsvwhuvATgFvvoD3~~j=uqA*jPdKourUfFBsKvOXtQKzyA7j7>!Ky0tJ)ov-Ct+
za)D-J&{1f6tD9pZO#QiP393@U!iNJ`=VQo3G0bzwpQzK<){%qJ2uHd<nULEb#^Ugj
zASl2C38Kq9QMs{@c(^zc(ESTR2r8fQe7wjQtVA3#HwAyx@*rqTKqbT`<dWIJ9%{wl
zKo{!2vh-HhB|cQfRX=ExY{&Nc1y4=VzvqSFsVQPsC?~3%Rv3AuiceWd?1!j1!%H{b
z_CA`nfkump*9k5}247B>hImI@(w}M@s#@QIj(rSrrhMY-3TpSB<AYZ?oHM-<zDbW%
zeQw8Ct)<cBl{D+%t)}oDR#mGbKr`y{-$XZ^3TV=unKbm$&|hLNp@%r|heJQ3)5W$u
z;wCJNPC)toV$xTH-~VI0G$rHAV*p_YK+O^p$gx?2U&^Fw{RY<ab|QOFwK<bMq^|*T
zQ`DA4jLolHN+17_3epvU&(n`_wU{aBy*K^XOz)Roj@tL?P7jJ$#XaE7ikeDYcmg_>
zK0x`N(^_}M)cDl7eWSd}>5*OgetmXM3-M+3Hl0f6S2g^>faW^*Y>0iHM#CpWYd4$*
z0@wo8u|VdF%2JF03)XACkA-NuJEN>^7(xTBY*p>)C~kc=)#&EnuwM{yD8^vLpjP3~
z$IJ5N=CjENdpXFxEE*90`uQh6d!gQ6Bg|7vo7G%doyf~f0l17)zi!}F880h-4Kq*4
zZB`DUdrUtiFby$~%`n`N&!Rp`a*EJaQ7~CatpqY!R)W_b<MF<uo!ec^+Zt7*EP|lc
z+a;$b=TfgkLXFmpPhO{vcoP%Je@F$@x^5I7PP0!skB0>P1-Hk!M%#}Jc=qEvH9@Ke
z*XhJKJ_Mg}eH7yd#!nTF&SnM)y~-C#^+yXi&_TI@|BhD=E0R?#<@*)j67H6MdXy{q
zeYNKis^7Lyg=Vs^i2Z!o62llbimhL`HVT@Rv_<g)h-DWNlCLkG{fkTkoqM{9r3M=j
z-()CXrMDUA`h96-R-;I<D*j46)BMm}jh20-1*!#WG4pNiWJbHAi+7}i3V($kP<2;Y
z%!9@69V4xal8QgaiQS-N9gY8S1L(kOatDWB*kNWU?FLmThvW&ghm;W;qd>#))F#>#
zSlauxlcQX+@@1|YT6*xtT{>u;Ey4zh*zPtLqrWN|;ixh2A}!jGa7(=Txurf`7zPA~
zT!zh(r~QUT*U{-6!HoVGLV8*Av`<P6UKr_A!G7|~9TR@7kdnG%#pQY6@*yD<L%QiH
zar1ptzTD(zMv`=mtA}hKc{0o%RjmhAxb;@o;++=ouZ}uPZVs>hjJ`D0a{ak2;~}Rb
z_g0Bx*8pek%VaGrx!9`p1w5a~hRafB$~yPU=e0(Fro`4;ezFw|pz<avebu}0%I#y9
z%uds=9=(Ty1}v}H=|2?_-&zLz*_5YD$QnGz6(ozSjq^&4#}1{&wA`J3^eaD=HJZp-
zRXW+8V3wf-Cl16omi{s|n}Q>$^phhGgiF|!pe3cK;KFt3pP;Rh&^31tZjcfAc`nUI
zo#8W^Rmfq5RPKP5i4VHFu%;KT;l2)CL@HN@#g8RH3;L@{pA^09Rd0V=+fXs-M#1aM
z(fy1-^?d%aC&4<>Tc3r0@l-4cvix|o&mFw`LhX8jxz0Ar9DkEF7gEOQn7$_bt-t={
zI^4fT(_15)%B*hb2LD0*MO-`XG~xy!_c`^qTpqCLM`n8kPY>}B7$(#alw@+WOM6Yw
zqUSBIu)oQ6L2#``g~gWpZjI&|`2BOpg|?n}vYq606n5De<ET=j-!AWmF#V2ke7`Pi
zcU9SYE)4(8&`8=@h~}Oa_q94hM?B`=n;r<Qy<H%6X}(!HX;xwmuS^VZ0%o?8Z0bgr
z(of*ElmhZ(ozBYM_Kt>yZ;ZUtzG)CU78H1NJlN1)6<&6|zZuTox5i#@!4leRo%Uw$
z*l22EiZj2{=`U^15!3t4pgcU^T4D&ktt-8Sda~8nHyt*8{vn-5-uC>w{V0WR_C^hb
zrAgh+a=e`$OksB;Ne2d9t!Y2UZ>UVg@BAjjzqAyCE~<ize7V%}C_{->SDWspAVZFu
zUzI2|QUh-&#cDUC_=Vf(LA0*|t?R=C=Jqk(JZej4Q?&9Nf!C6+DV3iaCEpBaMm2EP
z@i3RMHioG3^Jt-Tm8+5BA*j%~P6c>%V{A1FS|%o5s$eIp#gn&*N%_9Wk6vMMQksHT
zK!M3q#plA<mIT!p6B9#?*yV}Y5fW4nIvuNv(?swEj_oPeo^ZBkYR7VpD&wk#&yB@o
zROvn^IV@<!*?y@O%$GuTT-^5|c9&CY{)0{EW~^5Mqgs`6fKs*4-Pe)(?|xTvbv?0Z
zelyb8UGZS5XXR0{8^E0UM*DbA`RSJ>jB!4v%?~^g;pOpS&)x9iEm^EsH<FbM<95m`
zO1gOHJDZq?BQ1{Z+rKRE1?!rx&M^C6<MiXdvK&3=;wjVYY5{NseMYyWzg*YD;gtN~
zlh7aeO@P#E_cc1^Mdoe(cwl<|VPI9_G5dk`r=XcP3q|yJwJLaF!`HeHFj}oZHg<m_
zUmlacXQ?Jq9B%gVlZFsybi?<Eb`>gI<tmkFS25$X8xgg%msKV|QNHB(GK^sK_`$0;
zOrlSIkP2a69r^>>wctT|Y@$nkNRUr8pL%g))v|jxGJ${c8xQlU*8MWBZw9WscQOh$
zxKxK1wc-!y+3VP}bZR!}XzmJl{?x`Fs)s!4Fjy0>;+-rQY+B85OxC>np&_E*G$47c
zSY4IMkjD81ZiY;;lFP*YIBmFvQbNw#E{!4nMO~K_iVLZ}pf$~HqM`2`T7k6WTDyxq
z<bi=iJ+&VSIKt=#0xgr~LSiWxskNnRae;li_ZPlECtCH<OMOzt{87T=AKLoLyPiOZ
zp;e&0RL5ZQD8zubdz5jt<GW3QT;h_yii?ygh1~_ix#eb(9T-BFm6Qz`otjGump(6A
zg6)-LdrK|Fqp!BdfhNXPr5mh%&h?{9v&sR=-b#)c#>*5L_%%*uCy)F5o7R5E>E!Cc
z54dz}7b){|{xzCY_53K7eO;%{UD-{mdU&<7IvRb0M+SxMDzP#D_2lWfi#Vy8QS7+Q
zr=VvDMQ3|Juzv_KQGnj31zBg46<RapDV~mGlN=H=)gwhavjlZ-YJpsG7B~+*lzks9
zm_$Y#(~_^%r-@RtilbPm%7`wkjAH@iTD?N?laDTLkAMumPM@z-3p|S<-GW&01+UVE
z4^T|RR=6xD;1@>WZCZ~I>GC^ay3O?$sy?N0(R^x{B>e5(^O$G3&#uyN778`tWWHDq
z&KTeB)oYl2d}T(kO#BiT*(+!+37)M7l&OOv9WBxmJdHqLYIkr`80Ei6jPDM7FO>P0
zq2iWr7*9|(UvpYIZp0=nsFwPGwY@298-{Xt)cLT?HrV)uiW?f)M4(B<@pz+Sa&x71
zP6^ohp;PvtNaicmj2gqb^Xmf@B*Buu3rQ^vK;ePHceo0KCmlE)Z7KSqZ+=u!wSRCH
zM=m6sN^xaCjc4V?xQ^RQX)c5xrSEE)E60-9=?0^m66*we+~q%m7RU4&@5EE53H}K2
zI`6Bh1_oI}JfJ+VO?>FDmxdv#@_t@igJe`YRV%cP(1W#8H&n(j>19N9gf=ftMd>m*
z!!Wtf5W`Jy;9CCYiI7cRV>0Sw$w+DFdJe_OkF-moZg?JpQ7<otzH@-^n3_Y}8Xf4>
z3p`mTk7Ogo3`T8}FQLVUrKc5BtERnPVV9T=QLuiwGNz(}6QsUq3HhrW0IZctj?#I3
zp~wl|mlt!ge|5sQlYFGJV=-l~aHO<g!k0`OV&gko&;CAFBJt8m!(<bJ07zo`A3eQg
zprz<sc=z7I8~u!#_i>8wYzoL+lYF`Vwtw7H75@<#-Oz7{B~)rL_k`XcM`rnJJe+tG
zdnY4Xp0YAG_VG;>O#;(z{MY=F0*9qtC=V;@Q-I3Ix8=1<=t3<aM7YXSgqQpSl?$5`
zL=|fO-iSoxK+4LWoe(Ze$MM73b1|iyUY(Cc%zwz8*A$He!2~0;$A9-Mm>sptbF7Uv
z&M&7Nciy+W0F%KtF<Y1itq42Lq<f#@^(fJDXU(d$B^eq%^M)*KPRmQcMB32H@iI;V
zGJ8^AM~e6IoMF~3=YaT6nZcqv1`rq^)BTcf_mHX;$6_#zAS6TnDdo{X8UZgt7*=}N
zC#HiZxmlse#~x8^YK`CHn~!94PWu2C*^ie0R4$A}JG+Hpl*}uG5+-7|br@wbWmrF;
z&%OO~?(BJ#yXHpx043{}cUmx0whIQYB_QKc&0yOkzZ#^&JW)#P%ez1IO9I0h+r5@`
zt_xci_1Q{AQXQs{8(n1oqjutc5j!ATQ&?J<*p74bp?I}Yl=JY1norN^m^g|a7?gLv
zyc4?9B5dNyKYYj2*%SwqRV;jr&Z`-yWWRVqVAN$#8>otTy02FxWBlGWl4X@^Cimyy
z?IvCj#C-laaTWi=1~SX3eKF34EFBBMl(@b>tHYP{p{aN4yTe08D)qx6tJ%8_Y44Fn
zSujl<5tTSpmX)M$IXx=#Ig0K7EpEq=0<Wex(siV$w)Yr(zBOZ@-ZSyO*3wD{?X!5#
zfndyHztx*I-#UJ1M|mLno_jv7^T8apLqN@nF3k|#(B?Ts@DkF)@O*po&C8J{4W0u=
zC_N!4ZIO+r4cR4_<GeUw-tyNXsUYAxGjFb`B=lFENUD|%&eJ#5+LZE%;3my$>N|3m
zZO$q*y}UOnzMx#=tw#bW&B{#0J}A?d)-4W889t<XmAKdzTJEmmkk%c_EvzsW4hjCL
z&ssvaLi9DzgR66qRxEjR#MZFFe<o;hrhfxju5r|{Uk;WSCZK#PC--xEu)j-S)P>cq
z>)a`=SuxT>zG>FiQ~58NMe}cF;7Wx?nb4ceT>24H0LPj1;M^TTn84x7I&Ya{QQaGb
z-=Vo1%%sd2B_;MVZ~MBCdrJACZ2w=j0^wNTMRsIo7p{h5R?@8XoHdgI!U+rS{Z^a|
z9PR+v%G|vVRI6FJ)u;S{$qKt7ssH68Ek0`|7g`*9Gg3?9TaEHX8=XHImGqA9IVl8c
z&cG|yQtRN==JJ7ljNfHI|BedL#7sXigj8nJ1NT1(sxqZ7^VHn^N6Fqd(P#sQG<e9M
zmhny|MO36$t}UDu;p;4fWEPFz91q8a@JF-{UcMfzVVqi$DnpP1?qR6nn`>a$?OOHB
z$QgbWX7RX3%%$`fF$4H&BA6UCpB^DB{CLYyF|@n810m9>Y^33A|DT&FFCU<7BqrpX
z$o;24|NrrC$b}FVS_WZy#(!P-zq%UM4}i0wrmW$S@t-I9FTns9!cigRqU`=QgKN^`
z5LUV+c-2$)4I{kd2zjM0#amB*{qY?sHH0bCT<u;fRvU0Zf>l~XJQ~43h@R#uI1u#3
zd7#u%O6G35Iw%F?UV-fuQNRO}!}J8jgnQ`JP^mE>mumwe(T5pTm48~nHD?h%YsJwh
z<_2!AFDR77c0rGu4kHv%Kq@#hWbiFxe6L#p^n8Ij4GSbl1f72~#4?G&5H8S^wHXSe
zdRx1e5!MQ+-xjp92VZ^$zWj-853F`xgy%wDDnLh8TfwPBf{W070yH?+1z`oHYg1J9
z<VL(O{SWR+=^iGa4*cp+Y3*fAwk0gC+sFq}R!-+7^?&ng!o__J?7u%kNFz-bBZP2y
zJm<06l5C18PG)^>p}><Mz^-OmFa_9K|GeG@NHGSU_n!aL8_&Q0Oeye38~oL%(uz}0
z<G%KF{s&Xk){g--*g2qE5U4&r9%?qYMj$MOK+$E*dj?Dq#BG6y&_XZf5-7LCxq$j_
z9wEHM2vxp0?3a`jpF_fX=EBb39#{j)s`CgF2Hm&g7Hyy&NFJxRa$E6^c2AqwijFq8
z3@anUdyKau@~#J2=97pg&&{K@m9Adc>YB+)-}OMsENlNzCKnO<U5?<<$&3NMLE*Qt
zh<lgc`xC}{#_MxuoOT`u9j49h&Qw_CZf)^bc)Yy<?LZ}iGY7ZTB(H}q_f0y}rTwQs
zDSPQj6z%p-)2+9V!-Cu?5GszTk(~pAcj`)r(6e{o<<+sJy0!u`h(WQ>?F|G(mM-9Y
z&rP<@NnFT+jFp<+7+xN&FGjVTBjleu?PSKz2(es^;RR42F7|(F+0TwQ+StPru;?PT
zzv}=Bs-&eMSh*lE6K?yo3yRclQP8lVn?*ILz=vu2UP7Qau;j=V19mmjK)<xz57bJl
z&cRUSFbZL)$+Hzn+3yrXQPd*8BPbtrO#_L^4k+lx1LDo{6wuc#3(k5T`iakXgObKP
zcf+2{DL4>oft0ALSNyQ&MtDyTIEl!X<EB+^!yFbH*q>1$N)bE2fw;;5wDJ?nvgiz=
z^IikaTU=?Yz%uGooWln+aCHC`UmHlOt5yApe?p7b>GUd4zIx0?EnX{=Sxm6|Zmy*`
z_3itqraYNsq(}ba^J^K^_E9Vxjnk9;DyVt8X14G1i<^EqUpU%<x5veLu3D<k%{j6v
zLKmAf0uS<o**9GahAhe^dY)_ybJhZm{ov8%Zj+CGq{`y6(~2@M%g=->P81|SiY?F=
z5SjIEcSZsNmix2QRlA1M84v4oRv5FT-be4KO&4%|vRA9*h|;l{|HRZ0)`Lp*15m;z
zUcx;7ViBhontJPtPMcr|9z7&Pf~JclO;3m<<|i4EFyRD!vHjSG!%jLM!;e<20hl3}
z7PaekRi#UNZFoG-=r(XPTtAdA_JiG|kRA`nVU!+JX+qp1%@_28#95n}S&>P4QPON(
z0m~p76v}ypqC%e6_LN&xnoIt8h%vivUKtT0z%hvE1Y5fh%J~_XTCp<^=3)fD|KsD#
ziBw1p?C+E4Ng>rhNy}3j&~iCpQ}VKzlhm@jHA1E78G6799h(SnxB84DI7V;EtL7F=
zYS}v<1tEQ8tzYr&na!(_2kYJk^lt;2oB4;Z9I`co(YKbQsS*5)XcSywdOn-vO6rQw
z3KBq2Rmonlps?7Z-+||>21xJ7^Hzf@LMnq51gQ9t=Gx4d*mxpKAN{W3EvAtoE6;lP
zY|S*Z2`fG*L<N2$K!+F7zt|5cZJ7mAEqY}fY^jS}cRMp5kbk7}+-nIb!jD_21>%F>
z;tt;l@`ZWeUt0XpbJz1~^zgFX@E;?bl<4};dG~~@YJMX43_ZXv%UjaoF%W-S(+a)?
z2~4GO#g#(O!u@fu(1_q7ku9?bGJ`;rUKcaMKu$kZr02vf&d7aT;PG+{k?CX^T^7ER
zApU|04JzDm^tmd*1k0b3lO7p|WsXwcJ&ZJ!1R{)swr?sGkw75BH;?AalGT5Y%Df|7
zVbQiLlBX-@D9isX+8zUf7G$m8Rly<6a9?^3v$Hf$dHtp#!nIjqF`S=O(B&Jw9@h*)
zgl0`WB0`O_KM$-(R8E<8=x^|YNO}-bZUJsmDTI5Uvm{knY={b*qHU5k<t;D@$zA0K
zb2|5OocC$D^%N+^r*w>KR-#IWxYN5g08Www?q*E$2dCgRz=2BcxIU?AQpsF!Z+ncp
zQYqN$Poj;1a671@W8lIKzVj8gjD8RFOUb$%1@tF)j%W6GD%k7=Ai!Zz;S}_`pIP_b
zAVildfu@Xwa;g$lPZrSy9QIuze&@Suu&%Yno$n;n*HhG=R#`?R2=I~q_^gp46G9wI
zS22ZF(pX9EldtjJVI?Mll-^+YTNhd{nB1uUE>AEcLLL!bG8I+E0IjzZXUPI$!F`Lh
zD2DC<x#RCnQ{Mxyy#;dBrtQCf%=zkLi)U8WaRmCUE;OLYw&g2i=sb|j=vk&Y5~}ol
z+?9UT$EsXO0Rk%(tPyyFT4&hWiU@|%vm|d?py{?wRX_b1&BnIE^JCZ8#P{yKoCJmw
zb>o{EKwzp&d2uWlRBcT|KBe&lqy0?$VlC79J1{w@|2SoE9nk2|h9i`9+4kX_Lh<5w
zGd=+?tMX-UXCx0+_s3?Itfv83%Xb-g;TDqM1-<H*^c1?4$_pF?D|+tT<cqmfCT+vY
z8oxi5ELgz;D8978cLedP9MWXy@x|DxttEEA;k*AlH^niuVqL_0GN;Zpx2-*eXwi@~
zs9rdwYMq?Bdn{+r6}?foti9|3;>>hJr*Zx`E4WEyrQv=xt7Gi7Y^xYm!6DXnwc;Ao
z8WZJYUZLyYK;yNN;v-yMg_IY?H{TIKC)r3pyx&Q;3%#ez%SllKQXw*Ua#aMC*xN$>
zFjA`#u0~o*ngwNyz4hQ4YcX#st6E_^);a1iI9gM$WD2o8Z2rT|<wpkD29!C0--5~w
z2TCOsQHyizXW)%F0pezvS~XBYi6s}W)U-+J&XXqqRXbZ2HgM<ItlWmigfCij@wNOM
z7s&be_?k=0p0KPHzxx>xXcMbd1A?<lyPJ9TaXBWss6)%cn#G>`Kj$&x_kdKs6_8l9
zys6kaL0(=oD>(lnv2>{>>^jpYL3s6x(BO(7O#yu#=F^$PhiR<Lq7}>>!BI_MD-G_K
zoLQl4*s0t6UHzVJ6b<)VZJ!EPc(jcHs+`mxpSr+if%^QR%qYqARF8d&(>R<P$@3+R
zcMHL$Bq-dhQwcwo0m;y!shlvd?059J$G#H!A<b7yprt!Tu}yxmWP5>M-~B-$npH$w
z%<K{4q4~m~F)%Fbqb9$U&e9tfcDl1AkG}Dt*-XPKMbF}_vhd-n5l)sUjm`Ho1HmM&
z#Z5OCpO=|lm$njpjk)t84BFPEw_=mCv@g2^LcZmmmh#(sKEh=a+SIoB305KM9dGm*
zV)BKod+Z~O_rvV8^YpF0xQre7`z+{M*6B*gnOX4p>78VG1#5NcDimr;U6pZYWq;0c
zsFcQ!|NUj)iP(w%+R-&&+BPne8k*c}L2kd;G>moGj$`wDKTvx&lb}>lfBf=~Hzb#?
zh}<BsJzXE4Jlg?N;weiounyeqY}X>??`1u0?X7fviy>GOLAA@Oc9S(%sY)r*Fz1oS
z(+=7|jvbNl^zFT+-9#^BA%_$BLE8i~!iw%J<74*lao2~U6~5H%8dolD2*lLp!r%kl
zGiiE)Ld3vvb6q~d#nU_IdA2tX0lUP$#l(h!e0)DHdXY<W<T4H;A<`ye^1-5QI}49M
zqJ}AtKK|&ldDd!Y87@8_A?k-hCK0kUi_H(WbYb)oWrZSUm`Gu)0nBk1tT9B8p3{%@
zR|nl*`f}AKzW%yF%@*EnDIy*xj97N?gB?@7U0vAt>&%E0mCnQE(uNw5*C&(hH)U{G
z5%NkVnck~ULl^8k*C1^$c(L?m)f?Y6mJlM7q$t5Mr75Fe{m1M|cSo-12QHdN(b9xa
z<T}fQ60H(ZLyxxJpT4qDM?Se}PDTgKZBeYdKD->qm>TO22cA=KH}l&^9el?;geCU_
z&ByV{cB8s~PU3po?0FHzG1PD<N^nHJ^Dl{iP(9WfZ;x``U?#f7xjGp@QX=E!FKbGT
z8>AJfd%Yg5Cc(iz8jvZVwgrR5l#mm({}vzDN@t(Sk;&c{CTE?K6CCQz5k2>+x>=-#
z?ooGzd9{Lh)fqM^P#R2w58}x3bba6>W9Uwud_T4$@honqhQnh0rqp+qhUmi;od(5z
z2=N5Xt)gC&G=niq+6H>8`U}cG4g-AOV&-O8P??yyYsZ19VL!QX3zv8f2}ap#S@U=Q
z8i>!VFOfwt?s#?}t2EsE1w!tjucFvjy`Qt&yyc={$|(a6p?EDhZ%E*)B4;?(i~ag&
zTRcryj_zEMROoUv703#UR2)-d0%b!3yvS(BU1%v+<@dEP3LD@rmagtH+=sVwsutC*
zB$>WzIhf~ZJTt3H!>M3b?5_ghx-~WD`@oaXcv3ds^CyanX7e3a`&pN#APK7E64W)l
z*9nh7q-8k{`}z9&`IZbwk#U_7RAh~$*S0m@>cjzze+;w~YEs-CbN3LTTRU1S4ey)F
zBKaCxx2=%M=ey)S_PPBTDbO~gQa?<TlRXM7Awd?F7R5l}!^C+VLK*DlHyxf|m{)#`
zcD8rRX>c>jvq!0ElZT>c(>RDPNU?m4L#h{%QPmX{r|$P`WnRG+X?fF;bD4D+B4pKR
z{YX)-c*x8_w&f|cgPgl~;U|Pb614;G@sYYCNakF_h_x5*E%Yk!e2>YolINDg(e`7E
z5=m8AEcM1@C>G)rWq>za?$n2<<SO<MI3%rt<O4(RGXc|+tjn?=^TH(!2a0CiZwcjU
znjyc^rLAdUh^#;Y*A%l@cf3?o)3#l}dF__~o(qPBsf)j>tg%d~sh+DgX`5&lwMeep
zf#5_D-4frgzr_i@D{ReU62U^@=aVAJM8JewjdGc)vLa6KE0ZSU)W;ERCq?u@?0ob2
z4`&EceVJC~z25;XLTO%?Cn`Ow_Y|=F&Q%o-QvenIu7hrMz(f21-IKb{>fP_ZIQH^E
z-5a1&dlWg(_aBq;n;|ia73FHrqbU&^?B~9I`OW`)ibFT&axF7THJ6+q%`OatHT_|9
zzQ%@#m_A$*9hW*GK{EMcI}a5N*Q*6*+fL7(G}WXa963sOoNemfm+bipJCD5<bTSn+
z39fYf8^yr4Tj<%Y?5cm;GTksyyMce-HZ{;lcWDc?Onh*I9^Z?-Cse)VWY(>i>%U$I
zmG$b8wlh-_APYvT=Bgp{3hu^gVT8xwpOVsz3+R62RTpAw8UL0sYeQ2yDD)(PQj7j!
z0@LymNZeEqzCA}%iyQ`JcU~yMKq%=YIwaKJsq#$jB|>G)syl+}ixNiSbU!5lW$|O-
z++Yf!$E-lv^2efurR%A&&og(e7v0UJi3>A?Nzd&t&){)q+&|jLxbpDzWxkvl+EooV
zJPH>nQ9ZSiCvi&Jx_n}r=%0<Z9p$2KBz5-Cs%s{clRAn+>ulp^fkAcn+ii3`+zakM
zL+D?WsDAy)Z>#IpeTnFaFl@2Ml1zInbn2|qd|K?jw_8H0Vs&gMqIm~e64mFFUqe@z
zvaL7u3eARQa};U;!L1McxvsuHA&S29&2ym3NZ_B()U6u47JU3Ov3Wr^XF7mx7T0>o
zNAN&9)@+#VFk~@K*DR#G`>h5W`9NbKua>pRF|T&I8OuYbXD^=%#)%3UOL{A~#(mz+
z|Fv<QULd?K{6{`Yk9^FqH^&rJTToIzfTR0Hp=L93awPW`DQEU_Jc{JX(t!8+uK$Ov
z<%_;y7nCtl8!N3EWMsEimAm6Ha(|9Kh%nNnQ9-l6uVM~I6eo@iHB|0%AJJ&CYs0o%
zj))BMa%*k$GTx%oI0y`WpTc}fH?XZu&yt__jg+2#KIbl_f)??garJ9XWZi2zaoYgd
z8es=`X|?DnwEO|j)Ybf6=2dNqfTOE0n^&lm3M%u|P=HF}-?k>X^slHBUQ@FN8rc)y
zk*M5VD)r|5(ed6QT*4%648C`d=d0U2k;>)#bNuL$d!MFHcV3sntQ#frC`10tKmVPM
zUIo1mpgMH$k4o4vV)-^gJHCUX%PF)>^yl3pk_2CE`d>SX-g;A&GCW!|@_)u)h#O8<
z!L0laUF@~fhwV>(M>2q|Yr6b-oc!ye>`I7xni1jC$kumJ*n4Z=T>jV)^Y2fLxLzP;
z<t5CxK(PwCsx|ySe$Ygpjeh<^?Td0);>cxfpV~i$PzqK5Gk84BWK!JinfDK-ob&7c
z9?yff5W|9auBLqAiHJB9o=KgUe?A)GZo)91!4gFuS!;E|k7B`Hb2l0}3;+H3Ub`d9
z-W&*>USvg0&BeyK)E9r(54vbPX$gXy=vlt4=oi-r65f6-fxIoT6YsRJvKgKK=^wWw
z#fE`RDKasA-OAaB3QwFKdD$CrvCQ+EQ1%L3)2Y6wB5BgB-C_{-c7hxP|Mg(|p9ayw
z`Yo$k>eb_lajSO-&#zl5f!7}=&B7kkk%R?MC9^$p+0ayp-57y<^AG#SOc)B2!na&F
z_^fmr<K5fAwBvcT8a;Ss?X?K(;v50ck%lFsQhWGiIv`~r^JzV>&8RZ`{Q<571Br>B
z&G7mQ@Op7-?`wYh`?FN?`WEuG<;4&}%J(05Zm<+YTJ!=@+)j~=A}beR2uUBv1lJxo
zgfd(I*m(=g9`iM2>tgQ#wDs?4DK|(<ML*L?dN)i0OEJ#s@^#(TQ;*Wd+LH+z8jWvt
z_n*N&wX5hHSAFhu+o@fh0;uDf;Ft*tB29`{o_zU9XbS3I58#-oRF9o?ZDX(Fo%|1x
z|5z|AV30ZB{;w-Q(nGSdwNwMZ&w_3^6{ZmQ`SF*V(bqtn9$P=>hcyM<E4C!Ak2Fq!
zdM{n#?r2$zJgFZ1JFpdiWJU-&B1{cwl(e7!ZHHo1mjq98)BSn<d9Yyn)i?rOh5Y!)
zU=+}j#EJ^1^_&l<;Ah>sf5!Y^0cS9ml4imPmiW*j)EL)L0zx@GtQhYDobNnV)d8v&
z^6o-Y)a4Wo5S20`LrMux*FpWeE_f6)T7RyD^hAtjuycDG`a<#JA&uK<0=xMVghoH?
z#Cb}tp@m1)D18e6p^QBF#h2jc_ESSPLo02tY);X(^e04<{ywGxlD>WSg#6VWck;0H
zInG~IZ8*+n%aO&MS&Ho8gOuly{Y!rq9Ea=6Q@rOp09AHIl%X#k&wP`+3K<+Np9YIf
zgsnJxls)S2R}PjMBwQ<mM)%G(?NUP))(BKQ8r$!GI6D9k%IcFv6W6`D776Ztbk(i4
z59`_}=(s%(g3Ogug!zPujl?F6V5a$+{i%;P+bg=et>sW?LHx8c07TUQ?TSt#bpEZt
zR_n0XQQJxD(bLP<Ne#)4)pi6Rpr<b~McP@GLUaS=Ilxt5m_)3w>^S|dB7ltU1T#fK
zLA^5)VXe_1WS?^N;k}~UdUpK9!+y}|qI43W)Z4i_?0*N4-aU<PP~4tbS-i(fx*cBN
zpWXt%6=rT^h5?NJ8Yh9*&J+O7Rsr_KFKNsN4^)f1{;kAQ3j}t92#5TgAjvD!;QJSd
zqf<16J+pBKU^&)xJ98wFAv(^UJIyCx>N<cDy$(9R)JdBAMqZ;z)5Qj7%~pAL9k3ml
zqya!0q=Ujrxu0pqbtTb?TBD8k(gVQH2<hnR<Qx!>Iu;byy-5+6z5!&2sYI*Pbx>Zo
zkLXo#cB1DzAU~ax4B5zSnQwX~{kJK!k6PY}^)x&lh3;}qV<*Fd)_L^tiL-v9aHHXk
zfCiEMQV5@ei{#CjIhp6g+~P{*plVnq4fn&+O3be@9<jPhnCqM8<G~I-k2gp6$`kG*
zHX{lBht$GHKLVQE(TI=<QPL95K8+Dtc_;7g&jJ^jxP;6Z+@LBXAG1(%>4}f_ASzY@
z%|>wOtXiK+&wP~)y0~VA6K_cZbo9!bh>Ea2!LhpviyeU~V;v;2&ky$TwqgGS8=)co
zJJ6pbYdPVy2ENWlHvnta4-?lkJ{F3(2AV?vD5B8hef|4zeX_=0dK!V=2}Hh407Apx
zyWLzB$_K!1uY&%uai7GcExbqIi%6(y4M!Wqh~{8Sg@@0VTjgo;9@&Jq?_JVo%6B$C
zs)_yWAlpzgnI_02tXbT}x;cnE*e5e)&4knr-nQ?@u0$OQOjdt)RqJFjHGI*_cD|^7
z-(JuzrG$1eg8Xze)99rZnl{n{8p?t9(!}ZJN%D%02S3?7_S>jMS%PTYU;B~Eq&%2>
z*^IlH&Fh*5AaBBolzo2}xG$Kuoa@5{I_~qDoKsNofcFR}xc2tuG8$B!_$eN}(e$I2
znrg-3Nl6G)(N8OBx)Ckv?x3<y*#UWb|DZU+?7FV$bA)57iq1jk<PXh-S5d$a6#py2
z-0w(J`B)_<&HDmg7(!T)s?bAtpRXVx;JR8SZWXBgZv<5O(OM1g-yuL<cwr8q?hF8<
zLlOxt#4Foofo{Oh6KD&+M`dykErRKNXy*)c#Agzy$-pJAfIh16Zy>qA2Pvz-_`VhU
z9z89c{NAoTbK(xhsw+Ooy_OuUST29_M-K(ere=R!jMUp=3W>=1vp2t=?dcZHD$V0*
z97O1p?>Zo)mV<qsK#fNX-w%wWlS|VFa+o07QftF?zKRhh!7ukQM;LX-@j<g{le9*)
zG>M<!7QZ|wUON5P8@Oi|@Plwxy%iIntZbN!_k`G!M@Zl1rU@={S~#6fzstQOSpP9t
z|85tRGf9{}+>}863haWhPZ-ATKJV+n9K1GV+93llx%60(+Mnl|FB-vG;ok4@D;&|H
z{Lq)LzXo27Ws?qc7`hQthmA93ca;ri-}^m!85WT2PPDyn@UNM`OD9xo<pj>S3)QgY
zyCdWbsM1yd`o*jl^(1^6RH6;zqvNFMGD9CsZ@udbj_!BQ%q8?Z#mS1!xA#ZbvV?XQ
zXnw~{K39dUD;j-`C=LCIr3;6q1`B~or=8K~S3quiYHdP{tgXDn?;}v#Is&vdsR)yi
zpTO3SyxdiZ?a*uKknhU_s!~TrJRdzi_GInZzXfNaYUvfNN>+#OZm|C!XKxu$Wx9S3
z10o?(Qc9O}3eqJg-HjmK-5rt}L_m;|5RsDZ?h*kB36W;g-AHWWz4y$SIitTh{}1n%
z5gebo^Saly*17}?#P8E<!rl?s0S8?z(eI2}ifcA{O(Bx6VUZNY=f-->uv$b58e)!c
zB-i04oTrEa_O?&Tm*eCvu%cR1j5EQ>5BiXuQZ@wROWLBlwDF+l+lPtT9eMA7<m+k;
zuEE0E_=>9$B%5*-`RvaT%QPWLBNctT_9}+@$nia_7KBGIZg^h2?-mt{Hsd?I#pTVy
zQpK`4MxtaMDM3ROv%!y7@rBM_`0T&N&%^hT(h2khQd>DKG+yKzrD+dX6o16*u{5>p
zs%wosDfXC*%F*4MT8*CwM`5AA17LFV6e~JW&)S4gXX}frk`h9DJ|+>Tpvo7y2rK-(
z)fy?jvz0_{EY@QnHojZxY!`C#e!CtY)&h5%sv=61lYfY@@h&<P&r}zerJSJg&PW)$
zf$zbyik+J2T(2+v>H=x5v%q$pbq7HxElcE=M*pCJ=BnwrVS8=9puVG?za8nRt59d?
zi}zW|D?>iV`oFKNUuR`jm@3I_$ge`FR2P`Z%DN-S!~B2%W0q=02qY=yWY~#*z_UEQ
zXHW=P0Yn2mNbx7TqOKA&x3a0P`Wwh7uTL9;;irg#MXG)10JfLiwp&u4Ywr34x!uEx
z?i`5VA?Greha4NBQa`}Tb|NG@+_&m)CnE3@*Y|t%Yvefw`Ez=g4(Yg-#9OE1ExqIm
zSrDftAB~?%bXgQD;mpA5DJUjQc~%z)U5sSkMcrb7zF={!b_|x7P0)PaJHafE$g~=n
zs|`v-c;DfTpM0Rd5|V0orTP_BkuOhHBseBz0S`j*9qhfDJX;`5o$>lUC$(GL*K?-d
zSDN=?{Lqz-Mha=k`A2N;&aSg(`r`XDQuBM=H5*Aio7UwXf9H7}Q$^}&LSmqn<9wEg
zcl!|3A_&XL*{EW{{Nts7p04Li0GfRYc2~u#+Sg=)HQEG`yQQ^`qu{-!Ea4gDCL&$i
z@`7AOBTg4!<9nXdSxLE1Kh_!$V6Y34ya|%6pb(765T24y>~18lHlfI;QIOPjCC#z>
zed)kqpl|9r2$p;;TjICe8}z*Ez`kdm{<8YHSUCF98_57d5{&Uk9h$p5n;Nwx3{ry;
zE(}R{w_l<2=4JRdv~p+@3J%451v%>XUqJvOqEKBZJHD94_nw;Iau<2r4M^|@(jO%R
z)68l(Ky$f3&*Lu2)$tRgHhexV+pgF#de=x3BlJjk&(oy!>gUmlaW_5^T_`C=hA?07
zU>L~Q<hj*@FRA?YJE)*+fwU5mH28U<z5$cD<hdxX(Or!Ji}G@7VI|p)sB?3xmEpf;
z)BP%%@ZsJhP#Xa`lP(0Ly*YKP^K(WJeY1cat3(Grqo&jywM7tvkA~!Q=Pv=j-}?nx
z-z=I#QwR6KB9Jx=^k|Dim0G3xy(>uu`i{{><e}1?al1~WL72AMff$9^p7kC@W{!OF
ze=OLEr{G^*taMJcg2G}C@#y5Gmy*rh)-xOB6XX#P*r{cnK2e8U2=Rrpt<LZbe8Bvz
zLlp7Wi#XKS0`i!DJiA>ci@y{vd+n%r2{JY?(HiDniIi<w^(ek-u<((n3`r*B=d1FY
z_D3KAko{H11vMX|B)(z9{%u0-HV^Ngl?8a|jo&&HlBq)tQi~>u`@<lS9PVNX!5<B^
z{`$Q5DCv$@Do{NlJ;!!az-3T09)FOz0`_j1Av|VM(t8l0%CC>)f*evQ-OF#JL@!iO
z5mBOz>fJ^tN8m;V=-;(6i@>RoUpSiQx0r=k>O<PTDx3e=yuG~ljdy_PvjUAg+1m|9
znosU0;lrL*p$G05Z!BI#=_@de<?V!~YU-=JlC*t#3rq=Fblx#^QAPk)R@JV4P@`EW
z>-(mrB%E*uU1v=}0)llygmS+4GRvfo!Q4O0Org#Z#}sWy=t#cd-UvudEiR7iDDX^n
ztufd1si$yES%x@D98|+QGjnR6AEfu*`d?k-q~TO10wRSeNG;?)RFxj0|1Q%-)even
zW+c>kmx~sdN$ff2wZ~#dk|tvIWGGwWiJ;!S{{~)Yg;wSFb0rcOjqjWfGGCpwOfJS(
z;*Hc=FFf<-pbYO}oZPVvCF%Q0jL!W^h34~BRDlgm-_8LA^z$Ub_*C&p2L+aBpVmco
zY-ei8;rD}C0CaBJKBltxe!s=vydF9Swo_j3V@r!gh0*bPLFO?_{hF%!R6eJVTu(l~
zd#La%&sr^g1~@(}eC3VhiX`I&@^+2*p<Frs$~mVRmb$IcJf&w|@zTG=;UdT=QKUP&
z{?LS=jz3Q8>_i!KX_7pjV<`53XrejJ0<L-H*F~Ah<D7rL3y$wh@8;4d8lMECB*?3k
zelaIMo!BCkOIQjesYGK;$jx6$DMp<4S|j5HJ7kWy!ri?DEq$k&zSwy)O+ou$OrG$p
zX=mN0sftOrkzbCo!^(fQ9A>c|FF~{?m*>9WO;A0T28SGp#kE+Yd{t)20MG8;-PY%a
zKigjCCB7br%X>$>58NGG0PQJJ0<94w8=FHV7r3oPXf5QV8^Ojl5y{JA*Y|EH6=yav
zV{trjpyVy#KcRrYFgynOukn!%p0^t}5R^pDvpXxo4lG&QeWyI-NL_?g<bI|cagWxu
zuD)G=D#<?cVYaGZT!HKHhvFa0?!b11eTuR#*+kEx#crl?uVt&O%%~vxT+1mrz8H|H
z(k*MOXbL?QNOnF|{xV7e&1sYslOOnQ^6xhEyl4C5E|gF}X-s_C!Od_4d0u`Jb*|@D
zgH%f7*KkXUD+<=QbZO?KX0aJ=NF({$(IU+$47L!AeMeU63s`4eX4(R8Vf?H;B08{M
z`#w?s3lbw{f=23fqF{eqyfi~^;Ga%T$^7-T-!UWa&+@#PWFK<pW{daV6t0gLt)|>3
z4g2uaK9zMru|?C7b0v&4Iw|~Zla0sIpL9e;r9BYpU(CIp#p&sa5jqUt8ZS)p2#=JV
zEJ)i@$}@>r9FL9o`P=q4CTVz>WWdipm@L-$^Q;rHO!#zWnZ3pJ3ZS?orRlRuVjY+T
z3K$Rod=c6UX#AF6`~xxTyJvao)Cz~tp8XF9tr6f5a0qQ>Ll6K)vu@D!x?jfBpZua>
z0yx;ozSi~PTfghwUsu^bM?+u=xDh7>uUej>o3PK%B6LF!3u}N@*k22@{2xpK<m}_b
z8e?G1-BFqe)}};ilmGHeN~G$0Zyd8Ua;$d*`{;iS1OM|@h5)ybuY1yHrGeTFhr3!t
z)SLe0VXn-9e*#&x?xJLRzs}x2fyEE_fi*<-x$^H8lWrw-E9BdM{68?_A9(97<?zpr
zs0{jXvgIw;ub|-tjMO>*<=uzl;qA4TC;Ql}UtK#tIGS$?nza^^6=OO1aDZ7z<Ke%7
zxi!=r;0W%qUxqu!z866gRy|%1dArlDp8sChCv1=P)az?+*6ea`M%|xy`D2UzaRY*1
zCgWcd^9%icdp7oLMAncaJXMM*>?rO3(aP7MUyz>MWinxRa?QX|*P;9!V6YM79juOQ
z{0j~(2E*~(kL{TmpO{@oVX4lZcI&a5UhB%@vOCXLjS;!dZd^>+ni0ns-1~XaYVa&C
zSK(iWg(jWj=lZqAiFwa{yV`L=`y7HqhZVK_`dxsuJFXfv#249H@1piG{7e5TJfqZ}
zt~%moBsNXKu@4%@q^~*%+iE<ScoC^^`(GbMNb9&Zd*fJpeWhq{<X%&QD29DBoOZna
zE$en_d0C%{LsR$c=|ZP}9*e`B$@SEK87ftG0u8Ms{3i752zWg!6`tp8V&<=L8#&>9
z=~~1TanK~LYtl7^UfU1yUs&evBgka@TjxJT);@%F#)!D%(Y36S`z^}sjfQQ?RGqiP
zHaWhfjWED#j+iQ5E#R=*tZ`bpx(9ts^zrq-+=mirRvaONhvdpsd0K#GP<)TmtS>&>
zV(9(k73&Qd;#xhCfxAQVRSj(UtrFQ{{Qu#_z?Ty-7u+^KxxKmOnait-`kW+f`5=W{
zuUru6ymJ}V`nN_z#I>|S8h!1um}q}nL;v3<ix{#qnCrcPA7A|IOH&WuMdsEhc<}s*
z+b?VOUxO1TkQAxn|9yFrW9KWm(ZxR10R-*;b(81lUlwyUo&SAh08BGFN(x>~l%mC7
zj%0tQ5k6=l{eex!kPBP0N}T@|ZT<Z#v6vVkFXqbv>i=;Ua%58{HSAYR693*#zg<2R
z(>9i`HVgQbdo9-&HoPFns(WXil7B_H{`#K}*i;nj543pW4=S`qL-wpY;HpAE7^bKL
z{L_gj65hcpP@=~L7(2*4e#T%&gm?duX}AwSJ!S#Ba$WPeRSug-1J=YYG62pnc)boy
z0mO8a!vNrO)_IBpUU%S7od*NFPj?SckhTucWv9rTx^OqHt(<6L<O<X1cb+yLkcgiF
z+yBjLAak$PD44G}xjb8n0k+Aff(8L4ZvjeKzv==|t9Tzku$=+u=~4~2eM)~m?GkXh
zTfGJaDtiV1*q1=7^*4PXkca-mN*foMApou%0n1g#++m{>gr9Bz(|a9~I+C2iq}idM
z_E<_+!@Mt^ard<KrWro8XMkPYHaOU>54FyQrW)%#&vXG*VQ=jMJo88+9S{VYztjNc
zNh7?F7eT@Nh@0&*=qiZ2+=yPd#==0+*JZd_TjFYI-`_jCD<+~sLZ71uC=EQqn@jZy
z70~}Khg%=$0ybO6?y(C1;$1{RA<&02*-s1RK^@7|Sx{_e6HZyG?WIdqHxNtUr=3wp
zm+#$@e5r8>N??edg16**Iu8e_lV*226gb(cU-me!#j7bE=#&?1y(W-+*dq$Km9t$D
zc(ZW86O_DFny9oG;?~ugcqr_cYRg^dsJ6+w15z>WAoE;9!eRKb6}3u6ZG-#ou_5rJ
z4TD!6^A!cRpvoNgyAuEqx+dv4M-W*^Mw99slRnlcU`VOJO|Ih_|4^7q1o9@+w6eou
zNZLuhpwsPZCe7tyMs_<eDG%$iUl#m01NLXLH&^pF=cMpjycm31D)P@{aMN)1;1*DV
z$Z5dzu!Pb;>wC^Zo84iKPH3ugtJN_^NkFdTKaT2R{7BC=3P`CUlN{9$vlZzWPv3xQ
zbb_Wyj-!YX?yg*j=)5O3FH7*{aBSgtlfgMSJ<p!(OxG?vZKz<ojcWgvy_jjHO6F+&
zzaP5!R7@?02|*{)G1#RO9Ej(dK@a=OA}gYyViGUIQ$;g0hq>o)@Ev%Ah+Y=Z3SFM=
z&ClBbQ){dY^zjft@ckkT{MB~BP<1M8xhO~l27)v9<XE8o@T$Y4jF6Y?6h$FuXb((!
zqTQ5)PvSePZU7CCsjTB83yblb?~wv1J(U?s=nS6TQY(IEr8|R9e_4-DL`@tRA%)li
z*Sp)y#g4w42OtpwI|6S~Pi6*Sfn$3>_l%A_-q^<!BYSWc`Xk}!<5!TVD511F3)+hS
z<tK-eL_yHm0GR7DcA&t`T&;A@V1$7u^fqJ?Mjgqrcr*tmwu7pNKg|X~O5_?-a3>^q
z)AqxQy{03@Q;?lF&&MBo+tTLBu}O|Ph`xo8rm+jgev7COkYn9;Thjw|dI;ww<6!`t
z5kR@D;uLutK2(U>lV5{rg?Axh7wv{txXc1p4|q=Oa0hRK3>t+v2K@P$4JdMvINU;9
zjEJfHVgy!0Wnr>uM5tv|?cjv41&HHb^LgvMRjhst>`hlcr>}kC#h)7Bq=Hi}QZ=sT
z96hw{WTtw6j1ki2MGf&S-3@3Swx8r(=PO$I0YoK)03WpQ$_2dp^i;q?_wxcqUIL?p
z<1>&tindT6V!tJj>NuPb^aIXsyz&n?Zyy41+ZlXy^t{xK0bu0Kfbx?mx#%Qbdg6Ky
zuQ;plc3_~s%~{bI&SJyTH9V6Tw)o0l(|Z6&)@pZwpIDZM`H-7z+f<kjk)K~Ef#&|{
zSJ^F9tDB<LmUNG}g!dF)o#kbB+k+x}u=F~GAwKsfX5fXNf+Rv)0&hR`TLQAk{nJ||
zy1Q9$!GJDE2w@z?!^E36O!SUGH@|PSw^Z8oIeSe#d|ElW$On-P;O*n5$GR#U+cSLF
zYIP~n=?s?G<LEb)YgqF@G|;V(%+aniyV_C-48hNRq!ZmNv-VSa_dw~}*|oYMr<+jT
z(<1$5Z!_$yy}$QX)~8?(BH-4n22$kha3rB{uJF}Bu8?&1sa|a3P7e{z>Ynn4NVftZ
z%Rr1jv$r?fSbGYIC0mAt@Za1gEkC?_j&Ag3h=;lp3Zd8qq}v`XNE;rx=K<>xNCci;
zT{ePJC~AlcaK<U9pOzW3l$nf(5s*ewXu<g=2A&`A;5GkxUzCpy(-_wn2k~GTRCbo5
zpyn63<$oWL+>?Z$$=hqbeC&fUp7*I-aUA#0K+>%JWMi}^V2xts3K*6i1j+q)FclQ|
zDB8$tq1aS|5t#vH6%B{<mZCiCYb^>B$MCF4zBUgKr|CDDh++?ta;0s7ng9!^!c;@>
z9H60uu$GP)0c5?)Nt)u2Qm8!W&b8oup*M-%A)YAF@)KXetfz6DHbJ7~bfqH|5kZa=
z4@WZj(S2;>pxb!VUx2V;?}$^|d|37aMW;8YQhzev*=l_u`z1KE6XYUyP#<qc!uW!T
zF2;b}B4Hd%359bREcp(Xly6-#l@`Sab8~VdomoM`@VdpI<Mu9<(CLheeOEZ{HFJ;Q
zO9G?`bYsFEvo{n^a~6>O006RqP@~_WP;B>vqF_}7KR0YKnXJX=aSkvH8KIKKEfX`s
zkuhxR<rL2l;}!(f^6rF`2(c{}SBX{>P%K*1k$;i<fPDj`J;xoZr#^=_S}p@4*dCRP
zsv&2dq!=pi#=){9_xP%E1Xfe3y=w4yP3pTNO9>Hj97t^bs9YxPyuvnurxgz;Jo)t2
zNoI(=yxOY?=dtVjwVf~yTI0n0cfG=^Le5$s_lbX6gr-^t@B)A+VNQbiTtVW;#}Y5*
zZmL6<fR#B!i(LokDQTt!ytJ8i6k8Rpm6wq#py-}oqh;-HxA$iN5UD!&lLop^4(?yU
zoh24Hk}+9A08I1B^v#ei+Z@wj?)@zia&HTO!+U@XD4}-x0x+=SSm-Q&=)mv*zbqq=
zHCULOVX56%zZ&-uj`>``jbAOmDPa)45JHqh?a}?*dxglP97i~0<Yx?#5RpR;v{ZPi
z0U_0|Nd|7Bc_qP5$RR|_CEfmU5l~2vriGM`2-DjnF3OBLeZ878SBeFK{mF~Gl%IL(
z0HC8u49a!6M&Ts%b@jXsikK*1@&fpvUUuz(Yu{6dqXyl9J@D;hLr!!JeX#aYOk4zo
zLI|JhQ`?>Jwl>^v1?p%Wm{vHHIEDASIFj4q7JxqFWOC^VpP)7?av@G~Y+kF5a(miQ
zwlK~eLz0jx%9%GwJn%AITNK;n?oY<R!rOlt%y)%=7_njv?SFaSh7~0uq$nfGdiu?E
z@R1(*#Vx@LR)<vF(QwFvZE-YX#QBX=ZFOa-x%;E@xR3aiF7DWgf66HxK4rMYj8(#l
zOjLsX6dOfTk3HNUm>dVSM)P5vU>eiivb#XKyTOY_fChnkTQ(6OY((Bhk#E`%-Tai*
zw4y29v&qr)jo#3!8lbdc43KKVjR#-U_HYi7UwLEjk`|8CP})_WW^(Y+v-^=S-+8Kz
z5~2MAp6b|D3b=T?ml3XiSG7K|o(H#e-JlBfG#%%#Zfu02p6L7HQtp&ZqIZv4P923A
za10sGnYz~L^%LCx>aXeJe^6eB+J;{!=r3A_vT-X-bV7Y$fODy(UHFv`fhLWfX!wQp
zjw2?utwmm<+16K&T|vG1@cU>qV~Cmi0Jc5#i|~K;!5}tFxqnZR6Pi2a!_dQilBx+n
z0Ls<VxATO_M$IT5b<nTLF!WOu7URw%u^CC|DHb!IKg??t?*A-YSfag{cBJ|D(Zmu5
z(Z^G9d*EFZ1pgH-2iIQL93_1Xl6*O>{|!KgmPX&T#s28@e)1fT#g}xY3FL*W($LX2
zuHh-n4S$~PcCPZ;IFY$ITB5EMzjDNEC7;CzdiU@eNMl!#pKntHgUFm_pKOdDT*>yO
z^I*UuSP7g%1-mFfg-Ve@6!_ilMPQEH^LeRw8j8tv^>f4S4XJxhMm9u2Uj$FmHw|+H
z@4|+3TcJ8;8tiL$_wm+;%mbHBQ-9#npH632B4)+ZqE2HSOp@^+oLKEd`HA~<2b!p`
zZ<2FW@n%QpB-7H_)0#iPvj9>a%JL`CLnh)9#1_VJ^HMr=XK*P7X2Xal-XI8jM?-E?
z{9!%|v$pCySn7c}!z=q@ord9{ww|@%M%#@BjhH|%FLc&@%%kw!>8p<krZ7bID-lhe
zYyNo2e*ib#?kMScD%v{4qCeti)QPM?Ve!$R{XFFCY!oF%q`3K8v<Llij>s`KUele$
zPpBuHTctr)@cQ;w*N&|BWJIZ0{rItX3{PMKDfDwMTpJT>KCOu0?|P)Q>Xf;Cia~d8
znd4btA?^{T#R4%vMq#d~Duwo8QZrFcPh_o4y?L)gqUA<;U07wN-iv~rjFsK#$tB2M
zb((>1QIk)c&g~1AwF^2sv`mL&%Z)t`BhieR&d#gJt{Xlkk5uRS8cVrU<1s4C)A-@<
zX(njn*Y<CQid21d4z98ieHhFVE)<yE6)3!xW3SI<Y$^i1_ifwjr{c@G1?*|wYg7cn
z$i2RfJSNHc=gy4~i5~h0xq!faJIdHT;;xYA%U7tSMhn`u%AY?#goMzNFw8X;MpuOm
z-zEiC=y=lp{5ecSAiDofLkhAO%+NuZ-Y&zFoB$Ceztt@pr1RqJI8CXhNfo>P31tHy
zHMwBp)lrw>1R-=F+;3-M4{0w}@ac<W`#}V_Wp^~nM19fi)O#sum!E701?%vKys&CM
zI(vf_3*oDjUFWz@ErNzo{zg-dBqcOaG+HM*+xY$p9*)hnLhTLAf9Uk)mXZ$!#hzmA
zz+p#{mFAO;7FCk&i#r`ScMp-N`?4HHdxFCy{eq<}90~<VM~c##l*Qj2v{g!oPq%-F
zb?t;;D`n9urX{~m(m6ld(SB*RAWL59E_YNGORo%at@*jE*7ew-?Ox?DG9;ok#d)!!
z*SF?3q;w8gW8_$`%G0#(P2`O1G}$CJrQ_OLZ@~L9;k^>ii@EazLBbQ>R>hWdJ6XNw
zru8jGiLXSIG}q-Z!g+A=H>A2poMY(Ui&m=3xM;!}pL`aA=KiPm`tj`R=x{!r%`&;O
z-)TiWkjr+q!}rhg%KZ2zoCy9q+<<(ko{#e2NS>=(Q&8j1Jc@i&FG_CN53wPo4I^u8
zs$}z}RNAeZV9#6~sG3>ZOGJNSeAuCQvb&+f%H<gT<zzfYc|<kl1xBtzEYYazPm`49
z&%`#a4AG22d^_E?<N=S2?%YM+8OS^R78JqT)82y`AWueZ$ToyufFt`Z0kVO|CuCNj
z%41k@lfo}y{`?DEWtwLOwLzv}0by1sM|B=C1+P46dAk^7k<TN|{E<coBkyDzH)rn3
zk6SgT{U)^-1_rs3cHpcxcZ%Y*n6IiM(goQtkeADvHx1UAssrbs&$S5=IwB2;JlX8;
z_@Gyb96M+MoX1MJ5Tlw5A|xeW%oYBZIT?l(8Ee6LDJ>oG{JFNAtZaG`UMJ|V{aa7d
zlj(Z6bDLh`Dd*DtnBK+0%33<s)1_naq+mVPx+raacN(BKEnjaea7!(Rk8tB)sr{tA
zs)M6C@R3ADn2Y1c^Syl4@v3L6U~?hM{c#m-70dA$w;NVte1YN@eiWtC_4)|DmGmnp
zy^48P`(op<+}xmiLP1VIVxz-ax{|v=&YD(ld2&ss`p4lte$D!p_NxnEhkr2f@HAAF
zO3wtGCx%RKO^~V4q3b2J^E<7}C4i|cs)u?|_3`;`W+q#A?#-$~LPzWk@GxG@OJ2+t
zWZ%DRYYy8mq`P}gyD}AClNps9G%%+8H_90Jop$(E<%+5zzwS}hrtX&H9p1ZT2Tsat
zrhcZTqg>J*?C6LF3<*_M^{65!nLG;ZNjkd}*qiM-tk=5xu#T5uh{Vw$5B9kbFxFlf
z;5-e)0Xg6DWZV%#*fJuSR9Sm1N;Ik6l(zjLB{#Qf9aQfD+J2eBOGFmKM*zOr^Y{Sr
zj>UH2>uuK3WnGz%5Df&-*o$yN-!AhZzwhosA|+f(BN8RLOD+DXrgY&H)%~of-9onh
z<sOCaw)(xVkFwVb9H>OE&|8VyV{owYtt>7vpf0zdST~wzkh{_6T|H8DJQDmy%9CUr
z3i`TZ&J;|%d~15R%=O=Oo<T&OEfBX!jj;P4VC-?s?p+SG3b8%an5M8HurFvf&)2mG
zNqv4{Q4iyBV<IdNZk3G=Wr#SkOdA8|!rklPl?#*!j)_NsHV_dNmgJM@(}!W~w3Y9-
z-moau<*#@I2OWXS_cFWvNBI=rI|iHB)j8d?@jK~@A!D+mE=03eIor`f>0+{f{s*BJ
z+roY0vUq2zD7FK$1JPls9KRPUY^mVDy>+ZlRr@aGa~w}RB2w<pW~R0M!uz49N}2%?
zNv8veogSq7kIJOhp-+-foi>9{Zo|+II$ghiq$OqEO5-Dc$$1vlO>SU$979m3&G~9Y
zS*N~WjN~)u4cR&)j-F|?RGy`DPA=(mAdeWG3Tqe33QcXRPT`Sfwj$vn=n(8$hElX6
z(RZRL-7Q0%JnW+a{SuPOp`3|r68Z!LYh~U8K+UHTt7a7)sAfU>VX=)*k79cWgKzh9
zxqbf2Ba;&Lsi;6Etj2QMC&yG}4fsKr4qqR9HD+x?cx?WxK`8KJA&dRt)W<}aa(z4h
z+Jhhk`ol#`MXL>|@IdV$DqrX@Ux*MJRrHW7%*1z|f&OmDA$&WWegGD~Yn|N|vO#*7
zPXD=va}lNcK1tX(O(qDdU;>KekvfJdgzVIgy9QrBaw^qDOt+5AV@4AUKCG$BKOrYR
zGz$P7Q-`vokyBRG9q5&x#2rY|8m!%Eyz;yxigrd!?=MnfE+SH~V1MD3wLUuquQ~DV
z8kB2ID1;-A{DvzXlZWGECG~;#vu6pZBo53gXNQijbgkNMP+L$A)7DVtxw^ELmgvr!
z%QV873c`xNLbqPFzASQxQWo3qRmBFk+uVz>FqUT!Dc=zCrx>I?xD|`ZQ+9e#K02l9
z`^6zxD5K|ToUPL}j6h2dx->v45>=XmIr{Y-=3plZ&Gmi0rKln1eU??N+Xf<4KHC9#
zi7m#rNDQJCn)}AsZVDrWM4F4AYAVlPj;)-A@pR1Nx-Fy`&y%-%+#YN?a0qU_L!#}@
zz;|qg=QUDSa_IDSg0Ol9(s#}&qr_6#UL6yI^<z@3o{}d<?n%(PT>iCoWK8Pw5}kt4
z2Nb;3$3xDiJ7_BH=B)5FOa8-8y9a{9>=V55O-Ej~p`U^TR{fyQKbGPj-LmKijiFcA
zUZOkB0WboedmWbXT37X)MB#~($;a2C*t;6t{<T3a?z^m1@isKOy=Co0X@5ihVq5qA
zm=+~qS_ENYYy8w4E~QS;BJ&YUuWjsXDHD*Hla;;eZ0ijXC1ei7=@Z^RXp@`O=A<q9
z5ie|6V-GdrcW)y-T;P6pcvdJ`hhE4?<-UA77uJov%~MS6c1;{<N>$qIrKsg*9q)*T
zvR`Gxqij$qa6n4TIx{vBc2{5f90O84iF5iO)jd`c6-rk+`yeDFq4ujc>wuaZC@m4m
z>XVU(=di$#blv?S!q7iKb*;<GnA&Pxuu3K;Frfp-^lQTx1CnwRhclcWN<8Qr8#eY3
z7l&*|H3ePd5&#j&Vh%#1EoDR>-6)dbIKCKBERrUG2(eWk_h{D{H3FT|W4ZcqG~UUE
zu@TWF8;)I{mBI4FqsSPu(NqCar1HRPMctH`L~fDeC}XVYfjfh1y}F2;tjnS#JmX_|
zvtT2LJA02e;-nWnWN;~{yt9Y0vVzWAJtM(b_#7Grqn*H5!;LhIClKe$13U`uZ6=r?
z8<g%@&R>iZkTZdwdt1Q9Aas26Jr?pf1f6_&$#Bpd&&4$jztS{(wBjot_P143N~4E~
zI5>7+xu+>QeQ~mT!YTS9F%h&gAq@wb3CB)`31rcsIZ|jKE<f7PfikhZCGg|pF*|^)
zh?92cY7}u)1fqJ7Px12((qM&ita5di+TM$lD`M($!ns>!iWUel8G(4KSCV>`Yvcef
zlyU4Gxpz3)GW11dPsy|&@rM`=v|ksMJxh7cV*f?Uj-+CY#m$iMqNrMWq3_W_`43!R
z&_iB?Mu6lu<eQeg((U&#u?4BMEZ&<1$w>&s(P;9(bMj}|-DZW(4NB_dqitjix+BI|
zeWJ|WZjs>bJFgFmzTqT<FR{1qEFQv7lDaeMqwwj{u|QhR!p^|}LHv%Wm*<4Wd~JHZ
z;*_5w3RWaSbFJf7TeuDr&I56+X^s*ps&4r;0h-S9tI3nf{pa01eKj<44ycF%Hkf!9
zD9oc~0gawcZC7b6xEM*37oX>K`UH-1w9}y1_=#WWMD($m66d3YpkdzXKG+YH^5?54
zKbqA~9;*brpIM@lPZr~}Lc0pFp}j7SoMvcg4SRjh9tr&~5}cR~-g<i*lRl;;aq^YM
zshVYW3<*=D65;CiX@oXFS=RF(C$J&f(+xS_I-6^IV9kF+5+B-%uo*doa5;FqGd+>y
zfbHQ=K<ewfuot3iZ!cu^#R7YK4w1Rgjf0-z=J8L$5txG!g+CLat}SOA%%uD<?gc=A
zG5vjPH{(PJMOe3^DwT-R8ZX#?vj0?j=^{Be&O$PhP~hnPwLm7me^W7%r6RnP<fIIu
z(b|F2@-(Ov`I0{wZCSfHgdkMAJW@&1qvIQ+NU$w}a%^dQ0I<~`%so3>(rhTe-?6}6
zx%Nz>xwhk@$D3$+yV^$W{#2(A6~}C>q5%KAz)qrWLF~Tf42dCRK6H3B-l`*N8k9->
zaZGhq7s%<gj(wIuh0VNHhTW5M=7SdKZy;w7cxwmLNuV%;h7!3KeKEfE*x)!(*M7qm
zhX`xw3U2t_;;>kix)qdAuU#JHODE>`NjHVx;uZx@6)R#Zzs`*k-LZfV&F+%ZBUus)
ziTCVD3#~|+d|_BrLllzX{jj1OR))MOm@>a8ot_V$%c_V(tD%_?scY(|Z8G^KSYKCT
z(D?Bmr~^NR?=-xg`P@9wDeJD!R#7FEN_}RcO=3{pgrhLddeTg1Wv2QIK6`+h#lhTv
zp81xpTrQe?3p>+9zy2zZb98DqHI~~#aC|h(`^Ch#zE!eb@tl<dcYeOdWM0|pB<d78
zapy+mOmguQ0>iipf-z!wckbP}&NIHT2gk(a^SVs(@i~cJkiRMZ@pxd5M5Mm1$H^~b
z-f>s$vK_By``}Kz6AAP*>}Pl|5F>L}vHmCBT`UJOeOklrQH1uNkP7|whkHM~L1aX<
zXuQk!wcz24#WAV)^BxHbEHcKos87g$-WQsh@w!1Et4Q)$z}UcvzaKs|hH+E&)t@|?
zaWpshEFnnzxrkH6mwTn=PZm9n5E}ZJ3eR$4or3yqvG(UwzIG(_T(9Dd-C#p0y=yFC
z*alHE2|*Z)<U_ul7%>a4ML!Y;K_s|^R#_nPZn5cp;2Hqj4{vF7QEApO5?JHfGsHYW
z5hrHuQ8qvd7C`ah8#3j9?1$pXiD!k7^p(_L;&NHKOg*ZiS)ue?2;pwT_rSrxLD}d`
zb6M|UQBV@?)m3fz-qIl!t)a19Tm@7{7-(s!_6=5$1{H@hF6~E=RP3~6G5)=VasJX2
z1>9|)=e&J#i?qk{lrn;f%)6J;2`c+ibjV%TlV}I=7&cjF)Tar@3R7Up_tS`UvC<B;
zg~MUQ)RYqvXfqQy6G00kKi8b7N~W%*$wT;&ad%xpet4D4#~zgec#4_{*B&5KDc3q1
zeu8Vq1ugX5J>sU-`RV$ePmmW=Ojdv=`l{&C5=aEpMZWb+b4`8xTB$?W0kE$e&E4Mm
z*mbRRP4h`g-Cs(95K#*of6(FbqKD2nRCHjT7oN{D(9I|-R-Y;#;=>e}>1N(Q#DuWk
zohzUPCK0gI4_4zr>Ok<+W%~Cx7$rn3W*Rr$>Al5?{i*43KNebHF;hPt*ZS^6X$EMb
zje>#qsqcAX?yBE!>-i|FZ%oeMr7fk0p2*>~vFL|JyezS>pkS?Ewqg1n_xsby+DNaB
z2gl_Nc;ecZJUr}nG(STx9=$2;vM#`N3-2$=#q8}dOcdH@uCaB%vF|8Q&7?RABZubd
zfk;)E&f&-_QYpYlOk3uIl5>-{K2ZW`ZQ+P(4eKWh%T{l&lzVZZt-SAY)3tW1d(-m6
z0%T&ASEg#M9$sJfI59V4KVD2Ju3~%fO_W(!v;+?nzjZ=UK?p?7&DqU+QWx<|xKI4@
z({e3MmBF0F*^4aFt_fKQzBLf?$R_9x2v^0;R~h$wWZx&jvhf$i|2q*sl_ZAklPsSs
z^5KuOdiA|8uWnZ-X8ESmf2dg(l1SJW4g?4Ndptln`tUqn@*nAV%8Zw}vMVm%^nqNG
z2~C>i6Ov}|+X7bNyLC~oK#Ec_s#xuBZJVVvlC$E>*g#fagqRJ^8|`7Co$MOR_cfL$
zDbjUTCxq%(f2U$|3BZP*n~*r>6)whm&oJSkFXxX(HTIy?+{WjW^<is_lR$6WwtDWu
z`?%UvMfWm{v%C3QSYbOLF)h4@pW=7t@B9w<p&D;kJ%4JF@&6bS{mBU9j(^EwPy9+N
z^zQ`rFHAA99ppcFC8K?+)e`E8|AW+ljHoli9aPZwn+WzlIB1{%&YPH20Wo#lf4<j$
ze;!8rn=e7E((*rUf{6Pm7QCr7a-QvfulyTZfx|17fcas?ZItjEtN*Wm^Z4GIZiT3Y
zc!huT-`|uCF=S!|uv+q_l=Tt)m2UVO#fAS6NQ`dDzfauG_;17>&|=&vU?e>Le_ieg
zHQyY|F98&r$Ap>x;~OZEq9{LT<Pbm6F#C-;|DR3~BSW(+P$#1-K>PpQ6OL-A;Y{NH
zqY<8b=!s`kiz65I=DYsy1o?ZW{P{x)<fZQnx03EBx_|EpWihc11w<^rzY{mVw&W_+
zLZ0l&_GG1(b#}@xgY6$;0Z%YlilYDOyWgIpAPX}1DOE=5tpDB$fY~SVzc1}jc+2y;
z;Q!c1{rL>xT*dShkSvs-{q3Xw{x#(_7=|fDPt?i&{o!bTPMEjj3Su9B)BpT6vOpqB
z81Mn(jzJ^vTW3B0UyYCrxK2#ZGXFXU{L+koO2r0WQ1o^(r~dtVF<H<Juf$1yYrOyb
zI;;mLQq@mMRR51|g0Bmz_*1_<^gq7_u2S#cARr*z-1KZ}X8u(<Z#(^V8g2I^#0DE}
zcNb#gh=$dk9=xzij)aWqUI*z6LWX>Jf`#qO7r4L%A$>#1uZOo#(h5qL)#h*PkWasx
zd^elt-#S}U;os1Zw>9t3JpS1Gc)bgi*RTyi>Lmg)B?2Ov7y=T`KYp~NKzeb{zM-LE
zDo=6@`IrCo*T15~S--Q&)As4rOP06z0#DYxfu432PCEDwJSBPCk@3{s{GSGiRidwx
zZ-&6~CP}|g{CXd;YUChC35$Y9C4iVPl<t4ALA40?Wx@jfX?+pijGuuOm;*0RB{Tw+
zTyHVZ%<aM>)tnS%7G!@qN8tHa2k6HAc8xnVyMSSFb&g>3&rg8Ar?NCcWU4r~D8(7L
zaWKv!=jAVDf0zXVt=`2D?v(8g0Ee7FDZ<pZl(ld^5}<mNtvsFqrO)BaW|F>UK#VA>
zuskQQY(;wb-4;kR6zwFau@Ha#5(H!>ytc*MM>HOw4H|*R+y~lKpz2sm1d@w5znv;4
z!1HPZa*-)Gcf=m#Q|-OR{Xtc_h9rG&#&|*NF@`jQ+RHmtQh~sm<)fOe^4XTb%_h&B
zrwP0;R~=kkunl+WnBg9k$NPSc`g?cHq8mDmrpwd{2cuv*!`WFtYt{k-ipwS1r`sU&
zzY8>q+k{DEH%bW5utZ9XYEY<vM>}8#7=79U+2GyNflLVbCj5Bg0W$6NK#)5s49pen
zff^Ix{_n$M83(OW)=C<4G;nSBpwT#hQ`fFK;caLeP$6#7r8#z#i2zTr1lo8B!=up3
zwf8;^fDbbY$Kcvk_QBa?6?jvi*8-rip_e|RiFOuOiWDmO`aZ5e1JD!Oepv!<;tU+?
zT4#bV*w%Sw93|ksSqa&UQ)j?scm`M+;$g{&#fAoV0InCd2S|27PJl_;>;T`=>s=rv
zcZIXrVL+D#*Xk1ao`Sy;qEft6vRej}A8buLXWycu5yv7Rj>zsJ-l%Q8Du#gyv9ras
zbDMy97x^Z%u9vD<U>mLuPAMKd1vkPXI|YtgtlIkPdMiqnfI=j<WVKS!&jyz)8vO78
zI$^$UV4B)L3o`2~;5X7*aGyp%PMc8>*vNjkVY>tZa%TVyxUd7W$xn@gPI>9>&cF*X
z{u!eV81#9&GcH4zR%0mYd!Xp$*bZn%4SpX&rE?b*Z6LLng^&5LyAKwDI-N5w(-zDy
zpZh$t6i>aL9B_BZ?`(h~jCmw{jvsW5LJ88Q#z1%L#&u0a556#yR#qn=pc(gp>$Ab^
zv8hA3Cvy!*3UxrNErj;Qn&NPR8yve5m#s+pB<v(NXrIG{o_{!90`0>N6IOr^@K~KS
zPqic5bU3%lw}{FZVB01(dCfU<zLr6OoX&@}_4|z57ez|JN>i3!08GD8byesd;MplP
zC5ScbbcfiZH`6Q}p8=J0+H1h>+o)Mtx*fATu4TX~)A)rtGQ<<8wVWydv&BO$s|rwh
zC}c<Q|MaW87}wNgjdBMSe{*5*@nBkzpDSBiY_E?j)AZ(T?zdNaW%T;K>x2^{ppr9F
zFT8%{8}rTlJhs<sp`W-7L@!z1na0UDFL`sa9CSz!YccCv$}V{y&>nQCG}xW&OLWA6
z1)+g9oyhPWyQf=ZA-BG~EZhb*?riD|hz{Za;ggX!>eM0L^B_+*Wji`X^qNm$?{-p`
zZgTdtrUC1az*bRQ_FM|{10hex#qOw?Gl3q!PAsF1swQ*5O+3@-avt3ff;-1`MT*Qu
zGrySQ_sV2G?`HS^#@e!3><ssnjPu5~W7q?EeYOK?g_H@v&wTqy*gLkI;Q@^5w*|Tl
z@69b;@drqA)KsoKdCA7Fx&#@q(lzi*npU3F#+N&0VU^UzOE+<S@6w&5-E`H>^P4nF
zVwJH;cOcWs^8>A@2$(u$UD%_tqwCt5!wkL40VDv2>+2s9N&rj;wqAG%Pfv^wRcYGW
zDv5JQbi%8}ym4}D^|Y}c9s_PyF05HYiQ$EK7jTD2?m`*_g_?1GHUnWa)gVC3V{?x*
zrKxU!!z-T-(7OgFe{5j%W9jJXh>C_~K7Qh=Lfl9`wP$g8$LvSz0PnmIs|~;+6r)8h
z*1KR=j51*AO=ur?>GsjWtw^P_wiYbJ?pQTFR+SM+KpxVrQ)#A+_T0)|22@kO#bUdW
zrlth>LvWw$6;MquKrzP4<{hP{Cq~visFWQImeX|Xhm|YNhhSlMytk)CMynoC>w%MY
zmMQmeLT^!%w8<gmDfPz@D@LePz=7KpV9OHGGd8k)Q}KG|NbB_Kw}wYRN<c@3N*bJ_
z&!V3h@mbM(1J<b=O>*+b=zX}>d3QpVWk&kPn{LQ$(dFEyO$U|2lbLafH5AVib|+qW
zET?>@QDR|=*yb(3wZ9xrzSoZ#!L+Hp<q(8U$Iz>a6!cSx``gn9itBjtqfSfJOf$GV
z^wg#sJ74CgzozsLq2SLv(W`vg7q*i}aPP_<VAqAsE_<oIwowkRk}$wd`1l$WmCJ)Y
zjPG^+(gDcFN#I@+wjPTR?;KdSFxEZ6*WcVGUJy}i){tZHRv5o3t)}i-RIr88ZjmNX
zefuKlp?H)~M{^+6V|v?!Q1KNG2Dks2c8Vl(d37wyyGxGZ<GPF!W?>2)(e8F+xr8;y
zj~s|UkhpeD1tW9eEsdb@GkeT9Nm<h0%fB2h9gcSO_g~jlv~_>-Yk=`mOr8>rH=zi1
z5&6n$7KSGySmV?qNbXFFON~|T=mP3%e};54ochGAGDZ?(IIY3Jc3e4Yw2|JFixeTy
zv?-K?0Y{F#nMHNVlR2njdxJtS@$fF?HEIM|AlMY-VSX}Q5fc1R$(@1gMegUKz_4Rf
zz>|V&1FBsIm++5XJqIKtB~_7o{Vb%e!%wXA=hmWk6qD|~Y+_G;N}Y)QWUfb1nx_BF
zHV1h%;t~yWfio4MJ?&@H;4mK@{c<!@y~EvJKxm>@z{9R)o^WpxP32Z#5qa*nxMjLl
znDbO-+@bejQq`x8!%tb!vPZAC-b;pSjzxb>k<-+;<IlAJM*q8@^)&MDaTfy}PDtuv
z=hbO=5f^vS)AWf4=E+oOn3575uZmP%<s~u~72O{~CH*CfI@v@i2>aYx2<U5GetCYb
zO<q%^Ri^`7dPf@=u`%WXof-m)%0J7}dRj`W^V>vf<9vBOqunz1&1I2{AC;L1b5G@b
z&dTw5qQ@&66*=D-(@>IU6;RcCMl1|UCS(~gWJ7Fb<Hr8l@iAdXT>*3Gj+;J`BKm!y
zKwBCXqcdBf`KV7zA^|wuCUe9q1V#Pm>WnwGNprRX8~(0L{{dEEqlS)uauNCAPL?CE
z*w2Bv3YmX!!>q30hS$2S6{-~Eu2R&rCLAL-MSK{Udp1|T#Pa(xw_t%}B;eSp;}mv(
zUS;dk{utL#eUgDs=haa#_9csyLH*kp{*SpAHYg7VlCwYPcr~#n#~rtfJ}{s9ra0i9
z&37k7q1Qa%kdSxK!?x2OmZ$Tv2?w9&v0#k3fa>t;XDRhk?HCfX=2(aRmLnTI%_|UH
zU_v4>(-feu>@-(z&$oOvUI(vzZZxYaRj0r^%U$FXNdijM8qHqAm7i96?5-g?dE3e6
zpGV|1{KKPn?$~`6RK=>~_cEfIEhQMxT<#7n8}b-y9C)64*iAQBN_(pn+MVfYPUir<
zXYQp+%09y<nk`#sHT+ezuOEYL7epbzpZf!@x!Fiqt*W!WtL)NRu_YlbJHs;BX3Y?W
z+F&H}?9XYefu}2>iDetC_GuJ9%^)2kFvL5R{8kc`CSDfbjBbE+ABDN`A(G(_wu`(9
z4b)I)JE=;!V&H#H^}Zxyz?0DZEMTtORX{h1$iAb<d@i=^=({0d&bBI-#fHF2sE1_J
zmiYrdm$^)itOWD;0=l~**Z8N!t@LQW?Db;vv<s})vw+LHY`$NKF~obCW?%k{a5I(u
z`I^oNn0P@0^I^gZc^|JUkb4<>$aN}SSeX=8e|Lu0ZO^fU*5x*~0P=5#_e1Ds!BvI4
zuAhWdyMP;icLP4C+Xcrk)hukTK%C*>ul-ijMS?4YgdlsP`SG*r3|uDHpLPunZf#e#
zx`Tp;3R`N5bt-xa-NhdmzdY7BdDPFcWDYQ$H!%tZb81jY;}H-blJ$K%o=b^t*4yuF
zOUt-oeELm&?Ow&J4iHhRY0iAos*8QO<o7egcpT+nl?>_V@xk0kHzt_?H>pjo;}V&Y
z;9fXiJWZhTL<Ixfus#2Nauj%I?`PK9C`Ywute$@!p@vV<<RA5R*`Fk6K5Z+PD>TCJ
zGpp-RsGW=54p?8<_xOHJL>F+=qt@Fh<sXNSIetF5|H*Ygw>w+HTqw^~Tl!l=S_>G6
zNmOrTC32QOjURrKS0n7h^iUx^;>xPhOw1WzBN0|-N^PxK!Tao+@JX@U;Q<*tuR4>v
z*d<^GGk6m(3i$}AGyPOqE`B%i$o5%U6B^<5m}Cn$W{uTGl5Uv$Vd^wkC!X9*i0d>W
zIm|Kgp4<WzIY{#C^4@2vdR2<8U?#kp{zOz-!2e?Lw}auQ)Rz|~n~jCor7cY-TjM?S
zXH=?wx5Zhe){ReTEd^}ww3fxR$u62i6|(FO*y<L7lucP?Yyq)lwxIl*BuS1HTl4YA
zu_w!nDcM!ud_)3GhCqTiO=v3IH|ZPx=*2YP(KiwZ1G0TsL$6gu2r5Q-mPvVJFe%cO
zFSlSEe^>QV`RLsHJG_U*#xvYGUZl&NUpB!B!zCMHY#^SJB1p1~{{!2he|NX$MT{e!
z(pz{`pR~+aGe^uIoM8^?lKP(+Q5#4a)6;hsXz_fRtTfM|{_Ptrxe-q`a2@<}r|3gc
z=`;L!nm?V2?C%d*Xsx9vcoaq3Xg-ao^aUcCk?1Ol!FyQU9Z@4NBT=L07X0|%S=8ug
z<$<K&;iy_qM-=H2&@b;qq@8+GJdB_akI#+leqG0Q;7t=sqGOU@Qc&BK3O9Dt4w8Ni
z>^W^lyw9nWoCxmm?^U~i2-&3bt6B!2@Q35+dVP6v1VqknEH~YBLbQolSI{QJ>veMQ
zdss9;${B7Lw7ISACb|-@)}g+ULdI01&kuwv#mQ~co0Nql5xmYFEbWq&dI~}ZU70L<
zybKC&YgJ<$vo5SR9hnVI#*b&6Iat=ZY7F{43y$k{Op8OnUB{o#tove#UhY>3>8PC>
z1xJ{N$G!0YmXD}UdSEKzO}&k0+rhuU2j22xem-~(V{3auPZY%kuP<YSSB@Q@_*h%f
z-~a`Y_LPwZq)zY6Cr;o5o_p}{5X6K7%J?32)g@Ocx%^m8YmE%Ea6cW-wQ8q|nG=wh
zWfG$vd5WhH|30sX^DDK)8jVU9ERHch@+oB7%V(aCDjK=;qYF2pq?K8^X(l;T((2)e
zv~BPA?wV$oxh~jdxpBv%_mVS<-EulDUzl?AK1tQ7_|I`V8oe;#DSt^+n=XmYTOs|t
zUCD$z!^8bWrJP1eN((7X^l#A$gH#*KA74eKJ>yytLsD7ujjv7;S=2{;N+;n=neofV
z&jM8yPs2k=6k4}Ii1MBCRbHmzAypiv)0*yg{0hTzU$fA1z)z=7DQQR<wuDNW!Ocn{
zGBTOq2a^%+e1CuQqNn2WJko}*Afb#U9!05=Z*N1w7$*5;FDHRh8{Qrz-z<GUJ;uo$
zURhD&u5d#{ZeZDz>(&2AY9d$K^G!}4I52BdbL6-9yB8LeNHlju?LJe8C681{@xBH+
zFePr%Ay0s2*oV<YOe=!*xpTOJs>Z)!qm4Cs^JD&knU2ZIrhu2!RD_42?Kf@lU&A#^
zV#Fh_(TrlSVW_sKeJ_Vr6qdLEpX37Az{OVGLn4E!i6I&XO~$=16POetGv}GSij}x4
zp-nnD+<0-hmT;vFv!Ypgl11fDs|GuT=ACB@Yh+wWtmeyKVh7FZQ;c6RHgumPGAlYY
zNiQ`$lc`;bnt>Mg&j1^SjiwXj<ev>GO>XZ~(7(bu(YXXQ-sa*uHCZlRaxmuAEZxqs
zAI<0e`1<+beso+qQCr%n)tFtu#q&cdwqLP}z~^W}*UO{3VVSk{=WFRbc8%S1)u3LS
zlc0Vb|Lz!-(dOQ*)5(4X{_f>wf1|^YRBNUL`Wf}N(R{z`eDDz;*dlAVOrO#47LvBZ
z{p>6gwl}J!RJrZt)&yc#sFY1zlHkUAr_U_YlWdT)s^P`@tvvxaRY3RQ8yYaae0{_<
z*8q=XHeLM~jgv05(Zuq?Zea;Bsb9sL#MnlviPc#}_KQ9I=N1D$mVAi8v8?qEC@gnx
z>Q-oc(Pq>cRu2pXAL~i&t^e>^>(+QN3d{;Xz~s;01vgPk+1<-2ki|v+9lD|%?nj;~
zo}afSeNy*LIZLs+VPlV|Y#cM}@b@PoAQjUN&%>@>_~)jZ0vctp>D+L|1?;vhgZ!gk
z*8%vIRSyEM=k_c<si!`cF1YnOWQFsxZ3y|I8A!zzGe~azAK(stJrQCEiFtx`DWQzr
z|9ul2Y4l?s5IN8(suGjcjm)zfqUt{?xch$|^C?9vVDHp}Q@vobM*QjT;Wp@o=kf^P
z2$c}`O(AcPWgOfma*ycMzkE$R{5~d5qa&-5M!ye-VOu1a-htNXE`3J*lStNuniuxH
z_T5qU&+}7FFArvDm!hV3?h8)Eh_w>g?>mk9N5v8Uw!pj;yF%6!au4^}ABR%iir|_q
zF3T45D~uYsyL0xTo6vQdwKZEe;M?sHlPj+kpcr+0@#2L&5Jy=u-$mn9wZBwme37Pj
z_v#ACeerSD;BW7jBGVS~uI}|R`&xGD<kCG4k(;CZjf3m5N5)-fysqoY9$<7dfWV#Y
zG+s;3=^3x(Fl8+;m1qpSg}VCLs(TQ0<KCSD1!ig9{MXn1h^Zk7w!ekyt}MWwG7FE9
ze#SJ$V>?1i#R;7U?pBCnTM+(UauR?^GqF<Slgvnppb=4_D3PgEtQAOs(e#c7-9(L`
zBFPYIdDlIA5FT!x9YKGYwaUzhA*sH`6(#Uu8MDB=CYB<zV@`(dT^AfNR-{&BzSR+>
zo{EL#w}R9HV7Ogys&g+as(3XGa^us7uV%m>yFl*oM@1T4;CnMw5v|@=4~&ey3j-q*
zr~q7zN*VZ%ZA`3{=B4B4Rootc+IIht@qUOF?vq1OEEG4`IGyNc{>t=lCv2l_>)DTF
zSHa!7thYH`po+p;3-A!+{e0hqn{EkZ^%1ZEsjr>)pDqS}y$dvP)`o+o<I+fIyiwUQ
z`v2&lbZG==?r{Moxe(vo7^Yd>1~aS(GYy(Z((~qXfK1BKJkurS$??_2#j%%+Q4|>G
zEGL#WsDBARV{_=}0<dHj_`N*;_S1%K39Rzii*feD?$vh+&a*EJkwQ{MJXQD~{&&;^
z!w1Tl%hz(9S)e!#EW_ie4IFY?4<N+!YXG}bdXdc>P_;3P4;2E1s*GHi!byVv&Cs&7
zZYRH!T~jz_U=2NJnx9GGcmA=SalaE&3Qc_yAS5bJU$W70GLb(T+V5-*!0+A@E1GYT
zqXFzy!{TP8VTa0TLI;xH`Qhro(TaD7(9bb%iG{tnC2~?G`@WDMvC@K@i~qpC{oh$U
zoQUkrG-Eo7o#y=LbnuPI)S+I#MnRfE>b5dHrjIv>MI_u)Q1p6O<144m0eCZUtU`13
zqRvUbHr6rgnN-*nHd)$wX)F|It7L%^c%=)LCgTshgu1YCWt&D9Oo5lBLQ_VP=_n}S
z(o~?W4Ynhiw;-#)40mzFD;1&x#4%TA@ECfyt=l0e>BPCblm0m|TT6#&6xP5v8343Z
zp;y=DXs}Wcz?lN7fiw_AHkeLX<zb#2GFi!_z_G#ue@k(JJ&uCqWV`M19&+dzs7Mue
z3CiTuG;TWsQ6iSrAg~IH^K5SK@5Aqbc0%ZZ)xVBmMH>=E{FnmCHS}!}NLcg&>2HQS
z&!lNY0NO*K9P>N`Dmjlx8$o?fXy}_YJ(q!m*B}z?1%-y**#fMw7o-8~RT@|U8hS&w
zSiA))zNpcu$#XtiOy{GAqwRG+XYa*N8ckdcOJFNZFUT?%<8Oi*dq=bY{<Q<~N$K)x
z+1E$?U!b0g>C#E0wObxQ44SZA8wD<A(KD#-6ymYgx^B<#tQLM}`7t8yfkhgpO1k=l
zqJP+r^U9F_&Z%`lWKF)+<1V{$sa^wLcV6Lhy^3qAH3IU|c#*-v7ZU(>J{o3Mo~PW~
z1L_rp!d-}vTV$3WA=66E(!kw;^;6!;mZ(8NFnI>663!nlA;}&qcg_J|TAW_AG**cZ
z8WQ0#Hoc<`T;94(7uo`6iJK3#9ouh9<mqq0Pw;Xh1;Hg(AUR{udyS{aN41?qnW^Za
z|Dq}8<8s4R3A4;8kUvs&kpTnPx4d(nS<647c;}K=T~-pb5=ohBRcO(UQP`PXKwo19
zMLES9-h%)`Od(;d?gzlCY;?x}pz6IKRCyqUy|tF^p}&~!mUqyUweI@D%kyD_F0t^Z
zRgeJTeqR!CU8H}HA1=Xlm(!~1EP(;}V}>Wak(EedM&doCT_9$&*TH{5k1i`qufoZG
z7aTxYrKn9v-vg7<r*?CFLyx|>z4;>ZR|*auqlpRPeA4thzntES8{KPSzwACK;qgn$
zo&A2)b>AmrLiLImHrlgumi+zyWA81)qTbfHVRfT|NGm8Ql9DPZNT+nCfOL1aAR!<i
zEnU(*)X++YG(!#`F%FG%<Fm$d_TKJid!DcFm-mC$rB3}<-D|D;{zbprrvXOK=W`Ka
z<YDvO#%!k-;l+BDd$(F;>3o@OJFl}V3S!v<Wkz|FXW0Xv=U_;BD1%9(C2tQu+0Lk4
zK7B{b!LZrbC$$7l=(kgyL;e6;hRuqZ_EM=TRFMbcD$2QsKvTRCWY<2|i}=5eII$1w
z0qpA7aiqYH6M3x!j&TjD*&iTPizbbcqX`@=M=oH+cQCFseP(1)R+9x~C&!0)Qj2c_
zf!KloDmfnY4t(UZ#TqDpVT_ASv-UlDq5%ZinLIS4+}P|*!FbA}lAUx0C!mnSe4pJ6
zl`ggeYTmIQV>%*tm335bH1k%70qfR06KnMYMXO45E<6Z>ODeC1x-V-&&zJ86tic$@
zQs~22Lxj8hHjU<8oji{~5{##8UmlBaw*Vz#>Ya$HH`j+j87XF?<;P`#pfk!QcI*w-
z-%<4{`aYpw+AUT-*?DawSwfNG%{8{MGor}3p|>#(CuX98Y$Bky`-^R}_ryVY$s+4D
z&-s+TWN0(cTn-j58n7Z|f7e622MRwV6t~v#Z_Df#NI-|*msoLw1v~N-NNdVJ-w`#4
z$Adr=hj6K2ifzsOpe$kKVq6=B<~R4%*jUO4Z^G*R2TD9Kqz7QKnc&c&+#!0!MGBZC
zKPnS%=QH*soxQjhBNiLcrN)TAVRVso0UW<R8pp9Lxnu%@C>nvy*bNl=-{ytUxS5*J
zl#8NM>e^i!BkOF(Q9bf?pyb9(8UtiKemy;I3TEWBO3RPdUVn3~&)c(>wRX%b3M%l?
zN3QOem}cn9&~_k+GfxHdk+lKsEtG>_&dtkOXF#qF5NGVe)HKw1EMyu&6JM?~8_$z_
zL$An=>Iaj%P+P{vjo$UI6mDPr7LGyrE+zjD7D~aLCdY!tjovLrd^C?Y32~2#J~TcE
zyO)~Ro}5Mbd>4_$ZD1r+2ss4H)~&8JzE}q3{(!H?h3~Y?E3wL+!c1a>_{e@5M&UE%
zwo`+_Rc|Av5190~jMp-WgR|CE%Iv73B$2rS0%WgVs%RX|A=>I@!Nq+xqT-KVTihh{
zpB5i=J~Qnb>oW6<EHeg@oQs!&iu`M?9Bkl7nww~+9p%c#k`Z!E?3*s_t^DCm!aEMc
zMc%vW%6CAIhVp#Jr`h;chdN;0Wu&VF8G6^ZY@l2ofB-gBFy=WBMDbDvdUveOiNc7*
z`~_{l7pmlvUJDEBwCF8n-L?fZc^rFC8(xYH4tQLtbP6l;iGu_7{R<a*CE{mV!{yK7
z=)xGV?vK1L%6dT8`DDrM0+m<n0VM}ic~2piyxX3>UJl$N@m&DFH&-DZtzF<^Ri5Ky
zJ!HL;=hwrR)_<E@yGY6yr+?9|74M!E9&VH$E1z?^zw8DkHD7^z(P&VnQVB~{6avI$
zHT>(L0m&eT!{uZHt6;uWLTICcbJAX+&#|_QeAWXiR(IzzV6ynR=!=vRcjseV`Q6V5
zLEMh+qv@l;qN#)uN6;V}@TD$+nngl;HP*8|*lnG7acQia7?Cot=|S5IW!1Fo8{Kq7
zpm#u<fU!|2dpf9_w-!d<`MG$FnIzy2-$*A^{bSG|sM0NS^4(t-Yt<kBU98x*EvlhW
z6@t%&zk)qmYF57e;&tP}M%S`<x-Tj`mKw6{ITAC#dNS`5l}FRRr-OGh=%?6sVvuR~
z8>!s!5P_l;to>tjXJ3KZuk$XDe{d;EE0&^OG5WCx{d4GY4JJ<HIAAJ0AZ)%o+~#UI
zk>w(HF!BPGb{dFW^czD@?p0zv;P5!RID;Kx<nVymbU0qT4`?Vhi|+S0)L4^@tA^WA
z`StX^A2q-fn<$`b4d0FbN{t+Zh=v6+!-PbB6mO~F#Q$=p#9d*&#&=iOBdNJ|fS0A#
z%tdQm#3-SH&ETZw3ps0Tcx3ViucZllxs<l5pUt9A24@#Wb{psVFyW#=k`p~mtBMZc
zCM$G>sO_{Yo|(&sLK$3cstlvWdZAulC!eWSvQuz;Bapx;1~S-%1|#aa?lhnhV5k(Q
zwV6Gw5N_uPY99gXg$tS$>4jPAW6BG(r47?CAjgt~DlZmrB#dMH`nYB{uf+u<NRyv?
zK3yKr@8SJ%NnKkXH-e<Ks7$RMV7MzUnicg2A|Pp_;vpARxbVpBH{s&2lDj95RTzRD
zXcRLfp~GV%7N3%c>*=esz*Qc)B%I35qBzQ(>=uJGs>vUyX_3TT!P1TEeZKgXs?~iE
zaD-{Hf>Nc2l?d7Jsg3Moupsm(@5pXfl!^sT3%HR`hNrk7uFGQD;?w|z1xi+_T5nKr
zatJ8)a*jZ)AL6Z?V|PMvDOOA3qP!p<&G#+jPloLZ8p}bcI?xGq${JZE^m0db@&7&d
z{068LUbuxsmbrad?E$ta>JHI6_O%`4A(uSNlfk;4U1e2pa94`{{N`q`!1|Gjlwp^u
z8rvVOvTUn054KHSev--(jIwhChp<5GViTK@p#-a;4PLN2y1!LkFIGC>ri%!cOq?fE
zmdgVbYdEFy6i?U8pYt%_hUeQmSURKM%Qvbv9XfNIJYFFJ!D*k1G~sT{_3#T7;uG#@
zwiT=QKkgR+*{|7nzLW;*)^N1i$*VPDmjDRS8jI+4jpUQ^6%8$oVKTU**Op@RBnAt_
zBRwrpm#yHWk{ERVj7HH9$@Red^~OFlgT{ct%Evc1gH)G2*;O~ZcyGdLIL{5-n8&%n
z;ch}Jc<x<fhb;ER&-P`@HK5_m-f>uF$n5kdg@Rgi<7)V*)q?mqC8wxVB~>C#0MB^R
zeMx6HFl8wAP-XtP391&zqz-|iIl+KqRtT+BDY$k;JC1EA;+s=*ws%oaz703|8m+4I
ze72$3c-c;)>j>Nl*;~Mt$09>fdVxYT8?cEy@(<D^19JD2;iRHO&$#5+&gKE>uh%h3
zjPM0N$fB`_20S3Cp^35sLK3S_N<h4s+(iNf8Yv(Rwf<i2+Bm?pkgnzL?&o=EgZ=B~
zh#|;p8-#q#^GKu_1ZO?l7yn4CWvFB9t9&SkZB~~r4Qkz_DsDn1X!mM-1zG&tzSZ2E
zYWMrGFLa?H-iGWXE^NEtkXB56>kbANkASA$hZuv9Ye^5i0OI5}ncikCNyb!bI9Ali
zQ2qukxh#ndSMi#*H9cy#RL^<pEQkMs-7q$_D7Q-2Fq{LQ@4Z!eKs-o=Q;I#n6TuGI
z1bl-?3Q>H5hALk$yEbV*z0H=bE#<~vT~-!v4MjKuEJZFtMeE6exZ3l=H=-2%i`02~
z(>2d&J{pM(JCC@dL~qQsFtkud?6qw1h$7~B4d^hNuyV@Glj=utnN>CNJ}%^dhHa%f
z8T9wP;I&{GZa#IR3XjjSo~<<PT#xq0AGRM<=&<AP-85S@D8}Yy!{WhpQO={J&{?jy
zG1=NWTZ$ulK0VFqX7MZg7{@4vkZXtl5@R}nM{8qJ&|%rk9Fu1rmnTSNO3ETBa^S~H
zSvu13ndf^oD0ax>Cu6+uQP^z-Qcm}K8Iz0|SY@Lg43RW4#F-x?AcldiNU99b4=w0^
zupspC?U+%eDCAhnB0b`TQ>FQsGZ~HC1~?(rwSA41BYXzoAO4<utWPf;3&gY36brF;
zoD-bio8&zGA=;~L@D-?kCMN3*J1ZHTEIn~ilfd9cc_`!RTIn&tH7G$vROcauEUk>z
zOAH+pVoA&p<L^uF6+c}%g%=+RoZxbT&9>tLn~kD7yc{a)>$ILehs}C6Q&#hwYI&C|
zaHk8LfW1Zk7V=agZ0?PGg;nJUKFB7+cANx~teyv$H|>qz%k-IZX!8a)Sd=@)Kp2;`
zI&!X9q0;@Npg&bTDwW76rB<t8O{MAe0?L69=}qv=wqmK1)bUH<$jO4zfc7@G05f!t
z-?&hUKw>wZeE_GzLATt|hhBwyIoLX|-mRkFosuC!cdwp;7NP5V;mifjtU*sLdOn?X
z+52=Be`@7rb_A-ry39Qxn7=kLmq24@l5*>_dT>H)%sC>(sbOS?-GD-KhlLWZC~@IC
zU$+u_?(}uQ_ZTM_rgw137nT)tacNkq++2db3E#HuIC1T%|D=7lDyuj*cG!jp9OMO@
zz}-%tVXU2w&+FI@X?o>WLnACg+c-`YRMZ{FbWala<e@#0J-UBKWbi}}q%)!)E3dk7
zwltSBD}DnBA9_y)AK_>__*oqjNm*Q0IKzm|#U;cp$?mZRoSkw$-grumNI~s(A4`K(
zxo$ns+wu<#^7}q2%_|UC<q4n=Z`_uGWuFNww__jm(KLp#@&aWsl89f6Od0roQmryM
zOL4o~V@m)8XkK18yz<(^|Hzy`Jo31pZT*F=Ym&>_(S$cXpX4M>S9U6oj1+QKj%a9b
zav7+$S<(%QXT5WMx87(=as;OBGtEh}{D>pv#l~zpP@e2N_zF1)|M;DuIRc%l!;1Ub
zuN^N1f-&2hOSfi{(|t^usdkY9DeV0UtU7}s+&s{v;#{^F;4~n@QzvcaY?cQS%!4`z
zN;vz6`lI{Hpx%EEg}G~pqLPSTW}!ranC1$~Qg%I;myK7;&Wj@LVg>`7e%;&igFbyF
zv2hjIBL3EVz9nG3U;Nl{PkFE*Io)SY=WvL?W^t#}Uhn**irvOnBkHvyh#<i&0Il=*
zDE6Yb2IaN3P{xHuQltWMr^_jmubdVksjL~K1ZPt&De2X8-0gAMQ*t#n7A|M6Ck6u$
zqEmyk2-Lh8q(9iZI{xc6bj7a_-D_v|h~+JtZpQHGAHf$bOS4u6WM_*r+wf11=myEx
zTxY(`bb8HJVZL_RI;!=@BjhT{kh%YBbN+kv9uosu<1=W~Us+?Fk~GnOz0VJu5|u9p
zH6uxo<NEi@my#Ltm|Vxu)yV!d$6v$Ze<GyQ4UhqU#O0H(lE>4(36k<`Hf$EZ#)<z7
zYkuU<6!&#lF29R)RAGzWry3}_%C%qbEkA#Hi2B+^(>z5034mFT)pryA>kU`@$ngZB
zQ5K`0Gr^Z&H#@12{p&pnQK%ma*39`h`<TqFqel2&5SIVu)J^tRJ}Q$D6qW2BVNNcd
z1up($D1JUUGYzVDxan-n9kU<*V@>|2_+&x(+HR@qML0QMy<xBvncMNOoJf-#&*}FF
zzF;k4Cj0*@2@Mw5Md0iGP$1meY5sAjr;Bu0Pp)D4Ij@ge!IB)=BB%sQyME>Otb3IA
zp>cV6^4BcNf48IzM~rvp!18qWedR25jLZi1tZ(`NUljRR<5IAcjtk6rD@R?|xkb~L
ztaf=Z?C{F<7yo_+Tr;|Bkpd@G4f-qAHka;5`x%>x7rd$^#?Gs5Vaa)E?gKiWOA1^-
ztpeKQGF4&xl^*?Hy?n**8$S1$e;5EEUyNGUFPx&F6&5!7)=8dSm|Tk%Z8_!j=A&xj
z)&K5P4*bWK$(PS%q`K>YQQqC$Kem@2eePcqr>p8LWNe62*HA0^-H`FT|KyFszqnP8
zY*yI2w6dnULbkosIX&NBJG)BmeNLfI&_|NpivO=C9nwVmG9q5BYtlml&u|{!C?+to
zvp#!gN5xX%MwQML#@zTm**f0OX19mdxbXW8E>g(9Yb)&juXE2Y_bUfywYT5d$@87P
z{BEA@g=c-4ZgY=;<JG6v;^j7B&)KckY}?4ul>=(U0`t*+y{7)R6I2P_%O}IswJPR;
z@T&hB!9YkQU5+&dH*3pb&>8Y31r+2&dTCxn6NP*KYbk;h&cmxG@Km?O5cus;S>(55
zPdT*YFV!o`A~{cyowUFCIouU9kj*FaKFNRnn^(OPue8eQHP@$*{N_b6*^E9<TRHZ$
zcmKi{{%57?qLo9<%hrXg|2@7S<0l1>b4m6XMai)kjK67#U<Na~Q#eT0-GBT_P+KKP
z>erp;@3QW>%<D`gfy!4{{~A+N@$K%_6oOh9BID`regFWo(7FB}9}SYK{(pQ_1AhL+
zpW`>{{lSnLU<72ZeoE9VEGfl|`?V<Z*O?JJjD+~=Z~7G1O!?X|)O-|Er24m=hHJyF
zQdm@kN&LG8UAbm03YY?%_4ib+|E@dQ!FYt2mt+63kN)-7>9<!1xvZU@<lp+;Q@zCi
zVN&Le^KY9gj`jh&F`VUw>Tg^6<Z6&q2fIe_Urqnz$*o1f9LSc4bOCl*X4w{s|44BB
zJ>Dj9Sy+Gn>+fgq<D~hdP{7&rSOxQU&3$DrLh_sF2zp5h6su%eZ^Qh5_fR_7;^9(&
zGm>)oPpH^m@7)x+Lcz7^$efSyyRM=K;a=JQpNZ8!AAX1*tyQ7m>K`|%<imge>DPh}
zUOO5PU;EuRgQ;;l&f<SfjVrBK)_*UHKYtOm2p)mb<Nxd=C$KN^tgfy3|1K7RRho<k
zC?WkU=&;`ot~eOK7t!3sHn%aP{~njWCe?!>ax_%@j=O#DaR#4-2=nje^c6HE&@L&(
z@?Xz)e|^Ptm|(h{oY#B|72JNJaZ~q)lNT4m{p^B(t`%a$x1@7z*A<h>`Zywr$uUSb
z>A$Ce-=%B@a5o6yoJrZUAHAMz#Rg7iCuz!5b4H)bvHtoQfQ9f81Xo>hI~4H*<)lgS
z#6a|T)Ergxvx$B|i-Afea59};#g@anhHLiFFM@)hdSpAePMtq7Kjdv_WtwYf8N7T{
zjUnO_-aon`Lmm$b*Z{MN5@d0=IO61NKxM}USl7w@hkzr<hsHCvXmYxlW>!}n?iUa1
zZ(+HJvxfXqcLJ06l>VybPvXw!*4#AZSegL<<Xom+#zl4Lm@q1mVmB(A#wVG~<XJqM
z59+#Dfpie3(cS;6!09KBhhh(*<R-oWFq9pN+QiPFz3V5~hLHmHi=QrqC{{+>-j;a~
zF=6%R8zfK^k4Hk&96hc*8R(l-NSwUCcMW$%5B0z|7IGblH-O3^9A$8qn`FUI3(9F9
z@A`s7$}GtGk=Nin|1Jpf*h@KGJl+U^>ahc+SAN<at2whk>vDWGPvn9Ubh>cHiaQ@L
z#&883jhnYnHipRnT6u;MHNe*oWH0&8FQ4yrQ*EK7iBV>C$h6xWw#0tm&i|PVsMt~d
zK-p&ZgG87tW8c#OPl+V^&ik|Kdfo^dATo`z!qXbl)sw0^IVkg;9rA$t{<wI{g+(J}
zg1a&UTG1t|hi3y!-)^87GW8(Y)ME`;RNfHSs^vV${(}9}mLDa1n}c)%<;`5yXy7FE
zGb!f5WQzcu<>-4lnhpnaAhm~A5FMMF-eD~D`JR9o1;0Go-j;iYh@C5y(?OuVYk?Gq
zaWR2X`q?w)zUxhIFF-ZZ1tqDVZCO%%D;tG9|LIN$gjBuEa8UK^<5t=z%bd7SZ;68N
z6d+nlIbTvUUDysk2EB`|SK(v_gkfDkLB~=5gy%b`9QC6_hrtPj&J}>nJ&BJ{d>#Bd
z4fXYK;6H{?sm=Nhno|!nxM)dr4MJ!N@mEgUE_B<AYL8Hf!Yx+clQ0r~FQ~G1bloZ7
z@@$TSk44vv%^YlO?uMmJ05G8P>1`;;5Va-j%#~Wcyad#x$glMKDDD|P)7VLhX_~t*
zUl@}tptO-50my6DRDiR$sKVLM{54Fbuc*tojeS*HTGY<xC!P1&WZC-J7w%V$DM{C%
z67BqOh_j}OEg&YzO-MC!plqqXzqHi6PM>dx?gd=PY_dWw=S`QvA|y-;=`Zz~<Bdj3
z1`GhMbCz|VG+=j^q!S)`V(Atun*2~Y`L3GA=S?s`LIF`6;env0IkmbCQnr;kG}0Xa
zC}G;hmb-j~1ho_Gq90QnwEGH;W>K|`%{)(JKeNpd(UaOwP?yWjum<JlkQV+PfLxo%
zXIdXX0(OM#xwI9Es4<o*q1y`PK6^?wk&P7gJg9)^w+zg?ew2zpScCNXeacH)AWPWT
zW?elPMwD3!oVGNYP|yxLZy*ExgPm#6;XX?CbM*j~bM6(x>Oyhpf{uYmr?fsCRm|H-
z1*9LHv*STbt`H)9htZbrt(fL;;9pio9kKmBuS-qSI4;`Ioy0<fVZwDw3Y$@{D3ZuY
zDx!nL!-WNKxhPAwKhS{sq?#Aht|@ivs8#B);*Vy6bQG5^WLqI`V!X5>zTRhU*l48i
ztdO{|--A$H*=2Zd8mI2XiTjg`q+%`nE=-4zA3W*f%*{1gfWNpJgTi^%vH(v(OMRZc
zE}R+3eXkx*z0mY1LIK^=0Zj;)O2J4Mo9ju?QOwl^`2O?#ENuemhwE~5UrSz&oB<JW
z=4Yu{uGD;C&Nvrq>Ma&8_!#a&fP-qT)uN~Ny6)|g*yrs%xs}%2d$|T4KQXPiS0`5Q
z?Y75?Z^gV~+uhr4)k||5rT5t!i`t97wQ$n{Fm0^HRs+34d9GF8;=1fJ%}@U!H9U06
zK~<TR5S<o_=zrUGk`4?%`Fe8Ks_gTYiCT`uGBXVBtKr*#96{~=bxE)Dgp1`e-wVq{
zQ!~kP+<GH`Z@})#1Nqc;ZG=Y6Dnx5RoK*~D(Djp8Y;z<5PJ7$y@mQPoEHw%bs=K=k
zoOPrI5dgF^5FS%o2|By+^q|@sU$Buz-J@jRYV=~MC4d%atGg@)M||w+#fT{RHd1VA
z&w*6jZ?utE=+rKvovWvLDZ-Zxu#FAv+QzgXbQ)%zIh59YlPW8#&0TjnrG+1t{pg{%
z{2shNsC|zXuq34#?+PdJZ`WB4O4>3f<??}YD#0u=zBWw)gfZ<bq<WEm0CC*5_dQw=
z$qkA^b5gKrhU7ptT*=d9ovecEO~8EuO-SFtgkH->i@6cj`%jG|-O`6WNPUhP=I?$}
z4nHP9c7R&ikO1Hd(QacZ<$X2#C>hh=Cz=er8(Tsy$-Q<eZPd8J7suqt>P(yoQA2>v
z1vJf7ju*56oP#8=x!`1<19ToU;9VI#wHV76wgH(=0rBVF_ETW_5(wlrYxARQ=@)}(
z1KrjXOhuSMVd!L{<ub1S;VcUs+zW6ELyo%ctUUpxeAl8P3hemf1rKvimEfA`A-N;Z
zYUizGH;9|^%t70EG+2aOM=IwEowyP^jicRg?vlBwzq*-gL45F`fasH#4F!2=JUc!w
z>r>Ox*zjLDSs%#U1H1hTQUY~qQsnj7b=s{0tdoUQnqe8}&ZUpk;Y<*PRGbV5=b2ub
zm&XguF8Kw0D4tSmfs5#CL7Hou)bRXL$QKyjdN93ep@(wh8RbMKd7<<n>t)IJON)B4
zNP))|e93b)7j|EA)BZ>lxpK|>4LEOK7b$^c^;g>ZBz~!wVMFKQGdmI^^8<dAO&aUL
zTg8<FYeKSG3015ZTx;c%(w!7Qa9;Q==)UcB%H;}x2q(&&@B^TPLCUmZ9TXfRzP&^Z
zT5(zm$b~ekOThmye9?WLWA&M5Uby{8I}eQ5gG#6(9-L1xOVT=E>hdJysy5wO{I9y1
z^sHZs986PckXTk77;+%hz^vo~xWpRy?O}&DUg~BPB8Rfnwe+QbMzmdaH--1U;?n`{
zrGS0SqGUj(83CArvjT)1W5AtiQ;Y$NK~U-sC=`4xsCjLZ7T&EiQap=-I3$#KR$_k(
zd2&epF$aE2qq{PHxS6}%ymGywn;=ggm8N-(XLoAPdUODPShN1rl4kVnriB<u94ud9
zEGp*UGr;nYUOJ^VQo-7J@5wZ>^`nqaSmQXS{x1hC)&Rxy#rZq&5Ld4h85EYLbIk%8
zs!Pp$oESOc@MRg!YbASB0Jnl3jBCFcL`UR#9aInVhRK3-?}61=xy~3~z8W+t^47_%
zA%&z3B55p5JV0@sepGAKbmd+bAe%N)4-i`x<3%(9l0k?MH!4Hf&RcnV{LU`sgQzUh
zd5{68K4yKN*tAAxzX((zUw|}w!^dblD!f+SD$M5l`!tih3({jR_Sk%5$96zLNM_wu
zBxKp~^T4A)2Lv#2kTL2kVr_)n-Wipn^<kJ4CAGvDe>80O2EYNhozNOb2ikcN{r$O;
zP&`*p#i$2LEGx#6ZP@L~BKeC7C3e}A8fv;xwqam6dJp6*MflgMrk;5QPn*x7AT3L4
zs?~E}&MrW87yD=d?8SIYK`1kWv0l+Z?CL~NlIAWkJ%2YGb_U)-K3zVY?d8$_nb$-H
z<zOM&cGr1uoqq}#@!|_;za%X&(iso!RW{j%@C-S___Dm5^a!u(m?BDC@~~^qaYM8Z
zFPWum&p1@XHwBNv(;N~0Jj<a)q9eCB|I`AoOhvAX50Y)a;*07?KVD%hNGIk*A?j|W
z;~jbpJD-3;PFtlg;ls7}Z?mW6H{^@sO)C&3>jkC(X=JB5lVF`o%PAX#xke-wm$%*u
z0jx4IBcUv$pR1%6{sd=e+61U_*2^0y=9$J$hXiP03B^z(S>@+k7>`=a@CxEg$S^Tp
z-x)rDRX)ZB?+h(lFWo;)4ST~!6~<)4REkEGlaQZ+94wjh?AVP=Aij|gacbK0X|Y()
z9rP}%U(uZfwCpxJ=GnGgTlFn6A@eo!A_&unqpZlxe%eQ5_?)}ZlLBN=P?LwmaW6mG
z$z$a+74LnL>_hif3_7RELX~Bd2k&ypnFOg*%bKRi>e!P=0hSdV(ZLcFQ||WsC|@3>
zCqlUCNV;h|z+*7VEq@-}ldzjeiKA7PZ~HEvyTk}@>a=|w&SS*n;l4)Nz3fw!GxadL
znDCj=`WSL>NcRLeh|!)r7<wk{KsMoU?%me#=BJZ50i7E&L;^FW(gJ(3TgI{I`u0^-
ztb<zWx~{+<Ly|79(7th_zC+n41Z{kw+KrahY-X?#&r8CHQRV0Ic+yqr@u>I435~+k
zY3m1~<)MkSHB%<~5Ci9grICltPb&x4jn)tox~I&(+ESk$`?9<1or0}r@hdKDQJc?7
zoAn)`fgXd)b6peO#2t0Bj!}+^<H7_C+<4!*9A~L9KeaAp|Fqrc69?U3R5?7X43??3
zLtm;_4fuMJiA%4VQocFI7L%E#5_BO7D$OHeX_gDNJQiSel4gCDME0kR2M-r=^N!Ad
zDTVe(?z`IfdRr^Agmf4~iQ3CtuQ%=H=T^Mt&z-*`M291~tfdCyip8SwrCuwWj*oQv
zOZnE6oKbD<Yv|((FDJAub__Cal00`S7b}6P@Tw+ReA(m(5EqWTG|I%g={)_#U+Bbm
zof=Q<NP=_Ho7prOe{eHpF{j<ukyN{{a&q@j`RK-zPrI?7h;LTHE0*kMVexxRonU6h
zf$h)m70;L=xG{)s%3o6^EwuKvC)S>@jq;k#C*3KzLv6P@o#y^6kw$UzzAn2;@57=u
zWe}$youAX9z=vl=I{A5x%H}+2N+lYb+pu{9>ZPi>F<}m6$Yyo-)6{CmyKI%O$LdQH
z1N<8m<hA2Qy%0t7^duv>o5%9kvf7oKBsvD;f##`*Cx&n+mEX|xixly7{MSy~XZMAq
zd*3bHeRjCrbD=cIn<+|N`8;er&zV4|I?c36ZO~IpelBW^-zw`$bxtFWio11w)ERZ7
z@iQ2NIgAXGSWT6sr1$5Mja~v|<%Sgsw8WCtFu6Rw_W29Pv#hB|c9&<;ohtTe)#vXS
z3gDmCmn`8wX1AGqzPv7`<-Xb%&Qo)WQhpQWX)2#=KEAmJ{MOOCV2Loyavoj?OVk@p
z&D4AuL~?cLqcwEkW^H!tzdN9no$tpb3{{--u-{P@4aUwZe)pwSv<vd>0H3*-ijL5M
zg|0#{>+R%vSmVelt7Y61tI6{HNf4V!bm?LCqZ3R^W!R-&t@M%~Dl926i4g_sug-)&
z{<s(o^VfZMkX1ZT)$Fo*YTlA!$WYQOu0~R<oRwg3oy4`&>%0m+3weZZGd870974~B
z0lUTJV8z79&`<c$;Q+x!0&qRC;+rqsR|dD9m2~-=aBe%yfN0a(5`T69$b7QA74-va
z57x<5c;mBGidy2u0JoeO*mP#ju7oumKgzdGs`f9&X5SY+WA|!5@1nOpSJhsnCNytp
zmRm1^@^C@+ftUTL(p3evs~tjeDkYU=mbuuu(=A)ld&*g!B7@-;{?+c9Brp;q3`$0<
z)Ub9Un3#X+7PDr6rUbq1+qe)$DaNAr(&vuC*2)J7U$ZVwW4MbH`YO2xw8xomlDoZf
z!|s|88u#th%c|N^=i5GLR120gcakx%svcYihl}DsnUs-gPjKUZ13d#kgh11XxE$6q
zLW8S9U3=5%9sMk@_*ik@MJ?NMY<Ixbfy+!z*lLn)+}C^oRV3ClFKC{EtktP6@)%9X
zR*jdBHY#8pd2D-PP`k)Wa*sHQwj_9{mq)%h4e!<39iLH?h2p7ermUvWytXhAzL1;l
zx<T-j!!ysPi#i^#b)G+ol3rah&4wo0Wg9{=V4e|ahNsr?2nfb-d~E<-Q+9s%SwZm|
z)vA%gO(U^2aX4%Bx%i4tg=rAK+R8JN7Q933occBS?L_;0WK$O1wxpViSLC`@HBaoG
ztzmI!{FG^QlPgh&sY`*Ho=)!@K_nh}Yq;(mUXJ$hr+k`a5>@8acG(dzx*r!ah$znR
zx(71AC22jt(4C<f?Z(;KN1`b1Ng~#`1gula8Y1~bD$_T*8pZrmtekv!He*+ZFr$4$
z_oj=Qoc7xn#r4+4gu>no9HCHF+;ky|JLUfCr41~66OEY<@%1;v1Q_A@1drrAR(o%R
zSkiJXYp#8`D?dKyzpJR_936Lr(lhAiY3!a>SAdlzy-LL=u!-#q!ZC*i>lQC6P{SuD
zB%96;smC6|^GQh<sA!2f@1a~Xs-HbGuBj<8c7ckf*ybEqpyZKVlS`z@h@78R3W;1T
zzO+YDZ+$Y?P(8e#?PX=5hLx>iN=GvGLVd16HS9y8uRn^~pZu}i_dS{<W?q_yMYnXT
zX$=!hR<Bl7Eh;V(VJN*WXrZCd^b^Rw9?LbF7=XY2sbhdaHO)De+DvjK^o=NPgWle>
za-FGtN^Ov_(cZXyh^tFK;sF=Q@@r2N9Nivbaw_(7`e}0YoYIp}H&5A0Sdl5qp7nh*
zp4r(>56Jfr0p#*)sl`v)mHget>nixDitubU{t$h>pFQW913yXnq({x7-qw_MrtADv
zNa3L@=L#20qjS8H&%B5hF8RHmz-jXmcF=bjQRG8hXx0LoLIV6u65{dTaMMYL(ws+d
zcaWQg^`TBt-jQ@k3*I*>1qykmZPPbccVTtyt+Gu&cW6lcYNG8n6Mm8wS$kGmOR<^Z
zwpZM)#leXpIk-`2qG|*bBXU@Lc$Q4oO<A%<fyr5AScm?!I}fq(ukTZ3MmWrI#CK;!
zSh-Bf)D8IW4&yXm8ZeSFs<UQzJW{CBT*%0$QV8z|=h5k9EBhlKLP7~Q@-^E`F}nIn
zpvFG$%a_oDgHrlCC(z+?%qL?B+l{Zt&Kj{5o-K506td-GtLc^#DSD@t(Q4#T14)2!
zjl7o+<w!#VNC@yNFKJ@c+9Jm=`p)`piGVw`$4(_BcD;K0oG{pk7rXd9#@zcz2n|ov
zw5AXGYf_<Xs_PdvdR}3rMbk;uOAi-lEvrqDl#J*(urJc?LLv%Gwj?~XTWi$jE$7_E
zZ+N6VE>~Cy&8X2C!_VmvCm+F9XDXaz;XV67kojua+^hHi2s-^O6Rg;#Tw3@YP5uwC
z@N*L*kvh|gMXfpacv~Kp&l*g7yW{rPWp#?UEk<|V_hliS0afDAI9{nfa?jtn9I@0T
z4F4APGYHXqDB3!WaTaO%96%CMiO;<$-@=7ICi60eo<X|Gs@&9wqcuDvr6NbO=}4-E
zyr#rbUpOmhaXHWeI^j4kJy~U$rT^4jh`(#>{)B=uCYU4RrA9glL<WBHgxv0*eFiJX
z^A9}>GRNF0)57KAtEMuJr~%GDIEHi4r{I7qEBdX@@>1^H(JjLyZ`#gxp>t7-+=m0%
znffKz<MEc7Ci65!cdb=!pfJh6&y4Ix?Bg98U8%S3>u<^kn3pcx*ZJ_QWA(CyImqf<
z&o}7ZKkJr4upb$=(65npw?34&>iMQwP>I{6PN&ft)cg%~n^_o4Az3$Oz!oFB>iK9W
zQtccuJ0f*^1gBP4H0&O`GE|XoqsYn1n3__=c>p^T;$f-TFC8L^nHaquR?*xYlHJ5)
zk%)DOA7g5tO=({k(~eisdls`=zi4#v%BZixdOa2;f>KbK@3o(&|CkU=8E<{Hm(>$i
zZooBgw2?_(yR+FRwp4AQb0pue@VVj5agY<hrzn=wI$WlK3?DU!QWqs}<uw9?W%gk-
z)>?k@^$$EH?$%PHRN5!RX|Fz~(cs@(X3`oAl@dDg_tu9^ScS-(E^6DBuczIOF6x(u
zGev@2bMfOuK3jy>Gi=&YBfW3Ta>I^_UEz9Z2iXzoy)!-}i`dyC9h8R!1g^VbYpT?6
zGh&<Ss~9$5t)xz}QIWIU$3&M>mVTcTQ{7+@*w}b33$19}jmK|cCw;;?$p#@_=tOJY
zDCcPyuZA<aI}bM>8;ZD~r{om0H_e^t#uG2nMHR&l#nfoMfJS|=nyBhlEN8O5L&xYa
zZEGK8N2SLf?}}$hqD1EV((>Dd0n?Ies|MIvamT9}@NL$-%gn}jqf0~XAvGUNjC8Jr
zXs;_g3SqY|$H^ZT?`7tQ{i)cJLF&hEYEOXqgi7E?X|WqY7YsKs>ru-d8pVt{wheO^
z@oZEj<REUUnS1@Fh#Ee={r+wi_6xAAyR!!TM^-Q!nCLf(bmt-!fi?~}F5%l4kr$os
ziQX>qtqdd~p*4*E1M(aqr|j}J3HG87Z0A9~o8VMrp2r=je~8d^k0-E^A?@j7Y>-!@
zhoP;<0&R^akCkmta35pFJ_H$^=E66+0T3Y(oMm3xOSZi1a9kUew3A6iGNa~F)OA!Y
zb5;Vl?y(ws69&i>9Z#&B>F}FwoDzB?N`X#6U>HKD|EbGm33kkh6{L!IJX`;nN6@n7
zwOi@MS7AGq?2zT5$7p-QO4k?JL!Em$mSp%SYiJo<n+#i2?QafDO9O;&$UZH!qtznb
zk7tE8wj*`=KS5yXXv0IbvMRBP0RtUqG|xDY+87%L3w7==lxUMg8OQlZZ^$=iZk!qm
zh_<^=qefcXCqf0e@i@z4I}S=-W7Cqz(8WFTL|bi9ciY>R|9fE~qHk?vv}QU4Kv=hd
z>6my{<t(Enqh$lO*w5=&xSIsTV`@9cM_P+)+2RvawenpFq~D_|$tg4&^0SE8i?`y~
z+E3cRM}T$@<H;!_zAZ83bX7w~xQ<)m=$d6E&sxP$7PiWq)kAQ=_g1U~o^g~zk7=Fr
z*|Wnt*)2~MFVH!ppcN5%E*1v70?f(G@JS*HS;|7($cAxuqChYldhy{gLEHIMo&fkr
zqpstu`pV1)*W#{?m1J<PP#nROgYWLFvTV8B3pJ>sR@0R=%!bn1CY8GwT*NLJZWg?2
z=c>29EmtYFhV$H1<4Rm95>W=L)9J87WkQCGeEmy@4+BH0ycb+ow32o?jz_tdYCGq-
zTmlyYG6G`+596f6JG+gTjs+mYo*T}@?01CWagi52eims0<T(j?c$yX6@Hx@vIWera
z`W4iy%Qa0nr$NOxCbm7SCBMi}`Ob3j*Z|{UpuTkutTlYP7M7QipJ|$iWgnVe0X87c
zF|olnQr4nfvhdIun-W4UNGE$UDxEr<QvjV0NG@)BMN_pmQY`B36L6<1Eef2nIX^1;
zsP78%9Z7MfPcl?=OXcIE4wrmou&u=fyQx#-TF+@UUPWky3+&w)%{JE}DA~xT-#m<>
z@gxJ_e~&pvkJE@d6S5+muw2L`a6IYPnrKMmlPJ;*tqjyEwvKfjAN+u5Lt#lk(#m7!
z(dn9b)U>;KJnIf58sw*kbCm;<k57AEsu4a+QWO-pbNZ06@{l{0z-IZ6&$`dUyv!$=
zSf*HGLBh|0kZbpkY$C^#d-Pm^PGE7eCGY|Cx01>?GiA2rJ79P_d16jmqfJkY#vi$>
zi6fY7WR{~T0>!Vd$1Y=VF;HDP<d@0PMxapXG^+0_Ej)Lk65Vo81bsvgPEbgM$BRO7
zXw((+gJz)4AY9#Vo_Cl)uoXH`0n9zDZj@nb>Y}7Wu1BW&mhemNu4SI@TRm=}6x(Ew
zD~d>Mze!S)aVoi7Oxs;3yHoT?0$T|dGLf!1VYU*V>RXqo%c)u#q}us8AP`*j3g3_x
z7H;7Oh6!6$<Lk|%R%Azb5O!hl#tBiJ<ryOeI$@dFGeFJ@aFA7D4b8iN)Q?ujy}B0+
z;t!hWp5nusU)_IRbCWgTVZ3hc?iPA{N1-Df!ji+d5GnY2)3!CIbaj)Ku>7<I-7T*E
zM!nqt63yyqN0~|=1n4NR&xWQoQgs|u9_72`dw4Y_u2+0DK2NIl0#%=6cZOw9^4-6B
z&3mLP94+qQPHt3|EH5V4E?@S}kJG+Nn<314tcxL)E_-@9_zKOCPu1@EFnu}@Z~(^b
z;`FTB(q=DBF&GLH&ZU<zqIRS74<dpc=p&`b7*q4Sqat|2Ozvh+MThz~*|i&19?<lr
zpqZE^mU{ud%oiD*)|ccr`&!~bo+Ff}8Q<5MK9R?o*1;G^Xq0}aoOWpYUTo8kYZF`R
zji+`tp{`$zxzmfe)~Ipz9ua(9b5Ao^QH|S#?^PEgGYK<%MQf&*evKOu2v}Y^T$Vp7
z#Kd*)@9<+>^SHdz^iE2!##4##8ljPWhSS<((>H0x<M(mfELw*$MMfQVi~Sa#TaCv}
zniux6Q*Z$)vOQ^&k<KNx6aTJ0{!L4PCQA6ELZ`zZ{mGb869+r9kI5JVyj`TjAT0ZX
z7)UH%rDT<Dv<1$5SO*hq)g#{Y`eH~10X<Zg(WhNBuka7CQIdc=o*Wc!rh`zMDVEhz
zosWxo%(G16v@u81sZ)e&(Jc--;W<CUB<0cEDc7|GF|PaQlIJ=4k5O%MRq==b0qUSx
zee5j4$htMYUe9ShzLK;G+OILq8@@JFED$Gz0(dBd2&Mx{QacG&Dnwu9;J8Y$c}I`t
z6O7!}NkT4_ypm~1y}9v$qw@uNN0$F$908U=QAp$cJIgq&JnzHrG2~?4FEpHcUwWKE
zoj-|F*!j)$jnDT@H?WH%3*0|5v9P~vYi?ys3)fTYk|D&IdO+Yzz+lkn@eD#~>CX0&
zo|T|wH%Mx#qF5}ZS3P)QK$-B0yU@e<6Sp4Tv{}>CXb_xt5bwu%^3|G0j72s~b0w=F
z>?WFH`I$=bWlXi8_!kiyvsScer6AF#`x^G>3-+`3ZzLKbrXpT(mTkCXZ@VIFN5?Je
zH=uvm7<Y;Igqp-L5Eo`8s<oQ~VKo*fyHd`(ym)HCisnYJ1XE@@`>E;BG)BUWG<EGB
z%yC6^I_UH(5i*2Gk4aN+t}1e>_%(#~B&lX{Kw!&Gn;hTOx;w*!I`qvf(E&OaBCUfV
zTWQYZA_H67<(6epc1S|fEq-hef$I<P2Rh7y$z0x6N=?965MOz0(&Nwq*zG@uPR`tR
zMFbJIi}*qY(?Irl`rWg9J&;dqfVHPZft&`DDkutWS2amjy%hmR>=X$X9c!J5tnLsG
z4)}WA_Q9FSrl6elp1&qjCzIz0DkhtQBU6iZg`<JaO_KU-Q!CxK+fm1fFSk9#nzkkF
zXQ@+W6s9J3yh-z>);(NiY*lj*HFM7@(4;TSo0PnGb@$JPHXNyZfw)8^dO)U9sw!e+
zy7QsboX7YsSn%P!mMUiA5^`*qs}e$&&)CUwo0!)7!gy>B@A94DGycGn%1h913g{3T
z-P1BvJ!t{-#)a}l^X|9jS0-^3YnF7!@aTydXez|r?=~5=AB@=DsC+Q;n36!lsflAL
zP7_MsavUh?u7Q+5(lB0G`e?X2WhksN?k`GsoAb@MFeY<s{*tNC%Z>HY-Z8gB?)*QB
zFHRX4Dx_0|nlj9E$ZW|*_0lq4RSKI=zAZK8Tv@LlSvxhKhH<}*aa(&?*|q4lQ|~O*
zi@_CY%O<ZeTREX;zkgS~_>P405T@&4QE|}LYT(>%5BA>M3obL-Qts}D?IVZ~b3!gc
zojU@Nm0l(qx?;4`o#Hzdcx_4cEq#!VHO9=(L0=2PyGPoCxEbV1zyMY@J-0kPnw*wP
zRl-Uby`T&JSl@YzVZQwxK%G<>N#+JQm|0lE#8wRixIn3_d2P8%S!I2CW@4fkYB0fR
zTX5E!rkzy4u%4nEA3$r=HzF;<zVu*tfb^m_OZ=er!8(3raSZEQAXYhz9hk$X7pnUu
zEG<mx<(6hKz><$wbD2UtzO^GuOtbkIjjUrf@7#q+4?eOq)x0W9_=1OayuLZqQfT}!
z=RsXinP$GYU^!Gwy7H~!R6X6&dLFVa&6$>VWeQ(lDb5t+0qkWo6z(5M_%JzrN&5qc
zO1hi@a03lWA%e$C#eB(8T`Lfr`+mr${?HqURMm~Dw)i<KRY^Qu)-EH1qouB(Txv&M
zNNUs5s$g<=Y}yMnkEEmQ2zXP}&ffY`Ef4WrhQEJHaMM$5Y*#n)eBE0D0y)@F;~i(~
zShMWXs;k1eRVZE8a_lX>j#!+ou$Z&gb}x+u>Ht-&et`Vp9b!Je=2E7arV%rnaMzYt
z-`vpHsZ7z^Gif+#^iE%eF#smPrfSP#PKSqxK5P&fIrqw-4TmN0&{TvJHVw^0Mg*~Z
zK&QqeU>nv2^gHQS8ax;T_VoBRR+Iig(y9cgdh))6(zrN2da)suY16npBfiZ>hb}UM
zHQZz>Ywu1MP+Duz<}g~bZjIQT2y4&`m1K%u($5(L_x=}<(-mlGc!+Lc!^wk@dL9jX
zg}j-`uxhW~b~3$^KD_D<MG2LG3zNfKXpKCX`TDCacVvln9w>Tc%O!<8Wsq3i^<T@Y
z(RaqXnOervWRm&OaE%`6>;iHX`MR7{V#Z+m3$b(IGn$H`d;bW>S-hmFs7d9_VCvnO
z&Oub0@)AR)*iorw)FftA!~_GJ-uBr8t{w3S@oR5W7-#rs1s+V9n;5^qb-m%_+kM(0
zbEujCD2%F8c|v+w98CQKB1cha+Agf-Ej-iq$?^mVn!{{gH0W_O6;?>UM1!m<uU3>i
zZiqjvXo1{rOxD?#0kO8C-INL9^v0UvH9|fj=i-q{sM1`oh=1DbnTMQo#z^@c%lTd^
z&)L}0d|gn8ZIb>_&XiW4?z~A&K4lxqPYrkog?P9s=?+4O-lrqILu_J$jH#Ah{i=}~
zV-?Rq8p>(z@a1?VgO4r5^y7f0ao3>B=4kp>Dy2w}M$~Nl0i1F6X^4yDW2HI|egt1j
zAp#VfSk*W;>((+nMSNx#ap>I%oeyeYa(8W#oLc~i%7XkGj>3f4QL_)#m*AMKKRnZn
z1Cu@G8P~ux%(ZH(+AWS`mSc>!NbY>G5qb$O1hGh7AIL2fz|hYEeSbAmiMG_td{LH4
zj07>0KU5r%!V|x%X{cAQ*(EOA`GPK0Wpa2-+VgzZTu#%u*#jf?1HSx35rwC7jnOJ(
zRE{^0f&+un9^5a%L6lf4lgOrN<J(F7+r4UM=OhlD+7L+|^_+<>0&5DIc}1Y2bDJ|S
z#X%~>ErW<e)>F3>du^qF&7g72T_IRbuiW?|+XLJ(VVV&Nu)1=~tbKg_<t35Pqv=aP
zF6ohb!gK%|G0`mNp2E)7O@T!{362akH5iZbamg#zP*)N(Y2%>**C(1$BEBU(YH%27
z&j)qF+V*-$XBFP)aytE007_CHv&jUv944w_kz_y&SIs(IdAZ-J#<F7BtP|`e`Ld3^
zzkXgdmq%;Id4exPUj;&3;ZYc4mN|``vKZEchDmTcc0N{F?*3NPLpiBzIc>O~8qX}-
z&V*Z0WV}VXMcyuzQL258VjV=|aacXKEXTSn0HUoZBu$z;-!C5FBW`g*BIth5GP(sX
z(vCAUZ54syF0?&~M$WQ$4U`MyLE<x~v4ot5^#Z$n&<dv0W**Aa0jfq|vN6iHW-xgz
zTIR`RwjUHzBxy~jBlN1qY(v`HHJHX6Ra^bixZJM=?Siwu;&aVcTFD_7d{b;A5t<F}
z%}UQu;1sz~lU>DTLXdN3vUVw0H@eJ##D|1xV;*^IdB$bxYpLCQGQ6i_0Nlef-R$%8
zN?Z!<43V=dXE`Z$*-w9*BLx!B7d+Bd@6#UA8kq)?<P;q>WzD%#$C-;<I@un%ywB0`
zibR&I-=~W>4HKaK)&XnIn(v?ESMLSr-{}~^ghB)bIT=ar)L}v4I{&bnVE|Omo2zh*
zJ?^28)09D6R#m_KkB)YCftv%`0o*?hW>1KwA<lcOlLN`)!BE{}`%9We>gFF>cXs#m
zx>J8dZ+X#WExXBcHVzUaW!+PK6YVaI>vD@5X+riy{Dr+Qh?J1L^TwlR353W%G$gOu
zz>lFIXtUwU`GgHp4E#s4@#u`u50Oo;uAvj`usuCOYuAn(BAt}lZ}x>nKTegNG>d&#
zqa1L(k>dNrrFqY)p@I2=$OPH4!aa{sTA(}o)M5nNelN>^kM+RMFFqiRKp}b8$4J=o
z&M446x!K%1g|lEc_q<_C*y|=Y+^`<ml%ohcIo7w68^oNCa?usdXGo=pUv50e*c*R5
z;2OX<H>hg7M&(|FgA5)GJXO~w>eEJU2S=^6NpKUf-kHqIWn$zDvwWn|a#i=Oi*6Ou
z89bk6Fbk?HgOjqKth{w!HMV)~;?#P?_Vu<|Jy0N-b;qpms9dXd0%2vU*JGjGy-ye!
zNaG5$3yg3k8g;h4%aHE}BwB<n|B!+qY9J+QIt8@iRtFbZuIK_^_|C;uJmh=RTtLCO
zx|zydvCTc~0kT9lm0~NsM7Ye#Gd*fRJ0@_xB27hb+rx*xe2?X(M>Li>3e_o|p@+fM
z53Nb1hO;l7C&%ScoNYEnCO`P-hD_{dpj}R;gR@r)J`EO(L6<aBmEd4?`yre82a;Jd
zr5(5069lIrR}41+UZKe&!s3BJ>ihhy`?HmZFQ>#;F{pj=;~D@0WA+A#)evW19uCE6
zH?qWky)cG9NwR8Kg6n5!(?WMLe`ih87pC>p${7wE$C4De0+LM>tgX|~xk?bS=KYl4
z7sFV2wt2fx^mXN0O_{!|OfnP|FB&-`gTHVKENM702$h12tTx{FHs4tQ3|?t$b3g_=
z*Qn0s-$n~XKc-w7z&W`!4)=k&iDB+!c_r1&^G>_WsVkS?E6pX<e8$i$O7ZhiJkXsQ
zJNox$_!h)z496U|_~h8cC+LsLq<vvaUfmh47!Tn4EWT2<x379D9u0K1B{*;28F#1q
zG;p?s(MGlngaIB~iHcA+ZPVl}0nSUtHo?&MT;K;b>aHg)Cz96~ncwU?lA<p`F!Wf$
zJK%lJhxAamd)}h8H$UW4)Z6TwpzBFA5lohiwp>U$YjlI~_@BfXK1$pGlJL=Om7?T0
zAAv7TyFH?O`U<Yo?s><(SiIIb^`kN6d_ZQYs>?ZpkdN+x?{%QPUbM$X|LjB>I7x}0
zm^Y-l%8+lH0MyRP653dzio_)EgiGY}T}fQ$v*SmO9%M3~<O9Ag&v(lcZJ#gWlX=np
zBw`5~VmO%}Mih@ubrKH4;ai>#0W;rHBDHOtsVtNGj#8#e8jnAHOM6hqmHIlp<Wo;#
zPCBCV<WX?4F8OuAj48Bp$60f?SeY+~duju1+N-2BQ%H$RFi_TL%M()LoWP%;ey=hg
z7XM)q*NpP20B`;b;8(w_ydbIh9!q}<m1Gw|cLGXditpVV;T*ON69Qx{tJfmXlIv)H
zjFZ(*6~E=gGWR$74H#Vz&o9DN?xmB##&5|Csd9i-Fk1HD;5V;k4C1d4h~%7Zz!utn
zgMnX}0L+ZliG=i+-+eX}CDuLa=eqkvY4i4n`u|&V4aH0F^8nrn%B;^ue)}RV!KW_S
zn5!{-;GMr9-v9I0`~<=Ol1hr^o=g7Al;I~^V+idU;EY~n(EJNd{>#_+iQ@u_0N$OR
ze`t*S$?{<L12{L?*HZrwcKDN(k%5Pzj{HA9I_k&uzkl^rz6uq6^v&Nj%Iuoo1Nb{~
zzG*B#JiwTWq50jLUJEv%eNZjbb@=#iG8f=a$kGCG3GE-Wp8r7e|CeH+z<QO*W{pOI
z=XWm-83AIE><yX2KRe+UHilq^?zR7)Ve%K31}w+_?-?dn20~`mJrqcOH<s`51)(qg
zCpYDaNY3>C{^X}cTCvZ+<x`olUIQ|fPG7$;!E}j&rhlCue{p!2Y|Q@n?F5p=_`3AJ
z=}Rd2%YxEU7PH@eDS8zin7BaZSmC!^D_mdzL!0~gAM!bW#tbtm5Cp1*J2Du4_f!vP
zKRJDUf;IjdCh2QI61)|HQNQ`4Wpvm7hTQpZsZKM7xhM7Fb$`ZP8$`!V&T6KozYBrB
z1S`jxO8C|_&yY*Gn4D8453eG3`SQdYd;IlDKurG`1LN^fVij<Z<(viQek96{<x=Gs
zWL%bMfjn(F9ALfMAjWZ75B?lyViX1OPx_fzXGyPB&ODA|nb%XrqEN<1rgM*)9opoy
z3ydg!G6jD21K5Co^s|!dn4(0Eux!rm4Q$et8#v?})Qdl<IH*2fVY)^pP&5WM{9y-6
zl7@Cj{mDd53q<zs2$)fTW~5mObgXY;CVSk9{s)=o=QrF2-=JcVWSzdIIzpjSqfr(w
zzkq5aPvECfd4Wx!qxPs4076`(;tEU!s2_VBe}7;_YWL}CX;D#83A&la7&se!MM*}J
z!=y#>sppEJi=lkI!R>zzTvd=@mo^-1?zx%mIix@?ZVPOi4ggSIX#V9Ka2z&K^nv#<
z)Tsw(nKyE4gJJdKm-!k*Vq>RmRS^jObijcQ&UEl#tnxaBA0`X*(@${*ASC2cR8pfQ
z4=H5W1fN_e1$yncM>xL6Z_a=c+5$`c%EMZ4Ype_BobJ}~+^n`{i+!2Z50Llkg#$&?
zk{}f!uqazy{`SB7(25v{q<jJM^kK<hNGH4j7F-o(lACDa0E8)JRqd1U%mLNH9^hMj
zXK4~%E~1hhg<(*TZ=4167vjZ8(q|*GPde_X=53m{qdZAJyDtGDmZjz&m!4ceox2`D
z59k^{$Upv!#@C;={|pW2*3`UIz684Xef^KyZrcF)NBg}&ftF;mthpV<IAvoOj*w44
zs%BM9LqBlnk(z`(aQ(1RdSNuPibkm8q=<6rfdW0l`BaDAN3sH`+Q6m?=vH}Trr0*0
zbcO>I^%g)9J2942MSCtsNx*?R7g7$OxN;}5m97$#(+uZ!kBA>lpbUaU?`e)|Kv8;@
zmn;n%PiIsiDsWKpiq}`BQTdbgT}9zns+cWK^Ypq6m*ZCp#p>2Ylji$fSTOgKi|q#0
zB5>0UKua`LCji*!XGcIEQI(+jkv-1~sQZtLqc(M)rq{?ofcKqC1<HIjfHTm?3m@?Y
zQrT|+a(TP8iF>D=ptfqm<W3DRbg2hcC{U|$9(gPYg<ugfTH$%B47u_&TOdADO2TP%
zPw(h#j>cx?e)Su>YyzN38VP?G#<a+P{$0css0r2s4ZQ43q^70GuJj(zTR_qleWMB`
zz2C<wr>iiBZ~GV5vWoSp7hDC(iEmvx>pPBXIjTJGqPdeh48T@efY@~asg4%;3^+%1
zRw*Xr8+R7I0jwvc9{s^JmOWRjQ4PRsLitNA%>jh&E9@V@F6pMq)3|x?ujG&tgE{<X
z)GqIU+Nsc|f)5$}R3Gf9`U-Virf5n^h{9$)x0{f_pQvIeal)^9T&u4~I8XWd^8T{M
zs`w|KcVIeKfHUxVJ(=lEG=poK06irK#9UpE`E-F!zyE>k%R#l$8NOKcZ{SBMm@GCv
z<o+=+_7(Cm>Tbjw5tHNt0U#G{RcWLdeykk*`Y+)<Efg8`whe(bEwSx8-1Qx<X6NLT
zU9}gX;+S0ES%P`NG?nT#s|}X}$Fz<MC23{^yQl?FvT@lh%S_nj?#6!=Bg=`w+5|Zt
zn)s4vn)WPWWaOZk0saL{^ew;@+v-#z6h}#p@dAEW+Y>AzI3Q8gcNj__{||L<9Tw%*
zegP|@lF}uT!hkd)DIuve(nxoABO%?QAf1As(#_Bf(o!NY#E=pKLpR@^^Zt&nzTY|D
z|KD|ac|FcJGyB<lKYQQ%Uh7^9|EtfZjVoXa8O%f7M~;Hpi)X<AmpVuT6;k47$me+m
zNVn=2uggD%AS8*cJw@+?EZZy44BdXsVrlX`Ckw7F*-oey5`s_gYmZPwG5j?4>iUhT
z3OBW}d@b=@P~X73ebsI2w648Xuq_ooh5<LL$ERH8d9k**62V;j?BZHatT8b287xZi
z{`qC17nI0tAYF8*>6WByS_dy7Ff_|px>l_s?-zwY-)rmj<1LHpmJt?2{u?FD!eKc&
z)9QHJ=T1}d(6?N^=>2z@a%ohG?syu>>4bt>Izi0|3;hhqfo<QT$Gj$A-aL}#FX+--
zk|y|7ZTjRT?heJr4nLytzbn8_|Ed6!^1akupx6m%HlI6xm~32Q?$l>VSP5#i?ju-f
z5yZUQrfZ?cbf5~vX+eKb?60~ygi0_3NU-WY1guO55bu>)&_Bo6+piF(|EuzcRWVk}
zJe?b{G9K>dsBm7W816^YFV71E@<Z#qM%R%RQu06*Wy7TDWJMN8tClN~Y%4u{yZyli
z3N$Lk1kyi}$d!k-S5vjUJN_I%a23y$?9hfD*GZx;h-kOL7pa8s`VK3I>_gsF0mW59
zN$I0A1=Fy4U{8^E*1)a6M^bih88mW%h^WCucZ?{WL<;eH%<=ai6<0m3Si@_0o&l$_
z_9ajz8dD*Cj$8C5#y#QQIy`u+aufXDQo3TE^POT7U>JsT;?><7?!H4_?0>ux3?M|#
zrH|EF^XZNuULLJXm3ZSln7WqAB7HK@OJDWGj>mWIOsG$M_>q!}&czHYo5cC307-^l
zxvmzh9U&gGhK_6gSGMD$5TrO&hr1E}RW5&8JCLwR@-WW{-%4~Esvi<QV?ipS;a{l<
zAk;O(uP`XKKJE=ZX6MyaoC=?*_x*0X5ZrD8sx%eGZb34=cO_Qu-L4|5BACgslC7Jo
zp0X<VN{qx#wroWrwaWog9`aHJ3veaUJBE@7o^Dk8_OaH``SN6TJQl?{0_A9INglGF
zI?f{3iEBWTXY69D2+cX?bkM;f6*yu!EIjTE-|7U}(MOYDU#jmsBE|`)B98TFR)u@J
zG@ssaT}Y2cO4=d?wU%Q1&W$}@hi#~;$j39zfS-&HQ+#gm@ns>=k$sWvG7$B}m>7s0
z2;cGtO1Hx2-+oLD00pofAm*3iu@Oz%0Mxj=@u%v2t@l$Gi|)sX-{Gf22sZ&6C`cvQ
zb{ZdVqx)d02Pge-g>Exmo%wzmtCxZ{1nj8#;%5kPkp6nn9Bs92m2<i`7|!ZdH)bD`
z(Ic>RbH&B4Kz)DO?x4Wja{HG0oRg=?;)}b#f|PyX>pqCBA74`eUS_8X=mGrjAc8j8
zbUmZ-=L0Vv?CF2U-`397R%;yX{2E^N$oMtC*+ZZj{lODiCKXP_KF6Al&g+{$wzFWf
zwzv$E7}G!Lp|K8opqe&#uzWe^^n0BIjq7GUx-Xi-g3nY?B~oa+lWzUdDO{ijtYXPs
zYLx2LddGVK=y&iF%S9=CUQTKVb86V)0Eub&>^oKQ@w$}WJFS+2MaS&f^!>(Cb%V3R
z_StpaqO0a7TVPXItNU4zn;F83@HG!`FgRPtrE($`&~cny{#HO_r)nObW1WV5P#F$*
zs`)|B6B;uoSzLH3OfRTjnqRk<RlD4FWrL(E2fTZi^{M6N_4r3m#FXpk;~&0JSW^-c
zK)wDP71dJW?%Q`;353#|Tj^J4EPmVP6B%3;FEcBK_~#BzHXm1*s}FEluVfs|Y@e|~
zg2D`Z2Rfa?u+YRT*G<xnD<b(!${2UuEa!CkcFm9hR|>+oz-if&Y!y~hZo(O|>#c*i
z*j^HCPEz(MiRZgPpdgN?%B>aJWL?kY_)gmRx#S(Mmn$pJQ-<c~iT#*lOZpbzV@pq8
z?bdzITl58C2_>D&b5gj_a__;%iNH^)5QU>@E*`=m`vT+6h0@M5!vgYe=Txz?_a)+y
zeXt_Dy9`_lBT!6ICXQ+oFNIkM>~I%wjfMOK?m%nMo^=K(S@(Ibnl`X#_a0a6G|EBW
z3v1(2C(MCeGjjas{G~w1XcKR}eF1dY=TS|*@*O=A+Xvx)d$#T~Tu0{(?*vE$4;!iL
zMztFgY$ue2APy<@uh4YjdJf`+!7H?`y6j`jij$3Qk%bjt8DbIMLKhOghBRjLOU_f!
z_I3G6e`*rBr)iq>SfaAaAU6F{0J%1PdsoB&YXC4Eg2Z>dqx_Y~@k!t`3RbuN75^an
z3NiyPpKhuTb=%!*W%`sp))SPb|HVhFwF-G8m;@?KZ**P9)sj1D!!8!|YJ;)VDK#rJ
zzkcy}js9@%<U^db#G}GbP_`}1=1V8V6Vp`vf{T=a<${&i(QvAtTcFB#65K_6BM7&L
zr!XQ(dmo0EwR}O4IBQ!nzXZczM2X5u^4<;R*qu_h;bSQUg;TQE{m3r!i4;{;(S2+j
zpnp{cgL@q>&+3%WifeM>EuHdf+)I_)E$f)SmjHn=e>WyG@E6UA$6PI)l2&0@><A`b
z4`w&Q7@7r6i|=S?-$E5NzrX2L59%om2_Q3Wl_c&U*S357Q@!$THr4`j+x>~Qiojr0
z^%rT(3Ql<B{DZe6Zxt$lji$&VI(Qtr8*c(=rj4gm=Qn-FP%gtFeyH}qC(*z(G?(h4
z5y*n=(#i?eN(E7z_6zwx?k?NP($_@GMVAT_O%r#hG$=xxmJPo5eeHP1y5iBnBG<Q#
zRT4}t&B}-B%4LB^54SP9@;cEYw`rS8G>!AZ&lVOK7vCIlZPT#yllp1a4wDF<>nA{F
zUF|5sf4Fs1xOW_7-pq^{s!o*czO#IC)iX3%K38_{Y65Y&e0j!SjV5l|6U>@X`(A<A
zy(lln(vSRSJFooZJ&kyALKXbK4Rn7f0)y;JMX2S|%C+E5Y`-@TJwKmve3n%aIAK=k
z_!2rDd-WEONvNZa=@RslB76Man}}%<%AUtKbwDISjoOw2c{u&e7gj%KI0WK~k`>;K
zKp(zQfI7%)EZR=@t>gr(X3XjnV@C>*B{?IDOzCF`5+4W^wAO)gBk>Wut<A9`uKbbj
z`LPG3f8Zq%!BOUJoPvNQq3*f207AU-0fZ%)aW!+HBlH|P?T{g@QSte$LpwLeV56>1
z=*ZY$Qp;4=hOD3Ep_k*ygZeu<B7B2F?f6AW1`9)&%`aYpwd2DOo0zngSbvtjDS;HE
z7251bsez{m_4}$Jtf@pa3brM}zWHwpD0rR@IoZYK`ZLKo^&T3g{^~ZX0J;i4K)Muk
zs+_p{B~n*&UT25QQZ+pNF#%Mvl?5qS<6sfDG?)}Y)TzMI&fhU-)K(NCaPndG3_-TB
zyf?k2=?K5YS=3K7VH6=*4T_&wMABa-TN51N!czn#;UVrK-HxtIO&Yb$VM}R>em2j7
zX<2?our)Nql-)THRzv62d=`5<vG~2hY>j%2<ggitU3*F@^mN62e5@4zww=!6NAVZ2
zk#chCOH`=-8Nt(tYqx$O+Q|>eu-xs@A1|3Y$5?lr8p-o~4oS0bKuDc0-HxMJsPL#Y
zk|WNvQS0n&k!)j7A<=OV)w7Ow5ZAd;qx9g#9S=CN>h7>RVee2pe%eLZtUyL>rNBKq
z4xK+ip;Y`ytJR03(o5=MvA5Pj@DTJu#k8_p4`ek7pptjWL<DmQn#=j<bqW+;m$fm;
zLSr4}VP|G@WNa{8jUdN$DhZ5*Iw)hSrlE4ex9P2<Cqes;FM%rrP933+n?cOk^OUeE
zQGS-h{8(*SI1l`Doa4d}8{$(hK1!@U<`%u_TEpI8<j`GW*9;I2#%R9oan@>M>S5^C
zr1PZp#rkRZ`Q0q0$k5phx6ju$S9`13LJXx<<Ii;il2jAU(_4=}%$bJssqT~GeI?*b
z=9Ahi&X=$u?8;DdI6L??YI$->LA+Zpcb*DLcpNR2b&r^T89J$E>cS4-cHK3W(30V=
z&86M;>)rW`k09@azGwC0-D4wPU%Ie2-7uayn<}&rCztu<7JVUY&~e4C3;9mnA$T(K
zm~6UyZ>>y0B2^EK7fOi;wH#+4(kE3GK50*@W8s`ch#Yf}mB^e=MOy^OUOze4@a)~a
z?U>?Su6Dl2F|Zi7ixg52*^J{@m%A~8Ji3*|pixxYI2=~iUJ{DTQuUvZ(-+=9Pl;T3
zmQ(KA1V+p#8B^mtz+U$4geIjYd1sO0on98ZG~N4f)CtsLp>&py1St>UA-=dDL!C5b
z<LL`o(jM5PNVCB_YRg#zj3?O-f4)XXy{(gO5n1Ob)V5rpCq}n>%w$T;r1x!m2sjjM
zhh{Iw>1)K(%c!w@kQ!nW{qUK*FG)RC8;(o$`S{+6J5EsgE$qXM9C=t&sjtPMUgCj0
z5F#jioX0r&LpR{dQ$Gjey(W?x=$p3;(UFT{_qIX@@_c=|yiU%mAFJy?MR6Hr2V>7-
zn>NtL2FtP^o4<IP?9hH?+(7aml3M%T4exIG$USdCDZ)0$+=*e9h3%p(&wbd=Rq=$b
zY5d}W>&xl<0#!r?lzQW$q^2`oM*7#YBZ4jg&)b|BzuerK*UP2FI{S><-m7%bk@|?8
zlWo0-Qq88j8E5PH%cla-j-#&~+I`Hq-%I&!OU4~a#j&D!G`w-?%*_{B(K^VTrHbox
zR=ZA@?tPaqUZi(gIvtI-vYYBu4%)aacaLNI>8tz*yaj^Qhwv`e*SH<)^a180W_2m*
z><qpKrweV^Vz-Ok*SfnOf5SKZ9LMQTPA#gCE~IV5OO5iuj&s(o_hZJFMNaKcL%OJs
z$rz%8Qp;bi`4ms>%6)VcQ@&+-h8m(kkf3HaDe0?DB;L^~N#I`)AEb@$`tD}(f!Eze
z*)VD4Z`<X@lyqtCwU~~Q6Uz2AHq#|TngYW04;tJas!!qBSqyEvPg;5UD)t7E7ZUbu
zd5&||d~!Y-&hAU7>8vJ$L#mz>mHWzWY_13wN2*O|xe2;1yKD@Vdz*Im!szNfS@UIo
z^{Wrc`*n>^hXwbhV%f5e6HM#z42~Dm72`cdv4=x=>f^m>Q!yw8#%3&bHHH?tbjeEZ
z&_EeD>Cp6K?x7^q9g1v%_Mk1u0Nw1FN6k@8@DR;gOPvcLq$1J6!j^-~Y?~Z;J^?Mt
zt3N-0ePxzXR29$I0cS_87^(nM1(jqhLkad9=)6t4_;D#-J;t0I8G;8^3#$hjwz|*<
z+IL_@((}MyqcTIG8+D6JGX}BY%#<}uc|Ad;hJ0$3FVjfyW2K_zEl**irZ)nhw=;B`
zR|lZCy+q1x?Fi#TYlbT%s3O*oN55^9Al#S@@pL)gaGEij-Ifx~4pn+Tg@VE(nA0ti
zc&UkiU>tPA39=8x25LS#i-YxZ8D)Ax&FN9`Zb9S=Jy3e1b+L_eA8iQi!#1X`g~cOc
z*h5#U$hA(*mbOAB?)xx<+BM^dqf@24NAt}`?`L_Ue~w2~VY^!K@4RoQu==~hU)<+l
z(#^da&O3u|D^>2WxFsRi5AtB;qB#)V<nVCul)LiPUp63!bNJ?G8E9*Iu*lu;p^>7c
zV(N}Mi+8w>0n@pdC3<_LC#a!N2ofiUD@b{JLK~|~TM>##!YiCtX0O#0%TiEmOgZ+v
zP}AO)O?D6`!|{+SHG{ZXuCF9z*>#<P)JVE^T<P|M=o_6825LQt9~8PR85TdhbyzGA
zRO@W{yv{&-d$EAYPEM`1e6eG)RlsQ0b2Zx42s`AlF;`FUoAOtSdQHRiL8RO|vH}^6
zHjS*;Z60V;sd{Nm{#pybv@qBbT>;4HmvU{~n0T;7);frslul_?gcHFT+eenvK9j+_
z_6!Di#?WcHN*X7o%Y!jOPQAu6(8B%`Uq9jZe@>nTm1$VZv*3yiCNH!;zF%q;pQR8)
z9^mb@qjKqRs7ep}z{Y6TGjBRI<E4X_ploOIezDK+W5V^MgZg-^KEp(M`*z(&f;f)K
zxEQ^@$(<wZ4D6k`VPML2kRwE<9B<~!G>vTmf#f*zwdD?W`wu1`K{qVWOsJ(9)I5gZ
z>V2w-7zPPqQvQXe<!>P{0{5cUg+eA<U^ZXIA{rs&`cUC6Ixi5ix3$5U$SqwMefPH(
zK)IUBj~iv5!=!^<-!h;+OTxcaH`%eS?64U3;=ZRRq;E@1?Lg2&Z?0}!uMtWX9YpR<
zBF-1!TG1mZnlYT;K^jOwEcN04x|2)YV7%C2F(C<L>o~{X<voPo@*lhLJrg*$<u3Q$
z$@5<?m_=vn-RW1Yh12ReHNE9l*P^O(EF9<K-LD!~jIVd)JuMNCc=CTwy#NCTD2$Yd
ze~7p>@xVRDiXjjCATM*!zV*tA)Jo&Qg2GNHMY9BLC80`Plt+94A=?v4S@d<sX0OYy
zNKf>={DL6zDRWwRzogAXdWbD*u8rHS)DyV{XC-r?z3nm7W>TGRMOa}K&*h?MV&KmS
z?F7wm69i3rZf1hezH;ReBIE~qz}rZS41b~=ot@7qZ$7e#0I%j$lIYgl&xwk>#wJVH
zs+*7S?HE_`&NZKXh|6>94yq@@HU7*(1MmRZiZRxR<w|~}F*lBpqEHlr&dC=Q7j`T6
zH1L@pnIa@=eZgn=JuH@+J&Rt{5l}|>s(0kgb|6B$sh{)ZhaHP)Yj#iAON<G9b~Aas
z_diQd$xb$kI!2#Cr8|XKGJ5fiZ@y)gAH2p}TW(Mu#Xak@zYR>HA|#PvN3O$S+6yw~
z7Ap-X;)>h?$GX_aXuQVqV|ukq8ho(tVu4KZ%LCb{!2K((g@?5VYHIVY?tLG&_9@<h
z9a!t`wZ}qp8$LSdYx-PNFmXJulhQdkvfZyCvA-t$6+UTvvGV6qWkUP92S5v^W<&{-
zcQw<`_wqJ{-&d~|9Tq*oXCJRxHO_-a8MM>7iF*3lP#kYElMLn(v!oT^+wq0w-Y`v4
zs-SZ|Ef68*LVdP;4gdt%!@LpE+Z6Bg?;G9j%X}$z&8QPElavd=8X;zv-inIj-`z<_
zT8nwxhY5p&(%cLPZp8?WEIXh(Nf+Yw{w!_3Gn)=I9cgnEHjOhcyuo)nXF(#PCtY85
zSg0_Opg9GT(Hoor4G&02u#{^A@~zC}J~&#GGRbbAfLtQ}4T<(r3(H$C^{Z}0rnsPV
zU$`+}Gb$zwe&yCJeII`7R)<A)bC{H+4sOEZu9SgH$*vHFuGD5l+<4`q+g*GC7y-8y
z1&G`Pv-oT@4F@xCcW9|gIY)+Ox2*jnt{MBeNYs~AzI0K-YuO<X=!I+KX*L>^N-p+b
zNW$wi`WaC7AnxOYD;8~00w4|Rh;_X~o?ZUpIO<^c#MZsAk{R|v4C8t`I^A}73*7GF
zOQWcgG{Nc&Mr`iZ=y*Q#4oZqKk(9xq>UYPoFz3RDD~l=SXo;*-yNZa(!^4@*`1q+1
z<`W#0*@=8xtMqPPwWfU!p#mtpPOpj?<^SSJC0PSiZ5Z^G3K&vD%SG3T1)Hl>#mZyj
z2<c~yIDHf^tsb3-Uqgs|9qFNn<K&H76^vU2;%{6-8=OXbH6Rn<<?Of-$C|))bXgt|
zb5-8MY1G9*rl11id67IHE&blT0%kv!y{FK63y$|To$(O@T5jL^+TVSDta(Qc7zUkG
zjYtW!9tm?HTuAPoc1V0pOj$VtiAd57MhxEbg-C9E&tqy6M^+ZapWX9u7<#jLB_R@-
z$=^3YzR8!#ZYDd(tJK6mxtH6~_MZ4FrWc|IP74~NwQY%JLF5s~KB1$)i0j?N$Y4?y
z*5WunS8?JCtIvF*N5)b53FPb$RGFIm_w0gHnkpxx^Cyf1)Ke75jrz2EFY?Wj&qtg>
zg_Q-y?mm|KQt0j~-Yqo3C?cG(eh=xHH49A4w0$87&#ofv;$dQ9Wi|ulJU!aX2@N7T
z*c|;q5P1f{Rv_0rnS@7cReMYkfHAn^Tu(dCx=Iqyde3?@*?Wh1gEEcQYs?ELhU_03
z=jy_5eba2LWoBK(E$fox>8fgGh-||)4WC|Gz!uv$Ml4nU$u$TGN4Tg;C2nVIZ!pQ$
z<89v{&64iLGRI;$sHn~ECGkd{qIf*6L8=yKu^K!?AX9<GICR}>?DelF*cvt4VRVyf
zp-4^WQLXM1%Su;7UTQYBtsC<RYBvMzLG{{5UNpo{tquEP1xK(@_&m{NYDvQb!ggNP
zH!^w;DV=A<2A=Kn)}f$2)@NV(Y8Oi0>p?Rd7CnzmsZ=~jv_BEN4IKYGqCX(y$E7{B
z9P^UJ;8P3^!7WH@2b>Xu!ZKZMXNIV&51)m&29lt#qWK*9UT}zzm=4Wgt*YgA!TWsE
zk6OLsx_qBr0xL7=dV-_mV~$Db4O6FROyXu*5|t7L-_FDHmlbW;&2?uTpZc*2(>Ysv
zEegAq4o(}zmD*E2Fu}$4iL`xrSwnaHBZ1Gf;Bz$=4AG+3aZ*EeQ>3jaGitA`Mdge}
zB9?X3XuI&gJy|osxqd@5KmXp)cPVmP)jhdUN?JI`%uVga&Qp>Ht(LHy)PKlu5a*vY
z4l5OW>C0Zr9+oO-u67m5Sq)uf`|><teniJOS#!f@^P{;9W5%3%w+urYc9d2wI?e1&
z^I6j{XU%!Mu#_`Z2uz8%K(ebehGKURfSr?o|E6rLE2XEXIltqld&)w+jwg=ZI?}D0
z?6An@ht|@bo`SC0e-(c|HyG;ETn!%Mx4f{4kB5?fZ<qP#SUZ?i7YLK9k1_p^Mj?Kd
zb&Dzr0@D3whi3#SY@>{eederFjIwi?yhmjQ>Ni?Z(+uK<4E!W&VCH9Pf=S$RrTT|~
z7qOF0Cq~!L;<=J6y-W3t0xzEH3C?_TC*NrGHN@dT$AZY*JnO7p^XeafB;9<@f%hOu
zR(W*!i-jF;E97>odJu*gD=z;;K}*Suug@I_o7yg2COUR2<bG=*4%6PawKZM3Gh0y<
zI>9pS{jO?ss#eI3yzawgQoqCXsG}B%=Dc1ItE5=A1fbp49)FNT{e8bmiQRaDr8NNE
z7rQ(2DA4>AB&frOvb5%c+%7Xq(Ve}``eT`r!tmvm4%Vk<Q|9se#i$?7lUYI#n|rUh
z${2*t2Hw#OX};`&uDEq!EKf;8*ibR=-jgfD8JLx|4>f;xREy4M2&#Dw+g)p-Zp?O8
zcAjM=n-JT#1~nKIu-`g+o}El9G+?}y<u8m7bdNpuYu8B)tbOLD9Nio7cZwAY&;R<P
zbQ-GyhJi|2*nakn98u`nO_K2k$i)?xBeBrnn?Y;BZ5*>)2qP_r5n2+r3`b4A!B!<4
zRQ+zG`XUp#t%a6TTXCJ0;o0&P3u<#ZPyyQiTbhlNo)Fr7wVOKOuA+iUL)Sv<vxJe+
z=M(<x&U2CKvYHwkcswM@yHNs6C_WOenj`xM*mOXmx>W}=u=DwP&g?}AGjW!nW>kR%
z{kYs}X+NDvcFeE6yyXim#{#RJ+06cH4w|z}%rT{$OcMh!4@5sge5P=U0A%+3@g(O#
z;ti8niLcJ+#jA-QJbc+~PtqxzQGqYoM}q>Tn~|Y}HV;mlntWLta2>xdD6D-G)%>Q(
zv0_k`m95#X{_BKnV1iEy0KC4RUOpZ_4jzOCUj~deQxuCh)f!rAM<e^Q<r%F3Gs;cO
zehM4c0*g+L*wf;s*Q_YjmEM}5ygu-z=pBGWyGG@3Ripi|`ZfDcqg%piptW0r=51Zw
z%@3E<c{Qig8ZV*@PdZnA)V$2U{Hwq8@mqd&s2^Zd_xtD{DyHLKNBiEZ2Cp1dzyuiW
z@h6<q;>T=%Z-*QY(K^&}cb4tU>EHX-N_3<K4*D?(o_3iCkvQPmtfX!=mUeqNOINNX
zUeEIVzq7#K(*gO<7DjrGg~S_Fxkr+T^nZUT^&c089rZG6l)om?A79d9L5~}p8cx9Q
z+Ct;=u$Qxo?yvOE?-$0YEn)g<RyK3Ox{ZG??SHhw0zwTw@9pkt`}@a!UEfc6#bPJ5
z|5Ii4S6BWDz`=zS7l00OPPW#ket-4XwbUbje{=$f$&DK~{Qo<le*b-N{p1Q)DJu1{
zmSjErpIZ0|Z4CE~gG!*d{;#k7<08usO+w?d<6_r=V$2u;9`4_X=07g{pFL>}=f?fx
zgMTlK5?PAqU)1sy?W5}cWgPJB9^Lxak3NI0jgsfs{X$dz9Ho|yaDobd|Lbr6XwGkK
z{K17%4qdAt&))juga7R#g0MFE1XEFU-q#Yqq4l><{<{8wgK~oaBKM^$ntXz)@j3fH
zH}wgs6N*!O?{kZ%e`ig8b--U2r;)D$2#zK$l<fcc^VAH~aLCj56#vo&cJSrvC1>wv
z|M@naC_EwN<;VE>FYo%{g|%V#`CFTQzO3V1kN)R*@MS^D_|G=~YU$~_S4Ob?wdm(H
zzh3&|f*OMtDua!M6&CW(Umf;@3hzy)Jk<=AtK>g-k1`l0X-f<Je}4Bg3_K>MKg>Qc
z|9W!%xOjvA)oK0#_Rq-wj_Yp?0Y47j_Hp4FBl_pweFi2dD24U;=XZbHM|loS=5sV6
z<+anHa+TG^`=?m~rpwoS<-0fjXxFdx=Ick)C8qI@yizm2keXlf>#qwfm<86q3|=Pw
z8;8+<|LFfumVhV>jn5lf-jI7Pmn!gKUI->ZxwKb=SFAs}Vbj_y=F37}4Nc!Ney^zn
zCX#>ZU(#t*sRoBYiwXpyWM8NB!5sqBw2GR{=L_<9QBBBkZ$YC49*Vp{Kx~x`2KI9}
zGEkwaYyLtT8H5x)wd0*MiGxyzCgv9ZzT`*IqTJVmYS~R}w2PN0^0U;Kw64wFnV_nL
zl~xu>{byC4VsHR5Jt2U#$WCH)cl=TJJ?9{#?;7<2;~(o%ixNI*5|}7F92^|)Y~8Ag
zw0IkhzZBV?qm<Tpg8lqb?LSM5zc9lq(*a<9OU!CBwZ@dd*L*g!jUx8?S4{BNG{(B=
zk7w`51wu(O425{x2Jdg#@vAOke?1{!Rh}oV0<zjcNM;{}D+UQuM{0@hK>@{hPTL<-
z@GF)-Bg{mLSSo)Uq?yg^Dt0Ty=0Sg8AbB|~yX{n$9C89{ABqUs2hM=MVGt-H<j$A|
zsS2absF5gL!S9h9Ka7sN)W-p{j|yo&xdY(pE}pI!Dym}^faMyN_dqtZ>hqz^=+sjz
zAW5nFa|wvGJ`Ly9rO)sEeU<1%!;(wlpdklO(PS;2qs=1>UN^<I+(f;*c0l@?)DNCR
zbzzYN)V_@!`qhApM@NK>xKI`-pKkoJ1Hv>+?|A{FctS9V9v_ko1qV%cuuLolUeBd~
z=hNj}(s=kH38bE6_o|$B4yWyLkg~fhy8zI@2~U;eEnci$&A>!D-g*H0=o>5!IEF06
z4ZFSKPS`~pkZmA=K_vp)Fq%SAWdZ80Bq*5I)C}}e4S^y)mWn*L+R~%gxr-tgA1nvg
zHlM||X*a$E6;+MJqBIZT0^qLO!sh9&2~_!$u}2v%x7Pa1-{<9={vARhhlC>=xeta<
zA0<x;Q#uPBpNrgH-l{GjY{o!Jf5So162%ztZKRVX-^uv`NwcO`)7+gVFzH$s7=r<k
zX7T!Ut4|{UZzuW&{@MXGZ3#RlYl?mX_gu%G8^)`tlesjJ2Rtnsc?*F7cF1iYckhOV
z>cC1M3e807mAA+E?&r`nmPi(_xffCaR%ES*MOh~?=0;(KLS;f7pgp!{f<m`aU?J6E
z&dka+b?EucW91pr2r<bdR@#aUk=T50`W+ahFO~tWDJu(rQn^>3ZjdaDP|qghat-q3
zz@hW})NBe`*>)Y|^na|TKZyMCsM4Sl#JpiVB%3@MOU+w&iow|)qw??-q#H50O{wVd
zkl!VN889^ELztlSE^Pn~Zdd?zGbs?4UGnc?To7;m2s%j!>1zxJd`@gA1-7J-6Vkpb
z#1A-R8v;rbHaHfmKlvfX2Yll~+khAxDH7k`d5`16r~@tnVGLb$4trp%pGM{Yek%8D
zvAy>q`7pjA;GJPYy~|v7L3I(qkZt3^H#l$wyc;n+Rf=8s32=9_Ic8i&gA?_A`Df=s
zf~B->!4_A*ID4oeecTDXMrFOb66%3$d{sNLMA8?u$GsDqqo|qcXd|2r$qTOhgz#+-
zMMTqMtMh3ldA8B60<`m>gnQboBQpi%kC{S^!itQ^ZYM<Ys3@E^>lfMkZ8nw;!mEhy
z&EVVV0Uv=<K-0RVLsptkv$M=n(XTxESVxVodnv$!;@s%<@z){CPr>9tMac9}oy2?!
zYB#W?ExR=g#PP|4(F&c+k_<z3z^{)(pGLXDS8j_Oi}C?m&1~k$A>YG_Qb55P+gZe1
z?Rgr20OkOcN1=O}H;FZ=k!}Qrk*w8U7SXZI{X%knO0^9*>{~*oCA>eE8_0FrX<^-C
zu`K;W1GhT>ip)*>P8K&vp8d}}xOu%+Mooz|f(J+FN>p<-jG=vcd!lRbM}kAU$sTxC
zW7s6+9^w-AjsVvMyrz=@`z{rv9JnUnnf8_+43xbmw)5SM%M8lA-2eFYK0+&hVHCH*
z6bU_~g~7`K=WMmVtK1=w@!36USPoL++yU4Ntm=$VprqW7G934RIRd1&6Ei3iE-dqs
zAsB99@_-V%Sh{ZrC69Mdd3n3HBk55$P|Z({tTrX)o&#Fn?a0JG$!C%d5hBlBl&L><
ze}6mN(j+vV+vK&DUD4b9br)K8F}KSnX1ztufQ&bh$dMpI{cz28i_P{U`BHx_1J~$z
z|CYHK!C;+Q3b~q@-5pM(WpnB(H%XSw$#P;0Rixuv3ZMPqWcflaOtF+?j<>7E-G$2K
zH*f?w&Nj_OQnl_y^|KI_gLR3Wi{=wV9}!urZUW&j%{+sx8u3@)_9AJF{p#DFd#o0e
zXGxqDBYe0ysYSXDh)0n<)(<0o=xp1Y2gIHG1A@%Jbk#TnPhCY))oy(_c5=~O!f7t%
zx4quJ0X*||c51$ib_3Xq-&!v?m_MdCUoHc7?~siad{ZU!RJDPMm>Fp^|Fax8WVTg|
z*$fCUm5ll(4<V7N{zBD<1l0@NDv1}T`YL(Ho$9i^HcrW`jr${rrWDiXW_EJPwJ(V(
zy0!;&o|esnrHc5h$A^o#bYU%Jd*zaN&v(<9s*eStFu>o$!Nx-EV8*7NTzh1S$y%vY
zJuF3Tx?jNL189CRiyejU%aQK2XR}95iOKO=CjA~WV1&6Ul6oVZ{k&nR2U?pk=uRh`
z&YV%61G*4Oq{!-S`P!YKaUeULrgd$)A2sXP#s(|^WJkRcpEZ#rewoOQreS2q?4>MT
zcIpi5`hHkE)@VLe)62a1_4UCHR!ZbV7GiXh%l!*YXoo=aelGj+Vn2*!v1~sbMPt?U
zo6qccifw`MW1piPEHF3I$<kQETupi^47b839nSTQ+hhj=S8K;{mPb`fygBV(D4hMd
zX`^39={7qr6H*>^h~TN5i4L-W6QCTD(?fjaN^Ps+1g)8{Y`~`B=`;2cY-Xz`$lvIf
zyV~0mo}|z090`w`5Zt@^NnOctvL{^bDjMRm{_M;N<O;@@<on9>)0U=3rnyf>g(oqT
z0wEQhmnZHOs=XVvyS>a84t>*70imoL={1WJ+Y@29Zotw4%c{b|Z!_^MMSyXrOf^cD
znbW$k9|dLARQd89cTMi2moR%5ia?C-*Ml(Eji(utT@~(yMoC7Jsm9F|;$%a?)AzF1
zb!6`0^`R1LfQdzBCnPG?poJn!7mQyLJ2RNat{^VJGsnLoj=Gf88Jxeypx?hvt8Exe
zB(otZQAs_4xM$2M&lanRySnetWM8JdD}ZMqm@KI&Xt%|k-1)p`@9STVgJ#wT$>O+s
z)@*io3WD5s3DRHNYF9Cfe_=lK-&RX&uy6cMe3EcbFw2SQk?xLZSf!^orTj-g?yrXn
z&V%esl=%Yn4`7u>mWw~#76n+7?1X9NNiN-#nXou&HLX79W}^jW8FA_u#ml*seVuRU
zwEEINK(FwM^^LWe9j7N1(z`r`Z4>yxBkrjatc1jJ8rEE^p0xMfOYIN1>~fZKKzayt
zJE3uDitV%pgdBcqkI9Ya;ynHGR5*5W1Xk7z1VX&hzB<DK3cJcd#f0*U4^DG1S|i`7
zJ#+`t6#<5Ic{^Z+w#%qGe5<*1I$!PW`y$P_WK8W@-{-HGXQ{L&8MqP)EiQsgLu$#F
zP5Cn*EYub;LqK>v&5*mb@dLIt{{zaWSn$(P)op<h@3khbl5#oeJ@ubl!e&5z`8zu*
zHRcD3v%c@MAkN*hF3YXItp;zyo`?t@09(o1i=Xy>k?H~~g9(X}_vmN@&Y*2|QBG+0
zeX(TkDht7HZLq9bU$5k1c~*Lew4b3U3Od)R0o1*!WhfVBMmmj$rol2F<q!LUp?d)=
z6XzhVpl?n99yd&s?QMf9jhw?pWzoy`62!thHO~xBx~pihNQ(9v^c$y)@K%pX##xQo
z<<UY8)}P>N{O{<YHGXno+;F*`J8JtFnN7d1b?+@7jRC%fS@2gm^3NPQRV6;G3hyG9
zON|T`44Ks>nFAM2w!K#$BfPC_{UwPLuD@%)$WL+@Mf6~8iF7^!wKko5&~ZY7;=5b4
zAq7u4X_`1Db1t)SmHYeL3zZw#p^;Uo`H-40nXQOU)aIm!HchLZgjp)cx?~OBR(+&F
z7@wt>1iUT@mxKUo2LCpKRbFl4?aG6#vjZBJ%2Z?+eHQ7V$&=wIz2F5&cNxKoOny}B
z5Qs?@V3dMu=-n`%ts&=I-0zA6`eiWTZ!R}M7z>n&>Pguw)3$>h0{e_OU3dFw=teYz
z(JDGsxgmAj)p#K@cYCM1Tzk)gB!`qB_BG?S&npq;rO$=LJ#Bx{43NRO!6tITJL2=l
zvNfx;hU@~y83-{-1r5YnB&uiLVcbw_w&Hr5M-h}=?gIGz%LFX$KMiaeKoL4Zg$Mm<
zTIrMCGM(gOWxy<urX#SciDEpA^tiWQE64a?r7HgQ?j^|(Vn#hU9KoCPERTwXWn}3h
zTepx@&``34lO@JLIl%#s7Kh3x$3tctCvKzM1uSICre()FL7k{S4VP6Dn!r@+cIpU~
zRvCBw;2Cii7P?Py^wAApEOx@b^Qji?Y^3%Q;Z0f+JEY@Kd3Lh)%zU1z+)p%KwiH@l
zwHcKzO1V0q7?|(aDH}HT*mGry$PV-m>ks!e?%L(_n>g%3a|MByEY;<<8kO&{|2J0g
z$Gb{2O9o8Hy(QUg3DLYwZ?8gv;XLiO0f3ScGK6%5Sn%eyJxQ)7Y75ggn-`YMSh(#@
zl{v3kdzXgx9L)Ry;8-GJf;3M#H)s{F1tdHJr6a&A&?HxSP2JkrbbJJYEtVB6uo2%L
z*A;XCwROuE>;wTeT07?r`V86u(7eww$WTql=tQbm+jju)M0NCRbI!!O9_h&@SD||1
z3OV?Q6Sk>Eznotno_?gJ`!wYvG^X#aT(1PwXtsQN7J?!tB>LUB+`#7@gv2f)&U|R`
zXr3$cB#NrH2J{oE;))j@cY$(A5IM{vMY>4P`6mYNV3mgPwB+K?nz^QA*{v5D>bkiR
zYyq0Jx!Vz5XHez;a+{GUizn=8Q38>vs$qtvj7=ZK<m)n5OmBYnDtMZ^JaS<Nd-sUX
zzMf4uI_UaB)L5zu;Sk<7t-R)9VR<hT=PNtT5<m7xtp!@C<bp9!wl?LG8L=QU#XDzD
z$ZWA3ukjke6IR>W%^DoxT7TT)noG>f_J&a7{qCX9*)qEyza9xQt)~?bzzK~EuMfe~
zr<bqpch-5|)5&X|VHe4!4j#2{+OSOP;##9Q_es;lh0l3S_h*M0)bR=u1w$|$ZAKoA
zwMBP()2b_}-DQL4rJEP)!t*AKUqXXY)dLAWGS|cJrU>gt9}=ZO*U?8De>>9nE1-kB
zCQtY&^$L;OP|%TT7si9eH}eej#-X%7yFSdS5!|tRa2ACx8HCTVQL(P$k*Tgy7RweZ
zL%NHy8_=QXxK?b}Gm`JH$f+xg2v;2YiFpCaQMk!zX|l?k>9Xu|BwiWp@-oBT#GFS<
zV6%jMNo1p%`EmJG12*V=K%Y=@7<BNKt7|zZ>r02Dp(`gUC5{aY8*bJ~q!H!A{-Vu8
z|E{eTYlQVx8%dKAFLQzU+Y)H+D4+>+1ZGpQT<FG!h(j%plC3qMYX{#c+2A4O!DrK(
zq3&TH)eCJu>G%0R=C}PlDP1RTpvrc8_F2PPg2gB+Jj4ScTt+=8og=|Qz;b_tK8qav
zMu#JUC*NrPT~!~(^A4ByECk=nmzeRY)|r->Y4Hea$-~u(1i#v7eVs5OFT&uZ)X#kz
zwxrG+rk!zjhHAIWD|Rl&1!c_$qxnZ-XYC}AE-<RKgUZxyd<CS)RoxPpo?|DG<2|QF
zN|R%7_<ik@4Dtp{eU2#agREI+&%nW;38YcFe5vPEbHP6Z{(9KGgsMYj0b@hQuiC4M
zzA66C6w7`<%O~AC4S$h`koQC$sfJDvQJz(>7HytOk>Cs2MwYB(TG3(QYJM-`*UYY&
zbODm@-PIQCuH-U(HOw$*eLtYDYV%UcOsVJiz-oUm+bMyN-fm_S++h<FNdZ<avs7+0
zlAzCT9zgRFIaw2nzjnq>(ZN1?=Q0>gz00-3;7!zVlJ;#@DJUp+s{t`}5(#C7<^|@Z
zx5IY63^L~Jckbux9y1}cf_G^^+hRXM@5Z_p%0L}Oi)6mYYI&8~ubb359jkUi*OvY}
zqPJ!p4ml?aY{wfv`25ex_O9iVbG*#r(7SM6s6s8d+G9@Jky8-ye26=IG$@9+g_PcK
z#23TWVtFLUeIE<g<6U?ks9e;qljCwl)~=E<-|#dFx6j;sS4)K#8kp6)^uRejpJDw2
zn^DKf1KIsxVeZu9;F(}nqy9$()HPZf4`AP6riC)+P8u{F394w%ws8oK%9o1C(6rdF
z@b<ox+<sq>M0#ToN?xoy7US{dg6@tI6W<40kt3M%$p{QtIOQ8L-_zvnz0Q<iUP`gR
zaFP@tn-cN@S_|BFoSUG4Yrc&^LJ?6QgFL$<1VEi^O3KThuJg*P6Uk0CbTF6Qej$)J
z@Jtm<?NlW?`lM}4Uei>*gcT~l#|Z>ytL8$bv;zp5LCq<M>+$Euq<<s)B4hKf%pePl
zkTxp0yJp%bNt1ir$T;hwQn{Ara3cp;uF)uPlt%G`n$blJvB5hVcsg&r@rOnxEM<cI
z^Ls{tIDBk9KHewZs;pL_K(%De-sD$hP5ZpWbhD5$?N5P0SuGOo5fAddFi4sbxat#O
z@Mfrjq*wiTA4n!76U}sJ3WX;LRO$<^F85X2p|=HDMRR}qf=f0ML>hE$h4`6dWO#lL
zt1AcMgWhRh?+Z)XEv&XX7pxeM*Dm0KY?51t9eYn<)S0Sz394f;U%U7hU>sx&A_Zn;
zL+dhn#iZ<cv#uX5*tS$k=JpVa-R8i-NJ5^NMGPip1EfQ#Dx-Lqb%z<&8S4t4AAut}
z)zBi?W5rovUoVmAfwRDCaS?GPO{Z2a%T7&_@RczY#eqoz?=w)T8lKpGY{c)%-px~W
zX$1!1wBPW$WNHT<Q=XS`Ho0;A`V3cE8#b0l%!i{KE2`lxf-|*~k;Snhx<7!rMmm7S
zd8wl}+BA^6k_4xeZ%ZQb$P;*G6?ltVHw-5AgKlLK8mNiCnLwr~^m|jCS#ot6%s+D|
zaeHP{EEId(BUNWKGHU97*k>Yam|>Owxg2ohhU*Dynp8`VFe5QYgpem<L5D3+qNS_y
zn!OoB9eW$19tOL8LEj0^C`sc_@le9xado_ffIm|EW@&ld7LVH-f87V^RZ>Bpph=qw
zNFh$o1DrLNq0g3Gzoo+PpLPf0s8CvyEaWIP*QiwosC)UrvTv@SS}1g~7dJxRoq!~#
z+NgPg{?S7;NzET$dCt({GS+oNS3gf7Q#`ej*sjh#QSti%;l_bsDhVT5rKp)*Q;|@9
zHZ-3N?Kvi*UGID9S{%oko8O$~_tTRUn@-6lBBlw8b!IhiuyhISNO{9dedqA@evm9M
zbT`~PD?;Pl?<pDGuv<=^cI>9u6XxX6<nKd<+tFpZ2U}!z@Q`D!hUql(@oFSzrJ#5+
z+4>hf=`ScF9iMc(SedQ3^gm>kgF{-pBjdM{#67rn-T|$bKvgJ%6Tu|=nd2*P34Mts
ztA0k8%oBz#?wwSAEmgA@S#D28jBe@oS6(Npk|k!qk>x=IItg9}8hdvFpOB^4r<MVX
z=bd{rVl4)lK8HOsAtMh5HWy<94dw|P*3B}dIVK`ZpK0au*3yd*vunnFi1S&`n*|lx
z#f827+c^EnJNIq=A~PM7H-i$%#0WCgXVeBkIIHch)O0XV_A?1`VsTW88uZpK6uA`g
zckpv=S-(?#mF2U=MJ&5U$NL~*8-LLh?9TncSiQ7%4(Xpal=NEMyyfoXI*6Y^(>T?2
z#y*sw@fA)jZ`qqB5NSG}^s4&WL#29QV3#`au~b7Y!R<_JMDI$!?~Yl>xjd|{z07wX
za=_%(xuS|wTRqn!ssZMDmRn4nz6fu`%gM75t^euf8Cs4VKcbtdXj5|^?z0b6_UNZ<
z?Z1mtz~5`SxD3kcd(?Zps};%9J96k*k%3lySCwNU!XWzz2XkWe1{1SIT)V;6vsOr7
zE6dZ~^09kd%$WwF&VjW7sHtzdow&)?z01(;O2;b}T$7%uChq|eHZ-0SOfyqL76m!e
zCUpf(Sp3dr#n3GR%z$vJR`njMT#uOs<axC8RcWilM+1TjgKxyHdnAg=-+~IhmzZUU
z5;O*Ma-y3_<84k{8o3IcAt%Bu0^S8a&g&()ZvFHuuZ>Tw6I5F}-X`?on3`qOg1R#f
zZ;-{qGJ8OnI%^P!9l+X1Dc6BP?3Z8pcm+b#@5I1SUE5`s>z2t+V6adzZ~(Lg1Z|^F
z6uRANNL?y2$nBssvrlIY)9Jc)K@sr1{?p<(D^>MB(8Cm3j=Z4Mys*lo&xvjFk-E>_
z0F#0TjXF(BCt10*voI$>t5AY-7?v2I^`dGxAYz~3y7o`jByM>q*ubaO6SVXshi`G}
z{^Cyjg^h*;v|P(WoR7@)mt2SszgM5O=v>GfuS@M=hv$*W^xj9gkTuvF;Kf<_Mr2ca
zPzs7|S12UEawe7<h<?m*O|I>fkS!GqbOXpexFIghYpWK~6aB#k(vrRsRDbT#q%tVO
z3ucVun{L__c3w}D-dqgb%%67U&9?`b8N8FLo3}S_59~}nGA%li?LbU{gr!TFu!NP-
zv2=d;x-5C*bAp-ZAEzM6b<Yhb77I6GxE2tgXwFkFlvZ6s)Y9Kc;3j^_q*++R_^nj!
z&to*4nqwh2b=j>^SaARJU3)7V3*W^w{Pcbzc|!I0ClK);p?zn1VVJ1v7LJG*c@eH_
z(%RMzOmNaEzcu}ayZ#5oBJ=;jG;Z}|oMuCp09)66mCJB(QJ>7IfV|LlaMri0^xVk#
z(Xgy3NUM^fqaqXN4&aP~8gPnFJ*{qzQJp>g>_^=x;~)D0Er$$x)bV@=jO1TwA!NBY
z!EAr?>3>I|PJ>&*+~e0t-mHiIZ&Uw+zq+Kp3QDyjQ1kgCBllk<mmU<@)uAen{|j1M
zgN`Ma#>YucO8UdCG5=Rt*Z%<PS>i}q0&Z5szaZ8nXcBNpUpaL_sveDc<G-|o@;}h;
zVpp_vNu|smNaSB#|DP7_N4?U?^$JlZ`j?+FM<q;ya``f`{@KNU->}eqYIvTxg<9Fa
z^p@0<V&!y%isf%dqu=1$A7t0HVEb4_OvJyv_+RAPe-PYf$Z|_nxvDv}+KWFP-(Q1P
zCl9y{Gm!k#U$6XektK^txR@tPt@bap2A5R8-g1b)iyV-de;<$=$N{;Q5%D`V{NEvd
z!jArBAurKIt>$04;R$FXMT^Swf9VGL>#VnDW$W^_|M?aLsI!(^9>4mS{VyXei)4S$
z>yH1+7*T*6&H!M-v_l;i1wKhh{(fxxy{|w|7Rb1!ep*M8%KqPf{Mqo{6sRUX$-nzg
z?_S6I!2<@<<^S{J4x{vM@}>UyCcy#Hpe+b}vZdw8e9oT%-hXfVs|a#5{kDR=euqx~
zo{ZrCaih|~#^%40{7Vz5P=?j4U{J@4(fbDy|J)7<YJ4RJBW%=v`34naU;jJh=oOF-
z{C{`dU$6X70ZYT_e%B}M|K87UEvMz+a9rrHF)(;S_xqsyetjB+<hg8ye0u!P-!KnI
z!*QlsZ^onVlTH0ZdRsbx<9-lQnZtX_Ig@;<E7jsBKt0jGu}Sf`i?<06sRsd(VT?qp
zRG0_W%ibQKG^72g$m#G7Fce)PLi!=Yk+AN$FR0)PLTc8Fd`!1Oxj2UHUSUaJO{mWC
zrvHg}J^aOn(r{Dg4tdpb1lqAvk$J&V?J}Y39?b3y#}xl+<t*QDx?b=XCX3ATx7Rcs
z6gdEmBpwZ=T8S)46rdg9?g6A++MWvUzTE*TNX+bw;OB#Y$diyS5_fNpm1RrL997`=
z_w}~(ETOp;=R(!Do%;HZ2lNRM5>9+emc57!srUetZDc*6@8_cl<e)=8Eq4tVTyG6Z
z(eG_OUuF*#xmZ(-#(dBn#!x!rHXRHI5IlO_rir>dbj0{zP3N^a{aM=x_Wm{?-V>`o
zudZ!NqyV7j^Ln>lbgXV?%~=8pqThy|)D8thL9pNbm43J5&6BZ@!bIOd{)Q%*uEwbc
z$&qZqw*cndF+MiAg}bliP=Jhx15%{RXmx;=9V=KeBPez2b-b^aojbr~9DwQa3JKrx
zJCzXR*~1WcyAH%ynsfNWJ?`8-5_|f`B=H9ulrI!>JrHdl&mW$|Ap>2@x&F1Y7>Lwf
zp#u*+Sr72LHv$HLniYlh)52Lmi>d!U@}t0tFQa|<>2r<Wp1qtvusO(V-7l5}L#Hd)
z&fbYsvE)13tZ3K2+)dmmi}7K(^=!tvq_GVs3vqqg2W$+I*I>Rm0A%$q^^;rofX{uj
zabZ&69RbFbZdBiJ`h>7EpsHX61xez?OTgct0OXkr=$sW55=_`>-1cGb$^oim(nhef
z2YE@f-#SH*<;qat559PW<ggfm0BUGR?dLg|H#p}n6pZi@fmG+zTfptt?+!8n3Y$Zc
zG>|nL)Ab<AU+mZf`AoU*;M?1Q-8$|b;T1p78$uzzjw7_M)S!n#MbKvg6rM1v1$|sd
zj58&4qJV&xz*aj#oa$8R7>IM>Q34bC@1aOuf5sx!)+C_65D&@oOq#&KytdH<K?(EB
z5L5)I)6o)t1M`(4fS~=UYjyVIxCY)$Y&_m>zVZdOy9C*Nq+5(g8Jr~dS<f3saZW{f
zfM!9j1MHy7E|5$e!^@LZ9HcxB(6qpoDWE;XG!EWq0EwsUPLzo+s2;<TBowME-6EHc
z9^hGNLzZ9M0h&}h1^O3E=WrZ9G^Do4;=y0gr*Q~Ej23qX&=`o2bc5Tc;@NfqJzHhn
zlz*`qfbf(aR^C8uAdWB}l8ubGiyWv|1ypg)$^|~Q8qoJMfRWEx9er@u2T3;}En&va
zy8z*05D@JWIE=p5-C-lJ^hUf5WPvHWDa!Kl@rwgsALq_jc>S}QqeM^Zksg0YX{$<7
z(Qddr7-LU}@D+?XBN4E33i7aqggk$+FCtoQ;6xoI@sOT@le2Zd2q>;c5~)h^SP&l_
zgxVg0!+0JB(#TnS+&Pul#&xsGNyzdsk`UEa10DsBFipLv9MGE#EWmX5<T1}c<`yz3
zgk)!60Le7JrS=2AHCg?Lqw3xlw^yRXdmS=8ZrcL<Exzn6sfeJWH$eAa1MIw_+x-xb
zf<%5$Jh7pi6{4GEj(Y!y0?<U@;FhC8q2G`ku_he%?}nisQAcb;JXaz>g9vx_s9|HI
zF2(cCsN1MdP?`F)Y~Lt5?7ruA6L6&Gw7Ap&G@xrSNOq3pxB10{tJ}4ZOZNK1DeJ|n
zM8QzlA`oAyM_f1p;h<2k;_(XGN2y(kz^}p<D(10w{MfF#m0p{>zYivk*ml&3B!W#n
zu>5u6=Ey_)E-|@6FZ1Afs!rLt^m!6#>?A7n)mHaF)q@K3XD?VPpw!7lSlo;ywJ9b@
zkkA(fA@SrVP}*HQeCq7mkS@FlYPvji51%^fC0<OWPf|@F(k>9`TDafObs8yB`IZlc
z{S+Z6%iX-dkZ6-2^H}0?<|L^lKKad}<ia5!1DPMDZ+n|7>GdXsy`ic>cheh0p<V6n
zF)p~XJZGz%w#xOKMP$pzz}j!g9Be5uyWUOCfC**3&pEJh#`B<Gu3@Lp@eJf@&4@qM
zJ`%A-LRZ`;8$LADP<aD%480eb@;eU+u36{5O7A3N8W=kMaIsKf6Zb92FNDnOi`+gF
ztM!(r=VQpuyA}UPbScg`KrM(})dEDGJ)d2U!Dm1B#~}`7Y?uo7Hg^2-GjIk|8RI7<
z>ho}XapaZyY<9QCO?ci9>}fT`_p3YhHBU?M4r##3q>Z~ScDy2|ky$&gxA}QVTFE95
zse}YhL*_F8+33d2p&WHJM0M};m-bloo5#(2Tq3DvW&tncCy_iV(4cD_&T2!f4AW#U
zi}VzyL<#7OuAn6lM$-m%gD+ghMrtWlW>iuT@1=<Zr_~wjY<qcM0)ujp?x_NufUsi$
zS`GvjvVC$u{4P1%m0Pl3hH<FxEH8-^b5@Zcc+pauhE>E2<(V0Z_2tZ7Id>~-NpbQj
z$B@o<%a20&20EL7#}mIzmy`<C9ZiYRCg@@Aehl+Fo1QZ}Z;sPrKYJ&e`Md-cR1<|z
z?jLf`DBzv*9<8wYHLs{qj6<#w-$BGwb2@j*>sT<Q>~v>eC{teT=-XC}TLs;y;QREM
zHQgndNXD#r!CVf*M|s^ZteOe-X!>?VT@ORK9Li6UneWZ}UJ*XUwXfO|^U)2MU|)Gr
zu{(&*mPNRj-<{)Zscycvs&M!+MDv<s_))<doAYDDiQ_sbJWQh^(43MOqe<pg)yt6H
zLelOS!q!Y$eNSRMPeRc};%==Q(?*B2ans;KpLHW#vKQhAdy`z1`eUdcUF?sp+NMgX
z%t|#<RM39u<8XW=n};PzS7Z$;lzIvbluZ*TJjp5qzVtKQf6Wd_8VvRtU24N#O>QU#
zDv)n$iuwtgU-FY+B?~&mjD#;L`kjt?Yyx5Y7`2aW(TTi$#hM}Ep7lNl<{z}+w`gu%
z4-uw*WefO?h^EvkjluT9EGJH8BD;n;4o=<-Wy2x<ya{V!)MTwl)2Ec4Ce?tFwer*9
zYNX?MhllZoIOL$R+p#NGaq~gqYgYEq?`Gdj%3f5I_iQ`{Y3R|shZS8tLrCo%gwD8g
zUyph>rRj@C%HB76z9-A)o?@yr$(<Ur`o#q-$>TD5uMsV0uNutW0=S*}sp{T4j5e72
z>~-SAf)$_ia;}ZS{zBc|(|#`|uE^x$SqIVhqbRM9o&;JS+pv!kj_%kx&W#-6ee?8-
z1MAqH0+E|C9O%%0S^&A_9<7}_l1UG(NAJG31aMoiB`ZZu1Fz>(gs@`F=<P0{?FV21
zG#<UW@2%s}xx>>}_MM~}O~iY|9sjC?>Axq=7R~!0LtExH99_&yByimM9fr3{i<D8h
zylr<H$`Yra>5?2N-bM8_<2XL8Cn(ci4Qg49Q|aDApSbjsLzIIzt6#@(ffG`-vO7Ox
z1uaUsme+<&u%$Y05U@RASxn_guE}shwR!&5o{i~*zoUJuJX;0|7w8XW;Y!SHV6o+D
z&6a2J^WGJ|6~vqw#5sIuvL)<Ebp&$PBKK<K4jZn7hsA#&jL)qyAleiRB8d^KmKiQ{
zI&YmY=^_6QTUQ+r)zbDAK}tgDMvyK+VChf+X{0-)yQE7|8l*cE=`LB2PU!}PrMslN
zzS(=<8=u~Pbal_!b7tn5e12iM68<5*L$RIZ)>^feQzH7)nY$;PWDyZU=VpD+R{^=P
zXH)te32l}+$4O+JoMWbxys^6b=@C`iX9hfuIcruwt`^&`Ue+p5c9*ES2!Od%pKMPm
zTN-B(o4+f~SB;&|pnbY9&WhreR~1s@u=Moan>TcY=qWnq-g5#*69b7JsRVh6Yd~3b
z_$~7Sv{ScVdt%>V%k>6IAjF!VHubtgmw#fBOaS2X_PsAE{Ex!XV^+>%&@FY}TQm9+
zv=1sbJx8QsznhA6sVKS%R$F}oEI|I0UHGPHs3$>7$vY+W@ap}GjXWiwT{Eq^a<H+$
zjb|H-AAFS7nj{s)mS;C2<xw{=*X+@W5WUK^FXS9aa-XG&RT_!7?SM0DTt4uyE=15E
zabv42Un;srVR^Ne1|r;kqa`$6R_pYTcOc_mlm)_NMD-1gJP}Gf8#}QVIMISP%K~_J
z;CQ_yA3IIbn93KhRRaARqbd~;fkLjCdFUZGWzy*Y|4KXXpc;h`EFo4hBIK_NXnoh)
zvgth)*zu*ji!RG$%M-ZI*xP_U5ngAHGAhKl1tpGCH(bvnq$^HsV8BCfSnrDETD)&5
zva6<jAc!LUyJK(rL*_hfg^w(>xM>u+VQ@HM<Vk?ubO>q)eWA#ydT*HP<N{wC2dowD
zr>Xwvx_kSc;z^k@lmQ=rJwpKEiwfavLzYl!zJqSje0uvBymN=ngEHObVLDlv@YDc3
zEk;;V)|zTuocu}RmJ$Jurj`ziV5}g}@!OlBUT|$8ZkqaXD(uZ;WAAeyX?Onf1znSR
zUJOmh6wapDrIX+L<9e15wy<8Mzq9~EqX-JzZNQwetsUXgR+Nryr!>*%zN7YB!>7@q
zuf6T-U^-Sv!2@}tvlY@{*6>#%r`h+6dVkaukg|$+Gh6o<epq%szbI9j&!#^gCP(;m
zGA$;)BT>IPcz|2|M=J|pT{DcE+gI-k?H3=!gik5Utk$(xboIp4SC3d8ti~73dYlp{
zS-7dbQt2(&`DX|EcoLk_WdD%tHT!y+znKRq%Lwh%Frb=a;2M+nDLXuv#<j_<D8!n<
z$AQpF3q8~i`TC6gjBVCj==dtWA50F^^DCBm7n(C)LWuH0-Xo<lzozL>*z*SMC=AxL
z$g$4~_Z+mT?TLrwiPPKOVS7iWgQUuVgZc}0Q8Dcnsto3byRQ7|-Plj=-o_Noi1okl
zn^3xpt<5KQx&Lv%m?8B;&Vq^{&@)kNnq-h&|D2!J9;PMm*?4N(lBoql^_Gp8c+H`A
zg{`QPqcoGD;Ri)<Y2Awp-7gVb?`PTC_@Cd>*2wqXJ3$pzH9pMz4k5T#`gB*>7GcZH
zZeZWrweF!mx^P@@xypbwzfno*=Eni`2-jI=$`U<s*sz*#r(+B)GvbxDy>|B5@YN_<
z=PYFXY(YrXedg}Yc6m&&C~MQvQ)qKo|AnF_#i$2n&v|c|IPgh6rjIBXzKu+ZJw1YL
z<r<%3Bei~GebliH@W;`5@kkyy8%dR5N3^<HX7;H0hlX9l>DHXZ@@fdaKUeH#$Umo0
zp-&MqU#sLb!n|x<cOyGn(7)vOgDn9WCcnPzMRG|^8>48U^0RV1*SE6QK>OE-cFlf_
zG@0`*x*ZXg*4%e}oG9pk6wS)W&X2|MYr^mXyWMu$%Vyepd(a?^c{m>TqHxV%Ph!EF
z-zyO5W`{!clfgUUsH<QiHIy>F)SI2H8*c70ti!4VW>s-*nl9QL`&hhwt-7Qp`>3l)
zA~;eVYKsqPzHSP?xQ?jdTXM6e!c$8%M0!B@q4$bP&%C3j3G+Qb4lP)4Y*n;GCQet7
z$UspGVNtXpQxDWQBqLO|D_SCu7Q=EhUIxb+s9!P3(wekeW|CEef0HkhdQecW&K!72
z$RCPS9IukB{xJI`M@Xz^EVJtPr<<b(Od4gAAL>08EF=r9RAmZ-jrVjH41R`aw6u9u
zYy>h{?Y-MKH{_zBu;dmEFR(v5bML{<S?u;tZVJ{<<6CE9qSqMQ(*H@g_hX;0Ck;#W
zIY&I<fTD|K^ei+uPD65;NjK3BM-4k)>oISa)YC%F4#M5GC+%nwg{-F0Q?B2i7xS15
zd!{v7S>o&18*`{O8y=B9xYrkKrtrFhiHSV%TbeMk&@pd+zVcy^@)7I{-|=KU`FRuL
z^TH-^!`RG2Z+85e672$1_2$CRHzmHN_62X+AA~IT2D6_^dG3j{3)51zseIt++fbt|
zRav^6HNfF(1-|Khr|<TxSasg+S0rVW<aXX5nQ%SmmE~5qTTY1g9%|$~yP6|B2{~b5
zN=@9oUy+C;qm9AJ(%NlOSp1x0p0*@?=P2!2e|*;KsV9)WQlOQGbUGnj_@eWPSU$u?
zL#KPz+U_v+cD+r=SxgC|NsH{`mwYpp=;c2(Hf)HLXfsq-YAzZsTHOe)i}&l~{ysuI
zq_}+@muivE&`P&$n>)}eY^#2Vev>?Vs3#wgBk>YCk7a(7>El{ERIhs9s<`(0u2%nP
zQIZsvuw8o6&QU`pbrK~?!i8jETo8`5bdEXwJCZmj@t88bxC7Q0ROYj;;8ZZu@V8+2
zysFUV?eeY(?~%#r`@#fEKzgp-5Lb)c8vI6M@-6~WbRB2ng>;=QvtQ5WHYCjbhm#ss
z(VQMBlof64IHdmEw84)MDQKBiT9l$2PeF#RpU%@5L6u#2_P&j}$xNY!!$aD>&f&S0
z2l!Z7(bI68$vS+PIq8iT&LM5lP%+eSp?wR)qDHNMI@qWDuy|$P(&h3%I<Eq;9!Vm6
zmWZwLT}A-UOEz}%)tT|+TRF@3KlEWR3r#WW^d%TwYS=C5+k5X9{x#T$LJg^G3T~FX
z@~c}phWpVT;)#a(D|DAnhCOH@qN2}};be=0SZ4UTN<95wA1TxqKxkdeyY~UTFjE66
z`eEVxMW7~16Aan0FQg|{Ypc?=IKCxJBNhq$Iq8&Wn*=mp3LnaUvzNgf;h)UG$VdCX
z6aaNd6UgD?HGF}o(afD%R|IY3N;Y0xQIt;~e}{N`dk^RRu=cr@KHjh_nLw1cUNM}q
zkEPNLVh>9P%Ir1@PoAwaifLo*gp>^WS*j3+7%3o2V=C8ZS1vM&ZK3W&YcSliC`u%R
z7#Ay&9=L1V&x?M3t8etO@g*tJn|gN{g7aG^;z2a;>l;n(bJ6qLliLx@FWRV+e<wa6
zMj#}J*6?3)evmRbVh5F~nwn76&I*h-eCk+d0vqpjXl1K$m?|z%)_B+UoEOZ*jw|MM
z#1TQQf^v84;>Q*{huPJ3G!<Q*X^VN1;u-BI3s!H3*1s;M^AdKY*t7<c6burP_vJed
z@YP7EqJy5E9n7<Gx1H>9nAF5fEc5T~nxahz8>+f_t6nimn|M7qc--%Kw$7RB_JhAL
zak(kPddyLWm{E-(p>~s{KzL7AI$DEvrEbzbmQf2SzgLAZOi<j{;_oz{UzwP1<4D5S
zCjq9cI|uG7r&1>7&pb&e!wzGDxnWy!iXfc#<UBd_$02W%=;Gd{?{M<4$6ioO%D9fS
zy&6(e)C5}e<-(ee<!$3d>We;u4#3CGgf6Fzzxck^GtWA1Urx>Yqx=eM+(|_&A!I!t
zV(ceQG&`F5rPD(A@STcU?^w}YNp}hj+LX3@v87d|&}WgwJh5^jmW;9u0szZ$c4g3_
zD?=_FfSOst6I-0&|00^Uc%c2kPsiF8wXZF*#M*oqjM87t?H0-jAz+1s2UO=i7Yvlf
z*t6e%egr2AU{zDYuyML}zQP;rtRFz7NIIDZNTT%=-LKlev!<9T_I5j&Tc|=Gs((T5
zIwn*_q+rX=U;Q#tHnDZ|c>UM~Q#$6!`)(m}te`scLF+W5@I6m=5&Omt&K2z2c9P6P
zKeyS1M%o<Z^$q*MZZ5rF{_J#~*8`A$_7}IXDJN%34u_P8lRIH)mv%5Js2ip0<o@yu
ze-N+I4sW43Q16rTD0T6^Opm1PsM4rjUiAPFC?-S)y<zrwuLa~=s#*WQ!wIht6Go)#
z&TdZJl$nveS9MO7AV-rV7HV?mH}R8~x}dQdTXLko8hSOC)FGbB(m7uG!I<XXH`O*w
zV)~pu@QrI@l)Db#EqK8N0K>ijdRdvMne%whfT|5Kxhp|FX3Z3gBQ5U|$5tmKcGVFw
zIp&`b1oYmC*Q|Rduxn>gBXUbF?jCKKl>E8$V|=vFPP`^R+27nMkQ{oSc)V(z!*rpK
z)LgGW94+@c*A{RXx_c5rWK(!J+&JUYU{R0o{LDI8auRx}W+*oXcYwq@Q%M2gT9wZH
zd*22jT}*-9Cf5kqMn<IFh>e~WFzsbw*`Zd21VUD*a4#&1*&+#y(B^%W<)QPWhSWVu
zIjX9mEYHQ&Dd+U<{dV7=GzV+;2aZJx*k7r$*oEKfMyzQc4r?e|h%c#pKBpqzhXz@a
zS3CU}#xY;HQIq8f7E-aB2HLfD_rAIdqkUElEbLxo(1{FO?bLoiE&L{_VvBd8&#}pi
zdT-{Stl!Jf&4aMCR^5VS;VH8*A%XV|v$(>0l%O>On}9RH1%Xc`bU#^+97%6uSQ7nY
zF?@PHGv^5$uiOU=#xAnR=I?s%I+5>sOcr9HK28bVO$ms|abM)dkb@PrV;mWFEnPK5
zg*9#3Nj#_7<+~}dZ+tX!sx$Z(lt3KfCqeE(mA?99m7*soft*^1%=L6=@BM2F^F>M^
zUq;_Uv72{m-p9B6NX72^POM!k1#D&oXo0Q8<Iu4~f7pe`e)de<6nNGyH-=aWYP-u<
z-oHM*LG}y?RSY`&<6S45)COy9$g!xX$D%+&In&ujwmR)RL{j$J9z{#OO?OGVPTe$g
z_{o5`nNXJ#)TMI1SvN7S#f%A8fUbO@ty^tj^%9dQU?EstC~?`7eN0P*kxXKSE@b;b
zf!QP2hoB%AaN4T^{g~>sOtE8HYdpMz|Ki9$dDOxZoXIGs=Jc>N3RLj0oq3tI{8VMD
zY=2Jf_gHpRjg-Q?5zZ5%7k5o`$I%~HoKham=y!568BjWcIW(k}O>`fXrqt_M4goEl
z)hQ?51LY;r$BxZon^M)xx6@fY<h=qpS#1DCC4H5MAdfR^Aa_-|y0BPTX8i`kT=#gy
zV+I3QRy!sf3wkwHQp4=R@U3_oZQD1c(wCjYn%oz^039B5hUZs?6vI1(tg#KrAtx_p
z|ITcR6Wp$@Gw2tNQ%V^cyHKf|orhLoc-u`&ty8Q*iSeRu9%?x$QBgEv=HQsny5Zld
zFo_D<oe!e1y^2umcDJa)x<puCxMPDWWWRgPJZLf_SJAVjDtl`R&t?t1SWLa~lx-sL
zVOwGoQWx*%GDBt*JMTK?jxaq69LEHW$9)3Aq;^<~YEy=W4&T~B^_-`l`W~0DHU&2$
z^x}uS!jIvhUXeK8<UAperqa5fM=Oj&z$}X0?RmDsc}JB*eGSTW$2yt-{kAq&_b{N<
zrvKOw;QEAelCt-XP(@~)hdHf)4u&m3SGDxfmYhF_X#V{d&239CzHB!U^<*obw$i+3
zkKxFpgYAY0Z69b)Z9tTPQs4V>m9cX8AvT59V*{($X)UzHIREzNe2JzS#)zo>S$Q*v
zJbj%)6HCsMQikm#dmdwsn~7kz*{2)vHKG~0r&=6!f^>g>&$zn&p1nUHCx5vVcoT+X
z*3W_}m~LxrT=Xr)Q<v@puK=1KB!qxXWpR!v^4#$3s2q{MLzQpF)rO_Xp%VA-_0`o>
z@rS2V;CLbbMEdLYp3tkUoCSg%d4DMI4&hzx`r4sXZ=Z|?!H<~<S(+Ms+GT`yCVBn_
z&xEn#;N~6DUU40puIk@X41PnBO-3`J#s$gu8}mms8qb|w=RO9sCKVJth*RGRId*aM
zd87(4P@zl4ZCf@6DS{r)F5|fCD(IuDp&^3}q@ICEwx7)~r3J;N^<WleqXv*Ks-AuV
z)%q|CMT?d#B_215p8rmuO1WTUs5s4G^5a3T7!~W4Rdk4cbnx&cw??RQB2>wJ1}n)!
zQk(b(V!(TAr4HEs8x5j%d*gB5W<=zY`~od>++;Qu>*$d$8|3*7n#|$)?Cc8<dJFwW
z<o1{IHe;(2Uf65w!n3rj#yV_lt5y$)<9SU(6|!d)3yf@eiUY>-*60fIx!mLCEQOyV
z;v_8u+ZEc3$#96$hEsH4G9e^=P^u<e3_FPrs%Z94t99cS)HovLzVJ5B^7^?0GNxp+
z>~#^u_GVc>U+*Vb8fte9AU5m2(dJjl4gG7U*hEih2N0R>W_2Aj)XkcaT4*;*o}d-y
z9!UfK$7cI^PMfF%DNg+L^}HOvKT)==ZOeF3L75)r9qFXWk{GUN^Xpv`a}&px!O@<2
ztWd4(@EG@mwh9<i4?#{e*~q)M8q<hzRkUS=U#_S~PL3k}dhFjol&0@AyOW!?{;lD>
ztfkLS$-i!M(u#(<h9pz`tP=jIJ3n}JLOiaAe3mr~Q-4#Ff#_&}va<gGPO;TrxoOt6
zLTDt7Vm>u2b!9MeDAizoug}DZ<Vb|NqKn%*Dy06QPrq2LS-YMJC&U(;`E;jrrib0l
z(P`+PLySKY@q+<~36?izJ9j?0v=|_7O$P{WdBp==frGb#Cm}JIV6!nZVlnup=mn0|
zSe*VIr<CJl@Z<SUA*>eNu*S+a_q_)f(w>W=$H$fXGx@h?u1m*9m0xcp{8n0#9n`~-
zy2cYVe(1Z~2sk(+nJ={?n#C>_Uo=jO7%~Cl9-`(rHjFRYj-`073{yz7P^k-nQNz`3
zYeElEfkYfRo`-OMoaQ(wthS7Ym>-IQajmjq*qJOa7Fk}7{8p+7#B=Kz;n7lY&(P#D
z?>hnRO}T>q0dD}1G9#}Uws{kJiR8)u2l@IdtqoM?6A0jFnV&SmTD3;+dX28`;@hni
z{8m6;lu$<akCn`|Wm@oT8vZ*${lCxpPWM09wQ5dM^MoCd@Vv22t^Hfv=U=D@4Ajsg
zw?;!4Cn;6;zyAB5B0kmzh>vdzCeV(w$$zKc{|2y_iRkyDLvZNidhg!7ORT>!I|5$%
zcqjGcz<<0{hT|VqpqAI)`N87vpZNEOwfjJGXNB=y_2`SLTB1!zsl>p${Qr2cUjyai
z@ztxprC|slnW=K2M<m}dpTzz@#KfO<>lgV{zi{AUnUPCTJpcR;VXA-1_(#EwKEUf9
zH^uc{xVujIf7LiPz?W3!kD?IeZ)E@1_ksvUy3nA=Ac<WsieQpcVD|kEo^%ud8=-k{
zkc|#V1QKw8g;s$5AU%<IEaa?%SSvoa+lm!2@D1>gNdU<@u6V2<_?L?7;P(5NaB}iw
z9uBscO~Vp8rQ8BykMjVOc@MwMO`!vx|D1<stxty{ym5s<DiD)z))x61B=7@3l2*8w
zl6y>9=}7BjH2uEJ9LTs}0qX#dx;Jo2@?H&Lb9`noL{elYhE|jz`CkPSkpNAfP=MRx
z7cm-}<?ejvK98!leY@ReQFX`d<1kxKYR{trJq!RB&;uEEf)-$d^`ICepIvRh6_{|I
zjl>;$dbD&P3IXS>qoBxXr$?bUh1}Zt0FK$7z_&Q_g%$m1aM^>eDpecnMhNaXhkJc5
zC;q7becbzNV|6~CDWlqD+f&b*vAnUv0a<<*B;$E50V5k7Fa-NDQc~zB)?FGebksp|
z5_x$&=T6eAqmgL^z32K%ID`DgOS8{({QfCfC?dS2UWO(&w;qDLIqE_06M3hINnlQd
zP{!Z=K=m$Mx&q{_`CA-%SO|cuXl=Qbm!nK{VM7hxMj%Qk8hFpp;Hlh@e*)L9f$s76
zyJTOxXDP{%Nw24jW<%v6BY;>P_v2e1vyJRAfVPhnodey3FgM}jvIt{*9J&EZd)sng
zlOzPEz;mEmq=3x7dm@rmpU}mRffYB;RgfW5g8Ro9SM>8)asz80la;7gU|6L417z&w
z2RO_wfJfRZfC+IiVb%UY2WU)I0PE2o2k`4#K<}^j8bFRlmu~u98gMSkfiX{8Lz0&E
zrQD4i(3?!E^E?9~6G;X@F=Zuil?id)bDza92xj+GuiwQ^qwpUpBsa`o<hVg9slyu>
zV2$<RmUJC}B(31_6{wYNU4U!Y@|Xo@xxj(KR7sB4cndDVnp6+OEVzt^+4^)zJm*_i
zfsn+Dg20Q>R$j-P9=M>0=qj9c@9O;yPxadj7-vOSdoV9I^=`W1?n_(JdgqGVt@ob1
z0yC?ZNsE3Rfw8qK863q_0m7Dl-}tf@nAE@}1ET<Iz&tI>M9bDnlR1Y6zvc@Z9>KLd
z%mxrMuj_=+C&{ozkXPGXS*3xCk5$K&hFvq#la5%Vvwr3#m)9WU7H2#VQFY+C^iKLU
z9K>O|!ja$wkX#{G8NvYLY;X+3R^pbfZvt!pZ#vY}97K0F+#cx<z)Pz`ofaGq(rMpv
zFu<b&4g)xF{3}4V_uxiN_xr`g>`fY()1YW#O^UI=lTuBiFs^bvfb@vnu}nky*$ij5
zKefKOu&_x#6O@`|X*?e*S=ieFN*e5opodaSeQK;zBW#7h?4HS{7BwhYp#A&UIk2e|
z`#V5TEqH#YvB{y>AnqOwal27CZXEdnbS=$kS~VI7Aa;Oq7j`GnI`h>yFVR!1bbyND
z8n}itaL1e5(ojDL6UuxWY4e{ND7zXA5Q_1E_u?lZL{TOY7bf%38kFA!C=ir1k#T&`
ziId`usM6EqPgtN1X%T=};zp<SDpG9!(%c7baJV)17OS{xb}i(JDqTY+wXVTXuWzjI
zB_7vm{UvB#wN}b{TG}NP)b`PhDh+|m@3ud!+1Y;_akGI;*}^*g7rO?TT#}d{n2&=b
zM0WX*@80DQx=!^lD~s(87Qf$eU>`B;0E9)xDGl<5zQf>fr>~*Y<xW5tX6ecuD6JUb
zw>{lyg$vW<5)O31F+r=6op{S2NGe2)c?SCrUTQ{?EhT>cgLE-i96@)yuJoh+a|3+q
z^|nYavqoX%g5vC(L^)U?*Hmhxv9T>$pSmDUz+o|OyC0&lRt`ROtEtrKrqZR-#K!>!
zk1QGPd&-wK_BH!_N)HF$NOmrUsvxTF=+zp_JQQ)WSWaCquKf3$Md*z%jcxm0v(itK
zZRM)f2a>eo$7~~|-Y0khv)>0P?&O#h>z^Ow!xJyz^obt;`xcw(*w0H8O(ze>Ej^+2
zl0mrtTo*_H^3*IrPYkkRRrj~-Lyqn?9xJhpqp26^=k0-cL;{^O-Rhy0>%xSGR)+vT
zFmy2DEqr_0PnX*C@HJq-l3fl*h_sc#WmGg#T&KZ$Jw#2%#RK5gI&0~x!P?wZy-R@t
z9~Z7kBhcwzdTQxiFEtXxjnfC@WvBtf;W|zuW6cU&KQP6lnOx~;4a6p-3nM%<WM+Jd
ztpW6kB`sVPEoBN|!H`p#_<hB2&WM;oacEb*C@Q@Mu7f6Ube2GXm<qc=tSB#{DDx|5
zdgy(`3ScxPkj4~j9o9i>6wG&@gD|??pNnvnh&pWp6_Q8)&KcJbi3)A;!BCSJX@_aj
zq?^$2e!Ca*=o&<u*+%7k!Yk2Q>S{Lcy^uXpeCb0b*-$N?73>7Kqn_E((=!b2@04+i
zyztG(h+!fUbHu7^Lj>POE{_~hfc6boUJ?%&c)eFx3^FAO;Xe=J@fcH4Yxn5(DjnP2
z_fD|PCg`e8MT1m!9R#Z2j`M~JGdF2}{#bIDKDxzEvy<}rpV>+T@%+6A-9n#TAh&O{
z-3X*Lr#}2};qLjPFjR}Lz*9p;D$y5z1P&RaTbGH$<X!r(uzpYa?oF1Uv!G~h#yy;)
z(fkgk-7XTGRzqO2!i@je7_}_mKwUhh#(s{x`OJhlGM8dL<Pz$KhcmGg#{&)HOxA`P
zD28Oj(6-(2$C_+AqLJO!o&r+@$!3z%uw*9B$`N}_$5?=U%X5Nw+VsJwfP<Ki6p(4B
zXo3RRLYhB1##xW9KeX5`9Lq474v}qgwe|Ve1Z|!KAOvL5<|l3xeGQFOPh?8fx~pOL
zv#!g%r4L9K5nY56Cf2U~X={>Z3UjkKIosWDXJM6wk~Cwpe@f6UT(|_#PF2Ur1s&i#
z#o7M69{S)V=3XDpr*PrMoD_#(ivDUCTo;EuuJx)5$Hr>(od@olSL_dy92&cfZVy??
zT~y2#w_`ZtiwO~z66%!+_7kw&BB@uh;LBzE_sY%dnXenN&urB`Lvq2rF{C5I8DV9w
z9dUlYAY`1X$Rv0BJ3+TwZ?QT?n#Tds>U}W1<5N}o4K{tQX1-tYMgX1yJs43}#`bv^
zWUbK><;$TyhO3k*IS$+o@p?F3GD!zwkM_}3jWYD~urs5sF{xr0uY-Q@x)6OL!Xz3U
zVjOL-VOKyxTV`&tI*F|hv!KBnfWuwDAXg+GH*(OA+WZL5Y54l{#ZvR|onmM{E)Kf~
z9ByzbiBu(c{GB?kc|V_-y_gVr^ddm`^5MX+nN`$%_ArMfSvYU;LBv659hhCu^4wd(
zzNVxC+da2yrvM(sKvGX&#+v7vKfOv_1esnH>{MS;qIKQJe12~^N$DZpp1+YNIl$Ld
zc6;8y9bUXTsoHTm>7T*!%a6aAGL5x6<h93XU5{3bmXB>3PWLcZghB|ah4A4=FqRrE
zE#HW67ZthOb7IDFjQ(BUSE3nsdnP<$BxazhXDM7h*64!lbWPz^VgUhUa8d0u4pg;d
zhOSfPrz+x&F^9ia8<@s*&YM}@3Lw5=k(N0{J#_~wMpHP>_K9H#c18?`%$tzBnMWZ(
z)mly1tC@xJ0IjDd<ah9$ww*h_!N|NBaZq(8xR~K^>>b0GK0u-`6=0NRHNoZ?SE8F(
ziC!8#-}pLvWwQk4c7j*xsZAu+jPf?3QJVUvHTl~>#~62W{`?p$#<u{<*-~Zv5~}5n
zEs?e5ZQpxGk;3P4&#eYTc_=V$wcWxRKrjrTbLsoE%?bR1P(p1Uww#)CJ1?H)PT+r{
z3cX)R7~&~#7wcpI$1fDv4A~Vuf`!pbh|HVdAmlW9bTjAHk^6*~9ZD(XwDjc&9pzQl
zdNyv%L^WS18n?%*efk$v1KY3R(O{_S6WAw=Id}G*ogNa!AqFHm*4wT5?Co8yl3!{A
zh-Jfp4BOcEyW5=SrD(EAfd+4+?=Uqe0|&NG2^+HI>PUI{#pR2Lme#ZeqGj7(rdB>F
zXy_R4@#SyWNB|n#Wa-w&0h{Kx%XeWx<}F@x=R6T4ALxn$jNoYOD}`1Td>L~XX}1r6
zhxDqiBcqc~%Hqu0=RDMVlFo_Zlv%dEjZK<d8x+6T#qu<;Ix0KA%Zqq5myn;9MGv;K
zbVffO>m5MDWK)x%++hPeT?ay3wNp&q%6K%h`JDAcl0CJk=whi_Q&OR{*vL0zoX^%6
z?xy<}$>qa?T)LUVw`R}uXkdhhHBwov+#%8@9BzhUX|I(syUOH!H8kE+mK+HI`2dp{
z448{uWQGrP54-1GQ%)da;rW|n#8pi^8(6t-d11G5iEs*2t;`ac%<IzAT^@3%0p-(D
zWp*ZxAvFRXcNUnFgSAYC!P7!2f8sd*6_1UX<pMi{=H{#B^IO;E0!fI{(>ly7rQ=Q8
z?_XcO#r{yN*@33vjX9J%bVY?ynj>yBaxl;Mf&{UU_I~xd9c>EcVPI-Ox$7oepuIBe
z?%6oK+S(IuO@vJD@}4~$56|AWG{sQhTwV4Z2_oCMyuz~T14E`|MM$UkvXZJ;gSmzw
z3Gc|Lj%<spl;r<Y9xB47$FV&ZtDNV11S9lcC^;*F&CT~ug^&ckL&2d2Of9K4{^q9v
z^5;x$poX;6lz|b5#e|MZ>A5Q~13)%@*7R|ws8;HJV=LWTfS_8-aG&CBau^;xi!JfY
z;_UCk*Rr}la5AZqKVoSVH2?_9bjK(c<{}!j=cKLeD_}DbdLhkR_MHElMfafX#-VRd
z`(EIh#MeNqqR*fXHVp-+MdllxS&<<=oz!xfb{3RwD0*NcK#RF-7i-B~b>XQzb_3wN
zOMAijZMb@X5gofAG~)7xt2)Xv_OT%=SMsnr$C383XOPp(ZSyF*=;6VC^VLKO5Eb{b
z)1Q+RXA&G-tDfC6^{$bM9W?E-p|$iR)`+tL_7m)S#0fEsB(mYtNJc=b#9ET4b@;8f
z3KAs%R6q31XY26<Qr2+_=G)kNE}qV;ae1uL&uCyy?$)g1*gOddAR~aSFfjt;ys&pr
zncU7cRPx5&uNF)S0Z21Z0TSH2J4-|TM_1<}{9Jg|-i0(S$(DwTIN4l>JOE{a9&0z$
zS49Sh!sEZNS#EJui7P!l;Ca%(`TFaCgvJ%Aqcj7Ls>V~`qtZ}Lh@eVL$Y&ie*0<*4
z?$yTdiG}%N{)2^k%K~W__XIm+H_}v@!KPxWvo@#^D1%5Tq1PXJp6g1#4KWH6)5BY&
z&C2?hASz)pBDU4JY~{S%3n)8EIh5#9;k;x5zD-?5lahf>6Mv%r%$Y>`<mE{hPh$p9
zT>i>oFN3piYdN8k00&1nZf3<Zu^=Xdug#RfF+$5cE7tG_*km+1(2$-hRee&Kq|g==
z2uF$DH8iXuPp1bF68wd~hWm|h>!=zTV@0;8@1naP;VwXvsMIZW?=Wx5TtO*gS>nSI
zn%#uf7023m7YOZr$iZMbd|o!`1|;7s`{A`_f=DvibQHiYCITy0iOTmU*>E^+_wAU$
zWO5kl0D?C06VpEr=AH4Y?J_Zh+5#D97kW<7wDZ<Fcvg}aB$}4Wmkg)j%#}+{!_ex^
zQwC`uj%d~E2o{nnIn#;(rlng%Vov*6D@rF2#_xb$Y~-a<ka%BY>SB~-K6{9trt$Ir
zm*f>e1}7SX0;rI;64*Gr1mr;fCtVO6LvSUYBBkq%B%*+=_ZAn^&WEzZE<m5KCGC+1
zx;8{T$T_IhsM=0z&)mal{Jr*_fz;tL>kD<S(({;fqvVdp3>(#q{e!kHdRmw!w)3~v
z2P1jL2*tF}?#FI)3YI^X>eVTt<u|BaqX;Ahax|N!tEAVl!4F?T#F!eZaZ(bx`D(Ze
z0}}3e`1GifI2MrZm-4-28o({n^W+F8QQSc2RGia=Y>n_hU^w50Xj@)dls&rubA!s(
z39gdNOX@AoC)`(eDYac^&5+S6%0ZgYfQ#W=&J7l${Xst@aAD80^pT_z|A2(1&~)e1
z?sQXC2P1(GP$5HDQ{eR;gXUv0prW|PL;7tKb?=TrPv@iYC+1Y*_(%3$d0DuhvO4>l
zyIHDcfNM%qCMiA_%tu~eK<~7LV1d{0*8Np_**xQMU=om&E@5`$D&`$#UZ1KC<8;sY
zd^Pg#?(K_GDGfg<lu6S}eDwvrR&Ckc?G77Q2*EzRN5x{N0mA9$h$u|ApQjjFm^k!4
zg1t>pq(HzfR)8|QUdb#eMf!IoYk7Y_c6qd5>*`&7I_EK@86b2nB`Wh7H9wivvCnNG
z3+md67_~`5SS~N8(G|$U+V{x+PCD}l1tLZ|<)YBr?@ji{_Ic*CZo--xn6S<5rAgR>
zH`nK%XE%*K0AFL}1kN3nm*=XA7{h4J&PyKvX1s)I<qi`>U{ZHw2dpLQGmde)=h&?+
z?eAz$DZqgqS9=msvia?W$8L?VB09kVZ^8NZ2PmklGy2WIm;0QwY*^`KpxNqKMp6Ef
zbo)gW&=Dc6@t6am>&eJ;aGe3m{JBX_4cBg}wz;^aV&9vH`U~HROvVcy@7E(ZQV-m1
zKN76J;cQ1hX!wqO9~Tc1o$7^zm^&bcqkIZ{frE%1XowW^X}Cc7?MI|2g{SVXcP=gm
z9B3U)O>L$;Ty|h*eXA87J(W*pd7rqfBq|+F1A3Y|cZ3jq?#HX#J+wjkxjZ8V9y6aD
z6@Dd^c5LPmKIK}u)u0aqmEI}?QkZ=5{vv7PdA_Cl&(!tIJT(@R@Srb=^HY_g)|Z|j
zpiuhW`ty$?w95U4#+k}{?T3~2N@6<Gf}7ba-XobL6w{vhC+UT+*(~aL$7Mg}o3y=U
ztG%tJu$-*g_&7!`kWR_(ZK-FLm`^S0IL^r+dQ^jwq~B7;Em4#-Gve4eNlZqvjO2Fg
zM?+3%`0Fcty7|<+dXuJHGlk;LRrjtKK4g#xBHe;p*sgiR66PDDm|Hxu%Up)kT7MK(
zkEQA+#&sRxHmO>V=F&UWHCGa$RBl8!A+fG}sUaEh*vmDQ+d64Shj~U2YI9kI1vE4^
z9%~#D@At!D@m^}{eZVknsajfPs{Fl$A4y-1Z~DHonY82-oxDnxbkAy1PUPaVgDeb2
zUS}}th>Nlm={0`<LDEM7K_++2n3W@&GH*p9&{j|^rQ0ItD`+xFvQN;<%2N*GP_7=X
z<GZfJ`q_AM{aB+>O~qa*bLQiD+{%cXXx2tl*3H6`f^(DajSo}N=5qbzbN6$0l8K;s
z%P9}!sdw&++`5g3{l_1<Y8h*O$*g`q-g(*tWHxw5$zN2<U77S$H%ooxDOj1?x;w5B
z^gg@9_WW?YzjpAoszt|-=;QpJY76rINp5@9sCEsPDU}>7obP>~E9N5f0tD+_R9k36
z89k~<bWBygq##LOa>s`i9=weOc-U+id)4j^4d0LbHOazmPpXT~@*Ml~rFjb$7Ak!<
zx-3<@TL(;O1XGY+Xhv4vW*d=G<F$0@T-88F8Lz8zkBBHl(n5V^s*@}s*FAf5Z+zv$
ztT3M(i-_t$A)gP(A!$(dYhY(*pT)>K7jAGC)#+zBStJcevGHz_^><B3?T&E{h|uOA
zrEq+3e$4iF@QK(X-92b%B#Zre_<1ULxY}saLP}}KMPK%XjQ{_l^RGA+kwXghp52j#
zt(h0A7<4VOGM{7iF3V95{dK`#*N@UG9A0?mON}MGOt|+~UH@I{clCUmFsxzsyo-&(
ze!Y`YA^Mgd2?FqF$EAJxcQgI(R=;Kfde6BIclDP9eQ()jKXc)GA#(>sw*TFY{`YHx
zaR_3KJ2_#=UwY#nq5by!M<R0_`BHgbly#-2alMco2&w<-hJW4P1;2l1V||^$*~Mk`
zH3fke^2+PZNW1?<&EF-lz@|U<5?0Bw`1VNV&0mH8`)!_4E1WiAgyCSxb{G}?UQiuS
z3-wYe12i&zzu!s)ZVj_dbbYawTrvD<r)h=09QW6!Pby`som}ZC$65@8O6LC=(0{)g
zwutY~Ca*d1X}{Gf)4Wd-GdzL+iu*q<TYKgAY4${EAv@X;GWGtKcM$1ELZg6od5}OP
zd=_8jJa}fBdKm_bBkn$9f4=|gFPR1Ta_uaH^UmW=jEyb#3oZM{6=qHoOlCEOVUPo&
zUUFQ+NdH+HAR<mo4+W4d#A&$aRZ5;>{?;@O^t;`a>p!=4Qg=Ec^oG5*zqL9*k?zQs
zW5MouvOlZ#PuFn^^Ee&qgh?F3TCFR_@SnwFkB9#9?za$R@t~WtC(uoA$IL0Sw@1_0
z>8I*S@u~6emK)morcY*eyzQ@SVHO3&TbR6SzID)OxnC<6JD1AtI>LJ)?P}K1W(R9$
z{R_-<gi*<5WepY&9kM|k%c6H4Nlc6>`Xx%~(?sa4m6j|NCpT+$FtthUOHHp`fqcN~
zxQ+))z45===g;W&BSpJh9`}I?U#_zWEsL>QQ~SbPkjeLFOKdOezg`vloJGXcp)%G{
z{Su=e*!&cR#q(xtl8dI1Ph5Q(xHG!)wgdAOn;((ay-bE^*?h^<vJ4xWR>YwjRB;tq
z!26}L{kR_}#LteH)@`I+@4Rw3@jAKSwvG{a!|lc2g>2(LIz2rt{<UcDbMEA5pHF?e
z%l(;C#RQyRe&jad`==t-lUwBn{OD7J_QL`v^-?qtdQa6`tC2SX^JyOQNGIo;wot`9
zT=Bi&-<rvqY7oRroVEjM^?oo@EyjdafUm4!qm!~qUfY+w`@cO5`&*SrXB@QaNcZ91
zZyn0l7Zn@&kmT>~_s<2^jDuq%BT9;199QiB@ij_i#4T%B<v;@^%|G}2^+_c0mR~Xl
zCZJON_V(M<b3l*4#id$4_yy|U<LN(_`4VK<8*(80{>@-E0_e0OWY5Zf>$JCSBS4mZ
zFSkgBED{Q=ay|T^#$PY?&vQi7Y;A4x3JTCse+y!fTYlU)8Evx3+t^WW|GDF@Pl&fE
zpbW86;ffGHf3@Fl&JaYbb$54{0->-SNv!z$Foi;ijjEu+_-PK~KMJXfz$pjQy?8tN
zA5|9#DmCy8<Uh*d0e&#Q{unt=^w-h<HX_w+DcEz|y8rlQQo0G*W|WLaP`YX&{2|xx
zzk7?u=G&d$|63#(ZLmW&`6pr2yT9t>pSJ}gaK4nYv-8LQD)^u{LJZVAGgVaa_cru{
zg2yco*Gc?dgvl4a4<Oc+PhOz?USrq<8T`A@yZ>IF{BO7beHDDgJxTNk>G#+OL<db!
z-0blm?H7jVIhS2sJpm8Wm*xNUOy67eQjy62Q3P(hHE6z~prD{l^BW|&5=P0k-#fq=
zwt{trLF@aP`_$s66P}-ItMayTA3z*e`;SDE$D_)eetRXeD&IGdOo<4aBa2DzGcp`#
z;uF(wEvTKr)Z1v0->%M;)j!>xx9Lq_uabp*RC3mc{iLX-7C)k=i!3#{<U9~*^Xn~)
z=(zPuvOlMwFSWQUOb3eV;)z0jYuFk*LjKoQ22*uiUUTn<xoZS}zTo+_HMmf5YevIL
z7_(H95BPeMxI$(!_iGPcKz_Rph2DnU1_mY0-l~&ynC02)O?<*{TT&|aTdXP2mV$HW
zcrVuO0GL`Vm7P*dVfX7_Ms-{b-zHhP6CuCkl%G6NVZXe&2pIyR%|??&jwC9qa%6^*
z<=1Caif5GiCC|*vfLc<sR7N()L$tYjJ5lAIkpA=2<2HnM7_b;CLc@#OMQKfazNZO9
zzr>ZFHVQ7EUFLULutvg$cD3(`QT;mU6MhgexB~$ZLUR<5HsRMKt9wGaF8)i%XT0`n
zxoeZlsNz9uAoXi&VG|O=zcov7HRB+)6#M1YTYi&Z%p0{CQ&mz_$uD}19Q13)&!B;q
z1B@3mXF>0NsY*&;5ga5m66nW#WgN%*A-~MhU|fv*qkun~4kjybRkAc41WFZteZNVm
zj6uKT;^N{jlSD_4-Z#k#YRdc?P9j2oJS8mI(?nhIw-$>;L?eT~RLQH0tNqv}8;Pm(
z<(FwVBNyQvCTz(q2M5}9FhjllYm<)BDy%hO(AZe?Jd*i+hyp9jwWhwo4-nHLFc^hX
zOaE3wsqnX3-`+mj#u*`V<u{cd{%xUGh6LWR%d)ktyF3QUaO~GJ{>yq8_ZbK)lG;0L
z;&)A%evN`}6(S$+KvZ?QU#c(;{D`mo<zC9cAMgSW7AS)q^_O24e13K4Aj+awQzb|s
zZZjUA$$pK(NqGH%nzK&y&--nV(l<jyfjK#2gk9d6kP1q^jljYGYxm^Ernj2Q&dJI7
z3~y)}9=~K#QXO8|1(51QKLPk3D3Fi)z6~@dc&CGp<&QyTejSLP<5w?5N!P;Dq1);D
zih;KfSnk8MUSJ?CxEb%&c3%P-Ni8v6l?Knj{LD_aanS4szM9iR5)|9xdOlaRam{Tg
zm6=Vz?PGh(eR>;UHEg0~xy?HtsmhE1+=3%GEgh&~`SQI5h>7eJ@UT#WO7*jV$MPVV
zYgJ+MsQ{Y5<!<XWLc>gD1PP?y3n)bFS9q;Gqi_JJ0X-N%s-U_6#L#$ME-;s9O?BvI
zumQRyc6t|+6An{GT74t}O{k3rsXI_0kug*Rq>6t=N{|!H4JUX#M(h_n(T2-leg*iP
z{-V+rw6|s5-kW9toQKl5diP$;0X>}hDF8CL;sD1hG?3R@>NgE>jvL?y)`0;FMQo8?
z58O7PyJ7JTf*UT}*aBAPb^ycjIek_QU@0p$IJkv1fJg%a8q-TaeLn@3m5xa5E8+oG
zXXYhWFC8uD?UkOWe59=dwl^?>hTV6y)ows7<T%TU(<sv~xuB$BQZL1f2<_6UYE0F=
z=fgvhIodnfvW??PBOnpolp}Y$8ZNW)Hf{Lzi)Te7f<D)t5Yv8Ay?m8s?e|uGg-x<m
zj`{r+e0rAO0sLs1PWVi+dRU672B3o`<LkO~sg1DB(tN`m$#$s4Lj&K0SFzSl)*;$h
z#1;zZ*xHt$pI`v6RRRgOmHILfA?WVb3<}@>SP6hhbXhKs=H)!1c28w0cOP)qa5({~
zvwp$D!Dl}~YdZr7%*`cjK4DRQYHo0ZRLD}9`nJf)7&tGV1KRnshg!YUF0<PO%WIwI
z0Bx`X(Uo^ST2g(M=|{4SJk7I4yA7Pr?TtD@*Q?1J)WJ5@BvOogCXf9BoO2H#^RNMC
z??c|k%4ftD(`xxt8H%2KSTd=6RpUR<cy(0gvL|^}8XU%V((<b}IudXDHRCIoKR_ay
z1=bQk4)<$u@t9h2e3PtBN+OPYngH*4pW>L5%CsQ}y-QSFZoABUMQ*Sb3g0i3iiQI`
zUuI-$4#N*gU4TWy1*Ke-IltE>IP~6O8GYSSX+FYeV*^?%7~S}lFj%u*y*T~!7Ieqa
zh9?yWkg+(p4G&LMY?g&8fu5&*RToi&h%{n8k{)AGCA_j3*T;myn`F0DWr9Tb;bXu^
zKYzC7WU%tW3P^w)hE;D=MT*kc0)r!|91*#f$Ow?_>Qyl7%?dpf>%*b6Q~GKQ9_~`N
zNG7+PlsB1{zr#-X7#Cse4O{H6vb8P(B=*pPLSioaHB<KUj8yp2`CumR!<SEpHp(ng
zV`*?82paL2L>_(38wgyT_b7<pE?E2yBuPH(<BVZFMIQ0EKPnDvCE50;9I%)2_In(5
z1N5lokCgcs-5g$$odS=j&Y!?iBi43Kg=S`4(~>18rz3#W;l;E{!RSaEP}sq70a`y$
z(2*wUfs&LBP`tH+3-zbEn+yrbV^RQR_34&(=+ki29mH~+`2^szW^E?`re=$K+DU14
z^R2t9)G_x-kKXmL4v>Rtm?r0vA(6qA(FXtUDl<|Mg=dhW3wke8?!j^cYp%f&8aW-w
z5t<_qVXpzAH$u)tVOEX!qlH(yr;8C6hhgM`lWJij-YOBVx{--v<dvOmfN0WD`pC68
z$!Kyv94mJMkc6Fiky~Nhli$4N?ojL=(5{}XKpNM7e%%q8o%-Q1b3pC_2Etk(%{0wY
zHL55?VRnw?z57<~=uDn}n-gL&N>68+wGN`h1px39Z7WqSq{gIXJP%}NZ&gdN<nn#o
z4;?Rwa(55IlCm_DUrI0vU!OR&%q+G@IERA*VmbiNeW*Ii5y;q_y_VjPe4FhB&I~T?
zvl*k|05&fzI$MvaDHuFoeUdofnXNZ7E-(*OSX|J&0eKFV6M+Akf+r+wz|i5i<391#
z^X=ltA??0sF3;nN^rNhEUC%wS9Dz@aT>vwfnSKd8yK*mp_LT~Ef&0^1Ab|k`qr`@;
z>pW7U5Yp5MP+(}BDGw^}96Xb_&^*W|NCHU09)MZ9*>{s(O@b@@{AAKQ3!W8ck!q$<
zAsM`$a5Dfed~EH{aAS;dN3!HNC_je2gu&LLF;|x3DlLagF2z|6o+rEFeR}a?m7UA3
zczdK2h(Lb@K2ZI65ONF)Z0A(x@x7hJo9oj~VZPK^uC>z<_82aIBb~(~{(Q&zqY1qo
z9cNa!s?{frv5fNk2OFLl$zoMCnHxRub5o@Z25Ym!??XZ(XU{HPx~X*5k7sdvJ6*1M
zMv;y##`SY;u)h?2yOeSH=^*&7%GubN?6Xr0IPlY}VYudn+iI+u?q13HHtO5slKo2E
zqp43uFWfX&!z80=-*uhWZ)j(GeR52h^d91UVR9~rzW$<LdEkti*LIG~zWOgMfJsvp
z`827wGn){-Gl|9_J}iIHFf-&vAXU(-7LWog=9I}KCQ$fhvoVf(Nw8qKAN7_kmoMnj
zJ<GElm8j3yS^DPr$!z0w-SY-qx@Ysf8vu=$mn<5Y)J~-Fi%~f-oed|&dnfwYb(clZ
z5d(w=HmjvqZ;{==QD~nI>cZuhm6me=Krr3=^%Zx4)YoD)r{V~#qEp#$HsNirOgCuc
zVqv7CIM4BzjZx-=&p8X`L>M34TEg&|-h?YKb9W#{pMCg&@k3p;RBA3xqq1P00M@aQ
z^2VXCWoPy)w~{;`O_Q9jS=O`bIq5&iit?4mwyQ}5go||SVhT;8lzl8=#jmXI#j^C+
zNPRNjmdLk)#V{yIy|%{*t8RKB>0@v+iKW)Xn%%P^ITgN}s#6)uj6%>S?0LEyr6VGi
zUR1UmrE~94D{Y$j%zSI5>=i-F(BVTe_bT-BsH(1)+$Dm2$0M4Hl{Dy|Klhu`jYLiN
z#`F;kCm$2XnM1m>;EGw!i5%y^4Qt#sG0ev2$;n%;P~xmJ$Mg&BLm`{I!>K-}#zSPR
z?SRMi$9e+t>bJ6Iy;0moY$&D13zRrZj$PDEz9Em3%XT4P3~?F=x?g?o6jCiGsgKg(
z$qHBVt_7*ROk;~5PfU6Pv#UrZ%I(8yy>~ojm9#8}9G*=+)7+*ivl5IQ&fwHsY^PZs
zdhFxihQGzAQKD|#GwL}HE%jBA>@-XezP5n0(V&MPCqtkC6NP70%uGaz+>O&tF;1+g
zn~@%_C3X6ual?n}BRwmqo01+?8Aa)OtE^v}!{hMc^3>1+-S43P{2V^PsdsZep)~Qs
z%zeB0S=S`Cv`+f*%Wo5!)zhQmoBez_v?rFH7jPxKC?tl=gDJ4sBVl2)F%f-{PEK}b
zZ)aqtGs1cEM~)T$)(U&l>>FnqbcN@Oix*1fU-Tt7t<~i-JHuDNXfI4&Bz@PO;A;>I
zJdbrXZraQ*9MNC%5Mxgby-=(t^aj)apeh!&eL|w&oMxu+I$A9b6CGQkXJn^DkU20r
ztYpIdZb<gXm$q%V$5j;4-g%$e&KY$>L*)s+6{AM7@=LxJw}(q?WDy2J9%lDt2|7CU
zSnLR7NmfuxKrb22xQcbQ>EeTMMNvE>9?>mIa{JLR!ONJo>cq?-+_^dpC{K0KNHyIJ
zwwx3eKe{LO4on0vCXvs*Ms43^%aT*?dA;%rEax;oSG}a|6pY#->1z!mH<gTl>WuSJ
zlU{`B-e@!xzVa(ya}A=H!Y3@+tYu&CT<vcpko&nP(8+o?>a}1Z(YMQILbeVPuP04)
zD5r4z*PavHlo5UNU>OOHJGm&^;A~tv=6nE+tPm7s(&%~@CFlkIii;9F3$fWhyhErb
zKQ8+|yNqtzTd#XoYWkFf&O=H~v9=Pk$P(!Bv1sXf{^&Y+nDI)UMG80y1U0G;W8}pa
z)BnKXYZUP4p0#zGr&8D)>6?ZFk%UVGx7ps25QSCz?Cn{>5QY)w==%z`vuZG;M<LLU
ze|a9GR^?S|E|m@0cJxfFy>+=C->7{K0NvVAJpi*#r1N=lWYQbb`$zwHc4;EVD%B|X
z<KT}qeGdYP&uJ^gd14BHi+Kw(tQpF?dVT1S(vERD(3kJNf-Z&WUfxw3ho_*uyodW#
zABXD&{)q038a9*{_qxR_)Hwc8KiNh+rn>0kK~yXuBMV5dc~94Bp!JMeW@SiH7mtfs
zIXPyZEt|`~^h#6SRmkop;46O0$CxDw!F!mHM?$)6J?&~S#a6f5LLXQ)BF8V*gWeNH
zL2w+?_)2HzyspSu%N#8oKWi0ke%I*M%F$B5m8+#VH=Y)HafVAdW_s0b>yM|7G0vyz
z+^?qpV%0R&v{LAbCZfGGt#SezI^<a!q}VX*HV<|$j6X(p=^qpB$M+jdiZAmssi+T!
zg|4V1Mf)xJeOB{pC>8v={YA?u#ccZK#OH<}Y=pD+$GxfSJp-Y$cRN+`M;fB^VSs@k
zyd%8%Ro^Nr_mamWpS+J?MNJ4D;;mZydG_?Nj;k#BW-ZZJnHxZcp3UBs&G9k~8##CG
z)?G#LGNp-;3Ltkkt0aR{pu5K>zLjMjy%YH4Wh`GVJ<d}xdkmoDA1haqEYFYDtHsXP
ztpapO>J7rvOYp2z^fekGs<orYGF4Vg4@t>P(MUI4ltlTL$&f;-N^t9jc4P%)-7`M#
z;4MWK9G4)(ozF<^pPs!2*q3rQVqTxNiA2v55$A7~<7-v3_}jt-9cpN9lB?8Y(n%9i
z$6{`*p%Z&K0=bP+w<p|JtPf$MX5KQj{sWT{^V()vR?_EvLvF27@}~!(4bkc0tB)ge
zlgXe%w!X232b;t8CRt8i4HIWdor%Yh!v-|&o_tP1L)Qu*nW=Zhy~dApzG!YeX6xWd
zws#V?GA|xcAwEE~XVf^eDJ)2dc3UEK^RP+DtxHNZ-buzXeN7;%4!3&VYY%~=>gT~j
zERlOJ5tMs*CY}}X^OTINqe`7d<{c)%8l*<v+q+XGq?C*ZLmohf#9l#Pgj}eP(KgyT
z?P1>tZPGp?Fs~Jj^C?I4Td6iYA8HtHf9{!RzH`({z$)id7L`IP@MFB)dA}17mo|c8
zY@8MkHabUx`7bKh7+zf7WxTZOc|JvyF255SuHf*LV5V!&JiV1;If^^NCiiJtn6S0A
z(?xPU#RA09{6gh6vta5t_aj@rn377Yqa1yeVF`#~k}Y8F8WY4n-2FtSs*$z&bWR*{
ze?HGhy<zw>$>+Iz^s&dRbsKLWp%WO&r$S6-!?^_rpEM)V+Gx^;H?pZ=F`d$PUuB7!
zS8nJH?c*xkTgNP^HNfl)Q*mJ+p$JFU(cci~@6A*zQWE9J8p}V32@8>r_bj1|SQ)~(
zT;lQi^0VN|b^80~>814qlmoiA^yWPyE)VT8ht*Z<b7tLJ`Kq*2??m;y{2;%0n3Eyz
z>6uVHbGT9WKuXj+wVQ2k*+LI4TpKY?BE0h|RjKt7t(>8#D@umAg!0vQe8D}8gEbY1
z2XW42hKRkV_T<HBS+S9Vxtv_iu%>3V%E(51I+r!dVB4LIFmiszAB10Ir=ny+-jqJ1
zH&Yqv?toC+MXLlqMhwOMESW8NCUT*-9w$av;;6{eQ0V^h(2KBSSYSRSn^NkuA@V>X
z0kS=o|M{X)1FzML%z!V8J*MrY9i=CQ?lXqFNIzR#sv1<2tB2q#sxrl-qbA7<xr?We
z=`QmlJF2Cw(^C^<n}yp6m9rv9xv`k3jtl0Y@eYa#Ttad?T4%{A+G?jTGjf|H9+Gdo
z)Y=7H4p%t`smB3QU*B(ImY`(>SUy^w*cB{6v}RoP(?({y`@t2Y3mx;4rTDpa77r^S
zm$y_sWNj>~)>~bR!19pJ$L5h;^y@taYP_SkOxE+GRvcKl4Tn=?iAdl|*|E{5^;XY(
z;*8{bS2VWzt(<#mpnY1jefD-*JuFM8x`p9Pk)CW+0zZulJ$c`!<UzBr_Y^jk(x0r{
z3{u_4aMb$>GK?-S3Qr6Y^BH5g!_vmzSGK(s1H*g82^ij43viRAXx~`}3ZH#(pT71$
zx;^qmr}>RSEQ_}hJ_2NqBz@@;7?{(1j9NV8MI^_QkrA>Vb&ah<F%L(MEq_BBR-3OJ
zJDy2GB^WE6t<o$)hVy@XeRm+$|M!23ilnm2tRx{C#w}ZlknNfw$<DR6O9;s-T;iIU
z_g<rH*DOW$yyUvq-s76ry2kHydw)jh^Zor<?!C`-p6B^IkMlT>=ZbhDjIzzfR%m;2
z7V+FsZ`A2Vlj)*)j51wBC_t1iSRmatcJI!G4=o#(^eg(Y;7<ifXD9Dx@hhno*0+_F
z&_szUJJy^lS9dr7tTN)HY&3XO$f!~KMmIZc*4b;-E4vxpm#t>sp478O@G``z^Vp}`
zes;C-PJXN%SLpg?ceBa+TrAu>oMWEX>H}**$0(&R>O@ByXn3I?A<m&lA?&%3<D3$!
z$s?stlJjB4zx?i-P03uYu6Em&#Bh^ln#Lx8%Y_+s7PGC8c>_2=ma_aoqBZrKEB)^Z
z^6<%)-kj5sTX&<ETm*XUtbc-<R?=SRVreW(MwA@&Ryr`hyy0V?ux!3<NmfB#!x&a3
zNt82u!)|xyYDT&qICH)7+-kgHRiI07zdQ%D_W%Ha)wfg%Fvmc7yUG#SoclHJ#c?wZ
zBJZ5!%C%9OJF1NuIgGHIW=yPF{5qr_w8gDKV-xX$6An=x&yIYKeA<CEqp_d;+7%J!
zeKrYq?=x84-u1X~PsHalh9XJKPf=!Sw3>6_={IE4!|4ndLVX@?6gPmrWuMo6aNWB1
z?!1?Bw%i%ajcmi$+YK^{V~wCXq{DHx-cC4P_r90LBFj(-{Alf2{(cB!BKXT&?elgs
zomlHPHIcRI=?>Q7T>`w`cIM1+FCX8Ngt`|{N@A7~tEq-3f(rzVQT&?WGkWLsrD~av
zgVQUmWF-cNTlZ2aukybei_S1rXw-64lg+n2r5<2tFGr(;ydpozL<~xAc-ccK{3%CH
z9djhTByF4<k%{sY&O%T!Vk8_bmxXJ*g`c71j$xLwnM+m9x~@(19zjr6BHl7j<Q7XY
zJCyK>*Q}UiVicXW8nhNeyldsEp$~?3;$W1*;#QevIDZQ2L<+d~c<##fS1(~vYs}@{
zJ1A4o8B7GVuzs%GP0TY_%aOaSa3XV`nIF%vy_GlGKEHEYdb{7hZl$Y>G=i)uFipii
z1I4u;<ElA2(YXxqW*7cpBO`SHqqqRAZ(CXMv;*n4LwpipI4A9^Es^YxJu#m$SIZ6S
zNOJI=e6d1L7}Y%Z>e#e?$_-L>kd4cN8Id>B_EV{*H)n>Zk?>C#{2<pUky!v7fW!n@
zH=<WFnXhO|7Q+>WrR^Q#ck;A7g>#NR6P`g{Ss3^9VR;Zx!1#2HW^;#vYhTZ*V#YgN
z994z-q8PX({*r58N4OQaqP<$DcU#5|S_9t4s4aTiatS0#EG&B{dZ7Ab8etK)ToRvw
zb`eFhWizWSw>HDm4d50&33BZm2x`@BM*^;59|W#7)#h!UzC<m$ZQA1hxLq*|*2b`r
z_L9HTNF*N{Y`rGp2w{Hg)2dhiOSA_{Lu>6=2awmzmHU=R?{rF%tZ#^)37?W>t3}K8
z)u_v^iZ<l!nDvf$>iVn-`-sm}J@@l3RM6jsKP~<EGgxlbKD|-zCvAA5Ad-!Q%_yFi
z@;WyoR@Hg`;dE-TQ!T~!J(qOwB{yxnU{<}siEfI8G}E0oDhDF{CfrKicaQb+q=46Z
zR*l+xn-=pej3g=^w+|yySa=-LKlWI$kDgA;T{OR%aDCp3Usjd<fyCCQNG*)w_n*XT
z+TVZl^udTpSvnzat-*6qwy4+HZY$i+n_OPI3XEk2SbL0pY`9ooIy-CTSkcshiPb|m
zKT0PX^*LXv6!4f_=5>DschQ{UU=13Rr<wik0UrQ}UVA9Uq2vNcKe;cvo2m)=vBTAm
zB~#Bs^ogdGuh1NF5+$np(?=pn)8%caxxB8Mdz+$cm5^+v^`jNnn`2z5NH(TXt6ZdA
zV6m20p4QlPaWk#=n~E*!3hxz3y!Y*H#J>X?R!s|V@g|M8oW>+*P2TmEdbb|LYutp)
zG#T);eH6mN5Aq2Mn$zI@!gYMIWNTY2IeCJ#<=7oTbmw_BVlXRg#GE>0D$f<7rKsGZ
zLxjE1ueV_18-1GUYWa2ZIKM+QvA24tin%*oB$8L}d!ybtaqQVPV<1M$6`TiS?DIAY
zet>ES%aVEFxz?HHg?-sesJ6i$6;_u4z#<Q+ofl<r_sw)>u~qc2aOJn~*n+(bk)K~B
zyHE*7)EH{qh4b9?d12*NL_0@uwx&%YaN~<8@=F#(8ltS=-T4RY_r}8tq4dMXR!ifV
z{Lw1jSrf`Xj(bEJ3nlCefTNo|n=MXi4bmp*kICW9%q3i`H&oO?xpM-gr|Q+>%1<|V
zc3VsJ?uR5Xw4602<->@tja1pJFRk}JR1IDHiW>;bIOvJK?{Z+xw4j2Qu<7iHUyjj9
zK}l5i2#qRyNRBdyJh_9M>(N%G^A&}B_khM#?MT|>Y|wL~oC9O~XEuV1g-oTiyr>FX
z5OCx8!4T|hNS>ltju;pP8HxTV;EaMrY4WhZZgh6$b3wev7K}Obn+q5}Z8QcdhW>aG
z0A^U@3g|6yxmdXRu<BY!$^1m_=)i5I0hFS|>})P2%$$mphIQy#xByD)jTX+I%}r}6
z6l#$A8CcMhg028>e!~Q5!^$r`_N*7lna8WmaaFM8@j9dvbs0ntuIb=^&UHW@>~7~K
zcb~@q4;<4!oiBRkITvjfP8~q>W`Mn*9>#bsv?fao>M@8)!6~W|OK9mC)i;n)FPr;C
z&B+R%4-I33*Sw09aIeKbMxEK=&v7}$bw5TMmYO4!b1l_}dt6omI1jy>HhH;T*uLMs
zV6Pag_-v+J6QR1-KDTR&k=V7%18?)etMw7_g&}ktNU~`lE^XgQZgo%A47oa)rXQ@<
zovz0P`RX~{2A|f_m(5JkQhdUd{x!8KZ!JP`J1|Wn1g?E>Jy_^PbzgKa%l-B-QUQQc
zmDmW|>R^c}!nsSiJD)W}SYQ+RA~WTMC+}mfn|gntc&k4Kq$c6!-gvE<spq#T=lcc@
zMraz)L7r@j7s^A#W*XFGSob~+&~cOj!ro$D`t&K+h}CZs=e{cV^#jEr4SH}cvmOLi
z>jvZSV=zJutctm&bw*E?UkbNzt)1s$&ea1L()aZ@Z3FW@<sIo#sa&yr?2J#2t6;Xv
zjJY&8N=SFSygk{Kw28j*$(7st*%<kG&V&3|-$nNF5Ib4Ud~{uJ+k5|hsxiw`M{iYk
zG}G}q)(n`#tuADb4QN|`t5x0Cba{lAo@waEVnXCVj!yJ#i7QzeV1&}G>Rvt0?ENe?
z5WQXi(#7gN)mBp)wi8*`Cf#jgYjz);r*>OerldFx<_AA_PXlv}LO%Cl8Z8z<1<tt;
z6PvZ=hKX>Qbm7+tDDfM=uAD%hQcc*zM6gkO(Gu1MtHz}CP=dKmH_C`B=TYHq`0BF=
zNnS**_lxRwxVJN_<lT?d(T9|*$!B`Vf-e~|@!UI)d=uya)E%BPHoQX%&P+(+FiV}M
z<71o34VTJ>YR>~bQ}*7Y(jY$-pfb%2&MZ3Fqf(1PUSJIZu7Jut&BGJ#g7l40ljLyE
z4{-dz=C1@cf9}In-<g=*>b&oMR_A_P0Fst+k6a4XR+pjKvE`>hZ6$=`e4^SSRwdb+
zD<OH7v#AszWAkipH)SuCcTp7k^PtbgcsQyJGN5ntKBJ)~?F=?qjirFQ<+xOw)$`%K
z6Sv>hg)<<COqOVwh~eA)tM#^z+>>0)7VY$%)75NqN?UW`>vCna1HdM1ODr|!Qg{$@
zo`ULYw4($UxyWLV;*-E@8#e46`<@&W<ReiqgT=oyR^7g{Mn~Z^MGbwJ8i|p)aP@Uf
z*^sw43#d7ukHJA#Yrw{G?He=C2Gh35#Iuu-;w4#y(|j9Cxu5&q#T52;4uvVo@!rt4
zwFHltU!DbvDFQkHC{@qC($c&3>8^A!aY8dw4{W_=pXNR@)^55f<*;B}Vrpp1$8*5L
z(V$fJjq&|XX_u+|cE4x;%5-d~0Q!c@01(F8%|BNC1V#(Sd^&rSs`|Q8fu&4%sYALn
zYBdG>xpOD?^Qh0PhP3ha7thjA#Tq?f^Wo$Ke?w3E^W6h>Q{R}v6QwSMzLA`3Ft(+i
z&C<JGsBqSU3MZ7n5k1IykbCkWT2lSC-j~i|84rz2dFLckjP%|$JwLeIS{in^n^^0k
z)YA^Prd7#Q%r$ZJ4GVS!BPk%jiJxemxy0N=M%<3yx6rE8?kUYMJm8VCtY)Tva)#^a
z9@DODs*K-9N(lXX?S<=QvN`j8Rt2$<^GLb`+`eCX%2T6kZ}w&pNUvD*MkxMfOz)IJ
zcdx)uI@E`pZeU4CG{V2P_HgY{FTAW=J3B7X_@cxiT_7d81!KX7or}v8NFTQid@b5O
zx6PSnc*;eL9c%lUI=k15yPqjG9%JrrctlQs5%)HBU}gj4CG~BvS`F0PwAf=&5}XRn
zELGQvlzc*m-BTk`^o^L3!%&?{y_*A?-wGWTe>Nzm=chrlit~F*_FMx-7IUvDzjz1Z
z7OM8dMwKu$5&9>K8~BFjF7^sFd+iA93U^05`~aE<+p1X^ipEA6KARUmhn6YH?pGHb
zYk6BHpI*ht5l5^60|en~)z<Zo3}3W-RUFEI$j_`i?D;l$UyVe&qvC5doupW;_&xkV
zrQzIpg%%B3_mve4faDU3MIb`8;G&fl?R`!71*?``kE=fIkoBLRd2@XXt=)jq7j^~1
zI8Upt(z(R*s-dul%fl#J9-=h^NA@OT>hid7!G_^Q<3;bh;a8oZap37UQ`Bqo!p`cp
zpr$T&zL1M~9f~rKh8w4&^;TI2e*pMx>y}q0{+OI3o3-pUAauq=M}lpL<2~4Nb-2cA
z_exx18Fm`DH+n*>uSsbu+HAFH)O_wX+AGy;%*$7pc!rTmU(vG#42%{dklJSwt|veL
zCVNm3yt9H$!4{a{fVY#UYWu6K>G*-TzJ8-*40J!2a~u1Z9kTu_GG`?bjSgnZX{KM3
zU-j5)olKj*T5`ZtE2${D;?Y$?#b`Gn0=d)qnp77qVRmuGG3e#KN?X;AI%4|PtXfA^
zg2;W}Y#;XKx^MxXdYW`1{X}KvnRfI~_08{Cri~XlFI0n31Uj2)sb)^}d8)Oabm1D7
z4}~U<d+ivMR@tA=31#LB)Y>q$dK8u}kmI7x(4Eu2T%R|oU&+elrOy_wGs1(rt&M*F
z=GLv6R?p+0e~05LOhp^lZr<&B^w{!*uDP}+4|BGy&SsUi(BP81SNBs5)2J`<YsgSb
zeodyYD|ISjln`bYaGjh;pFni2eW;sWuD~MZLtcY{7sY#JfMksJqiKwnnB=2AGV@cd
z2D930>%Q8+$;zY`?h5L@_qjWrINPCk=i%VFjUxZ|%-N=QJkn7tq4r-;5chg<j8VPA
z&xMANk|Dngkh2%c2?wO|*^=C1+`d-a*Zsb!3?#I*GjCv-^dn&-$N{ZEcBww#zpUxO
zGNSy$irg_22>{R=<1f|7_mlpZ7=Y_gmA_7f9eYG8zARlVVg0yIaeLc&hV{8BG2H>n
zn6w#CQc^<4MvZPNEKU6AkZ_&-A$9Fhy=fbMv3v9PisxLqJWG=LWKDTkEmowfrl@C2
zxDk8pu)fl0yVu5z3cKRiAKS9?%{$TQr5=Dn1rfACRXXRLZmRCL`7CSA)$x+{TvMdZ
z&iEJq31_PmR2xg{oCG;*(9_LS(<51&Oxktjy+Ln>drISrf;(U0VzKWaJ2+Yw0UFX6
z@Gi-!VR^979QtASpiLFC9_?_jj*D!8gB2|`;Ko?{QoL=2XhDvNG!u#EBcKBquRRN{
zXVn!E#)k8AAE?eY%K{|tIF16jFZG+A7-CL-TJJfRU9TaFl=`>N1z-3DUopDF1>xO&
zMQb+I|44mH9XTl+-={xyy5|NqC9zghDj0s;P*-QL!5Y-42cpv(wt;#UB3XK$*)8(N
z^j6BxAY_J90M!z3PnOy2Np}F54vo!Bmi<Z*5^L%bpYG5UB|LidHjZAuziVH?!95{o
z+r<Q#t?7^rSS9u9XVb<VmUG0hXNyO-I!r2^uP~$(bdx@{=Cb$!2cX|eAXP@jirkU(
zfdbZf?`JJJbcNsdat|g*#XRhk?4>A}!nDPTyQG<dUo?xOCY3#G^b(A@B)fNIr4>Lv
zR^xe(Jz`uZXKyR_?RRd;J#|U9{63TJ!eh*{{EQ|*ZdlJWL;ab?JR*iNTqpJJ3A<u(
zHtxBQ>#P={D!HK>mhi8of#V;C;OV!0`)p>mA0DM<yVbYlJ%Fz7F<rcc%Aee<1+#@F
z@1tJ$uX^>ZMh}+(2c?T}f)VWJX)8dyttk(3<Uy+JVD1vJ|7~5k;{0pz)F?kIE{^Ef
zm5vot2|oMuSqzK*&+C)2^HVi1!t3RaQs;^3Q5C*7m7mx61bTWaC-|m^zHF^J0?+`O
zKntb#%U!X&X-C20Oi*XXSWpOjt;qq|r;lsO^xUqE0O23c>z*0T#0$-j21NAS4nKB+
z>cs2Co=wl0^T&*^5kO#_aBE)mi(`_LEVDD@EZ1Xa74R#=@pYpwpSK)iYW-6-DmMZ>
z6+=~{i8a`&<M+u%TGWkLB6^+kNhwZ32c4e2H*mw4r<2iG4xqPmdFPyDLFb<)DUf96
z-<<4!VNTN*mnm!2E&J+r%0_m{rk02@$|ri9{Wmy$R9~4?1pw;6^r2ZR<`Xn)DbV|;
z8pHfwdX`^!nTs@YX46ERY`ZN{Ffd)BQhaG_tLa^ykuCLv=gha(9NX@2`z;g1r0}d-
zi?|7M9^WrtIae3{6#Q12=`-5uG)cN(r|Yd$Qmz@tllZ&ejbG3BOWagqibsF$Rt`a5
z>f3DMJqjeP3>i?0FrSC@yUf{_10c9)t5Z@q^t-;mc*q;sSJG?q4=OeKi<>5AflQUv
zI3GR(gx=FvE!qHVu^nr>%*2iUbUGQ^fjp)$+hEWKP)gji+McXgUs?q>eauj*Bs)ip
zrY-&l&(DhjV=q#xa=7hR<~;S~GsVy6YJGn)Eiw<|#WFRc`Xtr#nqJ?o1{_}3LR~nd
zxxOu>bpF-xvomF?;9_Gx+}6gtxjy*&dW=|dyY-T+eFg&%uAo_z3n0DD<Mc?aW?7IQ
zGT|ey-%f6=_6bOgE6l%ZH7^{Fej;qQt6M-{-c>AGJF`XOp*XK~S!cS>y$L;XY07G%
zOlDffg_{kM6)@UoV23ZTR`-VT(lEAjnXpgZr*LtpXQ@Gf?CJVUY@a^_A1%2_(MJDG
zQ7k*q!}%o&3CU^C+IGhAjv$;K7NXOpP@B8w0r<i?{94?Y%tH!C`VU(`T5rL3*k5Tz
zU$TZ3)*O1$hu7A|Te7-9$nJ-Hcru*1DY9w(yA<EjjS=>PyrK<rZ^>R7H*fuF!1Gx?
z<=nn~)0pe77Tax~<o<niY_1>4XSUOuH;|rI9~lGIHFCH8Zs(}$ik+8UwdZWq<D3rL
zD$xgc1H6+rmbR7>*;{A4S#MQyamLSlDQpK`u@eH-@M(X#UQ_GDR&`N&ta2!!Y$|AE
z;q^~#*=!M&r*>{5vGFY%p@#Hv(ERl;kX34cn#mQMcF{t0AaNr};ytU{X7Jnv&G47V
zK_y{=rPNyn5O>~rZLhiUg{)>oKZBQkqNuO_xHFk(EwN@9FN>LZT0NM8EB9LnE~Zq%
z{K#aMEm=d^Irj@pkQqWRnY3!$?konogR<fUi&x&rJ;iXLm~U&zerG(z`pJ*^EjXYP
z%jD`ellyJ(-J7;}!N%<RWUZZXiTR5?&Wt&$_<Dm^LTkFLQQ?pEtkP$}k+-lNSPtz6
z{ANvg+s*zwD&d@{E+f8yz698}SmdrnW~KKnFYS+aM6y-~<s#Vl)oDED#q+C7{XRDH
zdDtw#?P_Lo_ZX$Br))N!sSYNU%1dB>hWoUImR*jp8_`{xEk~GHPHop8%c_w*x|h}G
zq--YR>ASBZi<#4?!Y(;@S5n@!^S-YKq_89PT6!FEZD;|}Q=0P@$_9%hzX@5}xOVtX
zTQ5<o#5-%)k}VGH`suRD_u;@V`^pgD?D9;+c(z+k5skMbv`j}Z?V8O@8zbrZ8z$ag
zPApuJ{Zd+P=L8+O-eE9=@ME#*Z6otHg_jciPCyoBjjeCV3l}7wcH(}=2=tP(+o#+n
zz92eVff{(BeWTF!)CBnQI^^S8ioXYX;KeWYeh%=0g0Tx{)<to@2PYxx*9w!lzXp^U
zAPW$h$3fUtPxJ{pA^Y@fn?9CDE|ys{HvlqS+hEcONP<OE)HzF7-R|}p9(V_9UMW_0
z{6o8Eq!k9KD**6ZI~@QvxF{rU$}@n>-(5?dpQvjC=u@Lw;fUC@uDWncoU3+OaV+?@
z@<}rFa;W{9eUG?O>}%;Fid=qni^Y<Au+q=2wTUIulZ5I`BMX`kkQewSEkMDY(FHoe
zR%zo@VFGYcb@#M{oiugWaIV<;B-ZlxPC1drZB_5<!i9Gx$+}+Fq2}HvsmLv;aQ&x+
z^=D&%ituu1NrM+2csXj)R|j6r9vciW+MNr5+7FeX%I(2YU_Ms$l@$kadyazuRlZb!
z1c3KGUfL#}+uNB;d?lC@{y;=<@21VOW8~+d5}6r_^97;fAteHBo}tS$J9@Ndal2K4
zS(HcfK&%H%=-oW*jpuoNPk>gAGkr=<-L*?%{!%<d^iJ<TZp^DhUX8b0z+!yfaI3Vl
z1-R=q<;s;yNmR2yqBUHkdMM~EpZ%kB%Xjzws%MctOXeYWMQ?hd`Cex4>AkKCuVSbI
zu8B~}r>k;Ywpv==z{@$7+4#r$hgr%wH^>BTpw6$A#a2)Qlhv!cB1<dLtCrB4749#B
z%12wvt_ji|<}J%|k%`@EX&}?;M?4O6Wg2#x*(p9~_+2x_-TBtdxm6Ot>C4{Cd2&VW
z5V^m&lFY{j*x;KB@yU{~I`wn%T=u=v);B`Zql5v$gNz=OXYbD!(aPOSb!CUy<`WNr
z`U4#u6<4sw-B8`Jtf#M34}ZkD=HIM;my^l;0$)z!ocF&pF&<{$1C&`BykGS8VY;|<
zDxS>7B(XO?=HP<deYVAXnDTx07y1FtL|0ZiRq~z2O}O^|kHSkvGDHH-e3=>!Pbi|I
zJKX%Mx@Tloso>9_ZBK!A5)e&)m0DS<0!F@AVT{arTc-@Zdi`)^-sMeTe>tM5fgU(F
zzJGbRHel`-v%IXVtQUg;p9Fg;D~@FSud=071~RXED>lU7is<8(YxaVVJ98-ykNFDy
z4d;;{qs*Y&)1R#mw{$Lt7nn_DRaI3)Wo0F=TBV9~2;3Dfm_dE`XQs$JURf|=%Is?F
z;o99J$MVhta~9MPVi29C%X`@1P6??3OTTvWq>F+Uj9Ck!eYi}Z?%k<>e*8+4T`v8h
zmXDtJH61}n4VQ@v*Z(f$xN;sC-#?|OJV-^Frj@UXhYjPR7TG<b(P&DB%6L9b`<^Gt
zv4;yDq`j!feP97C#$Qoj_-hC^FOXXSXRhkc1ziAz-o3MQcr(uYYGk!a6IfJ_rT4Cf
zr`np1ybc#YC1w}0{;n8FBagz|@&~*~TM;MJ_&)Q{*1O!<PG0Nvjg6g+klC|UNk!aN
zvWJRVQh)xc_b4%WZl<S*qbJpw%^#YHw^#nzJ4~DbMX<xWZ$b~KNMS(<Oy=;yrWcg3
zhrWAm<|TO+XTZoJL68C2+y34~>7ieh9&7FC;c)RKiSFd<%e|p%IR40XN6jpL`&-qe
zop}`tkIPo9({a~P;SPMags<8%x^3GQRP<YHZaGv|+1>$J1*#)@W?SS_;Pd+%%QvNb
z2DpMMtA{?nm?|!shT-g%eDD(cU%fYX*S8@dcj|G-mN4ff{EI{b-^nh-njtZ=9~TDV
z%br|enyQeJ+R94tB@r7c%JPPM^*Wv;E&2EkKapzNa;V4Eh=r*d8gDsH;f&k{_zQv}
z_lePB%AbVX;-GOGqg~Te@e0PCLO%X^OLPo<{cl2JNh#CQ6}95UmJ&MxXF|gXu6)X@
zCcgD}G+($Y-q57=V}G&jQ=!s>O0LGUPNYTMfxLsK-oF(^lC4YBUN!{2(HfJ1+&<Pn
zOhl8WHJxyJB>v&vK#*xg&yem+`!0r$5L7vAU!A!=u~?0FcN=Srb*T@A4P$EO;T`4E
zS+|x2p-X~%<@hq)tI(qxi^6VIgc{dLC7)eNRG4G!eRE>3mG4fO4&I{{K1F}?F-vLD
ztCoS3r$hXe6U&8N#uXEf+<L0*ww7wD1~mws_*em!0@`fj&BC5lVQ>3+E?k*piN7z$
zf!i03tjeXKdu_fYEm@(JYqU@ANTP>HOvZ*YuDcCAX2U7vn~vb)k_n^lIBG{AHMO@M
zXLQ)y1a<GNu-MGl)~2a5@z3ZSc-FH)2SWE^<9DCuP0A+#P42<@N72tKMQvH4*BYb%
z{4~`-)rfDO;rGJCA9=tjzJ-^GaOLEJI2IQL-9u32vpRVg*NxQ=-W(_%Q5K99vy&+p
zoUYWw$sWKBvWmaH9wn6MNkH0nAH8R#c+y^UxnWHE0q2>vv$#a}wid$M!Dgj`u!}>J
zj5nXgoXztJJk5#gIIA~sQuKkoKqXPwt+_;Vuh9*1uibDr5LTZv<I*9RLgeyY4~%sf
z<gt+({|dilv|B~$IS$R#j36x+5{krBPo--Z_xLlj6o_ICeb=oKJ;ApoNf8AShNZRu
zYU@{S2`!<7Jitb5)n?+Shs(6KX1Yu7FvqU~85Jrj<17EEd7RKDm)0dGCr6==ci6;@
z07rvYD~<Kn@h`AXW9BF95=wARKBTvmGm(Pc-SqG7_Z?#p%a`iox09ivDU-b0!shl}
ziNL@IOP9gGRSv#=)R1jEgTq;J`JAnFR!6*(DAmP53Drs!F4`AoQPTL8t(R`y!kT!v
z9qik{i;^w^mQyDbxgmbnESWT-7Y!AS)A#;RIUlC558cY<H8fybi{bnJT-sN{O1Vt&
zBlFL*!|n~$>(<6RAC0lAJxI+!vpHeDoE1_*p3&#IpB?<2&Z`D~S)ZzkfkcX7@q+t^
zd5M`^Ip0|W;oR=F<o@~OVrxgHA#qNs5yT6Ouzc<u{j2VGxQ1c&$^>}1yGKa2rQe1e
zMNw?&oc)>Ke2lX{`EuZVa_ICxoNdnacZ|=v#E+jIdcnUYYiIlwd5&1HqsbG_0qFD2
znD4!=j&(}GA$%*ZS+h*8F-a^jrFY-j^s%u8c|J6jNHC{>Xsudg(<M9fSZtK2r@NZf
zY=53?M$X?jYMpLg;FKJ$cr3|WCL^*Mquu^BIcjh>hdbS&EU7RShSZ}M-x@zIh>sKS
zNedefgT}dW;9b=X#HiG&$G2*%Rnz5N2TN5PIWJ)9n;D;RjLFcH(9$8{Y+K18gb%a=
z(TU<aRoN8r>?O}My^~*zWL*-_Hxail$^ti{?`Mj}_LY!kqwz%r>lAr4<?|YZWr-am
z{Ck;tOXb>n$*I;;{zw0FKBk`gb&G)WI7Iibflf5FQxywcsA|&J=9FPke+gaCBw)&z
z*Y}#3bX>(CxARjvaTHwHN5Zig-S(NVzRtGVAYdMPpDi=_^fIw(sLgO>=S}w3*<#NX
zh!hjCrg#QpJ+6cW&1q!^H~l778f0GyszjZR5(ZJ{i8Ep3=@K>9Q;2>c2C^34PNhy+
zD|#txm1{fy(JXlKn(??yI8mE<^7wsTd{G$e-ZlvVFf6&I)sI-yQb$?-G*9|W$miba
z2I@<MS~6qn!n;=&hgF=I_8rhe=p>L)tD*C<;y%=yg-GGY((zU5KZmKGKl!Qv)Dz+H
zq1fghgZtO*qst^jif7xX%6sX6!ONw~u!MXYbQ-W-<4R<{n4dj>07e<Hza2`@IasjK
z-Qw&!+ZoTm?4V7nz;VyCFltE&wY%1;pi(Vmb+4aUSn^;K>K7a^B-X`NGX3$wEnel-
z*A!2*zAMtO@ZE@dIXzVc2R!3&Z~yJjSa)@UTbLksHB;Mpu#(@0lwoYYN+fnb-Ak-#
zG;H43HEy@WE<tlsuN}IFtSR+~@`IaK^fH%MY^e(325LRNbA#CFL+#S#E|e<})FuC0
z-RN9MHgzPg*>PJy9gko>*nFb!*sYQic7;=Hk2~c;lms>xwf!eQ;p1ElRG2kmH*#s)
zsBqpB1|8^=DT_9jw?EMGkDvA4{FV#eY48S#?}p^$CCo?Yx1BT<svqWnFG`XEczlLz
z``P9NNRGxKmt5#-+8m&ZgWe`_nch|(I%`^uRi5_bp`DH4k}0H7Cjz5Qzr3t==l964
zz0i}wy+-ZZDF#i89#b!*zURaF3GHI3RXV)jS?vD2D#_ZUMeoRLp{$NWW#X!_6!flr
z&&@b}U_2L?&@?&>cfnje=Z58=*X=neDF3^zAIT-NK(*$R5a9k$ou=e<SM7p^29JBR
zaEEk&hzWj$@@>5vpTUu_;|2mIzM*2Ut4+*fek>GHg-DQ<4~1%SN>{&+VxgG5OLpGK
zs~{(-N`KAS6vg_%yti?&*`vWH^CpIhnx5}hGYbrT#a5_`30lA0X19ry=X&GgyY$3u
zh6@<~F76nYlEL`*B`Mp&6!~y|RF@eI6(J{yt!-_o=sFn3E)_r?zm~+@S(^i{b)!rX
zKl+I`mAe@18PTmgk$|&4!w<`XUDDVU&v6|GwK*af%hhksYRq5X%QfDFm3EaPs1g+M
zmT&CRCG9?~TB43+x$Om)8HA)O+LG2&0_=XfQ(D@QLx^hMyPEPN*Q0~Zg8>t`WAz1|
zYXxU0KCQ5az!#@@jSCGEl(qz_AfKl$x^10|b>$6@W*zf`Pn0XBMEk+Z*j8Q>A-(-U
z5sFPY#ZNM2Wa6@Oxv$Y!=#}se1j@*q17~+HH`4Xl+uRiEPTC4Z5Z>0-P7Ri--?qr0
z(CR()nVECQ3B`rGPbzr!C4>SZKd-J>e~nrjp_8LeHv2o&jCi+pYz=>s+DG~Dn@eTm
zALUYLw^yhMQzVO>M+dWT8{M+`>Y6WR(D&qx&c$ASNeqd4Y21EyGut?UN%%}&Dol|p
zFen6;za=u~lsO8uGr;YQI8A1T@hW%R`;T=TJ%I%jZGeC}Eo}XKdDE-W`2=7(?yig|
z_X)L~#lAj)lEK?ReDQmI=*hEwk+)SqYuSXNoRithP;vWoNY*%)(pRBTFxQJ@c(T!$
zd1!iyvt28J7;P>b#TuL5@0PL^Mj9@zF@sL`@a;s&n0TM+o>?oCs`e*I@!iirJ|^ED
zOO5SvNwZg=nCu$QS!&>#X0emsap2ROATTuFJ2V(xwrD7DvvABtJSPoO%pvB+#;rsV
zG<EA{1&z+7NgrtIoX;ieQ=Vd|>m_wH!;X1(2*`RJVmJ><-HfKGPPynQV9d22!+e#(
z7G0;ktsiaXhc^#ShS;T><8l5TdeyeJW|)PV=a|KdzZuC4J-No+)5}ZA5Y5s$3ly_v
zi{*z$B{6(ZU!GcYUGr+4yhT*9Mfr;~F(A$xQwZnR><ROo@7Cc`2u2|pzE^fc0MZtp
zRtVaQ+&1M?5&ii7{Dr}+7a?#%)x84P&W9xnaNR?{XvO*lV`z6<(lFD^_CTDD>yoaU
zI*?M%<`jT-b<`Y)ao-cxsKWOrZ={SbPVcU^_v0OO)-$I&hM)G#I?bpn;E^rp*ejQM
z-FuILsI0vwqnPl@n;XLA-s3B%N*5hgu=WM+82Y!HFJS*N6LoB?o}+rCA=L-O+xQ?_
zTU*0sU!-r`YLjh7I9%V6vgg0Chx1#qv#c>2V_kZ540M0U!!~9;cSKqL!bv_$I^)eJ
zm1$DD*|*9KhOIy8EaGwWs0Y2db#43864M0tssi<qTT7+IV$NlmV@)@_3Zw%RKfaa$
zCuo%b5An%QCvmTXJv5r$sS<>~*ab8kO#Q@olWux)q!5ItAM^ZhB>C>3C$%pFKE(P`
zluWo+9x?{o9|DTm9Z2FXAD67k9bC(8B6RVrB_jFoE)7^n>koliBMJ|pYh>>b0?a*(
z)HbZki4}5rwBNL}3ENWFnFX<y>DRi3M-4t6xjr`jU-c8|qrVE)br8oU>_t8!rTM?W
zwNKdgJ|@^kZcr%om3Chy5#AX!a}8~TD&lw7!W1B1pF_Ds09Cl{U$=QZ7BS{AaA@~3
z{j<}45t+H~N5xc9CMqc+RV%AupW=6R9)LVwlnp}HzT;iostMQi6P5~#8>x2|ciSw0
zX{*VU`(P(bO%WJdN*ToPA;;x0rEqV~XEe9Y@g_0A;d9xD$+zr&cA?pqp~hLNnf~Cd
z&XD1PYuPHv{yG5wj!GVg{j%p~Ludsxt&xJUysRV3Y1~7h-!xZly!saalu00jK@=Q6
zjRSX^fTWo8YuZ#p#aAsk6Hxmr31Xvj2qOiF2MFNVMw20bqim!?W=&~8-ou7DNHuIn
zv0MnqMr~L;i2JEn4-3v4D@}+Ql3r=7U6XR_5Ong^D8haW(b3dcmct;m!j&);WA*(7
z33EOsm@jgXGmcJ7>$cCT!{@IDFayke;*E=$BcYUFm?sXIYPI!UM~ArhZ3dc2-mw7t
zg8hSdKXg6O0>&zpv&dHRg)V49<U;xByT3^)(aVq(4v>lrSG<bCiKj9s?DQFm)zL;D
zK6h46XIS8l%~R>uuW;z~L8lDqc1c^c?t?;9_Bs96gukNF^!!-(`Gy9&SLx(*Ps3o|
zpJc~{a!$0w_t!4;9*?DTDS@U_yw@Uf-+$^lZ$pT&A^B^VBqC*@3we;*dbirjX&Sem
zsw5;&;8Mh1XCdL0+os#8@#uo4R5`#eQpT9E`Wq#H^pIH^BXWQudZzw}-28Txi~2qj
zUtp$;M2Mm7m(1JO%HG#0zZ?CpxJ2ryUvdKX9L^Vl26YRh#oc?FQ<We0dw`UkhHDW8
z58u>ia@H;ly|`1hyJZ5IN;KM3wK<pw@-jyU+EKXCZ>b%*b_NJhs$PQOu0@a<3}<wZ
zLpmC-!XhvwVq_ZwH^;jUTUn`-Zkwoy-Lt0UwsrrOMU9F2x@DkZ)RQOlxeA{!E9iwQ
zZIl8t>Q-$0z~Hh_k!Op*P-RMCz>T(5EmdgZYLgcLi%f|ea=Ns6-{$uHGXOih%^tyJ
zpPu|}f2p<U{dZbg{if>1Rexa3kQveb?s@^t(%Q0}e+C^uD4IxkgjAe#Zk)V4KsAIj
z1MSQWSl$j|$z#eI&nwHmzc!4dhJDt6eJx+;1mhm_&0YvHr-T$gA>MQup-l-z)6mW<
z)c9ESXW~q}GEUkG<sDOoa}Zw?E5nffiw-*zIaJX|Fy3q9nsEYmMSE@susC<^>1Y#j
zGP-U1h+B92rj#!NrY3}!HXO5hETY2Noz`EU2NIY(Nn^ddEoYOXOT)-r)}^X8n!?Jl
z(~f1xdPe^nIJ5l=nnP-AH)UiLuTk{wl_4)9GMb}rwTCMH%(*gL63a1J*}GrI7%C6W
z@PAx%9HgJGh}*>>MGdz%`*D2Q-Pg}3wy3a#6<I%_!;8#kl=;$SVdk^j;bR2vs)CFb
z$-ziBZeQ<;t(loUtN!W*0Vrw*hQ+9pM2Tm9jU~O*sZ@f%Gd#J`-nYE;C?v?&<}~hx
z#Bm3Nu>IO_+;rt;is%3_$0&iuf>2gPdgG#+f|HXf{3>+}#9)8%zd+qPv48YlV3k#h
z{?u1f8{VXNTKO#%>VreaxL#7irNJ3S?k;IdMqb}T>hU?}w{1JC;$6#yG^5S_8*E=z
z`vr560p{dPKs)BXsUYKjBC3A?H9wVe02r60<ig=73h2|!MsN=N7Ki>id3t{VX|}lD
z_evlB1}uXfl94nptl0*^qKG^5e?yX#V0051k9?uV_!pqY@-M_lr1kx^(}#Kp$W@WC
zxT}GzH2^#MtQ)h!U)ne-|GF7KN#C4L8d*e`IR18<`sWI9QHcB_tJvG09ZzyWC>Jl9
z{G}{(CjOtGTk?fR1jBy=lz*MR(&1#lQP+h>9*kgiqKf`)mj3}a>Qc!_xom+(K=QEe
zmEVl=pZNr4ai&h0O~n?(18Ah-1+K^(o@XIL@=OAVsD#w#zcrjJKLWcmKmWSp*`bd&
z90c9_at}|GUm6+l&-z`YB~A2&?tc|3{{>?PaQ_30(i&YiRX*H_%bg#9b{cR&-U7gC
zZVOyKdiWE?Psu(W44WemAouN2+R`Ig;KG|shgQvRgS-|0m08$m3e7li=mSSjTp&;A
zwVRH__ZL7FSi@_7nPw26gCX=yWL>Z=LAZsuv2hmq;PKJFCbsyYv~pD#3n-tf1+p3F
zy6vg4nA}V?3m0?CH~92SCXna1UG;Am%7gLZo#(GvBs`syL20AKZhBTQveZ*O^~JeM
zc@AbEuZ@K?70UU)bjSP{PlvII_0h11<UUfeTlzj#^DW$+$E9Z|KCJh!L3HLwzgHUk
z(F#}{4yE;T#c8V5ftpF+42Q?xxPBt_84gKY_$9&X(*}1wO}OcS)1#QTXI~cru+EVq
zY<3C{WwiXFKuMpN2L2mH{%b-L`8*Zi?@o$-L~8xKSdDCB5!TMt@r1u^S!O>p<$fEC
zYF{ptn5CyGs}B|{5YliUl|<a---7Y~+%%J}0?Vqoac%H#$u>6bP6u$ND1`R&Ulx2>
zO&3s>qj&8u8a-?^mpci^B<<4)bz+$o2-lO`(7!(LN;(fvf<u7c&i;1k|F>?N3?q=B
zlA*M4`JZ0{ei*4?XlPi{Uhn+(2aX&IxC~@^WTed*{{EvhCs}^(VYtWtYV=&{x3<fd
zi>UtcCeo?rkD`y;{hwbGTmC;=0|X2IudgkWHOGwl@py?-DAWJZ*CWSDr~m<|JPmSY
z_V7^76dnO*QeH~L9JWKi=1Zv5#<H||vJNLvfFpnsP)cjN98e_sKgOu-mk$87zm(!Q
zj{nslAPh!21qj`c7N|A;)@(f$1LVqi#z+3g_c|qy)gZOp+}ubRZ({yqalehn{U|f{
zb<Y3s7h7IwFhT@>=i1?n9bo7)Kxz-6^?d2-2*u2u@UVaH^nd;AI~~6WD%`o;CL0mf
zDrdTHm&9%Q4rTUk+xz8{CEt?m%!~Ym^@eE^!?-4tFZ20YKvT*VIjeu`Ah~NveD6pX
zKr2U-cdK3XR-L8^a-}zwE?-JSY}~iG?;Uw)f$G#w0V;^cSesa|X^)?9&TC<1UtO=V
zzQ3}$GHDLwND129rvK4g4^(NAmYGY1w(om)@Ex9US)O0&n}FYCZx%XZiPy&PQFXsg
zed3PsA7ARx*0S}+ihK971L8gWD=VYWK2+(AFq_Cc&c7__XEl;Sz!AR}MUnh*Bus?s
zrOGN;Ow7A6V(F=$`!ZKmWUYBM?Nt-+t=9k1hj*lg5GH}AGso{<v2^O_DZ;t9)l3n*
zy<<tkd~5ixLr)tsgYMc*_~7d+D}N=e2J^+*p)UqkAOMG9TSJ(t{o6rt+LdQ?MozUW
zFAq(VwEU?FN&6x|v;2m=)9z$PB_9OdbzUqe+_I*wMoh&yd#OxAuk-o|`{L4b#it9}
zRF5h>Je(Mm^aEr86Qq1=G{rzEqHcwii(R1kLC-9K#JUKUn^OX$<~fx`(ZE#YUEx>f
zs!m_{EqwW9a%VE72}-!uB(Z)(MjOo6*X0JAo?FBT$<OsCj90TXmVt~$gzF83Kb^R!
zE?GBI@`;gG>`r5S4^F;TxFW#qJiL#}&zQXgJ!rl79g2XzI3hm}+<>TDVnhBMxLN_Z
zO;(>3O#;%lN_)vw5c-8;W5B0M%yyUo|H-6Y1Em}iJfi$X@HG5S(<=6p22>gcrhc5n
zP3SNdALUZ`5nVUe5@zpv-zth03q)YW{3jr*#qtV&u4QLD*&QP_JgOB8w*@ylC*3Tj
z+F~IvG?nj!S2XU;c~0E&Xgzd4QYXH<dCl`lF?~efp*ztTB)QW!YY*@NR1M9d@*`bK
z`LlB2%#$c3L~r;p;k3ML@**V_VO}0mb(KyA-c}z2CNjCuz$=rO=A`WeXjyJ#LVyx>
zzl7!N-V1=j8C1^t51;J!@igGYEWHvJ!%wi^^I`y*w|=-`PglUpa7<)WI3eUO5!5pu
zr3sbCvjG=A6?@hI1GUJXXoz5&my2MH$5zIO01{roi_Rh^|2QOn#FM|nZ6964+Ar4x
z9+BgM(3h(p{|=lH=}EGOB}%IRm;2*XAVc|P7(@C6&<O|?oaX1B;?}8o6u+cHL37I4
zd7AL3dy2S>)Mc>pu_izY?a_B7yyX=w7&0U(<d3l)J)wV1x<G^9-|X|^E#M^H+dR+n
zr=h<U09@h6=~u_>e1YhePzS~W>2`|tb1y~za2uUL<m0VA=|L2wJmBa@?iDfq>FE6$
z02+x9q%rY6(`EbUHMYlpYEt_FJR{=zdQ9&T8zUBzOoy>!6WxrqSN-6OUkY^({ZiIx
z;56vDp{F(k+}kE>Bi|eS@qtu#AcOO^tYcuT4EXyyhC>6!8rJE+G*m@B*eKJHy%$V_
zDvl3TzLfgtL9IjxytIZdy4B&ddEgey2isA;0DWH)X6gS84y4n|mG*ZF4_pJl4dsR+
zEGZv8E}0hOtvynz7u1}t;7(2%ANtS}EsD1oF3L4<T(~VoaNDe!%2rPL^fiu8g>_c4
zYVl!N-)cJku2O`(rm?|DvX4VPX_Bo6-%@aE1~lF1ri;zHZSwkHKTwCM+;|tNUu*T1
zN!y?UI=a_Vsb0SrP6PC+lr$(?5ZuM@0T8z?XfqxXXzqLn9BBDRoia1!&|Wn~3g3CS
z4VI_6YpWIn_QzZD<-20OskPi4D-s9U)(oz`Ik~69F$m$=+zaS?6R84~vhXRW9Lb8q
z(Jt6+R1Fnc?Yp!$Krm)<+e>F_MlNl_ecNxa7|+({oW~PdRrBUH3Z2hz^fBp%sMgjU
z(~TQmeJeH!=o-p&e6&6IrlM52<n8Jrg?Qq6Z{s}m?Y8g^=IUYF(9?t{+5XiOh9h3X
zA(80d>m3mdWn(mcaP6GJCx5Ks5kGS(Kq!>5&C_4tz}-1ZY|B3zzaCHB68p5{u8=9G
zAN<o-ZsQO0uAl4V0j$Il*g=8$;*PdulNsN?j_slRg*k_K+34hOD=G1iVLPc=dg<=l
zxs@$=&z&GhH&y!HG%D{~n~7BN!Z7#2-bw}yz@UgE8Xs&J3*uy?+^^qP=#io;w-V){
z{&PQ^vn12un5Cm-;@o`4)j@mV6p)1+69^tAUuoNCh-0$^Bj|HFmpizJoH<1Iqy&tX
zuiISGL+N~h=?o!#=x;f!8KW*_ngz>L`&kWCLL`USs^%Rb-we2(N6AD1igp&hp2C|5
zH~w**?8W=@=xL}`l7(^nbl+1*ae*iiBcW4l)U>1F{AJ15k=uCh>Eq-<)0WeOMq>h>
zLVEYTLH50Ow2F`De!`PLdfkQ|-?00rK#?|;Myau6AD-$LD&94~%dPf;YBE!Yf)2|P
z^0;0D;|iyRUZz669vH4^e@?InR(2e3q}eo1@@#V=><(Ac%aKMDtI%NV-H#!3c0gVv
zJ6Ab=F%o+34p3#|j=2Uc`f_En@{%2F*9v%<;=*lEO1TVuOcU~XNk;@=6zreSs;`j`
z7jx=DGX>B1-gAJK%`%VgHm2+m8QfYsl4;U+=V^?MJ8Vl_jYHVM6{4%zljAMdA!C4~
zpz^mD>W6Me{O4!p78m&uy>dpuUn~>Lfvo3lP5Iy|;dQmnMvQg2+gd$G7`77Oa><I6
z)>juk1s(g^mI!3Gev%AS%MCbu>TB(;**mRrYdf4=EKE!}7|OP&z^nMQ)~b@SdDZ9h
zg&HD7r~7Y}JNXbF2o0QNxjC9IVa|5oQ3L*r#bOB_P2NH;Yrl*U;u>@3hdWAmwSg7*
z<h6p?-giPBoG-U3x!rPTqA%tEV$;^=a)oE^n!hNkJiwJbss=%E$GFR?819if+JxY?
zcWSX>K@+tJ)TyivO)uQO=Rqaz3tuR&APvIHVR7uU(atlG`}6q~P*45UT{k4J>zog2
zXESowu2j>daLc}}YrdQf^z^GQF&&=06BI@qMVt1!4Cd9A9~jZ_rR;`2!sPD8@$UkP
zi-F}g4^jG3d4MBZvk>A9@UpU!6mgc3yM)(7JfjT}Of9;HoyKq4d3P=4d^v^7fwI8L
z)sHCDCui?9mX)P%5-A~agLkhRS5=r3>jk(ar`SIUbQA?8iRgdb8_TKD5azvKv@=cM
zhp*degXd_6pAPF(YK(t3&_lq5bHiD|(cP(#)-uVlE1THdRk@@V#_kDPfLVK{dF+rE
zPZ0R`9ksH{Zm0XCiQgh)dBrld4Vo4r*k!k^dazq4MwmWWTLMyc!FgJ5na7k_2<|V<
z^_rsf6>&MGgP`1mKBnQ?D&q`ng5FZ-W@S9%xh^%k5jn$Po8;Rs*C$E%Vo+fK@4T)s
zVlWr2b+K=I7b<y?PI8_&b}MgE@)PmI0StRE@C<gR#^gEFAxqeEw|aPkqGI<%z;YxI
z>--hZ`5h%orBl|t=*-lp|C+r}`Idwu?O+2#+-#Db%4K4PoI6m2qG4arglp{O>dO<m
z!~9hCH=Y&Yw%*sEyBbhLAPaj5L+Wue^?L`DW?6sGHFOR(`K~%_*r%kuC0Qj<vSq*d
zV;de6sr_;43djswHB&T{Te55EHh76;XQ)hzS3c8IC}%UbjDx7Aw>jzaFqCYecW#Fs
zw$M*U!s+^@Kb%2pQQ;Cx4y+*uNhEYfO&|94c3}xk`jv_>U#aaZ&CQ=y^@fqPv+Xte
z+m>45_H<Ca(YAu6gwY!JQ9(1mSfG=<G;95uOt4gS3^#>AVGzUh2<J_xTeRhRma)fW
z>sR-7x`z_i;xRa%rG>TA!zisNMQ)l6Ku7h{cRh|jE*P(*tAS(P`kWG_Auk0aU(}He
zNam54M<tdT;&4{|8^Waq9e1M?kc{P@_0=Ir;<xpgnEN%#NxqUR=8orGbYS|PA)|!R
zHAYyfM=)_?y|wp|p*OeAr-6iV+)^G53r*jPC<EdvFOB1xd`~XU5_bCJAiZyDx<wAW
z%#sHQAA&WrmGjdFQcmN93}Pk^#lAuYuaFwTZ~Ew*E7lgm^SbcrK8VKs1wFS}W8;;j
zc|Ezi3M+MO6LHfOkx6?Gg%k=NDHxUJmtfjlGt-7HfbiNB^8+a_M|(#;2Sp}smsjGk
zLru)CgU|gdCpt@ZXJ!R~BtLD1l#Pbl<arx;+rgYXxMsnns^pBZkgN7|{UZ{GrV8NA
zjAaE?YuI!?s#ZYg@X+wO6lM|=*8z^-zEfVyG9CB+_v0Yd>U;gRz6<psJV@VMpiGF%
z$g5Qp5=^tBNNczij39hNWxdFsd4jsSF<XXwgWp=x0p2FLWu4A_zo&yXWn!pu*8PB3
z0jip5-<terZPH|AupM8g%;%yfa;Q6kfU5n!-ZgQZ1uKT1F!o(QLk5YAo1{sO$aZHA
ziTM>vj>$Xr>7|~%=8=>{m68DyS~O^SgQ&q^`=MG7xKFtaZw^g0M9iV~Gd5iEYn|l0
zqY5`qK$`Du9g4tTNoN86^{y3Tcn+hp9%T2F+mMV6;0zb|l0I51RVHuc*g0LlnTfso
z)!C{*7CdH-n}N)ad2tSZD(rTd_BBVVrjTO1pc@}Y0J?XakC_JjC(oVC3WA}rSH^P;
z|1pr2SNz{R)mzdmpgrXsX!IHMQ=b+-NCfdy@wX2qkUek%+C_(%O}G>l<R4kHu9s~!
zCfj#+tmoS>su2-gK(HZY4*0=qCAZL;uefa7u}IUvQjejMm8cqJX4sAH<*#Ae1UuU5
zQFdRS2m_1nU47@)qST+s57xxN?jm~`BVuJn<fwknuKbEEwV0NFL8nx1Q<!Nh6i*NU
z+A-D@gBa1b4A;XdiKCz$<)|~bb@=6#K=hC{6OK87tz01&IovqN?vb8*bOK+NIO1c!
z%nVuoQG-<5Gyimp{>RQPMMpV&$&26CdBE-eKlMMT&^O9gt6<Xc;x5S~jG-Vd+^u$Q
z-4Oe(B&^tqXedSjiAgTezPKn^3tWB*+-`yy>(uL}u!Gr^p}8w#ika@kVYknf{~a^~
znFioJ1{m}r{M<!=kydceA;ZA6X%sRyPmK!|WGrXLyl)-_BAWX+t80Hs<lp!Jm<3g7
z{Q&L};7AztmJey0r%F)FoUM}Bq((5G09YacuUdHzojH`(q}@i2kC{%1Qv(@{zr^3A
z@0<WqA7Oi~+F7U0l`F`M@*TR+mR|Tb@Ro$fI2mN#d;j6f%vtfzijuBxfV<b(f%h*d
z|JXU5UyiNwV!nvQDWh%z!C4`#=^^@XkP+Z_WNT?3e>n%BV3)4CYadd(S1TglHL{+6
zRRJ`Zd#t=-7XK8S7bTO(rx!I#bL4<A3qQDX>5mS)s(W|(S6Bwnyc73V?{(gDVBggD
z$^f>x*TTue?~A<S2R6ZgNZ72sAHYup9)gf`M+{-c{93Chg~Yu3KYRRfcat^&qBDAP
zouV`aplOBkhtc6;_$%Nw2MtOOHh?<aF9BMgRiT88W!gSafG>-#Be*F3__ZU)9?_>d
zj9n$Tlnzki+@=)Ck5E7+e!N!!X97XsokL5BRld9l&eYy-m4KMoA@ENXRN>TTmI#gq
zlF&zF1$EH#Z>Np{QBv(=_CF>>P0J5=5>hI<YXmZrvs2&X7{sU6@zPb|?IMkU2NeQ*
zS`X3iZ{IssL5uU=C(%|I4-4Aa7walDp7OR2RVRFl<R3>VhBFH{11SH^Ipw!TnWE;P
zqAPz4OPWA|CNohyAg_p^GD*VOniu8-w-YS4%a1WZT^-8WJjc^T05s#eP%m3V$g*fT
z!qoPU9{}K=_0to;8%ly5;^XaGZ7hT!5>uh-`5c9j<M6X?jf)kpSwN6PV5S>F7(Ru7
zRB|cK7b8NV|AGl_j2s7LYVeeS5FL`FT)2c+sn{xVfRJoql~Eq(k;%ze{oUG-kO*zq
zc@=&PL`GS{>4GnSsQO;NQg&Z_Lu0{tXbBwuK^dtqva9739a0BXv^d}?jz%bH(+S@e
z={oHo_;~H|sf9wB0<p2ZbSUu#@p@){9Yc8<-?B`d#bK<G1{fr=w-=$A<S$ZW-nQy{
z;NzG@8XU(HR&?YlE;-4e*{Mc_V(y5VWSJPYE3*m?=T)|fZ|1vr;k9jU5m54o48Yy*
zXbSVdO4AawxECBs|H}y_BY!jEen1uj=TZ5Z|F1%WqbGoe9C7dH4vi4_r=JMJ4=4a7
zyKw!FXMpNnQ2+_HXAc+;pJ2eE70UrQ-+pbin6Ask6CaNxtQ`32t-Vo0gx=&B`pOf-
z>-Ya=HRoiO#MhmCf2QY8`z0^+->U(56A=rCfPw>*VWGX?@v}AiuW}-UAad)O&h4mN
z`Vn2dLP1!9Sl+y~L7}B)LaT-0=D-*^Ojdbje8MPp0OcI|8v1}|4|cSmS+B5x^Tm#v
z7CuNWf|z8<w2t}w$yN^xiP;UW513=MU~Q1)P619-?<qJW2+wGpZFuZz)NQ#L=ze73
zm?K)S`buOyrbpsfbEZ~d^}fULv)DC=<i%y$z`_A;)f~|k_kPEQUjO`65f<ifH75iM
zj`{lOxj3PR@(mUd?4fwzj@H$v)14kF$Z-fUFZjU2BXKMk0l%VQZP3C_K{51jad>#l
z8pA;xq5(TNeS0=wgu3am9jm*56&{+k4l{t!x}k-m9X(n<2m(X>_dfktb9tftXqp%r
zc^Y5sy}uSXX6E9E?sJ6=EICu7MA$I&=rFbmr$2Qz!H`g0P_S8p2gAjYOxwItv8#Wa
z7AOIa9~fg3OWMO{JNfRM4T|g(<VE+X!|~p745tccJ?NQz;Rr`Jy6+9R&CiFeT(t<(
ycLFL49;<0cI$@-R8txZ6eqJ+BLyr;`&OeOnQ*(md9DeCA0D-5gpUXO@geCx)*_=NB

literal 0
HcmV?d00001

diff --git a/static/nic/ic-high-level.png b/static/nic/ic-high-level.png
new file mode 100644
index 0000000000000000000000000000000000000000..817b2655d18c28e2577cbb14aa733b3348e5a201
GIT binary patch
literal 99912
zcmeFZbzD_l*DkzO6vP_^3q>gf5fG4;#sJ)OmxPLdba$#KN($1kLAsHW1_cR8X=#w|
z?mA<!@p<0&Ip=(TeBbvwe;w}IpX{~QnrqH6M_l6?WBNf_QiK4X1RsS$5uhJGl0~6T
zN~2IGBJoba6|LXsEASVN?tO{-C{&j3ncZh6;WLHSV_69l%KjD#<?4n)ZNnwkNfgTJ
zE($gM6oujrL7|9EBZ_2r;fqtx#Y7&V4v_z%OA|lAmD8q=RV+}bE8)nWV`!^40dNu5
z5-lNwJ9Y|}==kl|>GSz8A`1QJzPxSEY`>kY{Mg>cQuB+7^R=Rnp5Jw)tnzTZ@-->?
z(s$Q0uU|*UR}my%tHRG?P<B!Lr6}l>)cVKclEFos`}c2nXlK1c5p@T!J=4V#3;Bq8
z`1IDwE^`CrLl(-9A6Z%L$}>FcLs@mVFrPl*MfFYWtM(b^KY{5WKd$%{4UE`dQK;jW
zj?o?czIopjkrwjfOc;F}`<p8{P7?Mv)DZ6fz4iZ~1l+>a4+Y;I^xEI3$NJ?P>mE*n
zy#eh@{3b+Jp{kF*wl*`(e-7A8?Z}l$>!v>8T<AOgQ+>BozU2P=8!@_!UvcSoB>dxb
zx_+MTRS!C4rW5?nrh?-a<+l!Jf0lJIKA9iDj}oa8p{3)OWne5;CZ<-86P6$eRcCqn
zrJ&z9zgq}-`?oFbVcv|uUjCLYyPPJw-r9F&MPnX*(;rPs)1E2jNS*xHJND6`xqNJ3
zt+UXiFFN#2uy@c{O!$keyBhf878px?gC>r#jO{@#linos!@LEnw~Sle)c9vcj_HSZ
zqAtNJ1f|Ub3v=%XjFh}?W3_wJo_gMdZ6{Y+s<2<O(5BSJ`TJC;<jLe`jctwm4DE8-
z+S+wbB3(4#YRP^5`uZnfPO3>Yc+$sUBplM6ET`=W8>#8q(+*&3ZPc7EO%u($goPr_
z$p=%j*Uq77&UH*XGZ3!@#`i~E_4eSlO4|%6+uJOs<Fk%Y+z9_Yf8MHWi%vMU;v!b<
zU)P=8xmD`NzW#bnAp2Q_@J2+_Zc@^P`9I|HUxzt~=TQV<w6oJH4Za@SX0_Ij4<bKV
zeP17hm8!d#FpY}{Mc(|13o|2RW3;rTLyJiMW;Ys(<yKXFu|9R<hx+28yuT!wZ1+ax
z7{5w!Y~CwY^+~uS>KplM*(FnYDoZv;ig@jxL#1<#mL?uf?((}}U0S*=1tM$UH*!nj
zJ}p&>j8IK8YR%J#Tq(knDun^0J4*}$0|P^ydXhwrq{FKeDt6EmDxX->r<5&W(J95T
z(@yld&p5Hpd0VcZY*o3euh4}VxmH(KmuoE}8A+BC_vO({+3xpQIT5}Ghu(o=NP9t5
zd4?c1MGJH>o4i+ded^|qf-~bC_LWKcq#Hx$3w;;ZcUFm>TO0mXLGG&zDpsoT@C|j^
zPNF%QN$!QFk!{Bn0db!F9j@k3r_+QF`WW5&o@jE+ZE6enu<o3vaJwhPou}8W)8<pY
zos*}ddA$7sc1Mo)^zdnh+3z}0_sUCWH_q0(5)Ka>6c(PmULU;k64M=gjPiNccz*&}
zIn2EZ*R!$gpCsJB@9ikQ9IpPFgLt=V_B`Q@zLP7BjQ8g&v~_}A39~Fl7<0s=@AJ2%
z4OQF}M8W~#7oVWZdYUM&eYHG`&)w7%I0aHY@mgCt!IU=N)pEoH@ow`erubK!&#C|A
zL%`F(cx(-Y-78nC#ouH(VjrpGNR%mYxU9p}U%8(qNF%iOxlGDljDu#0e|2e^{J1>4
z1a&O6HfwP9{6Fhjyth2U%z`h6s8>v>`YgbGI9wthD&Z?ceCo#^T>m@x52AaG_t(i-
z@>TF(52D?-e0dy5b1Vd6b*_t?pb_NDjgsjo_;R%7w7&jpjf~$H*NK^6jMsg`rPmtZ
z<49Lub5dyk)+^>J4=RT3r+%=!A4LD@^^YsYeo4>?ern2-4l<&c$bA&5{(9Ig=M~&t
z`<5Lq;_**~ah75nw}Nkly@&}8{o`F3148wemzR$j6>~PWzKUlqDHhR9{n+2b!-uZu
z<OZvLb<f?qH{xSrZm73zgX{#~pYbXtMMOc@LXno`;n84HlEdH<teXFrx%eNPLKZPM
zcr;A?-Pf@Nr56_Sy6xi1wjmyHALGN`<&};<t(SFzUlEF6_4BC^`-hINyXrc@pVf=k
z=~B>X-P#nj>|XET;@;s!{EoXfI%io3N5dX*w0zxlgx$+fFK(yG{s4C#$pBB8_QPDB
zQFvh_X5-RzdA%ugJk?ju9dn9WA)4H-uSU4y>CZI3KMM@vz7+Xw&npaFa!023s}XD7
zJExN;=@=Lk{%C*D(LC#R?`V(dKX=EQ7pkeQ^`A@V_@c9REB12qt*{>&bit|OsbxD+
zdhBT`r5#BplRoG)hDUC1?M5D6=}9_S@bT|Pni>>1_uJ%J&(Zxd6VZz#cWHZfF!h_+
zUHF`%<Z!2H4ioNcwGehSfnsOmo_4dE58ML#2?WKKv&zZbt1gnyV8<y93KX1hH#%U!
zmVLuXD<dX7U+&lVkhVqR;{GHtW``C2mB7or;(mtw-gG8brB1!~MVUj<&buwFs+lIi
z_jNQ+xxH6RwyB>BDr->FOr)GHdtJG`B+_hoC0L_s&#R|pFJV5>nP2zt!DvB&{moda
z<az@2hW~1ejB^=nd2>5SxvO#eJA(@|qai{<)T&vI>3~&?XUu#VrKVr5YYV=AiE)fn
z&7FyDl}&{E`nb7tWLjj>mG@)&jFT0n`8*^>orULKb|pvl*cfHDw#x2plpmyj(z<-<
zl3vyFn0ax(=**{txUXoKb^D3S`Mq--#dwIeCDqNJ=<RUm)Ao<s^n7kLm#36!_9*s@
zd79Hn+&sD&+`u4A0F|~xZ>CO5V`CW(9;FC={>;im$%aK-M(Ni`5)rl%ikcoJQ{~j`
z{Y01?mEKU?p8j=Y{T5Fbj(L;vD*9h^X%Q+~?=k4OcjM3N>js+lUny#9C+D`WuvH8S
z92Ccl#K6c&xM>F)F7Uq&F=9g~g%8FgslRJIa~=1H&9C!hkoIoe=HO8E^OMkDyBE%}
zD`n7S9Mm@DPsPW&yC7QpM>t1{oHF6rCuMd+d%tz#{Rci;G`U(k$EvD16kfa-QRQm_
zEdZTR<cfr~wtsg~^0WqBP?v}eqhq-xJCoB{Z#ElZZ8(_m`?s=?uyE(J8HdsD=sbh2
zx~bJ&mZzJaDm%)=9N;Z$I9L}HZK_~yqjE7pL10gWQ7P1VzAx4PPi)a-%)PgqNh%K`
zVq(rS95n0C4U{%3bJ!1Akl5AV%aOW9NmpiNgMQW%HBlOME+y{wXHP~CS=%>Z>_2Gf
zxKqXswq%NJ$XSA{CJ!PqCM);6&cqt+e9czAvpuyFHELd%YcU}ic#(J}#*-1AI>p{&
zBO~J%bTA>%Q|gePW%%pO8_O9c6ZV~48Q(=b0T85X^spt@+OPKg?S=77FYU{oLTL2q
zqFs*{Rn@|gZTst&uD2&h*wOJSkLK+5tUIx-Y=|}RtGgAj1k2U$w`lH|*AF(!%F327
zmfw)c%93c-bJ@W^YtWXUPRDEeL)XsJ+R1Wcq_4T)i<)F`0x!Ezc$XnZkexF>&D1h|
zhP0vKEZ3X~Y&nNfPh7<tT&JM?g&qy5gYv{ie)V?NBY@Ggqgk3Tq01-p%q~`#pgpEa
zsEDeCwMHwo^Fy^R7z7=^S`5gxC%;@;X#ISlS_b}(t<L7)S}MP9xRXbch<R{%LIhV}
zfAg?@%MIaRs%o^qYF=6GW?Ir@lE*n7dD+=tWqa-lF9dD{r>0f#%i<oW&t*(F3-_zA
z=zh>CWl61A7WO7d7V^9d?_IGdRG8^R-YZ1M@2E^&Rn?R4QtmOkF6zR6&c(c7`|P~I
zI&BQu4QzZ2=p1)WrO_Zyd*gmaU)zPaifXbyOLKaeiaQ{7p7i&2dYO~M7oXtvroFy<
zboa|`XT_>+nG3|uk7YD>7>sDP4L@`@&~{;Ne9kuCVJ4~{{$f4(Gv;XQ+z7_Rvf6!R
zCLLa@f&0@!%%`_Uz9df%?is&*V!#nhCw)PiG11!jAgi;{VY=i^d$r8zY2KG9s_IVp
z6$MexZUnc*&&GFeFD{T{Y(A2--4Wj4HS;anm}fMwZ5%&!O8+$$eEza1irA)f2`p3I
z%et)X;@Ek2EhYq~zje=eZNWM}L%;XU(8Xi%4P)}dJ_<ddD_Pb~2TLlI$lFAVwvF>d
zOP?&II}k?Ph%Sg=95ZQBTJP$v(+G3wyvv@T;svkEnCG-o>RmTFElEU(b>wal{kUJn
z{Fe>G70lBf`(Ny!QiNDTjSl88(X##^m`6(6$B3q5{GE2e=LTA~^1ZSUjqUtI?Iwp#
zFrIwxt5RGl^j9MeQXX@0e<Ws|XIg3S?%DMpN4^%s#=xP%IyE|eXXzc^*<WT8E#NUn
z788o@W#`3Q)1)%Eax+@m0brlJy&(5j31cO6<n^}a-u_`~x7hU=J>L?gB=G^t=5`(}
z5Isxkm$UjJ@;YmY%n2cOPx+DBYWy>20G~yZ4JAUBjB<4a5GE0RW<Paq-MfxSO;?}6
zXoM$KLJc=hszC9yOmL`^9-&*G$jT_A+AW)<bFIT2RxZ2CCeMq0o_7kov&323%2qWi
z_J%?pGLw^AJC*>VacwSzsn!djm-K^vi=Q@na(g@GWeyX;gNrw@DBlY~k7frps$Z?X
zt_K>j7DtHYy)P2yq&nAfiC8oC-LQ8fBkr+=IrCblmxX=BgTX#y;p&oOVYz{0t(reu
zXYEzeh;)?RpvHNp+RM^+0`hfIMe%2JMpp|xJbYzEyI$lyHvYVL%IoT*IZCXa6Mmg-
z?(8GTguJ4-J6>MwMdiKzZZj{&@&fosfhs(=r=)H7DejYd17o~B37ed9ovlikx`8z{
zp5V^cg|6+)&eYZ4r*p)TgCN67k&BYlZyA4{BX<8i#o_o*Q)1(VwkO@oL-#}WxAd<K
zsyxiJSCzO{6{e1V+;t~TUHb`!eT;cem8ebPS+D?&*qeJf^!HH+_*`J^I((?;Hm!zI
zqK#tgE$;@#llOfNmD^Ph!LL1aB5!oslLh<;M%aobEFZMnH#xOtWG}emHYdrsz-)ha
z<lxE76t-%`tL`scy3ab@9tG2!-ga;xiir_^selkB-!6VWj}dK!>_g(oRuT*ws*W#y
zo@F?hDv~!2#;SK>*(~QYbACY0yB1OZL2g1;-<lThIo8Kb_nn?t`Usgy3FY+Z2{TwY
zsYUVi&lfQEb`Rx)D`!QeYa(bODY2g?(1{?^$5<$uWU<0=N-8JG!fez{eTAb;-}-8j
z)_e)^LwepdZo66w<0Pd{mr}~O3c1Wyh<W=n1b_r7gbuABTJlnWVcT|TeFNjjYn5`F
zP<+v^q3Wlm-$RzrhZ`KCUj3G*{EgTsf0!<edJ|Fw?fQNL>#M|G3^th_=O9ry^_mbH
z?zr<NYd9MiUs*g#r|sovoIQU}q&=*W-kGf!r-|s;2dpQF<Wg0Q+pVzD2{!vaMw}7*
zS)Ol*UoZG<CP%T?nT17t648zm@in4Wrb?f?wbe{P%Uh-KC%ldxR?+;@2jeQWlWcs?
zL|!G7p0&qhN#38?JmJxUWoDwAW^+wA;GLK95(~)K<C3K&RHeE%I-_K&*QV5Dc(DGZ
zJv9BTK#2PB2@ll~{*unaLBqBeH=Uh$mD<l@@u<~!?S~sVVnb>&4w7Un#m8a9akmk-
zZfesEJZ0>rnZAlJCF3l{iS8^=Kbs?l()V78YlE!m5%w)Z$GPnPeCeh}<xRZs>%N4_
zdnc20j~M$X=*$0tD<ZBPcv#%Xcr1y%X11>xkJNp=?FvB$7PZ3@e>o>SWgeT~xqvpi
zwI>T=<>3RQ63-E3;<35jUUq!tnkT7E#IGh&Tm^Z{_E}lNAJ+4~KLhFpY(H|=9r*y6
z1?U*w-y}{^JH0EcBOJ1Yoeg4rg-&~;Ewfb6vG?h9b!}lC<Aca`0|iCQ*WH(_#TRk1
z6jW4HbL{iFwO=0W@2Lg`#xn@)zl0e)`+ry-#Z!jJ5(y^$O&^#yL=fcDl==b-GF~sH
zKVg0&%te6HNA#CbvvFIz5&;MD1+7KG<YxiC7uHujj4#K+r=%ICBCxCnSFn2LYNfZr
zq2K>U7uE)D%@RHp-M;l5S@eyO-rFgKTN@V2Z-hO(Ok%5B7!box+oEplxbbt>A?beQ
zDSc<OMHQPTbMZyDyV!jPF)zM3)Hp=qyIA*w{3?LmRru}Ox&K$U-t3z_WDMKMa|Bc!
zC1<3jnS?k!1SaP6dyV+!{ixL27g<U-=iT&8HXe7mgs5^drgf8RN49NOW_;=+2#;E^
z&PxX{uTMD@vS!Y(H^kI2F#lCIJREzYlcnU$AjkG)cKx2oi2PI|J*QSGwD)t8>3*fb
z<aKMlcb2Sq#yG^n|CztSdWPJq=Bz>Qkl6|DEq2=+@F%XBl#gqW((|QcT8xLQ+B|nO
zu+p=Mv?l+Zv9PlLWNyw_wDh3_2|Ih9wc5Sju87{fzJ!@l^B}U0d4lnQW{L1T#g)++
z%Q(~Gv&O0WdyaZFJQthxu4k9+EEij-9)yKw$|T3ibJ3fNr}OYrYRqxxwL#bp$fwNg
z>5X3(Rfv5roY3hrgf(gks^5kjXxZn_p9?Nr01k`zC}Vs!Ru{-^KKlOr`Sb0C784c&
zWd>at{&DOEo$aa;#LuIWTsqUAB))!q+-kc0r^%HC(|fsw-7IL?a_7AU#;c2-J6G3a
z3c3**1LfLp+!eyC<+Y)rqJn>p^B{`;0*xg2E;rZi99?==Ryp{%dhMRjqem|*+)n%B
zMG*cjh>{_1d4$lxu2bU;p*PW@XtdwxY3UR9Vf@V+0M}~~Tjj0D@Y0!Fk&-tBowmk;
z*`Izxl|r^N4dVv(+CJ>0&n%HOGc&u?xx}wyUrE6E*#E0xcMMEAJ}xdvBAf&N+_~Vk
zsrG8`YYNiR(PVt~^1qw^RC!WIlHFHujv^po`?WsT8yFmHGthPx)$uH+JJ)&79xeOg
zMO=~PRLuML@9}52uAd#@4<5D14A#``&eoo8PyWPMw)uQ+uv~MdD|3SQWD+ZQ8)2;J
ziszY)2w%E<S^xK!XQJZb@*DI0fsv66;f;#JOVWvL$u@&dN*3b{GS8lU&T?!|lDV{A
zY`>=87{dH8vuryB<FaoTwbs_w#%?{UOmK}OtzsGd>DJYSW=EX0)XXwjVPWC;9WP(s
zu9?hoW3QN#`gOymFaP}bP}k6qw%GmS!v&`YF;+93Q&Wji>xDGbQj@E`F1wYRW61uv
zoxZ?k+;^`roKwoq4wEs4BU$jPAd0BL){Pw5gyaF+5dw7Uw^t{q(HjE}nN)hi6>l$f
z?u~wuV$-Vr2aRztWm3t06f5k_5)>F55I}_{Vb$>}vYt!v^7^NAt@DY8udkAhPQv#3
zT<TY&Uj6T{Px99rafA=5@>otjon>WYlr$+_3%Yzq`6*6Tl=F6Sckl(u7jr#%Fn4)-
z`=X#bDlutkceG!;xXsV6ap9Ku-FXG~%Fpg(_K)AbeM`cw9{`U=Q;P-N=HpYhv$L}w
z^%J3+byyz#=^yv3@*Q&*(=^To>+7pn2p3XqoKMfg^JHmhsk*i?H<u0F>UEXX@?dXc
zhc{!ZiD%)lfAiyJznda-w6s63FxV#q1YC@giFevrXWwt(ciOf@>?MZGcIcP{hF1l)
zd87AA6+KMs>eZ{&JGkVI((sFF_KOeIKBNZg+CuL)|9CP{q4#z+IEDK_^={w1`7oTr
zh$W~oj9tv1hL?oPJT7Z54*kh%AqzH0Aw=iTIhV~7a#GPvrUExZn2#eowX0r<MHK(y
zw-eRbi;Jcse!I(!aS@V<OZRkPD980rA3qLlT;c4u{M78QaJ#k4X=nRR`R;N(HJV;A
z?VdruuJO#CyUVj@&jN2Mzp`L{QA>!%5H-^)WdyWM1&kIB+ON;*HC!un+Ob9_ikJm+
zf+?X{#{E`d<2cKRU5kKadRmQl$QUM=az|FjZUk#O7fLNoI_;J@vL?gYu0;it2hyR_
zpX9GQTwf?_vK$xq%2c-bN588{pk1c-`dN{;+L1gq9OF1-pc_=l4jc1Dpi6;4K{}4)
zX(~Cw{<=Rf0`BL?*X;%&_s1U;5i}Zh7ET(TM||f~kL6e~a{I~8qFq1h>r-<>+e7Jg
zYPbn+m)uO?H13<sFKq0|GoZE;ZVlvw9qOL5Mm$0orwJxIC&yclsmZXKRlogqdHLNW
z{QwSAM#RHlLEhaegUr%fKMw@_mC}?yH#CSds1-=x6!BTTN;z%G?Ie6HkUUaVZlGrA
zRnMQ&a#j|W-6p@C1($;-{<>8Cp@07TVY8f+CLraOw=V8~sX88sn+={4(OX&B^Zhku
z-^~PK`JbOXl$=$QP7W;-lN2ak(ZT*sN2X>uzDtS3XPt(SXE+H1E#d=Q%O&8VWDW9`
zZ29${_>%E?b$JpqWh@pp>d0AJf2ERoL;7<?>~)nVu>m+}{+a5ks;d^KT-G|2{3U(y
z(hT<pN=kTP3z|Yq&L`0VS1E$^Jkxy@Z_iMp-{78G=P^-#^vJEXt&KX;xzA;B=(~Sh
z4Vi;Dye6nor)_g-gxzlWMUK?ZZ+MCkw2X{RA<bssmPt4aLliUAk`V{eB0|niG7<-h
z%)lVwuZtNxdFJxVh7jiM$yi@6J-S)z;_=3C8Z@%I)aXk0bHP;FIy(Bhn@ic<hUVOn
zs`<u|?+C6XBt|)_Qd3hSY#tsmQ{IYmu+h<yfhJ^Q1dsNvvb=cD!piEcBRk-t+#JGO
zdF3-58VMD4Cbvvz^rCr9+9JTajE#+5T_}a+AYL&_^R{>-x55eBv+bilKhf{{Q}FTi
zhg`dN<HiHTzhIoV^<XNBA!5t@HiOi^MbiH`3p;6<755wGc*46;(k}O|pJjORRou_d
z?=XtYa7RjxWHl{Y41=Rb%oUABBR>B8g$v#y=+c>PLymOK@`261`ayFO^|4?jo2bC_
zGxFeI3_4O2go&3zLarbdPfZ=)x)v#!xV|u$xi-^fP~~xHda%4aqhz^G^aK^SGSGPa
zW(=Qy9HV*>5}NoagEsi39zT|zXo_qsyN+iLj2Y8^K}q9>sT(rq|IgUzzaTO^&SGRp
z6w1{4toy_IAcjv=Ym+SxA%^M%<H$eR+R10(>@$6H<Hn5!#tTUS|Asawl>A&H=U_Yd
zQ7SZqf!12Tn~jX8lQ_Z~6ONrYC0{5BUL4~v&-K=wb>Q5qw^$J9ikh(Gwwg)LCs{ai
z<_y$}gnqe2%kT@Te|h?<Sr;5@7ew%wii!uN+taDAABo*#$N57}Anp+A*!f4n6jYdm
z*Y*n)Ej@kxY_{u)e@MvWN}^`Dv;Fc<8ftWA>3UfA*s)7THD$sfY%KHU9C(S7gd>4R
zefsoi|2Un-FhIW2#}1J%R7D#86(Rt7$f&7B6xl3ffNjBs=hUCjZx}YcQchI>8V<>R
zlIu^X@52w?Q;6PvRD6eC+F_wosk^&dwZN3JF^<r(+LwG`g&)uk7=PG3vzXS_)&|CN
zNv?k-F=ol_jmmSxwJ@ngLTbOu!5-VE2hu+wcz;Rz@<qDXdQKLN{s8`_fsttOyOi?b
z8;{E?Dh2^366o)Lqqv_D6xp$})WJquSC^ii-ZNtikItYoZOIOSXHUN$N5U1%umya<
zRy^uBzRk_UL5|h+-lk(>YSzV>4xJ&4z7c{zvB_VbRm+`A!2%J`Vm05_J)4a>@mD;x
z|8iuAkm=PY0+lqF!_d^XZiT6{NZ*X)wvvT#U$#9>e_S5t;t`}j{_C$3QUn-Br#`Vb
zTp7k|#{%Lxf9Nr$+Y)`d<5B!~jPrYqtceaMH^i3MrpM-igww$UZqUk7`!)a3P^Lh;
zn?y;59O29aRj*H;@fzFNSm+93c*15fz^nCx-6HzNFH_FLlz{MQc6K(E9f^=ahaWFE
zf~lz~@Xm3e7hk_C-*R*ZM+7?+ym;}LI}x_k04D^TTyk`@AgqFWrZ0gbTmn>4>A{2J
zE5bLPf*$|}0oY42k{j(0+i{VI=$Un>VEn(0)Aw%9nZvn*mI`9o0Ms|GO~73U;(Ev!
zTt6%8N&>#Mv#-#C-G24uylympLml!AMV$8)<_G?(0}cyFA|_~ToUy;ZQ9c9agy`X5
znG;ymJzd<h*MCKDS$OGa`v*itWm?bmgsPJe9+hfPN$>jl)Fi^#(Ejb8AL6RJ?5%<I
zMtp*cdo!8`tx$aN(gr_9a`&lg&sQS@YdgVjSk@CYbf?ZeajrMNYr%PgM<rb`r~Y_T
z-IzHofTc6UjA?`s``caRI_<R51V_23{BXmf<?Qb)w?sVK`1p9$GRH#xomo~=e#hU+
zn4qA9?{9EZ?N$(S5QpGM3w9}Zg}%@-Fmw=WI(~-lw(gL#z5HmuF`qs;`7%cg=k?hm
zB@2Wb?<S`)%ZrP98JF)_BMZ@QPl8h6@%z}?J<64p5OYI$bbMTYpv11H#4ac64lOM@
zf51K!%(cnsO#AVpm)2483PoEKs`V6@#p*O;B(!cvpFMI2ruf6O$5r(7lFiM{SBKrn
zTd&|JJv>_8`^Af|Qd6p>yVPw+ztft&I;v1k^Hs><+;H*!jLdp}Z>J3&xru$m)!rMP
zxy8w;r0KF}^>%0#oZe^Vi%*XxB3LS9>mfL7UWja)3v375yW_{P6?Rm##tmK}3e!Th
zx~8U#T;_J8{QiWvI4TgyG#_>uf~5~_@pD?P;Ny|~ecRi`i#pt<L#~LOzW8}QYV6G^
zf*9tDgwaRpxOQrow&8)+Z3^4Jb3a)j7edL&*=3@Y1W?@k-0}NIK8SD`Pf8{@MgJeG
zHVMvT^<rz-wV~@rQhGo#Ogrt7&)nV`FXr^R4e%u$A75m(wBW}h)p5I1A=myEBJX6c
zNqI+!-HKxnhz0LRQCvShvh_G))Rm#Wy}Qz^_s_|{rAfhBO5UosqnXU@A1NOq>N?L(
z@#F71VP_a|K+HY)CYkr&oI)0UM1r_}yl?B#qo}HyGFBfvlhe$<a$2&jwUy0w@hQo}
zzjbgF1r;GChT{@3vB6YpJV+YLPowah-4c@+j%<j|=%2u_Fi}(d_M=UAjTVNX1+{LY
z_K)WA`tmTXensyUeI)65-KKf4-35bDV2L*rVH}>6S=q~fP7bO4z5nbmZIcLS6rf*E
z(Q6Oa=KG(tw6uUYDNskd@EVrZ6j)v@oj>SYoKe1S53^1>k5zn%mxP!<YX3W>E<F*g
zdbGFqUoBqj0A0!j2i=I_3$K<&>7P6rV~7az$52#EEb!B(*mDBAACd2ldaWp;i7+vA
z3heKS=8I<VB#*UY=^hltQzA?S`G3=D!E`JIjl!X-kdyzPv>MvPu;Gi)6jTROKPKz!
zT(-ZK=>j_?7>OmoP&gMW<ZKJo7$GJp^<0_$+G{K)E9(zN{I@Rxb?nXJ#q-{uQ8<^6
z)Lf8)x9Zgi+<?%~WXS0@5eGpC--o=zzU?V@MccMFtmybv>}tQsyCtqEfv+5_mNx4B
zI>wJ8JgRn}5-54oUH-dHqxg^Hmq5Xru36&!Ifzkx`a%Sx`brQRU}p)x9Nl2$vzWVo
z53H+fZ~Y16#?881$TZI!O*8TaZ#p^n-uPyLg9w<;YqG=XNWb;v-+qjsm)}`hpnSU4
zT!O#o$uZSGeoXp_kWoH9!@N)Okl-rIBT{b5p&0^-Nvz%|C}ZR8+HWmi^<SutVbfXw
zA<WDzvvQ{xLs%=@K3t%o<L2&}&6Ym1%l=M(u&neH0m&m!)cf9tg26*&mhTs_u(0In
zG?L_q9b?3+X!|Aqzp)X#(}ylZ5S1ipI&FIIFp4FA<GRU9z*kjOrCMZ33rlT3^Gt^r
z31uNwQ<l@QzWl9_9|U4B8LO+7kY!}l8C_=5NP~c)zx1c-68|*;=MqTz>B1Xz?&NeE
zR+}$GEsfOB1GLyIfuyL~VPQhUx>#K<L0kqrK}V_*lhs_00!S+<%UQby!=mj0d4Zyy
zx1c&q<Iq3__Lt7_E&aG4Y)f+CLhRt~IH&!HHz%9vkYI%ziV_>KlY$`+7WO4epPe<V
zs;Nme87xE40-60JC9ovoTGd`MwziG?MYE>&*pRfg^~<wL#M2n{6|~sOAGApcC;+~L
zDrEdsR-MQGw<IHy+}v=`m_<vVY3T0Ukrx&9071WK_{nYf`!2#kP*V%}w<pWdKrS)8
z)}@Is8&tF`EUmNkUiLnVY?i-3{hfqefxmLKpXyN3RDjeC8GmP?TyuDM7~w{YOV<=(
zs3fT<{%Jq~-ac6feb$;J6U$~k`uLDX3xN39rQsj}FkBAsk|lzZkLkm2UUL%-p|Jpq
ztriB<+Y%(?Y;6nPoh417eE4n>IFVK$a{~PQD1Tm%L?b9{z<!3o3gBGzvAfb2+!DVx
z|EDLDHd*9Ex-i?t#DeblQ4x^w{>CGztgKwyp2-yRSN&?JGNNTG;@=d?Dgp_lA_$8r
zS+^MjfP6wFf8$+>T%zRK>4!Wv^J$x#wvdng1aJsyyLkt)p6c&R(sJ-p#9W84QG3m&
za#$KDE~=}a6M{GVHhX>*TIeE45@g1e?+D}o<Nzs<kei#E<8#*P-u3DkP<+Lm5QuCk
zo?>{LLbfC&V9_1LHYR00sA+~nYi#EM#qw`2b=WxLoQCjdIXaE40Fgit&v?x>_p|m>
z^aEZr=&6PRRk7nGxW-?1F67lB+da~Irh*9P1~@wF&aGR*e;snzgJVe>hkihM!B!+v
zM_0FN+IeMVh5nA``}e;9kFmo(A?crT)`L$pQk{_bw5LDeEcfjVCchdU7+B?)fM*K}
zrvWIiGTzt*0M{EqT}8l#bpS*MhyRUsm*F3f`<f&q<bOs+6qJ>37x&L!fIPcU)?s~C
zCR3x-QP|qvj;A+MIjbUZ_!9_DLqp^38tGYg$ib-4A3l5_;kHbo(gUXJ&@h1dC}+1f
z0@t9Jcp0UCZCGy+0L8yi4=O3)2%I+Dg;<Ghg<x&ezzIah8pLG-7{)n&rZwJ^N)M7<
z$knT@L5?Y3j3IloUz?^5Zye9*+X>kNoo4vSd51w@V+u5u$}Zv9?Q&?Fp$GO2vF7ez
zA_`uD^8g69=ZhCsfhC+C3)bYQXalZIB9ui4vUn=qlPG~JuMSN_Z*y^&f5rbS7%M0s
z!hS+JPfzMZXIIfQ-(QSSb$WVw)z<!A?_@L<%62kN{c|N6vdSyZradmvdvQqsX~g(*
zrC=Yio}=7JzxQkUEs3xf?I93EfYk9OVHbtlIHq@d2lsW>wIA_`*ph5QfLyC0)|7|1
zR5X(z2m92>NQ63$_2bj=@89ErjZV(x4|e)fi-9VAhUv_N>SAP6RaFCfAp=l2bNS9M
zo`n)Ew@ic=)d0*Fg<@xBmH`HEd$mmp!DQei=ztsq)oud<)kzq0mYiR$7a)!F2;@U+
z)2W&IKmDo0n6=)44s_(3Xs%7Q)hz5L3#x+<4Ixw@_yM#wk@+Gj;)G}KoOQT54ycVZ
z`MpTVu=}A;f4nF1kAv4Y&&obHHLN$3g2l}9g%f0mmf8I=F@f6!NdW`jh9P+wgT=PC
zwgAcR3qkNGKy6;T4&S2yS4f@kgdh&yihp<U;lDt9uW_*iXfEIv6y+;y2sTx8OMLYP
zY+5@1C{`-m;3fD6FqJfT9H49e<T(C{z7N6F^~`(hBSX+Xx@B%*u?8L!lGA!+VR(5G
z&k>LnCBlSF7y{J$Y9wZgkFs*ZJ|ul?IGO7|!uQ%yg76J@Sg(JD;~m7RWGPd?h??<<
ziGVp#;*Sv5i$dKc#B`?rCn7~1Kk6eF^p{stOG6y&`QfRzUk$n#o%XjTkQq}P;Y4XO
zv#eX<A<;l#UBGAv78VvBe)|wR`r37PY%G&merJ7-{pBwT5VfFd&cAz?iB;io#dOtp
zU=5-~bfC3L+6I#T0Du1&s5Ia-GR+)Hj&QkbXP#$oCF+2!7;y#xE8&B?!d+?>-rd>}
zSj6_A2k6mU(4?GtxIvH_VbO;x-NV&|1F>WXB?MRXOBHQM0B99sQZO`3>mK{;!@Dz^
z;~zJHacG*AJzm`sE5Z)$ft1Vq5wKhKt1TiOxq5Or_4umbx!WhATrz;*zFM!E`|>kz
z+z`T0b+mMJt)TJj4(o<m-CzNhP(!&5ocQeW?jh<Id<;#6kilm!@zc?Xx@@;aUA%Nj
z+gk4~+R?G3n;OT>-~T*f?;<|ehj(I5sWApaj)g1){H7Mrvzi%Cj0=STv9T9FLgC#5
zW&|-?Svk42iZe_}adD6Q*?@~IU9O`)wsVH&(9gTYJ#;_2Wm)XJyHs=fgY-gRK){uQ
zr_{WB0^n_+akv%gH{LFrVzR-E>PWPIZ4c>iQqpa{{ml{kr7B`-G<bo|&kx<(OYAIi
z#8NLFLbeC88XA}-Zde55_H4ye2%uyKm>P45Uh!p1j1YglN#WS#wdoE|gVU&qB<=bj
z=>KGKz6!M=Yy~+a{xDxcg?KEk?jjW)sBowjTc>B;fid^C*W^@H!=Oy@!ukV>Fc*kw
z-Cf7V=H@Q;E;TJ{bRaf`awQbDwRc`#S;>3Za>J-QyGl7IBqRyRwAk6%pH57jaDCbe
zu;r#8g8+kQG!~e<5(?Sc8-rk-x2I?tqXY&MndPB20cb!Jv93g{aZ=zAVH7nXA?eK2
z%!Fzlq`0WRRF~V8ineJa9q-a~fwUMU7<lxI8zBZ02^k9TEv*uq{Rqx<Ju1%P5xFHQ
zq=J``mk*dPS&;<QM`1Mr<w_`MtI8Ez9}g_T3;;&RMW^|I-vk><H5;k+@b+dez784A
zVX0K`<4xZ5THqIGXcAkir8x&3a{z7VK^s!!&gO_OyT!OTU{SsG*>10*Qz=LJ*6S<7
z$(bqO6@i!pjRCI|QZZ(JbvPNySP*18vb02iws?K~aAQ$8v=wb_K#=8GPRYXFHXvRH
z=M9tqqeP}T4Sz=`NQBdIaTQh+4TvmK(^66nNBFD&k@?u)`Cw;o2I!htou-K7WVysJ
zr)@!LY{lA@;*ssNA0+UQdm2EIs+xu5A!SIPMKj-Ye{sIB&-LV=pJ?c5Xhi%2A|le@
zS(5M5kPx#O_2lCBHivU&s;-1OZw|YAczVj^8~0mIMB3=j_Z8C7(LHCBk0$whJjT>`
z+QD`jOBE1n*xt`9S@s~p+`4sZ`X^0PJJj<!0B-;h;T<m)jIirP5E^qqb-c;=RG;J<
zvkQB3Uq1^}vP5!nGFY`=+1B{A(!KRwcx{`U6rWY+o=Ja^0^Hd_YSTxV+L7|aq*TG5
z&1K&)M~V~=-|LWJcBPPws%!&sAF?lCoshUq7{S}BwRS+S+j8~Va?Qs?p;r1B46xcB
z5O=`n)z8~dMUywM_jr4TSkxb)xwp}$PoLOfXaaKn2u%)@?osvmMVdzGb_D-SXL@)y
zb=0SA5{&(|hXAQ6XzrB`zq{5B7!PDim22GJV@pazM2W5*+0DwzLgWltTZ%imv+_ot
zg)bx>s_8Wg0E@<(B2!04Uqso-nH0})!0MrXAjpnYH@vF|zHQV=UClwF<%APdy}zAI
zf_XcOeCnuK%mtb?RWZFaM#$4KXwbZ#f$iOcTCU#Pzi2SF57JfhT6ecr*!7_FkMWE9
zbW0*7`*S;>MS~J&h#THr(6s3Ph?O>)1ZzKTUNafRk~zA~8S6!_bf9JcFh9o_yhzm8
z8Ut^Cj;?Rn?y?wI&e)IYYJCXdB+Sp<@bU54z}YrN@+bkO%wR$7EmoeRMuXxce<?30
zxHmRB`b!-D-cbTdc@ugBdXDMq>!);&ZPzw82RG`l3jeZy*uH%cGd?ka*x&M1p$PCI
z;P6sF7&wVZHo#di{A5+Ngpg4kyAI^H{htpsAmAdp6Te{hUcz1!tu*nh{kR|{zr8it
z5{qmbu#y$CZ6}XkKC~*=k3^R)#sB#6sN8qS0XW}NYIs{v6uO#O>YKJP-9bNEDF-wH
zWBIOm|DhC*Q|$p3+8!Z4NZOe%mI8R55Aao9TAHG`KLd8FJXS<tZ&eQ6nw~$PIyC{V
zLrG2TdSjex4%XlZWw~wU9XnBZ786Z6!Bdqy+qossF**hL)Vc1(c1^7$sG7X|=6Vd`
za~)bttS!=JAQ{e|=|k@Te-uQZ_*SFqXWbEvfwxi9&?pu8bm${${~7LT6~|A)dJET&
z<{b)33NN|kySZP*?M}8Wug~|ViZK>GiWTuaJGsavAfQ<v%+$5FG3e51B_=AG`@9Mt
zwlL9l;&!^B-AJ{!_l6Yjk{gnGLLQ_CnT)8Uq#{T(^*X!#I6s}mM!yY!<h`_+V{2IM
z!u4Zowze4P&X$+{9j3nlNW5~oBQ^CpbFs~W23SMP1Fd91Btg^~=uQ##xr~i3fgJBZ
ztuB10olbXibJJ(?eg9q>dg)WyW!Zq{CL$ur`${Gqg(aNuxWJ7s^Wf(xWoqaI>q1Tt
z22o$7YXu_~{Wi(-GQ)CV6R3WQbS!v$n?5sl=lzu^)`=S^ilM&)DDYL2KlWXi7#-at
zrFBRUJR{Tmk5p;BanaPRx9;wUy94W5IxPw09_nwy!vml4n#~haOMBBk{0!i2tP+|p
zfJb8k90CC@zO@<Ib|4ab07(L+cL=N~s1(+(xKQwwxiH2`UAS<89m=b1BE}d7-oQ8r
z$5%3sLNR^xwWr5WrW{xR`9N0NcL}#{WT%7FiRAY8WGYA@r=iA^#KOBa4c-Na1q5#j
zK0eYY|0YK-fsbT^0=<)RCN|rk{-NqARLOujm`WBO<cTz7Xq2i#(BdpMMEzyeTt5O+
zm;%B7YUYXi3b9h9-}S)uzF8&;bS<`n0BD{be+oArwf5HH|3Kwsw<Ny05+N!JIZc9i
zsCg4~EP`=!4mIJTTvz`3z&yRSgw`${E{j#Y=u?S@jJ}eF-B?LJ6D{qti*yK$c^EG7
zR1{MckowzFkKq6ed_6*R;__iY@E2p0fv%LET)kLGdTvuv-uJ&qPHwWE44_l%NI<I5
zyhRH@76SYNYrgUHjoi;R)O6{_z$ba;>w$4#7-(5TL&I;F6DU+3HrC>y25KT9LZv`;
zGEDs}V>IG6@ot}pY}EM#|5Ir(s$_!Y-R9y_ff$28qGEZ9my0W8#3TYy2IPmn;%WBs
z&3)IWS%`;LFIEJH*!iC5X2{INq*KlVv5bo=h3jua504s3M<FDpi}=k+n3O{ppTpN~
zZPYREsExZPU^HB8@5ZNDC<9h#wZPUWfn6QaYj&=hko@yl&;A0O>;?P7(3aPwkqXtI
zFm*CQQ@TAnf!WJ>##SHxJh%Hnl2@Z4A4AHsp|4ndL+dJxjO|vv`>KAd6*>WQN_;<j
zXo2W@iImjHTJM_*yUBnW1bI0q#<M-Ez=5nt*?+aiAX5)oYuJL1*Cj8m@N>&vh;ou|
zk&$R*B%n;%5;D^dZWZM#vijvVkuYPrM1<aT%%CM3M$Y1iOUuj00WKcdD=-_ulOnQ=
ziH&84)|(M0sO}w}DmsIA`;zm3?-o0--vyIN2_&53UDXcG{9V{O!PD1ZFeI5;&z}bb
z1iY|Df3ri2ipoNbWT|Yolwim!YNN$Zv?%v&H}z-CWBB`d%uVl&T}OVGLp^Z)nNjcu
zA8DwJ+vO{Pc8{F;W5+u$1#9Y9pH9-P8?^Y>ohVn5DF|6h+rV|`1fM|Ni?>L$t~PMy
zj}pN0pRkz!|GN1exYm#P*N;87`^Y3RbVNF%@XR4ql}l)B4baPRe83fi+hvZEVEVVX
z_N|bfkt-!Zf`q=o4(L|L)J6g0Kq_qpdzCJ=Ze{;m{sT9T1LcNgL5=+=yP~fX1axOi
z5@Kt7=($spyYnwM9c6ha!WSN5KKd0FnW@^2p_q~>Tq}L5{+9SqD%v@JwZe0Doii6}
zmR&W;Rz67XFMiP2+NPVM{ip4RF8R$z1b4B<g+kre>6rHBR&$hh_lz$UBCyiSxlj~a
z58W!-c0){qPuiu!^SP+(%Dy@|Y!Lp<Kv9Apr#|&a&qwZbOvj8A<#wOWslQL4-ZSgA
zfA49cHJM==e=-5omv#R(O5)uBd1&J*O(vWb(g}X8x|-uQvaM2K#&s@3T3Mb3DcFfs
z&>m5?Kt4_{S(~_Qy@@mr3{@x44^I`hhYw*aMnRA;bdL@Ft;@PnWSLo%aU2vVgm18Q
zOsC7}1iw-Js%Il-G|(m=?$Vbs%MR_UxQW<PEs%kJEJ)GfAt>4t4(!&UXNdnXYc5^S
zoyVQRQ*=EbzKWqJL4+o!{yXizWb<NZuKc4x<3Bm|-%gr~1V6-|`Q1OuB7N3(5qu5u
z^Y3Hc_kWC;w+Pa?71mJ^YYw?$Pkq8!NGh0ef_QkmQrS!Ndy>~`+O71Ox$W&PcRtpS
zu@qmA`1g$*#!X%0<oWt5m;}{Q_Bv#49COAgjSgY@D?$Br8aY2_%}wzo;;?Ui{X>DY
zSMS#xXG#Od6FpjLWa*vB9WwnbW6^gQj9b|GxI@*?O8!eDZ=5hWc&lch6QX{K@guBP
zR=H*#n!e4kpbrk}b0yZN?+IbL%=}~@-Sq6HK6!D6DF1pqri;isuHbQol+)jtN;l6j
z`JdXWqD61lXQqiRhzcqXl)6|=|4P1kAxsFZDQ@`G8lCiz&F`>^jl#PT<-ATVq4HZc
zgC&PPnS9yM_$EZehtwEt;=0|u#?@AXC@9s2I!)g@>aIXhJRTjNYcFXoYZ>R0Sc_`R
zB3@Pg`XHaBD}dHQA{6HI?QZjU=Mzu$Z1QAYLCXMp{`^Ztd-Egi>6i@x!?imrWdarg
zgT{1ia7(pyAn8o6gm&2W2QhLc8`|dapf&|F^&P*q8SM<(m12y*fyzR1x=KKR|D+1X
zLGhVS8V8xtS>u_dkHhn4J6p947;BkL=dt~SQ0IP}E2bBJKYuWZrPr{({qy8&GJ{Hv
z{QccB-HW5RQUE8K<CCLoUsrOL-)@t$c{?>flkU&^Y#etmV5*Tx(#6>#MJWA=vX}PC
z{`HLa!mSaPw6|Gm(v9ctcz6bsH7vP>PN`Rp-nKH>p3vU5-I{V;Ze*%s%XSHIw$ln>
z<}|=Grfcpu+6h-_>tCjJT30KmNXM*|^~)y=mYUg9P1Gdr_ohb*W$st&r%m{_jd4tu
zr|O2pgg=%OSZd$sef3PYe_w6y&Tzr}q`7p^<@_X*1v28*8P91g9E3;*6Cu26yTfGJ
z+u=UF8X_fbqYsOlFWa{aU|ajdqD7@EIWQHSr4q2ZT&ZZpaIaK+nN5?<#44i~Ps&7c
z4aYAkotqSsKqV^GKgKl>t{I@WJ(0MvHoGG^qU^F2*rB{2{b9B5j?~j>%R=_0hrw9`
z*UIxq)-s!{4CeE7$%TsaYNq^B$|o--lqEk4bXE+9X+F*$>|1+1du`%xn*-{8wQ9}7
zKSlcuF%u%T&*S38S%hPZdxkp|eqPqzv*Z?E^+A=+*WF!<GHneJ$jxqAySd{&_1Rf*
zq;#WYvpDk{?2BEH$?x&gs^!~d;!^$EfwAp#ZNHLtni)JiSKY#WTHEd$eRx=HZ^V=}
zS=V`4J@9%0ZY$qRl@MmHWFqbM!Dd<Fe!wG8rPEfL4zm@GlxbFbCxrty^|7WIEy|b4
zOG+7^5aFzDs!uViG#Ew3uDYMKo*|IBO|+qD$z93>wzX`C=^|%hlJgzJ$ip8t;bbzp
zrL+qzwK3)VL#LHi3}wrgB>DD><f78<$UTaMIjO}7ffRL1I|_}}H+Y)u#mwt264PpN
zqg<}XCyLZs?}ZA1nHat`9@$lzDB5dk_W1SJXbB(j@68H?Wq*lRBTn#@iRad^<~B5J
zP5Lu2;D`Bny6p1{!xtTt@iy{_R9vFX8a3l`zKxo&ZofUL8r4(_zP6LA*A`aw9tRGv
zH|X}ff*DBc#fg`1mdXhjrf(k~AB{XKQr=)@@Jlm-WR*Cvc{i<|v)$R1+r@~rbhRfD
z=r;DjtAC5U;D~D*dz0;=oMOSdO|LA3hpPL0e!?R~I8B;075GVMFJR-(@3u^l^>b}0
z2VKz>Q8RVkZca&23WH_WGtOboa*hiI#wiJ`5s*a{)#o5ewC$ELHldr|;C{g6Fn6$B
zWc{$|;1XNsZXU57IL~dv77x{a&L(n;Lp%!Y;vcMO)7d81ujNrstZ<u9DFn{&sOEBa
zUBKvM(6&h^Jy~7bNF@K6>0_EI#F?nNs_pY+a928EXWPE0PZ#dUcw<bh{-R}#lp&kk
zPZ2!LJ0oL)`AZ3@{*?j#FWJXM`Q-oD?eg3BK1sFc@5yRTCvr+JqT>=*q86K3=Br=X
z*e2)G7x=@`l(_4dreVTh4bGu1KzAkWnoW@3*N!!aj}V3L?=3vm?ROT-<ld*NI6C%@
za;0EdT-Tg@<ayO<;Bg8a#_m4fO^$=zGBFqD!CqVR#KoBP8IlAh3$?l&biTlhd`?nZ
z?_h+!jD43WJD$x<KU2MB(j)LW@y2t!HEX9ZQvH__-V0yOD^lLB<jIhm;p#|_tkT7F
zFrP?wo>BI<uwT`SN~M1nn{RoBRrrf@c6LJ|k)i~InU8&QxV8G}rA{$A$0wf<V0FJk
zhIm--#iO+@33TqH0MpxRzO{o+P9fv`7c`zpw&xUrT{<mV78pzBO-g?-vE80Em5RP%
zoHsc~QyJ(#xn*cIKh+Wg61SYN!jSyA!Pl5jmpRct*x%(&Tbg>{dGCNn>R!*CI@ZDI
z(DNe<)y@JcDm$NAR8P>79^q_=WW}CZ@pdljKOUL+VYK<2jhTZ2qoQ)Nt*E7xb~FdB
zB)}iV&y}T|h5>Pd{n{Nj^S3gosawFAxXnma_GObVxdrNqdgV{PNxW7&Wp1!j*47(2
zl`@J<JmflvjdqpoTZ*BJZrHB$X0pX{d6R+fTcy;cORuqs1L8!tR&x%L8al;oER##Q
zq$|@eQ&&ehg_e&&1k#(P!T5#r_o%Gy;-wD!yu%tM+Hc!2MHFb}cR6aPBkH|y5ZwuJ
z6Na(M?v!<f$hDG`3)zYryiFYtD_?X+rr$qdlD-!?Qi4sb5LG7U7}X!p9eiB$nBlo3
z9Rh3osnGcwcx}52yb^(m6Ga^+C2dgDY+=>C-DJGiln_?FegoYtT0n*FTAc(Wjy<jg
z^ZqsYt1P`o)9=nD6Y2cXZ+KGF&3Mh{Fvigh?Aoe@Q>zite3}0s=5f(DJ(6+l^L(9{
zZ;DfWtnBF6^uU_vf5T1{`g!`Zlf&leq#88daZL*LT`A$LpY=QMPW{|>xY+qDB26*%
z-&oEW8lMry-JcD3DuDK=+6yrrUMw$ED&xKgir36AmysMsr|F)&RBWYQacTmRCun>?
zE|EE{wyf|Y^;xLmKub|0|Ja#2<NTe{ARP-R#CADAMO-1H*mmi;RzK@OTw<aDFoDp|
zs~*_vLoP4?jS47=XskpjksjEi0y>;?U^nVv%Mru3h1!3M>#-9JjIpv%I=ibeF*XJr
z(F<w4KWb`_@*y&jfzo2CWZ>dLLqnnA+nvqu_ZL?JuVWGYiBWqZD_tC{#s8>Lz~60&
znlIp(T-`8{Gc1b2P5v_Go%>4He$MH3qOX#PatkFZK2)?YC=7%Y<Df(MH(mY=(C_hb
zjA>8uC6NX!pzsrc`i|7Q>PoR%`A)5IXZ9MJI9aFx9UqS)d6PEhw{OAPG7TfvExmC_
z8`_SPV0W1l^3M)5Mf+z=wfvm*r#Q@rC|=0Z@Tx<1GthWQdjK$F+m7S^<zx&U-#Z(e
zQK(tArz&NNZj5MSPn19-f($b=vnZr-kYrvYCRUoVM>;5>&<@mhEYy$sO)ClfN98^N
z#SMgY0GtVfN-FS{TLkax$u<4Cfg%~+gmkzKa$c_uq+{H49|QmgZhC-dl$k(EEoY%c
z-QI9v8;UW^K?+upDcRWmSvu%ufD;vmJI=zg3e6|9H*Wli*yw_){NC_6mtPOh@x?&}
zRU+i>aLM|KZ@i>E`3gJq{_%eZrh~-cpOx{EovOc{Z?8eC9%yLI&TcUlFVayqCPTYy
zZna<^|1aI7z>&8Zor3f|5Gt}rMIUb!I>n*BMv=UXT0?qEpk>>8V?ZYSsDIdd4B0~{
z_d<KTj9xl&1O_>!Py(I3rAS#0$_aWvL03DM`ery7h(3Od%=Cp}Ftk3PNjQxopa`O>
zojxWJaj)f`z{1)h_sT9D#UisCC5oyUFP*W0<_TbNmruV?g1&aBe`&x`l1o0}7>sk%
zP5!~d11}@K0vS*QM*1v}R^G3Mp@ScH41tU^EYX1KPIK3B!J!=0bP^u>0yP77PyUCW
zYe;VKb-VahaC@z=op~rYbm-9G-ylhp8>#UvAM%}(f*xF2T3UPP=2(T&FH#xyM~c>9
zxLT#K#yUJH5oi@bTI!*OBzz){S*u#Ur}ib3=8;1Mh$$KO72w}gfWr`!Bb!iX7L}3;
zrWzr#$%In@Q1I8TiMspjwb^c#R?Rfj>Dj-oWz38bNR5n)1VRBD#+?L~RTc_#a4=%6
z_NMRV_1<e3pKF|wK;N~1ZX#uF=;J_I_Th*@N7(?lhwg3+*CL#Gx`DQbx&<|wRkw+E
zAyaEBQ{lmb3cCedSGzPtgS?716V5>J%ZvaSW#t6SrXXK1FX~e;9=UBbGctxT8c?0}
zk6m5e4mGG-ZE%o`(nhk3`W(BUZm_Y==fPwy{mGj9b8-9{^Toct!Nsdf=D`t+&1T4T
z_~@l2u!3pRbqO?DsV|RgKlh}*$({@utG?W>snR)adS$(Ho^QWh%5f%$>dEJczHO-_
zTaAI4rviTz4*~yNT-Le78B2zaEfVEQD*7o~!QoV>%c5{VRz7;GlP%DBsVFL1cQSIt
z5{_Th)z%{I_Z>O9Qg9~Z*Gp+O-KOhWrNGTqDZ7l;`XNWSpx6ede2~%>df96?tpSK5
zq{<5CL2@f%$H1FaFF_q~6^cXXWi}Byfd}o^7!|D?7iyb;&Znk{avo?a&KR{TDR;CD
zgUT>)>d<Pf0?oDoqrL6WNOSe3)I!k=Bb33wDjy(<0~9hlw82^w4Gb8BVKByOo`_}N
zn=f3R=LBVfTk=eGQFxC4!a8rfgJg}VO`We&-txzabKBX2VRb|jy93F|Q31&+0lAEW
zEBonH7}p#??MMbi%p!@4aj~tT-XWr;Zh`&YwMrb=t+-%3V5<-^u$SGStm)5TXkjo-
zqfNqGmHbBwqYXI`PN@z5g8a<o%SH^QGr=wvB=<)E$(8PChZ?(d=12hGK6fAxjInE;
z+URpxa!7<cZ=zskxqq5-f7MQY+&x{pXd_cHeJkoomfvNkk`i$nei!aqCxa}pH~W9u
zIRyfy_QUxm);tG!*5+<C7jpP6sfFtfSWJ~tGxo#0_%$>V%uEW|o_oj@pDhZEc-pcs
zV5-+4rF+hTNck``ccoYd$96UL;>z-}*A_pM8xX!*CFjna>q1&t&^={N#Z-fYX3&Uo
zX}tyd($M?i9Cj0Y>Edt%m;U<THI#kjBWSKKA%lYkgCh=^Dhfz%J6aYPetNHW1n16i
z3g<!_oT9%a)R?cunv3|7F(j_63d|w|w)tqSz5wF_H26nb)PAJo2e^26$Zc>A{1LRU
zFX@7zsg~Gg0ZFanbv9#m8-;ha(2i%V{B^ZLhQ-jACxGPG7Mh3c0lGK)F7BE)UNcr4
z7nrFJ@W0)-V^P3wTl5M;K5XZ<8&1yK`$I?-$t#^gN3Lpf?O8N0{{#-pBA_TR?0iDv
zJbs&jubq#>LE|&nZuMtu6Bgymj{DOlyuHpK_b9#zmG!<%-aO+$8~eS7)UBH2U#21F
zD_vJE5MJMy&1dmcbZ8oRljzhu@+ok?c@OY*`}%oLeg{T1$N)R8m9H6oa-kF48+T{v
zkI-+ymE!!>-}Pjz+hSN09gy9G_mC$)Z*q$Wvr@p-5d-PZp7Z;T34@PTL8vvCliq>h
z<@p>YSKA4(3C4Xm`0xv_9sK{{Q9p1{$%LC7?>w2x3M#UpH5!fdn^HBuSI$J@Nuhvy
z<uGeqE*vaV;9y(kuh!6je-p_`_&Jn8N7e#p<x+Udp!k=a^=U(90}isj1nhE&e*?3!
zy*7gs8K8<WgH%?L_PNN&bfg*z9T9v6IjMEF;UdskxYM9Qci3Ex1SD<NWau{}xN<kT
z)v2bY2I&fVHZMo<c&?{Z>XU~36IuE_vu~2X5!lAhAepZ<1LQbMy!K3J+7GSMY6rvp
zH1vEor8vQsDmj|%`+Mvj2#O>>A@aUc1mM0uLN$RVfyXN8k^R=Q)Egvr!coF(*^~Jv
zDs#(gSz~gBKK>8(zQY~M_W%EuL@Fafb{U1xAbV6IWN%rKoxQh6ln^qq%O-ne%Ph0F
z?M<@x-oN*ip6B!V9>?cT_&JW}cuLoOU*~mR=lgxW$LsYv-yZe_Jt7Q{rfK2R<s6#Z
zU2aP!nY0U4n4cOPYIGj4S(7OHRxqSIv*kj)d$)wpGtP<HP(60O2U38`oEk77cE(q+
z8N*rp(Hry8(lkOtCUPbckyU>(c{}IqPV+_S<?>1WIJxvib#+%k_6%L#7sI~fa}8Ko
z^lqP4tAmuv-zyi{FOMCZG>GoC4ibC^kSO%zQ~*GP5WL>LeXEWy$8wIM(#FX7L2Gjq
z>#knOpj&NqLHCnb^Ho5|=4`EYG*Y~aYnfbg+uJ}|7)OW89thwI_BGLh%sbI$N)3Ds
zo=FmQPuM-$l0Xf|cGPWq_l6|w_5j?{&^J0yyV6iE!pz7kzZCk=gwUpQ*;zW`3Am%n
zXGb>;<4{m4IX>i-80J-+P;1(sad9ej87gD$FNlX!5-cFyKu$g=e*aalO*Ly5TBaEd
zWgn~H&K|D;Cyh$A_sjc%5nwG~f^B-zy<@gY$NUu)>xuS8nzvNLl4AFV1)DbJehhpH
zifA!(?_Mja=is5b;nMI>*)8rTA=^VSZvC@C%J=<u)JyHtcus;uKVVFYhfM!mg09bO
z&l3wJ=nVlmNPB+$<G|t;?iIs(_g>Inw)q$yuW*NjW!|f;$+>v`3PR&dQ=XX%a<H8*
zJsl4yQiKl$@emWVP@%Is3r2y2aEPsdZ&M<Zb7lk>?&Djss;a8`1pEMTl)yv-;9t3n
zQh3Eb&?Mt^hahurncSPe6`|DW<Nd<Nz7qUFc`jmBTRU0DHJqP<A2Pj`xAtmqL|5E~
z8SSWA<`A`Q*N{)~-E$Jv`Q6XI9v!$qV{pR-ytGqs28Ezf(}(dKhi9gl{;byT<Fu&F
zH)F)W^XCXCR~}<GJXA;DkWep8e>|(n(r!OXb+7Dc^pn@CsdYcXqWS4GC$F+zO1aLh
z4YPKrzk=tZx$5;PF{-CoP|l_mK?$N>`T^}#uTT%xR-D^bKkmFE<_~BGD(-yF*PmMK
z%S)`y2MEsYLJ4r98x2RC<l6F~6GU#dERYJQ=)H=PWtcAn5qP>43Hv+BVoUBRK{Qna
z%rA*!$7*FxV@51m$A@B^S<o`H&D?Iq97ypoRNKwo93c$dqBD;d8?&frzLS$y;uKoq
z;`%$PD|YgDG*ut!106xRbL`dmbKnf$ib}3muT$3Tla(i;&06EjvPeWfIS0{+m*Y8W
zH9b^@K5!G~Q}x&<tNak<+zyX*T5{Mt-__&QWm5z-6QqiThH|UumkMiz4;_LfBwy@Q
zItGGzKGA8s3FJN2Mt#~kv9~Mqe@WBy9drv8Rl6yGXV}{a{`H}E{V{aFGOb4q&xDK^
zW74O?>IiYAU~-CP2{SC{=g@B^h6d7-SBwY5F1K)t^HJR{2VpEK%4Kf5jWQ#qkPuDZ
zDaq)Kwx~)6Fz2^O7CYFU$c5Zplc%=;jv&b^kdq-Ko!SK<>2S(z=rbb$sG{8+Ce)_F
zm+ntc8B~aqB43x0DcR#;;ir4RFgsH1?A}v(@H(}iqL+1;KYsM+bE@9qVuv$t|1$54
zGJJ?X`dZ{6l)>Nl7hbP4jVvoFn0Y-b&7*0)Svo*ua5PR80kLCeYzN=wj9FZ8TD42v
z6p?3K=6jLZ*RyeDNPNgu&Fv;=IOn7v3B~i?!}fwBKc>|7$(mUn6&Aj2*vXI&L(n<7
zdaOM%!_$~p;uK{V5IKQvY7yvV>|i|nMD$bLtw!ZCtTmilKveF5{v6Q8B*XB}0ZE<q
z`?}E%ObHVZ8i5{W44JLr;$tCzrv*Ub+h+igL*rd&N=DEp2FvemR$}}rvztdK<t#w<
zhLo#RXZqMz=-}%#lBQ*@?Es}xbY>s68(`9b+spuDgD4pv;MySr7qjN36vg3#q@WUj
z7$!q~U1#~A#fqfEd$XxU0Ji}W8mJy1D7s&>cRKhL^cNx3yHurobpG;fkr0UB<&102
z(b`Ty`TrP~T&1)<vBYOKy}TC6oJbyvlxV7|o+5pRIh&$ucyo>)pgb2x{q+Nx#m^FU
zU(;Fv<;A{f<@n4xB$62J?JYPuSZ=o6-h3(;RC;V2sif&)@UwTc+)l|la%3lK+Rc_|
zwqUx}Za6GXAE^@0SULFUNyMFzpPD8OF#4qy{$pW-_xo8Aq|zS3mOqn!+W+?<&rl@e
zSnDRyq`-XD>XQzqq!h>Y{Sr)>Ud{ee54f=L{KmpM47$)!{>v?oSv!?ivrq|}4>YYU
z1lK{dls7jRAtMtsmi5s!@$*ZA49jdP_5#I7$<4>dEJmM)4l3=OWj>nx^&Sa;fH48c
z3&iw4K#XDo9B(?zIVeDIMLh<Eg*vju>*7$6SQ#wU3;{uiRDf{pw|@TsF}cveIKH4w
zz}9@P41yr;5wOAQkV_QR{DHSJf-23JjEJW}02eZXyGck|3Livp)at-t1(xt8!uW&K
z57`q})tq2kYb?FS$Y=u1<0wee8sA=4_?Qii+=94mr1^|?EZ)`oi=+n_;hq`zq>Y9D
z5mG#aXaIU5W&3+wEwx!B$qq%=D>J7LKg7HAmM%&7XP4(sM3%1&|E|0^={Ehi@=wil
z-+W%}w_6r&6TeM+_m^+Y(@zBojxu`iOVn+Z@{{kgY8|x?7aTX2q%TA%D?QNfoq!u;
zG%r24usPwS93uF0XS69pQ-bBI>z~G+FabhiP0HZw4Z3`%k*q=0y?zP^F9>_Z7?dy&
z%sIea(aDmeKqn>J-vrp%op9hj%V?I_$^qO`8QAs!Slu!6LkRSMt&~J4GcffG;(+!p
z1JEZ6dI+j0kiW|TO6k&;!qH9`LJ9{U`cxNxv&#XPqZ)u#c;{D>yMpE;gtE7*feq0G
zUs0srLIS*OEu@M9Kv0m`i-wIAs1xW!F?>K%i6fGb#TKL40O3vtNDO3hpVv$Q1#bt@
zg?Nbb#*AFn{un~-fPq>qW|V~+DukM0pkpH=A2o=GHM`{_HNqZOU!3dzz0EuRTe%Y^
z$Y?jJgB`1S9-cl8N*0#{h1M$_1ad%20=N!}^E-guhuiYcmyK*@WOT)6@D4OJG$=U-
zPCIAS*41@G^##cU0qqLrQPGyzZuj0yiF0T2&{=U>Jx)rh7)#axc1V+nf}rLibH%WL
zB!U>&B=%aysBp_CuwWkppyhwsq9Sl@vr<rPS2OiAzCH}v=ix)Nt5_Q6KmEo3B9ePO
zG9QsXgzjCx{@AHq?R$Dtzd;W6{QJMaXK2RSFOH;&vsY%3k``VSxp1!>pA+qWPJPx#
zMMw@lip;{M>BY0)Nujk%OF~4H9y#-<RE7kpszHmJ)j!aZiMN(X(y{QOdVTbNw^uI$
zhJtgoUu;U9OXBBdTCk!UA=P-N_L*hbzDw-ak;eUhx2-Qybt|&fcD=hqH7>8J__AL=
zf%1Rw;=LYOeV1DlME_X0ZTW(j@AH5@pOO9L>%J!lb7(~pM^JVnK#dNYff-0bpyOWj
zx$kLr{B&W@9d?83To%AP|F>C=fF2l6=-#M%S7Ahqg8OODGqrm<J_W&}n5fyll=LWN
zzmNUNJqwy6NZ<VC9{~@jQ2L38aVnLwlxOxmRm!U~vFAx+Xu!*~r!h&3tT%s|it*|%
z0~vKMg?@tka5vO~p+wT-a>WC9Uj>r)FE~yMvf4v+J))><inTQxXX->61ity(!k~82
z1c;9E)dt9=jS#*y1SG|c6341Ql5>e~FfW{dXHY1w#}KuXAMayN*_Xd3j?Jtq?%rFc
z^nF7$zBlO^yQk)5=#E~aqfnzxXz}&Q91a`iTxIVy8a=v7J&G^<Z$E#=_J{q4&r;6K
zojPT|xUWjCh2omJyryURTz^G!$2TM}k6$>#w}|{>E=d+K9TOu^)&_CI{!7-oXt8{`
zs!Qm2S4JE$Ph^{n)(i;(LfAZlN1}(y<}5JfZk5xIRbcIHQ|K_p$8Qhw&IJd1v-jlz
zS|dY8`>7A%+Z*`VQ$@4oO7oi?B|^c(kwWp_Q_BxdfUB^JW58m%MAiL%>RuJ)3*UcU
z+W!&<gLV4<HRu1C0TX&5Ay9-yp}y#xpc+CK`wN;DE_#yh0)_o;FR&JGmIGttFP~J$
z3!r0@n^64#KE-nckAyJW;jeGEr<To7sQV|H3OZh(?i#<%Ubzv1pilHMrUB_On;fCF
zre^=U@&ZaY_k=I{Sf@yxQ@0*x@({iPp$;)~aYg)0!*PTXSaVxjcc_fu?43PZ0L<pA
zgDNyON;nJmM71KJ3IX~7*}o9Hzj!AwBoMGJLSb(~>fe7LerIHt5o^!rrU;9umQ>5+
ziqynwf1q9xC}A9(L_N%V;$jjm{#ojtuc03zhk$V*payBSu?nOPkAP#_*f7%^s-6^S
z9lP!mfrRu0{j8CM&)pOpEPBE2>tmXK5HOOpmrv%82!J^V-4nPbSqSJCaBw{fA)Y1(
z(aOAP*P!Tme<vscI2!^Yja99z8K5yON4s0snn#PD)cFpB`rKb<g@XbJI~vfZIS7*w
zv{QJkCO|dM=PlGJKzFs!=&3!^l|&Fc0vy@x^79EJ14S;{J}b66tWxN`5X**#KbIII
z`y`tS^>P#nNT}|F!`&pfHWof5N$wsiC!D~HPM!a%xTs##Omw@@VsvCd9+l7tFO0Ez
zkA2eZaneH~ngAtR1+Ok0G=F=BeHM9|n6GHm&B{l<L0=feL$wbhv~~xVjao@*cmC-1
z5OgB@JS1uWm_ec6JlN8uViVM@pxK@`s_h~m80L69=}u)<A*A6d;=9mb5aFY+gNJ~E
z2=W26uLKMXfXYE21n5H)T2<?aZPE_LAkOOeg<Fxn2uI~{QiG%Rk?94SzbI8T3NG`{
z8=R<@UMy^;Isj?YpQ=vT9R$YIKNuc@d?51<N@!!E2>f_UOpPkon0S=E1wP*W`wikS
zt)NrW=mLR0+#8k;fV)nJ$HI@Azkg5fxec3I#$QCHc$h$bhu#6`ylMRXJddGZ)pEoC
z{S}~GyPVw4fUFAR33TqtHOTBM1mQusiT)z0<$<RQZ+GX=6&4#vcypFNMqp1TE9m9>
zii!$#HNX!FU;P8iC(s2jvpUN>%+#Y3w|xIwKlSML#4Tur$!h-nRbwfC6f!!33d$zU
z{6!(Q{c$3|jX9qX{)NANYj3Zjoj-*-)so-sL%w2EoKg|(p*5JZKbuRE)0fl0vehzc
z9qq=8V>y0814b34OGdC6L?BWpP!qtH+WG1j|Dz(9_n5zNA)lb;?`Yq`@~p1SZ=&(g
z_yd*vph=CQMY(Q{VuIFn-x=l`yy;wm10QEQ>~ELfIDPX37zxi7z!O-WA#g3dYbxCA
zc-2HmaG854Wb#X<@?6aBESq@eXk#&G30Yj%Wm8go{m)*>eQi?vQ0@Z@zR`q*NA|ar
zapy&Ev*tl7#Sp`1)0hrLoj;CPS)P~No_-e>U-i)E;k5w$)w~NEzx;~ldgmu_=lKH5
zIpzz7qgH?7iOWmOr#K%(M8rA_JMjfFTQtcvG~Jb*j&CyRV}0GM`m8I4ecR;MyB-5=
z<<r+i6Hbs>V-+`4)e~;9KUW+HOq5ve*9cKmwUrMYZSNJ+URYJzPGsLQYCT600DNNB
z*Nu7`L`S1CQESq19eXS`c<H?>76B_9m4-G`i`*ITC1|f?tZAj?RPE(3`U}!B@98g8
z%w81ljCoAamNZ8CXR*LbZ<pM9bv1eWc{Wy8xoKx4OX06Y4!TEf)1k4V*Nuf-@59|A
z=mW?H)L9HPQ}ghXjK<$`1i0j8(KG1<OBEkB1-J<bx%tz}SeEJb*hO*t#?6Yfi+wd5
zlD2T+;j~8P<QK`y{?9{_o>&-N`F`gUXR@8bC6ZWl<ME|vHy*-&v?WlMBa8v1_g|B8
zh0`}QaG?A41zs3E{VBf4ej|+DO)cB1>)VyAOF#RV#c@m2ISM@_lMBt6#ntnQWka3~
zdJK`J^KKm#H|`MzWRdR+H#>EgJ})vHWy*>s-<0S~5Cl;kF6jVUtoFZbJ^)NlTo7#W
z_cu1G(5g=Eo37U6t5+_IFBX?_?HMfFS54kupBu?rJ5+2K<ezKhQN$jaIV)ShMcl2P
z$o%rJv;YbfLu#?&l+x^_BtF;8P^I1yL}@3nM)RI=pC?;r-ktY3N2!FL1^wXBWFw8s
zs(9iE)@aP=PzH|KKNf)U93v(jPUxI!YgaWFa?Mu`GG!MmIc(E<en$)6#UyKVb7c2f
z>Z>gawZVw9f0b|{K*RYWS^S6@I@dH$9H=sFOG~~hJX4U_ASRtWtElpsRk2!&R7G`^
zZ#zB0fzPAu)7l|r$?d>NHvR04)~~!KMy3o5B8p`rFORoFas8!DhGl%acc*VLYRa9y
z`WKAriTcgf|0zFq`P)US^dvZBp-D_1!*JJ0B$R!V-()mXvf{Q1^^d54hha-i<rQ61
zKLrQHLk?HY#yiQzvX!iIyW2U^w8$6_E7JKEZk3N@pYk<uEqqWwI*21X?#=T@`WTMu
zc~}0-Un4qBxj+0kl#)+hoct-!*O0|b7{wb{zOh$b0-88_6lB9o7Bjy;Ocv(OB#p#W
zJ^)`4a_zikg>E&jKY!3K7Ybemts&Lbyg0c`g^{)h7>0P<&CUMmV_WIX%JuKk;+<}o
zp&1&>JrwGXLSWnpABbK5jiNmr#bTQCx>OCsDQ`%6gJeu*f=iRC{*8QOZP%HLD>i=W
zvI!8hRAHI46Vc0T6zEe%jPY%dy^(Z^lv|G3Qo+#|>_O&FdEJKl-z}zDY^E^uv-uM?
z;@SelR?8jUZtgpJI3a7{Wx)tRZ+yK!1q&DeVxL%}#5YNq&;J`?q6`DMSvxu>Kqw~@
z?KyHbYG*JWxt8vHK#*C26@GCRfiT|UsC>>*x;IQq8cavW9{lA&@_Z0j<EkLs8jK=C
z<rsYr)A^cWW>wD7{8^1Im%H0%4G*2b6N&Q*m|S}IhbRqZuanU%8WU~^5AI(C+1Xxq
zPHzKvF<tPRwiW29JKD1!oKx;9{C?7lAZ|RKrn3cFBw1!QEbl$oFF}JN)Cb=XK%wS#
z|3`C_T&(c|CKH&RL{Uewp~;=B4>pzk5yTjORW?vHrwz|ZGl-Ah!r<H6cnntBO+LjW
zKCbM4OUT4d@lx|CQu4p<NSG=^+0yw9!>kI1z#efL{>e4~5F%m!6zr*i4cj6w1@X9_
zscj&6Me&za4^P9E@SX(kFk@Pfp<!AgaL&R|d@t-q_?*B+?cP@#l8QNOt8=zag&+t;
zdUEs#sKa6r*xM$SaYUw2EcH1oQDE=PbhQfw1;arfmxPD^fk~%5d@9D3F&<aVvaoZP
zX@P(H=hk;mDmPp-*FPCdQOz~(tk-_Z`68O;TeB$cDSi+96KC$ZRvY*^)5(#U>2o)x
zK|HSKzsO#b7X=NLv2STq3t~m=bT*g>{zk_T2!H=xFK7Kw%WY)Px5%k)K>=lX<{zsZ
z(9O%($R}-Q5h>y*R}L3#YlB_?UqE-76iKEAp-?E_=hafP9_z^dFw8WOzp|-N@;+Z8
zdBNdOYW(4GFnz2omojF{YJqv<i~_CYNw5Ku4QEOu1BwsDd+0_f{4<E+Btnum9~ER`
zk756Vtwt*{j2qjjUBqtD6)0&s#6VO1Gqk9*dw|{m^lB7@CK>;r;Vr8&2;-;)4Z82x
zsGGKpurRwKH(dGWhB5et!B^cYN}5+TUh>I%#C55=;Bm@J-*bUG#2?+{7Y&y@6XiyN
zYX7SY1A!5bKXEXh1WD@fGV{_3cNWhrb%rLH?G-%93duKfwBq^nhY}?I-3xc_p}vnU
zf-bD$e?F>shu^L+`eUex`glREy~n%c{-S&i$xOM+E?ecTRTtCrh0KJEE0%`RWB)5d
z_nhPPT~Qp*3v)NmQ@s>^Q128VC}kY|tYQS#`9z|=fi@u;jx^98C|b6?uJxbb5j5<?
zIBOMDesx<PxTcJ*6sANqJlwDFn61<;)i5u}Id1|~)%oP@H*VpvyG5^@{#oViR~KeP
zIs09=)#|!BTeRNQUS(6I0;W#2(+V48F>Y)EyZM@>d@{GmIdLx0uqrIIhdQt6mv_u`
zjq*E2d{+M5bb)xBbM%i^E=qU?m#<7NVBJGyidWQ89b4)nAdJLYj`u4Oe13@Sj^C5e
z5w`4cEyC*nF#BxkYzu+@`??clPN?CWV&&gN;3#`rOHa3^?y=4fmismaQo}(w+$Z8~
zki`M)#1>RkG7=IJ+5?^7PjihF799I%jF(@8F9238@c^=pPp>`P6^(~^qntj-p6e{L
zL)QxlWsKLEkN-SG)zd-53+o=?Vnbt~0(g{j3z1Oe<k~NUFPVFpdQJU6z1@E~eSM{{
zB1!Ve3}o(`-@bii2Es;XCs9hbmrZY)+=D+ws`D{eCm}GoILIB|zkeUjeF9Y!gZR6i
z1SC}!;p9vEDq-_6MysYgPfqtF_CQk4P|KarbFv~aW)SIHAh4l<_X}n5KVq|ifjtPf
z4-!s20iYs7cSIDTdPs`?TnJQLW=tvIBwJJ;Dnl|0_w*_Tk`un*jxZ!rzyQ<)<p<FA
z^#G1}8EB{il}!2RK5&K+pcY7h#R7TJbp+VMvZJo+0l-8TJDeb`2JT&4)8oo{`fJx%
zczF7`mEm-dp3iD}F)m8IV!TvI;ni9|^K*t;haIH78AwU6*baDjoTlLj1?Z154KSc5
zZ7M6LOMsZOI9#p*U=C4%5z`}3t27>~c>$6?Zaz({=WuZmX(YgUNvyr?40!!|wX_%u
z3k%WO0RH`y0~N}SUA0aDMS3EXK;Q{&uOu{DadUZe)G-zWp@8%_2ci~t?>8X?T3`Sx
z0fkgoPj3@a%NFyJc|;Ne6fTnY1zmS?kq;xRO++OCc#rJjh~5IdOytZah}0Pa!!iWn
zjsbORFwGb`>Ie=CDzHfE?S^oi{rql@0IE$r-s7kgZh`1g0Rw#wL=U=v2Zpflk;?|k
z>@tD8ZTPYlw3I6TDzU|F?mbGyR9xmn6gPi&#ODBH2Fb>eA}{C-8b99#@P_f;#%%uJ
zqJ)%GH)I_-+J|#0QFqOvfaRJMNX19qn+iCuM$XHyN_p)Uj5LB^tiZPu?GW7mO#es8
z)TAHoP3^jJ4+;#kU>eAKL!KEftXyrRfGPtbD?oF+(}X*pl#*fsgE1I&M}*vP6K?<6
zP=q}pFO&n(1rk>EB!G*V_2u3J!e|cyrUC*u=)s#oN7iA)DK*Y<0wSHC!Jx>Mi-=@!
z32#R6*raH=u09l4Z@m+eRDFE749v`IWIe(FE)f$O!3-l0hcMDWY4Eg1_v-F+ylH2W
zILtJVUphfI4dHAfx`E(y0MXVdusxKB;MqWz2PViZIVOe@IN^I0DW|`|I8&u#5sop`
zB-}tYR`kbQ<=qil8<@q$nL)roDVJ6M<&z_TP<UfgmfUaWS3y?dyGaocOlEyZwSFL4
z#e}5@N{Jq6QHkEHcv^Qx0OTeH^7MQOMI<{x1X<@T_vWkek$L<CbHcb&E7w|26xw&V
zKsSd@#}p)L=#7sKc0-at840jcWUS20A-`su54Hv^C_Wk~fwH3O{T}Uu3DOXLy6X(a
zK&}lz)*&1s1*)?^H|)+h1bredFIix&gAY)*FV_Sk2;sL$1t_W(4-XF_{+l8bpA9P?
z=;<>RIlW*;X8h8iF02yYfk(+rD_#cT7;no$LPPDEs2p}GLHA<g*8Lwe?mPEF5IO8g
zGMG^i5ZNfz0{u2Y?Q7z5&}asVx#{V|5jRAFqLCLqvZ{tHOl4J`aVd`4;!f}iaa!t0
zymmTwjqX<E$Jk->2zuxO%phyN^}`)REF?K4B?FOA>dnzE`u&st4)^nsiqejK8jpj#
z&MBm8AuZjmwmk|+r1)(_3uN_Cg-X1j+Xh&s5wJW%_!I9|f<N1Uv!;d(4?!z!FP4H6
zyv}q*OUEUaSUhezIy$#-ZTH=&u%%^{>b<azeW<QVhA_&+EfiQ-I3B`Oq=T0&gBe9+
z7TRKX6xOFZdVw)JbLTko*V#s>%Vr=H>fN=evZK9u_%wU1LPB<_rb*$VOg{B)RdaV>
ziJO|f6knt!D=PFPI>*ta6Mg#wG=;K26Gs8iH;6ufZ3}A&nN)bjgqh{9ATF}EuV3?|
zE>=Ww7|UmERy=(MDA!vV$|3O5vSH!v9rTx2#E%}r=Tg+0%0WPn#cec0i6wq&<hQh;
zR#5ZYGI0NSZC75hK<62eH2~~HP77Q4W9a5}16$n=)D&Quim#oXgk7N%e#79DqTsml
z6?+q{Afq%-i9(+O?Xd3pKU*g4xB7;L-3l3L=^i2({*OTPuZ>K!1!E9ZNL=p*wGCFy
zGDYb6ZC&o)g(>SED1D}{ZwzXJqID@u3Mph=`1JJjI~;`>>0tYh<b8NVD}#Q=vyyEE
zCb%u+HMR5p;bJ4$7I=HVK!6Mwq(I`If!5WnDmHima?rj6aWO;!7%7*)vK`2M>OCq~
zj50Yp&g5xR^LLmUV5}kh0k07?&=wG%jdz;9UNpGqF80_Ns<Wxh9e^^V7l#&c<89wM
zx$#>E>q@{gjnHxy|Ni|u2(ug|f&L33gV;?j;360j5<(vv7bU#L5w2cptzT5U-JU*o
zL8B6ir-*<m(q0C+V-UQXri8r?!31A!vgf9BUas6O1WS*%gT5u5cy|;vhVTV~xKrF>
zCmE5KA}A<vIxJ~`0F~y0SLfwGntTJM4fH+4K$$E1CiV<+SeM$=G{^}dG8AA9!0DF;
zb+UWQ)yGw!`~v%f!sIS5>=sT4ls#Th6EVRv=YJpqH302M2dNvwtYeLa#zxTXP(xli
z(r6zvE18AOi|f?v+;bXI(o|SIh{qu3woK4++f+jQFLc}+hYEmEkEpI9mBq~LG6}%x
zb;BSS#F5d03Kt@ff~<PLf|mV`GPND6!9cW!VdisD8npU&oC8N5O0QBOj^!C>dsnO1
zmQ5lIdO=9+=A{U61mekID}3T{Fi8_I1uoyv=ggyNy1RG(5T9XtPn_*a%~Z-%-W&7A
z-+(=s8Kh4JY+{suBVmlRbRg*1nQ=73rUUj7f+#o%93QMl@!FYWX%~Rl#1rWAJ45(@
zNIoK-w^1Xr`xbcfEMTi6Adp)g#>*p>h;{>67bQOka)U6`sK=;LU|3Adf=xCEZ=nGQ
z2TCLy@pdrQ1`|#crX_XE!#Cfk82r1I94>)rgysE5#OQx^YC5r|tV@xpp-U)#2SI=U
z;yu9FaNp!EuQt&{&?AR1gt;%pa&6V&3-PDUt0*ek_Q>T!_yfRIxv<`J-g#8o6{5PX
z|8#up=F`MP@$T-MBv9{~cRL@hFUrtk{T}sotrF_&+yIzzq^5lGiP{kkhH_?6PhA%T
zWW$b=0nT&jsc)B7!S_cAc~n6RRF!b<04mmqFwL;jbZp~6E~o|r?_Am1dW}cBdhYQp
z0tyP3o_WPsI}{p4Cxd||I7yb$kT(de;uJ8IOmL2kL#ZLQurWkxj_?4=+ZjB|Mhzyu
z5eQo$J2HT&o|Oy+G|gauhK>TN=%lLZsZGUak49V|pls&ArWIksMZN{??44S6k%A%<
zR)rX-GXIPdaDm1&#V|m@InDjBXjfFFiPNk`EHcl_Xa=ifLe@wRX^}O?>A$C^C?Q%B
z*4Fvpo%HOPimu+hd-qv8mhe<<pt<7Y!KhLx$c}o>oz#a>s4Iz8KB)~1VnrsKqEl1L
z@;!5KIFa}IyPm8>`2ogsu@byDfhI@`^7P*%9_K9RlCX|GrTWTZx_Jg^XsBKG--yOu
z?)<}nz1U7*V2^;M;fGUcw6+WW6-Va5524W`k%HTBAk&%l6JG^YYjo|Kf^NtCm(0C9
zKPP&vi^<IG(~ER_m)z9zZNob9$4fZm<|S({kv6E7>gcjFbp=*Rx2fB<sun++Wgh-f
z;2*+f_SD|#Umok}tQEHcwB=}ZhQ_t`wF(f?f6s{%9F2VB&nQTqIg@fa^=q0_jMAby
zr)&^j0LN43U_2Tt*z2HWQMpz!`rYKh(a+A0p35hvP7}PJdjfecbQ^%KUGFHg)cf;g
z>J{2D<H*KC-T_CCFFSsC{r+ui=TcXwpkxm}Uea#oWf+*)Jt9_l89P5Ek??C!GKZ+Y
zWMS;otzbVcdR4l^hV(2>`GI&EM34RYFOxu>u|N`s3AAeX)p5Jfy(=4!RWy2P7B0%R
zWPkbmBL8m8JNhY$!K^<C9Q}zz8V(NlOGIP_cp<H949}2&${>Qk8ek+yd@|F_lEYC>
zj3zaYAn!9syEmSylx<(J*urc&@O8oDg-uVX<^vFif_6q-<;UWa1_dK@61pL%wD{9=
zlJ~SRDCqwqLJc5{pU`W~gy8Fg=EeIT29rexkLc%vmoqg$z*yK!@6U+^HS|C@x2RYJ
z5n(TACYf$Rq6kSaB29g1oC!sA(tp1By*Z2pfm}?w`G>dJPCsz7{mEdJuYP%6_Q{dO
zFCqS8w{^k-$+MT?tVX=0BGaWO+Qy@C4?>cl-(dvUvNBNm0WI{8uU3dXzwbOj5Lh~1
zaFQmHQ#i)EHY7Xme7Is_Wy}vk&2io2DI^h%^W%oEuJ68)446U;8<eg3r>?wLq~o{q
zZGvF)OTtd{$+v)B<z7X#=`$KHh0~yn^4K9@VX|PM)rErFqWzPJPimn39UK`94cUVW
z2=VUb3lPxJx~6TF9wquPQuCsv7W{wb?R{1c3(V;@wIshGxo%vUOVp<JMX0~W;p*fw
z$^l{kBQ022sJz~>68thC9CG<C#i_^GS7*ZJm?n8rb@C)Pwzn#TlWP^>mpK14(`#J2
zab#M^wM8MDX#c0kqM$}O*iIf-b~UGGHD2l(KbGutZQI{7)6v>Uam(sxIYXoAl2efc
zyUV?N)iyR#j9RN92B=s+<iJ(Xc>Dkc;deqtmc^%ZcyDq%a-YiKy>h8^y9bxC*b#MU
z3?K@&@+Mlk$*mVB2dYbcKnL=;V<gs>ODSa;v$~*As?2xkMYwtK4J<WNee9oJykn=D
zxxXY_Wlr=SbdddUnd+Vu+0WH$*O$&EDp87&kuv+!rpYRQypc7W@I!!OHk?Ds+TEj`
zlDsT=-neVuMpLURuEMFqM!H3KS#a7d{oF17<iG(pVP776gR%JKDf^j2F&T<nJDJPH
zOHAGk%#Yl7&@FkGVUUUYrO|NbPLpZ5{l?@!XpN0@ZF5ZRtvYn&Dz-QxG_>)L2^4EE
z&f9tY<kquiG3Y6xU<zGF3Hdx#tfBG=($)190`|A$7isO((Ek5^-{8g)m!rcXV@w-s
zZGC3bL_Cea>**24(<MVLtnI%^#@V;4&p*&FLhD})j<#apFFGx)=O{6(yDu{Zr+NzG
zqiUk#<ATfR=cdRKE<zMXxT)Y$#pl^Ea&(5Skzpc{iv4MSf&WczbJ|yL-_{+J=QP+@
z@Sj3C9&AlNiK%<`xhZZL&o8Ja;?jKXbU9`g+a*iJ?TRiJjSmriL%#XCHqoGZxPTX#
z7^mwv&_pJstVrI<7Eq*$MI81)!`*enD8JTdE^11D<T#%IwK6eTheBO$+GOjMIwYbQ
zPaV0Ji;<#{FwXx&meGz=#Fi;YwnmRO;SJ`qgJBB7;PRcLOgE2P*!IxIM2U;sQ$%?_
zS*j#qE>a2Y^@Y)v9rODqysIIZPV4L)>oyduVcpg`huT?Kw5abjFWpujvK3<{mT*Dk
z!^n5m63wI~u|yh-t?Cw4{9ABUS(RN^pE`#+`F#_(F3D9}uu-Sn6j`_A$?*ImI$53~
z&V7owb30sbD*jbXuh{F}qu8LBJ4L94*jR^AN}nf&_|Mm>Dt+0<N;lPh%u>|r-Frdp
z_^X|}HHvcJS;bE{IQ2NT?$v0S$RzguSdfR`tmQC|p-He!3JF|D#z~Jlm)(7JG5V_O
zk>)Lu4w@UAX31J_gs?(4o-@|uUP$AsU3s5YVsgFU_%i47g5wViSFe^>9_WyuX!r8(
zu?C(Ez`2O|qlf!cN05EROS@wy5;-e%*R3tCoy}($C>O)I%nnx+%5f<`EO$1ww;r!o
zC4N_UsBkVd)_1jka8zfaTQ6@(r~`TZJZ&-}ZlrYz+lBguXTt^JU&B*AiX}dUf~U&;
z9joEGx9F4#BoG(smbeb$x-P6<6GGw{jMyp+mLogzV^^*w<Aaep(wk1>LAs7nyiBLz
zG4mF7A3yI`>-^|kJtTJ?6&aC%g&ML{I*l4z-?(bd_>fiCQ=;?YbK!3D8k2Wr7q43T
zbn6`7Vd+cCe(C4O`+e2uz|ZP+n|*w-${0$hwR&*mJ2^SwOQB=EvnX1jeM*$hcF8^l
z%EM77`wLU|yI`xGI!qf3)O35F2Z7**9wTb3cz>Ff<0=kw5$W&IHax{oRe|H_`_0_h
zVsl9Z&(-4JDz&`Q9pq!ueYdyd(f;P+v*fRDIhTK(LWK|UlDXWKuAg*hnw-DD<TydS
zKYGr1l=x%Xf^J=-&HQ5ZjASgamjJ~z-R}I4eFaumNi;GaHd?urn{q~dezf0sL|kvD
zP>1T{Q-}91oN6KbJ4Z==RC+F%EFq-uap`%P*L&odUylqU{QQRQtC$gRx<2>nnm&3_
zh4TD7=>&~KLkSF&w{C50BadK5pV{bz-TIHuQCsc3jf`3X%5zU1ictNMa8#!$jTtwl
zDK_bsHF}_gLP>dEqt<?gFJiZM=Kbt~sjf$_(PT=)I`)ICe4*h4#c!7L3ora=7BEqL
zHs6lUReic0+Lyk!^NHK4LOr<#p4B0(eHeSerU`$Ga30H(!f@c2ZNfkveep~heb%e>
z*m!S0XX@jHi-em_fu5k|A(u%ZSZXphb~CkuN;4}^7(L#(saUBPhhjVPdGDMi(ac3T
zc3RbOr>)()bqWeY>Z+V~lCr~jzY)6LO*y+lEF>7NG__GZ8FDH*_8ME~ps~hCX_>*a
z%_Hic2mD!9&#CQZ$un$Hj<;GWCimC|)7}i7!&D3*>E&mbizaX0Arm4Drto`HkaKLm
z_DI@a4{@(st`5Q)iG>V-DD+ptW?o(eBC+~YDBCILRI9ynTQu*Rq#vKM%<J0dTvt-+
zdE{2^mnLwUrD84KOTId@`)SITqTF42aZOe`FS?xyMVqh8sK?Y4zdBc=)X#Z_dw2Gc
zv=4?Pre2s}R2jdgb)EUn>tiKlPQOj_-6}oP%n%nnPYDqbD!n@rnizzHcAXQ~%&|}h
z`<rdtp@SQ<UR_Prt4jk?h%Ym1-<&LdARVtVyZ9oNj*RN=z|oiF$zXTig3_&`8A=RO
z$$Oc4bu3rsFx}6|T;dc{r)pe53m6>;L<tCvg-nLMdc`JSp|7<6d$6$R(ShSvJ>Q$t
zU(cr=Q;yG-AM*?nl?3dOC8Mzj5I-NxfjD%qBX0Mb=YmF$PJNmvoJf(@PF}2E^;W~7
z9P<?ta3Lj@co@AdV86evdQhL0mU(M@bDHba7cxJ*Knfg`<K_o^S?g>{1w-u@!=p=0
zh87;)H5l#_A*TWpHfI}->#6WZU%p$xa5Qa8l^<okYJI7$%bWonQAgyQ-eMV|qT0J)
z)x;=MCAc*sPNajcxJ}vlwCC3k#z`vEcwX+2-cAF#Qr4If9?{TCvo4FKxoo9&H?P)p
zw*@{~&FKR7W4Td?k@)KLBU`a_F7Oy4@PiII-0b#6wjyM3mUl~V*!homQM8txGzJ~<
zZ=#o@d{6<}(d)?WyRy33C@E8U;n2qf+<xAKwukM&d6Qv}xJwVZko^y3*;3gH?Eseg
zTi%mrCQ7-ezdkV)Y(QLRO%=LkIH<j;+>}ckSuLDwFH^nbF%?=(aONWI9}jt)-JBvY
z$;YUBibLvt>OIEIN%!;?>rRcDen+aGefPG+7Ow?exW6}IP1%a(;tQJG`6l9#x{V>6
z{B@xaFQb9kk18?Sl0TeAs1MtJ8sFSX<LPTc3PAyHsVDy6D2UFaA<rsuShMq;4)N2q
zLO)8rn}+6G4*K5vR!l7qkF<G{jNsx7v1^%0>&tP+$(Ar~hZK<oZnGQU_12fGNVtZB
z-`E&R+%&RuEQrl|Alf*d928gkVQ5{}C6j=h@N{S%wca&G&i<Eg{G8AFQ)g5NJuq*!
zu<}bl*F@%G$exkVG|TCxziIaPGHQ3l1Lb=ziLKzZM^&_Ua!G@5mVAv-zV2|-*0MK5
z7*-|w>642dIWrp<98J3}-za0kmGC)FlIgi96!svsL?~pr?}s==#(miYY}>sv2kVs@
z{8iWSqEIprD(p<VlrCm;tg0Sqa)}i4E|sM}?OU0>oV3i^^k$zZLAmH~18WoiyzFZv
zw%Wr88#o7>f2Q7jIxk-0n7b*m%uyF)2Kml-c9E&fUAy{Pbwk#W{Y9&M{{+FS)HWjW
z49@`#9Hl1O_hx2xpIv8c-Z||^YFZP0r#ltAB}Ld-#Z>EMTJ&iD_k?;PZ0Zc|pOu+b
z>IJM+*QMF+x;meUPbD3nJ9|ZXGXBf8cBaCL{omI=J6$84b!iE%Dxpjdy<ac38Y*_W
zc*oI04<f>P%O1jsVi9=M109-QG3gEA%aY)Ei;uHE9lgL{MvM}E?9SJ9*~>A_UzrK&
z!|XaIgh}Epxg2^;5c7kIA9{+*wEeAR>j%QX?dluEbw6NwhumxwLs4rz{g}6IJ`R}f
zF}#;*VM%@*flYMFxYd(!5<{nrZ!55CqjCy7ytmNNl{1`0BoU|3i$eXFy=d_(Y<BPA
zWP)3&Tds^FhaGC*(*K$gEU-mT5;Y?cIP<MwW&f=HqrfatPlvnDd9;g6an*ilzT0Jx
zaAU}d;^ZMNVDznpP)^apPCaKsKD6<?@ZO+Gt?nh+luR+Bcckxe)%+(dVg(3F+Nu2{
zye~7e`zYWH3>hd!I3FxI^1C}!wDjIKZbeZZxV}M`ym!9*cY&jyek8otx6x%PA8}7a
zpv`9mJ;z7BDJQd)vx5HQTfs*0X3krd-2Q<<dOZ%lj);6yN~rPlJ?e1gO{LPuS@K^h
z%+utr5cP`LJv9AzL(bukAO2%GY@xjd_rvy$GW9-JCCbsP^V8ZKOF8~hx-9*|IAT@O
z>&C>HbWowJLH!BZVQp#DuM{$UC^|!3#$IkOZ%6#=Y|EATYuoSAO8)buW)R}ma$-yS
zWF07cliJn1^YJ!n?PaQqn<KABI7w*JnWxV_Ril#$?D+mZ9=I#!SE*U=m}F@VZ=h3`
zXF_Iw)g5De5L?D)5W8>|_3Du(mR!d>Nlnzr(jeT_%6^&pJC|?I&~cCA>m5pi#ZKuC
zIvLj#nU|>|hZisvt<ODih^zmC_86NbJ-TMcw7AyONOOyAlcp~^c;434LX@pB`3Td(
z>_Ber;&2aKr=u|^B&(?Vu8bI}qgOv^Nvf6oOkP1>EY2N$m5LXhFn{IxDZT@DwN{!d
z>yq#HZu_NOJ};X-dONDM?Uf-(=7on0XH-8Io98@j8hMVYS$T<*I=PQG(A$1l$T=5X
z^2aRw_L%f%MIFQ4`{u}Q@h?t4`+d=IN(d`KPe`n}aGe%E>iVWWf!w(-XP8UFg6qzd
z@!Lx}GxmHQ4fLKpp0;%z{pfmQzr`bW%A4WGD{R{*S)!qrd3LA#g3i8R{4qFNWF`a=
zZOAJlmz5=$rQq`Pth@JBGJLgESnZf9Yx55K<s)d*YiNZ|`(V{J$-pns*f;s@f^~f4
zw=ePg_q_J~oS}OCu~T-(c*N<_Erax&mwxJBQDH+8o*+V&SMG6C)IXV;FX^1r^PmYA
z1EnG*VacndsOy=XPx3tx`$4)+C^y`<D894`<B8yqPwQLCbjewzDn}PzG{Xk2`1jRF
zn<frNXQxM+xSR4&52L#iQIk1l@h*BTHjw4969MtjJGIP#xO(=pYcHqdwQ&iHz!#KK
z`FFo+?RwZ(wa<al`Hj9p#_9TQ$64+*Mw4`$SYz-V)WUq~DdDxquiv;`MO{B1%`blN
zLz~>R?h`hu!>qSbxK^JiZ&4q2Sjug`#?OIaLVw|>E_{vDsgA~FxlI08Ez{XshkDmK
z21jkC^rf2u81J-`QdrKYUI~ol51RRgK_=vU6DD<#s*rc-Yuw>hkxC*RwvN$#ZbpVC
zo>+@*nJt>KY%-$ZB*~szzLV5^CO4y6zcsTyP?r9nI=%7wtY09miTw0WqG?%qb)R&i
ziKn;Ka*r)BwiY@r<+QEZwR~qM&2iaMs(W|)Zlf`q80+}cqetYQ9{!%aO37_~2Fr&u
zs&%S)yQAvCE_axwmsjmMl;?MqdQKO7jSnrWZaAo_DlI7!hctBW>t6hXhULsg?Fh9y
zudZCHrW`$v41nt+T_48m96Ha&ds7%_2ku0^v+tG>5pnD4kI{AAa^^M3cq<=qzf#da
z6c1NAzKIn-=_<3}r*)!`Cy*m^KFoR9CZskepG>DZE?0;FM*rmUWNqR>GwPcjjo0V+
z94bjP=}lpV65X`B<KwAZug9;WlFS6(?nDw)RP8AnovO52_~rE3ag}A&uBpl5aQ$xT
zB!ytU#aQ85NACj)YTByeUt6yyOh2{x=1rAPI@)!+rslS+#<9}ec)>fwBWwmQhjo++
zTL*uU@`f^n`ImXt8D`ViM&3E24r@#>aoe)?#t<=llAL>4Ya%dd$jyKK^v-kN%#z;Z
z-)klP_MN?n2)~^;r!<SV#BEP3mB6|yobJ)69j>H#ykAE(@7zY!1)4)YmAC?-#{32L
zW5S@+WnLfJ0Q{axOMfyP-l~-Ju2&N^!FQyp1Stgf2$7F9oO`0JkS4F~o2qi$F}vSn
zC5>`)Su|tA&SPy0<9EKP%z7N#<@U$b1i+)Mu0@a1Ee1TC*paBr>t7yi-2UCNO*)xp
zcr>^W?_J16QmQBf^#-Zmd#?=Yx{`i5rb~vtPb7-i9@iDKmI@<`uZ#=yjX%cZllv~6
zTg!6HbloJdkhhh%gye2KeR^it+tx^Yr6cQaH^Q=l3c71D-n^<+{BeNNNBwc4zSZam
z5fL^WPYHAVw!KB1&K;ep_?#y6*;QDlb<yzbZ|MwIhL^g&*e#K@M%_AJU~s+;JR-`o
zi#!dx>sW?=ME-i|cp?p9(&|^bZK<Y9dY@K1dL3xpdYPV4@^~M++7XwuQ*{}{vI?YF
z<PFsS$XqQwUVrkXj~k~QX5Ynl|6SEQan(p%zXA6QcMhGUDdjIJ0V_NYck?^917p6j
zP}onbVjDtI$@<|1c(E&!-!4BNcDe}TAe#UFon35g=IfW;J-La4Ww$k(0=w+tT%yZj
z?PKdXfgDe!Uj?~~xIV^#w{@<fJ8oykAM??mD_KX@Fs`OPt9<H(hR%lyu=|o!$ALi%
zCna_g+TNu;o}Rw@Kt;_TdGk)aLFPsN8}T{I1k1-P9m8+m=iM?g%GH@_nMIb#w&32a
zt>;=jNzps<VSBtcz8njzYJGP5&6uV{y>pOB*SGRB=*wPDZ~e`Fquc)D#xRy}AzM!H
z8F_Bo#uW#@w|^-0OuU$izf0ko4Tf+dlJAV<a-7%aq1&tKR9CiOan{G6=@*Weu-U73
z1+3Rv<P>#hdWzg$`#n+zM><6u*M4+J|2CSJ@{N1djdyh1F(o@D>5{?d00(U!?{b;3
zL7A;nxxQ&|ZTIr>xfkQ<EYC$9iK}~^dyVPBYm9H2(s*uve-iDcNxh9zr|?NI$>Uh^
z&5-;6h5t>{#+zwMao|%4erw!0CEQ{fSF8fFy|XupuhaAP>5tRSdflPbbwt%zfy?e|
z1zmlx75Tz{z4W;zV47Y9yr>#4$@_iaK<VrTWIrFQZ|b7RXo$R${Zml6*zZV82ZQ`v
z4;nC5$+a{&wPQ@tEBADTBZ_x#zGb|F5>9_NS*fxxPo4$yLMCNE97dLFaA=RJ$(X9P
znG<BaUh(63EK7LXDU|C`_fL}f$1Zw=6MFX(F5uS)lt`gaxA-+Te=Q?_O&j;N99`T(
z_2i*zlj9sMQ@VC?jt@P_3f+5Wto9_8=H}~B_AS_wH<@^(7wVBu)#rR~?7%N{imx7Y
zQ~xXg)(M-cFwsmv!?|m3iWY=4#yGTLCLX~pMK92tPQD)qZgm{Y7BiRqspUpJ4@%g`
zFWxbZp+u&B68uYbFHNaMnd9h)mJ5Y>EZ-TEu+&4+GZA7uZp*M4@55%yYe$B>NR3;1
zBGvdZvsZoY2eKHvtyvhAxfrBx@GGG>szqSK^t{X<eNMCI-i9Wd&!0?cLjr1sr{0sJ
z#qMg3DpDVN{E0TzM9_GLWtd6?H-tCO;#}gRMPEX_GVluaTz!Wn^{Ul_<C);n>bD>r
z&Qq`G2%1aor?p_tSwE>VZ=?UF=w_&yL>nLzidP3w#wp=Yv2;G>;txgqM3WCN622$S
zvl=hmazpJLiMd>lyv^1)yOVLvqj!Nnpsp}~ZSF4LIjWX3L-t)?7<&`WZiv2X#4c-A
ze>N5VIw-@m4s)g6`%WIb!_TffRAH}pQI@#k7%qJS%CTk50|xVtWA7G<v*JaJB>te?
z*MQ(<B5&p9F-a54CF}YNc%stoJh1DI>iXu={jh!cB|_pdsdr(UZ-brOlSv#V_AD&n
zP-*!l*Tm2$whIZ$PH(hBLpqstxMQl!BeLTMcLeDheRwPH!q%Sz9$aAGra@Zw>Q!s@
zGWp7`>B$tl2q^9*H%d{l*?&B>wM<1L1hwE`VzRj6c7vDGr4b*|%htw@4}M%Q@>4zi
zjs3_e-^3tct(DQ}*H(NvJ_&xqrAbjqH+>Pb^x<vcOXSQ~h^w$aIw}l$U%;j%!xKiK
zf-v4S@Sj&(QF`}%ZzPN8aYOD@#Sd56p$WSjEdDdX)W;mpFc}}Yoi&SsMY*<QJsXu=
z(;$m493AwiWFu10GB4BG@qX8jy_wfGNVv1sKF3RWhVRr!P&K!og+t79s~Eb^Hi#qa
zJ6z9^4*FI?Tx*xq{@Y6wTMRW4)wr!qlxA*^C$?yoj_w_Yu(x+($KtEiUbX`3nFhQ-
zn^O65z2`~FT?_M*Y(e+o*Vk{Dlr?rHUrC=7tZ#bBp=Ll^BQw>xNkk|&n%t}8Pjii-
zsbKxRdXnt7;P;g5_BTl5v&IbM4};H*r$hEje9Vp$H!iO-I7uAFH?H($AUW^f#NR+$
zsN0f-(NQ4CjmMo^S>U|NBR4A%w7DBQ*23v~xx&{EQ1{0NsiG6cPrY0)r2SPrV0h}`
zSV;}{vOdnGL0;G4Vuc`#5vzCC_`5Rste)V0ER(nSs5&YAqquM*vg+qEWTk*3h_d}D
zcvyQ}pTH`}D6-IpKAjd^yqhZtXIad+x?rk;&HfbkuHP;qcC>#O8{0j!2W3;=52^mB
zz6S;>bv?hi!-b4;!fTbKJOv2Mv)7A~i&Q7iU^{$qhYVnj=IUf^1FGm|$!V2VvMYAt
z=+GO^X$295WrQLBmHT((&y3q``P?nHrfPlaP;+t5ML5OC>M^G4%36tf4EMD6FDrR%
zT0%RK>a(&wuO#{cZ=5C{a6c%Ps>XVg|IOu!e?@_cLn5wHb&dUAdUokjnMPmW2%g$P
z;yba{h`mmFn}uJyjIoLOQ>1)?=!_nRTS!Fof8uXTTn4V}as}77<!SX});IfielBk<
zFfMb;OvWy%RP0=W;B=9A<M*!!e>>hD)x}4#vHBbzqEGw3GEs<LmL&g#Ri=}=*Er4A
zRaE)eYm)HrcU2CGcDbZxILurbNrhC>-71pUUL@776#DoV-~TweXx*DGb;)~g#!z#q
zT|jGwW%JTSxoaE#)6Oq5w9DA|&G;?G2XkW`(N*Cl?DQHtXNxDd9S-fLvwT?R;o#=7
z^5{f`yu5tTpw^<|7QP>AdVBkLzcG!<vZs*n+S-dl(9sQ|w|hn|T&Hn6cTgz2!bHq&
z-J<cIhE*sX?QL}4)1I!(<7ssF9FC_qhoE${B$z>a8k%eP^hbf|j_>TtmZa(4iR;Bl
zg&F<3B}@EF=D1URL+Pc<EMvMQH)+0JgU9*=-JgLQA4*SWXw%s8@N=3*)Y|s%xtA7V
z*i{eN9NsaVT^tfb%)FdIg!nSvMl*p@+Frv^pPNIQcHV{i<Jj`r21IRHME&8PE<Pw|
zqVW9`K*g`z_w3s4V)f!uoU8bb6H}AkUYnWyRNvTaC#N#i*AGaVCP0!YHS~6_)0tJ7
z;*G@l>&&;fyXREt?3+dw7<+X%KCF(d$*e-I8hfgKTW}Xi@E%bMkRc&iTW`>P2riI_
z$)k#Q;1~JiC-2xfj;K~?yPnH@q|(Jxko!nwvur=cLg{QNv0B7&*wr>9Gf_UZ)QdM4
zeCv@t%629`YuK>qBKERJ@#w6U`sceh+}7?uc%I3qhfmG&{Nm8vk?WZPRB6~AJcC)=
zk$;Lwv``_^$i3A3rcE}!3e#G_J-RNdD)A}h+Laq$ZJxM2tG*V?ULc`)$}X=9>%v4+
zq9~)SF5{epIaLC#a$@CrVL8lR#!b2N0p<JrJ{EPqn?*GQzJ*bBQc-Gp&5!J3xZJUB
zptbwHNQ8mPJRZGEDPYykbQ5#oV~?GOBNc@BB4F$!L&tGDj(cWYJnTkyAd4r9*u%G4
zf)ENN#Z}JCd`lQ&ISBh>dAVNre~nAD$xEyEEV+B+_ulmQ^^h0tt-@hAN5?TPf6b(|
z)CTkSQ0Z4=rx!l!jeMGQsnPg}aCPFf_HhWv{UH|CNxS_f=;Jh4Owdw}y7?%#c=|iN
z#XDRWC`iWH;%uZd+*I1(x|q2b{_RVtywwL=5hM@h+hMWl)QJh{emz_sM|^nMIz5uG
z-12*TnWAgLrJGr1)wCKijIUkn2l((};oXmQLE;13<@5b3=e)7;2u8a)-QsxcaKH$V
z#N~oRC4+s;(ISmD60AZ}Wp&o45n?SjEaZj899Z*%`^z0W+OA*jE)G9s)S9P8_NPLk
zvz+^!g}=zxdwDy0MbV(ucdi$ET&=J@d37_mMUG})H)n=7AjqFsi0wwvr;MJS*ZpZ+
z=@~^Ib2oIakL;LAb<S1#JJ@4fnf6(l=daw*@UeJ+Ly7(2c&byYKxg*Dk3OraiXsAz
zP+En}N=?29wkWR+&D8p1<)d9^NV{`qwpAt|I=>28C=xzH6mF-^z7aNU-e_Z5!fQu(
zYHQ3+-dZDb+SWEhYcH~Dl5jm;MXTqRfJxXjl2$5Y(~oVxoV0omVpJUtPM!8xigyq*
zcHX6F{JL>$x_SWD6}#r14ia3)f`Iu?z@b*H=_=r~p>yNOZOobmbMcy^8TZL-c{4{8
z#DjmzC}Q!urzm=d`;+bL(O+5;38;8bNJ0lA%u~3)exz?6YPl!x@9x2XLSEyWQPP0Q
zorqF1wx6(H{Dv&;DZJQwDr)n#La_JbLITTmdB0{&rXfdM4@nXGkIS=LmI2TUsT}^=
zz~eM)8Z*1M-3}acdU4B~nqk8dxwVN#nEbZdWgJ5nxi1(jdRH>5QYWlB>>be1D313t
zV8~v7CLbXht5bx#(}dmLQlq(7#5nuK%#%6t4PVu~D|WxM5Z3NaTZlO`gW|$W-Vas&
z=?}eEBoE4;^`7sevC!I`o+qU4**MnVcwv%S(|nJD+7rh8^~oYrAm+l0o-$H%!XWK3
zCdKE9H>+GdZsl9ISdM+WEMme*#`9dKfXXXyo%i>dg%_&28fjhJ4~otrj}?{vAgZ#e
zi6-WCvV+Xmk9t1b+RtnHf`g&%l-F@VXE4>{<xktZw(3<*F2Rz?GT4iVung^B_4<As
zcv-(Aiv(pBo{CxlVoT9@s7TJl*~DcoZ6OH_t%T1*RcaxL?ZZM-HL_;4zgQ;f_dj7E
z^(|?e*7!T*p*eo0TdN!4a~8Anv$>ArBCX}_9MaE7CtdSC_M4g-yC>gY+Bj0^XUKAQ
zds5yJC2X;}PtVdc;^f+fzS4Fk7k-hNBmPt_S#ne*tJ@~M=jbic@CkN-^5llQW2{ql
zx3mWKz4UvB2~9fdGT~(ljKsKDOV!f`6|3zYsJ?Pp8nq{{g+}IlS7@;g+=lj^>Xj%c
znLc>k{-#$j>(xh5f}l~4jyBorL&qKZ+T+C-8H;El0gujC=LneXg-Jq~zjL1R!n%Ky
zDc~{k#*E;qd3fQzG6nUI3A%O@kZr=CMcsO7yXiQ|BX)rX{abn~B5r$i^sY`BI?JYM
ztfy3OfZtG(DjS}{NTb4_hMKss>1CmFY}T+s6J=X$Vv&tD?<nLwp5xiWd@4C@Rzd@F
zXUxs;n)U~y60_7b4h5}-I*O|pV@tWr+ysyU<hRP3{ATt4iFLm)SdzDTQ)B!xiD;A@
zZ)Opl@Qn`~`<2d*^86@Tli`rT%fqrsQunHH0{%@x^9<)icy%~|iH&EO#{VPiEx@8&
zySCw>k#3L<Q9)?|=>`Gm5P<<yL}{d@JEcWXBqaurmKwSdR6qwoI;4h<q2s#-_ukKb
z-uL_e&*RvKTSnoIYt^~VwNC4AJaPeCMPHV;H}tmQx7_b}Oe(g#u%iK#Xn^Hr3P{?!
z@)ZeYN&BX#|49~WX%=AxUT&Vqt-}t&7pPaaa(RQ{qr*a_t@ES@6W?F`rmtO-r7nuS
z=dlAGpN$LaZsg{v>3WmHne=B~lbci6Y>SUnQ}|eI8f~S}7N+Bmu9Au@l!~8R=3R@6
z7%@tu134&Ok8~02$pGB-L}}`qx2Onin>z92Ytl!THBScn;>D^%Dct1y4$15M_AM1j
z2$JAbHen|DQ2EbR)&phZlk*rwtVXO<j){A49be3NPf8wi3dEjsuJ#a4o{`5=Bc3l4
zQV`XbzQt|2{@o~z8yEOfHrSI~-i8i#ywKUeuHCKHxtFk_QYGJ}hsZ=26WH`SySc>S
zb`^|u5o+TU>s0m}D0K@-`G50Tk=P6wvr`?BTX&eOu$6Qp2EM9A`tk{u2}t6g;o%JL
zt5NhL8EWYCgu>M~6De*V-I7V#${!2suZIRi;Wi<tW%(JAM@h!EdChiN$h%|$=16XI
z+=itg3>mU-4J(utzk$Cd5v!3gK~juy^7oR;Jqp~~UOlrFNc?o{>&b1Djqt@8$Z_K(
zt}T3w2H>#=oC<H<$dPV8!$eHU2F1L`E^KhXz;9x0ypDbrrO!$oTi=j+unBRfAa%tT
zqH9kUy9@ps-<3a;l1zT9K4Y*Y3K{^sF=cV4B(^j9wMcQ!oQ)-S3>$-urLAN*{^-cH
z_0Pn~drPtGvdCx=#&|d;`gtQCKXZxN{<XRSD-=|Ns<kA)O$Y|v{}=sOg%MG4@o+{Y
z5B9CsPcuJV&3HHWvwbn?np<@uv?UnrY(HdRzYf%WpsDB^KaK;du0}Pn%dW3XF7qsk
z7xG=DX}L19xrKf{6XEsE*}t~#_@t^KzaNJtCSBj2f5*)s?JdPbDszG7o<jjT^T`+b
zX|}#_TTgDGMTO)RMnUyF_4!qfl#ZgeY;M045#it^*d(LE4nHjk_XdG9`SLq|0Z&IP
zv><Zi@X4SNAlC^Ns;|<94NyC6Xfstd7h_tG>eTww5$@8M^SD`G%R6Vx7<;vK(~lIu
zt5AA}EAMf4vs55rBjnd}z9pzbWgk?@9bY`TqfTZuW|^UDE`mP)^$BA(AAY<;{|pYB
zM$(QS%-2%-$%Loyz!#!>1cjWnO};Kr9hdkqX7m;R+Yp;5fFaUlQ0SyMHIV4bEn*}M
z5hWYLWruFYZEn-miemTt3;-KkWYNbEs`#MD<Jbq>L!mmd7B>b()1ZxUGSc0nb?kqk
zN4i=zTlf`!z=cntaC+hUR#+CpAX!C38yC47SM91S>MB27y;xr2Pm4rS<hBceAnEHj
zbk~|3(zrFh?^2>ocw}g`s4K1`ym0g-H(R~w;-?L}?Oz0i>Ny!!L$y~k2-Jv?VZMuo
zvxPa%H$YR!nM;!TH9Z~QctBVnsh}ih4lg)JMdB8$-!fZRt%<E3dNy<u5+{@0?;<Pm
z3v`;janh6j7(XZvx@-B2R^9!pmoHD&-sUO##(<AfY|V<+8l_%*a}P>_x)#lhT;sG4
zE9ed(-l*zmR3a^Fl<6pTs#a%E62_i{%n!z)jlA@I#Kh}ysdiEbZZNRpLoG%=#ZF=S
zi_9ABG%UGV2KmplvI@5X9a}wn+e?G(TB&-ecrIwZ>M=#^RC3?rT-7I6&cEmGg+Afz
zwTs#A4O6tvU5>NXwrn{Kq5thwh6d!f?93@aE$$7D7?SC^zt4F=W~IP<QHH-O+pS`{
zie0>#L%0QZ7|#+;t5a+BmA_C3)@Wa<$}I-AB;m8lqj1vTVVjNwg(EttnrHs2R)X(z
zj9?uhS<B2)eCSg|o-mGlHe2|`6tgU-Mb4qm!@BWd0~Kg?VZ4<`evkC3o;Y>UO_`yY
z*ceH54yC{tOBggjjI!L?l)Dj23%1zHEiimvTdk?uY;|A0KGN|+9si~6BME-mpu&|8
z$FVbaMQf?9f2da}J82D+^gP-T_51Viq3xi7nIH8cZcD#h{$a&c<PVQJstjXam5#f=
z6^w$G_CIg!`RKewaB9oAh!@MA-sSr2`}5w0wF7MyrtCyW7tj`RPe)d`ym>?Cghady
z;rtTvy}xHgSgySF-4TCCd#!|jP8eZ16a0$&FrQ}l0s&`E_bGFb#b)z5SBn+xhg_q$
zLsinfQL#U5xryX2snb@THYg_IA5T|Ld@hY0wHmy2+j!~w;c@Q*EY7!LK&q03f#H^)
zsb@2l!LZc$n$p<=12-Om0rQFHP1^_T)o~`cu(8<@EC_OyXSAN9YJA|C;JXU{=`u2G
zi<#bf4YS&G&rcoD0-g${mKLCQB<05jk$s>O%n@$ty_PMscWiv>yhjAF7+er_KRJqk
zrOa;RqaPPk%`EK-s?0vT03|SR@OeWWbnJSLP}&#p&V|w+@JE?#XkWCzL_tTlymut?
z(+^TS%<cB@_u@yxTR>O^tKdnBA7A3?grF>nI7&Id{TjqOweDicykXt+`iH9$HJP%$
zO*jxT?=JR&5&LJ;D?3~I?@tcT$mn^`yXfg<sJUfM9Os;!)n3ebKB_f4AZ^f;BZDNH
z-#zUJbGKuU8+0g6h=3=k++=m>Z;?m4ziVt|UqiSLh75b^6fPg7FH*#Fx!KO;BN{bo
zqCi#f?XNhPgvtk^2Z~M`w|uymk9LhMm)<`W<#wwtLZbh-i^Jb+72%8K=gVg=H(X4!
z3D=G*_C1>5S*@5)R)qvqJ#&MV6mRZm<lR>mYF3xI9#)`QmFec?V-EYe@~&s!<Wav5
ze$)^H21JdI<rRFJbM0h{6cUhhW1z#X#`P#)H;)r{?Wm181G5#zU>;;T)aJ+;7buH0
z62OLZk;HZPBSBj!=Ac%)UK)AEl3AE;OMl)h8crwm>a@@B0yDCb`|IQ3A3xp(=~5AH
z@%eTv;;D{ILTYNn_I!^zR5^38W?g};g0hQOzjZ1SzR({Gt*Jni{pvbI`iFOIQ9;7K
zcz&^d#dGp@qh%1_K7BvBv_2?Lv!l^TO+>ncV1wP0LdqV(^!6W+^?QnO4JGrGMRO1(
z*@NjD>`3t_$Vny?eT~RF58CzAXFf?Y{SQ}vnR88Cmvlo<N(s0j^$Yv6{Lr$c=s)N2
zei(2W2aNF4W><-3pW``>ITVV<PF*H8%fkGAYCI%)tZMSo!nS0Ykw|2Etk%PwYL^4+
zVLn-?L!4<r`~^2zB0+2OTSTX~G;M<;hPUVG@C6Bnpdfxq9Q{Q0s<d}Lrb-;uU7T(R
z|I6*gZ`6EASm%0yMUw%;gB%CZ5#n;>fXmq5bAYx&aSfe%O0&>n6Q(C54Onl=Lv>Te
z1Zbo{U%Fw!ZH&wni~f`Pv7Pn=4LCMOyGu{nL#`Zxxe%x2LAFA5c2N=cH6v4(uflY9
z<F!cLacW7l4gA>ZY<`&)@RQfk-6X-^Q8IcCnVah{CZ<Lm8~<K<lU=Soa!nR{EpEd$
z+<evbK5TTzg?7vd19*)1BXg40Dc`g^Cl4+CPHLl3`1^T81cYw*grtg|o)BL3i05u&
zHKpEtiDk14RFg-?3*4+THm$D-@4R2)I8$s&P=TFQ_!=;F=z+JB!<%(`5`W-3sR`4M
zln%WI?T<jk5y)jFjO{kUD>Gt3%y^d!%-OU9fm&@Sl(?$iHiM266QZT1b$E273Jn{7
zu?nGnE`1++Eik7v2Nxbi|6cMX^VF2toNZfMGd~@2aL^)n$cRt6bn1P1$Xh!1uX-A>
zgk5P~d*Y!{OpgNyAgWatQ9Bb-H@{9z{f4VYp>A^hoL^25nsf8^>?J3giHVA$hdlrO
z$h&Y+eqJ--GY0DE{spA9FZ5HS7jgZ&Y%X-DrgdIL6HP{b(PqKK=Ds^sxpUo?8)>i~
zu{NP|B}WlEuw-HG^S_Wq+&wLyh12xhAt4&bDDik|eC?|rO-Jd=qR+T$L4|caWje4?
zj85^gG@-M&@%W?l>9mj@9%yZwh3kqbm&a*?%W4K(e)h+a7}}BauK)TdqHkV)k@nLu
zfcAIPPydw>i^`nRF(OhvoW`^9mQU0=&+6^}?-^`LHzm1hp*i5`XEFKllp5F2$}|g+
z<|7j|2S#inZYmvEc7$4y-uQZc%SU0ZVzWcW^_Ysg#p!<Il1oUZ=GxIJ2imr5lu@Bx
zjX>`R0}_2MOpd{(A(~!TEXZ-Pq-(h$85h+~zg_1MaDzSEnoQ_Aw!(G6&g_jPUC$yY
zf%=wdp}IXS02s}1{DUW6Z+<^KpK?=E^wk1LFviLJsmr-p#Cw+M*4Y6T<RByPU0v~4
z<HYRg+_<vCMdECnr^3{FCGTj&s>C%A2P=Q+;=AxBXgS}q318H#pP!DP_f=1FFhO5q
z&eX@!zE?5+Q{m#lzA<gRxfuBL%UF{~##B~jvOfp%dXMX=juXXmCm3(J)&DNVz9mU$
zZs#Jz3HYX?K8d-dHPDf~+b6kSwMX0jkcu$-WI_JVZj<7d684!|?b`h#j>lz2A(ihZ
zdymf-uCIoeamz|jyr87vu-PloJ_`NxG8Xqq^&QclHkgv{{8d*Lf-82<LqQwTX}`Ci
z_iTlSE-JQK9BR~l|C**hcJ{WO3Gu7T$m_+SP*0wDj)EYGtX`?bbiNKv5tEv8tQvD#
z9L2FSbD=spPYQ2!a&*tp9ijZV)#qRIRaoxC`2QmrS7iFWiK)Nc-sFRR<DWXpLi3tw
z^4~er5ijX@&k{jepS4=RuyEy9R_1k|kELcG-VMsFyBXIi5)M0+kLO>AyO+A7l3LXN
zNMIzV==ZfR%2E(kZ3#>@J{g#g0^K|GOn^@2)2gvfl@pab<;P>`ks95-pmFtzM7i&4
z#ppq%<Y~D8!;2>hGud-bx)4ee0+Q4pw{DI>NGDT3ZH28F{Bn?EKSnh&;uz+~kR_78
zw-Z>FLh2Ko(_ra4fcy5^HkW18{#mFcX_&$c0~L>I(`B|axzK(jzC9mV+g&RzauoKQ
zD4k+x?YK~pX)$cJu#p?fY{|^Ia8+O1Mq6fCVDvO8k2fs>_Jc0V9V_kQlE?0y{-9QW
zG$Dwb{Fj(Wv|6L!$FH%v_441gUc=w~)yb)%4-!{K+KgKXweL>!+n3HFTTAuWokfYX
z8v+d$NzoMod?`r(gJi}Za^8^R4k=I%ecb)YQH(c7vuZiJ@5H58;ya-l@vAEg$DLMc
z>+9m{LfQP}Iudoz0B)lgS$h%eGr3kzT=`&Te#YgR-Om&mfs)s%KW|UG*Ck>h|Mg_V
z{<Y|&0KzbXgbf5l32Tr;OJZW6EP63}Fr=@nn<)pNT>?ykD#O+O2}2I=(;<cQrrhE3
zih+;<8mY!_&4Y^+*d)YqqFHhc*zqrjAF(^jIFM%%005?o1b;~y6Y1=||9kjGfE6Yp
zC@6}VP#eU7J0Uot<|ZD3i~(EY;h-b6Pue)o%HS$t+4ey0x=XYpAKJc<!N9!ZQ7(mu
zr`rB=%9rIxBf*1)J3sTI<b3z4$Rs;1pZR!i9&eTqb}>0RAKw3A>0R(tE4%=L-7$N;
z#|M{4848v9mQlEzKu^Nbr;_Ea_+t!7;C1Sk#Y-!{FI3KyN;v+@gBAZxM%iT%c`Oz4
z6R)*P<tP%KoEB0b=yFB>m%1s5*4ME-erQd`EEjowlQcsXLA6*p(>srfT^*1*X~@gF
zwaP+Thd6L1{f@s=V7XEYYkM6D`&KZd@IKe;z`+OjySoK1wqAv+8yX7JX`!N7C2c*w
z+49xK*2PEX4KwleV#HHD^WXC5ba=9%L$8hCX_pmDYkCMdRzf0TK=evMI)u}cm*v-u
z9KUQWTv*MVMmbXx)AKr3H!k-SN$yPsDq;w%tk&XUpv8UMT0>cAfAeH`<vj@qth&?G
z4S(`-@UL_q$fM8qS#MT0y(gY$&NmC?{pL!;9-5~s+rO&tDmFGYAKesHgNmcr0GOK6
z{^K}x$s0I(p%mGF=jQyJb`~RC<fvP|yt38lzIgIe#(+}IuD|x&d99L*6bte#V|cc6
zyWK%-le9rAyLpN|qqyYVwI&sGrE&sNw#(-rGn=hz(btX*Y5nQ;_U_pe)v9@-1!W&p
zp8!M_7&kutY(DHa{Y(4n`t@;envDH!UX3<_xZPFghIsXHtny^}fW`2ac(^lr4)aKX
z`%wk8W8!(jnH7Fl8Y_`st2N#+OrUmVgvAU8f{xx0xSbwX($Fgw_spO+3#x$y{Wy!j
zK|%@X(DqukLy}OtR_sD`HneN^V`bx{y5UYL`)Coz4w@24*$_=8DuT^zPP(j)bh0}U
zLtOm=2>>qtUcHzhGO;kuDWsre<tr%Z(2SrR!w&O*<C}Ku?4S4ELJUBL?3P}jiAukq
ztAu%X4k$dn!45on82gE170@z@BTTMNm3(@y;M<3hk-2c_{x>}c{$Q-)y*0%pW3}^J
zsP*Rw>xd`uac7u<1|fjQ2~JW%TGFlGbw`B);Ne}VDeYGT7ffX(0>!n{x4D*oyYW8K
zxiD_|$G-ssC-s>-sd!SDy}#aSD4v;QUeUJyHE<6qUknO3HpL0-x8cf??h8x|6>g||
z+q;R6rJ4^Vu_7bM*Ef`fuYNsTSibsRs@O$bdgBf1o10NgllXI7h{-oX?Q2ckZdcJq
z>o;!WnWTWNb>iU*m$3UpDifn*2!k}8_x1tJxg>$JQ(HTRj|a7hCH0$b|IRV%Pu}{(
zwv2n{dCDGqOW!ORqs)b`V)b<d4C`1iz~+_~9?}`)%o_4j{qdaV&{Ihe8bHuiTCDY_
zjC)ujf_|?LA9m5*)ec@x)eZ^8`*e2+<oY*nBW8n2af4<~jlZuwOLNc6cnL+04~leP
z06zTOhf6d9Va?2q6L#OuTZn-)8K~9^kKD~8(KEDjaQVRLGRjmQ!t)xg|7?9te7yvN
zpFH6;xE}8JC-;yPro~l{8SJpG%QGi(Gc$n9@8-Z{@b|TK%_k*>4B*^HGUb6pQL}7h
zM6}hWy4th!uLSYiQrU6dgHqoy#__i(Z9v~cySW@`*?%xj(XjuZ5r1c^uMkfu$x-6Y
zg@n(e2ep6QfNOPmRb>Whr*Zi4KDa4>3UnlY!(TOgFg!dgaW-P;DGt8E_Q3Q@3yz+E
zUC(C9@ecGsitWYN<!l`}>ank&WcBiF^1(BZ6@$CvCpk+6PECi<%Rj)lqG>m2kAFN;
zMl3WqmQ2`szbZZB1X!~uu@(dOBMJ91M9QRt@3yTv`ZX(_sbmsr;oN#noi^*cLxbkV
ziB0531-|GF-#<R;l_uAT_VNvgDw@}QFz822Ytdgv1ANgO8`yG~`^&!z<=?Lo;BMJa
zKr|TJ`Ej9#-+ij(eaDX?a|?+|vgdV!8)BRzv@JE4KMBECN0ISUg?Cf<5;PeuBdw{|
zEDi>kNq+xNg)KX85O#9TOGnBAx#>t$q4MFsVy8(TwhL+6<{aZHJ=xze*UmWL_{Mxr
z)N(#}?68-j@sdvGiGy|JLn;V34?)1HKwCK+wNS=`4%p=NTx|qprv+ncGk3a5LcfAt
zB{u8O0(hAzi6&^l>ad`$Wf8qbdmZTyBX}_1%Bo6owv($y1HRZtgTnEJ?49$V{v@Z6
zAphX#bH(l0r5y1<!Q67QcMo85$bi5t62{*Md+u-6f1yaS$o|#$(&yEe=Yd`HM^C%n
zTLG4$(}nnlrsL*0(#~QZ-(A&B(NIJz?VUr0nGg%@0Qc!-UsRwG!4u5%+~%y8zcQWm
z93l(CTk#M4YB4gkTG^XZ*HF}MR{`zg`g|?h<$bAs<OAd;YGx&dne3DAf68iG7E9pA
zb?^l0k#h3e*S!x{nD8DRn)cpFf|SM6U@6L#L%=8r_ksM)UqpxnHQy`HvS!BTh_`>v
z0Al`F+mjmr4<m1vOp)RMC`6EY5s6$_s@h&>N3POksbzyWJ7tV-WP33oL9&y3f%i5X
zC>!3<Z+~+X?~Qv2wJ0h!MgBu>u@*J0ygK`G<LOOQgXur0Y`ro3U1Y=rHWp$E1a6eU
zQZ_*)9t`|G+qU%@ouNd)ydR>6E3B*2^t5d(?vJvr%x~@#5qYM2e_klnyBv(6`;6rL
zlU}8onMZR6lXof6UOX1MtmSM`zCsjy=Z1ri_2#w)THrq4@JpmTiHT9+YU^Am9#*ue
zvLnxqL4Y3WSY0Eu=jE9h{8Jx8-par80vAVxh2V9X^JG)&CmMY4v(2X3%`UOqzwNWZ
zU2nss9TSE))Q+yaP%G{1EJoe!K-=g)7AZW0*RH3upy^3n>TdlJP4MVlSQF=DM_wn=
zmbh0|ru4Iror(s@im&^?MF&7eoLye8saCi9hlC<t5y{VK^I&56=JJ+2bW2{Ep=`?n
zb9>;I*F8Q`t*4ibj9=jH|CEhYXs^m3AZvdE#6T>(9c|r@De%`KSAv=(P-_pFf`WVn
z9?4^}Y@=x!z?}O3nsyi(*gIWR5299^d~k`(Iib5RLj!6J71ZQ9GP5EW$P5<E4}BIP
z{sHt!1w<=vT;5CR1qS2oh@Yo6hk#TFjk_fHC`sl3j!(asnmW;4PgYV0zk|>1_I9k?
zW)L0GzaRmPB9uiFDgcQ<F~y*hj>a@SE8f5dZPTox3k`Rg|CoW4F$ZWuEs9{+B)3Jt
z;l~bX{sW{1ARmaK-}Q#bI;~-QdXYM<NO4b-6~yUn9M<+%Q$O{?f!sVnd8Zbs8#CU(
zZ$0-FyX%slV<NwJe2lwot8G3#xNr%LgW(s&GGgG<B%?%H6%O*$(TodV?zygM#^}Lh
z2g)q>0)P-@7sIT#Q80m)aFG=+?4J7pj@qsT0|k3Ka(i{-rp(ix9}D4(wBMLzw+mfQ
zk2{LL#`1Cfe6kdK|4SWr;gSRUr7<R8d;Q(tXdGU^X2j0JU5wyFzxqUcEQH7>s*Ix3
zc5;~&45GK&bg#{to&{e|HpfTTSMG<^biVWIcfEfLF`jKc(Gb^jqZTI8xvcGuBXFNg
zn<#%2T~0;^{kXXUQ;;kDDT1V0u7gcKk#t!#bG_N8fb#rW;yea6R4ZG$JXxz%s?F{-
zVIRTl!4ReC6Z|S}^96w}_`ahTyJdBAef_z-)%^e~V|#ysUzxQMa2-c*TCvx%>16ef
zho<Qet2%sP$tX(f915zVq9E#$Sb^|K4E5zr@7t2e51zKJPN;(>;m=F=@SC|XCL+Rk
zQRK7kj{Ro4#|$>&{lyj7xqo_w7C7<_4uwA|K+vq)`4*SGLukG28#D~G%M@T2Jg|?_
z7<ZN%mU5&pF<NFJkhc%+&LlzJ<{V9{*@T-%uU@<hex*e-zcvf#q0a`8WK5J}oD9;1
zr|mD!rfYujofM2?7{Qm|CN8ro=n4SJn>BtVo0qh5rkIWJEzTiv=of__yTa%fgpv!C
z^PB78yrDrS{UE@UHwpgH@3R%9w)6LEe$3><QfcjQ%75lc{^Sd5Z-W2@7&H&n&UjP8
zL_t3^EJEqhm^mk|%c2PDiKOL*;@|cMBEJnB%xBo)w|5OBS;<6$cxdnb5i}LF_ldD5
z4*<|NVCD&YF>&lb(>yETJCcXX)gY|A594m~;h!yyBL^V1->6f%r_V*RxxiA`i*#P4
zjakl843pJa94<`#?8oC>TDOJg1h(tu&#^Ud8bAC>M^7grg0jkG3kC+5iWCrsQ&p}8
z{>~fP=|7fI{Oo%lI)aJL|HUZ0d{3qwd$6kjz>jYDjKvdP0HS#LLg~uU;3wf0H*<ne
zM=U@Y?2*C%G!;z+a6Y>X`u89A+)9E#0J8c1u35w^2YX&=vtGy;;}X_l<<Cu0$iuDS
z)_}-(oa<E*=m94fIg5;NV&Z(l+ea6ohCe+FAOUhuntnx&DcFf%ERhUH9xy||$FuW2
zrJZl~ivA6WZDp8gf)drV2U30Y=p}7%?P9xLb~Z)L#}<q*EC6Q0(agSSQtVgZlG_gp
z0{E}F=jcVeOEVcez(N!$U-0W3V*IQzNeGRym+cbq#w+WA^tL+&-F9M}5q&>dh<;|9
zU+bUHgBcAKFcA<SrTF!@lwh_)AD`~`71C-`FvX-BJcJ7l|BojpkeSu8?)MV;s!+4C
zVcT|4!-e|Q_CpIm`G)+E89MX1+CDPE>(+I}l)+WoNBpA~fu6r!ho^-VT+$G^vSx!2
zdGK#ekQxp`HkO@6Jy9Ew`sYq;JEAdkP}^mF>Kx>>%~n$yT(3WjRLN4uC`tlddxB}2
z20e0q=F0Nb(aYC-_NE{O&*3F2H5g#v4TA;vY9Q1*q>yIK=Qa~NvfPqQlDWKj2jm~M
z-}rt9{g)^c!Za=2+BfX~3<g2z9e?tMaxQzhr-PYlXCiIB1h*pm0AGdNA<^dFd+)SS
z(M=z!_-yJR<J%`}EZbpvps%ta@_y``ok*$2X-@G`CW-cfg83)M8G{Ne`CmW3X+6IS
zX>$tr^F+&(x>ROnmo5T$ST-nFmI^YGUo*yudE5ugK*m3bm(Ts?adZuww{gppro_d%
z4s@6SW#SP!Q(<YNTBe|;-j4~-=Q$&B?&=!<QPA;2`5mFo4Zf*YWf?Jn&6TB;Lh4%i
z+F0i)<7GViIwy-}$=>Vfh3Qa-?D`Ev*5`O@Fk1RC8XUdeNiZ5^F*R2#;N5m@Sq*hl
z+9a@jf&vW7+9tf11*<ESwT)OuB<)rCu4p~&_CZJK`qfW=#Uig_aCTkjvdnTyOPO_^
z_{GVt<8P;0aJxruA==ze{d#-+*l_)u<%aIPJG(8|a+Ze3bK`o;jaeCSB-`nOZ#dtz
zfrw&CHxH6q(}db?Y7#dS07nGL#P*Iyr&qtjd`=Nt+j<<_(wKk@J9Km<QoKkM4Ep}h
z3=VYOrM%0)wE+A{Bxhs<6T+KTiCC!vJxb65cdmI)n|062;8fD@J67-MzT;icA<zj9
z&f_iX7hch{hlOMf1ZW?-jkp%jI0k7qem)m#(7OyKa4kN3t%d5hK<}5)@=ae&zro*V
z7iT>bn8wQ{X;~@n{Pw&TY};mFxBte%jyG>!F)XZ)j}hI0c>-KTI_anv2PnG?S|Z|h
zicjUq-tbcb?bo%f*CK9Y?S3b9-7xvdP$B!~o^7{PYe7<COSVGUd)(M<nEIIkSu*(9
zzoR!+G>PwHU@HG{77;KZ;AE*Kf7p0(-xTJ*ZnvDFsrA2lMcDDXOAz*)=8qsjKRKwc
z(LO^Jp0_{~TKYGwHT#$@+>a;TG$<oY2JP+YZL{c_bWSB##-5df9v8srJ)Sqi1m?*P
z#(VN`{ohMX?2pKu!d35G*E3twjDZ(;H|U|=awg&1i|4&Qb9v3K=maLGxg#fB+*`F6
znmKtD-4dE{+u$5&(8RmQ^A;@ypELhh#X@AzFbc_?8a;<$qwCtj6U2i2b6Ch11uV!Q
z5hJIYQj>hr1_F+W51%A+o%T3C`73>nby52A%;R!ISH~omNQ=h{*o6l;iGNCGh+wEI
zXzfJ6K@O_!iAO>qL&II84%Mus<gOVPHO9=^+ev`GH&eN;hbg_i?=UnC*VFMOkUug+
z)4rwr)h7$LVrw$ffIUROT9WuB4fHoc9?SxM(wM#g3~)%~m^c<D!7VtnhU6!Ju2?TM
ztz)EiC1BdX)3qzF9`eZI1b}p?=T}GOJ*Z(B=k6c`>$<Fn1!hP{i@T$T&DL;y=oie>
zuqbG|B0|8xz~CkqSD<DApaD56$jQm!lahwFwCweNCnK+CiUie9JvM0lfjXQU??0()
zuLkNEB5d<z6WTzg#j@=W^&Q9ydUE3~i_=oifk|EW@;0G_q`~~j$ZxZnR&bW0jn_1X
zHycI`#;(YB)kH%}L6pML2*3TD8=UU3?B-@>Ac)NidWm366+xPtn>zy<TVW|FcNnfw
zkk>Q(slZCY3Jj-*U~w;-SA*35<&XXlvDrMs)WP&U$f{AtR95X!mRj4!KEB+^&FtvE
z^0f4f8;|-}5&+7rYpxk*Gm#!Os=|g?l!b{u-rQM_0<YQ>fP>=$T^ss2B2S+^o39=*
z3vROj<FLpZ=r$+VJ30$w&p0S3C~|qjBVbzp%nifE|8Gp6ONWgG%rZG@aB%-y)JD#>
zvM$2SGIj$IaYXh}xz#Dx8?GmXD@)@?X&E>VX_;Nq<O~9A;rgvRK)f9Jy_Z;c!%2jW
z$aB4Vq}=K&J>cVzyJ^RT1E<qhsWtQPIQ#FU*mA_t5b(~LXp-K%F#@pSVATkc&5e9R
zBVSu|I=yHdi;l$A0nIA=SA1e6yl=&?dG-@*mRqID;5Dry6SDdeAm2tpjzo(wvw)3;
zkueOS=&>sF%VGAM!6;PcU`M)miA%aYeH+k?{KEl4*`w{L8<KnvQv<GNTg9fo7NA{$
z1z>~v&zFRZQPB^NJ-AT{;HYUb1%mCWooI1l(4Oz6A_zT{TEy2m08bY!M>k;<6#--N
zx+7VAbynw;`5&6-qFfxrx%zU1_*(0o(0h*sfvg8$B3<;aPZk1#OR{%EnS}6jLCbfl
zAT`TvcFl3n(bb*XJ9>3>jUqb(NR1N-$l|O`N28Ymn0|mwTq$cG{wpUo>Je>ni~lPp
zc1uSyZt$dV)BGzDwZH<ebwZM1DG7z_tkJ2{UndJ~!4Cw$IE@eWOp*nubL2#TW&x#)
zrmE`flM}=fK%E3quAL;yKuFw42q;_Af@MK9_2<u1LJCAUBnO&^^88ZNI~al-WEDEu
z-P3h5!A9hLtGGA@QIf#GK;0A-#0`E~dpX~d(&^iT#^%MrQIio(y1)yCso@_J;pdrq
zXn5Fc=SQa*SAb*<_G4~-z6&CJ<3@PD3K@BIcEO+OmB!JjeicFWr=>BjfZ#MNF&>_?
z1xwpJ!Hz|`TnaE%Y(x0b>IrDWl~{d1aK=YlGSm0U>juW_;|Jluq%q|D$pDdO@<%#-
zDkk<TE8y%BqJ4aQ^8mREHn5!VUr8UD^OObs&dH!pjuM&nzi6tPFp!hO$ne=w{k^d8
z2&~Sm0~;Olc;jFXz<4}D<+Ej9^kkvVfvclOkq4vYtP9&Ni~aN|*r*JQm(r9#t6Kfh
zm5lLOm%7T*qTqiSw=IkX2wF?Dx3}{HAtkyP<wl@*vvqLL0~TMViz}2E-fF%$_tt;#
zpkrWw^wFb7_*bsTdDg8?*Tz-=U0F}C6?hxye9nV?n$N&>;NrrdGo9P=2t+Db_AslB
zQ+aOnGOD^)9BdxC$5^Cfkrjui4fneDuMmLcR-c~M_y<GzR}iSqv<Ouh!bS5t+)}w5
zc<iKAnZ!f?H=*d4n_A+-Y8z^>WHk6!)w5_87HJ<kupd-<>g5tsXLmOy1UNlu^fUXC
zDu7Q!)S1AcqW$n;B(0ez2H2RrF1-n~pD-X#x?d$6(~zOOKx;}?P7VhU6EI|VAk}>q
zoxiH~iS^k((c{9-Uf<8h_L*Cs%xQ5e$T_A8*(o98u5t4^e*@Q>WwMtMMORfrd6#=_
zY<6E9lc1f-Kd3_S=5v5bx0mW6sYzI*U$wT%`s{uc1sjR)`kmfo_B(vEhVD*OR1B`7
zdi(o3G(;yu!kNAB1DZHcU>R@+*dS?2pv@Gwi6!ghB|hbU;R|VndQ5Vn7AR3(_r<|(
z4uCt+@nckCP_kY-tp*`HxGe0pCC!W|!q4n7d^?c*uLKV?PS|fm)AEHG+xxdW0-aI_
zYpE7;VF9PLId%nX9E}B6d6SBu5u7#Nfs2#ri{{T21(|;IU~_N$G2n4YfjtXn_rb|K
z_N8r5laParx>xiMOOSv98ib;!m+@T3e>i=%Fj^h+u92_G2Wh0L?A4nnD4R{rwsAf|
zsIO{dU!NKzz__Fv+)XH0K*}OI<;j75onV9OBd`?x@$%RkpqHt5T31?1V(xz?3=A(6
zXhS{$tG(yMB4J$lR~64p=Qs2_r3tb{@Z^Wd@j25P@+GRlnF5_R7qn3WBk+I0hNk%;
zNYB+l_vvr=k$aq1;UAv%aV(kJXu8K#B#`BtUoC6t23G@UgrxJpwRZi`l8FJ^UTcod
z)kV|1mb1h8!D{A4u<!Nm%bjZyI+0+dK{equO%vR*nFN?j5^k31cVkIJ;62b&hd`dr
z_Ulg5BZL3{!xVT+&Z2*Mj-YC}KRVbPtNl;jS1pKH&?dP|F8l4PR^jH*^Y;u|VBz-m
zpaSVE5Ik>h_C47G0%(uVj#0cgu&?!C6+H%|!F?U98bJ_Tr-7pBUmZ6dOZI(y7_cCr
zYP+qCXE9he4uRxRZ(_odkN34%uIs_lHZ_OWF^KTQMPFVv^}w6Orz3qh>h_;XwhVM-
zznOiv@p!J%uJ_UaxA9xkZ!i#yCvFnyl?0ZdVnM)m=2#%FJPWqHQnUQhQdMmOBC1Y@
zTaT7eUf8&}HQwhyWSJhq4;IT7@+Dt7FhyS5@9D;A#MzJWLZX;tJ3_x{IH2pP*5<3!
ze^T}1+sWS%sM*5*=3-OGb_+9omI?_8nE{&Cz;H3Z>i4+i<>#lTy90N94*7w^^{lQZ
z9IVLSo<|~We1N|K#ucpmfn2nNJ!erMnKg$bfeR6Eu>i<94x5_7)C#bPao@>8xg@q9
z_k-?Jv!U`XIi-ZB`ZTxc_IWI6^rD}PF=TLad$gl@oKJA_aPw1#$q)j%(*!xZ)XdDW
zXx9RkbG8HZIWFdwmHafPll9t$J3U1P#qXtAgsg}%{En^fXG*6t+`C*wLGE_tPsubn
zkq-Ykl}_(N4f@2OIla$%33gsvDyW><-2K+t(=j$j2f)evQCcXW7Su?gTHv4T@%TM(
zdQ*Axz^C0)RSg`rQF{6EWs*krn1l>@eJp6NyVYAY=oQDw-8_Ta!u6s>p%aLx%W73I
z@kbV&f2Id6#uUIl{z?Yd1N6$}3r`3#lvYi}YyXZHaGLAnC^v%8_62}R!*Q|n*^%y`
zQztb+q#DX<6o8~8+rwjf?bEiQk1iLazg3BoQZATdPVvOO5dL>Em!1YK0M!*GScs?-
zm-zWLZG+y2jle<eD{`4bQj>)sj}09N{o?=0clQ?Bb0KvzhF{{#oLv|*&Fi9BIk!)+
z0cRfWY6g5NLPcuj__{u*CezW&WUhhK9E?beeUdOZkkU>Wum8O2%=Wt^bms1ZPM=;(
zy?}rrkPxE3X>KV2+8@GpQowc_*Of*<xPJtCt;ai&V29)*u<WWy*=4d2CXJKrb1Nju
zK0PDz&*Or2{L|3;#F#-~=t*TC5Wb<F^3D2hg0(-nrlO)$G)M=q2gvM>T{G36lwFwM
zL$WjzBGNC;8*<%LVveLhX?VBx8r8J_Ze%}-5+wpELw*ZPFv%->@9>uP1BhI01IT3m
zhZDDX<G8|1bob=%@r0W4u8{?Ut6Sm+iRw@=)*XB-7uU9!c^iFdb!58013AWid;iK|
z=Xirs!v~3KfSbJpR0K5QHmKh!G3Muhe!xK&N3Pg3U`5lH^Bi(Ifl2_3|1-_8;)BNb
za;5?bA>=64m<GLsLl1NVrYKhS=C29i$wIe!kO0?Y0#^avfg%_#H)kelfBBF?`OdDf
zcY~&eKrx!)e2IdCXz`o*Up^2!$Zxt!SW6=N*9M~XMZmO^djaSf=(Nn(c)}N)$hu>j
ze&a+ln>{lR$XSd~U$Svo2L}tJ#hIs(z3aVHNboZ&;@oXLxG}pGXxy1B13zEB+u8>v
z_93PEq)ny9NZsSme^%3s^^8ETXpxSWw!i5J)rh_ImkBRb{4<`QS_Uj`S(ixL1Q2Cn
zaLNeQy|e)0O$M-^LUr1h`Xh6?qlTq%#wDh^_mH}ga08IYjM<^b<n`Ae^t`SP&HxAq
z!`lA}19RD+0zvz(-u2W~hVq3DXz!Qa1o&$|E-o=<myJ|hExx!6sR|1v?WvYomu%Fx
zp+q*)?B!gX)-H&_f7$}B-2a$3=z4ITyKV-Rn5?(hgT4RU2pi#7${g;SQ^a8W$@UFm
zq59qeEheiXQZT}c`mH?ip*abFEcZ9`^#nrtn#f$eAsvC=G^PL-adupzLGMgiK0gW_
z#sN$6x1FW{dO|_iKp8C8sYUbrosK2Z5Sz}n)Se?jTh!p1Xm(MbgPYOk_;8E;XdDZc
z8!1=l$P<ZCD_W-F#0{E-GGOmDNM67uDTkZ<{A2_;{%pg^$4>){LAnK&iCX|c64=L&
zoxKShXfA7Kry^`vgC*`^#bYp53UmxXCImjFibE|zs;hvi#}<em7!a^3KjiQbEG}V3
zItv<LTaxd3=Sv75a`y(6Vfs+4$$`E2I(%So<hh6>F-v|T{F7hy?_AZ>y8OO~0W+<h
zj)9Bp6A7Jhri?M1BaxX|#BKzUV1w&B(1R+sv2xw4CPT^J(0tzt^h9*@^{=^c{qFu`
z%mY*#qCr}y4vjKdet==~^eHFJZ6ip!=8~(Vloa&zu9(<Wpg-;C#$0V20~8}vOJ_lL
z02XY5?c9@or3X{q11nP>jjPoXZLcG_zPc9}vIPGPKf&t?4FClx=(<Aw+fKBfL{``M
z)b(>oYBYAU1b2HW@TRCjja&GAN&{TNk?|-fHN-mt4o**M?I9A-mq5^Mi<+%$syi1M
zVIHXk91&kcQh;Fj4F?XLG97dCxHy?}x^NPvL{MPk0o8{spnLITZM33py=Hu7VS&?4
z)z=tQC=B5RVAntTi(tPwVYM-j`-l9zJT?vvEXO7k4Go{!#GEO8jB+Lai?8p5?`dd&
z6&Tf(l@u#0EBFKiL7D{$AO{6vokMovya^47h3spyR{srY@dCiF|MLElZHi+wZ8NT$
z&BwvErFBz=%fR5uc7}vJ0&H^nV#Z(SE%L^hO|qK%O#6+e41HrYSa<+u53y>(2>rMo
z(*?Rls9@$`uq`O4LG>C>@o*H_j86$x+k@>wXJ3F)ySAQQFpv<5k3)ILx8S4iO#RL6
zHb8sL(l=||Lno0y{{+Ouw#ujd<v@^th)J9ZD4!q^Vlm1bz=ZD5k9aKda&reMf3Ow-
zC-9@)?wRrj9maxT8wt}3ASD2X3q>87iEy#LfB#<owEqqBiVr6;#!_$rfSWLH(CL*Q
zeCDe4-*p!Zk4egl3J3|&i8<%0`^Vj><@MCjAqOfmVL<5n6}_+;Qk^}A<a;tQU7F?2
zPZMO~aS7-MbU~=g{q5o6vdN+dR`y*MZ6jk6`4Tl5svBo4cFfK34_5`UW`2l>raG7Z
z>39XaZ@HO&j^5+1Icu$0PDA)?GPWG!k#_G@8=aAgv5z;Kw4-87WaM9j`o4_-l=8L7
z23i2QB*Pn}ivfofNGFK7iZg+V*JS;6`W<TuwCIe!fdQL{NKMxZu!BEU=otxQW~MDz
zvka|^V9HWm0dy~NR1fb0$rH$awZXyKuV7)@pAlu8H*U;>I)&1I%jbBdpsQ!)$B!Rf
zaZF1xUVAqU%gkclGcKj;(B3u*0Ky$L#V&})6%iQ7y_Fvr5TM}h39yl?Srli=i`jv<
zuT@)n6m58C@z%N|jV#Fbn%J64PzT(8ENvOcCENPky<lGtNHKJQ<@@hrt?$rZ<K)DE
zfI2!MF>!9MzbzI>o=|@O@uR|dK@BY7Tl|S5<Gw}*&T1gAR1koCQ_VaC?h&%&&pkPz
zNbG-#&yr6uqR1m{GL)C5T1bsrC(trDPQvfgvUO|3YS4@XL~haZT2pyT%#DU^KimQY
z50x{{r#53r_wjkp-4;jIhQV|FHgGZViHYqhM-njbSS8%oAduVUK#IL0{R&82_Vfg>
zH8eH5-;24#zkM6|>C>H$536uPLqk1*EKFLXBiL)++uJMa<0DxLM{@g|A1$H(sH}{;
zzxE3Y_!vM;$0`pm*xuf*TP<zqJfNkfMrYSJ5TG&ic<1-$o40Rwf}<7x=1myTA9Cjr
z13!fe_giet2gbM^7AddSGDMWnocaxY{mdZkW@>;IY7Pu+=yP*%y)aIKivfVL4rsdw
z0Mz<(ipdpHQWYB;Zsk};E^8)5#f@tg@db2QG>dO$qONklEzM+-aXg5AVTI-`#AGtg
z7P215YHx)9GaU&s^7x43+Ndakf&s@&-y0ozNOyvI%-VrwO8=L;*4su(N;tSAj5pn^
zeG|v=U^LN6Ykfq-#OpP?0DAy?cPcF-M_0scf8L$|^2tW!78t<joCc&0?!3&EL3^i`
zvl_blyvCpK0pz8qsYyb@Bp!mcaiA43M>+^}J07QyLVV6pBapSp{1~h;rD&R2_-ZNI
zUjY?d<POIfkiG!>iNSJus<=ttgGr+*D`FA*F*GDa{QpeBoNa;E)W~qYdFvKsgR;rV
zQ>YfbunpBkDJvK)WVU&kGO+URTwTSpsHjigX-YX|vBX|mPI}E8)Cq}`d^uCOFxb7*
zyKI6O%~Q>~DT-$yWwm@1?3A6n2%rFk3u8i{{0R>PpFVv$*OUH`@)J)iY8ogHrQN0^
zV_}H{2N^;;LSug$i1@7FY2@j0Nl&#nPD`iQqHCM3$1mR9kdk7;BV~3y8oPDtRzgAo
z24qeUCq_n7ODlZnxvMoVd!<J~pU)gy92^gfvao5L<L+eh$<a&*H!KlQk6TEf=<KeJ
zw0l{y**%*EOsps7h5-|?${zv^i`|YL!J{?;h>O|F1!~AX=L7l+=pZ$SG}`+5h=pAW
z@&s4ON1fA4>2d)c{j-IiWiU7uE<$D+0m!b^B1soQ8vFIBry2s2C9D9^@ffc=lI59|
zl^Rqtb73FDM(c$SrOh4sZM?7D7fLFimLwn`c-L54ujIqDI#yr#0?{5yh%qYh5U4Ia
z0<LT%??AYRd@DacUt9{a$gnu!y`6dObC63=Og_zN)&kB1Fdlm;FG#vNGuc>B<dzk2
zm{Tv(GtqDpSS14Jr8Sw?JKmrk0FG28AD65HAApEY>$YWH0adc_7xUd>Zqj${CgIdT
z9;V}GiAh@eE(r8pbuZ@mfvo^77(7sJd9Ie!j(zMB*aRO<{;mdMUQxmT;w1sHQ+K`g
zV2Ikd2$=cy$8R0NI|nADT4%fp&{lpT$!3b8qBW7Fj}*8wk#SGTLAr~5o~o*du*Js1
zRfh(dIGv~*GRW|ngQsc_g~hg3ZsTf|zLR|ET=1>Luo&&#8bOUeH&zJgtkwmxAz<@|
zCrvaCgNPlOOv@ggO;6KrD_upX$|9wsdH<cq(ttnA&ls3B?eXI44^04DK~01I25Mrl
zPQ%7W>^W<5^troGMe1s5;!@K<AdQbVu*#wh({8+mSUjBseCL3c7XR>bX7n9*wmbt0
zJlR9f(N4#Evx%0F=5{NHuy9L`+hDxm?K3y#cCCvR!yd#*x2!{9TR=M>^xdvJLgTQW
z6&wC;Gp|_^-ENuPm&v<BLek&Y2S))pY7G%jxW1>SXYG3rfc&J2xm*_%5~={zJNg=c
z-jNYV7J(g9_?;b#EIn^Dm9>@Q7foVEG7E+pn@Uhu#Er3Zm5F0!Te^&VOg}aW=Z3Ia
zNLoG`k)uidQmr?Mb{HVsL1v<El`bb9fus%{jpR!Vp8&BVqgn?h;B2-4UO2ay=IHQX
zwBBRW%x<(C1NcYJ?JnA`76sr!q5wF=!NWrg(CFXOJc^2wy`UVFqsA<I=aaH1baW$&
zecydl(ua-e(_|i?Bp@Et`vwrmPPAI1ki+-X)otC@07z2dg|b1%2dGS^7+eUCh;HUn
zo1T^~ck)~}6G-6dMpu#&5@vM|)@{q0a9gLS5xNi7fCNl@M#i_Vxe;En|If1H<YshN
z(E51oJW#X8wYX54%1fhm*Ps6iV`Q^2Hl}wKhc@_gtsHVr0>!2Ey@PN7zX2JV7@+m!
zFu9fhdSot~lGK(2o~eD%cV+DEY{;N)HQ$GzzLUx^KYi^3B$R-%8v2cl!rg46F`j`G
zd86sT4AKhZ#m1<~@^f=p!RJ@6UM)AetpRri?jg&txZ!vBSodn0@ok#d$;oVde54=^
zbEdEL+<wd`=8O&g@*zl8)9f5TY=~762Kr{(G^^l~+|hLS<1T`fH@K`h-;(|(SVJgR
ziwBth6TgXRS*e;QKS>NbUb8I1FXT(7x3+zo3WV`MCSIieZNcaOUeSG#nVFI@QVKzV
zlm;@mR+@Pl%BXV^YSk3`ZpJe8l=9K;OxQJqI2e3`#9#R-(t{wOi|K=<9r~&OI;a{*
zFRP79Mnln;V`*hIS2OMa@||K()Obw$hJ*iT1Ddd^s>>_HfM1v!b17@wQA;|a<uS%i
z*9-?yzq6+Y3oPkG8kHfaV|y-y1O)*U%@y`Ow%!~#(*m;L=XcmeN6tq#-A14z$O!;;
zRvYQrvXvPYD}meq)I=ctq$v$myGH&8Fp>hjg#Um=wMl@0f}dx?8vQbLvJ}cHEKCiQ
z=;*{<pC_5;x+&Y)*;Vy0`Fji_5OtC%U60BARY$%zDk7wditJuIVW|?w6lQzSPI<1I
zqSO@s2M}1_lQhg@aTOr6AYi<X;zV<X>il+-R)L+9k&y)uGl+n<TmohZl9H0P*Qy3;
zy#4ZYBWcZj$UzNMcDLn&cMo|Y@54$(A}x$h4GeA|a)4Sw3B+P_<4d5^2WW($J?U+e
z8X|NO0?<?)P%Hu=7Wsl7Y{J6T!@SwuX)551`r7||0n{`fbwyE6+>e5#Ebnh1<}_$U
zs|f%+IcN#UoZ=Jd+{^CcOLrK<e3t3m>uVHjY;028QZWPCES?{D^O`>QmmP@7j)12W
zRM264^9!{7-8z^iRdM19xu4;NzG>M9p#{}g%JcGjC1g})y5<z1`IBFYYv5)uh->?@
zk(8xis$lw5@q<2h1vs(*z+(cJ&+P2t(&a!mGq<P(Ji^)*sn-YPn06qyS?(|?o?B25
z-DVAvDXW2uNzQaR^%Pz}{o)03g=Dm}H+TurzLT%zlmdims*YK3R3|_}0#a_xVi%Dq
zNsyiuex=XXOeY9PQzb_kYEBmZtB(W)R#DRdzO+%x<hAPjNWzs8gg1E_KaK_+&aLT-
z^V+Tv#<&UdzHN_Z^XB;Q_U*lPAlV4_RZz(}zb)ANDwMJxV=V~P%cdW$8KNVENj!Dx
zGBWL|<Y{AYoPB%S&+mc^MK0_neAv@H3@a_}R;WF_QZZ)4ycyh6=z;W*De3O%k#O6j
zi|G~_*>2nmzgJ>7K1ce-xP+$Iu%sP;o$sK8)dD?ri(lRe7yqg@t~R!>nydmj?3@(~
zz+ah}nR)TrfCsSI_Imfhuy|ZJBO;e0iHpy@KzR}iFr0#<vE)}qCP&hdGGon02Iv78
zSihU}n_3#MRKxv)J7v#~V2Z=B<sJHTzXZ?1MKjw*+}he&j|L>2r~@M~7HuP=(cjhR
zb_FO~jVdiw8&U?@a^7&=9>%{t7S)<lQqFxwm%q;eCC@Mn*HnIrFqO@ZKX#6QQNL7r
z3542scDs+}cAxW$LLh?vVzG%66cAb8;K&~DqwUiPA6RynV*p<t@dA;aceWpGmRXU6
zs9Yj4LCIlFQIRL%<#Sd-RUCQUh6)K(E#NkU-{!}`r}M3l7<S4%I;do*9{-XiN(y3X
zE9inJync-h3<sosA5CgYzaE_LW?poD&r{DfEC#4VNb;=*nB^DWOPip%vBXS3OBUkq
z?>_;$N7~%UK&6vhwA;AODH~B6-D?k}&;LnG7dnRV!D63jVjbgQ@aHJFjS!?2J?KdA
zGWrSef^teXhAcGs>hYZTA<>q+?7i`ebGI++>q}QilXE`5xEz6$8gGp4o;UR^`)Z>A
z1{G7vN`%B2GTsf74|efd4r(Isep4^ZUij|wL0W}7bjh<wI>B!`Q1cjzX|fmZQ^KRb
zLwX^Mxa)gN)hvNxx=*a^p1Uu9dIhvsGi^#GsD}$!Upt0sSCstNm2fNY>XD<7rj@tX
zT-|&mYLk*C?F;{LJRPf%6%-WINlcTL^#1+r=AMdk5sS^|&}N^P4XcAT)!>C*5wRN$
z0LAAFa1f#3NJ&6bfKF;n3*^(eXCBxMZSonC*tIZO75D^@HWHHx%~}!ND5k@Fm2bu6
z`W<C<q^EuRka7=t_h+f^ykU$cBTq3Q%6}&Ccw&7wwPY|MG-tMttFoVW{i3(@^Jo5b
zqNekVU!v)a=To}J-63Fx=F_i$?*a!O^Hk{s1sXrUfEXQbxE457*RS4d6eOx*p~ryq
z%9sX1SuEQmS}CK=GDhdT{YMXP#pcttgD)I3|8!$G7bE|O|J6@#!t^5tui|9LyTK~}
zaYb^-W6EdkXk!IIl67%fnfqS8guQ#Uur2LuO7{LD#fuod;T*elDm@DH`xy8!<lD^y
z;g~03TJX&@N%v_7fXeRtgiF4egh6jeOPiVAkoXgi(IpjHDsXMOrKRiOD@b9{w1g?2
zT@B!@IBwp=kCWWFSMZa-ywOwO^z3XKI1*YA<_A|?(f`uw+xwO8^b?8*DPCf|7z_pN
zP1+HjCGmG=5xFZ^<ctgB8wY>JtY}jbz(gPseF^EeXDd3XFEJj<q_D3p>AoM8f{4lp
z=PRJ>{a178V&RW}e+lfB(vNNbLO5EvpJFv&@}dS;<;Qw|%EaF9)QuJCbxTiUhrQsV
zsHf###LLHH5wLLtosHAiL0d@HFQ?dJ8WokI&yRzQe>N{v!cMjebV2qh|Az)teZL`F
zVwieOxe1o%Rsmfwy5aq+@~P(RGnZX6xb(p>YV}ct5#&zG9SxV&pjyMtlG>>#6UV0N
zVX?@2;xQfi$#!IZF`s5T#WH!{j)T|bhARXnkUH%LZq(koCwcZHa<t3K8js7uU-A4)
z1>tDp;!Oe}K8tDpop@)L6BgeuU_Lg*obrnO<1F?01p+av3xO*P7mcK$Z)u&5dngLV
z=<fpor1nRU)=v_Y5>$+}g-Nq3Vd=9lCVt%Ae10IdqHcq<iFdgk-d33Q!ZkO8Pnxt%
zFF+)<zi^Lcvi6V!%yAHdrZ2kVt92^zn{r=P8p+Z7m<6YCd?@?34E*fIc?rX?VdLj!
zt6OerDjjNhy1y3Wo_TyxRfP6@jFl}UiwSb3whQ{GzIeZx4R;D719tPH92l0f>QTHd
zOuWtg?PtX7%ES$2;VW7g-tkw3#OZ2J?HM7h`ac42ld7Spuf{f;As5KxC*=?Ad0W7$
zbIJ$PqC}8#H)wtxFE_B(5}{P`w|5{M&q&r1PnL5jXRYh`@%@kaX--^D8=869k%qC8
z<1M2XV%#=;dA#9pBj4aF7e_BCf7<yBHLKF02+-UT7}Qdb(^7gHY_1G{yr<l&=Pob3
z#|frGYR|im6G<}ldQAw&hZ<N@qw<=4zyg$~hAK0l(6}p#6nlN`jD>(7b2z{BL@B&)
z1WQ!P+P~9x6@DLK@HXw$_Wtg3=Z`t%xDYbNmFU!=wvr5mG`fhVECZe3jhL9med4^r
zm5m>}r<C6I>J=a17-|aqCAwt#E0Du!8UH}w9M2O7EYC~{AgO0PxxD_a=2j(}+Lr+o
z<jnhoEvw(lz&?}&iTUYNPzrGUU8Tswz6NT$VS_lfRIRrvan;Y+ULOqfKikog)o>EL
ze;!%>(zOGm?)b4gN^{AN(1X?uGQG~$O+%+0`x`|sTyh$!Me5~ar=|SFrcQpup=X3I
z$9I(tdEQoT3BH$j7zswmPs_I-SZ-E@7r127;W+va@Rk^qz{2-Oxo_ScUiUIz4;ZQ=
z^Sy-~N*n)U`)fYf3Jt)B!<Nwg3YP<t0_fytsk=YrV<Lvw4ad(Hp2NJi3bfF@IKiH=
zLh@ZUqnLnMd^`ANU}YKH((i>mBKP9i^dU&i^zNTNL{c1=0BrFpS`H9m0pMpNAij&>
z6cclrfk+?DU_oScoh27}n#UFnl$ktpJC=k&;lypnjXaxMlQSkwtM{ZM&@x0j45GJG
zLsk#0XFsb!_DK*MG-Ns5FvLAZ4ZhC(TFq)(A#U&((lVHXMK>?xChl-=_mzv3l{NVo
z&`bzeic-;xq|{V!pJhcqgy_wbJG6u=B7}UJe6MD}1^7s*b2xJHc!TNDy*|ZBWi**C
zcrclAWTE}d3m(fW1F~TH4fPc8gS~Xa^J8AZs8TEWF+h-bJf3#r#inhNu}@=Dn<Y3K
z=dhM=<Ds?H`tWz=7kun&Sx}~2lK(^4TZd&CeQlx--Q6WApmevifPl1gBi-Ggbc2d?
zHz<gtw6v5U-K8MiU9(?*-#2H@xz5b|3D;ZC-fOS8?|ZGSL2MMh8&EXth(1Z|6r>`<
zhz0AlggO!x44cvNa|YhF{}e%}`*n6^SRu_ME&f;dNBcgguL8&bs|sjUsh;@#Gy%|a
zrPv-0gx#J6_;`l-0%64|<lJ18Or9ipoG0*sAd(a>rp@d&_U@$elV*g6drVrogp?@`
z>!nZRL0XlG>)SWsrYGqIm!{_YYrWx(E!o>!)Qa6;Mo4|D4?Zj&?Vssn(1!$r9}@yO
zO?PTk{K9!1by4s=Lqw3^TS0mg`Gi2~%AY(Koq&9X#W+D~m#coXGq3MV0F+qUuiloC
z0!`Xgl%AO&q~BZjCAmZ~0PukCL|jHFID#sAD*7rVb=MF$k+63>R?E7EdZghXxp9mv
z&&qa9i(e2#BJkdJX#OWb%|}L|yA<!&Iwf{7WK^-;EM2NroaQ(BOmL9V(&vk8(t$X$
z)MjT7bUL7{7%}PnSl8}8D<<Og{mRaUUx0dOyRODLaAFzEpZZn?e)O&Rx~;z#Hx>BB
zWrKO_ua-?Zy_m+2s(u<hS2k4MWGZ9_7f=8-X|n3K2CI?xcbK2jaHO9cQj^I{w1X;8
z)pOR&->#X2BY+3B4<o>|`s^NM7+z|^Y_rUK^Lhgj>l6;koH3mE%?J7_r5VFT?nrow
z?WPbjuk{^3pvzyg$3n(DwsHA1Y}@s4Z-es!^!3vT4v^G5q#{CV>QL5WiSU$msz`#(
zmLBu$>{qEukJdK%rf@Tr{n51$G~jeMn~kDMy~@igq&y7yl!yt+cjg<?D9-{JW6&65
zS`q4$j2S(IPBWGsH~>MuJ&w4TJ%!?p8O&;8KUj5>0DZV0Ze!56gj?boLBX+l3pC(b
z5ii5JOd`kEuU?(*8%~}*_E3(G%M`*TGu|iw4siA+{ejlyv`$SBgmMsynFoFWPdGz=
z=6f^W3{uj;ZW0d4US*Z~mb?iZiXd58Q>?f20bH+FU$5P4KI1~qn5OIj4bD_X@9VfS
zXu1@aF*}<t3~%-PymizPNkVtu>rp<##rp0EPw$k_JDNeCxBIpTA+q#h4B75zlr2bV
zgQM?T(gzB3RTMMdHB1If1({F$ueM$Pf=L0u|Lgx)&p~XFqIrKdWGqCi`(`3#fl2i4
zbQ}r>SLRZZEC2jN4emOQ3Ib^}6b$Z5RtUg|ysj0U=Nm=ze5gD%Ec;qo|AXtFqo53l
z8@w<D0RT~szqL3Rmk+-RQyR>&xCBA0@w&~FZQnj8s1RP<ez%E62((C}G+gF`^=Z~m
z6?l+G0%;pO6nJs@=Ou-i&_{TfUw*jR<Y?Tx`b{h_w2c}g8_w~omsViVr>5MTnrLN4
z4hd5|YC-1{Kk?&lSqF|KOHXD55XbPw07n`JYmd!$e5~QIhus~p2rxy1M;YnqbASf=
z4^};A4p%;AE#uo1@L3Neds!#L2q<t+lp6}2?F;6&5tj;v>JdnCSJAZQZabOq9YZ}`
zxgy#z!0p2ZTqG$V!1}r2@@yxjbyeS)cYJ%FymmtX9(G}7#Ow7BBG=pfqrs!4oIv+E
z%7HvE=flBiZd%^KX1qKtCL-^!VNP$Jv!eCbP5O)5K{E4TQk`HgULoTMRV1wd_FE_K
zO<@y28(*`)vQU``dMRn?YQT)W{HX!T6(P3`6ToQvqoh-08OlBlZzk1Ui9$4g(Wy(f
zCpmq{MTG2rx`oDiAiLF6`IQoa^|PRy4}8@8tY6A>Bg_&(`2hO)N<>qHjz%U<tt`nb
zr7Q%Tq=u^3ux5VXHZapjm(2EHxdzPe#!jUel&K?EN=H0!9uE4(F3&avCn(4b$PX@`
zk%_Vq7VJlxCcgNM43a6;Ws|ol5q8bB85Bc;hTh~5E*UvmT-6E3D2v@wH66=`hi}fx
zf>RF%d{9S@qi^AlnQT|q1Jbsc8=-gkawbb3uGU;ChNDl2Hgl`Ez$Lx`2%MbWxP-13
zTlG~=U#i}etA9H`E86daITv|&{d)U1ujbo5<z78aHgp~Ci>G>jtqw^1#d|#&I&x?f
zq8Kr*l%DCA_(8oKFOS**%7{Z8$Eyel;8g^~gr4uxoSmQ8b3d<4GzZP@;VP40L{03P
zJ;Lc@4^+&H=gx&3EeK+(dk3>?LY8dG_&YZH-gclR9&`2R{6eU*YmUa`Qj-n5jn1|^
z_|-BsNZ&vr5Oyt$G4x!q<Y24n8D8UR2w~=eJ8^rU2Bt>QY|%y5tX4Qr^8lx}9<yi!
zT2^I9WTBddc1V!DK^(FhLM7S9ZS}}<Rp!IR@1IM#CRd_qpQL8_e;(htd3hguS90-P
z`%jEtrQxnC+p7$shs7HtI%#^Bp2QE1?dQ90vzOkRy^MVUT5XN5=RQZGgZh-uz2O>}
zpiLw#KC6AdBgZKSzilbN?#Cl9m~thu6bAt4%r9QN;B@^hZ(XNH2xzaFYI7Ld)#7ua
z7l7FgDCy;Z3o3YcFw|PWYG>**6kMiJ0uO<^>7Buy<1){m(>;6k2w)DwZ9f6F#=?RD
zC|U4+84C-GnoTb9xS3Wz0Vp!7Abtl(^!rNH3Sin$AXZqJDAP!V)uBRE2SE>a7vM_I
z^BDnVyS;Q^^z%YOo_A-05RHE=va};5gKjE0Zoa3@N#P2!af&dHm?k=6sX<0f^+#bD
zec`2416n8U5$Pi5tyXNqSt1PRMKa6{O8#;PaoLD)r3~b0FqC}i38(gmi+S7`OE$l)
zxV#d5(qj?|-oCb-hS&TCzmDH$KFzVbE+c9A9y*hG6F@)Z61ARpG`W%{a=)+6w#hO=
zThnoWp{#;fsvmfb58+ba#n_~%MEo#F2q+1ZGIDvew0Mo3-T3F{q1u(ZAJyUy3$E`L
zTyVs>O2)lVT?)9v1sr1(`?*>)7*_Jl_3^X&OY_2_qNpkd0Dyx9^afa0?ki(VLICB$
zpe>h0wTQ=xA9?-aiCA7i5R42Gy;yJqb>hn^4xKL$AYnq(eU5T)U{r0+!|f)cIou6-
z<<Dm~p9I^!epMHZ0M}2muyjQeu_UIaN2jNg0}ya%s|l3+u#X2wsYomJm#Wq6MkWvg
z^j^6Z;y;#q3TJ?+5rTi4i+;NMduW0JHYG<1r)%X2?H;yzE4gMQYfQLLM(|fO<WOwT
zBO4&Yz~=CU7-#XA$>QFX@_Sol)rG&$0`u<mAHRuITU9;XXijBPD7W@2As^!n0klr=
zUQJgcDk$KHJ2)ocQ2b=o7!Im=UnOg*OFMA(8ubuM=KLEgBw_j8#e$f!4>$-!5o{+p
z@aF=r&7<eN@rcexF8+|2pg#DN0H&bcsJBYhJf1_Z&3l^ICmTm5Txxn;5JFJaBFvk)
zfZrG*=J8*lj~Bn)q1_d4#Zefecb-g5TXRK>t2%nK%+`~=F5Y2Qx8e?N&+c&GA*M4`
zg@^o7_S`6Pkf5V<TjjcbR>63&zQEvw0hH+?gM*2??M7p-pG_!aB|NH?9N<dUk4>i@
z|F580kJ4UK$_I<8k=Ma6CIb+K0D<HNtO%fUs;$T9D23foVXX=Og*L-9Ef56A1VE%l
zecu3=cjEyDvd(VWtScPrbM_#f8NhcD*ZUIswkIo+-oFn4FgG}M(VLv)ag6{4hJ#@2
z$?qh&ZklO4$LDf#=0|HEsSz-+u#g~1QEyyeZjlKIeaC+W)qsv;+Q{!8&C~43HdSTJ
zQJL2ScrI{OO@6$4+_>Mg<7-dwDPB*=ybho{b}6RJP;U7b?1yXDtcgFhI>rIChX)V4
z+vg{I*cu4t{<z{I@F69k+)5q@aUm1Y<CB7idi<wXb?mL$rSDAV&E;@O*F#JjWK0h~
z-~vl3<A{pX!>fpsRdBo!?&oVG4@C;k(=?9Ouu_SJ`(0LZK77~--?dV3{N`KnALGtl
zq4N+@Gi)+ZOj)8$HS_W}RRbhrt6YbgP3IR;la{h`BMEBd97I1`A5NcTGWU1WpMa~t
z#l}~HO)ks*!Rx=v%|Gh^F)Rx9pHlyH_lbRA1Iw2F2p#v{?er^IS^f_1U(Rxz`^T#X
zJOR;%hM$hur^lzCZ2%8p0z{zhYH7NN+$qf%zMR&-ynW63%dnr2uzVb(9PcIb#R(OZ
zHzKD-+mHV3HpAiBv@w{W_jQtM*deiSd<$UDjL+sCfz1pKhCb<3!#8^!5O)oO)(J^~
zy#pY~IPj`yCao#(&KD-=05rLB%w}tCh6mt6z5gU@!?5dz`-}E9A%4f&D)HpZ%vf#X
z0IgkKL%<EgRJbrw5Qc98$~H^bJfmQI>#&<ZCDIK+!rq>BV<;^oHWpKdmDmMKOU{Ix
zjO@pVM*hpu&FQt3Yf4IkoG#AEIIt<;9CvtBCCJU9NjJaM3<zWk^gSZPZcmHhy6EAO
zf9xu4j^DdBAM512J*1%2>@N(hm`uSz9o>aL9NOA@HAChtS!Lu+P<h+P|6&rsj?3Re
z(vrCBId#)g33(G{DR}85Q3f)#ypW@zh#=XxGGyRN`I<l4tiMLJRpRr$3pzKB4Mz$$
zHTz|O8AS=Nf^)NM8c~A-_r+@{UXe5*WESPnp;tgKGoW;~2>IT9oc{3WSW?mk?l}77
z3)pxA9(E$2eqcg>34P(9SlL>QqW>1r^OHoW8LRHB?sA%hqX7KKf%E~!3`eoU=AuKb
z6Rz7fm|Pbx32|;49%*z9`y{1OcKcG4o?cqC9+3P{2S^puLsQ-}sSqPfw6wG^(pnf8
zWRClNc<~s(b1-qq@87>8`@|m>?n$RW7|VLJgA!a=7?bhU;`M8oPQt<H;P;P_2Wuw-
zZCzcmF7<rJ2|*<-8_^`^R$@l+X;1Hxr3#nC^t<+x^EwqnlX6}Wq_QM!WW_czGCZN0
zxldov`1@b)-8}C5+sJjvzfSRCTT#ufJZ#piZAOh;sBriq0x3KyD=iDJ7_BRlWpmAa
z)#k4q=IAsfL9^l+AF@ms|3e!HPJN@Lrh*>l4A_=bUpVA)IeJL^#N~8MNFSxv5N;sX
z%*>{1d6S2|4lAu_c%UoOG)8v|af{dkJ8SlrjEb1;Q5B~qjUWx_jmiPR&%IOv$TqHS
z=J>=C!nNa=P7y&Wt;VZnV^<g@&oBv@wA?!lD6Z`KPg(}#VKy}gbwYr#wsswwpKtzA
zJ@Dd&z6p?J%0_OY{5TLFAD^;OJ8yr>sTj~e0kC=P7>bGlW7$}eUmzkOfdi6PSh&|W
z2!a)9BK{eE@e7{#08I!YU7?P}xF-UFjx0i9Q7Eqqfpfc(lrliPeNpl$6x$+3F6|U=
zk@#W)L&xD&%hj?#?lcAG)z>F`=xSnOqCI^RR2kxMB+V@I+>EB51~<9Wck}|p9H#sF
zSw^J6$^dKap=n?<P3H`?>Ezry-r^KU?eTeWRwStJi5$3eue`Lr_a~(AFCG*;=et>X
z+dmrfz<6<bD5HLg3JX|eHB4N*wyBqM9V?Px8pT=*<B42E9|S2`z8^o5A(7froJFKK
zzr98Xd?NPt#wqa2>>te1O)l6NpLZQFN;0qGi;GnWOFD)P#~yL(L=hDbDF&k(U|MJR
z4Vx}Bx+wF1u~jfIFlatN!t+Sz{)T|Z_n5FJ9RK#BRYN^R+OS{1AWmU0!gRurYv$}1
z7im0&Vc<b^0=n~V0X%Y<Osm9H+IT<v5Hgfm!74Km{C&^&p?0u@zDf`WoVo9Ed-RX&
z;tIOd_qO&1o<I<=jkWdT_~By8_&-$AAjk0snWfda8E9B3k!TQ_-TdmpdO(7Rf*5n=
z>+8LSqrJ%Pc>F;-GvWt*apZwb%dDn(GG8)VHj|G$H#bInj3R~Legb`ei<vz7dCpQq
zUPwfp&+?pGJLQXt7pkueqrYyeQw~3STP@vN=ZC!wI)z|CG;wHXh?siMDITzlu0v+k
zwb$91nVF2Vwz_F<4eIN08Qa_G2kiaB!yey8dIxcE)j;7>{9XFCn~y{BJmrNUu?NAj
zGhhCO&EYbJTy7b*lxp%$v$x3GiSOf5T)=oP!z&B}Iq*E<Ou4$aSYGp^|Ev`kMPm0<
z|G2FP*LqU@Q6{2~m%{nFbQjJZBqAV^I1e{!%7j0U&ftHH`GU~cX{eg(z4_v3SNkJ;
z<H2VsVXI?Z8JQLGUPhUHI!@iGgT0;OT?8P1XN~_R>PSfF8b<0`Onpl%ppu<1^mZL~
zz!_u{I>140au2e7xixDELBWuMjHIR#pIPKwBY}tasWU8nL8-xpg(&E7wo(PJ9L<62
zi$g*r#1<~cKx<}#*fnkx3Ug~})V~@}#)&{J<TjUzW=$S$RQ@fo-bH@<Z>EQ6{<6V}
zZM9DKnR-`OS5ce8JH2YRZ!jW9{Na{o$$K3O>HzsaEK4a<bae#@zCRc^3k8FV4Ttpo
z>jn?*E<PD%2{)K$jY|@|&5K&?CB93hA#tY7g~uC5;Oc(hcG*JK&iqe_(@m2c>HErd
zfE9G0YeXznB(lIx)Xdr71(XR+;7<7%k4ruc0bemW?BSktRl-h@f5s6Ov=Y;rL(fk)
zwdLQ@gNqLtJuC}%Kkr_vC&M^88i_NL-$pg2qRc944!n8<b56?#iG*TO20`v14}^Up
zh~YXXvoUL_p^{ODr-$~(qz^?GeRv&HskXSpq#K0M;dXT0uW>=b9`7wmn3sjELKSWk
zVLsHzWynq9@sIbBakK`?KzS9FzV9I@Jyg3?;IHv*zmwzi${qK=iLETTE~>tu)di+g
z0Y#_{ej_m<VI(!qqlNnsR61a~%4LtaA9JqZoXefKwX;0mV6rkT=WRYUl1n7#l)}<#
zC1(Ua6p4mzD^^9R7iy=0Br>Obo;;@Jpaz+4_9d4|&?hld)%<bayx=>$>-nlSf}-T2
zHE$Ih716UBBEfflq_!$fv9VNWZXvp&)R0UVb}vG^el)N_sZ4&Oh1BhR-3tk0bBSCh
z=(gp~WxUV_^%M(o=DKVJCWt<WZpu5I_vI6AQeKjL^dnl&F8Ff~b?Wv%56<<wm@f%4
zJD>+RdD0Ke$e)G{&CNBQza$b-<G_*yKGdae(kl<-L<qX)C8cKcW?4<%RBpz;?WG6*
z?pzK?2bjH<4-u4`FA<TBKTVvIqUT2Y+6~|r^9D7wLgsyQB$v}$?yy|*Fs1z#3H0Lu
zU65hM&O1wxg?@jFq|@dvgik<F4P*C<ir^r}mZRq`3l0s7;kC83jOzl93z0w;0ex}u
zoxF5;s9c#L-2uIkeL(aM$lT^zN}2t)c~9yh)Qcq6G9?>#h1o`KRpYyyHkv34$>S;T
zqO2$UQccEOHm&pbE$ehm3GDagB+9v{lW{<KVSmo2g7cHHN;VApx#r2>QcQ-hp>Txx
z-T221%<)iD&*Qq!*(FEu=Wz)_@dD4}+;&g+?p_DFoi+Lfktf*LU`^C7%@f1IVebRS
zo-$~@!BeX$<QPMMhCD1k{7D8Q4RfAK0XUoaDk@7^fIo_iAnq?kej)qfV^Gbx*(?B6
zgK+Ka2cQ)qP!W9th*yb{ad1^F$jzCVnXS3xfq3&DB?~gY=`C+pS8m6)E6XFd&#z*%
zjeL;6XGp(%`Lbr+uyy1d@Bw(w9&X)0s$w#dDFjp@JwP$gbSo+okSy!?Mmry~49EEU
z=m%k$%0zlgUs7ZhG#jtP?a5rJ#cbc(8+-C%aZaMSJUn${?4)_1bA~B#C8`8Wj$dmC
zQ|7B5SP<CHob2FS7M-H*w_kn7=BSb|jDh)|vsAqRDsrWB>W-1u*(i_!b9w0gCu~U7
z`8TUAi=7DX#fN4f7^h}53F-|j<EYVM(XO<g_Lj5y19lLI?glKU34lsxc*GBA;LHHA
zae04ppr)!C40_IDsl^{DC@Ay~4R!zi@t(`oVthH?*lW=PrXD{(SWXc0JC`UJqj~%o
z38;gVn@pLM(?i+x>sNqFTl)pk%f)vC^%R%QuR{JE`?7Pz1MPKe4WJ6}*qL&P)5?FY
zNv?94aNPOkeS62QZbG5y5vEGnIHjcR&?)DKEY6h<yV=pr=JN~p9x^I^wg>p7H%qDh
z7cvY=(If)Q^!Xz{gx$zz!)Bpiw`8h$`Dov&U*-58v{LdvH4)0yBskNT8NG$Ak4MEr
z<-&q}gSB?L>okMXH*@t(rfs;CN}}zjK;L1;RIc~g(PioK@{*B46s`jRCVFBy&kMc-
zJ+ndiw3@!Yc}7J|-JE{2F`FTYT9E73`c>b#Rad442WU+%mWn`GX`1e95Rv~pK2002
z$G_`yAqN7#p@q(n^U#a5xK18Sl|?m~VB#+Nceq@fZ&z(NI$=p$(`00t!XkO@($%&U
zU{bbW;|&A)hiwP|67Zo3b2|d8!|On-m;S!QR-Vb<PTP7Vw=ea3%`Ua1SM!cxqK@lN
z6CZRh%T}4dta3+gB@s&V-ngVDOxw`*YkB~~5{W!Reny@%qT-H59ft!3Y;QM^X1|-@
z<!Vc<^(WnE3qnFx!SJ{W@VFM<4RphqTE1pHFQJkMDU;lW4b-$H_{ZA3at)&dQ?T}b
z2?g*zYdpyE1AGJ?p2E<7(jHnDUFOp^62Kw`<XA*X+Gc%cK7-A;tcy%I1l?K<ifK8q
z)Jx0rkKKA=qk6GeHaeI_^|uFIMSu&3gF?fbmK4BaBSP8aj|cdQN>Q1+oZInA#rJ%z
zw%Sy<zZ|^BWKe3uByduB6O;<B=9Qk<DLR;s?wXC@0x4$V;6jyv<HJ?}Gb@X|t0+jE
zr3=Dol?WI;q87I;#?UCQmT4D)PC``sLHa8F4-XQ{&0Bh#$~6WQ45MW}X1y}&7aU8S
z!%R&IiW!=qKshCk1zl0jQ8XkgeBB5aqRprg?V{1(*&1(`cE#H1{C-ve^m{H*`$NR%
zn>H|^l>J$l>D;P%%ETYw;*)fpTV|&{?~cX(3t3f9nPmesuuHxm0rW-8oI+hgxE_to
zgAE2TPdK3S{9Ij0iD<GQD0||i+*v5DWa14ltGjornYy=v-0TM1u5-Whjys4jdd-Kh
z3KE;esr{Dj@W6hhEbXAG({oUVepqIb7U7lJ9;DsYGOMdjP3ESEP@x2J^*r^I@z!Z_
zyqIM}Arc56Cw(7t+GId6n1<BHC32;AS=tm>g;a)g6K>)ygTMWUaY(66?|-rrieQ*{
z=IuRU;EVZ)uPv@6)3?%hs#>oW_k~Ip_|P==QyI>RfZt*HKMmU=V)am9KT-8D>7PIZ
zCsyu!Dbo|FEUZ0KdX-}nS5y#noH})YCb={T81W(3P1B$Cn>Zi8D~a_AILO+cuhDXW
z)xY|}4U&kf?qx&Jgh-32;s^VTM*1%N@cymeW7{(i!P-C06?R$aaeK=)7bDsvt~Jbb
zbZFq#cHw|PaDhyIZ}TQjdF$dg>5(_<MaCIz5|xRd@{724BPFtOXK!s-i^b0P7(|O)
zwu)xzPZx&jd;@qyfQt!!^a9sQ@J_FSIvj%9o*Fk8qa?4|9Q-@E!bPlAnBsxAHHrya
z8Rg2VS7j#U{B=T8a_b>JKbQJJAE`Xuvp`#h$9?oX^eE83h9?tnF^p&aIc|n>$2Vz@
zwN_BR{`S7SEGuIF+(jw5omhs(EUXoKV7$DzPctbpO7Z?6J2F(^2u8ISl(lK@3VIxB
zU9Dx?ktiCHpYg!*^wLH9R}{zCzs)!2o6|*$mx+t4=7Y{It^J*sMK1mwGsVYr+tV8h
zTv$jYKMRTnP&*#wTLx%{9hyEx#5@j-NMF_RvgVvK5w!C3wWkIR29vN$=gS6nxIqxQ
z?5e<+qbi)*+DUBlq&RQ6p%2mAZuoWKAZx0Yr|(EJsRN2PMn+{~@rV7DR{(iDtl}{0
zRerx=YOyO{rnpPY6!S9ocm>HoV9U2mF>m?b;MA0~ILqDn4{xM15_0Rm)-N95#9@6O
zLaFTRQz@(yWVBS`b=2XCfK4{#SlRmXM*op~k5yGk4DC}BV}i3^&IwH^Rqf;rqKW7#
z95|q*&o!Q=uDljq{Qlv5UzB~|#EANV==r(njP@*|g&Lv&@x|jxWpiGxC`-HAv2Led
zz2{cxnf#j!HW~FcuD=Q$UV6T-WlXol=d0kVZ2Z!g7yK0+^Q%w?)YXAGa(QFUoxsBx
z(skY8+-h9aHn1Q%xEUBuW3VvT&ZG80&3@dcSkm^_v5b<T5LrC?`GtRE)6>Sxgaht&
zBoop&vV8(tPlb@)WtI+BhB)k~UMn&YwO1P9>po<jWVutk+Vt&=I9Gf=sK*$cwU=9F
zDKeyg;L44vBEG(g+Fm0sCD&5zZ+_?*=NKY+qxR;IY6l@LM``yRN_X9eops}{NS2h!
z+&amysqlS@Cej-!L3YTIJDgOez|g69OaI+hTk>D~FW+b<l0aR>svoCbPzmti+Zi`S
z6v#(Lh9@1Sn%o|%T$mrUV`Ge8*;qd=?ltL=KH1|I<$H|r!Sw3m<J2<~->Q&_p}pDu
zh3vS~x-v}lANxJB-Sqsd#4ld+NVRr#vs=lR&1sc7m6J5bN)j<+NCnH$Sa9Pg#b?oZ
z3Y`|Hk>%P>kP~ix$Q5l^EAD&x8%yfT_U=X~nj1c@=rdAmZ2E%~KaUvlO&o(Sq=foA
zUiV4xg3Us-Hfs3r^a$Pi@OW5x_e$d^nB#|5;+zCO1{uHqnEbKprl5%5j8y7IogFuO
z@zVl$OI}PNArZ5)@E)BuOMde052a<A5=MF~p1PiFtiq_@R|5~RPRYmYvd_b85`B+U
zX}KG$=KU*e64SrXV1JdkAw`t7c(F$Fy;mz?^>_7q&-NrupS{<+!c7|9S=xb;mox6R
z?P4yCJ#cQlKYKoGX*4EHaB`Q!YqlCCyvtN4d_8-fGE~WH%Qmt<C@b09gGa;+9{V>n
zn}mm&a?VXw%>|*TzZmCho3D$p-H+)8k<HTYkB1ex_-VUsNw<l9hq-9byId&=LDJsB
z7kRU0URjZmj-88LMEj2_Q4`Rf&vh!8rAT|eBxaVLODBZcnw4kHjz%K6h?S_NSn3E(
z@@{;$q}c^P(@TXlE%Tn3=#Y5W?(!<d)-InJQ#rbrcnc53rbAi<Q!9U&$VN-+5S-bh
zb4fG!A8|by>+<EbHTR%@8RTXualJS<8eNb>+12esz{xJ8zFUbm25C$^b@|&$kHD||
zV7c*3lp^Klhjpu<AjmW-&&(?aOrQvVB1h8q45dt#tcQ7k*)s73ZzrqD9hzfSQ~%m#
zOVN^9id?~HDXJ<8w+ye=2d&uN?dOF{N!+Z`6HUjyzjwv>R;Gu=)q{)E8I_FQiL%}(
z%hZqWoHn{vlP|Z`SN$A6Em`D3+VU##%qR}x0pB`vx#Wu|6Bj!MOO_be%@fmIFL(*5
zSR{L=)>T<1`LpaW)$i#1t4+p5Lm3cb7OC<BpH#4iNO=$iss~jok`eB+?>k2{&%BO&
zp4Sw8obKA45JS>Tc%8I}Qc7Nj%;fnRd+v<r7}?_B2bm`=Se*6T(30nqvV4iYig+3P
zM!S{xYSh;Ab^Uky@bL~JW1BYD7}RMAr5{}G^lCl;#|47o$B=HgqZ2bc5s~6)$@2Vs
zIFX#IOv$Hl)|1h;x9j3n2oP~MTkSlqN3E@+_L}OdB;`}lNaKYQhJ2~~ZuTgXO}K4v
z$_1|#dUKcMXq_Y!UT%FsBR~=1<$pTxG`t{&zT|`;j%Gmb@mJ3cn$4K;0O6puPQ;-m
zC*%;IWun8+vPsl)smEu!PezmN85S5q8VZ?6!zrRSdm$+BwGdBwgE1r`14Xzl>(Kce
zx0#aMgx%a=g}WEYoU)ImBc|O8i^P*EH(T7<w4-ECU*m%oW;>_xW$0z(oK>rlI742w
z8aS$m@fg7wL&_6@1W6udFUMiSXUXlc@lj$k9!0r~)2jtkBS$QW{;HtyIG}C|&q$%z
z_>>biGs}gkZZq?~N#Q61C0p{PC4VNBVK;jOa%xQh#z!TcXa$XTG#>Ax4YBX~9T7A=
zVw!$7k6cV{IgPALongpk4H#<}@L1$kj};Mwr8e0|TL&=G4TcZ$27qtR&%=L*8+-H6
z23vEzvfeiB3wrY%7vwTtI{C#yOqD&@cNA7)szeYpW2w5e?arT0+=Js#`lRyvOk;Ka
zsczMD0ZoBZv(<&1hZ+{$dpa5F07V((%wiQ_X$4ta@(yKo-;aW<@|g=}icexCw_)E9
z;PAA#G80pdM6SA7T1JMhW)P~A9eX<!{z`4%FwsS=7CN&nGV7PiA=e_A1`!ZHO|&X{
z{1jkpkxKpWuXWm9qk&VrR6#=o0l!4==EonRN&a!5d@xtlaL)yy?2}?z;`Cs(@BX4$
zipbwN;kiSHa{>7{6<KeI(3wA{8Njap@coITCgJdWa!TKfsY+4F8|~>7rx!yki(wJ?
zmA3t2GI}Y35ur%50iIxkA+pIIZp^ySVLJb>H`jT)&lhmQtSS}yLXprii=TrB^&BKE
z9GT}tA!!?y-Z;0<_{oQ*PC(o(Ni2BUzJr%m{z`M5`oV_^`a<KFH;Jod#35&N6{d!l
zYg=WLq#X!Xo#%o|y-Ki^KA$Y8>5UtKj<ZH`AsSVh$Xu;RH)9j5m&QbLc3)TIA^j+K
z`^@*l=Bvm#r`Mm~6{tpqM}p9Ivb?$aH=^&_{k}U4Ew#;+yc1u#XCEClfhf`C#9j7(
z;{#>r-QIui8b-*Pd+9Cc7iox%#hJpz?o77+mMh*IcZIKW+(g98>))};S6&uS=PL`p
z&88~HR=dH3hPCwpXn@7-V?-1m=#2?H+{M=IH=LinwL}`L`+pccwZUe|%j`LjS1aNs
z7sM3kCi>pbi<TzaW{j{6Fh5s&&Skb4D>txha~N|<)GWd~0PO8@7~v-k6VLocT;X>5
zwsY|%?=PmI;D(8t;y&#uZJKsbY65yDvrop%4A}U2hGn+B-ThHg`tQrpj(vslrSn(!
z*RUN*i2r!}DRpdwha%DAw>_~SRGdhO*8xZawgb3pBE;2s)uUS;f?6LCw3!6DBYL`i
zjQ!Xa;$a%Xe-=~|=(QKYC)|pC_2&x6(U?eNB4jeM3dVO-^$eqbZR0D&W?I)91Rn{3
z_Z4VNM-^-)n0zuWJ^W-JfCG-?7mH4HrSx}*WfTJM$k}(<B_``*YLH9I!k^B2`cleI
z*G_lu^QYUU{|gh`k-OL>TVR~bn8f>(DRk-xS(GTlc<We6+kwS#RrgPbWcmpg!t!S^
zhdpnVPjKJivU+-16DBn&IAE)IQ7uMQ4EWZ1)Y9&#GyYl|uNFOHB2I8n=QHj5uA*A<
zDP%%6`u129>WEHb!J{C@u#zM358Mr?wVRZWQHgk2)fFF-13`?>Um`-gV&71F{*cgk
zB++$<KoM>@X^T8J>ih$C9Q54QloRRv69SXclP;)(8bNP)WJ^{Lh=N;=F`(d0>g!hL
z5v|u^x2^D@ZImNop(0jQ&($^6t8Ppc^yMh-&+Z~hHKu5v3ZlQ}dkwat)6i`{yg5cB
zx;*;u$9D%PxVv9r=6dlau}S`DWi5wxR0MbKCEGLcdN2WbtDoa%2zc#R_Sb9C`REQ*
z4weVsuV0HFxO{#Eo<-h}EE^l>9&@o#%<O+NoR{jGc!y5QoQJ|(M5#cFzmwAX&>;Kw
z^0Nl1PVvknB;l+_KC_QIcUGLms}=FH{{I6FmOeO!I${@&e@}(|gKVk6m+JwSr}#7P
za{-puh*4Zr5<#BztCeAn<&HNzH(*_3Bn~8CVY_Yk9vQrsx%{b2)>mwmr7ISBN(Sp4
zPRvXB*vwF^nuE}8$+unKBAf*;a6c*;KaJhc^e9avOpcuy)v*?-yBt3kUz^``I-C$w
z>00ceDmyBJEljChxpb}<4VV<88=)KJ7TV_Tvg_s_XrIyp)s>cyexhdECT_XES`H1=
zIR@?xqM0!HBvQgjaq^yo=41^G(HCiLb5Nk;#~2!m<-(hb_5czR77X0KRLrsA4m;Le
zRj(d`5(VYI?EHOcVK~s8RilmJ@nAZS!CdjACT6(uIYBdqD#lm#XhV3YE4@(qTb{bC
zTG5PQIM7?uJ4Nl{!HieU_!8MSt@W7)1GNnXQ<NbwmUKz{?~K;{>pGtFG~}{6Sr5U}
z4Ls(j_BUdEyz*I|)0*8Q@vFPk<h)Po(1-V4csKbjp3YoycD>xkM?uS%HcRw)LZDpE
z7&G3_@rsZJSfnYOskK@I>?xv>-X{WI363XtX>nh1u4<qH>FPIN`ki$Ph6`cJ73rGF
zmeY=E4XKMf!VKh4=n5CGK9IRU5RO0>c~>#qQ)lxJ6<{xBMg@N-8{<mpYgk3U%s4{`
z9>sAenOd880HzJLjA4RP+y`!hi35Vb_J9THg00S`u#oWgWfrIe-7Rz-qIvRE7d84$
z^scED<&DuBRbCcf|DU{BRHY83lD}tM5UxF>1FXE@%A1Dk+wrmM^OoX_=4tQ$sw{I>
z2ECZj_RV^P6v4jM9j`QzVz_s9wZF8l(_%vlThur+ki^O>#o;|C4s2fJ3^BcKiK2{p
z0b$ass8IbNY2$}zxcHF4Ys^ykcLn7sfp35XaO6o6J7228eLoLz?)pc4nP)Ymg};I|
z%Cs(b>f3X*7Ne0|Fjkq)4vxIXzl<&qI)7?0T4Iv`mLLsmRu#S~=)S>mT8)<lSO{uV
z2qLf|lO3-E1PHj7;dq{`ZEQ%LWKd(Qxl(R>V|U419KIEPc!UeNqTDlCm)gVEFyYQx
zoi8oyYi}Du_*m1&3I55{#qoaiNIU;tXk~rXZdL5Bk2$ll6-pb&Oho(%)n$*E3f)r%
zbcScZ(5QMB=seN#69pBogYf9cT^(NVy*v;b2WjGZ@pH5Nt{Nd_kTydQ%cJy!V@2&;
zTN@M;RJHcSK+LEzF4P$8w-wDbGmqb)&du{Crc9+P&!a$PLqy=!9G*U1*`R9qCPs0*
z@HAsYgJsfE($;-WP_RibdXefYJuHda_CC?I>P;#LHf4A`Du#-PSs+)$uC5fTR4d%G
z{MUJ(R^G5s)uYt8ZMTIpt_^sD9Lk08(iLXW+DlVNVyZ~V)Ym^~;>pgCkw60<f<(hu
zA+XRwc6Ax#ID+S0OR?1l+JsufDTs&3WY6DuQsMc@sy)uE(!$#9;4iBnG}_Nb@KxRx
z5y4dLc^J$lHQiua^U8?ymCV)-(`Z(qe=u48NR@VTXwSf=5UQP+GGj<fmv7qrV;1ki
zUN8Eg<(mqs8eCU;sbLon`C=ir_Ck%#lgv!Azq3ynXi2^9@3Ctq>Q*lQyZY`0In%G{
zVzcdmADHT8#)XdRw;OM)oR7N|8ka357)_pev{nAVl_D?s=*1_-js%Q-2!3MV8eLGN
zspIE34tTJUlq@-2WitN7d%+RHoZihoPg-!=z%di_y+?&s&dIz`H%SIK;2QCk&gJyw
zGB|tM6edxj!;ijR`s^mY2I$zEkGL^Zm2Z|jPFWzZ%H5M2zBPdln};Pj+yP|o@<B42
zlwUpR&u~4taqUR&d^0#ZhNQ^ID(i11>Mt6AaymER<w?@KxaN!@JU4$6lo#lHOnM!J
z86oYwOY;5UOO$W^^j6Y^G#LB%JHY>R(4iGuWwCX!`naKCUBLK(+>JVY7<P{aD|!N2
zFUNzsIKGB?H+xukS@#4ftiY!i4bPxD3u9Fc|D*rWWKjf%&U56_C@TZl(1X{3NdH_?
z$VmLl>SihW)Cpx<4ezHONo#jbOFdU#PXsglP;;o~!+>$nN-TJ|Gi5(aKcM!>A<0Qj
z=5=QHEla3r;dz4a{du_+sPWp6Oi(%FM21m(QOtgv7QsTHZtqJFe@x?kU9|g<$ZE-Y
zyB$y*UhpdEK3v=<uvTi@y5$%a!u}~`3=2C^Ngt=L<I(w*{DQ#$N<UR~R2GOFZKOD%
z-hG+401*qICyWc`;3P{==1J*DkOoua?ShwtwIxq}pcS@Qd1&?Ubbr$jJIDYcssQ|?
zKtG9`V!YWJ!x8b2mpjEZbVeMZud1yd(~(OvcD=XncH*=oQ}ECGkEy!3dUkJP#Z>zb
z+w)F5QPU_3ZmE5>`&C}XbW9Qz`y#|Cmt<O$il&#wV~ha9+44fj!trPQ)xv+_BfoPP
zO}C>hKtgZk6|t*nF)H{e)ddAR^A7InkB?6FHGxu8w(Z&FVKAzw&t_GkzArX7cgSTi
zgdjlxmhuE7fwwz1IJ6!~u*HKg$Nx|p-14+s{h<KqUC37Tlhm9Rn74LrV<o|1^C5-R
zupXXa`MPhyiNih@>F*6Lz4uc!@*@Mmoei=6<Mj~;!1N%3J_y}Dfx7fQH@wufa5=S^
zZleg<I1Nqf{JVJd0|S?cGHh3I_VV`%|B#ANFdxQ2O(Pk}EH&_At#_?1e+G!u5GJ@P
zTQfSV)a-Jbi=`vVL4s{}c*w>2WtYxlYtm8^=t%OBN?#P=$7kM4TZF^17I}N%(48-w
zWxbU+e-TGtoNy(Hxw*T@{3mn&HZ5tpuf3UcGwIVkLYAP5Q_Lg(IHPRhskN}k%I;sY
zGt%*`9gv}!xfqU5x*hD-zbtK-n72pq)yQ}yy7ZY1<W@h$PyJTwirkcqBT!`An@hH?
zddZvW;lj^evVFF*-SYM#@v6A{tGFCjr(eFThozvVusEez_uB9k@YtGrPa7K>7fyA^
z$wATuFX86K0}kHmn(%3m?r^&^T*XFJ)0PWcH1Wj8sk}8QBwpK{o#4x`D>{2AX7~bl
zuHLch`9F*vU6a?okwu4VvaCI3WBV$+27f(#2`QT*2}HQnj6Lh7H=F&M&5w%1BD44&
zy{vrM`Yb21yGXsP8+PHjj2U_126ba(=0j$<URnLtLVm0n;cG&A&k=8iWqveTGy|hI
zpZ+`8Y0O7GCir+xn*Xc6U~9MI0_n#2%O#W@c-a20Ove9?ji5;#)J2X5oA%YI??iQc
zLqbg4Ilp{;=<pwGEm&&FWc-Zq7<qLj>V%QTOuey3t&DbEDtCO#`TW#IDUIJj{$^op
z3HzG?_Jhd-Z7au^bH2kgotqW^%LAd9`r@Uk9Rl1x34bzDT+^S8p=ztUn!nFZC9M=!
zkl`g4Y7#U%c2JPl`xu#T{<wd}w*?g6#-SX<_UU~z$*i_&4Io~lL)MeE+!A#>RMWzv
zE}sz^ktbMo$a1j>z!tpdmB%HfLiQ=61V&_JWF+l*aEn0#ejLroSJAzE<_c0--TJ)=
z>!WKqbk%nnZ*?z*LNkVjcinnd8f$9_(FhnZxBkv&W>WUI2u+4QFS-8eOZo8IBBx}l
z<WqWhZL@};au9TNy)-k*&cj1MA>bG)^Q*Z?EAkrFiqFHN;Z22y2XI;dCDEZoA*^lo
z(0O_)RfPb<M(})gA{3(emARV(vAuB<3@A1V&T)6gwD?+k8{B&Ae%AT6F)T7JL0VJ(
z!_1%2gzn|00Nf#cE*!}D^l+87*~-v?joqjv5^bERV|H?O*Uh)}QJS&E8H*_2uhKff
z%T-g}R|4sEioNoQZOl~DRmOclp&kBdxkpyE^mEzwPA!ax-E0{%0ERLDVC@k}Xi4yT
zG&=|Gm0g^tQVgmlZNIvn*13-9!Bj!fQBA4K#d##k?5V)}!u?JU1K-754&X7*07wy@
zFtxhhzJS(_Y7A<5<g$bNT?7MRb;Q<}9H0zKjYN+k=UWA!;m?W1*QfRddrW6?7S4q;
zuM^P#n85Ti9TOV0<`wi_>BwEKDrlwBO-pMGyb~@S*=ox$JkO@gDA}Fg?yekiq}?7W
z;(>#((2+*6pNajw1I+>bVqVx_9_rF4JB0)TvO_bm+=B;Z)$$3l=dGtz)wCd1<Z<86
z`+F$+_UF31E?=BoCN_SWQuyhq`|25(3;ZSMA@HxeaJ3@6NYVHf>@P4bMcG;rO#4yl
zoh6fzv0w*j!No&>GT5&=^|*kl{l1$WakIo1G7Rv|8Q|La`|tOiy!Xgq@VZPYbPm0-
zlHauD{6w&C4-t6Du^^Lu2e;v8#vimqS60i$q72h?Zu>twd-BA3$K~MTs8Fl$3h);c
z79s+6KUL7i*;9Yd+Np1>E5haO+Qa+Wn~s6bLUmu7m(n@?zP|?ONex=O@rH+oAxzqB
z@aw@)llatBQu!hSxyWmkB6T3G>$abJ26_AX!lu~*SX4%)E0s(BbDK`cLKR0Yb65Rr
zbT17bfUF7^c(4eZl!F1(FtbRDSNhL6Hr|(I{c`t|n5=vogR#84+Q|+GF>mWZX>XVD
z7$_J_8?G&zL})A11W(wu+@ON0qJ8I|JbQXaEISyiG=HG5K{A`_^*{-(0<Ykix;JB6
z@?B+vV6$aw_4b0Do@#->7+W9*dpM|L&iGT91?Dsf!wtwk)IPeAp)89m>?9Qjo2K9I
zqFB=T%reCD61}OZ;ekz7y9Isygi@LvUl?ttzr<M6`1ty+MKNUu*VMQ@Z~#onlLPD%
zE!ua$DG0|uh}39HZYOzhJO9qYEUZ%QnMi(5Rv1qQs;HpFa}sx3k!k=wgqM0gAD?}5
zfN{QRas(%Ow-V$+P-fcch%hlzsAEd_)FgGP&FjK(C`&v@g8$=F_NP+&-`u1kQK7+U
zb^(!%-L?hE11mdemP$e+7`O)oPlT1t+$Zc=JMtnTgJub9^`~5J8$)ojI!_-uk-*NW
z{q@puC$(fH%N%Q!F&nM7OS)M^qMY}HcTjd{eI`ybKs_kH(K8c@D=5F~n*0Heo}Zr>
zrZBH}TpSqv5H16nn}D?YCoCEBRVHTcI%ZSk-1+XFIhzr)P&G2|?+CCokTO^%3P;zL
z>W`K?B0;sbdStnCY4LVce;cRZ3=p=H&oEUZ&;U3Iw<1vWfZTq$#SuD99*2B$u@_R6
zW1NG~(=?}-Iq>6+o<p18T9xsA-R$3SfT!2;*J3M(V{o&h!<AdaBC51phH_pLbB6XA
z2V6Y{BhVAUc%__cLtV8uZdO0h3moFI{kMM5ZqbjK0CYd8jt51^_|)NUB?^OpbEl0A
zH4+`SnZ=@Wc9sk_?ia{>66WUgG&MDI3kzj-zxKy>cXxwp)!=~u-rxj0?ltUjZ?W7k
zCAat809oX4@(q|Vh-O2+oK#;W?wc*Dq;91SWBjsZjP}FS>XIg`SGTsqKn;gSK^*}D
z1_$$~XFY<So_t*Oa=IU3RYG(`jDFVEhKh+Q;jW~Vke3f4=bvBd{eO-f;pj|Kn{q^X
zW<PyyYP9UXE>p7`(^*8#!KH@6#~LaE+dzl^Lzwdr7^DqGuAqH0hzH3Y(6*ZT+uJ8h
zx9YYB-5po0QV%&z@w#q#_!@lEiE}cZp9a<0_<ri!(`F4J<)GB}KP(b|SVYFf^{n;8
z^nmLdK+ld`JbS#n{`<G!re}a<{TJ*PqA5Z`gdaBdORst`S90xtah=$zaD%3FCa8oI
zgy_7?gg{6XoRN`nC?qZ}&MP2LP*X#&x3_0Ge%hSQ836AX^!MCx@6R_P>A9bP`lAJx
zawP9)=W{mTf}*AAthv4zxsH!d(ChrusFR$W9Pl7gd8&{^175wME_z(l^XNCJ#qEbl
zSCKEs`fRQNhAYEstrRlx>(d|z$dtB4bH#3PlD0ao%%EDLW1!X9-N(g?)A0m%kcV@+
z7~BfBTu)TIO5no61XI-<n)b_csyg>@7MC0l9(%+%Jmg{(rmvARjAU3(ouBTgm|sjS
zE_RyR-SID47cnJ>U64+T72!qw2hz4?a0Qv(ZHo@TMkL3o-x(p5fm*fStzv~_H3lhT
zgG;`S0H7Y%JHCPoop4m=@<E0;Sw>8rWEN(c;Og;2Q692(zZ0*^&4c?V_FpEb#lj*1
z))?LrL|!*#b~A9sf=5ao*<j>dv3zlOdelw8@$Ah^;Y^@$jCHAV`ZE9$<IQ5AM1=r=
z_PT~gRg-tdz4AZoivg;7h#7)VhHdDtEf4R_n1)<Ue)EybZ<uO(vG+}n$a>_G^u34^
z7SA4NToO+o@+X`M7$uM}$FCmFdzPJ@FC^`6=Ifssnos`JHocnrV@dJcgHJO<&Z9`p
zZe@3>wUSKH(quccZ02g}<?eD_yUKLn?zg_gCeFHfYyJGy7xR^}V@GDYK_@i-fKt39
zLoVbpz!3d6OR_^VIXsBvHuY0#cbD|OMWmDPm4Q@J3o4{K$spIL5<2sE3@W!PlMS$=
z+ScE3uKded+@nI$%+Se<p$gZ<eioz6(Yr9evG!|L@p6Cspy@NgoEC6r8=q4nYW2ry
zPTH>E7xo<X@=uk$hOZADt+cH~4=Yf<tgRCD3nzxr`z1&iJv}(`B`8+u`0AHJ8~DOM
z;SCqa13zi4-Cp<zUawX^%My1ng)gqk4FA%t3JOM;mAPvGr{4H*00V2vlWlkZgV$Ik
z3U?}z3g8X?N?Cs~Nfch<$vne@_+IKgC%-#u*SM+01XAhqk;)PI?6lb5X+K75?MCzM
zCC4Wjc_+y4tB<gb!y4KJG7U2w(3O?7l8x|+RO*#DKKcxP@jf$SHEJbgQ)U}=w^j}K
zMsAyIdY3u+SGBS6o5aRrbL$uM(V|u8a^j-lgH{7K?)M83R_1fjWzH9_JL6ZdA1q_W
zja(LejQo37I1Xgp86!Mc>hC`?!4L#zcNfBDFl<P1JZ05&>$Sl*vwmv9xaGjVRXf!t
z15&XukC;54SeQ*9mlkIlX00A<<2;xI(Ud(*zZZ<*84idwKUjKc&bdpy%kiRB=8g~d
zf3hmKb|U}m5~*F@n05IpV$CC^K0qR!Kb0Q_#5$-S<&852Xgm;6A5p|oMKmBl(^7Q=
zNRwBM<xSDXMfZBU>ZKUSr6Cfr2fAiq^)hBF|Hv+vEq7m_5FVtasY`z;-z(2rFCyfH
zV+Pt=SNB)vJ_pdmPj8)$8jgF|9hCJhO)Slmv(@QWjLn@q-p10+RYFzgc=S}}zv&$&
zHkHtfl8WKYU!y-beo6x)gSwj1zGu^p8VmS8{3S2`8gSXbqN$x^{2m1oblvCtSj>Td
zMSV-+gDaoO@YkAp&O<dz^fE>AYtV7aQ~#FNDEB_g`T^)Fn}9HGzrIb;IoqYeRDtQr
z<x9rb*QeWi`>KN25Cei~X>M<v#Ovn*F9$U&r^{H&z7K+%Ud?WDvb}MVAM;u60qIp(
zO3+<i&w2a9xp{5f(&g2>j`{R?#^g-KoS(k=w5J`Po?n|x0FW)vIw+&xFPBgxwei<!
zZ(2J3>}|$z=xM0(Px#nG3{2KgDJCcW_10ju^|hHyL^o=4gB2k)(OV(No|<-V^$ng5
zZvdBBmsvHlNA--c(L~r{oJ8xC4;GuYer}?G#AM;ydP9t`g?icA8?%957O`;@^PgL5
z3lRyJl*zvaiYPQ!1^E^oq5~NKRjuE3*j49`Ni=n*C%2vcv?nQNzGQIu8LR*H?x?P=
zzN=@LEbH3SK+q5GHAw{oiBsM_N_rmv2gx$+07x*Rya>GnoqL7ILPz_yJD$5#Z_dTr
z3A=@$&N+$v{xHZ{n--!uS<$^zX$|Lk8BV5U+~R@_9sZy&UX3q#ze@8BX}VU};!z6(
zUHVSLvEKSnLf`?uueOGti;1*<ubuCLg9h~KRM)>tqu`3rf9WH4dgT{nTRY|Wxp!Nt
zXf)f0m15lT<=cV~7U2o<7<&CE`#*ozB5V1cq&B&7kL*61uE6^*#{c<l<`FEhvv|`w
z&lHNBu*KZd@(ZI>+?+INZtGW6cfSlI@go`EwD9SCgjI7*4gsS|YV40x*7FoXT~iX9
z6r(CRWf!a$FO&1?@;u}Z7BwqsNpnA@q~PcVmuo&<-C1*}uK#X9u0-;hY-;l8@JwRp
zlo>GrCp-k9>*;nge-U}fMfQKzH3_Wi`a|{u;a7-Bsd1hN8?J%IwvrH{p<0HM%`inE
z$YG!<*F|5Jw=y`few+Up4Z?NHAkfp##1)%HDA(W4yFNO|i@IoB|0tFfsZSU3wTAdF
zZ*7U#TF7_~ui0F{Gwa<_;%#}qZj`X)29q_a{Z6q}#6r>EF~15vqh=g97c6#-E~!?&
zQTbJuF*T#Hmu|;?S23p7oJ^i2MJsA7GeIY36!JD}&$?`S?LjPvLt1lN;QuaP;7%eH
zLj%4PXa)+|ap&$3ZpZR%EN?g+RnkVA$5wey9lwFGksj4Ce}M>YTGeyoEACR%_pWJ#
zll>g?saNi8s2q;Ics5|dbwVWRDLM8d!C>RoCNk48Q_DS2j$&>9ozI5JZp_pX&D8VB
z3e~InPs*KbFKm8Ox6G8Bz>Y9b+^iD)ehlM5<t><0vb(`FAtWf3-+>$q4`uRHu!M~@
zACseog8=;a#kcD)vogiw5Wa2E@iN5n8d=;M(Rr&hZ$fW5YRHQS3jSkfMendWI_$a=
zccLqMdE1Hrg>MEqS!5ZN9C#$!cGFDq7cU=_bSw8r4+b%Uk~TWC%^iKd?M5JY_3Cc+
zv^@b-h@hueVfP&?c{RPNJ|SEGTozWG9*Zs2XDryPc1zm4hIUilzu#)CP{brYSA3QY
zk%A);NO8;|U=c-v06Cuj$xPFrwBwVXWvB86qaGXYEyxD{F9=R#<R^-p{e-W`WEPU~
zm@2X>cq@?~BK*hH=cA6c?qMRGe#y1qOP}h<EUJ*`nq<MFDkT_SWT>t-7M%6d9~+e5
zL;lQEcp9DG?1}Mai}1*DjYinyfS96s5SQ65`4H_0&*%n)BJj(YHE+ML555h!RbwDP
zWNtnwInBmXr2ypm)zmSoWdDH=lrjb2*5A>C1T{SE{^d9|P<R1V)bPIyFhr(gyr8lO
zfAz_}SqgW#PnghmmLW6`w&X*1?BGy1A}n}-cJwMIbT@7#m4XUX+Ue1jR$|iyj&axj
zlZXHbvxW9^gJ8W6TCCe20u;+*?1tbqA)OXquJePr1W<Cy7yXjd#X0+%L=Qj$otCB>
z_p0r+^k)Vxhrg+xNLa}+nT_|x7@}h#{1Z{|-jaERXxC4h59m<~3Idu$p&;ETi0Wp!
zJ(zM@c;Vr<1E!jdY8V6J`h9!VmPcawtMclD$vcq50`UyqY%(4ZY`v&Gfz%1;2515;
zGiR|+%NmN!9xCsk;J5Hy*0XQW)xdJOoc7~^G#iW>E}Gs^%hsnoH{U7-P*V1rY}8mx
z+-5?2xPN(A9BUDhtEs?c(_3srCf5@>F1`;oqdJwc^yP^`<%kM4)j*Y35d6OgKf3Cd
z`{MpT!Vh*hDH;0dNHmxocG=DaYQMH(&xosxRgRVgDcJ8KS125}uDT4(ZDV9_IsmjY
z#y@(78TT9k0%VW0{ktn16(W+SJ%N<3{_Ki{h2i|%OfM~ntp6W;y#-j6ZMQAF07ayc
zl$1~rq$EX3TBSp}rIC<skVeu1K}qQnNoi@6?ruT4yUtwd+1K9t|IWXz*H=YY>v`_y
zzGsX%#+*8@+CPo_UA6i~xzM^(;yalty3btru@76yk!FpSx(8d{ytVEB!6Bg|?~#=8
zadXnkAHKPp3HMI$rhaC1;cl_u@p!7sezIx65abkx9z(2+O-*~i0t49KMb{@W<1`5O
zy59%2>*}pk@#OlMAo#qeQG3<WLUhn^zWxVv4T@RP;yX5p5p%y(4Pzb(hbGMVnj5`o
zV)c{c=)18un=JYVDcA11!ENx6@|o{FBv0m95dlGx?wu+mPp0r^dDdy_Wh9+vlm9M1
z_Ww=dy3_lX6hMMdUoRR)^?)RLu9=pdv2~gI)vM4OF+Y2TyM16-LA<9mgyfDCo^DIx
z$-|K|=>T;0zZ<e=s-@}$;OytOFux6|^&PIW5xjQs?XQpil6l0rWMJL?rE_!b>-L_Q
zN=A!eExA|vu7AGP6U<JB+W%VF*f2)_&2kDkFrDfELl7N<q$r|(T$JeJJsRR{xHxEX
z8ph~o&zabp-(v=lW$vV9{qEKBv*fXkQSuy$pkJdI@3r}LTM+{hWEo3|llCP48%$um
zhvXKCbBRI?FYa>IVr_@te}jYp8BZZF7)J8aOvJ;4xcMvDNU3Y6qmHiE906?j<(GHa
z^t+3Vch<DocS=S}y`KSxumZj)a!>Nb+$jmS-0Baa$`c;T=Vk$tc^q2XK9babh+1E5
zkYUx%A_co~9v&s7H9_S^#R9HW;-<Zmt?32gsLjYut}rsc{<oDG$-mXFLJbz|^77vd
zj`m;v=*YQ>)(^>Q;gjDbxf3I??o*Vslw5(Cdgm)oik4123n5z1J!{e|+EfAJ;i0!&
z@Wh&K4r~7R@_A`UmUU;5p-@Us^4HJkK?e&6M7CTGLBcF6(j+M5ON=NIBZ%dw+N4J7
zC)ct>xQHkjaDx*`Ujcut8dr&!7-#sXeGywJ#7vzW+G{JzzJX01Cz;oDet@gLu<QU_
zH3YkVCi751WA3k_&EviTG01NQxEoR$Hh<ek(%t26&#f-3Ajqh_j|OhTsmwhuD?J2d
z8KeG>@l1UJrHh3E>4$0Cbda#rf#p=RPs7*>HgS23EWv7OsRV(+^i4_mo^CJe*Kh7D
zD}l`0&PBviDBya;-aVgs7L-a@d5;5VpCfUZfI}Y6)t(2Z>`1f<MTMV%p2a1+DTkDP
zZ?NAwUIO}7x(dG7Pq<bY@5%FeYOF_GBd0O>AY#`w4#|R2-)t55^W4aN7p8=$t{YdM
zGzjA){Ju{ed#!Qvtt2j(a?xuq?JlN<l8y}l4DAObR0`;ju|-}aekyd=2EO1aNX@oB
zRyIBOl`^k#UCBBTop&TWJjL*hAwfLRtCCvvSIs%$zZIO5fJ=>-rkKaF@wPcUJc*SZ
z;8iNiv^%f6%s5Z~z=v{aBTw)@vNNGH0Q?_}mJ<0OQgmr9C16Z^7%QUf%KN$`P@?pl
z<g;W(xZhtqGeyw^w)B2dNiy*jVS%vLc?^GfY(kz`RBYvwGru#Gq_N%8d`%*j%=Va6
zfilrmRvfZwUA!w-&hh!Q|0D16bS4218c@?*eT32cskRmk)D?W^8!}K-8FNVBkiP5#
z^krn+3Tr`r4<I%LSL@3^?3t%$R(v-b*^xxXSN%;EKAA%+J;}==6TjS47TS77yP2Fw
z(Y1rJ8?2tOhKOn8h!1vB&U@HZ$S=xk$NFd-bcl$k_#i9TbSWqfkiTTAl+w9H1P!O*
z`}BrAEq0$b?D_G*Fh;cB=Bvo{_cj_Yq1JW41XuI7X4nBj%|L846#_u-=q{vDwj+rU
z2w)0F)i4ovT6ZEKO7UxF`?_|IJ#EJC54w_hTY{9y7SaGjU57jNOG2F{R&$j~&0gQH
zsZ4KaNm0IgNk4wIb|DcGh+-7QZ__}jeaM3cPvN=H5ZUKj7hG4B)fmJ`7>kay-9PuO
zbdP5fRbnrr$>XsB#pkRR9|uMOHi!Ub8b=XFFl|CsJv83kzWEj%=Z~w5W=Xm2Ps>D0
z^kd)clAJBlWOVWVxGoee7xnGXaCVoh@Fy*~t#v~Ff3vF9m`e7w{E>ivB8yu92YU8{
z+$3gaYhbHDAvKevl4v<dzZU=0VNjmKU|hWL2`v^`5-vN4!`?5L^s7uAHV=%Chjn&#
zQg=P6wyfAJq;`AuNx*zZ&`(Shfj~h)v9<fviufA#cXfCfu3bUK5PXV-K@^X0&~S0f
z^dZoY!TLsg?VKQfH5RrX{{O4;_Bl5J9TN1yO3q9!Xg+=1fcud}fZpj27s7&Qz{R=i
zLF_eN;saJqG*c;4ATknSD_jvd55UUI0lt3LRsK);@<ZiK^Fc~&WLKF0L=zg?RW~&?
zbvZe_0WBxyjPB<JA^tbLaN&;yRD4W_WN3#$JXC*Ogv$aP!T+nE78K>L4;MJ?;6_!t
z?ujR{O;`9N8O5n|6MM9u$x3^VEMpIk9$Vo=I!h%5N|UX>UTD{PLDQm303m~~hoaI$
z0Ld}1u*9@QQK7>^BWp)W^Rc8g9XCetnkEqyTk|<D-agozcJ8IvFE@OJKO;GP!M!5}
zWZm6a1Ify%e(^zslsbo4j6Kr7ZrF+Z#rcqdTBccDr>Ric&l`J<M{_1KSs6LEdz;f5
z8YIwzv<@GPOQ+Q4OIb<*2g@|&TlIB>0s~up$W9A~>9%&^&r})?k+rmleJ2o2CY7d3
zt}0nCLl09JStAbZ*FDZo+3go(<hIJ}f$!Yuofwo#Lk(~aA?Yps;~(Z2Pq2wAnUO9O
zTjhPfh(>CFn)-%GindUWh>iwUJ`q#TWUj<)eIbVIW}sfVL$}4mzQZk|7sLqtk-3m^
zj|C=7`9TBtV{jtzvmM8pvzE&<a~~`Xr<c6v78e(C*7yoj#a*gTN#CI73BPCjrK#fB
zPk+m6JZdt=jF0`lLwKkX5`MCa<bEo=Y`pCn!dQhxMv}WC1hN_Ei8SXjE>zP5!T0AD
z@9|M3Q(D{kWaN;N+`Rixa!awl3>td~37=k9x}9#vbir=Gi(=8-lWJye9oXJSXup6f
zC#na)z4HD0o(bt}=}^l;g8E8*z4+7w9E=B<IeAT4lnruueacGsWY13UvipV6IAp#5
zz+SUv`oN36mziTxHyGoDhESs3F1aH<u(I1asT0xO^`m_h&szlpAzjOix#TQ?<C3>b
zlBeN9PPuaRLn2nQ?4Fcuu4zHOs>@foLq5JitT!=%R}0t@6=OZU7}5F%kLBi1b5QOd
z;;tm>hHR3ZTz@3hul1h*L7JY27Gg!N-hC};oB}0ixMh4dJhl1v6Q<~kxw&|6G_r}W
z_F^~@C6#jVish9)C-c^OMk#2qli9Z`v4rr6eZ&#<!|H^&vi*t4{+3afpo#tS#fU^S
zgtmY^K}UGU)5uDwM}ED>si>&P!AM&K4U;F)!X-JUhi=>djrRN=Eia)1hf4Dky0uWL
ztnbu;_mOBF881D4+mrg~^|`R3DV5oAq5JoQnZ;xti<CuY4g@^r`xdb@I60E+SD}g}
zWqNh|nOyhEZYGQQLxnJz!y}1_l%}IIRRn@p{`RF7H}dqg2T$OguzB$^tcR*JdqSi5
z*nkpH%tP*Fy|-z%zR#&R`JLGW#RC2>xL<o@@nDpkdoyyAU5lqqQ&@Di%F0Xl;{?_8
z{5nD^gwO-+xo~7_0{GBxdU_&?l7+I1@aH=RG7XJdgwwxg8J(Q1o~D);nmdBx<`02B
z1U(qY?Wh8%0g9R2p%!4s{U<JE`YlcSqM0c$=6VTvD)QgziVK6q+{D}8I5-0glf$SD
zJ3f+Eurv*9G6=T<a<PVMEo+<REG;c;H|tRDR_zVadW3Q*@F59n!GSL;gP3^$w)o0i
z>-*-U15E`g$o?5RQgNLZ8kE|fBYrD5#!)3!S5hu|XTGe^z(Q<dy`i(4QD<Nw2TUIA
zvAkZBv(5Z>Hkr@|-n_(9=bU)kRgwt&^aYxuOoj4-3XNBI2?Ex3nBGG@g$5x)v3zWo
zrmCZ_Ak+_z?-nf`dl@J(&NF3d72CeKe>GLR;hLvEc^GS=s(#nc#rDxzlS`QNDzYaW
zma^FUwaN&`A`<w4yV^81%2CVntlz_Myrgjx@SO2je@Z+<vdRAc%8^nkQJ9EMBfjdf
z$-^gS0SNAk7easWc2u<f_^%`hZpSW$GuZ*^HBR?G>I8N1-u+O9-NyMQ8p;=z-i0J1
zSBeVHXvQkTWu7ZAlBGnj11kD))RX+^3fumY$DdFxW%9*=ZOI*h%QwR2FZsm2^|4Oe
z;CH+@#Z&WV?>qbkhtu{jRrHd$TWmlm<~Pi-gii6^6a}tURRvy4I|nU-S<}n3t|12g
zW;1R4hXIc`JS7-j8VTARwW}7LsD88|S|^3={k>3E)CIHduE1rV#sDKbc*Fj8rTXJU
z!YaD#{^>?@RltYq#HB*6SDnCH76FZ+=QyeX+5u-9MEdJ!g?uGtl<?UXt}{eD-d|hO
zO;_hxedDi4#Sv)G{}qWrERJ#mBnzNih#UqXQc%C~<{(x^jgil&Ur~m<7PdT%`#Q&G
zR+)fj?VFPw%J(E+A`2zWudlZXM!!0^IIYo$8ckBTu`>VYbH^9YVrCqcYPralVx)G4
zQn!|W=I<YSINLbioh-&LENX6OD{+n&24OM5o}_F~cp|4~^W-UBY4g&i4zKHv(_Czc
z4~`R(#*-%}L@vjbbOzS!LN42U{T-TIde5b#KazrnV-(Q1GNs_0Lm@fvt^~nOa~*SB
zJ+UNb__{COsUmHshgOK4@@bTJBfBvV`{Tj2VR!FD)amAXh~}OG(#SyvtOy#HJ5<*9
z8kEpz1Y9Y743@oz5HZ2Won)U`-3(Cx77c>fjwcZmNdK})TCBGt9;^f-Y?W6PXpYwC
zF(UD#ex*I`*Unry*aIlw@slSVqqk%dePp|AUbc@N^L7J<*Zrd8@><>+!Y5txX7SqS
z!=<7(IfPYy0OsaX=SLm=WN+@-){29@#&)r2Y<2eY>9g~wJH={GpVGY;FGm^Ke6%nZ
zqUKbMiWn|)^cF7QsVKQKz*l`B1Du%1c=8ZXHv9=a=$2zj2c3!so$KkR7w8M0dGSh0
zmhxD*VPBHv^}IJR-$o{vFm}6T{7Q5DC!;FeA#T~{s;_nM5SzGmq@$>Gg1OWix9nfW
zXAsW2hAWhr(RNw->%|fYC9j*b+^>-C)+i9`O!#S*X+d~=86i8cu+m@Y%Ku$<;n^Tf
z9lp@mwIqu%hs@eu|4r$Gc<LwOKz5+-9sH~hr5M;%ukM9{!m=GgWW=zd4>=hL22@+j
zM!C?gB~f>^)<JbQU<ip5K!#WBl3O7Wp8ZNqL0Re5VBjF_nzO5Qz=$QD9^R#vOSD`D
zcgLSCcpo`CIX0)0@)#`iesI~#QVZD6ZI{Va|JM6{Y_GMaO;H_fuqULC>e%o``qFJ6
zrw&Da=ZBr9sE5RqI~IilveT&U;2qU7=Ppk7PAoQmefl2t`?Bawu4PLIE!Nd^(&IVz
z0&_A5Zv>6-=aTQ0P<K7jBnpLdytyWfqkKk48nNaSrkl~S=q-c>#tD3>!EvZG<-}8l
z+!YHf)3W#r&GhGeGxL?0l;$Vb{<zfGX)i&kl%7T|X_k(Pu&}(A<fo&hS4)5b>@mjR
z&oF#Gm7tpul&^f-=^(@mF)ZuD9~Js4)PG_gWo5=3M18E3KWMhQi*ExaYWCbrLh&gF
zQiy2&T^!QmSgJSwYOR0hBZzQGKcHQ)+x32~8Gn8Jx0>5Z4d)1xf{kk8>7@^euh?;r
zeyhf9O#sf60cQ1<df%6lSr0UX{&p`rkhjr`h2}=naMVVVhL&b-*x|36J~9o$<+y{=
zdYUVvzQg4td4r#O!9aR{{RQn^?ua;U9j$@4b|WbA-fE0YHeo6_VGFH1Daqj9g8yNt
zz$gP?=AW1^{-w&C;H~^ugq17e{qoofEaloyZ+TeV5g5qi=BwPGB-#$t)pa#1;VGVN
z%$EVm9u#TXY@I4Om~Qag8N4gb!op(g!{7MNnQ=Pfsad(5>rx6G{E`K67K^(8!B|3@
zKX{>wD%;1gU#&k5t}iV4r(M|4`B21jc^*hozb&!gQY}l~{A_Sb!^&;i=is(Lj}(U3
zl>2O~hR*v;t&&ZwnEH;stIH-Vr}dw~O(h>$RF2rO_EK;bL|8LRsy=*U8&Q>XHKr?W
zBWrW%V*ZA?B4g);!p-9A8G8qfZ8|TnQ=H=8`tYMCL;P(1h8;VWlDxMQdMM_YSFM@~
zm;NGWBGy9-1*@b1;X^XCQTvVghqHHl<?4Gf#p#LB`dPuA#Kq%aO|$7%mutC<s!s&>
zO?~v06y#fp!$l9MLXi?~t1C{F;id>DhorwH!5!PCdXog0P|FsUSDvw`EMNbV>GeoM
z3DLsd1ry;lqm=9JNmAo+lN9{GvPm90zdbzb&-vuHFX23Th21x^gRA>+!88yB8=P&s
zCZS(atS?RU^=pd(?g{Y`ep+k~Y1ItClSCbTn-*sKxV%+0yesl??6#DQg-=tL{72H4
zs}nKF)`KaGMY#4f!4g((2%)3rJP@C=QssOv&k8io2ggq5<-`s?>PA@er*F5K7lin}
zJ;CSasRJvQX$njeFWtM@Y=hI?@lsHRu5kTk(0Qx@2)q%==cjtP1d?S=rH*t}f|&0f
z8uRGH2M5xiXX+5?a`|f}2qmbWyectCw9K_`1ooHbx7^<#;|0*Hv3+34gmyXXCg<i}
zX#p+UJ9=T^M3m(lJ^zI${xzUqEfdc3U8d6<AS$VMaDGC;a9^5|-PN4z78{P(&VUmi
z|C5UF#;}BiNXLS%WvBeYj=2^`weXhv{8Q>Qj+0%p?Dn!@Bk9TyIqr?u+`Mj0EobWx
zJ>9#di3p4?9LyJ7nIw}rdQ@&pg-2sr6i2DUFnqY64c?429}96%6NT!SLjo62@7bUC
ziHx@iFY?r$hkrDGglqe4aG<2LDEs=wNu2JLEQ>Vq6WxhOFd!W-`vJG&cwimog<Wr%
znuIm<YC@H684Z?%ktpyEk9_q$5rdKSDT3#9gR=5_(f-?dZr8M)+W3CWdbGN|8u1sE
z=Br-3I~q6Y=IJH!R`|V*ZfN0ETC^HmGO(9D9mOT3Vq@ukZ`?O{t(Rr_%${FylOnw;
zprdW$R+TnaF?q4Aae2SW1J}oZ%Ss_E<I7WXh-=~t)^6B+Q7>TOzCNVn7{#{>r@C}0
z$$Aa?mAV&n-J}~M14gDR+6$*optk!P4$q}asblN6{BB7SRQ8Ko;>MtEN#hHaymsrJ
zPUe8cXST;u>JG!<r6eUfAm0U5ujs@Jqhu>^Be};%OurqpBaM^#V+Q7439o<GvvDT|
z*1+J(CYSL5m%vt=5r~Yt2;P(ZK+?H_1GTj*A540jD}VG*LwP>ddU2nFuI&nBOel!X
zwKrHZ=Hp=^3@p^=mOm`V9Qcm%Q8#MKNuTGfoz>nT*lT6$CH+};_j`piwK!Btc@i_8
zW=CI$b^R>y-0Bj{{H9IsL>iJw%7;4OuatEOX6+8;nXG{%9>1~}#Tjt7&jpVOb=kB_
z@PXHKnTeSR(mq-zSNdKNnZCrcIvEDG_{Kk&B?G@|5qUO=m_mm2>KJ4HOe2({b}Lh&
ziuqL3HS2o6qWIDB4HEvOmR}v>=6ddCHn!WHf`;SxxZJ&bf5lDw8HGj?Hu5?F0=F}<
zVSQ1{FMMO@Y&OyT%W}vAzH9Hy{K){>G?oaEZIPwoypEV=Z~neuUtyuZIK4C%0;Ig;
zJOETNzdg513}e7_MFadhAnWv=&2?mS6DlP10I|8bgD*6w+n1F5)UMAyY-3Ei`OlR<
zi$oRkEIeO&SFZ4;Cnx-K-~*09s=Zz3k_s8$JONb7=<O)B*;8eF>V~=ivrNG4V`~i}
zXr(7SaRJ*p@$6tb|8}KJ@GB+3Rm#SG(sz5rtu=4Mzxc3!ZpwJ2gFEugfF{Yrc$CNS
ze4Pc_ibQlq@FW_wA@j)n<N9QeLYnVM-)tFapjt{_rMtJIiu8w>c}rs|FLxz)YYejZ
zHJ`iDAg@+M?`h;*;z#lG@2@=hg<+$7p7?}XaD(kH8RnTHV8-)CtG5NHma6JMf`JlQ
zy%#LW4Z`5hd5^vW$?*z<^x1K>P4rg>ex>&^q?MNR5lRDLRWBOC475=Db)=j%&pv`s
zFg+qM5X5+el@bm8fZGOXwtps@F#<3USt@x#&V{USW^w~fb(Ni*Bf)#G;yQ%P%%nM6
zYnCT}om+6Q+1q<KN>7Sdk^1M%cgsRL%%)R!5c<LVtziZ^+!`_W2!0a>C$dc;ZcCll
z$Ssg1InB&@8#x~@8=mO(f2$}*hq5AU?)*-}7)~qm|D<*Qn_1Hb%4GyW1rMM$?8A~;
zKu;hUHrVd{a;_)S=#G7}`ka54UvQey>8ALz`M-W0BNV4jD$;X&afMx+iXSO3ba_%8
zFa$z5B2{9#xl=_DAK8}fV#i!cvL;K4gBqFNv-a?&E#{qh!x*mLOgr<UKA2?bGp6U=
z2RHFo!$C5f`{{n`(X2yaXJR=!O3`|}uMeYK2~rRqE%BFa68N>6KzZ;O+a*}j<tr`%
zoqL=z)E%1`uCCMCMm*~$ia@#RWrovKfu1ifw&%_ZLil?{`%5Eu%nHnB)>m<FOWg*2
z>P+Y?CVw#%1{MY<)}2ZVCGKR^3DmUg>$*zvF6C`*0@UoeuA|8V`ngl;<(1`l>cY_b
z03@nXmFZL<MWuy1L(lB*fF~+DG_V>{^r~p{qBNoJ-O{cn!b#9`N|VNv_0!0r<p-hK
z{H|W|xf7m`*o|Cg=FTz?k0-MJE%#G%U&=pp5y#6^7;==uI#ayfU(LEt*oh9vm~f2A
zx!zm$1e4DvGCfq%w7Ot>ERL2^lu8Jl8PHzjee}%eRw-yqDZvUlTWzu_s(q+?bb0)~
zJ9lU{W~FR&B*<FN%7idN8p3@oK)t%3Fm7bW@2O%-G}vC-Wp!KyQd?pP;+oD=OvfMm
zMMiV=vsa3R6~8NjPDpyS<?)}*%3J*<OReQ+m2tIDko7-)*I7;H?7%BzIjFF*kNNM7
zIEbx&#%R}ze);&9MA2q(kyub~pBjN+2hFt>ttdbc5MZ{7$8Zk-hf!JJrgJoAaQHM7
zumc{j+@Xr(o-nC@qbmeg4=h6C2!xq2mPuH?)|Q6_GwAu>a%t$1K$S?tgn(t{jfcNG
z*$TiA^=#S}g?NMOJsu@grnSgH9&B{4J=(pTR#v-bc87>D!d@F7(_&Jlo|NArr@1#~
z65xjwT$2e9_`=Msxe24MO~4cL37mDHna-V|h%79k7U=U9EgDzhAt3#pxjv046+@Bi
z=N*QXvhbK-mH<>)X0i8+PR4z73+An^@~f;JE(MNBHg3G1N<7BR#w7;Lq1{S<6Q8Y#
z@bX(nq%ae@XtXSUbH-|^xmc?d#g8Mqe--4jNMi<4PUJV7Ox3)SWu_*L=qk5W!Qf7P
znF`uY-;ph}HkZUDyE}%$O5}loo<2+@;hOYLSH(uv<|LK=%9{uXG<Yudm-uvbjR(`M
z2WBgIw~=8==)Dzup6?U^w^yQ$G_Ld1aFbf!yA83-;b{}6LaS<UJVEe50$<=~iDU@j
zu~&2xFUymvc|atL49XZfvA88V4%fp47%c}F+wy~KG9MrvJ4Av4n@aowXxdvxiCuNP
zGNF}T4~P+)4V9N6{SFGZ=_t{xWjVljvP+Qfy5z!A<4%ufoglY~^Jcca?46m-peU`{
z_4)~#lXcQt0iyZ!^JxYE&idP*%p-GjgxI00bs{Bv$oPpUCTxgIR+U*{HnQ}E<_-*^
z_asQL2$}uw6y1B~_4L-bTEY+pU~~f8T_Ywlk9H~XWGKcizT=8>+44W&kN#GD(RWap
z%~bQUVDijO+&>c@%(~Vg!cYvydprauTmmVG^j{9W?u=CJf@=|Vv8cc`cM-V+?M*O1
zXUYrKN<l-<7ld6Pb))UCvfsC0khpoZrRxJ1sg2i>Wa4slb`>Tl`5k2gHAhP<KHlLE
z=QpN;ryqSShH0N3ZVn}zxWW=t4*Ggm{%Fwv-;h^*NH}=*oCNMK_S-FVB-r4X#)6FT
zko2&q9DkoLaAxEae-<uP;8i_Sk6;FPHb|Jszd{0w_XFYjX+hTTzRWFFs)7JW$>I6h
zwkW@;40l`mDail80U2cWPriVCYd4js1gToxuOiG<*CXw+odFh2ff`3&c2O?(17rW2
z$ND{imtZ+(H>Cpj%H$)Erxebc#D_q=UYf%v{HOJ4$m>HMDXmm=h(-A>#E8cQKKU<Z
zWvb9_bQ2e!AG*?!*W~Lytpi$#MVeb(f#7RV6(bi5uA6R5NY$T@L3JOvJA+2EBsKlA
zJ-O<%Nl@5}f+}<S=MDiizAuU6tIeZB*1kQoYP1vWmD^X!G_1;s{SnawXe#8Y|EX|c
zFnocA>}0_eYp8_gkLV%W*5QBZ2gr_s@@Fm?v5Ufq9*LLTS0`bM3+i$HY7R^2zSO`r
z^ohKI=H#qC4dC#{WVGafpUtHoUXNJnemId$-08SudoTXndW{+-ni_$fYB4c=36L`5
z$lI90i`NULRF{9))$hd@l!{H{HqD05)UPyNHd1`65j1+O;WbL(k}q=k=*L3YH+<C(
z!yFq<6PvCMaYl3so||7yKV_hVRI8|quxFDP6wo*{d1#2t_%XY@RKkH63lv0*{g0l>
zUR+me)x-iDY(-MxFBti~Ge=k6Wlm>WKToH9rlSly3Jnzf2n3y9vqn`!ttkSUM05`t
z9O~%kvX!|Arb3GXk|Cw)4<P#k2{UsQPlN~y*p$T53j%Y{Ac91(kcJrtx{8^rC_u}f
z^AiEevrYBCKDAFxPE6e}^G~f4DyT^Ez++?PltmYZlaFdq@dG<hM4`0~Jo=rKL?*AF
zNGZsn^RvIF#2vxER*C_~5FG#y&Y|();^N(1Rj?lkn{H5YsUQ6;IMD!D%Dtz}h{2JL
zQ?<`u#A#Z0$U8;>O|EZgc9dlaS7G^)i(D*PFgFl!&z$0^B6l|8##uh2OeG6y1nV{A
zZ&cZGkXE*Q^L$b6%1`U~i%&+E+{CH+zv{3xHm8rp{aQNuh&LTT4U3KlPBbNZ_W}C)
zM+%){7&%15vOA%gG<7^IO1Un(_gMSRx0m~a`_u(msvegg=pNw>T75HB56qlFAs`v6
zME__JPD@6$VtRC7VYvoc{=21>mE{Lnlk>mZCM4_9n=(=#4fqcUUr<2b1;gb-^E2{a
zkN1O6m`1q&cMb4gi;=;M9b`io$?Oy?V!o;&_O;0l_plL3C0@e!ztJ2mGc@AAmR|H}
z?L?|jEN?l~hfv*AKgVid8|djfEnMHzsJFAGu1@q?`fY__#l384vZm9}mw#H1?Yk=2
zB@56eq&dACp`yn+iuJpv07*>~&j%iAJOn$Se-26Lf$tU+Homw0#hk%~V)<?iyvBV?
zrJ9WW4Fh8z+=w`R2TNTE$EPTlNB9pMJ<8<Eaz=Zy*2JHGGiZz4eu?RjIjX4Y(X@Fq
z=tL_{WgSNUq>`zi+G>BaV+7x&)RN`GT|cjS#W5_5UiC_7Sw97Axz>ueA)HMa_c7nK
zvx}674&*LhNJwI+7GYZ7JGqMSM<gGddGSAr&PxN|0JKK>Du^n95dsw%a6B7of}xLz
zalKW7;WXBdJjX_Qp{*i64(m`FFrb?bOH-M5=QOipy0nQU3wZQO1eosf4JscFo950e
z{yyG*N-F{-F~%RcQilvQ<!v8rk8)9|YgmzB4x4u9H@q+@MH4EyH5Mr=H=mJ0T033!
zb8)&!*Hy;HFO~xk1OKB4jvwu5_pYLz7+_j5$%44RTxgDvZ9+U6H>SW=a0Q4qn)ZXJ
za;ibJYFn?#YfQ<d!hWp$f+%srscPx1XWvfPP~l$9*$n;8^<vAu)@H;2W}f8O#j7y<
z{a&>>uCvuHx#ZN6)S*TDKVpX-oNFOy>)zWuA2Wy1t^`e<l~O1C_CsQhlY}5XctN?1
zt6R7vFc+w(1MEhR^F>ai*RAg;zwSG{vwh#n!_qpD=k?cTfa!cZvHO6sf$#kG*-!(U
z4Ca)=j(N)STk#J7(7*>v2);#JHu~CJ`tjWFQo79elJdE%Hl#lyUZhX}EB6hrkq*+!
zm@dX7>p{bHv_Qqr8T;?&z{>zCgodX_I!|>^puqpz_j*ApO6%`$ON3%cUNAG9(hK)w
z&fc)|X_va?pA-6|dJ4mpJ&Ruj+S)|%jjOvgIXGk%w0}u(aFE7^vqV>Liu$yxx^m1h
ztnchi%Il6!H0#_{i_dHQnmA8S=pn>L)b$UW8wx=nM3(eg$4ohUtLtR)nr@{_`7mY5
zAC3w^wDGkNv9itn9*vi<4pB!RA|HoCpmR79SjPrNCelX7r%z8UDP20mT~GSqd9(%P
zd1m+O;j}s%!l%6}Z7eRU`2>I+1-lvo1Hvkfu4hJR5)`)(h)}sfM=j=JwgZIEk?<=q
zE4LfC*46%Y%4bL?yVYh>R7o{8u&pN}y8W7c-ixgTYGJf@d#>2iU=Z*m$DP!<luJ|D
zS=ihM@C(pG;Ynr$GzS?!s?2IVpS}05qy=R$<id+eTh340Vwp-4^nBUvRI`~W-A$wu
zxPb}*%3;@xJPHE3c+|J{{f;vG+wEa<VUo8!;(~vN8FX+Gq40G?AVCg%6LhtinK}`!
zf4%gRo#O=^c-*bCtc_#s6;<N{gr+WA%T^UO?b}b+1XWk19yeg4^`k_2&!DO>5x*1@
z1t6m50&Cw-DNB5&2?U7c{+C=_T|>@X0{tsvD4J!%i3a%{UpTIEi2VA)dQYjbgTkF<
zWZb>y%4KHBPb~suUqdj04C>&1MH$W9JfuIWmF<biZg5(MCgMwiwpjY^pg~@G`~+G#
zhw(*?a9TZp8c$j*lcRFjJtdw+dh%A+q;)-zru64l0A3O-dxOUtpV(lt&&b5f%ayv+
z>!3!X5^g!@y};e7_k7Z}U8n9_i4BP<avG*vhwckgmOQWbVD$|Db`_|H4iGatMwR|X
z;VbX<2a&PHnRb%e4T$#0<RZ{Gi+oqFz#=H<>f)A+ei<$tMzMHe&k2MN6vTI0+CPdR
z`bXjLMbDfjBUpk)P@w!hs?j)1Pb`vhd!T@DP%G^PM-d8n(OzmqaoIS^_et|3Nh_ZS
zR=5<Se@J}y9Wdl9<`!D_G6S5d-{!z9Mn@?8D9K#Tl#)5+1C|WkwXi*`rt#0Nt<1GP
zqDME2OUh_z4N;Y5l>&M)B*94y7th+w6Pbwh<cdI&#~>;9GBG1@Z_dV>(lk^)wQB#~
zxXuItDM=&*1!iW7NzeuadeiU>d>}JF!qYEI4iwhC>~<xNg;3;KD0r=KQ2dm;S7K2}
z0W~-E*boOHRvuT(K%o0j*DwazyO)cuUzJ;b<w+$90%|1tOyZ7j?$7wf^cJoy$spZ-
z-Ip3O`O1F0E6oHcaDOupP1^1_)KkgJLNB||iE8V$|BFlzJAJPAHrUJu5@~uCp^4cA
zh4&GkpaTNpZhpY1Ds&QhpK;ze>sXIwMbl{VvpP5zW?ecNgWi7lEQ1Y{4Hh?_p6@#~
zc9P@WR>Q4Dwx(Og$;zOBjv{7`<mE@ZLLv@t?i<X-+c&LC7VL2i=*o1i<J!J(_DOBL
zTH_0MB?dQ@4c*!*uRX97_$%4MLHsKjJX7;RyY0Lsr61u0t$x~vr-SCFkD%Yd+QnsX
z;;kk?4XW#PkD+51z?Zl$VHktTn?*qlWl)63jNR7CbqnYRP=4`_8@RHtbk9h~1+}3C
z6g|9Exodf_4myCSnGFa>giN9^RWe6%H<x8{wmD%5iCPwg$=weqh|Ko9YbQO(GAO*F
zsWc&S8|QZ<82>bJ;?0p_(D`r`6+#KXfLyZgX89`R6IWs%M+2o&)x3Jx7@q)z-D-B8
zWiRjz{Q)KI$)AaC@XZxje>o!bi+VWNib1~rp2yhv!2_VxKsz<$Rn^}?wp@g+#o_&Z
zI7%Owi}`WJJ<4&jhyOcsp&GjR!H28-nLY~NJOKcsVc*UHUF9}~H3K&`fcNZ1el)NB
z78@oSR99cXhf5O6%^;r<9o?({ycp0a``@b-^Uq{HST{w$WQ(8k1C^A<e9S?i%;~?D
z?(cV3m|H$?iSP0beY3$tmV%2m%0nerlT&xXwl1M%SvmX*7BHM?T>J;7sk7<o>8^5o
zgly%5CfkS%LLryuIhl?bY>!EWtX1x8cB~gz<s%6Y!L8B*xq;bD`2ATFj@nqN&*FFl
zivdaP@eSm^$@>~EpIj6hIXnZ@qVaVKdb!?iH(C3i0eke(>I+H1NQ4wpE5dg{<lk}$
zfXP2AifjT7FJ$|cKo9JOzL|R9nkE~eHM07_BKFUaLzC$L`+EAPe=c&B9QXxyk5`an
z>)w?Dv4Xx=|8~ut)2D}5PUceQX!e#r{wuT_#;}%q@0_Wh4KK%2FV1byI|2LwySx3j
zgPX_c@sL6(ui^is<C~W8ru6?pP>)xkUc1^-4-17ujGoDJxL&z|K<q4Z_~qm<kB*Jm
z&9@RD>b@HPY-H_X`cNjbdJTCeX8uepQK_qjFp3~Q3GI8x_@0i;{{p6Rhi}5Y-^hIW
z6pIGB#UOh<nyH{?%F4>Nc6CXanB0nsi;H^u*1x=*52)$i2TD%x0%5+|U4;I|WVNlM
zqlB{Zn{J+uX#JDNyM6L@=clekrJp}DfGQRh(c9ZQy|%{U^x@AvUNXEbp?@Aqq;1Y>
z@|QTTe=5KhwnqsvZL_!bjx}3?M;4aV(7XY`=_%iU+5mgkiz^$oKRx{xbbd$2!ND<E
zJK0|&6q18R{ugIc7ke&LYHDhCbt+We3L(cwA$(vcfOB1eC-N#xd-g^UA~G`Ax}JNg
z{{H^Kz23-8P0o*G$A3k?4VQ5lAvZ@F4Tve{dwKD<Hm`v!8r}NR<E4M(gM7!N^l#+f
z6HcinsQbCpQs*>-Hb-}>Z`p;%A)qJ$%hTj}FcFlQ$yi=dftjl4ygKZ=x@uK*vR*m-
z#lUaC($(F4u8CBSD2)cGOMlO*!_NqlHd7;oLdUEtJ95`n3Tm74bt)B<lwJy-Z$<Lr
zd_eBiR-v#xvdDtTA1H|Y0H)WFF)=ciNPGV9GN~m{oH}wjrW<Cv#EsdYvZ4Izek{cU
zyo7wPkCJEI<N1wQ+mthoU-U4blTj1vD=#i4RF%HXT@V5_RXDD&o3w}LcO?i?6q$BO
zf;yhZW-_d7%8TOa)vK|B?oPGqBa@T3YHCBevhD@>`GI9+Wld?9;L%&VdAYk++G^`b
zg#-o!I6iQOfo#%`9(|{e6nF{u%f-!Y$1e<~uZK~=<!MCo3l>BJ|HpF<*6x)8wBJH>
zsu=@w?>WlUtz!5br*@^0rKrl!S|=iu1w(o*dzM3$B?l@-HWnMt!{3kQ4VWE!ynDg&
zBO)7txP9=;=zOj3WLM}~w5RL*zSL$Ao)=ynJLcZWOHYg)T&Z9+43CMkM%GBT<YZZ2
z3uEqi*>@&uk>lsV!)ehW&;fIOv;^kA;RJ_-EZIF<S{*6c>Q|OePD{HC%(SPGIr;g`
zFclDi$dLPV?_}J0%JX(^q{VVpM#3_Wg~PE!1D>$^!McQ`B)YEGk@1XuR#w(<xgGs2
z`2=jl;lzg5ZJCUzGMmKB!mabg&QA?`=i8)j-@c8VFzSfob~)W@VL|^|{Vq0^(L-BN
z@y`_CU^61%14|frV&yLtZ_57mdE6IPG)93E8z~LNHQQ~S%b(AU?v@70*^2=#HdFEV
z8_E3(3z2^9tfqaCHO&w&Fcim_6sN3a{xEbOFy}V0+9X7MJQuN-oio%vYV*{{#&Sb8
zTxSec(TZ1SDvD9Ky@rKoz!)cX=S`NO_kH{x_L;e*R}U7a0=n?LZxy%2GgSuIa^0J_
zf593dL}el=;o}CgZV+{xT>|!fMkk!y=Y8_R#G>8({VK@8ZLY4aFhb%Aay5X;YBlmT
zZOqmCbdDza)2DD~tbv^1H(X*#`n9MC`4yPD2IpcHj1;;)hP;uX;pS!o9@Zk9*12dY
zZ0`^16%Kb`IvW~v1VFojs}F;E%q%R(qi$Z=-rn|)lx^tug{C(tc^ctQp<RYveDHBg
zgFL#kJTKoj{=ExBFqpHk5pGp)wE~-8G|=o&&3_O6#6yCxJ)bo;8(Z!fP7k;!Q9lf9
zMIffU?a@bh1Yu9Hdv9TvKmG(WHl0jR5f)uehCTAHXMS594$S-2Zd^gkdnea-B~%ha
zobO<fKXW)DhVY4N*NWmdCPyTtDTbd(;h`ep<SGq1KLsW#Qe<m&t9ub4k_vXERzKPa
z4!RVLo+zi5fB^PAX@7EI6$xTmG0~@OX{%1XuogAgj4zJUmDNMgv(V_msW@8;WMb$(
z(DirluI{U=bGJfuFdYpJpdqT|kiX&w;8OcJCGPJ#(F%CN0S<`Hhp{FNFcq=Tq=OvB
zfuIRr9CcNOkGFSrHiN~x9mb<mW=%!yGK~UzaC&#C4~{esY}GL66tOy1h6gjp)Js>J
zkEQgy&$tl{X3Bj&P7@W5<!hy5Utrjq0LUSD<d<T8{>seH=dt|R+FA!n!hrJ+tiIiP
zLwiGtI@*4L*@5SJVZrDDU-O~bNU{7XYU_J>z{(W(ZOyGV#n@W9%LsPM$#DI>!CwYZ
z+V)~9_3GeRvDPf9sa{3uU6Ajn$w;|$hwnSqQomv=rLNoNE}B`lGb-($W6N!-J$GiK
zKE8N5ZWe<YS&Q#)<4oCr?6FD5A>(=wgSwLVer9u0xqR+Cjd#?@cTfH#X?2#kUC(QW
z+&#OxmRmD#;&J$SmVsFgr-#6OLEY6dU>1CXWu0|iIj3+<BUMn;@_n6s&EUBT`Sq7)
zqWFa5e!)o?43hFMi&CMzU-V_@zA!j6ghhk5(77cQL5ZSI<~r*5!3Q=rco!mYIt^f}
zD?Ej`xm7XbQS{qmIbd!pKMakH`tZSgM>E&h*tpzjEe_v0;yR~f?D7<aP3;-aq}R!s
z^;%6$4f5a^8XBVSj<jLTi}HzyH)x5eqCpV_KY@(Z=?=2nk>!f5rbUc2<z{z*P1$gb
zTf?mN8Z_=2-aV}*8DpWMp(eE2I-cS9Zen1jXGs%`yl)T~5@^h>{th$W>f>NZn0gS5
z{tCKgi#738Pr$snvEQ<Y;IObuh_^8@&L`tlt~(Va*E3qjzS{Mp;R*O4jsM8V$l)(G
z?+|cWcrcE3b%#8SgM%YDB7(<~nT18-(W9$_xf(`x^!YUwipA^#H^~j&I(BSgTKKlh
z-$GvYpO;_fI+{u!eqlw0TeoB~xu0AgPJ$J;Y3E0;iLrqJVx*1ODyuz{RewP2^X2I>
zT!&jpNI%$Dt5R_vMfi*a&wY)mv;8q>@^PlgHYlx;vwFZCZ1($(<-30Y90agmPQdN*
z<rWms^qZd|DxPolt12jTCyhIgd^JXn`2o8D7DibA;`~f>`UA{*y*R18poppwgtipJ
zRj!=S7>1u6g-I&$TDbI&3KM_4Q{5N;ZlECoRt@2g^YMH;rWR?61R*~dzkdoV^Bs(#
zQ7P+E2bomG@!_F5W%Yfc=CJF2Fw@j%d%kV>t1;H3=Yfua#f3<C%_qK|FNE4+Vhu?V
zzi+0@Y{c!8H}i#udP^cBF^I*8?C~pol5Js>FbccO!wayDxzt1b{r*zau9u((PHS7+
z(tu!ZUmpqro(t?I&9W}Amt(~VSu8RI_G_cuDquZfD@{a<eKA0TL8>SSIL~`N<0mH@
zwO90q6+&n3^!!dAT53Y}HT(0C-Ql4KZU%-+mV>z{2!WH;BIHcXb{;ni3yb=UL@y@F
zB8Md<tKl!nY6mdqE2yA=4KZCZq`TsD2J?Unwq~0c@7y664WCKR3+uZmDk|y_?MMCt
zgq;(j{a~NozJHI3u&!Jy^%87=zanF>;R;7)gg&%XI;)`mlN2F?18H`P1zqdOs_O{}
z2`(pVWrap9xH-y4%F4=H^;m4X$Hzv^Vc(yyRU_9zyu60v2DkO{?(ft{x?8s-`C1(O
zn6+dQ1g<}cVQs4MJo#eYcMI$sGX6ZA_QU&P*o0{XZw=>6y~>3HViw!w{ySV;T>4AB
zY1QN`$E!tMvm>U7CC5j9U76wZBqcHuM7~lCEc!2HB0oJ4hvJL=cU0u8H%1l~ZVDWW
z@l*4j6bUlUbel+H<ioCXW<ySg1A{7$As54{6Z-3Cj1kO4J6ms=ixiIN?Nt(&lA`D5
zC(qB%-`wACj-Yz*#r?qgBfsNgj3BtxLJ)>~1$_E@!q5>gzjn5C%zCaL*)9Fgi=10h
z*2jW~kkF4*&qL8=;%`Jo-F4q_`R&L`R8$mH7ZTmKnn<^1U$M=OmRJe~7B<h_)hM<4
z(A1GBDk^$6A|X5^<U35z@)x?#&%e))v7SZ!f8RZ&#|&D1=uF%dSc|NQct+LvU!O}y
zE-Tq|OX=TnfZsg-Ml7&}j?;d71Z>*r>n9;|w4TUqwnZ$OofG@1Kl2))x4myX^wF_9
zN@IpBy`L>zuK^x6{E;g+)~l8+niMjt@O$Zc_NV9L&i@XxI6e^(gGa7~xl~U;sF!xQ
zv;gR+pveNMZoJoX!ssJ!!o20DM6qEQ4CFGPPU^|FCf5BQp9s4Y?$v+DU0A@sA{)K%
zC*ATp_<i+kGis9`Halzt!x#y!T!%BST5z^1%-IkQuWFa1kU!YBAw|B|MR1X<z@N=I
zgA9-Dy9BQwBg+obb3f?R*?3Fh#@)D7akInMF@q_;JuYv5ebPQk<GHH{z0b(s%hXPl
zWovD1m&UN)v}U>$5g%;#eGcN#)z)8eKU-@*MivE_wvQg2ee*_wo{X$)&EE;H;1d$~
zX_>NItNf@tRBgMEM@DmB*Q_8rdTvEbkN!UG^(AGK={5ODR79?h9nCYP55vY|mxYue
zTfz14^t3yea5jP{Q&daW=~0<Ns2M{!SnT^1A+4BCrZ&1r5|&6_5a6JDd9MpY>R#F1
z{aNIxHOXTp$w4*>_x%k?_)C@Xq{&*wPS*`)UM%bUz^3M+7e!I;;xFetWp-+F^6LU(
zRp2YvodtuwblJ_#P0(bg2yJa{)}_nFv)fDx0Ln!^czBi&NM0+9M;U=cVu<jqb_ze3
z%FlkH+5oVLCbon$hIFpW=KQL+=dtnO(IJjz9{(rY%Qr70y4Qp<*gm2n8YP<W22$x^
zLlVe-<Rj=3z7Xh46pq~9enCV^npzRJG6xm6Yu8?G&9%S`;cGDE%+|??q>>?pz;|lH
z{L9wK&NPgSa=O{gTeo0j&$ggxRZw-0>%sJ3KgD^pcE53(FNrEvwnYv;IT5DmZ7<{}
zk+XdK^eOuF>z8le5+R|wl!uKQ2jcX2XewWykmsSl8+d27p<pz7C@#%#t*EOcThp#^
zmkuG)lZimIe!f?nscBm}eHW2bagK?o6I(_xy=^+fXCrR|-_1x)%$UU(SWrfTdWOo9
zpE|NfshqKcV>!Xld@HUbMokADArsFvVK@atuPv5y6jikb=BnLO`j)!;$NiU&nH9=%
z2;e%srw~PTgDznu$L_~fTlP1Jn=o)NC2U2c%XU!2)N=<c0(P`iSQrZ`uxaEItrt}W
zTH&1n?hs};VZ9IE$a?dJ5O&K5=kn6|AY5&C?`T-|C{y{j3R(tzt3)Y!3QM#b{iZ+N
zXIIv)*nDs<JBbr=o?8s-x^>I2YGkYV0vB<E>29`Km(O2^5sVFcc4B0wfqHeMb}V--
zqKSE{@3L@!INkS=Q%)DtmIw8VUOT<Y2p?1G6SmV|dBRw01)iJa2>rRZaOuQ*Vtm#+
z6&=GB_RN|pEEDT?Eh!J$N5dA?HF4|sWQFhbd$crFr9k)i;t=J^y}XL^P+M8$i;|@>
zlX!)_&k_SK)h0c!tCpxv2$`<t^h^o6QNdr-xhx6Rwd`s~3O78DS---*eg82~YQtT|
z%=_d`8EoQ#wNdjna~GFA{-RC$lSz5_Qb5NF&)iAaM!-#+u=C^HpSCYv)Gr7Nm=D&N
z4bqL5Se4ka%(=(G`vh>>G$l@*z8TrNmxbLWbUwuskaQ*D!YA^;Ydp_WwEdEm_K8_R
zy~Pu~R|f^<wPTW|EZHPgMQ3Z)XT1A+lVgJzGp5S+Z$^exhYEtOau9Cj?A12Uw2PUX
zMLjYu_ncXyw|K+-*8-=^_{2*`>x^s-;KJfkz$Fh?S#v^j?rS~<Md_!8V(ixmIjAXy
ztcW^C%1!8b@<)PiT-+$ye?U^u*vw5qKxjZML*CF=JkK>=JL^TOFjnNv+o|^>fQ3sl
zoSpxx<&A@eEgA&kI|}VYCud+q^Jv)l=|ZA{Dt+yerz1ZV&&A9mm4T-ZZ@n{sXLVR0
zTTA?&0Qp2)1>CP8ZbVCeF>X*6m2K`RhBQhExz0D<{Mg)Fb|e|&g-fXwI=hFwR#+yD
zZyJ2@Hm*T!c@N4`l0J+4j@kNfdX_r0CG34-Gvn5LuoE;VJgqJ#S+=5mw>nt3_UQJE
zi%~7?h{KL2@()u7b`L%FPrpcEP?2_MG6>LoPzikb8uhem>YRfAQ)l|(>5ob_teGXM
zS89f^ncz4ywYUp6GjG(~?T6#DiTo5=0dB9gK=c4iPtT1$XO_vuNSo8-v7$SSck0{|
zYhJ<A3+ql&u+lCffMqsQESa9Grg6qP|APhs9%xGG``9T>V!)7xob!&*b>A8k<U;Vd
zE-<{FeKWH-cSV>+*nlW|Dfs8^9Zvs!4P{de%EDnsuDR8>_YZA{uC)H>s6V(qMSn*~
zgKxh;z81TVy=g+lVB{uZB4dd{><4UwyK-f?aOG^?`=4z$;JD7x(40|$G35K?jh_77
zKu{?0<IadEjn_qvFvi1Qhpk)EVX}>uG*y9AdTSz&m6#Z=h2VEq7tK-qS=n*6L}*Jc
zfTDjku@az|#Q#aoOmC-;yWYOqsD~<+$ByZIvE<@AZ%{3V`(*mYnB~P;g@U|Hqs!?+
zT82N+z4e6H1n}lgTuY~Oo1#Ca)9dtQwAZ~Jc@m%)7hoLIK1riYp4WVLlZ#6Bw6@lh
znC<k;74`~kEnn9%w@jk_!$&Bhexh5IEs4YlirOjyJZA?+jEr~iE!yrUhLfm1DLdeS
zWn5(YHCuwGD+canFuxoRb_#Vb#RI2X;<u-x-FY#(B$t;XkWVIe{BBWnezR!;oYU>>
zpS*d0;9M|3*3%d&UmqwMD4G<6(;wZHW!`vI=)16D!2jUBQL~De$bcheDM#)ac_4Yl
zl6>$7{lNtHElPy`{_coq{8DR|Yt~N1#F)!!@|!C*nkTRrDEb(Dl@T7?ffjIR4g8qv
z@M~m)Klp%wr0f*%m#>{f`U{c{&1WQyj~K31?N1dLfg^LkdSpzUfIxm*(K#9Xfd11+
zbDG7pPEL2PW`ghOU85ZXvWJJIm&-n|5Kb@71;L3#)U|Qm&J&_A%4B)-qk^RgjuShZ
z<D_hX-JB;^nD}|yX=3ca?CN~j#ptfqsn^a10V%PKlhsfGbKk)w1ZL<?fF)T+EPuo5
z$l(dhFUnxZh|^(ayg^nMULg1{e*20e1>uASm!)Fam)@okN0E)_kKLZTy3%#(Gjk-W
zKV^s7+B><!F0GO8lk<LAuCVe^JRA<TeqJ-_RqtujT)u9uBUa6>I;8>%MDUT=^un@|
zMd!1owT*pjXOgj#tZ#nUZalZVJK0cfrzrMD6yu7G$q)ZKPlZWIiJkj)WD{#Sa=DGM
z@!V6a)v!E^cCA#_o+EBp2@Mj?aWo$^s|=M`gturOSD<3gyny{O+W&k)XvpzQd(Iv#
z;Y1BOnkO1UWVk!@pQEvYG3l$1heTemlSviF-TRbMFks;>px2Wr@+v!RjLY+r-0iUJ
z;?j}mvi7lbo+mOx>#G%oJso@x?$7N9lwqMPA6E`(X&X+TrfI*Tu$l;~jISK%+T%f#
z5$RGiG$g!j`-vbEHR+RWuBgzM0t;yy#<CH<rT#=u4S|1+>?IhSw<>QPw7%A9DkS26
z>drAmQk0OdL5OUZ)0!8Wtu4cOxOqoBydFt#_^hY0hW9Oy?!AcF#g(m;ZTWzn@SdmT
zo^eIzEq#p3wE~A}n{F$ed52R|H5N`CB&x5zw5bj`8iMN{J`K8kvRNDy!QsK1FEOf?
zuDtr((+2TVPpvMTAhk3s1?HY3Un#yV+zKIXOD|Mi%Xs>d+DCsYrW$2Lpdelo-ij|t
zJhuxvZX6cRStM^zQ*Jgts_sd*CLA;^*%j`?$43Z_@A-aN&$5#`fL(3i6lNDLhj2Ol
ze!D$E%yr-witB#qm*VE^yeC)55;Mv&oFlsyO~O(iu~hTIvCoy9JI;MylkY>JeER&l
z#FM|vAdVIZwMOD6E8>%3k~xLL*3WnKw|=EqKW~Oh<FZOkNMA~<vBeZQaAc9ap79|*
z+cNWtEq(Axh@C@@UEV<cy{-gt)$sA$HF!YJewkcdNf4@Xqk5)v-HY$sZ=^8Y(Lra?
zo{^U|JHNI!FR!G7J(TknUGuVQI{gb--ky8e5E{cz=IF7dr_09S*1fPjnWgY<w9$3L
z1ow=XZf;eAN16T;MO{;VAdcBl%}VI~zn$gQjNDm|Btkk`$cG{Y-oG&zw8o~Z71}Ln
z+QEE`xw(Ja=3!5!k6cEB@0>7(r3tyS1+N=K63BnJN*h~ZehiE9#ZFnlERsUu%=Yxk
z>X88+mnIJUCp2<W_$6Vf{zDmN%N=rJ^^0A8C@Xy$F>AS56yvnww{`CBHSFi?RE7LS
zpBpopV)1?OlNJg>i+Th#L>v{u$J|<XLB#aC16=~tCUe3JR0KF$|8o)uogw_M$7}J%
zKQ=ZeS`!(C7z)<VUoOKhMbWoR*!2lUUgf%s&5y1Yd6x}6*A3zsavy*Pe^sk(j$SE9
z{#vn}-sL(nZd_l)ex`Zf`wl6DPH^&K6Km>Lhx7H+kk+}0_Z*`Rzug%p&Am59vF+cJ
zes+CGBu#N;>q=rBghGTulP4U=U&sIi+@I~x*8%W%*Un@9g<X6b5ET}hURc9p{h(t5
zF%m5i=RInB_&!9gd>`B0%1iKgBrL-YCLuzB=oDXNvd|?>mcs1l=y2wo_+Sp4G1eJp
zb%YF4!+RY0tCsOKMQ6_qmTQ)dKR()Ot6$%wSwBWZP9Bhn`ZYi-9}1S(>b&8N$<P@@
zEte6eM;*d5$gHD9?ZM`#cdgL$#*%;R)xZkxs-UGndFQ*jBSw5U2uro`AlMlG;h*p7
zG`zpjH`4ZP%$}!YA;Z$&bQMf7GDHM-RpgQ@!?ZFKm-}xu`h~F-+E@?WC?xST<5Je<
z=bzcRoq&IaFf{thqe#2Z;>1WASQ|!}+I6=M2n`Ih%^0>rw{5d_ufg_Cmx+COw1ic$
zCSy}o0MR*OrEfP}c|05?spNP=-66<!V|CnWywK(5`wpGK=N(EQy*S{ha2%v#xGmGX
z#o40h@eSi&(0k2@5ZnZtc22e=E=Z+6-^`eSfYTwza&A<r&~xK9%x&Q~^Elmv;6TdD
zj=HAnkQ)5lc+I90ycfxP=3$5;eJJ|Q!n+20cO5MEwA_VJ>KZ1{BF8IH?k^TayK|6|
zK4GKdzE2!d7$O}iU$eAltn{Hf=#8n|tl^S`47kcWgy}a}nexYO$@98*+9}%c#o70-
zt}xuZU!oNiPm~x2QQ_AS_t*HJfaVcPU7PQAthtn(aq$oF3T~~?%GX0Sy`VGO<@cU`
zIec^2>a1@Cfk38+@jTa3l2gr8rg_-}2c8$R<K!QHu(N&PxO@>19E{!u5Zl(EmJJFT
z)?*6<;xgeQ@rNo1NJj$!fC|xpfyV>{9{@7@E=A*c34t6^5C7K4+D4b}`&itmp<ILL
zPks;BlL)f*{r~;SzsD{9>@sgO-Pazy#Q(E8;JEhNm%3$|S6a6(-~QnrbWUH8R|Po9
zZT9F`;Nj^mN)LYn*CK#Hb5rmSXnPV^@T>vfWek-{VFlgO3<KJrE6`ye5<ap5)YKMJ
zS-BG!CM}>Vv4Lmh?wvIYcz_e|FlVJjdR^V!t^L5m{dCGK!=Pg=yMZG^$~7^uvAx%>
z0r#GO%wHtGb=$T@yLLrY<o?=xy8u|Hf(pSmlluGnZ@vbNyk2-&0vrngy36F%%MvS~
zz<-16*C3_fYjZ(LfnB@gep|IYz(K2Ho6p;I1BbEt+(31bkYjeXHgHGuN8tF`tX{j?
zHye)wn>E1c<yD4B;tn9Mnna|XnbEk|y?@by1q=-j+rRDq`!*k9os0b}gG45vv|^d0
z?IR9waBRv3UNL<Te1<b{Ivu#m0W@5<E$60EnWTB?Y2YT}_1&>7y>Z~(RxC=d7DJMQ
z&~6?jrP(K+7S(*c8V<bmTx7Qh$m4;!wzjhNe_#3wiirWoqRoJjyeO%`%cMy4+<Xpp
zPIV)JizlvJy2RA$rd$R*n;v*$U>ERs^b{lD$jTR~>kg`cy@gWE*|)Mm>pu3H9LwYZ
z-o_0)qwNv@JCI@(zJK4m7k%RSAhH|i66Sx~p|#>-V9W}IKG?wkjHX3)59)V=6axby
z3b+^mY$EXZq>ZN)7R7b=^c|2;U&jDVEsL4WCoW2K1fDzm^Cxh1rWNo~n2t3C6L%>X
zX)*y9pa730f*O<}vEb4M;34k|Gp`$Ys7krTEYT|{D}A&q5Gt<)O$(sNSK8Ec7?A?W
zOM>tf9ANX|YZ@S?Ly{#p=}r`d4aI|Ej;z!^Y84`~s1bmF{(m^v!yjr96U4y4pjrYv
z-7qDwB-JXpC>2OC7#SED>Kd5o8kmO|np+tdS(zAU8yHv_7)S@5*o&eeH$NpatrE9}
TEdByUpaup{S3j3^P6<r_^EMC?

literal 0
HcmV?d00001

diff --git a/static/nic/ic-pod.png b/static/nic/ic-pod.png
new file mode 100644
index 0000000000000000000000000000000000000000..a48520feff7a13fa3d7ea7e5723d708fc12e3c9c
GIT binary patch
literal 54934
zcmeFYcTiLB)-W1G1wp_HDqW;VRZu#Fj`S`fO{q$iP$GmPO+chbi`0m85Rgs?#X<>$
zqVy6#AfdA(HH1)Z^!(0w-#hdDbMMTZx!*UhGmLvbd-b)RwbxqDPK=?xCIj6KIuHoN
zp!Gn_7z8?l1%b|L&{9)Y!j6*x%73SwmGzWCpsED=!>4B`_gwZ5jP*dE06q}tRRjoh
zKv{aV3<CMy0fAPZfIzbEK_HeFSxrXrAke84LtRt#larIp&CQ94iKeEew6wJS{e2r7
z8+Uj2xVX5ova-6my7~EeJRaZK+3DrwH99(qLZQ;r(<LM%R8>{``}?P-r|s<Q3JVLX
zs;W#(OhQ6JIyyR9T3UYm__4aW8XX;-mzQ^Vc$krq0RX_jz`)+#UTkb^LqkJAK!ApZ
z2ANDQE-p4VH~;?q`}60|r>3Uj<Ktrz!waf2E1L82K4*+?bWQ&5?wLj<XT1%H2xuRz
z&nilJ?)q$arF~%GOH2P}pO;>c*Y93^sEH_P>0fB8?<jfygOEPB6&@3eC`&6rW+Tc|
z2A95djMvw+7e*xotEefDZFCx$>DxM5y8Af8BD|aXE0Pg0y}z2jkJL7Fm3$wm3yb&9
zD1VdNkodkVrUPHvwfqS=`mr5fTKhArY2u@AdPNFm<!$TaLl<AC@Z`|)j>Pu)teR*@
zsIwEq`pd7vq~g&0)<pOCTzO@+$Mz;lYKqaBFVzjqqUwIY2MGGsjzRG+KB3d}Odi-m
zBVl<>sNRb5&h*&ykP38qKp3RBE%n=caVxgqRV>um#j&V1J1ELGt1|Y5pIc5%T<t(k
za$e*MKiA>a?`SldNF;v#{MkA1p+}<8i!=lO+6Mvk4}8irbe_mMCMdtG(R9yIvkV5S
zn@K<PRd^0pHFA}I5~bw#S<|aPT?Tv)tS#BxS2=)d^AGlmiVtn*EOmJPBr@MEquV=o
z%r9>O>f&SfVaV4n+6k8Y>`l3cf3R=ByJsow9_bjboS!~n#rC<QzK`9sVL7%6Dl!Qu
zSMQ|9nucK4*Jg&c>M_;M_5p@TnX#n}AL8pg5v6J9DP(f9S9ZV8r>5M-#>TL)u(h?d
z%F4?2_I5WnH&<6z7Z;b=+1W9Ls5DC8QrYQfs)3@<us@*OoO|)W!W#s-migz8O3ODq
zg|bNFqot=#gFj1i@fv;Nk|PHt*g;xq%BC+T*N@^5JYDHaG-(g$T=bMjrhgKqbFNo`
zuGr9-;enj96Ao=JI=g;0f=sCdhGU8ORnoV3jVkkP1Q>X=7cTSmOj^T&8lVy!)g8n|
zOwNFuMAn3LX8!)o)@T&8VUM&2tcNVl``;9QSFCb%Mx5uSM93`D#F<;-)S)!jXV1%D
zOqY@PvrGSf^6vto5kER*_pQ7k@S9)l1#tVBSC4*oPl;E}*Bea6Uz?9=1pQKM2<-7I
zy8$<twv%&;=A1wEYArBn>Q}D8iN5gu4!1`n<8IX-Ob~zWY(FBWuk-bU0fuhYNzUaj
z@Kj*f<cE#d_c?~?vacVh9A01nW#O2Snq9>q>b*UJa>?xK|5}qs@8zB<cd=r06mOV}
zXZ_3jo|jt$!cRcv%|5p%NLq`Hb&eoCOndP!H)S3*3Zl0c)t76}A}FlvL`6Z@sN*hd
zs#^7SoB`Q?xOg)-Iu_XodUF1rN;{L+T^1J5+fa>Y3aLek5_f<6q0?by1-f(g1~-M<
z`&fEVr_%or{ol@}oj2yN*tuJh-+nGYUwZUE_%I!9dzw5FyeTIRy{GsmKEAW&CbDH_
zX3B}nnPD!@zkF1VEzoF`3!dqc_tMQ;uiW+G{zmuZi9YR#h`~>|AH)Or;dN9y5G#tY
zjy5@j?&VAS*%5WZr6zV)___*?=w6jv*8_U1Op@!;dDc-r-PTPjxQg&O90bAYt}1>o
zH=}yy#O4hG+r5DbUdg^@4HWTDjaf}rg5GBs;q*oDzu!ryWL+zXTVFIhz$t#1m5Ib^
zVt>DtzU^b3LU2mpl;!JpvKJsydCY=?VfbKL2+b1*q)xmMN-pqFZSS|trLoPSBK<P+
zcuqtg2iRAC&(t{~Yg9ioRSY55%cTEi2*M+{_`8J1f`B(EYP>>P{%lKoBm;4IcHC8<
zA#Dh>W(qt$yq+K=lbwjr*I8>vniLIdDsr34dI1rSSB8=66=O`C?;If?93Qll)3mQ-
zNqbwdWo{6&v3`=l5aI&#+pLVwVgK$tKauOI_0h_q0?@uG0ZGW@idh~EKJ#VxEjLkh
z{(J$ges(@D|Kh&+N%!UE&Uf}H^)g-&%<OhN**G|pSLT&ryGUtGq3k)^>8^y8f}H~^
zf_s1Vrev%R58ExGO`Eqq@Abx^+b47Tw2EJ{AEsA$3m2Jq<2<<;y(9Fu*Sea=%svz}
z4~NUp5k5#~U)6M6I(pECbtY}h^AS~T4)sZLG+l(3V!=!Cq=XUeD6<Fg0Wu}$4gk>&
zbC7P|BM4Zl^j+LDKrQW9;ij+m>oIA+_2FFmtyGC3Ca>^J1-|%fS!nc*gpg(aDw6YZ
zRD2c=%gAt)Ei2W<fHVM{9df%2*e@^H4bjq|6%tLxd7;;tu3vuh<zhUDlds@yyphMD
zbkyeXbuZy5;=$Zd>5?c<@J{p<mdLfY(kMB7eu25*$4n&$l5m}Y4t=0?3W~7?l#5at
z5@4`I;>s`wG;KXNj3~W>Ri3<V4b)_%8ENp5*vv;|Ra~=Vz6SlQsqvweZg2g#=pUba
zN@WQvL*EyKQFW=^yvKec3<B<5b57`Gx8jB0m;)hcwmMKaQKmP;-{rNR{^FE&zReq~
z?fbRcyyo#>3YchX-o40Eni=qZ-X~BgD?Vw=V42%&cCpCrecB3Afs1Hy@S`>}TUzyJ
zhRNm}Q=ia^0zk`O$j3J8^}OxW6Bmtl<dub}1QYPP_Pa%|&1BShWVH4+@%h2G5Ss;Q
z3VixRoW3ed+g#<v>eGiYrToOpsuJS;_rJA3z!RCZ)s{e!+3CgQyOof58|i|amz9Wj
zQ*5J^Fjh$W(&0^-j+JYgC!Yf5Ql$N@f}ao9#ZA9jy(_jo$PZQgnB5Z~_kL8WE5=-Q
zh2W*h1qDUlEmX;ouNY~6^VCcTU)(8ORy!b=q%WhMSR9Dt+{`TVx!k7fAK6;l%Y9I%
zQ2VrLn3mXMorRSW@wSSEtE;mWyw5g9UNP9OjU&p!Y`cT>dpDD0-mr9)c*@4CR`=wc
zIa$$*l$T|dLdHsXQxA%Fwe(XTspNNQ`Ub`m3C5ucj1Za?rz=QA7A4{MloA53Rl4@u
z4Z3UTnGHdRwCJP8hNI12m?esfyo#lkZzO0mngdZz&I$g>SZH_9XtIexYfe^x$<edS
zp|4{j^j!faV@J~2KnsBl@k~-`=_qjCxk#Uwpwp=Wc-OSV<fCxG*w~>>g-zDaUCIF0
z^xL~1CdHt2BSs^i4{-fWU>_?lyH{8P!@@3@%y=+w%@Skw%8@X%?IL3qo&WwLuBc0i
zs2n8p_26AuP?s}Jx3!|;QX8;~9a!ZRUZ3Cz@{;|TJk{MInUIP#C>eq|Q(r|e^c-a+
zk>4HfcUK$&|57**xxMNf1lvfJb5>&75ar^6p0Ih(-y2{wqK>4KMM+4;z4)!AtLbBG
z<y@)nirmJfsjfEYh!vC3(;?HzWZ*+@&Wa4VSUPXmFCtm)E?jPdfx-zqi0}q$bXCu6
zBFts$p$V+4@I4_=p;I6dvE`dOqM8T8191&Gie26;{f=aOurU<9{5Jc0sVZh-h(~i^
zrJgNQqj3OFqhIp#=a3*He;q{y{-|Qto&+X@th^ym)75UYd*DTg9I|=1gg$q@XhBfF
ztGPj8kyF&5bV7SG4F&a)FS3I?#AHW?L?1tc59G*JfTt~5y0T@XCd5H^7BJc6JR9DN
z5BAXMzj|w4VI2ot0IR)r?qG`&c>!p~)tB<HdEt|NMIJ`>MYb)k>Jb@5Oa4(4?wUzW
zO=-p==Y)ZCo;l>)%TY@^SU=MHLUoQC0#Jgl<nB4bFxB<ViJ^Pr0w+dGUjsD2gQ$C_
z6Fzm?02V>55rF~o?cAQr%AL3fy7h}<irz=4ly$RWYdQ!`iSxHC*k1IFUvhr8<Q@Ps
z(ZB90bR`TJZgeZaOn;{|*f$O6_xb4$q~#{($Fm2XeWMfi0*qXfNFTN+D5}LWk;ZHn
zhV&A4dC_DX(56_X#;;T0E#C4x%o*CTlAqI@GP0E4X$x5Rh7DT8&psC+s<v!H23D!g
zhA^MpZqeD@lSZ@WXU@faK2cde?x<nn%$Adc?!0)y;M=nC-Q`RG=~K=pFCSpt%aga|
zXj9eOxqo%-2b-eL;`&A8;L{s?@`4J!0q8S5RxS~!g(c0kb}ZXDB6dO|D&G4U<3M({
z!hPss3iH;x8h!%~S@9|Q7-$PI&s%e6&3SljaK}4pd58VY{%wV<Nfv&RP3V<YVUIE1
zeyD=41>o&1o302;TYw(^s8ZFGF1>;navoqC;XGjLT2h-8_3fqa=AK;W?EL$V|H|%7
zscZkILj0cs`TtFS@K###n}OWFo0S-Q9{H4Rtc#q--==5?o7C;#<la!a`99UGwZjkl
zw}C1mMPT#5?kJ16sKebXQp83hcW^X4$ithp?%TE9DyI?#*_0dqbW6#IBst$jL$?o;
z!K=yjd9VL8NR9m>Sh|JwqO6{`l-7rWxYa%7M&Z%eS9N^#Z$BkK>GvcqCU&bCt%@+l
z`$t}HJ6Q(5x#{9JA4REZ)gV*u&%_qCQEjfMvlZb-bRdj_c$+hd?k<iPGV8}+MMJ&{
zN>k>^dS&1w{@{q?JS7zihigbvwPkj5iFw}{uLONQe`D_SVK85KbMMzDZKuA7KZ{t{
z*2+kZYVHmF&pqlE6z9lz`d`G@5VQP99x-pOf3U{`jkASfntPT10k`*#O_Hndf?W8|
z^M~C>HT7$A_x@RE!~)jeSN*2$dtF~Q2R%9)_rl6!6BpmyOZ9JtTNVZYqR#p<{A=);
zSB^huyKs9mbsg{E6P*7b=z6Slv-_tX{pWd&0y1RO&zkM*KQbo&QkYGIPq6$0f9XQq
zQ!bUiy#D9%e_@CFpjQh@Cdr9kiX9{0!$TmXutTVFbQn=ZRA;@-%<G%fm5=!+R3J5_
zQ}-QToz^J7)svduQF`HH(>)Wz!ZEQsBX*8o9wy3xDw34+u5<Yt+3PshbvZjN!mObp
zQ0_G1l$-eY+JsyG9zP9N?kxioz6UnLjSH>9a_h+I3#2Dw);&S5-Nk%ug%{~3<VCD+
zi@r;<03tssUckL++0m<i^vOY{t7g8f*>qTNK-4S+>lh00Mp|^hN`9qskM*<oRCT2G
zoCiG-PAa;6`Ie}Q_F|T$?M<X>!R3RWVHb36;YxiVj#awWq%*w4kAW&Ona%Q&(Z)8O
z4^!wP(WSZr&B6`ercCi~&iLmGh>@OO7ql<<bm^Xusm6Wq!qJlth%;uvDTrStRG=>}
zZ|MX61344T!)}q&pI|?<fmFeA?vx>xf>+%Hp)B<60dMEFn~#oEh+iD3AYLAk!~N+T
z$e&v`*}0dcjS6f}DInn($aQy%y&kl2TAOZaqM2n{LQiD3;&o6}zF^PRthS^O^w5fn
zY=I77`@HF3Z_&bGouQS54T2|ouNaLIgfO1+nRpxjP@4ibz0@tj)c{?)iXW{F4=(i&
zZu7RayMzwPY|W~t4&FANFVa2>&#XL+7iHoXGR3}8d?MWU`{{@3Tg3G<`j>z5fQ(gh
zf^y0Q%e_ZUjdnV}9H?c9?bRjx#OE-$(IPKvrJxStBln=5`NN!sB3orLZJgXt>Br^m
zmLet(TTKN?$b*~b5NbA}scEDK??jkOP?d~lLMOya-_jkG^$1`%X?ApSWevLEVOS^s
z;10hC&>bzalSwmok+RA2cOL<cKgZs2S_7C+25*|<8xQDXlF7|&WezMUF_fx0eQ;4C
z%Qkmf$GM{>;Qn*ZgV{`135kUx=Hi!f^UYFMHD9U|@z`B&f|BtfPqhBe%5^z&npY7Y
zxAH$)4R3tL8Q2Q#=^2`^6Pn%HwrgvvYrh3AcGlsD(a-u-cnwUr4rQ2DmFpj{GH=O~
zmHkeT4wZ@NJ=#_86{q?20jzhW@Kv}EOOq{d>{6<lxE*J+2?Kan9Ze5(@{c~QT3GmX
z;Kg(%IE%hco#FT<LV7K>*Ry=|pm*?*Ft5L$&<<@7G?9b3aU_+l$!q6q#{tgfQ|Uby
zEh6sum$#ZlxIt{S_S;K7uWz=fDM)#Ip25-VN^q4qftL$&DpytLO7l|d1D{>O=itS>
zbNuo;tYx4f_m5l+ZlF|Ly&r1;N<y`5<u5$47A5zzvy7Vhdl;2+QgRloKkKq@6(~an
zHqpYVRkhLs$iv8<LA$Dt5{aPvh-$d`Pq|?3_k^8{Q}_9k_H<j@6`&J^rSwf&sU0d4
zoS+4NCQR+;_H?t5E!8yC;TinPkzrqMOyH|@TisdD#rAG%-}8&U4{tR<>))zitb-Ti
zTX-w?ZUi)bbZSaD;;0wpDzgz|Sw>e03nbfoSmM3=0I<349~|qSBc<vpmIkBN2HoPE
z{WU`kjumBnSn|M-=iRi6$FtHp5fh<w7L3q6>9i4We2g&k3%q1%(YJjE7bWZ|AZ07M
zT-f@H#h4j`OivA*yd)8mi~_FpmeDixo`1j8zuZz#t=6{6ymc%O%}LM6E63PWev^|m
zEK)HwZ{#%W_x{+bBGfO&lmv?pQ5YQm8738NIp+}U-|ZI-x})KjfYqTw3TfZ+&iQU=
zT3$ZLs$urMeB>2Y2b*6lSTvd0_zN@bx)Z9hwZqp@>*$!oPfRaey<uMM5BQfgOJ8PF
zAy|uW!IyIG8GILc$$!l(Euf6K+G2W4RJbILu2w6Og=I^|!b6`0ZQ|cjEo5Vmo3wk@
zTTtjW+bGp@r$nqTXYArNcyvd4&SGqn5a3&$l6&MnETkT+%>=v55{Pu(JqY!eIe;I|
zKe(^YsFjS0K2x8U@=)+Sw{wOvWDH4A>ThXZl39tg$Sz(w9=(7h@`2aiq5AjA7|lZq
z=eW3Uc)Gc=LJ&!AKV5&PrgjXr!solM>co<&LY$p11}w0>_a?Tk@!m-8G1_Y>?&|H4
z323~h3$%1I9SgN$mr4u+lC8WHD-oTS6uv%-yiD^o_Wj!Bz^K4apQKjbo5)0G$<E*p
z-?m?2(YvQ-Yqk__aw(L2#aE)@CAbkzvutgB@qu3lBM=SuJ7FA1ePQi1^i0k~qvf$6
zeuVT(R|&YM75cgwlA=|ahMvG1r}y8xev>%U9!Zz&_@2HeyGY59+vjfaph}=vPhU~!
z<_~Kb!gPg7*Fz(P7i<G?a&v&;UKj5HE=Odp)SSz>7Au7L*!+HgStmRrAFIWZR!t%a
zPCN;LRJr$Qeau(?^drcfPkJE8QMp8ip=Nc09y2iqA?O8vFgabLj3m-^m*^aI)GqXc
zowgn?e69I%%KuGx^E$>_?|b3%qM7b}<wg6UAey`Cb(Sl8jw4shPqAO^Ypw>_=9m!I
z=!2~HvmU=E;%z3TK2htus6q%B$($ivdK&pElWyV(?zzjUJb0;G$;!mJV=G!;Qq?K&
zh|obY=d+P8guh{=s6Qc<6CATd=UBc&Vna}+uhr3}&Xo(VXz?J`gE&882g8nkrOq20
z04^FUN!sU!UP@#WGKHL0400chUVig%@n<;AyAQY=0$!5^4n11@bh<yNM09YbS)kbi
zft?oGg1_`vEJEGqZ4#BRoz_H@DG>~NjN+B_;xL1U!{RI^mpVEGleTj0U_L@rdDgPe
zlllVSIu?7PZ$IMuogrt44)?oK;z2$#lP&~ZgyW5doTBYE2yQ=BnE(45i`}+g+vk@x
z_3w)Wv~AQIj8~{+2&~GL_7YGUe#B2vjzI_MP0>?f#iC`1N;9LvPcW_4rVkZY^6{-!
z1t<F=4+T0<pTx<$ifcdpKuMAA>HJE7g47UN?J3`j=a=V>dJA&M)i)jqY@MNlOXumc
z8afTFF^D9Ml-ZRCrwK&aKFxz~--0&Xk6cG?Gmi|PH|2A$E?y8oig6~M2m#s!OC&}i
zpZXV(0}lthAKzUnZ~O*x$<^j(bKbRB!2}AiWCV4MA>MbV?YdiQTlA*UXP1Hpy!hUm
zfby!A*^?g3*J={o#P+X<Hia=VnTq}Nt<=6Zr)%pWKTtFwwht-VWJKC{C<mW23yRya
zBJ}60d$2`*`TSro6dN}mm%0IFDy-FEnz^13cyw_izVwD)9?Q=36`cb=%j1sMbO&zN
z>q$2mL{p82o>JZY#;V)D!uh^-XjLfhWt--5GbxbJrIq_A-!@NOfm|c?LQf(!AGy-y
zs!VTv@?jST^cm@NU%Up9qQkVj_>3hxON*{8nfYc1mv7m9h(%x)V|jxje_Xd+Ue)Gv
z<XBpOiWC4n#$0EgA&1^_-Vfq>Y4cuydH3qi!&sT$1@|$SgTv|c^j~#!@D7O4?s$vb
zB~n8(IzU2aWbWHukt8+F<I0G)SnQEA&`;3DylmrU86FARFTRk1Y8WHpT0b>l&H^ml
zdmQ&cFF=mZASgiJIsAG0b+L^>lrQ#@!ob=#v?gn86Q@seYJ}$T=n-2G^;H94yNWIC
z{WbKofHpwm@Auri!7duRw9;QUv96*7*xZPM0qSuxw2cokobO*D!TB~i58Q_5MUg`w
z!Pz?hTw{x@rQ?9s>JMUB$Oqr`Zjp^|7kRSOehaS*g;~FZh?RUg)b-1a&XS|$<Rx~@
zynT-a{4J1QUKl)Y{VXR^V+kDS7Og5mn6U6O5NO&xsc*ctT?fRa!-@&<zzqi*E0N?r
z{161GJM{G#KrgagQC|Y^n;RuZ#U4SHNT=^%wX+WzZHk{-4K~|ad|39?*zq)!&3-<1
zKJC(MP2wX{csGI7aGIAG1`eD|hFMf1c0=YK(n%zuzULz^Ze?d2p#sx(Mrf~jdhpLK
zmnSXBe1+J;LzaYOnmle~|1h#y?an^0uhlKTv`EI={K8zivOLI9lD?F)c+_*M!^S!P
z&Ud->9G&y%mKNQiGY=P!GI3j`XozD2cEq8Jx5?w|Z2u^$A>Qugh~V^8Ts+tIAI41=
zwbRW7ElzGe4Rv*PY`N^U+wmRJRB|PtrWJS7_x|=JV&`tg)w%-N*|C#_)QlV%`;wW;
z-UVyR*8{R5B|lH5Km8Evb0jzk$jdxYekrBB(w$wQ|AmFtRv-rQ(9fY7hS%3Z52{!o
z+D{|pwBN9D_Y>bFULlxE3LL<r1vhIyk(4LedQN3Ga;NQ9YPLRbNL@NUi?66qHp_)2
z!5=!MrIFaytRYLB6(4&Dr;u_w6cRWN?%Ok!ZYDCzG<LIQpXh09$WS!9tnrS-y^4I)
z#flVdq2uHZ<8#hNQR+=ZArKoV?t&WCzq(!8kDz}wg{O^P{ppZDT+~1HQS!VR?f-F?
zkLE8oU;|jW#M4j4{jS>4{?SsP02_eeFE2exhKy0pu`ehhTBdWRJV_}V223E37TyH$
zdDPRn0nzs2;sfz?@Mr7DYhlF<)EBk+S^8_H-FK&N^Lx)3Gu%n<Wv?&0p!&CuevTi^
zHvWvLTi7#5oN}l6!v2GnpUQ~!?9CJ#G~lOU=J}5BHW<ZpW9}B0%Xg)SK@4xnxaBAG
z5#_+xe+n_f{U2~UQD^Z66=07tp*XGPel6PY4KlGCdlorG6Zhg@efsUin>gU~vxwwZ
ze}%f6h+_S>{{%Xe0FPH1(&wTl?_9{eLXAXG{hOolc^q)|e~^?S{+}B{wK0OWfRc_G
zC{FsCUOeqfygFre&8kv&F=;~<WJxjkueXJE>U`cKepg-G_H_B|QOwlHM5G&v?#m5|
zciL@%u?kyh#3@m$Hs-@&c*U%i6Vw!d1Kn1it!bVxP$=8oBD#h%+bAHk7?xTP^n>dy
z1@&!dR8~!FdDC<ej1<?U_xe(pB1?%@;|s(!b2rwpTjtBCRS8rqq|I+L=h}uDS0EQu
zN*aNj^1G@Lsp~foi3*FYsGd6cop7AozO5O8_B)xKW=*gad;!Y{#ZLd4=}mPVg4><0
zBnLnT2o6o)gN1>DFz_)C>FEg$xOQlYTmn#q`x(mX6lkTrpanZ(j)HufEl<N#T7?W6
z7~5e>=YTf8roSBXN{<Vw*~n++Mf&K@{Z<7rSb+^XGTvwkOiT)v+w8JwU6_o71-$#*
zLQVCV9zA`vqT^T8@e|<CKq4Jn>u!~N__P!8bbK4NaYXaVS_$ZXu~P9w^Nyqyl3Wpc
zJDJS6yMdY{)I&KzepJZtyXP{j<0cC9fRk<@h`8DUm#A-J{@0V0^yy4OP5@HpPT)B!
zY6y*eHD>)jnjORviv9ZjL5(c{*1QU#`J%uDy~775OlOC^!cx6pLbK~K;22-Qlz=BL
zl*2bH1<`~WN&Sl>QSSW>3O4Z-_Uo_`0BWScF&3WvgFnwryf%&S9#fDsq56Z_t_*mg
zz)Pgs>^F>m5bq|!4uJuGUPq`@_#X~Ld<ErpsvHq>reUVj&%k_^{SO%|Tn_Kx(K4;g
z&Og6rDe>HuOqmw}bIsV5<E(~B=DnAR(<b*z>Hbjc$7BNo*YkqqykHu$_7Wn0#EII5
zG(7xzyRjUa&}RzzD=_RdHlw<e>F+hFV<7Fyzw~L?pGZ3OFBO@=mc|r)B0i0-9WQ9K
z%&>WH*BxYR82q}E_z%LJ>w4UyE1r40YBkdr*$I(NPb5c~MuW_K+(S-Bg<?g5>+?a#
z@a|>0pFcv>YwGzT#x9OQ;BFkv3b<DAe~4VHUg)<-H~R{y+-(AkfwjKH(fakD4I`y9
zl5y;WpNzQR|6+J?O?x^nZQKc|)9qPezWSKFMJOHK576;xG-;c@__0o(wcJ;&feOia
z8t1WD!+VC}un3?8+ToOpZ{=yP4^YPhIfskiXPBsj8_yPx)DQElklcfZR~=Wra&SRo
z5hAxKuDv<@Vzu;How)@72?b)-YISuCXM<Cl2$?B4wgeBi5y=PJtRIJPz0Df~|IHTX
z<gf~!wfRkJ+CcUz?A7x7s}s=GUHAKwlaymj^z!N*(7&aMyw`KI%Kqf>u|yh~@A+d)
zi_l{i_!eIOd(q6o?qgH|hrenSJL$(>(em7+HQT?$$~OY)345uhk1w)LB6h~{icOOR
zru{)?y906`hi>^jJM9+-0~qdWCdqq}O-?rk5_qTFz06S&Sofg6PSDz)CA@>(5m8mx
zX7K!7`_NS?Go@={7<r9Dd)iAEFeZpjqp2W&ysvTt?;*Ds^8xzCc$!jv?I4n|nJTrD
z_cWdC%X!+F^)hq26YW}BZZn;A6)A!MV?c{UG7=KC;j;7U-yV+{|82bf7|_cZsX%PY
z6MaXI0(1(nCH!Jda>j%{KAF~<xg@OX>Zl5^GtK>9Rxi;}tFiI?z0H0i(>7Q!w&qT9
zF1IW)pLET%tea%46lS?UdTNZ_JIpn`SAEL&_kRNH+y(BZWbYj>Mehl}tCZCCj~h>2
zx=mb5e=8y3^q(d1$?`89PjB3$GJk_i>6Vtrr$bsEx@l2CXf9U|ty_O?nRb(O8*>ie
zf}$0)C>!V5|K}HJNWY_R{=X<m8=+=#7`c`=d;auaH=M$Gq?R@2x|T|Z`0n_fLrxw1
zk+Y$DSE$~dx)*{!KyO@vH0=J_tsd{n*7pWN<_tnFJBXk7M-+t2ZMzYF9svK|VzGw$
zi}be5OwuZR+s^OOPCCRKG^UUKZI!)74UYzqdp~$wkh4(EiJ*KVGxYSlvkqM%N}&Ri
z79WgKRTCqM^;8Dtf0FxWTTQ#HgFUC5xs-MwZG`Rg-pGqY%FAi=FVe`kDj@n)39x-J
zot+4Syuy}uazLQxs39jNW7Fr5{4{6^Ha8Uh3d>ErMTNACQ@{b266J6?x458XRZ&>$
zQ;;ZZGGznb-%CX4C;^GEq<_;uvqKCh$M=6ZP$5+Tty7SO8!+@V?>~NeXwO-VC4~I?
z8YAidE3~+Pnf~vCh+9OlpcTx)PxIEDALea)zEg|_ud$qmol<S2IIm{%tNl@dGKItF
zu7(jl6*ZB%M<Ar87_q}RIAuh;fZDd7!9S>pk|9-+P#0|H+Ga1lAvBc|uXP_C6G|Q_
zHidW|e)ZgK+xuL*ODoSM-&!Df-2j+92_B}aJ&of?!`5s&a`%MGw+g)B8NSJ1x;6XF
z*bK-k=;)c*iu}w=j9(tkc$3Y}J-R!uQ8V!{<VFiP;==UTGb54DG(_KDz#p4&w;t40
z25yvrUyK5`h-FZ<u7XXwkXKmFK-0jr&?wI1J*kd7CPG7hLx&pa%55Uem4op+Iap5i
zl_ll#p;*-<a<k9YmUs-33n3EYMktsMr5s<I!`pANT5)hK3sl`?F$-gzOeSYsaJ@f$
ze|5A;<ylN6oe?~wsRuu$;I$p50fiZ8-AyK&cR)|F5Q=-&o8P;_D#3fHzb+pW*KDsp
z8nm}1K?vROHu>ebT1di<q6=IsK9B_$jz2Eme;4puVN-!bI7$F-p{2$<667JX;j=Fz
zI25-;HuE$&3Y$qhhgQDd+m6sdOd;fp?m@`Hfc-B#OyI*tU<`aA(f`AeXhQ%llss}{
ztB<4bqv_p4b1~Sji<|bxp-KashLwtkzonirSbX_T?6`(jU_-J*{F?EznY2E(pnQy`
zb1;(hC^w|k#|_<`r<S`Ego1cBICNRlp@vf3#xjD(T5><>_rpUZ_h&iEsGA6zNo08B
zep2vpDraC<G8x{kYI~A<h-OmgTnjqNB`DsydVGQ3b2#_c8u;Q&nk`vW<e1U&SZ8NH
zDr63P_!Zt+mduV!2>1$2UO<AmILvZVds3J<Ol59pN7HV)2ka{Z-11j)wg^7_(2oq!
zk)Ky+Baj72H|bwS)E}go*V8s9z`ak-R+1Hv6W?bCJ@*(|I`Za~Lne3xv%OEGNHXlN
zT6y=~TTdDrxGI!@IdqVbsn8^@K!w}#s*Xi~jm6_0e@LZ6Y)2{^=ecSb{F+-ql1L0m
z_?&fgkFNf5xJrdp-+;psUZ>fq{{1dKr;lZOW^wBzH9ZR}-(Y<0sKy#~2jcwpQ9(RR
zZ+9?8uWfDSV)<kDsEjZ1tCXDF*SVT;$a6x7*3Z_Rv9fiAsry4_EoLjq#530V9@prr
zOO1{;jNMo;6?Q?MAosu8!)y<d_CwdZbmUGF$C4k0L<j86)7YkZaiLB~&<<$Gmi6Wj
z_;X4`MFl@_4FtTw?{wOBF0dT3Z%#)o&mp3Ch|lf)KyaYx#Q@q5YzQPoxAyKewC5$r
z@AItqK0HX^*x$>W-z0PF=j^{;cR6_^zxA7XHh;Gc+tI+WUmqAVC<%$A3D)gQ)jys|
z;4qJ5NFh_3u2au`41eu&5KaUi7r*=!%v~&W+-S8d2HR(yhcU?uU|>6&G`MZeVOB)}
zOvsL9Ldb&A#f4Tm97jBMNgY`<b`yH4S|ZiX;@H{{VtadgP~8{wYZoVLVIyE`o9nn`
z!R0(4)?FaPt34`Qg%#qhtNm8FO^8SmNK^X_{}zhaxKTGM*ZKUH^=guo7NFf?DGamA
z{?sZcD}sDwe!(t}mtAZ>L|Nyd+?GLE#cl<zAETzjT+M@F&Rp9$8~FA@dG>AhD}~s$
z@5VDi(9Q75AfSpsyLtby!C}YP^9d+Exl;aCFc*141#NR|558c_yA)zJaV&&@={g3q
zs+Aoo8J--u&ZBJotbrsQxMp+m<X6ZE-}9j*W$t3mljwcE^nK04-<tVm+OGpoGMhW|
zTCpXlBlqf^gzn$OX#-a9&45XE0itIq<;yI`ceC@v;NPrFm`Kwv3Anp>%fsljO=cpd
zU%qWEVTGaOlpt(J<nCZ%MWzyvTi}>>r2Hc+<=!r~z*~ouB#_+PJ-<y7jFsmiYWrF2
zVn>S0uy!3{$+kU4g+<M3w}X;U!cXqnnj$&5OFuR}C}GQ9;XIfaUr)b_@9&25!7SZ$
zbQ+GD&+{*gbp)7;KJl#i&|t=I^J2i-gU6QH(uLZlM6VvMLKq&_X4hXsr><_TXuz^c
z84lxBlF6!ehVwWbx7~ptAZnh!c7|zr6MDwkrd1^~NKfQo8*$jNbgU8xmm<aZ9Kv^<
z5;j+HhXZ<*empgfqSMJpX_s{(oZQg95bB&zd`N3)@mnZCC}C~*fSO7E!=-!8iT6J}
z#1HoqaXNukKX#lj@`K6b1Tzb85~lcjW&G)c<Yq$Ac_Yv3o|~YS7o5Cqz?df*%#NFq
zw`>3Y4up)l_dzhy(&kamiZeD@^mDgXzxv=FB-C8UJPcCABK^EZ_}LWOZcnU5(0fBM
zk=Qe&W<y@&lG&I|f#+%d#g$i|L-fJFCx9k0hghs^Ja#H8@%id#jS;=>>*tBxa(3mS
zES^cZc)GF~y2Am+mA0Rk0^CyZt)0_E+1-PJpHt0ddK_mQDqDW~lq|JYV*M9;Rfj8C
zurw!G%u**uj9Rvv?3>>!FW45CwNX55yBWLRZT{Nq>viOqsDo(24YCmoNGSH${jOjS
z{*g>x05b>gwKxYNT@2<Eh!*CeCuukD3@C6Nk_En=w0QoQI(+2!qpi;q5L*!8Aex6L
zwaxJa_J(4a_}C$py+dpo6UqIg$^JEAnI*g0(3+hd5RyeLody5=Tb#f^<ql3X<jjxc
zGlK3mp52wj$8s%(;|-5zoKb6lP$+k`7p|X_HmTo$Lh_-eQalLN^D*(`iD9$v${xsg
zRu|s(9ZDwq{d#XW1Tp8S)T@lGjIvu<{%L^-XuPkBJaK5NeS1t!lqy?Xn<OI0q4I2}
z8P741I`?zei%wo~1g4ILyglpCVW9E=$@-3Lo!<LE;${>M8!}9MEAjg=u=9Co(=*wJ
z8~{)u*OF5?#zlx<>?s}Q)@UlFguqaD<`K)Jjtd2USQb*=m!bzxZGqKUO(0ez5%!Y*
zF8&Q~s_WRK=vJ@qY5=^L1u>#BKsk`J5neW?)1gnvMi8$6?iRO@aEG=W0i$!W%7oPV
z6X!K46waVOp+Dp&t2Qr#=gKX49``o&@Y3p#{vbd1%^a+h0;*)!0uY%DJJ_*SnAS*b
z=vgZt>nxtM5p_^WA;Vwx`rJc?IDW>4{N`m)IO;L)CSbcx4xr0(w(Y6_Tw|SqO@K&q
z#6}8FIDTgSSVLh){+K6+_GBM~#GD)@XT9z@>OxiHnH06@Inrduu3z&^*T+PYTM81%
z%lR5W`x`jpz}_bvzWzanYmNu=T*v_$O=D*|ULX$cQ=QX*n-IqY+kVcM;uIx<k<Jk-
z9^~x=(}8S*N0W>GcdbK`@=OoTDok8p59!oJV9m)(iq+UL8J3y?W7+H*jt(j0hI)M7
zo@uHACnZbHWDabNGqoMybFj$F<K!G{OKq?H4zaA|_!w$>pzvj^ZH*GaTi|`{@HH9L
z`{$85j=>4L{wG8S&ST|*1<imlx*r@NSk{5VV=iPF)d;zDbDx$n5iFezK0GFKl3oW$
z2of{HXw0ZF93S2dk<AuQf>)PRfxKivqzR4O8Yaks+&r9#d!Us@1rZ|_J*0D7ZGu6V
z_OL9~Z?I?x=MV3b@Yp=>RAJpTVEta|TNwX``jM1t{jIewDE!Qz1*vm!&qWEatkr@g
zS8r}1M*Om6_xd&}1f8AVmTuq!iuvy<;07WOT?ki3z+-$N(HiP?*l_C7fGfMMvqv$3
z0{e+d{K6~A={P~#F{Y#A<5~y;cYegHU!Fk|U;+zr1mQxvLUsgnjxFcAW`p-NZ~gv&
z<;+cf)W+T3z?oPH%gduehFHoU<WZ_k#nd~dz`d(m$`<2!#95-k=1~*@W*GO`7?RB>
z-r~rFAug08CSXr~B^=7gC6XWHD+7_dgfObBxr1{S<qOxdS;x}1vwD!;t$b6-sHQz7
z-nQkwXIVvOZ2E)LMV=zXh%>`*^0(erU4%EB-L<FACo%{7;M<<4l9K<8)r`uYZ#%6a
z@Q*W(@~+B?gaG*&bQ8uHNgu&Nbp@hid1Dp9mtKR<6d9tP4c{3@oV2svHKPyNPaRO$
z<F!#IlXT`$A#-|>f$OMwe%r#5MB728l>yryZ0Ih<B4dS+ibbVhkxw~fwKlI#>Fs-L
z$XVj&*7{zl?(&0Mg_^)xGWjT>M}3EhlwH_BNJ1&bXz>nkZt5s5-{NaZ>ieFsN<VM`
zJZg_@aZEU^Z)Z%yfetbq<RWHiC)K!=F!j$^8}Vezq`^|18_OJJQlDF_cL!;?x9WO7
z_wkqi{<{8lnFw49(2>=wNfA4Z3;uHM^VbP+7QPG-)#<hRoTOIeC7yCp#Y5{oNph={
zp2i8cHHJgB&u9H5%S}UwryItRwd~$X)x^~`_kJY7?e~|pTIaiwF!yxul7v>|g;0M9
z+uY>$90#G$OP4D(dGf(8A0XOySi%h44*>hsIRl)123R$uHBaB}pwwzkhl%pzuP>ju
zh`r0sIj?U)Z_juJo{(oE&}2%jp1`pw3Vwlr#(k!FrnKEk2_N?+(J$0Ys~9GEtmTF>
zGPU(ki6DNDsca0`#{5(dULYsPR~RcZ$#0c=F8dr2cd~kCs>z)GI4{vn%~fQ;cbc8H
zyR89ta2)!NHDrUl3dEB~On#IJuT=|(ZN}*G`dWvnJbgDLvIEJzQ+d`Fnb7(nU@5Zt
zkxfq@ZfkXmTHZ4$o{IiV2DcdA=60-0aAEbWo`rnJK)#HnicW1_IhPze^V-Ai<v6Eg
z?^QithN{Ahp5o(|LT3u4R(0aK9dp{DlgI0se%`J<T0q^8N;=ZG!Am=gYUp9NIi(5U
zho0c7eg)VTeE*^<=(~OY`7vkU5~f+){aCft=c~OfK9>16o~HGC?DwX_FQ=d0SnD17
zfdft@5MP^IX2Nk8_qX5@d<L!1!U(^Nr89W-dO~wRx-+V*Yuho0!C;H{+H%|Gwwd<4
z>G*PF>Ep~~d7m61y~5nNu}!=U>&bbur&;H$Mu_Z@K{fHeQrl9n_%@i>B@+J2$F5Te
zZG)(Yul6lnp;3}J8`h=Xq0`+*p#<=aB@_Lw(-0<CrTgZ>TFgF!fjOMz!lrN*Z&FeZ
zT3FazM<)PJT2%>lddGBHr(p0RIMt?G%<yi&YOi*TWVx`Y`O@}PUj^bfyAmtGEr)|k
zo{D*~oPSz`m%ctUN&w0l{9+F!Qutm(Vk^Dq9Hl+>>d#G}$HmLtWpJ!Pt$=4%{LG6)
ze-v30{7}0qm~+9JiR9?F0gKPWaL4F<;zsP<zkR<h`Y39MWj+F{sjz)d8DhZlcl9Hj
z3~#&AsZ>l4;oR*tK`RvgodrbO03LTou9qglszd)ZK}ev&<+%Mb0k8)l`P0BWltUcq
zBa&SNff{Lf8e$-sD0fZmw=Pa#mIl&5`xp97G-3~XJoJBC;SYd>-0UGz21}=q{H$p9
z^YgI^NX>N0IKus(1zeFvwRj>*kBjI)jSLT!e|k%Z8aee32Q*8ZgCiG|Qss72X20R2
zl9*5DaUPe^3KNu};vIwc=pH3NG8CIk86ltDR=;d<9X-wWSBtNThi|dRHPN$_(a*o6
z`^*I9N1n*fOZ`Wd_3z2Ii2OXkm(kNV|AiEMD17kW7=VL0f*ziQG@SdZ-e*n&4Mb|_
zzXe~%4BQ;}FZO%*rFYK%h{|UKIqA4;yWbohI2U94e$cD&?!MRw22HW#U(;#ef;Z<!
zF4}|Ru!zIJP76g&|1H_VyOd!c#U`1CxS5KvvBOBq-2fQcFD{@(MtaW#eH3FmSwE(H
zC_e96+kXFSB1%0;gh)SjHjv`~;+K$0dT#uT70dKS_G6Rirr;pd6z>2OHC-4`2ro0c
z(bt(XZXinJpKxuMKDfTrxGO1{8QKav|3{!(6OaK1U;+<C2Yvcog`E=l`P5!VG9RO^
zV+pg2ru3<rqBCg&`|29I*s-H<C9%C^O!n5rh8YhO^86xYaIVq$#{L>L#e`aLm=k=K
zn^^U&3j${+I+agfEI)XCq0E8gyL-S){4th~MG2p5w3b^^ss+Zwdytbe{(XM-6P)6f
zxV%!Yw^Wp=+ZA;7VKC9Ug+L48R0tF%GW&L$PyFt4LOo1=V_w-XvAXtAogPPLY5d#L
z+Nh{jH(TzY@3DOyPm`t1I)9p+brANaqL3GiZ%ZhzOX81_2Dzc#SO2BkJ1i@fcb56%
z^rMAbQ=nVo6N!P_cB;g^=W70l+(!do@C0|vz)p_A9~Z?pluwDLi>Zkar8_~82DAWT
zqk?|PUi;*kB8eTsX$e?nSrFcgHeJ~bKrvr4<}K3+l9IEl8+~`SsQK`~CEWa3fJ|lp
zN=S`o4$?NFG^h~&$GPG=HP%f-d*{pUAeX?A*sfI6YB2_ASgswey>1H(lFPQz*Xt@9
zN<zdq8(ad;)QuKC8(CXxw)luYzK#xha-K3>JWqCmi|X*&w7$5T^I?f21M5hD<xMYE
z4cCi718i8PCrg)KoY*APoyCdXTcd1w;G>+0Fcd;=f%DaeyC-@xnE>)>ljnM@MK^p>
z(YN^tyDQX?A{oik0YD;ISqWGKPqk1EyDl@w(}G#OscIbg=xhyuDS6A+s9&K&?_ZAl
z==lCX)lora7t`<SiS1EXC|*EMA3CEXyq)v+;;y;-^?D=j1qLYj#x3>M*2}qV@%8zc
z|4!F)2gZ_n!Xa>0pA2`T7qqNQ^3SmH=oPjvq+Tc;##86n{_Fh6i$WFS&cHbDrR<Ch
zo`v#3OSNh82Q1QjHvf83k{&yZGOgsK#d#dp#06L@X(FRtF%d5=nM55~Pdz47cn3R%
z7qtu2qpU~$;bOuyLmL&l$8KY53{A|+(4ew%dnU?!Gu%=T=W$rmVFggP@lXnhorbnT
zC-DHcm}!={>k5AqYMpJRLb4vaCBk~o;Y$;n)+$z_M?bqB1FV18&w9?j!ZL(Nq7@b+
zZW8NeXiH_6eC8?h*+g<M`7F+3zeX9j%bz88_kQLvt&4k<7>DFj%4ilH)D}bykvg2<
zBEGlBNy75FI4C)gI3>je{f=OOB*-M9s{Bq<<ny4Sq=0-Zmt4GEIF=h)M#+4g(O69@
zCJH#y`2P}|6+Qh(E{p=)@aj({^!UWCOqo+tjz%dtQ))DxlE$Y+{$^KJSIs{$!TdMb
z#ntgp)PcrYaue04k(pE!`q>Nhx{E5beR7gY03|gfoX6$7K-vyCh&N2d|9*+hk=f@f
zp;#pp+edjNSOH`Cw>|6F=QbP79+D=hIM4mn;yM>G0@LD`v(Ay%O5VWjQG;*bIJ~)_
z5=wv;oIE0AoR&UiM?JFF6FL?chP7wJdGuaPgnh)@p!)q1E}K_y?uSxLM2%$iK26EG
z$gzr?2KTj1X)x|_`Cry?GN&L0jab(@*D<m9KJanZg6Cxo?y*V+^1c6h-i+m+n}J#1
zc95d1X+>d$Xrz8=d*w=-2*ynTT@&A0vD1`v6HKZWid;WS5xW}>b9|mFTuQG)gDw|{
zc>nGsPQQZd<hnCG3IdfnTS5_B*C~H0Mco$7L6I)`C32}$B}Lnj@+G;HrIs+>se0mW
zMzcUqNaw`2QY?GC@+v;qlTRW@n>R&e4}|Q>%Eu^}Gt*ziH$(=pzVOdt6nf`a6}Lj`
z3W3V}p^n#eI!MtLh+L<l2t&!ETD`E>mZH7Ari(gu$du#(79HfFivLqbCqCPc!R7rN
z&N`UbtE3F841`fxA5NQ;dWPhZ`{+^uuSL&%b#V{epI)%)@yBD=))dQkyo;L5nYWQB
zw(wfakzk)zmSn*tZEjd7)?R-QFRI4<`;$`1Iqr5kR)dr>6=8q7ymhZ!wMsFu*mYea
zUtOK8rw>yExUEaH!_OI|+Lcw0zl^nsQ7669w(`*fM7y{)AZ_qwdH27Xo}y?Pfl<)p
zp!~Wrtwtj9Oj`1Vj-KA6M>#+9!gdBOwdABiCV3@|dLH5~P3V*h3q@VsWiD;^7py|_
zE+W<7IKb!ppePZ8!#_6>%)L_0LfK@utN{O?Qf3Kn3r?<B_+JG^4(u{nQVbtW3Q20)
z;i`wJM2%;f_$7f#K;$PcQjR@51#?s?YwpwZ$DZdw6nmb7lZ_GMbSl4n-j&uG85J--
z@@*Y26>i0HRFzbCIu<+<epu4}Vf>LjW-wYkb<&1;;%oe8UTBehA_Qq`Zqw?~mPn;U
z+0%27fj3*PoOxGxMJj@;RxGAq?VWyBC3IRy12>D74wcIGB#J*}&)$ZUvwJYmNihe|
zpXh7EQisPNPx)$+a#!scFIc8~Gey1{FIA{AQ<u^7U;QvH*u-gdNvFSOdgWTaB>-=B
zeQ8~7jpq6jXFf>s5J<?eY7pTmdN9A;QJ9}%UO51ZH?d1*+7|Axz8y2o+r$rr+b4P;
zZHdkDdVkz-mg;Z7S+73JG5BRssQl#;*y18y+raH>$Qz$}roJ=1J*m$+yXHNr9M6a>
zY4J37oI-G>Fr+N!V6EeooAAL!OZex;6#I+Q{;|I`aBm~e>hY&i6GA~+sXD1qTH=x0
zM76*G93wB0FPw%i4NYkeyHK4)sup0*$GvfhZxF7s5<a8jWAG<FMj*t?f<yVHDz_cD
z{+Oc~>kOg4ceYq8gSU@Yul8O|!nl)Q2gF~wpul|DAv^HNox4ITDJ;(gr3yGBWbsk`
z8!SFI5-|{{^x2X$@@@{C-=HMI7_IcjJb_3Zx`|&4-#+hI{TMo?Lr#m~&X(I;xB2Lf
zM6rgOVvhR%JNUL{RSKD<>+%#D2fy9jd~3@De(%f0yGV<uiEH_ffv>O`y)5H%1&Kl0
zud()hoKBP;k#Tex(&pMeo*?k0*8s6^cf~F<orS(5@_1-h)mu#$=OOt=s7G-E2P$u`
zxLodea#ZEMkg<?Z)H57+uwl!w0TO?W<vj{!T4VO!R*7EKz7-!Gi;bhy6j9hXFFluq
z1UI2Ewvbz3;0G%nz!c9Ocl0Xc9X??*0M?28-<hX+b$O+Nu2ZvDE!8MYl(m{bq^?s_
zvbI#0e>F_|00`0bK-i73?@qxrdoeuYL2gK$;Js~rRc1?v_~jEfgX2SI$|<OfAXJr7
ze{?-l`^jRLZ&+s4qSC+r-Bby&({qI-nUyrvmeY;(o~w|1{hKDe7fh;oN6UEgc3YQ@
zTigD(fyPzJJA)C)iaSWvebXr3haLafcC=<<zN1886>@{K>S%)HSg3O5FH|OO)qkq<
zeix}k^prwpL&(NFo)+9W5PWRgrRH|B-bQl#@DCt<ayOP5?I0T8bFECHlh(IUk@QIL
z@>T;_t6!mpU&Q3L=oQjvPHX{nk;@X%-~Z{;MI~k(a#m$BnDV;@H`~DZqPBIgz|m5O
z?0f!J>Bnr8*2eC3bCnrdp<3fK(x5wXo2TebKLTN#IplqGh}$01?4Uvt*bS}oVL_!B
zR%Rxbx{j}6OKNS{npA6{6wJcaWx4qi>3+|5h~t~GNb~BvPX*&a+@asDO)*AO;W+eo
z!mvfSz{UCEGT94hu@?!+7Xy3G6{-Y#RgP=lw0+<06x9=i@cs?ozj0e}V%l7*J78>p
zz3xlS_^EEcJ}~J}>17@N&17=YwP|-0-iFP7N}1vlp66<b<P;^~Vo2``eY;CJ!LQLl
zoXiKFC&*e$prgAVGiFCtZ<{4zkYLibt&_NIv^KD9f^IpDM2$yt5pRcLd5+&dwF-Vx
zbxW<JT?WcaOf{~vn(u#E@JLW(fL!tMiho7zd&^G`W2q3^{zPP?qtW9}Xz^0J^y+?O
zhj9!+O14HA-}b0SBsD@*(DJe9LuQ@e(8vx)(HEg6zf&WP>uo7PKpN1vW*B5#u`_V<
z9jwB%khc4~X^EBfBcpeZEQ-?}Iz43WIn2c^Sz3v*P`=WKFP4pTT%AnI)5*Ppq0fpN
z5KT#g$EMB^=#iTLUFfS2FN+kN0-OHq3LT+1HUFLJV#=qMl3wQv&^31c7Q(S#^fYAF
zs*TgM;U_Fk%eJ?PpRf-VlQJJJD_-R_`nWV4RfKwszS(1E5E{5m=d0N?Z3i3NCR2*m
zR_WleAXB7}vdM=ulEjscun+W&Vlfc2=&J{TnA#6nV~`@QhtJJg+#~DpXC#EeRLyQ2
zw<f|O;%Fg=OK64pgzG)LAvMPgVGn?VQDw6dVPDH!-s1*-D7V~bWa;ms2;n4bsl$Fx
z*rQ<xCI<5Ek|gGqgw2Bj(LwG!fwY>ysb_6Uq~_1M1wYmxm~To|3Z!iWV>%sa*5SD9
z0j}b*xxZqsNXZocIg*g0&HqK+dqy=CHEqKxDk>sYP>`kq(iJI6RZx+R^cJwtA)uiI
z2muvQ5a~@pK<PE1V+a8o(xemWNl;1X1SugxDDMgO`+nBD-u12T&-2SAIcM+Lvu9?{
zzNVZG*7#BUSS(@b-8Sy@@db|N!w&^iieXHHmDf~Y?BB;a=dWQzeoFOj63<-2(~FcV
zGBi7l^(LA;hzS{5->OYav0*<l>CyfEg^(OZINsnid&R2ODo@SewjA*%setIDV8(*t
zq{xx>gkg1t?z|B`yCD{P%;V!HGnk|>Zvoaqbcm%^@6d*nx&D;h@`9<OPm*#Hya1oS
zV&wTaI~duJ$PW+t!=C$K#4hjj^PFJg>(+a%ru16~2(Z}}(KlXJWTh(1db+7jr2GIi
zIS$jEMkOh~f7C<cXx;s#z2L>?{HWV$Bhm=~8GUHw>Ey252;&x_P^Vg_u{eBLBjNO;
zMg8Gor|8O}<})4cX;}wy-l<WdWll6AHTh^ED)!r9lDl={AFYos!NQ3BX)%aA8;WmA
zP9G@_(6rt_WWV7W7d|zwBjV?#dy#Uk77*^fK7QeyIEJ29lB*J6B5M6TEi&RJ;4zlG
z7>~r5ZX0Urm@%uLzs9la5pdGww<_);)$*~I?lJKQxb(fdpZeXQ4j40L&(4?2Kiw|A
zomAH&1Sc4_v&Lb&mEgyAQID}qhK#o0NI9+vUhPPYZ$~c|kEPNovm%Apta<FJ_mX(b
z8OCEfEb{y9t1%un6!(I#b@4|#v+eTjBvikny2`GcFR{uDx`MKy_~pN>zUg_9;{5Dx
zJ+G6eF6DmNmL6YoB+SNWN*J?nO^Qrng3XE+8*op=ZTk<YFpobfEa70BV<mC^8f9{j
zDPD@!UWQNizM<<)ZgLYq&fLETaMb$;gD`qL{eGF<baM)uS&Qd(OY76yD=1Akiw=(q
z6B%vY`N2EHY1@WF^xQ0k#Siakv1(Q%xm6vwL^0fkQC~fKGD<;!pry5tDLgT-9DmEb
zi^zwWa$!3hoGT%oAlzMhqWQ{X-IL|z(#BCE4rM-Ce5qK1eP#P}0)6WOAl?G;!<psk
z*M}+23bk-kl`$>tq8putmz*T9dtX_}wV&*fmMhgB$y>;zl5YhZa5~oVN9=-uW%*kV
zB%#l2vhN!Qj)L<_j_;mbmI^;OiFqLXKKjw&M9_U=+fGt86i#SiL3mK=pCn0|<>ikA
zYr)Xp`cJO``^h^}*Ix^b)f$n{ZCO;0Z;(0mZcj?VDV&7L%?P!oIv9KNQT>YH-?sHt
zBU19h#uKLa=_m~Z&X@&@-q{rN7&HBu$JuRMI7y-jM|-}sn^`Y<0s(CwLoK3WOd2CR
z=e9N~y<;3hKNR*FCECC$J8j#QvxQTWnE>rJ4gXGc8!WQ$H%~`S)0#`oPA9Bh9}GIq
zNW;1QN9d1}b-g(hpWEl2WB_vce}>Hh1mX|q)`49$JTmM%8<_qXP=t1X`v5P73%uv-
z!(g{C497$8!p*eA3K}@jTbVo^h4{dG=;y7H7Q%AYAUETK76ooq!?O%#V~(6><P2pv
zGnC@>DO!;qt_1FsVeOvubQeiE;twgIYGCfiW%c!eN$;xVWs@rW0FZ~5uQ4mD5WZZ1
z)nwyp{rK{hcedi;e}_DOidMbfrJ^#fYP_pkrq)B%<uOm;&fc5VGZs)t5A%`kgWbkV
zFy4j(pj*LX%ut^X+?bXKY@DBIc{!k<S_mg^Eau{u`kZ8jT3LIMEwOan;%DOE#oco|
zxL|cWV+Zf5QwmgFH8AL^cmV#eABC5_5=Q^#;>^A5Xt?g=)|Z^mHe3j8V!G&n)p@+5
z1b+bXg}N%V<3Fbbv9%+FTzuS%zD6MKQFP1e4c*36teGj!N1V1Z%WXUL3wCu2Om1oy
z=$S?4Gxqdr1R(d}k>5*_6^%s9ta+L<<praCloz;_RJf?q+~L|0B})A~WjT503~Lnq
zd;|jt$>lsiQWl^z5@zqr#v>AA&S_(b2ddpsB;A&zsdAIVh4WEZb9Dw>YqY5l4&>U&
zCgfuUGLGtP;-uP|Bt%1XG|?p7w_uXJ{$ha%MTf_RU~kM!YCCtk*Xf7=+;?xk)ld&C
zr;iVw@z>Oeka$FpVA*W$p=Z@ZCvC2Lc<o3Ft}|VG?P?vsbqE)D`9Gv3*{a!=!s$h5
zWHxI0O!Z6Id38!hYU!#LxpQr+@j$eD5gKnk+O?iCx}mYFL^Go>87dARh#yX!JZ{{G
zJpN}X5m>3`S{W#=HKS{(%z3$e-WH1IvS)OB9cs=Q$t{iul7|&MO$-SwgvJI#0ee2$
z-9HK<g0gP1;_)SiyieCPo^&R?PnmJ6(v2O&Pv|^JS+TFe7PV;*P<>qCc(;^<-eefG
z;*pi24%m+9uQ50&uNAMF2o4s9+<BfZ_-8w=$B+a1f)_er0<ld`?;<@Lkq1HjTe}Cs
zIFYaSpA3#@%2GJD^R>eZgw181goyESngrf-o9xa%+7V}jv8firBbMLQU&GMyEpIwW
zCkK&;uDWtnceVe}kp8ea1qhgJ>^9qbQ$_6V>N8N}1Kxlbl)6<&v}(iG6|<&0YW-|l
z$5jMD$>uF~2i--`kMAgXt>BSE=G^-x!0b+tD~SE@({^!PS0x7sc%Xm$+14e*JMHP`
z+o~WqwG{-Xc<%CF-4kxk3KSkDQ4TXS>n5mKhQ`8;1Yw44VVJC(e1j;gAw$j>?vS2w
z79Tw4$Iu5zsrj0hD7p;ubU^k*qmps_10aQAB~H3tjzZ*%?7%407e&$E90lLTw#eKm
zV~hkOH2L$-z<3Wc?k#Z4PB#+~J1`^=+XT1`S<^kRg~UVGTQ>1gFn`hIvwfC<AkF5Q
z2jFaJL-!~sBub_yAdZ7z6qo?n_oh`dOPfMNrhXcAtfP9*5BBpyT`>)3cY;fyz`$i0
z4U*PLk`oCcRTp;SrxW$AO45#QUbY~p`^oW|$-pe)YoefAql|Ffak&xYP=JA4|02r^
z%)4xAAFAwI_Yas3pkIbX+JKO2BZ18M+B|QuX|0wXF!v!%zUk0NM3$}?t-qdei~BKf
z1`u0s3yVDVi;lx29ylLu{g<eGECiRm2NtOih1mGDueVK@<V1I18n_#AfgqxIQsTq4
zS7!@ADjxtN`$)vPU%UJa53U-_aA$_i4$FZ~5NM|zKRJVZ;-kH0!q8^9Kr<eER9M=6
zlivv7K0pWaMmJ47XBmTX1qtiOA<*{I@BQ=3(Ly6IGkDs(AJtbSI3RHmS3COVe|$>4
ze9!<-pvbBa4A`n`;sz!}df_XT1uUJ4xmNtu`~0;Vacuvt0i#*8yTro9eGmE8#w9Qs
zVXdaz<GNk$A#i)wzYDX<l23oXw#be(Q|>UJcoDJy1*#tsQk%X)5#a)j&lj&b7pRI}
z_ah)>`#;OSQD|V<a~JI;#|06fQ7aSX6NbIqCk09)>m(|0mHhH?I;Jppw3l6Ct!@C?
zy|H#p#J%%Kz=Z@*gNV$3(NOZ*XD%Pq6~3fmR}Xm2B_%J|-Hg5w_FINUUz?DSkQs}j
z`rS#omMswFEP*M1>6ec!3z1(owiU0Q<)?wJ&5s?9ieiBj^sO~8LN&b~V|C_s)!Nx!
zJ_#R~UE*=%Kp0S-Bv|l~Ydc+Kvxc%-;hBwGL!>(iSm_mS?ArqGhh{GD@sMJEi`FGs
z5(UIaeu&7m*TJ%{xiFQ)$wD-KP`vrHXm2&oTRc2z=5u#vc+W1^aV{y%^ceah+Kotn
z`goEx7v-T>XFZ&)tk{B#HMJn`Q>eF9Q+D@AtJ{iE_|5o(Zm$gFSWCk{M`TM!^&LUe
zBle((6KV5jtD}3FxIVrfqXd3df(;W-(u^Y#<?cQrqwG7RHI`-)B2cN0On(pL{7Pri
zh7uJjo6B@;yjts6k=(I>d_nK&5HL7^blV5-T+<+~;Ct^M+6o`6C=R_!DMFHKd7==B
zhLfZ@ok`3gO^RaQRn}Sq&47XoQY|FtuT9=v(cv}uy6g)Vpl(B*fy}l7C>axlbZmVd
zvvmQ4qX^}YSv|fz+o${RoA4zIb)5rqqfc_vw#Gds4(^u^>O^T7cJbLFAo8fP83VH=
zyYlj<Ndg*kmLpsHQ<74}Phx4%fY*a0+r8?seeSB1ecOKN(L;;VaDk>N=_~HB*wMkB
zt(YoY&w~VdLi6dKCM~WSSFNIJhBXsTiQxUnJQNfQTpL=Hjq*LXF{{Yrv;NnMW=mIu
z{fn$;J8Zp|tJ=y2lNH4#nePjAeN%)V8w@YfQ5lnXKQxfuJ`@#c;cRg#9wQ$4C<+UD
zTWde8^DFk|jDQNkuu7~Ui!Jjum`%p>0Z3^@QoB0$H*Rl^aLyP^AO1<4n|0PZS?^w9
zgd}U_KyEBOxrX1Vs5WbFQ?P5t*96Ckp(%pS<9DT!B3mFS8npH1YZWx@;KGGrsF&4Z
zwyIlx1|dnF;w5a-D)S_u0IXB{tr7?AUsY!iNjyt}Sq%zXF)l$GCo3ksDl6p7Em7TW
zvRtQVpPS;FT_Df}zZ<9!Nx1ypVn8A8^Jmq}Z?b)yhXS^hmGthOhbl!j(uW}34sv(3
zaV>4G-V=8QtY=W@3g4vz+=>$u?6|@H1k1dZ(26NAUO7X#94g$X1YYodYSS4O<8w0J
zxopDp$T;1l92bzf<iRmAyCU0eoKAzJuFl3tEMhW%4W1!HD@ux?M+_6t6>{I9ACqso
z3-q3FE)4wJB%S)C8V}%|5~o(tlFosZpY}m^MLYP9ry}0BU+h^ed4J=s7o)j>#}$8!
z9ChWbFM(D5P@UX+Vu0Ba6HM>eZ*_bYEZhHa3V3A#o88-pDG&x)lN`oaC(&|P0{$k<
zW&{uK5p_Yr62H!ls}8ox(unYn1=w)2z7+`y*UNKv^0xBPPXD&es^UEg3b5NQ#yVek
zq+eDGaJYF1=ZQga1DVS)Q($YD+s^=yBJc4RtKRw)7i)e?X?NQKu1fBV7(~VZVA(0V
z_NHVTiAUf!b-BU$yZxQ_F;k0@gR)g8`-C~v%oi=N1vw#mV-Zkn*4UG8h0*r<l<Fv`
z3Ra~vJY;XfAm|4DO_5R7kV~r{+`}t}R`an;!LJ(HgPpSMxe0Y$$YSE0BFGoz2tIN}
z^ra1af%bmS8+<YLq(l2zB~bjz;psS)Ylr|1C@Y$wd|XP<x*5tAg#b~lpHj`w&bhqh
zCTS$}(QPH3*O$EioKdP`J(ZshNzi`4Y5!~+ph}mJ8FJL|PRb0sNQpH*24mauTTQLT
zb<5yO`_s-O?dPL4<?qEX|9!Xx9^b|C9|tfm^E)s&@%LGKJ35`qHgd;*JjXbwMZ*7%
z-fPc0{gO=3>DxTXMUb$-`GsQ+%d4>?fjs}7eV~_-0;GM<f(G$^kW4#DXS(!@3qL(C
zhKq6vyH;tbGIE?zj>e0f-S=x<zm9RI*q^0obl&EfDtp22j=we<bO<*chj=N>#sk33
z@+)1<n-^|$<e$^=hZ7}~sl+`~b*QRkGCbMq@jquj=oQ2@t?5B!)(>FBW0&7O17mmp
z;azAqDv=H~#)#1@8#cg5=)Z2ukw?IgrwuH!$Pd|%+r>roE0evTkwACgquu}E`W?N;
z)OUH88pVshw-Wng#{P3QnIPe7EdlM_Mtj!<mv`0n^V0j*ZxD3pDC|Rs?C~}V+B*@A
z!cWn0J#M<a@sI*NglXS?645PGx2Ry&t}8y$Lf&Xd)fGQpJL1VPn6#e@dDnu2+C*f7
z&4SR#FDEItiPQ6P0c2=^QeJK8FG;zWQ-&cN;jTrvyzG__q10C09elC4Pmhr2Zgubh
zu$=I9zR?)%-p$=?ceoeNVtG7L#za}1NEs?5?{ES3DgNU(=m*I}J+QFT+CBMH)*qRd
z_$<7MOiZxU>kactA0y6VNkjfUL*JAgl8b63EXr>fU)9~|SRguiI7gnj$lRsSdpq};
zhI}a!&z8T)eG8KNI1_JCV7NzhrFphGc1W(*M6Pj4K5-gaj#aNl1AXU_`~!ifU~uzr
z2ul)kA%d?Pbdlgq@SeBfi21!P0czLAW;@Wam3#Ho7n>j}X+YiCHZD~P^0y*h-6LZf
zBtH4NU|l}UIVbU!qi}46+=r_{nRucRcW31yQr)Y-)G{4A&<nGfBCu78)5{6aS@zEr
z-nj1kzM8fT5u89B!2%5z)#{&YRPD_=p)duN6z}fO9@C+Azru;L$z}wWPmpWL+)3l(
z>W_1XY)AJb^uWtbs%WWmTGgKDHNBwgS0s~vw@R{AMm3(F21dw!i&iWCUN~jQQ8X&l
z(FdnHso5e^Ek60Ax4(b>)iha7ewv~qK;y<_QPSKieBzDuDCO1#Bca!a55It|K~-kE
z$*GbX7USPuJtEg;6Sa)*#tyrAn(9iz>oRm>?Z@5qD4zOp?Y3wnc!s>sexh@clALag
zMo+P-qyA$jFr2v$pYTb#I}1(hZLzrXEDEUTeMymVf<nB%W-aBiNYJSUU*~runRP9(
zKxML~EEO~(J)b#te6)B9i>+L#=$InJ08^H>t5*@p0j$M<TwY&oHd)vdVw$qvx$8QG
zTUIV-km?W>**jJGqyTh)5lX#ar7}<PuBSJj8rU@|ZTaJ&>U+qH!)X47)WRkWFDc3E
zY){H3bXf8XO;Uv-3-d=VVg~?z8TY7`BT!1KTvF?!u9G<dW~51~%w!v?OB6?hnsRGa
z3b)o}i1gxjGzDFHOssyNH`_VZ@lc2+K6}0|7F%eOQ*gOf=Rh}d<sP80I50^q`563{
za|;^1q=NgU<cLMj$FZMr#7UFl?mT9riQxoFwA;>XIGnmYI;kov=c0tpk%8$cYH0}*
zZU{y659*e-)TFHV6r<*crUJawPby;E5otvOw5Idn0+(lB_X*LU>$|0irviW50kF-*
zvP(qoCu>%V!Gv(}A}Je+0$`fpS~R<ztXt+_6j`2Snwyu3MX$Vh=?ckluUz?XT46dI
zg0pn5)xi>t^T4_WWzFL6c(pRvaMv-9Kq>t)n#-g4%c|i5hOG}^?j1+(Sh@j($%t6>
z2LOC4!|V!2(c9j5@Nl(`7PADFC(~2dmEV2L==rpdKhw@+s-Q6MDxbL8`<I^L@s-p0
z1?GI35HIU+1ECj@j-J>d*E&BvBDcXeld1x?qm!r7W{6Xz>ZrDaNvfMtplrNkpHUlx
z+s{V|!-_$att+GgzTeGH_Plks+#Z-Hjq70_d$D+DVf^9`4ZS)~MhRI;V<GXaKpuSJ
zR5NiPsKT$Rg>v1cFyEmfsO`f<t4(UQeZsDr7b^-z)Ac=9w;JQ+AVOD)dbh!bJC(Yi
ze&wA&rrU-1F3NVjHXHZ(=V*~)(rcXqApu%sDQ6t9DF5-Qn<bT7>0PtK?ocm3WOoFB
z*Vy8@``DV6tr}b5{NrhF^D#(m@u!HvfyFdvZKj&q%yaPaP21#EQzBh{IeiAJN{y7a
zZiwwTlxLYg)I-Il=aY+A&-nY1DP!-0bqf}Cn={R)iT;uIfC-ikQTIs~)M**_<x%LJ
z(HFJbjTLpmr?>kpS#9S{S|b)w!1VoFQ+^_(h$L4`XYmR6frA-!Cx2SoQ`VIH5n}p8
z`wINb+J~Hlo2w}LzNuRcX$geDn9qVFo{Kgdb~&{e47(4?u}2P@?BdyI)Nq9$2}OJN
z^$j`)Q<h9xv0`8Ss;07V-o4m@MTC>inyYi4DLp{$I=rfASe5FAV-a=3W4VT$xAxt3
zz+#(&^Q)HV9VfS76n2o5k2d0j&crVrCOlH+uMxo2W}_FscoBRv-E~st-&MxgM{%Bz
z>vUh=7v_wspp5BN0PspnZZDarkA69*huzkM%rJ*={d1Pu*Mo`|?c%PhSRGAVg|O@k
zLCqxhvatM={A)FU@t{Y62}`-OS8Z!jpe$cxZxM?w^MVnpaNx3yA!JppBf)t-mBwY$
zgv%h6<g@Kf*%x{lOmEqUP$H$;V)`7}>l)ff?<pruf4NDaiCC45m+<G2Zefq-{Stj|
zy>bu1qpXT`h2aL&l_dD+%cPz@C%2WhC9t!NYhlG=(>E%2t%Z1s52o97CT%jj0tiJ_
zyFQ`W7P`E8dM(Isim*#ldDo$;0Tx_y6k-d*>$z49aMgCNF~>O$T-Pdp;FK-{!8=(>
zyeyE92H?&W_kd-QB3vxgj4}lXlb#2-ey`N`xcI^Oc3hJA?PktJ9VS+9qxZH#`48B(
zz~Fltkzh@_Wbvpq#vQI8!r!e`=6Rl34LMiI?w8XmL?aTsjwWD}gjC0xXLC!;bz7!8
z;-YnNXUpw-i*1<X-m;b+!4&GbWk-o`x6UVpi6U84FYW?yMm|~)sZEI*ZlO={Ts!0i
zJ?Nh9RaI$8@prZ@9;3A2P~<kD_MXb`7mJmD4h3HAqi*wt0$R8)Pr9_PA4c@rd=4gO
zMGyMCI^X3SMSpgY5^!>GK!8Ts=`|>~Si!1<L3hUA!cWZHHwBHHhlSuX!EwEoLXmd4
z)wfvtmNZdbuZ2`WS&8T<E?c&f`(W)HVfDWJq`G?lG=Sp+>@2p_ETN6}e)>^6@kXQ-
zAMNu!5gUsN4TntGWJRMYi?Qpy-snIb>+GrLg;Srj>Hy1{clNg{@Ozd3+*V_+t%I%N
zNs5NC8*W`>XUixA0OD}8M!#m(MjYSeh;`I>9d@GS^I_7fmmBrOktZAHO~F)v9k5xM
z6JA$e(-g{xCPHd4O;y`GVl+NMDKD9IU8f=6-zV>xNRg~Vh@46>5SCr0UF@@Q%=Fbe
z!u9yhOM@sn*cIp?{)quBYiz;}gI?eiwQKGtIh-ykD;3kdEBejEvanf*#XKNdHc!If
zz(9<DTo3?;Cm2)a8<>`vxVSgFQRQ`<_FCifh%;SJ!G=BZY6dC&xq8I_Nu|}Rb6}~r
zPsqTnD2!D`CL1#Bnt!u@N!Dw`R6X~(_%s6syhLGcL1v32h^`fo^V2P?*t7OPi!V04
zP+Z1}G;h>g3+2WQJ~_>iNa_`%!F;WYs!n~FzlGV0i3Bf`E|*)^cFGMEokb}~JxnR`
zQ@EoP)ah)`Lf=Ht==(8acIt=#;q&I%AJ8UQ`C7M9#jVL(%{7O%XX3Oa5;sQ2ugG6K
zT)zz}D2EaQqZ(T=i10?-xsx-Np8__aRprZ+b6Rl^5430nY~aMMQR7@W($m>(n}*Mw
zV}ebv7#V4Z!RG8N?#o&~V6f#e@VMcl@bTQkBxP-ibSLuqo&akV(eJksrV@7v(7w81
z#yGwgzX9uuzfvu2`Dt_afS_>43gz*6omM}kPab@Bcd603iB;}re=gt-rr=8Y=c0-l
zElQSw8`wIq6l)Ws9t;7?WO%`>qUd`7_nqJ}nKDpoKmd|08k-2US*oTeogMSExSHpm
z2zcb9>$E6-NuTzRlzF1COsG4R_Dc+CmXF3nw$6K!wazS3uY9h|s97r>?Xy07k|uCH
zVH7>B+0uBVbaiJG-3%;BlulQmye2ue-m>1Dh8OH)E>@-*V?9mn3cGbd!SLlxyssar
zHQ|d+zT%ZfpHmfdoNdNq5gKu@bIT%(c@d|>Papi!U-fJaL@|XMkuL$6D@l|SAHXpF
z8x1g3mh%Q#-T0Ng0z1CsrB!cEdNUaeM!#~wgK2~0`j#lV&mR;T5ox7iqauiI(9r5(
zwRw&<(aO4YBO75CfKjYV=ZXI?f8sf!B(r*YLAp9WVrv+lTn~I|R@JC|HgzN|F-$ZI
zi85lsu<iT>_im!zyn7jOHLK0V{WvLp;>de`+OnUJ^d{0yzwrx5-h|p|Z~xH7z}kbr
ztot9}_a@lR%=8QG-bCB~FB7v}flRp=m8MI79ApBcBA^}piAX;H9&ZD?7H$6bt+m7j
z{k+R9YhgjB4wL{n-e7!m%Ma8Wff0=j{XE}1a`P$$9&AazzT?^Q#338tWatD*w@R0w
zb~9>CH1_yGzF!pgw*-H(8!|p~g4Xh!<%@|g_)(FSHD$0I*RHzBt5)pcX><px!uR~B
z3)fSHKXupN*COJH7sL$@Vq&cBmPk<$mwv6a_^}qvR$>qpbO2-X2{<$=88=623ka0r
z3k@Y%f5A?ZgUwD$bgU(^<8^4`?GMbXEkrt%E<AuqhWQGwt-hWG1^35(ymga+wArEt
zP!GY8T5KgAJJL$X63YYaX^W@Mh63?J4*9FIF+K20glBmouyd205Bj|NU}zJ^`ry06
zU>O8s8}&?swBXN1P%JcCsXlS$Ec>gJimB(HlsG7RL_GtenpR^~xI(q}FVP>u(i{q=
zu$HDhGxPK1HwMntMkdg|YJYCijiQ%>drChn^V)k3_VLWV*Mz4)6Gh@%S=vT-D5+K(
zt|4HaxV*0I`FL9Kf`9bhG>-I|C|cQ+1x3_Z3oNh)<pVj-d9<&c9Jb^kC1VJyx;qY5
z18(@8z_7e6Z391dkg_<wbHJ{xv9Ke=*%!=vFmF`SX1w*4Gxx)NYG~-_*;BMT1&RS}
zO6QC%>;p97Sg>7UVYi&>^%`vxuN;F#?g#fgt$Zgx+j4zKTqCl1t8vo7b7~p6)2_8l
z-j|HVmWB2F(MGuEVE-I2SQ|ypl-cE5Y7L(K0Fxm>D0Po{7JpZa*=c=m`{(S5m!C_`
ziQdAz>;B9Vh4B3O__B2J(P$scW6y(z5nU9plX8pk^-&bUdRJRnJIkfpg#nMiWLt*l
zF~~^c<2?zMFz8FDycx+kx7_t$`el3K<-A6>oMX|7SF%gX^;xwOo8oOb0;A=kEmbMt
zH%QbdvAu5s)?Dv4T;UM3jR-#3=OGyp_@wI^7{+A&{d0Eab+jC_7^=^d8Kvwqv&Ds4
zJrh|jsoRJvHHi3nD>`aZ8<Aa{{pjJiLYB^4ytgbC5>Q=6a4JGqINfdksxTzZUp)j}
z)(^Qvag!b*zDMn^ROzaH%}1;0I7a)%{ZrF~itewi=rly^pDI<+br|aC7EFVmtaM>@
z@^I(I>3e!F#nSC(uYo;kv}=u?zMF}nEC1kAu}$5?xIqJ?8kg|`>^RLezhQ!{BurJe
z>?jE5UY^ZPK-@Ovhq@EIFH#ifwGJ8fyE#ZauTJvOz%*3Gwt(;FIp#*tKkBBW02FVz
zp;BH62*Ez_oEY5#fvf!pb9WC5m!ZtafqC<!fI6V2M50<jlM-(1TkcrY$rdETzRu}2
ztDrOJZ|Leeuv{L6;Qi|wu2#rcRXwLm)!Y1~gbIZhkB0Yi<1SYFzMq0>k>S_K;W(J-
zKr;K0@(iBFQcKTo`~7!Cvn3NpXXXkxxBX9JT}e^0o{Gi#zvka?rSGwKfy-8nm*^wi
zOTb(2%41oxtc>8#k6kM4)tA=n<ZzV&SB78l?zS}Q5`os*le_-~Fjz}=E=|cDNlxuX
zz!Gn{&Ggiivy}B3r@(mhXYMrA48<ZKEl9O;QuT|P*>8@8Vl_CCG`Fys1jlPLRmuK<
zV^>HKE8m~c4S2hKWX43NCO@I@VBDRnn90@!GQEznryR^kDi!x(rVB3BBA3dFG|gfg
z?%SKX7KK$nC%o2FZwN+QR|P9AHR<bdmv4S!xpEzVXMFum>kVQU-k)-seJc{^Qv%0q
zWAQ$3jLKGZ#<<T}C}G^k4{|x5@lNg?--Xdc=oGqNL(3tOhxo)W4s`cdM#2;W-zyM4
zS8dEJ;_~^Bbht9;865qgHH@`SVM(<!Sey{8I(3LRkw_Pzy~A2iT!{A{cu<_rm`L<T
z&vwLgxp!E#6lFFdOX?z12*{5Udxk~bwU<;*9Df}RF9y|xamH+FQ+B%UdXdbOSBxi4
zciXI|fXg&e=A~xF%VZa-PD;YuG>~0ltogC;0`stIOKG(wB!Mm>ZZ?Km<xD$tWk;BW
z0oZ6$V%4}Y-zDG(yajokAnKm|RZ?=A62}3<a$%HD7?l$9<EK--e6*;&&P8G*<?Vl#
zVk!OpO3KUTbBA%vUR@<}M_>h6?3J8gPMf#&N-9U=zB)(Bw^I$QsdKe&xm>5eY5Qpo
z7cK}kMPVmzOLhv0IZ#^{ODErLYndJq8D>V<U8+^qTStp^i3+^xk}|(;k=MLKi#Suv
z;$L!1{)EvJJCTR`ScC0E668z;7FbiBEO?&%ELLRP*1Z&Sf)ua?4Bjd`u}=57i}d7a
zx<FbZXg74yh?#vB1d4ZG)i^(Vl3XV(QC*3_RK8~!9HROKHJcAx7;@w}xx%ZA1JofE
z_F;WPyWQMUqe!Vj0vy3+VhN3t_4&^v*)w0%ulhfav()FXm+bbaj(F;M*Q>-z!UZh1
zudouA==KVX?~VUD5fa5g{@PV@+H{<Ur=`ALD*kdGGAG6~6ChuDby;r4lCOosVcwJb
zi`d`Paz0dY^#`Izx^hji^Q|5<<fY*oYEKepD~z%NpNPR{iCSUO>lWtwEhwHY_+u9Q
zdYEU<R|sjLk-J#@bxN|jo>)b@bsObAc_CpAcFgAR)fx;4Cgz8ff7;JDT{f+xH0b4C
zd*`y+)6kYb5VeE997ycho8+2sIAvikfJlLXNuLv#>U?@l6v3l5iy3FoLv!w$%t;Kh
z_<Y2?G)^IFkcv~zUo6-P;{_X`Ve~8*8W&URLSO1%)P?9A{L+ZKXwnu23;jk`8crse
zNzkUX(V_xl+hA!oF^0`q26)pgqbDD%D)DJ5mXwMl<bBV#sw1_xe&L$CerdJWt`WKY
zH?48y$*q^z-DTk)C7ONTMbi%syv`--!n;KCJ}f_RE4o05p}9S>=#;z6eHt$8MR{Ft
z@}2h0>&>Z^9GaA@u5{BFNm^k7B5yl}jp03Qn)v(CyVWT`gZ1tgnbiejs5WU<V8Vh7
zDYczbf+dneoa+@%d@H#b-6h+C%Ufg#XwszY=u{Zm4ddPUYq3lx4@Ceinba4uu5KUO
zF&+t7MqLg`J4x1E7rZ6I4@My_Jqf&|Q_KInU|@E^U{S<Q#W1%+>jh3Sz8oMg`OX&c
z({BE<{VJB3)SUw>gG>S?`W+eREQ(y&Vo#1F9W}hpK=8uSlTw-zX^Vibu1<92r~H$u
zm#A~XO{rwx=_3~U`^o8khs0^VB`@%G+zG3^`~Nx%)5ImN*63X|Anzxk(6jLwCG8^Z
zaIsz2voyrhMG}uJKF{8Y8Pj|qh?{M~aAYMrv6G&h-bjnjG(C;CCO5#S`9MUo1u3Ql
zY@xeDeuwk(F~G={RTE4+`HOI4ih#_4yV+;z3LPpx9o7;^Dzg@mlsp3F?1?3uuQ#|w
zwdWXJP(&r=9KlO17aJIeiYKf~t~g7JmUh?~JJuSZ+6q2kCCqsQdMx5^X^2VM<F)*b
z{bd{-!pfVG+rBqTVI>5P-T(W<Q~}GOGGfN2c8h7lt_+v_a+WvucVHWg_j%2J0k7xJ
zuKjbiGk!?%&odIaI(Qc>)?$=M{d(aCUh&gnw6kxf%rM+|nug1bx`4`ijKr89z9mE0
z%XTpGZT|QjY2tqz{U0t37^B~Wn>Kx;r6~unQKRq=uY2>rXOIsj-fa53|GP;5+p9AD
z!>6xc%^Az>fKz|P(fBvLyl5$mN_3O0TNU)%8U|uA8+umd;2&hXWB(?juRR9>`Dc6!
zpuw~4MWudqM;A{16>;12797IBU{`H>EP;ClJFM%*OV9Z4C(4`Fnrt-h+q-!j%pZ_U
zJ5D?FU(ehxfL~kZTM$|tOPXnZ`ql`{7TR5jEm(yCPr;f&#IGElP1?ooDDlN(p{DkG
zvt#K<y#Qk6TiV#dZQ2k&jqocE>j!Q3wYC-jc37#~XR?4<>@0`gs*~etcOa*=x!zNS
z1hBmLXAJe~o*&N#wbTxw`%%s3wZ&;?mY3V1eSZa!9790gP=yQNYAJkb3ELQGcl{rJ
zwF<X0`6!H0dETTQCCGN<KiOV*=R$<}u^iI+g7!ym>z#ihR6hn61-KdtpBln8%mr^N
zNdBFG^a1pz(~h7%o)sO50n#$Z&D&c3i+bjiM2sz#=k}K<AW*ln>_y`5i1^dPoVUQU
zw|$?8q({z-^V7#_u#IEE?Xdr*Kq0pV?8b^e$_6K`XRds?E%)D42v9<8Og{2sR9=yk
z*Qqz&{hd6t$s#SQkj)1+jGESROhh-)?Vov6o68VD)k}(wL;!W;DNIXOl0hi*Pg2z;
zne4O=5{w7ZzJWdU{+j@Ci61`)PBsyo|9c6RR$&m6kH;`{^J7@wWB;`SciWAJWR7x}
zlGZQlQDhgS{&CLV+ETG#f5YW|u*|3L^&LV{@;A&0TG|rH?c9IRp>0rCFs5FIv;Z#5
z8qkPGFw9K0XaDmV{kos+Y>zj8!k&PCthJcwd-Ky3`iLGj_NLpc;{%g@)+Z$gD4V?{
z8=P<ayuyw2MZ%;4seO7`59-znw0p3W^A{-*_}{OicvA+JO)Ilp_LXAKW#mU;Z_Aw7
zvUwy1l}y1QgAxL3-e1w@_Cc~h{I_uDPDYxchRYf6HInXPVr95XOx-723A6Q`L5vQD
z`S-W-!Qte9x%8R2^NmQ6_2yTZAjD$Ex)<y$C_$_6L%!*<$JL(8>|pd&U3~()KH#K(
z^$9CU`QZjTjQ1(BVh{}uLCYl*_uqo7=fSZqtNzfkiV{L*Jp}j2KUA@<sMpN6{ge(r
z>E<f}Ff~`bzcmS*vr%c!bOAnKa~^S;4nJo_3hUeKggqSE8I=?kKONkuI0`w*PYds1
za|ofZ9)%FQ2hiUB<Rjt(%pKMM35k&U9%1x-a;LaUc?}9X{lPuo)I!FhV#xGOwh-+i
zGcgg7F(baGrn(yyyqUXu{};I-<XT<aV$$LA7zM2LpnnkkoBT!>e*yXlyZC3Tr>lWD
zeAZ(f%2=PvOa*JF`NAG!SdLwK{iM5hy?urja($^<%sxZ8@ZHT1475b({U5Txc5~r$
zJT8@<;5qMIR4MSVQigYnY;ezf(meR7Jvxc_rH-2*G!{SDgXgd^O5v@%MwyT5bY2!v
z=LFk0z|!{8ohxjZn7~}r76@xjuOg<evaumu6gq4#dC29|NQBu`^NwU&N6g33$p}t;
zav<sK%`*NYU?;~Ln3kf-p>S4tAJ2&+&7%vE54>-eVcqz^h7u&@V@r7FI))@<#M2|b
z8H}#H<)pps<Epsm4dL{)T(2|a;F4+kun^(`9-zV$Kje@KXECsR<{}&1Q{xnTes$Eu
zY~d7GZT;7tiPA<TFzy;OO5xlt=NseYCuJ)yhncuJzH;wbArXx|Tz&2qjgsA}{j#!4
zmD|gl79@jOZ+eWs4*`2hVDujS+z5CX%ygunw41OGteqz$=na-?wPzG6xlhf==8fs*
zGTJ`1jdm+GKY|y(M6I?hJ?d8)5lrf5_&&D%rUh%9N5N856G}MPN8Wt4=Yacma&6XC
zoxEA@XZt3akSRxqal|D}29|!{mL+*gp+=qxIC1JcZi$rtmoF!I^|N#<raiQ7f{g<O
zvp!6TO+QLg9SfDTo%K4P-G3TWMG|G@6e0{xw`1HprIL<!XRBRxNS;4iUR+jzC+i}6
zN*JeaQ!(0v&d^4l5<t$=)M~NSDHCY1xbg0U*T7KCwZh&Na&3KbNp=0zJ0hoqQ?k{Y
zRlTdFzod9jrt(+Cnf_}Ge4ZvG{P0|_H{2sUMsVsr(BzybBq>`x`A&);;nfN6skfi>
zKk{J78IEkV4Ad#=jcQr6+m$o~P2#r6n3t2C<cGXqfR`C>eo1I1jDtN?@!!RR=Hd3{
zz4fL|(UJ>jh6ry20-0O2fH^$~Ymj^vNx{<o-v^ZDlf9;;neE<iwc0y!xEs}9xpUwK
zD87-~eu*!IXy2|3iXP97U!n)jqQd^q-owceT(%9z!P2~6mH;aXr>ijkV;mUQX~q(M
zE7_)V$henC{d(*F!y`5fqqy5;6Wsc->U-@DQXE%-U%9{`GWUSnr@*ef+M{8W(2>n&
z_AA-M*(_5J3<>;5`37BwD8y4zfKKJ2WPfk?V}?v$TJ*mZK<>Nhn)v(R1B;wv5HpGc
zgy>rA<|94+(SY(Gg&Cu61127+6@q1uLKqv|2`<Fwf-VCV?djuN(R<cpb!=t@%tc#d
z<RO3HyhynV4kJIro%vYwq#cNCANuw867cU}eQ4!Y!3!#rUd;ToaYi;XV+A7uG>aLq
zB9t-erAe3lGJWctTGYY6=?6%ZJ*e3MVKDu^_6KaUX@>e}({W&`{4W9-Dm#VnZU!xg
zB$!dn|8q;IN(y!tDU9-0&~Myi=9iV!6e+$x6o5K$2idL*Cj9+g2B^BPYaMd-HYzd7
zdqMvM+)V1YuI83421Jd^myD27R>Nh6U|KyAOsi+`m|?*F{~_^)Dn)Pj^_=M1w~ygD
z%d_X&m1#9T>%kmpOYC)x8?}p1{no#RkEQxej)o_u&ZiQ6mWAsc5=Ro<fO`P+-=&@5
zr<p$VF=knQ<P+?*k>3H3>L<|~i+RakccK@Ms~`ptFHMdRqraLjf4^6SJN9ImpN9OG
z6GvmPuMfmwdzM_<mDhT@>-?-kIOrsaR7%rY9!IeJVPJo|%Aq*=!pavG=9aaJAnS)f
zPW?X|zj2i!xqHr4k5VdxT99nNhOIjuMQ26s*M|j83e4qO&6=jpR{&{!dT9sHV8fv0
zdIzO7m4#+ew0^W?iyHW^;`>Oq+Vp_)9SeyzVEf&-|2eu`+HD;d%!cN%6yw#eEqXgh
z>tKDWBSvK*$tSdWS&k{VNyal~^vc|W7&`iV)51aFjpxa$W=o6iu->uwoK)ZYyx%%6
z^W3sNa(ij)e_DUfqDL)Yvn#Vh>9#0FOJL#B#g?_aoM4|h-@6%sc!v)ztK+_NV#yXf
z2dsVOb}YMm7FKpsq<z(q7pysv6|gYcGS6M_A!nnHIX+1ZJ9};p#Df17txt_>7dTh_
z>tpE)>rvx87!@j~!eFdI(;)9tstIyZplwbOj6#a18em=|E|0xgu<AI6Ci*;=T3aQ)
zz$X$mOwZeFe0>Jy`O)707jI4nuGb{c&-uMr%rkwKLnp28sr#NjTo+(HEq|~vKJ|!X
zBXfI`+N0(Y#nz?3c$2+PaUz)Ep7&_U&P!_J$|@wDZT|}OZCK!Q!!bD{=9MEePOru~
z7fI_qEMF@edf2CD-jI%ht!zfxJ5=;sz(q8p-H84XEs0kHXGTFcTWe_e)N6#~5-Es}
z7JBy|bvqhMH>^uv-P5urqonGmHb3ZwQBjLoBCS95U&aTV?AB}#<*=iz`QqwD(K|*z
zE!>+dXvYDu*ap^FC?8G#Ux|GN4kj(t46A$VbfmtO0Lz(P?M?;qxMo|u*&5fJmgiaG
zg1?Aowz=2Ne=;OyCOO#ngzJFf{82Pu#o<95c%S3_cgaDpK#LFuxLz<As97o*RP|jG
zPzo;<f)CI@R-BX9+IS#Bm`$j=cy7dIu2k_YwBZGKfXqhzV~O6p1k(I;YnBwJs4{{5
z3(vX057UgDpEFQ;zjjQf<?Lyi&2BtBM`&JuZm(pFXx*x)%!+1E0eV~pf1hM7-!dW7
zsHFI>!4V{{e{xZ!rlcMDis!KLoqTS3T5Y|602^C~bPOA#noX9yJ$8=R<DI%sLofA}
zZA*(}h$&fCav|;*=Kl0l-6xHszP2yJVsP)Kz}xHl{}3DlihuO6-l?+n;P<J4D|t$=
zK+P2A#TP!tHr}7J-dMpay0k=w-sxE%ROOMejsfohPSpwh;eAGT+vl*j)5DV$rg*TH
z`trXN+e<7@wZeVd>PWM#iK!fD;_E!-^Ej<_KlLCkSXd%n)ta8g6`%|$S}d#%Iiun`
zYT6!_7yz~^t4n`3Vek%J`|X5)b1LTT>{7XZPM@{Ub=+FFUN{S>mhIpD0t(;X15Br=
zTeXs@ez!k8n50(Z(H<B7D<$B8(1H_w7>7V$hp0Wkv^TcghhS+}RA2_>HH+C#8264l
z`>&90z9DKcV^Mapf9`TJPoHzLst<%#9f-pBUJ?L<Mff-Tf1N2O6S0%8Svu#*wc=)!
zaBId_MRC?>_gy8g*uU>it{hHuKQBPj`awCbK_euhSL_{ld`7oGygRa9S{CT&QRd$Y
zHbLsZE~s)7?xrCr7ElMQKreiJxw;1lkLLlu%z&GT0?-apiDIU21BPJW$KfwZI7png
zDBA@dbKt#*oeOh)fkaG5LX`ogYhq6m=(=H~+N^`pLp87QUrFJL`$9|__%Sw>Dxr;=
z?<24IP<Gcz-U?)X2+TAig*tAIF%P918p3Gw`9=SV0U+kYY$K)Gv8cjw{(6Rhg#v4D
z&3-P08I%H}=@$ap_lpdaom8S)6?Tn#Kdfrg2bar>MUjZ0|J*s4j#>wAY50sH1s$pC
z!ODrJK-Li2ssgf`4s8J$7!-||27|BFCyk_@2Oe;{&);_gSb=C|0BGGq8yniYWS9(E
zkU{caAqfcgdp)s;g4QYF-rPPtPp@t2-e0kaVzas*>KD3Z`c6PQM=g-5_khQIGyC>k
zm7Q8_Lgt68o#gkqT;50T?V*#2wq$haJG*vBSEfds7X^i$6YZiB6kKPwK56Nt&oIJS
z^fM?(jVl&^ejiC$Vk1{Y{7@Xi#v;4P!d)iUT{3={m>1nO<?6ZOkdlVwrzxO^QiTuM
z7wBz|!un44?Y%(DBP$!P!hJ55Uq_?0WcsEy`UFe(?TF*N`p|q8Nb1hITKs`q>diG3
zg1q2IB*X_E+dwbGdce1B@&dllk3L3nGo?r?bB-4;czUOJ*icjbU^#}Sea_*m)*kVG
zORBD2pBgzsA+8rGm!_-4AA>!$Zr9mIVeK#r#yh<i>u*>4yBR>SS_!@H^JQu)_ttex
zd&`m2Qm7Q!cEm8HS;f+mQ1a2Qib(OUf=;VO+^U0K*iLfeq05Bb2W&9Q)8`~>?~DjS
zpljr0xir5eLC6={K(d^h;uwTVt522-%%Tt%KeckW)x6}b^IyPlwJS}j_<tF2_!zhl
zLY7c%m|rLDTN+AG1N)1W*pwY@T+8-Z_gzY;cIeWnHf=a3DIAZ>lxWpuv&kqZsY|CU
zyp43vHy%%?NaokKKXwC4@XY@#t0W35y;wFsY?{W8sasiPk?bnvLf628++QuuFMwt+
zE#SUeJnd7#SG<Ew09mH`Q1`j{`ouKf1ot9ZlFt`%j<v6~q8t+XE*??T3x|RoSEwZ|
z+m!xHFc+neW%C`C1KK}koN0Vc+97lo1O@8S4hi0Q94(c<bD_u}&2Mrdxdz{|`fc<>
ze26Zk!oKXn4X2C&*GS0W@tc46_ZYA-QLSroI@VQQ%_OUYB<FEt;x*RWJD~c@UkoLi
zDr_Z*dhcu4FI^Rs#spm}9<DsT4JH@4mQ=4wLC@Pr(L^VC2CGGNA&aJ&m_TxopIVJ~
zkWaYO%!{_=BWT(QrJCjWQ(yr>!{Oi3Vh%=!)RO5}FH$CD{PNk)qE|+qz+xS&Nq74b
z`zeZB5brTtjrSk>vma)Sgei=QI)s{&Hc18PRf4O;Q?l$7tpnyBY4*oX+8lh>^g<zI
z``<GV!G<JR)zgwwFX&~Yl|-Yl)%awzzJ)!lx1Gk0%Y0<UPcyplHyiR6igsT2QXZAT
zUkSYbX)WDn#?IO^7B;0<_R+>?C66O@Oakjq&9hMoH00jHM_c^o<@#`kG{acF3LvZA
z1~FIP7q?_{<m+geWHE*u!;u=WBrwOR7h1Qx*wS7rV(PnMJO_wMs?a&Rq=esX+BAaV
zk_$TvX85zAzV9CF{`T)5Ipjmvr6V(HH9hQ8O~y)VInS$6eZ9m!*B{l_Vf(`xpT@Q4
z4({NgBSdufJH(l`j%Sfvophppf6kGH_+pM*DwDIR&U0w5S^erEw<rQm3WO)?J%*fX
zB;5R4q7dIr9s#itYn9~vKdb_HPmB%yfBdi5P8b~QYx$QBfESHa?LXuHKmPX`3Xrs}
zaaMRuzrir>{4`sJqCZ@K*%Yu<-@a33J$$V6CRpLWFW`zBP<+gTuD}O6F+ztJ`)-wp
zP$LM`5@%3NDnpQPD**4(nCRW3RsJ#G&t$>v)UX?c>H`TG-Q~`GYzcl5yqW0<GT8W9
z;x}T3^1{*c@V&@O=)A;-T{tU4_dGv}%Psc?UXU5Th#C0}mszAZf(0L)^VO8nLv`i_
zGuJRx&gITk=zHLycz<7wB<<>u<zXMM97x#FzX?4K<|umsE(RUxeN2fED%if#a#u>=
zL=@iiN*MbciL2{%#L2Grg7Af@ilxCv<AuIEPGh>II=>nuLrMn54btjx5@7?mZ0LUJ
z{^6|*AnAF(yXC$wuK|V9*tWIFRA4B-z4reGmL+buFL*2$Ux6h)ernPpdEvzL?7iO`
zbjOO~e7=G`PQl@e%c(JF#f@-V;D8GRb0c=II0T2O&e&<RoW_lLd3|i3%3D~XCA5l*
z%k$fKm*`MjlY65Z0$VZwiIg5?a9D{4*4Mq8vsI9)HK=pNQf{lgx;U5AT7mH84=U>1
zn}=`}xprhWc0EX3Z}LQx=WxQtY)}2wa0K-MqwQkW>nSR9!|@Gl?EMxcpi>|kXj(|N
zyxtyLUdN<LnTx_UYoaQ9_&W1bbvj&Ekg3GuLE#laAD{5iq`y`I$p|uqX5pun!(CD$
zU{MZJV?k#03c>5P=2E>V*#)M~B2x>B$+C9NA4ZEWEOy^y2;6Occ!Ezd%{m4PxXU^6
ze2Yj>9?|1dIFq;wlN0^A2`Bd!Cj`e7xVH#F2M+thRg6J#1VJjWyF$4IS3lsNq@I^O
zl$(lxIv~`hQ|}&<-Q)s0Y%D_C&{GzPnd0EYp%mJga<6wq!v~iJ^C#a{RZY6AY$>ix
z;KbOJfu{8x6eG9Ph{VsnT0C6y5Bw&<^>~=u0n;*aG5L_Ji*rw96U@C^I!Tu=>)4K8
z^H{5w5mB=VSR=odz)W`U@!2+cnfrd0RlAk96?RTP@Y5s(@O#vIA7M;WK)?#pf%2d(
z4Gr9d$$&j6LbV+RgJs6NH9~MrQ(4Cso-So7W3^XW9AVnY^4C(J%?%yz+ImeA6{wwH
z`?lk1FdBBqFK3vPmhHdOn~=7vkSt*{o*U?^lC!VbK2ct{=lu9}c~XGhsN0b7om~y&
z+E>`Gs_jmNUN~#21z*!Ou$#5y!GekaFyq9&(5>Xai#-}T!9QTU9>SLw^lHD1qHDLo
zg9Dt(hAJ;*L9zBjhQZyCF%?$*Gv0DNnM8K-xWcWBN<%cdOS7Q*m}`z21@0i#2YPt?
z#}l#g#!cAtPn<TYS8)fA8m6-}e|uVjsxH>9(t<2<dzCzwhkqX`Ab3gcFt;=;kReGC
zRFj5gIN?ZV%ONf<YKWvR*cK6-8;ms51zTTC>}1YR9H}zW%kG|mJ;=tHpxwLjormz!
zjcb$3+N1LVLlt*+<&Y)B4&MC4PkW{Ys~fr1V>K)ex7Qj!kPa4BB+Wju(9=sGb<6tL
zUrfZRmj^7$R5quWN<IHXxC5rEgNSu?fKwbo5Y{%EfXL8LIZtcGWse5!&|~?c5vN1&
z82);2k|P6M3YD;MGmZFC4!FF{i$qRu*ByD5x``}i-(qkpfxeuJDHa{m4a)S=EG{gq
zsWO_T8eOX`H7HUGx2v$uVG$@Y7%jCNDLX&@qIZSb=;E4)oh=3OU%dCibWh-!5+)Co
zzE@>;_;%tA*beWkyrq43**F(uN!n&#-q{<K+9`+5Nn6?nWj}3FyI7!>Xf~KRAZ2uM
z4~%kyqpd~hK8VpZ0E#p>zG!R1P|sAs4(h_A`@WQd3hxwYBD9Z_JL#Opnr}5pIEBQF
z$zf|GC^Ba8d*rNUBk?rQf|4t2bN`$X&ZZJ3LuqlJaQQUtx-5x;Rt%|0itmh3hcS>&
zFh8Ra{Hj!gQ^b}#(WGWVttz4D7<d!}eE|D}HUzZt(ZI5ZQGy+eE%|`W>aJ7Z)8GNS
z6VsqZ*`f`0@dX`6M(ffjAHE;n>tAnzA4xsM^Yd{v3g6tOM|ck09p+HxO}_{1T&i$Q
z@%JHl=_}Z5l;O;RE$9xi{qGn$?MdAO;L_foUO3%o)lSgk?Y!KsH~O3WFmHr`{q}6v
z2P^Nk&h^cYSXZsGZaZ^$lPT<_09s>cEgniv8bOm9aQ4ew+i#rS<c1hn=Ft{QFzkYF
zxWE()C~uHIM(c;w`CZu~xsaH5PkAD~0K_1+Jo>Rs?-Cd&tdh9ZrH|YnK&+hM1XTkr
zrtL$rs0(cw!~4E&*<>h-4W(kRVu~X?w&_`5`_xgb9dlqe8_);6!Vl+qp~BX^t(ffx
z3Bs^QJ)Ny*bivLji8G%mmgj~v9{^jgDK^E^?Hu$DRH08ba^L$9YsE<E^=R_;WWH^q
z0e)05R0spBOK7t4?xujB+ruzL`NW9At6$(5SG@O1;1%zSC+p6-$*(ns!Pk)*U_j?q
zFrPF9L$7wJdkB6*aY>*Fh9=zoQVKmO$kI1&1rAA%al|M*K?>-^cz_?^EcNiN;?>yl
zVh2bz__y;f{osONYm}tOg$rA*$uMXab?O?Bf;*thP|N4jnC^k;+{q2KF@o`QnFhB@
zwkk1O&a*Ihp_$~9N{|19ODItOIJSik&k#>^W+*v8*`pJNZ}@(EOC~3Skv~?!*Z|Xm
zq<t4Rh4jZ#8B&Y{k$^2f#QcBngBsEF<%K?1)2&-fK^0`e%<6%+n_0*p*ae_Fky}@I
z%ZKeCC!*-<o|m<nkq%|pqEvUN8;a61DBiidu)M622(fXAwDdL%@hh)j24NBS!bJ+b
zRPcjykqL*Y=d!P<^1-5=;^r)<4}}y<ZLPf)doV#pTQSMZu;Ijg)DF2|A(}D2eAjF;
z5(3BQdsb@D73guL;AiQ!{1~d_BljZZs$mQ6N}$P<CGdRMU`pE7G}Uhomcr^+O>pv>
zSoW^6bn%qy9jus%0Q|ANGpM5L-Z{A5BLu1}X`cbutQq{0gi3F)V`BuoD4SHPCTl|Q
zSng<fXQ-FTEA1lh{vO?=ULda9>uKC>vot%=ZV}e!SOFR~i60bnQez}FL9mmGaxCgT
zo|w?~j+Qf=wSa9cif}9e6kO)(_o<MiE;}HLD)|*w!o3D}!I<;F>m3^iFA~q^2k7^m
z%$cgVN6P}gpt5u5g^x|v3mwxe&&H`*pz3^BS*xDxpSjLnq`1tmPA0nC?CT%Hr7F+{
zng*xJRn>;T&~bQuUAC+{XikkmdA$#|7fS^C`agP6^64-eW2I#asEa5cO$WCPJ>7(}
z?8f;ua%X})yTQE+n2y16UNO!ng!KA^FNkq-+Cn>~8=(Qv_(EJHz|}n76aE;uln+`m
zaR1dGJIKi<OSeX&j_@grQt|BV5feT{p@A?8XDi(5<eIx|rMyx`86bDzNJivg;=M_E
z(!Q=8KX{xOKLoVcPf9}`nT_oGUTvL6V0~KV_MMFhmYCv~x~B=&H&#~330i&*P+9qC
zYx=wAQQ-F~a)z9th6nA%&p)jmgocJgWgN0GU_X>DD-HQj4OHI@<y)QS!Px&(-j|0%
z-MtTwod}UAF+_yOR`#6`W#6(Uk`^*(vW_KXsq9;}L?l^TG+Bm_eaVu_Fdhck#%_i&
z<~^gH=lgtr@AdxP>;1jo?{)p&>-CRo&gY!_-1mLX=RWu6KKJtUD8_c|dRdpN`<1bG
zG7_|!!M`@F{%BrL1Fyf945YDrpD_$V#x64R5FQ{V*!G>q!q|WH?6a;{pLlTWv9hBo
z3q%^EjSm33OcT35hzgPjgarePEe^!9xYZtjd^kX%X{`G%`LHkaehCyX?AIyvOD^t9
z9wr#WuXFB~bo_7B@j@87kCQxxz#|GYJ|v1mg7&%buu<)3UeK)(I!fVQu<#EXL9LiG
z-^!UGQq=p52*0TY)M-a<hyyK!k^J;{0STH$t$l7aPf%COLXK0cN9}4X<$`}b(D{Sk
z%^jjhIfg)FkAtQ)eHhLDzIyoS>^~kTItbP{S2;36j_<D#KPx;Lz5M>~zZ22R)&Ka-
zVUv(b<>I{mItuzIfT<TLa=cwl7^e+p2>C@oD;JpI+b><n7XA1&3xo*dj3~%l?Wb?M
zizkO%*NZxcW2L(V)<$#~sFuBrYAH$GYM^#WnpP)(k?aZ*c}c&Jz1m9WhY8mM(-qp{
zW^WU}p7tDT4(9}v8&;r~Q$G>Y5$iPweBk7EEsB(d5Yt$!PeWZ#0L4<*3$1bK<!-VF
zGTZz5o3RK2(Rk(nha9Csb%419Ud7FM%lozpNCli#MZOpbYKH?oE4fA(j(kI^2N{KR
z?~dgtOF{~PSD>nA8WB}33CcDv7|&el!pIwd8sy-eNm=n8sEwxqi7>#L6$2mZZ~Lp0
z3zC+(fC3kQ>tMOVFYdES3{+<YRWtrCJI*B%f!5H=K!Ad6|A@j-Nf=6bqQMB9&kq0^
z$s9;$R8ly4@Z&GEl39_??lt66)V6}!o<1n;e3inuhiEa;bp=F?{oOx@9YBIA*UPDV
zpky-T)F{-(jl4jUy($*LG%S>9xL{EEVoD9?<G&~e)t9sOcb^6DF21$DNllm%R4SSF
zx57zHT%*XprDKv9{tzx5RETzA1q?P!AsXO~qR>>*3|OyR+Rl)-#24B)NCwFIZ?c9}
zpCp+J!Xe!h`~zUn)zA_^?hJ)XilDM3$`Y`{m%@&0w0^y_I3QgKkS=@)SJ3PE@E1t1
ztN-Psgt(30o4QE)DM|ja;JvpqvUl|zp-f@?-YCX(#G-zFbWfJtlvRHsvQB6`3av%G
zzqjHav1>CE99N&nuBj|DP3B-|kDw%4h<iuOamxWF2%#454YS4|Vd(V$gn;^ev=(fC
zqs0s1;XBy9nV`vf_&8}rX#0~lxI!NP*+JUG+(<@|ocb`(>wl0hN5}8@vmqmO_g4|B
zgIkVqX242~?a7E*jqe%M;jiVPH4e0sHrZN(-u`Htq&cIpzC)a(*&|jt;BVjF4qs+M
zM!JC%hzu~wVDXDL<508y*cW3Od$%=l%c$bi*N;eB43k&C!q1fMJz)2)@6`)_8Mp`?
z6t6(7uIf+bum!w>j|ULP;xQvI1aS)fv(H<7Pjk=w*|ECqUZQt>7i9)e&Gy#}6^IsA
z>mvwYc)WKHhQN<Z*4KdhYtlu*P}0|+kdPI;V&eLPd$Tp-Hq9uemwn{i-Q}7cgA;KU
zFob^a#{2o1!HS5Qd(H8!_j16oOnGHZUQdV4hP_DaBpp2I_nzSGcf%bRYaU~m+8wuk
zV2JHT!>24wNFl4ZQHKL~?DUt(90e!x62qk0_(pv^Cd8tHq|>{zYu)cNp`f}ZKEe&%
z+mUSNYoP->R3?o$mMKA#c3vEQAq`a~xz~`F`dtFAFid!vXOKR&h~Kf?wLeGDpS-wD
zwtw5B|CWPDzRjP@HQ%oVv++WZXf{j3<7vF3o04w|z$Yl5C9bFOAbDeHQ2KcZe2r4=
zrz0cv>mwM%!?|SQg1E|Z7ir{#^wU=d_lg!@q4e9Loh|H^2Q@BygPKw)&z+dwv!C7?
zso$1g?trp+FUlc7g`X#2-9<mc(kmPr-g;bl3oGuJ_uj&zF=izzp-5CuGM^d}Wr*Cs
z6Aus#$~W!j<H+at*3Wqa)d}yYytNhGz#M|k0aHIyo^vv~%@2GuzNP@|g{2d_#v+fL
z7lY#}-?Um?i|UmOnR@IDj5(dXH|bEML;^vfcIU@i+(Xqj=110fbFSIk3^r&bz>2lL
z)>wr@OE8SfyGLLQK9rX^d)ld11=Q#M<B58?o+Q3zoD+2|4s|F)a{V(u(wE**B17~e
z;&rjv4L1*`EgZ%Tf!bCVbyHsn!hwK*y>VXXy@EIOCGiO=(MKsPl*Iqo?)JKFSO_cj
z``FoDH<$&H)5N9Z*x2tr&?9XHk!UKR(axpiC<ijl*8B7pZt+<VvtICKd2Mo>2S^H6
zpvUIk>mm&}!kuL#@go`>orB&lm1Zl}cU#n8#oO_9L$x2edA0K}uL!2Wg||pW1kIeH
z9sBP_vrCrL<LR|dYx#t*@ueQTdMNL266>bb!(I-`-bmV3xqw+~A}%)wP49+lkjBzg
zX1lg+R}wqh>Y%FnsXOb+eQUXJB(+_y3M!Qxyc>u@iz%(2i+>qP$bxU1QXwNVfW!kY
zqdm^eGsLPrerO{VKhEZm+L%tv((ZYLPubgIXyVKqKeEF?E6?QQKZh}I4IylKAxl%9
zgx27lf&RJpOYC&>juYlan<Q#cL>#a8w#m>Yx_;Js;7GlHWcppa)7U%0V@v}vOJOss
zzRWsMqOy}06^cJt0ladeIsYx<ADp@W=O<6|OxXk-?=am7VmbX$hjmHv>S(>yIP2*L
zXf4@&Iv=*zPG0@^9SDuv4cMJ5=%!TjUU)-NMeugL^FnGAo>0a%x2lg4e1qy^L#TLi
zfj3c@vW=whMnP%cQdP#R=G5|+^GK{}6U1|0E@r;eA=`Uy$43!Bfn&WkeP}}gu6{L~
zFwu<H;8?ELi^C9C#^BWWaex2^Kwzo?eTM(TDyqJrYx(Z9)Of(uW{pN+)|td1#QG7;
z`7E#RO*sTiG=4lJ2bYeQsyBw4lFp7jnY;LPX8{@;KX=x@xq(dpo&XAuuLI-13ftbb
zpSj=QTiavRXk=U2(nY*>h&@JUxyH@MAKEa22_e_`A#ROhX|~sR$Hy$~cK`5j0~!k-
z5Le}0q(Bj0QsZN}&SjhWlWEhv2n}->xo06e=L!a8h`_9RRb1fPVZ#Wh7qP0kd-(Cs
zG>_{50~4r*P8mEfO|z7{iVUt;t93*o3VTRTJp9SlUpFkbbGJ3`)fGIjYYl>~@!4)i
zu{Gm?sGw*LZT_I*j8o!dLui}2TSO&hEP>ees<c5L7uq{5wAx#Hz-c3k&2V0oZmkEe
z!Omk!#{?uo{5q_{u{P;wP8WXfs{VlN0M;8dZq!u=g3y+ON*f9WmZ>(_C5WVYwF+&V
zz*lh0`v8+mDLxk*QRLnjs$u6rjS6CXz~%1I3RFclDc^7R;m)*zyEmx^Q&(maKq|wm
z1QRgxPO88N25Qsif*aI{$72_|`YqdQ)UTbr8H6~cPAGf3$uJ~|FuL1|u^!}`)_|g3
zwApQTA3bItViT<U9065>C!D4z73XnYEH6V>`14wHzjFimg&k!3S!a1R)v*qLC_ca8
zlE?GV-9r^S?|0W%A3|3J!!HFtf7lL=WQytn(u)}TgX?^Fs6^{7mB-gPW0A?F_!r|C
zqOGIyjAO}md}xnYI;P*9Y5b4uo-Fz7o$)qQ{=1IF$tmZDj%VBXY=L5LLXE`@7#a_W
zVzML=5|uxf8mAO!;xIfL>@Wr<D)1Z)YLM8cLmAbq_`ydZMUTtP=n6TrA3*b4nT^)O
zL0CX}Bk=uk!n=<5ixo;6@~=>8|Dh(k$#R#0@CgOru};|;vzHd~j>8mwYnZb;;rP6B
zz}ER&(e8WE^?nHy$@ryMOWxVMAmY2d!?)G$wx<{U0_3&?@s<=N_1uTM?$}Y2Hps{H
zbNf;F;K;A}G#u17Y7MebDeV)Rdp^PU_dLai+Q%4wHwwUo_BGj{W8vt>zXXpb&=-Co
z^#4^yH*uu%k2kdY@l{}HiW7}zCJ*zHM;B^$St%h>ly95C_ME{Mbs^-NzU4o+joM>}
zKDTm{I-m1Cvzw*k9F&AJl+BfUUdl1|6YgkU7hW6%3WSAIK9lg4u+3P@^-UF#6P))+
z{{Y+ZP9n4NL-4Z312hBm{*sDK&)3iDBok3!k$<(g7$>A1<=R*07_LT84V&#lgiDL;
zSsEZ-0VmN6gk*smag=(F4#sd*cG%Du;cfpxWSdyhOH1#fEC71ec02Jp;t&#S%!r$#
zA7-A#^Ul-#fbcN1^BMQNgpq3zVzoH3%P6vl!0_D%1@oMrpq3U)P|0{|Hodn)cHD9&
zPh)m(ixYSQguBo;iKSFxfGrks)o5q3O@59t7jxx98jx1e<;MARB8K$%Hs&doI!U(i
z1O>zw0Ac|_tRRoS_wBjUm&0RBXC01i8hRvzFO1+!3%f}f2V7zKJ}_Weizsmg;X(iM
zCj5vqnRl_TQ3i11Y=Vk&H-WrLuA{j(5s|S)L53xXhysPl5FUU#1eH<le7`4M+_;E|
zC2C}(%=b|@h7J-UX^H4fsjpM=@e=8!LuGww(eZY^M}{+)C$Pv{4RZsS!ouZVyg(D~
zIJUgDVq$9|4M5H?&0FkMN3o?4HTu<b<;db({i5}-;Vtf|V|X{5mg{E`Q23IQltt`a
zXy~EuByA$dXKokM8N;SOE-kkzm3zoC#)7YGX%V%2#|E42kV?Svhlj^liK;tGK}b;$
z+$0Wc$ZCfi<P<x~OhB>oIO4^i-Ml>#%J2mFs>r&A0}G7wbcwIg&~1b-;3!xm!-*eU
zaXDYX;WCxd<JtE8rBH;RRjDS9Y2wwz8Y3iG1yt3fhSeOv@*^mzFmST?yS3e+rk6$X
zHE}}JNP9Y1yaxVhPHJV>A`rlfG*~aLcC|gU=eeXGi{T~UzJ&)=)T1;3iPzIGW*{na
zlBYdHSAbG`Znf<W=MVR-W59oh>em#n6$HV2EjziHUIKW+)p{l^oQuF$e77GBvJJX$
z5tuk>sv10scmX_HZ*2fPdQ(kqi~=c;6C~jFK@A=H+jCFw-h8_F;C%Bx;5qgc;zCP4
zm~Nl4#mEgF1XR6N$iJC6G<Jq-guq9)5OnQhIC?6cB;uzYNqiAe{|zH&LFu)qAn4z7
zWfU&kN-}qB-pkFr0q~pB<oxKh8M{{0L^9WJ30ITrp<ogv;<s4`%qlc^BR($ft!`j%
zX@e>}?FZ%z$u$jfU(q-dc*3W!)jb5VhC=1@FE1&}o@9+s8x&6n+STHGHH@npynC?G
zsnX*zg}c|a-x+0gznC+k5{&$_&vRe5#B?9F#Z2(-OtC#RUFtQa4>*c%%=M(O`Wchs
z^P{otU5X4_#uPR)T#PPvcu@B!$ffTsWg+|T<AjkyXQqySlPd!#<P9n08_jo{Vci{s
zHiL>B0cFWMB7Tk?V26wtka9h_0nEY%rm+(2le$MY3q$+ff()pLf${rN0X7@jPM>84
z8ayt8<Qp2E-r6H-6v#ZD7&%Emcivlte3gH0Nl_5gkcgzf3GRDKVXgW2{c=17vi;v$
zaEp}LYYet?Jt>P_SjR-S9QLs8k;R{V`tP%Yyj(S|zvvaD_lodt{l!0R7Bnp;)(TJ&
zDRQ6Z15*RnFCH+;+~EwC_{A`G*9j4VHTZl3{1<F#ytq;ZR0j&Hqr<Z%?5ln;>0dAb
z43ykc`x9#CwDF9!1Pn!IgJEU<J?*#qIE{cfE+j&`VV!Ois&Vug(=S>?{Nk!jE+-PZ
zZ@a-a#&jSTf1$tiLD!4?ny;oWc+JAk`R%&P4cSbMDo45n0eUIG0e-g;lQAztoLo(?
zI1L0Mz@fg$Wbc(8f*-ww2!uckMDpH!_4ZKr>GEhCa+4*W8MUfpb)7gtuwL|udr@V{
zE}q%F{JlKFpPh!gsfN1I@;5egVI`WJ`+PkBu?YXoRY(!_Z=@i`bWeYA6q0e^H(?NI
zuHST1xrqN>tpBF~Zmh=Gd(}&dpaZ)^Z|TSVNk8LC$Ea-8<a?7JPk1OqixaFh<L%Ym
zN54+3mDt~EW1;ZmaIi$<Z1UokPTpRQ?aG|aE%-tR{7=R}J3E2{&++nJ)3}&<bkt1e
zH)B@_w8*jdm2HuWUO|>zzd74Db;PriXLB^h&dz<*?k^DW;Bb0)Yc$Y-)m^scGAr+I
z?uY3gpWgE%8vdi7VkZeM0O!_ZaiGN<SP4Um{<&n0G_X9zKQUr!4>|GY5~%{;`9Ep>
zHw-Xru89azj|X)u4taw8p>^DFZ@&Q~13T2=4H{GpclR4uKtl|r!PszTzXABi9x|jf
zIQ(jWHkLO<lj&f2_X`ySTLj95ckP?h^6(!0E+7MyIuoVmEkgoj=rZ)FR^*`sB0;zg
zyj)c$|G->0KG=Q@x2@_TJ^7x8o*4$GZfVrx*eh!>!~JfCyYid{ZVKQ%05CZ8k-V$J
z&zeBSzY`qe_t_)AC9QbV!7vZ^!Rr1677%gX1@O<{9#~UXqfaQV_K-)7nmEqH74Xiq
zq}@kIBoKMR!_lHA{s0RcEy+Z-7Qo9;(;!WBKV`AIvfBe3Kyg%BdRSiceF|0Y0afAX
zHbx3J{vwGQ8Gi_zp?^mODkPmi{5v8znNQOpf`6eh(7@&JJXk=;ahw}~E<6iBiwQ5-
zH=XQcko)ngqcy-eN$2@~M`<Ca{f@enj#|QVl#ci-EnP%yKuaN@ML0${MB;<)w#)hY
zx-$`H4;kJ7>`pT1uZb{9S#Exrj@PRcIiUq;G&sz(V|^!PEriGak_za^MCtgP(s3PD
z#KICmCnBtM%#a;)0u^;=l3QFPQ)cE&&e``f6SNvEJL#>(+an&(Rast6AxovLaRrW|
z4Z@vIr+y~C7vFZ3QLt#|=Jt)-&GixZJCsJ3>8SR;ZfsiAse!>%IzipD3Kn8<xpxEd
zovt8gy#-s$txvsb{nX8VLHqd1jdI16=xX7v-rnv()Jd79CMw85Ebe$h(DkMyj*8yy
z!)kDwl(a6c%PC7`Lazq)T(=tqs?okMITKt&ta=7IT!V3j0cw)g3VSar6tDjMf>(<(
zWAYo*%g;3SmXB?6dc3f_yn5ttodMJ`bwF1`Mr7v-&3OhGoV8u;tqT`&N~$FyDJXYu
zrCM_&hr4>x&KddQ09i0|`dt=tfFz#lJ6Ad^FWo!4V*cO(quisu-(&IZ62dA4Wf@kv
zeZ+y+Ze7*cv3|uH#SXRA)w&W#u=c0j5NAxhCp+q8RXybecfb3t``x>$;*nnOLSQI=
z4nMWP>C-^|Abfr=riz15@4Ldr3v}RGa6gbwS1R1O;Vo5)ZRkFCg|mk_Us4EacDX^*
z@oQ(2<z1w0zN8VCSe`qwQeeckcg<Swd;N&J*-oLs_n^7@0C91n_;!4gcFUvS(@?JK
z>(uu0730<<Nc#o2RG=r1S<j91-V$!B%MVzEbV99-FQkUHrli!_ToaEQH_1M!eo7W(
z|NH)8`pdKvS3QlDRCVMLkk)QC46VbQwn(?`EQ#faORIem;Owj<RvyJQJlo5Rn@+zz
zd?OQf)+pHEW!inGj}xh>5*AE!m!%B+?KZC?KSiZ%%)4God|Pr$%&15<oly2O!Au<Z
zM~aPDI29Hcr*V^gl_w7~pA6x7CB??akrAzG^<X?OYCM&HE>Cfw$!SC_q4DWzXcG2%
z{+`zJsnZhk<cR#dW2u>3v7WsPFH12Bbb)QB$)`KrLy*KLeO&80Z8D8NHF3RE$cJ2~
zE0UMg5@H=spRSJcRdalmy8v_gcwNhqS=`=qV7}b^jDI+v&GRYk#7=RpIK8>M0fn|F
zHmk@-=8D7ou&xNfjq~e%VF`|IcBU`Pzqau@iYC>{UkS}mDJYW&^hrzYgjICXoOidI
z4g2ICj!6)iZNHH^?HwP%U6nf!2?G%XS539_USml`FDucW{XZ5Oy3E%O=TVm#Z1XSU
zA1kMPN%YMno09XGOFFfy-SgvUT)06ku5d$#%DY|l6EAqKwd?QkJj<18UXx0{&{Zfm
z+)=FB8|yL3aXT+(mBF&~wX>Oc>h;G?&Nj5nS1JY{tXuZON-SrLzZh%cP7}57me>xo
z;ycv1Uta%~Lb_#QHeIwEy`9M18KOrjx4UM;y}rRgDze4KpH5SHHx(jpCN=m;97?^7
zznJ-1;=)FpF7%Ssz1aELZq+u}6{Sxm3p^4xl)aiX{ALJdhCO4O?OP(NIQ<4;6?!?O
zc}(a5_cua($ESa6n|&R9XH|6yakq0^Q>Ja%lO3d@YZR8UwKGx3ErqR5o4<c0dX|2$
zMX57@JJ>rJ(H>L?b+3u-wZAj+@v^v8>iX_|zt%Gq73@tK+^~SLCL1iZzqw9>T<WVp
z&kA(h7dJN^Okv8?P6nE3(YHTI>52mzwYq!4e~gDF#>bC)$EF@F4{(ACd`P*G|4Goc
zFd_)$9lPVp1dCMPn$tdjMmUR?KO%~`9>CKdnXBoiUSdz_E~pS97?o7F*S4-T@mtv+
zb}!b7&y9}Cm+9uOvynU)TJ<_e@p;OU(buC8Se~qO4D(l9u8IY4yp-Uysy0F&p7Bf_
zKmL>h-eN>j!=I4cSh6p>C-naQJW}G1GlVF{J!Itv%`@d2=f#5j2X1HbDWXjJa%L)Y
zznH8QRGV)-Ka^1WM7Ik5dM$M1^(iEGaAx02&-|vTtoayj%W&qsWnNGOkuO(MP?mmp
zJNR<7Y_MhD&7-BxdbjWsVmx}JIQ`cwVq!*O??Gy#J-*xQsWb@o!}KOsll&bzS69r+
zWhc+v?+-&4vlvG=Da*p;v(%K~EnbydShUe}-P)-ol%BV~RI<`+36rGh4OJV5FG{|9
z3JJc&^w`waIsYGn%yLn#>iQDcl;LmKkf@)lrsF4^hkCS+n!YnmMOUyUso>+SmOg!E
zHfew#7|}$YNsq3}8@g->>%%|ExUqBtRI?1ZKJ~DkNudGFEZ3w{?3!t!ZJ^)h*mLg1
zX)ZmKW}X`AlUOZ~y`pm4nYFP`GrOE5PkYwPFb77uZyF{3XsH{iw_QE%yxM2}lgs?n
zDJ|}l*&w+<4_KV4)1|I}S~N$WLVM@cjZSiw>`gmo95UaqAb~<}w_np!HTXuM;@zzc
zpFr4!Zud97lPO~^R^RfJa9$uu=<&IdS4CXc>g^<k%2IYN9|>eVcyKc{65L8XI(gQ<
z=vBSFWtqi$F=hE~V*F1Vzbht!Xf=tK@aGYJs9Xo9?)f6)Wi7k;8+YT;9p&o<eP@qH
zzSbaOmgf$p1ofSDI$4)Xe7<*4a7WIucDi8#PaA^l>!uCD?L0Jm|3URr$(0z*B}8^}
znzL8Kgg;kxI7Ze973sm5SWV|X=Q+~e)eJ%Szhzss{BcxyCrFevWqZMHLuB0g-Ui}|
zjbLkCXXom2>u$9|0sPu$-ZSasGlM4j{Ij_uVg_doZHnCwth;{ei;V#anSOIL+QTG}
z^k&db5-(Kz1X|go<P$tpEy`+bHEULP|J*Fkt09*oL4zh~oi{!jTbr11yJIvuO;m?<
zmT(ekWXY0dD!9U&VpDvl(NNkBbIHBrmVn$KZ)L{e(wAd~Tv^2dGp%Z{3R5AgRMyPc
zP692W6{LgB?P=C9j17K!xv2Xvnf=%ac$&2yxuFB!;mD;O$86Mk96xR$!(07x88I~V
zk`}c&-mlt|<2X=iHT?4|`K`UwVCLb#`?ZS)hp}}Zde?K6D$c(e=C11Igd^F>_$zw;
zzCT5EFZGNMi=9_@!+LDQORDusqWmuJ_D!RPUDZq3bmSYIo(O0~0$n$j329UVRZ)<r
zUG|7ld_Em24T8RNf=+UIJF2r;I`_Xg_EYdk_4adefn~+B8JC63Z*Na$^>pMxqBK96
zry9H;41zDa%7jGqLmdN8q7Iwdl;cNj_r!Zko?ETXdsM);!yC%9TT~XTp~OH9A8I*0
zqDNQ1Tk!WRhy1x`*juD5*JyM-MnS^T>)kg|yeiiu)3wm?Jh7*D0zGD>e&z?B#P1qU
zz@N;grOf&U&U;yt3)cJshIPy|1k*Q$MqR5uJUf4_>&E15LsDoeX&IJZ!M>+uWf~yk
zU8%zT`gjObX`ANR+n0z!ASII2S*ABDwFnp<pj^v}U_;Hbvp4zqRPwQ*1On6LJClSG
zi}8YHb8<0j*TXk$Cb5Hc8-zp){Y$zWrxT^My>-SNbS3ePKp!BF+{LKEbL+Imf;po1
zV$6G3Q){2j_M*Ihj)A-y61tD2(k#CC;HNKfMy1hsD4h0*u4}lHZ@UyCs2ZOZPZKBC
z+0ixLXQbSWlpo|Zb!0J~KagEv!*awNOJ(l=YO9)G-1&g@rR(24Y-07u*>%s*+<{yN
zxzXzZek|>z$`#@tZ}i#l)960FDbnN5*3$z*8wBj?qL0%(@t|E64MkqP%3EFE0+8zg
zZ<NlYqymhS$X9Fo70#R}MP&EC+E73hnppO1lY8%JcoE=nc$GGChz{>o=$Dn}TseU+
zSGFzZG%voJzJG3dE(L9~QTTa6zB%@3CpO5wZ+Vzz*iYWkve@$UR`17WFY2#uJ$H6;
z7SzL`OT!O)Z%3fUA1TnqR+x*^cdErYCQ;t8wlK6wTyjVs$Xa<sBVZn#ed+6QPLC(Y
z)kGZCCDJYWNQE1uRf{%7GpJVOPWjU4RZoIj74|C8)_vvF41b{FweP%<Ox<ykfz7PQ
z)DyF$>%o2<3U52d+~AvNnyW`o;==LQSU_|{KD+UT1hTJ7a=UeU?+S>xAM!ikZrA)N
zR1N;h>1RD0@Q(%XufMzjZi4d_clJ$LL|kADjPzB#8b{ozZZi?f^z}_{kioUc%e?1e
zMJDra5_YOj&HBzSP6wQUtlt<nesW3JI#R&MC>&Ycs@bc?oe^beiY$}8ZOrLC%ys7a
zj^~q$<2LQpAT8<hYa4;768B(vBOdvwTOe)RC)7(mu<z*ULBg!BS50ur&O(x*8Q4oE
zmsX&A9$Oh1IAS=uSn%F$3?%&MqQEhNxvtz!o!i-bgP#^1yPQ)$T~*vW6BlBn)~zno
zFko{>XogQ@Enmc~l}E}~h>X9|XJ&TTD%U2Ewh8&n12E^wRoF>*V0_YwxsIF`a`1|K
z)v-O~s}i-jfiEsSF$E!gAxJ3q<WI2(htLbhr)+{?qL@6@v#oEBGGO<DQ1II6V`1O^
z*bG!dmflpiP-qy)3N<%1T$9~SFMc@)!r9kpx7Mhgm44J-{`^Qe@<fH`_<-k7z1WBE
zQ4QKZ*$akVU)$IzxzNyGlB9y^y7t0!tF0*rmS^|JPE@FjK>Jvk3*V2kn=+^1@l$)W
z9bsq>wlDV<GGqGg!hmu2W2Lw>oktbv(5=p@*|Z@Se|1Ivl%6A`xTV8sgoyS%2fI-7
z?)6(gS~;8_T#h&89_qh)a`|FX1$I4(DvB^QDW^I)R?2q<|GCX3&F{<j#zeM)ReI67
z?wtdiSe$j`rMRo1X^)bAY9XOY<r#d!@D8Mo$B^4G(TKAk8%k*XqqrrrgT)Mn0`Qs$
ze{F&xp0lm@_;LqHw|_Kpy4OQ9$LFN&6b({{e#&+9b3*OO$y4}6L7&Cr8X41rnSnH~
zJcgp@PJ>A04#&&nb~9_T&sopUQ7(_!S|0EiYx=AhxGA0F9#I1BfK@I%{G5~hNX}VS
zKF+qCORmZ%(xJWl>W0iu7^c<rO?p>luH5ySRFX@m<rJV7kQacDMEJX2BI~LYi8K*B
zUglcGdA<+ILz}cm`F<~0b5=I=A7Ew&+4918!hlvY#{4zW!nf^GZ_Z5k@Wdv%FGnq4
zhTU0xW+nTnw332;db-kC{ffb;h`wC)MdQlP46ZsXn&5Jg(OSOg7&Q8z%$?+n-YXFm
z?60o_&am?WtE3FcdP0I$;;GAH6JuZ!NVw;^Q`Ts+KOisT9QYhxZP~D|nk{Yi)mfIo
z7SOYn5kc+8l)oOuwAiR#_4dLoh8KT=+Q50BRgH#HF?7gLmal}Cx4`}pBU*&H;0Cj?
zc*pkhjt(X7p9&Q)0fKo?B&j&x-W>`b;dw|&Ft~3N0ki9#f`7c3(9rV7AA`la>bo&h
zZQE9o`0rD}@Y&|sOF8Pj5`$yUOpYrp<#+}};C5a!7usv~J-N)(9s(|eMS<x_7))3Q
z(|C>(%f~GS8#^woFsdm9d`nkx=8rSU9kI(+@|kB>Q!)zFXkv@M6Fxg6`7Hj4!@>3t
zmcNg;Nw0dUCe+KX1T$xx_sipO#ckMq>`YA}3Wfxn_St$nv{%LX_KS=R9Q*p2y;|Re
zOsKNnLmImY8M|&D<c!kIh6uFK$s&qLLUo^3;@n{IB|ZSr)W!jWm=ylLQwdwoRxH7m
zqszS^%3b)3EDLU_Srxs!8IEgxN$9>3*C&rcnXmsdT5sHYY0sFoD<r5q_Y(0TpncMa
zo~bcP#ckFm7RNj;O~an_S1b8%Hv0<WIbG3R-?ee)BG0PJ+y+*V$(Xqsjzl!um$Gb=
z1M?w9y*bMA3h)QIA#dSvrXRhtb0q?R*a*^qnrmy60uN5^kc>guhd+<>Pi1%0{)hD}
zRKhoBUr}0ge1=BJDiz=e-Ao%6^+e<C(n@sv-0-k}*RbR>lhJi9EWg-4CNDu-iO;<5
zEY7xy?+cVL41%h3>AW2B9l?jHkDtLO&#y8$PAne!NGDHkSpbr#QH*4i{UCuaNYT*v
zoXj_!r!+t?ysRFyOZ%NDJtivOwY}+dSN#+`=eg2|N{r{$BcAOfd0_I|e_=it7^70J
zPlujA{=!RP^Bo)W8o|d~8++7!xw-9BY59P{n$^cdQ&Zf-p{j{fT=%f2xL?io+OPgI
z%EOih7pk(Ag;ZwIq+B(hjc+nrJ4byM<#UGpbo+cYdge7Gp5#1z(OSGSEk#!H&Gr@#
z%q|)*sO`&LbYFV>A6}KMPghiT0(3DWcCYph`wwr^ky(b{$X}glF?^?9uV;$0Q`fS}
zR@2d->pkFOoaS>2OL_G{!J5BbnAPFqK0k-V)HVVL{h4oyJ%CD+lN75S?1%d%*gN=g
z0oj+EBb1q!tKz$Ms-j|<zRWqTYxYtP{|oShUny|y+xJ1y^X0%83cSLB{E^}q^rmaj
zu6)k)w|DhGaFmN4=j+uNPhg<qFfm4P5e_uPir7wZ4pIzpxf!7nD_jv=7b`!D{<XXR
z_Yx%hx6Ju#Gf+DV+J2$E8SMH4*f(1^|6fGps&9~Smg!3hALG2Ix73U#N@X-FpJVZ^
zU+$lvm$?IO@{f#K@#H7v)w`!-{@8!0dw#@=&H-%hL=$)Qo3#g;I}CP6tj>?ABDhZ0
zwC2<40bAe+vS2bYWXJr3NC6{(ui+RCt%SB$OshBMWjNZ=?OgJ9$SiOLTHOW1v_3^{
zLdm&$p*FbW-kQ9h;piOQ_q&*y@5<)|!A*be9cL|I-tCe_-K?bpWz%sYd4!PBo~yUi
zgSyC~-+_o~V@$i~MI1Bv;e`S*jJ2JM2tvwj$N1Lbz2;k=Lg<k8%ttbSSBSAe{~{Sf
zmR6y0eoPlZcLLnMb5?gP%B>9B3fKy`f*WGN&PB3D-#@hsERt_F{!>fdyaJIW`0NqJ
zBherQ_<j2Qt#(=(xHmH%1iQ>t{UD{dJFB)(2L-hWQxV_NrJO^WI04n9MTwg*jr0z;
zYqt?Qs~J5LA04G2$VhM|3Ne0_97xG~Pnv6+8m#WjtE`u!2Cx~h{92W#+7h?@9_`@X
zVDA>9`G8AJK1i;`{(6zTg&OE^edtQ#e4Wt-2Ll0>_d((-t;*`}zU0!SxKEEm4k@{z
z9se9~x`TYT{e4;6)VYn(oWB}p(tJ@<;x+EF<Svg0bVQY<ei&NoI!GZ%+vR`f+^aVL
zZFvDaW5l#_LhXN(AD{wa|ME5qGBP?Gpek&K%g3xAg)tnW0i0}9%M)TuTL9KX;B@dm
z|0-Zio4T*gL-mOoa4|ecUH{POHl`41>icwHy=d^kxw5uAk064-#}>03p%<cP9s=@r
z`ewx<qna4mfjb7{<HEwk$HtIt7J8wuHc>C+=KGbzT5yaV(=%aE1Ys=hmC`(k7t{l?
zmd^O7e(E!$o&_2-i}jJnLt@x8lka;RZFCG98&pV>qo+ldA`f{^?O%GmCrv;3T$~td
zBnnK5O)$Rf$H%BrlA8pS?|>|Koi0dLEWdhQyUUKm9q3=b{k(J@?JUt=axfD7HK<)J
zc=7{uB8hVjTvf^1mV;OkljC?AhtpD^<e&w8m%jjhr708w!VCeH4h(AVS7N3@A;{wR
z!uGM~=E-j_6K@{OQ^YYO1nn5aq8}@=yb*=~k5R=iqm+2683h`^Hy=p)DJVmBCL@TU
zU}poj6h8eUhhq+YC^8TRoMN5en7$fbN(FXr3k|qEQN6?G4Ys%~1wfam*S7Jk#_13t
z;FCoG!{A~JU@%nXQA>+lmlt4l(V%lN?!T^iyfO4ZW5%;DVTxg-!(lR71ynu|q8Q|A
z#Ce)Y$d(1<Gwoyg7OKT!$Rnm>2cv1enNaa?${+hr0kOA{4&#IAtz)hh08b?S<9G}7
z`cd1HPaf05OrRfT<setVqAP|4snbXUZ<1&_N)sp}1Q4e*@q;FY{azIJ+5IL~&~%W}
zQ~=z_Aez+SXex*Rhy{i~5;Q?n1jIl9L=!-SL4^+pgo6>w3V|@u!WbZ7w7?<hU(wyH
zo%9o(s1+CA%?AP;AdQTJU8HFC;+^#FC8uYKCub-)NPpUZX^6FCCSpT(hZ4;?BSA-(
z8%1fvD?W=EiVCr49U2Nsf*^6R&g4%spRYmZf_B=OPU5H9Jlvg0=+_Q+aYIajOD(I-
z8+|d0F+#;A6av`=2RlQoqnjT_nO3X&7#Oftp`#Sx#_CFU35;h{@_li|En-fdUI*$y
z@G(UCzUOr4Qx2S{KmYk3yNii(lNm|1yS^J4iUEt?JWJLG8_<2xa&KK?Gvz1@W4Uq}
znJ1VCHPd-j9UtnjrzHLsZL;zlX?NN0Yq|=Q@zN6ieG0t-x<x5OpWgQF1N`P{;+N*#
zPs1;?Kxfoz{dTKz(I$jZ5bp_LKWNcON;qa@g_s#iwv&Wcf86!8MWWM*hV{KZl!bZj
zs*E(!&&y2C{^Q991v>LC(uct8v6FbEdREGcCCcQWO_=g5gz-9R$UX{0m&bEhpo=N@
z9)CeK@a6)#4Fr%tD!VOV8nbM1xz7ZL2PePX`da&~+Y||XKtWTyD2ZryR{27|%PaZa
zOyA%WgQsA51V_p+p3m~IbXoivy1Vz4SA%gSib@P%YlJx#B@&TJ%32)@ANz8;u9@`l
zWvQI)8u8UohTBROA=n0?4Y{>&GdxmEip&fKG_v0j75Vq?w}0<${x3q`C6B&|<fXsD
z6ZZT>6hwOrG4_B}Gb@>Mp`Ph9wBa?afdQI|g99FRzlBdg(1+na`I&!oDl}H5@eTMl
zv=ckd+t`1hY%{jpKd<z$!*e{n^xGGyYma*U^WHqJ(_KF3a%;g6ALE5z@TwJshk1;S
zyV}Kjq6cyI8($&kZ5sUZI&iIg6UDb50|3KgtSj*^>Wa;FUr<B-i+_b%RIg}FubTxN
z0xJzU>8EGw=XS-<UHK}^9sGmHO3TVfN}rRIR<M*&P?nWfmXVf_mR6RQrf+0({-*)A
bz1=*o1^llEz;kM*C^#DGUD7Src8T~O^-$UO

literal 0
HcmV?d00001

diff --git a/static/nic/ic-process-components.png b/static/nic/ic-process-components.png
new file mode 100644
index 0000000000000000000000000000000000000000..6fe6b9c70c44c33b02b08d1a3311e0758728a1a4
GIT binary patch
literal 51942
zcmeFZXH=70_b(c3C~iRAB8mbkpaKFaAkwh`p?8ofB3(M62e4wHXrw3z0qI?kjucTr
zK|o3fz1M^yC6v(ae89cm_l$eT9e3Oh=l|tokByMzS!J$SezUD-YASN{bS!iz6p9`#
ze?tR>+Vc{H+A*_t54>~d=#y&rXP4zw<*O)EPRRZ>)7|j*Ni%s3WfaQm3<~A{2!*1;
zTmIuH6y^d7MY@ebiM>Igm>u7hs7t^Hd+sR8-9T+3|HYOizlL}AIm+L1L7|RDA^+2$
zF%LuGO<Gs9@=e;2J+y}|9b<5@I13}9&^NAXd2~+p_!)*#);DLzB*eb%8VQi?SG}?!
zf3TiCC2_^O{d`Lz`wyGZ=HgsRPEuciwX{xA=0r2)$Mdz0(dS8tUy9L3E%dohvTQtE
z@DG0wTBUv=gtK*t(T%^6i}uD%{zo<IZe4c7;;bb~xiJyLU^Dh(b$#RWQlH;u8LVpi
z<-cij7en*UU#Jv=y+ENquiMxBcm4A_>hB$#|Nj2wz{!6fseFXm_wNU1cFF(y`-M|7
zJO25@e;>`Ee||?P{hujN|C5A5o2BoE!$=_;@<$Zd_wb;fKYy-aWtBqUihI(UzjRqZ
zK=tk0x449+csYZ0kF8^)KZ=}RQPOBbw86;iv%k-#>1G>8^q6RAg`QE4)Ec3THsVb<
zmik@AgdKV%&>Dt@-R1#*@kc1CBx`0G6zU9B=dU(qfBGb`LZ$MYJlUVy$j8S=Ae#7P
z`un5cy*8Vk{1KbJuE_AWZ>?L0j-3>ZRw*{*SCqOgTwjZ)Mb;ognKikGLiI-~C@7@O
zE%$$Zm|Z08K!Y2bjih^-)rR9z41M`B_UqTL`t;{uW7WZ|>2Kb=;q^MQx;WL6XWep`
znYqU5js77fro^J6BDz&}-(^$L6T$kMe;Msh*Ui@P@$o4uVn$|4X+#*bQg~#l?l*RI
zk^9uCtGL!ro-T?c=VC+c;52SNzOV$Fke4YL70t~WL&oVE`ubis<1fOjkwVskly0L^
zHzR^e`zOzNbD}0;JzCmt<GJi5qiJvTXiLw;#;z$1Jf1gGP)I26TFRiS*ofm5n@JYo
zTQgyKCZ%q6L9IKHRTLGl+%iH|(<d9kW;Ea@Dk_TOEbYm<`f!iYJPUPkD!m-LYSWUW
z42#k)aZTOB$d*y;GFCg{tZh|c-Et=An4m0(dd1>oho*G}L%{X@%=}tPN`c7t+S~QY
z))%{E`*Yxn^hYmLT1mT2>QSb;h#phU#Xzhx->R!^D*b7Yf#>Gt_&uc)6BCg??wFYg
zd;Go)&&Y&G%sstq*Lk;O?AAvMG!J{&NV(q<MzS&F*|VnRM8%+&r-6}xe!>s3J?BSL
z9s0^^>*`>=QGsI<w`|Q<mnJ*n<=8xL?A-I$g_x$Q$NS5q+#O~fu6EPx++#J}UEEoY
zEhR3w4OBhGB}{b{+QM?42L)yRYBN&3cQ2zl@YoP#IWcB6M$%izecEuyn192^LyC53
zEFNa67IZ6gsu+VUhqg>Cc$I5OaSf%Y$MdZJ<vHXkmhU>D@$KtZtDkQ!B72(sWW*oQ
zw8;@7aYw9i{>`eV0<+ZE^jHayVMuU##nY)`33e~L`glJx3!ZkVjOp;<H`9q?cu(Y*
zWTwn^foP;?cNIG5+SsIVPJClF$(Y@E_~1dHK#D+t4S|PGKkxgMn9$IKgal45PR{T4
zg^D<!qjJ0?5X0icyq3Ox+FL<O7VPfbyMGKgT77=7n}>&|d10a@J)>p9HSz%s`gur*
zu8+?ri=S`QM^>Ul9DrLtIT@i9l$Et%&PWjl-ydoXl8G@|Y=fdF7{1likk^;`vfHdu
z5tfa-Y!^9E=5*zR^OX~|KYldvW`EL{DE3~Qyx6wG8Bg}D_@s;tfBiZhxQ9jasMraH
z`bgorg<dbVhy*y<V~yEj(-oV(EtX#f9FO8d!gzIcj=maRSvhy^+=X7jrA<YRYuBo{
z@ZUz-;lK`_C@GfKtqbSV%r-7N%*tx#V=N)3;Tf!VT+}&%(;5ylsqxX5fnOjSc~(uQ
zfgD<T2DU@hLHea`nNEHC_U%(pQ7IqR3P)(`UlMQ->`81}ks-h2=Gr_i0VLWscLS{*
zFL;6>fX#2sDKR<Oc6RVv^#-3of&3*^rXzp<9Zw+>c`sgUvNhq=%@Qi-#9uUfg2Um2
z%&PxFk7&Avg@@ZLj5j55uO0gP@35E{ezez2*%D_MEr*knQ)hu))InE|J%9C{M-I(>
zol4QK@GXPWVuFD;*T$rA2@4CZz&uBna4|7ipdxt%1RD45dLJL3??thJRs8gj0%41b
zi<6DkSP^<OF)<Ob?we^`*4eHiFR!Mdfg2ngJPd>R`}_0A#Yn6Szpj?#Hz-g#E@Cef
z>}g+`n3Mz>Ql_iGPEgWi$=g6*-{#TLrluyKOIv|m7r$s^P5p@TF?<jRaSH~>Aho&X
zl0C+C=1ioN?X>@eix<`5+p<$(LEj^#{d^PgryROxDthdRx#o3wc3qc;+9QQ+InmOa
zD~&<e7)-^=XjHXeNMN8)uSn{eVCb7SR-gFKo%_`gEzWD`H`ST%HSm~u>$wd&I=W%U
zD?(liRxORMSB>>(x9mRY3<3<)Y++l0zrMM+qV00JrdTAs@;I%3#a^u*f8A5+u83Ql
z>2t`77IjJT!D5+MSkh?OeLh?>X-QVq_3|odZfOz5Qe9hw?t%nRspRbR4D+563@+j6
z)4exu-uwYFkTulN_pO^F0@jds_s5};(NUYxpKoD<<%s1O!SoEM!9d2IBTS%edtKKQ
zh@G=ZCKbNbi!TJqQzX3?Q~WkJWTUlr)1uL61yxmDIEd36925%C<oNv?<}_Uyw>}P&
z$+n+raIVAO54LP7HV^-J&2-?vNfQ$j<#$(d^p^%j#VosvoSem?!CqdHx^8W4&D7wz
zHd_Px(Ko%(4)TiZEXS;dWi`#KBE3$K^Z3O(kMs-e`I1{w;k1U{DqN~MHBlv|%O6p9
z^w<^Cs$IhN-R%pviiU#4Inf|>f)7+09c%4cQ`AX>^avmo<?G+7M^|m<To7c6N?}zp
z1zTwIxNhW9d1Wvt!wWsS%BePK83#FJ-xx1Vb?L(Hs+q^c-6k&td#cor*wKln4lWo+
z%%ATzNl8vhihQuEaD8=2SB$9#HXI7vAMhpa(W71QPhfqL3%{;2B{7x0`7&_f+T$0j
zl3ojRc%PePUX<p*V}gg-*&USLj{3$_Y*4ZZU@;Z8Z1|gtW<1fszwZFg*>o>gN!yv-
zxub;N-H76lkmzo=hhxmAx`#|UNsqlKzAmrYD<v|0AR~83*Q~D`TV3GYS@L3JWQ1Et
zNGm5Nr`pmItW}c#Jy6Uz{=i<GmZ`o(>YC-$U}dx5JG%Y*)0<YeY-20`j)Xn$Q&Qwt
zmu83o?7k^GX&Lm47*MhIm%j=4#@*jZtAMj6r8x~%8#&>pg@Zx-7fSoq8xFI0s5~28
zxmgx9cJA;*RSM(MIouIG{i8L&?Us)WS5{V-sLlZ*8lJHSjvY&lmkTj=ri!9%niHPo
z*cEn_1v}F1+n2hqRvmPlOwctUc+Zq21G-`Ptb}Q6amwx)_M8HawgvrdjBg@Dieb|1
z%U3Mc$D}teW~vI=bqd*a6=XJ_bOMDX>mg*>aN_af#}g}K_-rAywDUsqmwUQ8K3WQ_
zN=d9Pz0=6z0ftD=Wp}8_mYpB151M-O<|sXzL{W1Ahg`6b6j<~xdsV00N-ti@fMI1<
zj|p15F)r1<Oo`E2SJ%!ir>1d#+Kn=Ns~#`QEheUa@ZiDRj(a*0KtB=<P_G{VRK&Z6
zJt%+MdP(!BVeIhZmI<Nqz$_aZ!KIW_sXkv{dWWi5Tc_qcd2yG`e9+D5O+SNiH@Sa-
zOl;iiU%ouJf2eMwyStkXTb$g#pN_5>7^=0%$*ewFys*}?pMjr6#Qq-3sUgvk$hwiV
zw(;{3b&1~7#d5FDC~Ls5h)Drc1=_9_F>!Q_0&|i?d#~AV%!m+yz-oDB0x^$w#hkjS
zq7po7>>1UdgnRzt1tD3Lot{NVetxWx*yT`R_ek5I&|bKwG|KXd2#|D$EnS@D$LrO1
zDJkbPH>VqKTUc1+Q)mA&eE<G^;A+<Ns`l|ox6*?j+{S->_9y_mj=M`|;7uW!=NW;b
zcXEg^wb<NP51NW{DDPOlRk|FL?Mf}nuGomAgrH*gaGgEND=K;mxVi;V7(+v57&Kr~
zF*$#&M$ad5a1ex-r>?i=+v*D2b+(e4!SD31sHn)9in(_F%$aK2E(Al|e_p80Vej7U
z6wqYfmT~KOaBv$uly~PFon~dfU8v^OtM>tCr>ANr+l<tPRr@Z<2Q5x@9bes8u8}4Y
zD>m}y=I4Vdzr0>moPY3Ohh6WdTXG?6!pd(KN245UV8Emg_u#omP`03Z?79QM+yWjG
zzSn-CY<ciSQqzsz2bUWs#=12>=iB!ni~+a+^ePUI$0zKMH`375%(rZ0YgtE+a9I0p
z%;U)+erxeL0^;IbZ$^KzUdYhPx%QBjQAb9`pSmz%mKQB-8-7H<_#TVVFgNVcLlrE6
z()~ww88AE_VNaNe=9{){85gHO;Jp(y*F1-gX@PN-KXvMqn9FD&h@V#GykxS)ix)3i
z{#KQU1Mm#S4Y=6~Mki#AIeR>D1KZe&C>na>GfHn_mzO;<jY@TZ*xK^)Ph))M(16GQ
zjmVRU*&<c!?gow4M+5#kcIO`Lu3Z4O>INLgM<PsgK#0Qdc!x*HpsKWk-R7$WJ@h|X
z1ObgQLHQ}axiAnZA&#;-_f91lND%h!T?S|stA=-?z;uG^27kdhJ0CnrFawJu>(QEN
zAW|PA8D%<&LMeKvxL{H#p8V#B!K3owlx)dG-@bkGq&ETJ01(4o|4TKiOtG!Y(o~E^
zeb4BiZBd0!M6DbLm^<r^Tyta@prR1}<@<N}AU4U)aY1fwP~~U^B_%Dq6gJRTz&P6i
zmJ*f~VpiBC41CU~_n}fNzDrY8(mYV;Eu1y(^=oZ4wOH$xBsc|G&14nftPx)~m(ic<
zFOKjDfma677Q`y91As(7_wF-T8S-_oRy_RtDxm5vOENBXUYX7hmH<#@1tzFka1L;a
zruE)IQC#)MMX(a}??g3W$$%fit@Xc>9Hm9v@zb{2mUlG)z%em1Cj-vs78WKf9Lw#R
z0`*5SCpe4lp=Z$=_^5H~yO_n#qh*^LtH5ncF)RB8KHa8sd_sTR!mIJlojW{%NnQ(0
za+J0CM&0EMn8c`Q?-KZiL)hPIp0_y<p$wySGWAnk#u^ZDSzDRMP#3K0qeN8qA32YF
zj4HabOP<ocvA)U`79w$4Vh2iZqPy6o`g{B<4mmG7&FH3c_8%=9+rX$(KujW&8cDz6
z9)c3uP)I)fA~3LZvg2bu0DfR9<-gCWXaRann_LYRpH^F%?#Xu?xQ1qKJ2Pk4b(V)m
zVX50C1e99_zfs9ij>zsMA=|d|;IEqbfkYrSyOuZm`-H0vU?(x>;isT?T9Z}r3ST%1
z(XY>>Dn{^AVUzh7vJS|X9KRHiNYoYh^!q_`b8}$RIk!?Hz`zLR<eZ2LV7qj!Y_vX#
z{PV3~^~&@I1s)UjTCB7{*#Zs}Lb9-J+c`jrU=Fmv#|@&q?rxNZzkmGr(OK-03|KK~
za`GNHb-KtmBKVEcKGnb>mM!&q*Z%w|RHmvJe*U8D$KAVj9mS`=ke2S1QU%@I+@52W
z4+sl3G=%jYeQT*SV`mN?XeQ9nrY4w`+UU0d*cF9%fLQ9n#cQQ6Uml1*)7ThSD2Byi
zdGja|eJyZ4K(i_yqA;#jPQQ5PFM#C7@uhG&x_ceKW&!gB0WLk&9((m+p3{)*(0X{S
z9L?fHOHE40yp#mq)O>ZOc#I7YNb6AoCO_^Hs{a9)Xj||KWuJzIg(ZU1r*CuwPF-ca
ze|4r}vzK(*(eBgls{LY){r-q)87lOnL0LWRwmnfS_Y0s?tL5|zIGRUe0WGwXoWZ@v
zq`e~S?(Y<Z2RKu0iCH=kJ5Vyw9{?ezE5ZXsqtzko0_e^hvw+&#+6;ccU53efU$Xdv
z&!%s*9oS0Y0_9olW@;Ko7y)mEeApJkV*XwNAW+ST#3Bfhr7-I4JO;Dx+QP^)InxIb
z9EYkLF{KmV`VIN<f1+t9;wy-xh(<TCOf`-;-@+Q`-h-o#6nD=en74`tW%B<+EB`0_
z5L7U$3D$;427>$tidrUG|KKnlVPS3D;lqa$kif|A{?9Dna<YhIZRl=<QABK7&)t-j
zHFopU^`4=jp_!vl%HGev#^E@BkX^onar_&qjAd{EfFBg34OaNUg9nJG#=t5z4(>GK
zG9X&|&6^Zma5QpPKXy&Y`T^%?U%U2z(;6JM{6pVE!MmJn&jFLsGTs!Qoe}~8DO+R9
z>o@+5q{^_499uLzk*kE4g0O=kXiiOV;ln{ZCt8wqJ4}p?W0F*&^{xG;hrj@UmiofA
zTB>j2w@%SsI>^G}rEGgI<v#(`lz29XV`ZC$L}h1Z>tq?Gf<h;OCxS$(RCep$@)$k>
zaEePY{M_ZsI-rJh0D4^viw2_2jnsjSyBBCo>MG1;^BO;eC<5#!2n&IB*iwfsV=CZP
zB2)!z4hrub0H-Dd(c==d({+#yM_zGy??oYTp^;dP+hltj_{K>50fI-v-(Nikr&2k4
z%y{#=<el1iDuUJhHs;y6xVR7t1zI-4(HEA}>p8}1CMLbq>W>&Lo3I1`e^!8fk-<5w
z;TO8Sdw+p?&fIuo`1gO}%dJ-dylo?w=I^gKc<q>BqYDcQii=~;#evqp(@2f>g}UR7
zto=pcuAc*Y3T`>*M*U*v#EXZ{2?}ZgdBK^37)n@=eMFDFE*#^bLx=M2bzI`$ObZ0m
z1Q0LK_U4TnN5>l93L?PuQm65!JsRrjuYeB@A2<*T>U4-YJ+Z;h(8%UJd6DDF^JmXq
zLBOf=vb1#H(YH+CGPUZM9Q-#}u0~s&>`n%HTYvo-R$E_RHn;)m{VW>zjQ~1+giKBc
z6Keef$E6@I{|iEzJQ;68qoeKUULgDdxCgeJ3XxX`Gvf5~tm5Fy6Q60>g&ssAfk>~I
zu|}|nfX&*TGw~|XG=GC|1}~ba3W3vBoq5)PCWNvOY{wx1<6n@~DBk(;=8GfNa8^lU
zu-I$_2gOJf8>`}p-%0-l?`3Xog@Zv1TIKyp-KKDy0D+9!JR!CVB*g{(mgm7s&49JS
zxtbn+nG6ocTUiz){D{kQo9g7rCW2RhAWvla=ovDZ7owN|T*2=%%AFn`w`y5=_39Na
zp|w>DLcZvcmS5;*1RX>^fdk|PP60FkYFO@Zxn;w<TiIVYo*_Y@?N_Tc@O0KIUm%9l
z&9UMy;jyu?bYx!7C;XnCo=IvWgVuB1HGpmTJ?nq{QUjZ2*O`X~v`heN#u*lHiy(aW
z`+*kQM)e!8ney`TYAr0d^|g(SOPz4!mP*<2@$u<~mTBcD|4TstxWVxY2&DoIpC-(`
zQr1?canE`8?gT`a`aJ(;WzB4DZKYcUuLS!ozZ~RA|HJM3)_o&cB3jXvKUpn`i9%@%
zjlVLa{#)sQbNgCLO0pZ`VreHRgN|1YA3369e%w9wHAI;J8t@RW&P@tPNEm9YM9TJh
z><`J31x0a?4G}f)nX7Z^=wGEl)GMb~742TExAUKrjKA1-02q6fbh3?&ti`wE5a30&
zzp-zK0*aW?#{r1a?F6mbXzK^32@J-RHRUGE5iEf~A&r&qNe}~ko24B+F~c9Qx>7=n
zN_*~oL+|?4|59keE~84Y`3ydzlDupFLylJ#et%(9#6f_@<ww4!vCr&HbTe#hVX@0W
z_sTSckT4`IBuDTL&{9x88prLy1K9x3;%8GOo~GK|Xh}Q)mcQLC<Wp@!gN~C^j#Fm7
zEs@2pyM<)Lz2w3o;qigfnvkZQ^dTcJPYa1dvw035H1qptQJ+PMBpy%tuoWc$7Ksg}
zqo>z~nLx~vL4F`Iif|Md00^gDmL2|DU9Dql#L>8M<h)+&?)^uO#yf&&2f7Jb{QL#_
zJBSD|K}0x_a3w@?gV?2wd37=_WX&*?@Dssl<22HHm;zxYQcH43!W;!b)xr?gL8bwJ
z1i*LGgWdZV0C18(ypvc20=!ufKx)(U{wAm{WFrvLjRUC017W+=)YQm}X4PERi>c55
z&8hi|-GgW)sjs3UT)-r2c=#^I_&#v9At2M5Z6b}BG#x*6b#(;NLl`Y+19Y@(;L(A6
zX%I35vV%f^NP%8FI6`EIOn(}rJOrvM)7%2}4N)8ch*&Ctds_l7PtdP>z)Fa=g|KEA
zI3vKvybLe95v&_@Tm*4OWo5?7v%xnz8lS`Rp512?%%XwOuB;$#%_Mo;5q`rI0O_|N
z5QDr@xO^bfNr|c(X@<yhpt?|gj|r&z@(n7Pmm!Ehpk*QykMGk~4skCg+Jbg^$ch>M
zFVQxXgLT>p^%r$-zyb_;2VNzx?EgU`QAoM6I$L>~ty%m_9{)=#)c^Lhn)N*-cWP)0
z3K5isE?@>iBC@P}9uAJ{8yg!s5i}^7hs=OU0I=89)YOnP(t=>UY7Swcp;q6XGa>kL
z`;l;u`FfE|ei+W<sIX1wblH+|$34KJ#heH`w<^*yvbDYwb=e!TwQZD|CFj|*<k=c_
zT`)(4M8iWIkh7wwpwZ8aeOJt*rLdiO72Y!{IuS^!yY>0{u>ekVbcy>fMr<S!DMQi6
ztj<`V#jw;oL^Qw(5GG#9gLU=yvV>(N{XS<=b(>PmrxA4TF9;){WWMxo;CSG@{J-wd
zL%cV`ZD}V**r#cZMC=>xREZm2<jg`>U<U&u{lw)n^eDCL!%R$XlQLhty`Z;lAA&e!
z$jjfHrGw>IpJp)xQqmI=zLJ`GvO5q<lY)leTM`j#|01shhDTm9I3b%gyCkBC&+KCY
zmo_32FzVsMN4t8w-R}%<BWV;VP_{sp)LtAk8~I;+KsrHaYInPGLMK9#`#*VWfBnI(
zj8p=b*8cyKjsCx<?OSu-Ykt#-*d{(oD>a7z=k8c0{>mh_X4+c;x6rnlt#!q>LHoTC
zyCu)i>oTf`VoA<sn<<vyeVdUo-lDz1x6bbwz4^kxRID%4$m0#LAX=J5<c85{jtt)u
z+XJW2BH*>?$#WGZ@}_cBc1y$Q{Jp=4nO~^273MCi%L^~1dU07Hg$d~}fbV8!w)w}7
zG=k;bnXEa7rnM?z75qgCr8L4KJvBRoP`IsW{K;GCY2s5$4<Xaqqd}z(dEA_0V?0fG
zd@!**@cjBLQE`DR-H@U4bYb44Ct2sz)g<iMx%~@N{AL#R*e&Y$`Iq(+?ADa2ZM)Gg
zCJWZBQh2Vq&epZ_R)RqQg&---syX1HX~MovDn1rTsT73e81@~;XSQj%_2$v-YktIS
zmM6fWxUX)*dY3$!EcNU2y6E$0w?Zi&hk&{AHH9+T#b0(DR5VViFCufP%|SS+`o(0A
zwvqP@t-Yn3sTmnc=_XjYo5>CGxHW^z#Dsw9tP7nJH+=6O3SZY;T{_WfZK<A!4G#;m
zuAx0vyL>mh$!%dd?m3BAf7oBUkae57HVg=76Tfdr(sH3&{4geoc9B%-cz(WL#w+sf
zJ%yp1*tf53C&i1T<=7q2x=j;;oe{6N&?LzZ0SR-C)`Ysvmz;1Mx?RC>@IfNbMxm#m
zMkv#`DfLc0ejZo;^M`P!?<X!JywA(HzKw|p8)mjMsS+=}7X3EQr%D8pdec8H&WNVK
zgSDMeb}Z(U8WVvgID-8Bj4hRMW!kQ!z{{DdGEr^VSmy8sVQPl`A3wPD1R|$d_g%6M
zMY|nAYh-51h0gvkMmLYoUgtg01&e|2Ym=iM5L$_HV}@L^9t-0R$u^b0dLgWxl=}Np
zi?pEZa#8Z&{5>+mi<oy(Ch2{v(&*;*mJtfLGfKzI0!t8%XqMhIf}InC885kZJ@rN2
zLRPo;x5#d7O}6NiV@ndLTz-1UWSMUNEbaXE(y~MFp`1Np88gCV4Whcwo~z=U0%oRu
zb&6b8z`dtp(tk~ZEGTne+_3MsQ++~TdW(st`tW>;i>I|Qkqs|6n@kGdc*P^8oq_QD
zen!FksYA!&<ov|7ajqL(8d&UF!bS7wu~4is7VEk+489nb(X)LsZ>d+N&f|tYa*z%k
zJB6Nem`E<{^-H|APO#f5i$M8DB2cUnGn%s+Ggne^)4#&vXK^37L<S`9D_IobuXbXw
zcTvKA&EKrji}{?X%BxX4d6d5%2D3E)=IrT_n@N7#8O=?VZGJpK0d}#f3caYmS}iNN
zTH)6QY<;++G`&+U?_yAU+P|muha}<mH*g6ctmKG!U!8cY>KhHIlCv{)*~5Lg#giiL
zTEIuu3$DFIL^)>{Rd?n?Z6((X@JZ64oMv?8uT7W~N<O$XC;Gg7ogU#=F^8L~?h(<)
zg}y6Nw(V=T3XElu^i4S<>00O{@Sn|I-;&J!zUIbuDbP$H%3%e3KvSGcpH4@0%ak;W
z+EhW<M7N|N9J7e*9#0<8rObr6gUT_Nq&jR_oV4CH4F%ZL#&5d(aJw9(ytJ0*lbImk
z;!NpC4#=CHiORF?p|zRzdw7xF7}EvD7+$fXLb)aIFNt?aKJJnEW=5X!ty^z5`tnx1
zCd-o-R>~*!(=&@V>2V1US6z5cxXh423V__5tgC|_j|)oOr(1x;6YtV*d=}ZGfRkD|
zIh0GbW@bxzGkcw~{IP`#4ckp|$-?p4|2fk1?Ok577?ekpV~s&G#m|XXOGn2-%=dJK
zjNcjs5fW>Ve_#qHbLNsASo<KHmejZ2XKOpmHi0=WmPLElmH>5Z4)$lm_LNT%;oXge
zF5QJf-9Gi#?3csWM;VY0TN>WenYNFu=2C_iR;oMY*~{=r-f|KerkM$g2klx<SDNtc
zSR)Jv1f}<EYg?4?3kO3`;j)NknYB!|ZThH4nGJVE`1Ms;X>G+#m#IFNUwUTea@}=%
zHh)Xz8+Sbn*$B}oTVs@T>(ea3=$Qajn)FOkfLZtaHD#CQ*FWIBFgK%1>eyWWc-q@t
zo5*%hL8aT`#K(?%Or41CXm4l#G23Bkr@wSxf7f!l96k$|Ky%%j?2ug^54@uh+{jSp
z>mrBNxKrgVHg&!^z9O0@s$OTxZR-S4DYuZof#G$qM0v{&6)jzLo2jZ&-+zJZqep1!
zLB|N+wqoyan7)nPdq~hXh10sHPh?_<Z=!kwQT_`iJ(g(`1qat#Gm5hZnKRnpxv9GE
z8eo+oFOK=%q?C2E@-J7*@OinVf{G;6RhU>W921|iH?unzRi7ly7nLqzY#gslmU`KS
zJ(=qBykwtd_0a+Ce>u$JzrvVGZ!g`%<w3|f--b{Np~_etpSd4ry{7VsoM=Ek&C9fY
zcQNQQ=H})+5>5)4*B)f>e;Wqo>I?U=-6auW!y6WICoR<*5ejzd+HV|I2eA$^*O`~v
z522gm8zo}HuL3XyQztR0D4jy_Qx4}uqPdLHYaa+)p5OL@9=3T^Z;|dY@JfqqkG4o?
zs(oo)F_E-OH=^Ya3+N_8@N}EBh=ADtPnP<z7$9X*#3+a7MhHQY_rJ*GN7k0oJm$?v
zell9F6LFs>Z|{QU?ey@H&ml_yBMXuGMK$HV@OQ-O!U8M5>Qm{8h^(h^t@KRkMEKi~
zdP`qdcZ(}YFIeBfaHCN2r@{Y^)ejy$LF^ofT2P+7wf%q^<5c671dae_;eog&o8!K(
zkwCBvqM{Og44ivyJz7gm@(78@*v94wi3+$9IZ9|qNC;shmTr1U0awl~m7ZTGVm;cj
zBzR~a>b59iY4}Zt3=EV8nj~LO6YL5Z!|E+QmI%QJmAvlfoEkT~(_{N@r`KI&n)dsB
z3cD~s>oqo22*C{b<9(g)XBjuXZ>1d#Igld1SpL<dc60st@fh?HY0;Ep+k0r;3ryJ+
z5cCUX5MD%f0JK9q1*?7poTXeFc&3>|EbNhLCE;LRRO@x-&BE$$n|u%<w?m>9v2;M?
zpsC*V_s2YU!58`?KY$U&=*)*ie*pL{vr`U8u=Q%CVg14pIAtcff^gjS_{azTVzC|c
zB6>(5eb0XY`v3M&c)}LQg(JhdBo*nI_=ROxRqaSuydO|mc{0EJ;*I+CwTx|Mn%|DO
z#y$xR4LxT{IbJKTm|t>OE6%;b>RYe$O(`iUB!K|5+R`*o5VO<yL_ppkMOWKU>n?`7
z=uu#v7AsXkQF?Xd3tgdmZV7^iV^t8o0&1jdX=n@zOVCYs){vU}2ky4<o0S%&$nzTe
zX{$<Z(#oFR;-KxS+e&Q(z4a&D5_IfR>Zi)~Owa~FT7M5?wBMTM$V^ApyHH5FTu*pJ
zaImVqE?v0AIk64ae~Nq^CB-!j@9EE<^I5*p)9Sr<K%I5rq3mV&^=Vars?Z`ZDM`sG
zXPad)TWAvW=Hu*&T9Gn_3E}S~oZ~*`3OVMA09ZC^n<o8f5Ue`d_1S3k!rZvnZy2tH
zs#O#0YmMZ_A*X^EGk94!u3i5UH1$QaV@vs<T1B^mx&C{Sa~uS>k}fEc(ElJa{4a&f
z|0Eqq4{~!aMLUZLtbP*w_KlgkTySGdg;@{FOL-DvqPQOWs-AQSHs`<R*_Qh$^RU3r
zA!#Fj!)RoLt&~*$PINVo*Ah=C)XEmx&!D~9HKTLe!+l$MupHjrEWHMJ?T2(K;($fc
z6|XWi#QbcroGDN1&%)l_Y`WXwJHAzA0D%NVvjEq8=H}&X$<;M!`<&4T>`8FFWE;_d
zmyDnOo6S@o0j;q|wpqo>QHuI|r=~~i`72t{HA?CqV-Hk46B}HesdX(lX+kSf9{2I=
zJSRH2V$E>HyMUb3dp(1n5uQ(3+O9nXc22_K4wcO>8dQ^yOqHY%Rq?I#nN@p3NH5ui
zawneXn35<hX9@3(n9clDYFWat26r$>S)@$awg!m3%6-MNYN4bqn(@#Hf~mCCUCjt_
zcA+V8cWMH`9ARn-+m<ixzlTd;=}k@#j3jJ5YKcJ?JvvjrrWF6OTeB1ST9Ml}uL<cX
zM+z5~?9zJe7q!={^ny1Y(YXH(gNkjKr?)c4AmLA$hyS0-*Z)xgC`VBR#fBfVKP-kY
z^ZmyOVxOW|kb;@5_{s4<tV*tZ)x*xcWU`s^VY7F)!w-QgUrBQ?m%rEj?dXGJ&#~36
zh}OaC0-p87cZ+8-o675FY}V&P#><(B7eK`WacTY;OyPEv<6~En>8El^xk+tuaRukZ
z@v(ifr;rT``~Mlxh+85&e(k!q@+l2`X|f)Y^@KRcp91_W@n;o&N(a{i(y@*A>Bzmh
z<r{pN{9Ci=ZW9be3=2PH7Zw$jJ{iqj+xzx3nvUFNu+z+v=Yw4lVPxwFu5H;07`NYf
zm-~2zb=_s#Ne2@Ryc1(BQCg;$_EMhHz&)(4j>Vs|-DX2n(X>!*$KmGG0BX17O*0FD
zP|o7#@2Fy9{@dDvvO}{S(xD2`-26JSUTF+tcX>JZ2qb5JeIgh|u_tmV?tNCmOY<K~
zPG}7%Y<?1Zo3D8GquVVb-?Ag!`5~Yzn7Z=|BZbo6;^UDN?}8Yt_%xMKcd_AcwCGA$
zYia<YkRDcTxP)xgUw0x^e4&u3E`xvP2Q69sv`ftzl!h*ciTikE&AxFOorqlm%kydW
zE&;Bh+_tTrKM&`Z6!&Q_tzZ^u9!LL-FmZfZ4q}yqwMM99vWa>u$M}&N4g~shxLUuF
z(Z2A_7#QtQOJ1}4b_wgW{9*d7Yc?UVa;KlMkqLvn&-HILA)s5orjwGF@0RyQYR+0Z
z-JayIx%=@JHVW1%Q?^Asr8(yi?d3~u-<N;bFtw@F8|>0EVpFqic;`mCF&)uaGOcXZ
z7hup!ti1Y=iKVTYG<R~w&-gJTKIORmy?FM^4%QgYmkU#GHL0WNX0_;BW|QJEIocwN
zMcN{Hbfts7T{kJZt8sP<VP<&F)Rszh8$wRH&$@v=wr*<)Te17U06=<;2neubN3E>b
z&P|TBW{BEW#170d{-tA8qe5!s)py|c(YJi@f)ky+Hga=)nsNVKv(Sf${2TLWXhG?o
zxqb)RdqJ$Nfk}K1hS`tA^=FmkdlP0b8~1WJtv4eh2s6x1)T{BltD;oXkE5hZ&Yw=p
z1s76}Y*93Q3qSgo428C&4!%D<L@7E}aa!WqLt;iTzPf%nY_<f<U-CPZ^g5g0$b_q3
z<@SY;K7dYW#SX?-ljkj8XlwY?l5$}~D6K8wJIXM2C2-2ZcZ06{nRN*YO;?^86uGi;
zJX_LF=Qe%gQY>1qB0Z9UK7R<*R?^GtD*`p!@MimQ4?=Y>fpo}U?AyHM;EOK-nf$bD
z`g!Dgn0+Z{8kZpXb}+pTkruVxTUtAoMa+$CeGf0Hc@HC6iQ&F*y18A-Z!vIN9i{B}
z{~KYn>Cp{d7c&{mErEg~6e{db;;FS{@bwDSapYP$a)c<gecPr(CUf4p&9FmUQ_JU4
zA4voG$fK$KPwI|dwJT+VWu=P<5&<8`a3NxnV%cz*nM}@})7H~->=<Kfa68&{^YK}V
zXEj5*18vcHUz)2n9XvPcBUf)3A$?PTtc8)eNYB6!aAo*jKW3dO+-$PJELyvHx`x!X
zBTIhF;Jxsj!G|`3Pz}e8;&B?iTiy^+)cUoC_-93*S-|;f-6<M;-D@MYuT{@um*EV<
zv<l(4-*WyO1AA`CVN}?6_er9+K>f!*+rEty)f0<h&P<PWZ6;=>w~OxOT%Dw5e|>ky
zrN;*-_ncmBtXK0!&P7RII<zk(-kI@k3P{}A12AC-`mel+?6#-@mi*-~8~riqTatSi
zv^k>cks+4iy_2nH&azvPOGLN;InQL@N^Dwc`~YByd3Ha;D`ywX?|4p1vG?=s<1E^X
zs4_=Z1Up3**n`xPM6GrW9AwFmy&UDmz!G<A=<M-TWJ?`_5JKJ4fBM_mc`kIc!;2i)
z8@!AWeeKA)N=^4^A+zla&^J1ycGht1qa*3YMi^#Sf8_IV>30)k_@=)Y66p3P>zSI~
z&*@nSw~}R}*(7|o5X{`^c6v!MU2%uws{`KdJyMtgf;lpD%C0R|BPB+OwFgZN$wAC}
zXaDK?hu60b;1co`tp{7Sgrd=6u?@N5JtE&W2O*#Tudw@HgP4Y>FwTi5{yLz(v`Y|R
zfXX`Z$6Uw5XXRpfs`U>YwB(c7!V1Jq2Ai3Wv7>R5JLU9^3I;Mo!M~X{`W+5O!qc-A
z*wB5kwGNqwvxGRTf+w~dw0ZU=88KZSeeUeW2(7~HC8h9X-2a0Z6^tymQX;67mOti<
zUPawFIH%{LL={rS1LO+eh7vq5U6&5ye-fF!rJ8huv7o`<S6&_<wJ*70CMEUm+kH{C
zTe34w&OWi)iv4;ezbGe@;oeFzL$cpF-B+4DPx><Lzf6Z``_<7Aub2#Kj3)V65vkg;
zn}yw;726gk)P~?${xvZ#zb-T)U+!^@^Dvn`_E(gHdh-4F)~qp9Hbz$UO_syEvw55A
z6z5U4rblBDQ6y2!n&J=@G0%t+{<}jp2r@c-;dOKC?&e_b>O6Xq?8M<nVg017_$M4^
z(oAh_-o}dDFpskW?%?=gwz{S)O1h9&8@tj#p!nT6if!s-E1xryC{z0x!>rTEZkZ;D
zMr2*<DwjIt&n@Nk<b~NjlS@YKuz_0XH@Bw5_J@pG4OMl>M&GxqU2O!)01zMvPG3dX
zn<%zq=SyrQt{jTc*%+*;CO_TyGV)XM&H{#v4dHek_DJuGtix4UmQG;E$3e2TkcG?k
zQN%{NZQAA^+)*qy_E*$~0c$%hC1i60r$OY;yig*CTeS1lg`M+yRk^P04jA`&rZ`h3
zqzYid^@>^4!IMn*pCVQ9-(N|qSL|y6R@GezShQI+VNU<8r;<-n0_HHhsj@<)wW^xu
z4OCYNR=vzSLRsm|_YD*4JHk=Xe;^y<#&Si0#*~#4jd$qc+=4Y`qiY>jWFE1^iuD-}
z?AlU9YdNu!4okS%=ck*rCfODCI=8wVK_8K;E4PeTfb42xh-BW*0c=kN;bb~;#Bi}V
z;3I3boB9A68<X>e)J4Pp!bIk!egU2O$59{87o8()k}k#ic?>PT@r{I_=+i-1I91Fs
z34Qj>buK2hx>xDrp+xHmd%T!|vX2iJ8h#MWf3c3xXix*HtzsXtbD?<{ZSBiuBC3l|
zMSGnC0@>-WMJcxFc?i|)jg<JpfzD+-k=kN1W&>x~8I@P<N?&MjcC*=4rAfDj6HODx
zsx$@GoOHh;Lvx~V%=NlVy6uXawwi`k%HQ}z?NV$iIpg`9vr<bN8i%i_xHE&-nDT|a
z`ajw7a9;e!gUx)kF<0?jeS?{>TJIX0HQ}R}C#&S61}g?7nu5dj%eRoh?l5%@PpfAC
z;{TvrbdasM`1-j<^_$7Te%xpq5;6B$#q`0e5rfkL83qp7S9SCXdyzw$%U$%4bek2G
zymQ8;Z`3{CVZL<EdfGw1@Q1->e%zIr56|ZrOtjg3H#VppjqKr!e$%i(lrd5&bNl{@
znp1zYKG-0&vnRTv)69a;uY1&T&`q`fAUXd+-B@7HI#}V6);t7?meTgln|E?ED?^F4
zfRo3TT#+Uj{f-mE>O5vnAeN6+(ygY6-|Q}Sc+Q0e_FJH~nuZn3>-a@nb@wRC^3FWF
zRHA&}u8NQ|GnI5<!mAnB14wqw15rU+(7<0`XUjV$0eJx0=1=!e@8|g4aD;iH&*9U1
z?ur!-j#p}yWvi2oLH%6L!>X-fYZgO#wd8qT$?OSwLR3=ITkqjC+w&_)YctFUu<Z3w
z4C-EbY9f(nP~DyU<ye>N$q_t{gpQPQFNnJ9w&*Rh6sur%@7j}Q_Gmq~Vd5xT+-1A2
zR7%jPjIEH1)=oqb=bwjAMAC07#3EgEOxbo=T1(h_#Ff3JS7Z!`Wn0Nvzj~gaa=$0A
zcqY)2BFc;+Cl?P6HQMVorLq*u%IMJo+cr&PyObGMhyiB{7NoP7V~TflJ>dn&jiCFi
z_nHdN{EQLufp*b|_#Drx)a1^G3H)FSL5A#nGJ=fg)wg3#r$o0x3|ou(e>Ia@zrhYb
zh3Mkic+Qm;e9u`1OHav~E-hE>+4Y%Dx#|3u64)UL^-QTq+P-sWP<giJ+W{I~B2M&a
zxJ%5Q-CeLRg45idDi>sk*cX`|1lY>(QK`K14k1fNuR!?9Uu<9y|5)>Enn?4G6y=!D
zftj<6LF>RY`AcQO!p=dz$K!Abh-W07M|2GWJ*u4^(l*co+WjP2?86A2nw9a>b#0v(
zL+smFI_vC{yMn_;3ph<sQorQQF-vDT@6rN}7k1u+`B5YW#DLkT|38}Uy7Y1SqRZFB
zC>I{Q-Tbt?IlO%L<7NKku--_QY|e?cRkqihQ!7gb1Uk!4vw!&=^4omV>o?^&MIAft
zW!q53BjMJ5MJEj4#-3`a(`ZD*Ha5QA5S8k<*BVtOcoTP+O>z>46`q|XjNkHm$(iZ5
zaS(YH_N5ED)3&a;4>W7=j;=?%37U+&eTeQu5m89Nsv2WhSQx1?E7}?BB6~mc`rVn{
z79gBrN$Nu*TK5RmS&y}+*ClC#AhH+x;FR>LpMp`T7H~qS_sQ!TE8|fEf-$&8df(2n
z0S6v%RYQqmbyAMQ=1YCwEm|Ip=~_)`O21D3Zv99SCuFgBZK`+Ky`{Xioi<ntyzH>G
zIYBtrusN#F(3{d;(#E0dr7=4Z39w#zQeh4HFX@$<X^)rf?MbEd-mTy>@c@m6q|@My
zk@+}gsF7-CK6>=r@d^q93Ip}iJ2}zwx@GD8FMsip%tjvcaZf$Gi`J-!i{Jaw(a5TE
za!<OV%+6osOLishpABr*z9eZEl%9$W1DK-oczw!?K@Daf2K&)s!m3UFZJ%^<^nS%B
zGQ~@IU0-XJ1)OV2rAe>$><=H{%edn^^dSIn1LsN}HsJv+-gDqrt<}u*7Z<#i)E&~G
zul-)D5#cM&OXN%y^z##<#;-VPjxX`0R+S-WJjG=1OVYD3yq_^tuq}E`E>&!nO<<r@
zf1z1X;Fb|oJhM>OT8wZBqJF`|Ak!(N0+|$eMyecOw)YP=FgYA~v(?0kM6d+L1PVWf
zzM}snT}_$M$22J(a!uE|mK<j0I80PY2@!^w2EGKCye<G>sro}S;`zJB)!#WP!Xu0Y
zwlm(S-(UA8c)eG}OF=t?QGVABRF**9#&Rg9b!Rr7*xMT7dYh;+g7wrZ+tZt6;OCm`
z6B)kgwi^CbxO4tT0EqA@zSSYk=i^5bP0h|K;8aG(Ce|_gYFFnzJXaNE>MW0^GO}l~
zH5F<X8Q&;8M=8T5NOeW0{fzDso?uoTPwy6>e14M8;ziuGa=G+ssdR7JTD;uh=7NXz
z#h9m6Vx3{$?QuQq4%*d=d@MdSJxSE=+FAw5KsBaT>SgLD0S4YY$edHy6Ql}5Ue>z}
z;LjQyBA#27Nvf7y{@^UtmHy?{Dq(E#pwf@+{F-AB^l|(R^=)Nm>}XIJxlY<2bk<#0
zk8c!cZP483aX!Lh>mGT?c;(}fGizfwj-bUP--HPKM%b)aM!b<VJ0~x273H{?LW}SE
zrwM&elM_0N_m#}}5}g>OGODuYgNX2*;~4qoHovm?WAhuayDK73ZTicgHL7_1veZmw
zxszkOm!*b2Wfd;8jNzv>V1DX&ncu`K%Z<CcRAPwkn|?J}JzRePy1(snR4Usss0o4=
z4}p$7D980qYPP%3SmSK2`%G$Xu0|$yohxx|o?T(n@#B-A=oC1EG`R)4$kl$;)<jEo
zj>9~nW6dVa^%0ysluFm263bklNNR1)re@j7+>S)-%Zxa8<qJWRKO`q#a!OLW@fgk0
zU^<3<+6|W8;2nwPgsdqPh8z<>>lgRCE3BTpwcl6x`j?pv_Mj;02Nn_QJFV`+{WNBw
zEnV4VDW@&tN_v}BL%#9h>f7|V#tii<=CrpK=R2m{<JosTY1Pdn8&*eWMd&0IB6b7f
zmAz*430|CHVkNSjphmM!x%ZkqlDKSOMk&TV;yl*UrajuCDkXF+N_@uq`_TcjnO@EK
z%`qBuGwty<ohuFtn-a0WT-;YUTl4y)PpW;XRtbg4;dx++yC<R+e*ZmZO|ngMu&h0U
z9=RIs&G|}P0>_C@DrXU)n4+7XRPbf0$?3_JBE;)|sn&AXeQQ~$qRY#BlGvU-eVX#>
zGIS%S+h&(15&0hKqj9-z$=c*Kl~-jvll#eP8}8S8nFDxFkVSvHWv?#)drx4N>m@nS
z>rW!(N=nEsyiy~fT5K{?)Zgn0<nvM^LdrixHYx_df+H^*T2N_spw8u8wLLW6Z1w5w
zLlx06(_SKk6}v!n2*xUkuExhF3SDx+JbI$tPmaeZ!;Cm>yyP8xV=n0{MhB-ge7<##
zIVSZ}k7&f2>nWL%RHGUe?<XMenx>0VW~<c*d`H+n1)^o7x8vjE3OhNIvUmDF;Z3j$
zP%M~b-1~_{_K9}Ss2!UAPzzL4<=5A-7H<>Xfij$2h@cIcDwq=ADjh?q&4By}YAdVP
zEMQQ-9E;`H%%{7v#!W9KnTg`3!Z<M#9b;+Pul*L}^E;VD_m2=S#Wo*QfzSlc&yH+}
z+yoI%i99yG>45A#Egm94u@=S2Ii*Kih%_=^Mvddg=T+TPhu_t;o9O7If$VY_c~Ofa
z51crZ_955}-Te9IUoAO<nktCO>BJRPlWKOOQm&VazT&M(B2<%qeYi|V$52pm9!3Yo
z+NB{mY{w$LwN<_=oLcKof)Ro9y4QUHk%oK*yLjR3&6_tHuC37SN^6|rut^O65z^4~
zz@+|Ho$9875ma21PUDk6u=6L_{WPad1D^B>f8LsOxA|BFp}1vt7@I&tojTAt`e&zk
zr}Wf-TqZwKkz;iLXno2-lW-BsifVO$q1=C5)*O@Is5nBSurel{H{hVCJf`A3C)#l@
zf4*^t_fkyc{1{ZJuFKvkZ3)d6hXULZc|`serzJBzpQ8NrM}GFE8+CXKkl%Tq>8Ts%
zKsFhE;3VNX6f+=giO~BBY2p%$8C48b6#UbKlEuj#t8Hu6mtZ0h2MX$5=a{{qAE7iU
z|Iw$Z*PKzAIcFr-9-UcRyC|ya!-o#bx;~sWa7U81H)|!mH_W8YU$IS{;0p`W|J_!h
z?NghIbIDR5r%aa9py*$KcQK9azlxbTXpUq_A>@A5UrQBfVB7l=dWP&UqA35m11B_`
zOdTu2Y34L#9<N_E7^0ghn<{-b6h=6SmQu!!{5@zeB_)8#tes9Tsi8qpbglG`cZj>I
zuLiRc;>Y;rW@mG@N&;iAo{~vRE^(V8VGz59B0Yfoqwq)^9^$d^r@sPFK@;+Dq_)hc
z93(Eh^-?o}zObX3#BD_bU*mN$+AV)p<=x9K18Qz=1<<LH$)DW7%gg(k6AR7UIuROU
zP>RTX`t&vE#mdyr-_F!+jddOagF&gM7lojU>93@LWQ}C_yLac&$dpJQ#>(odfzcnK
zMxny3An6w2{Ja0^`dmZ>r^K~Pq}j-KrOt!|&9~d>LS$TjF4Dr@g!k`H*W;!8@&ur8
z7^>9Op}3qd636zVv5^Qp9a?H?w<n{Z-F;(bb0g%{KLzlRJ5!;RN1A;nFwhZG;yQ5$
zb1NmF8=u}Ny=e#y4%HjFCRlA%sg;E7SU)nKS~_X+up8_n$(sD+uVdFd9@%C=TN=xy
zyH97SmG^hT<rBGE(t~^%WuqNU{}MV*m9yc-2uSH!o#fxhFj~8{6`_I8W6RS&!YwTN
zLeb*x1tlkhF2vwP8(%qYJqtgCc402d?8tC!Q5HGYRTIKqxRv<a`qYMr=1~7lxDjMK
z#IyBY-JisU&CS_aj_qQ^*vRd8gCVgY=5Fl(`P+m5<1wfKy|G<r?9a3PNYS+GUxmlJ
zELBG*);jK_D^_v6lQzhJ{8k__X66(O4!22cg`X-h$>uWt6O?klHGKJI)=yHd+OwGo
z-WKF<>%MP)zPnvjT#2c%_=sc>1dZ{MZ<F(gqp9aaqMGC}-&a0<<EgFJ>9n0!iVtC1
z?hrzXb?Xo`rS`b`PkplPdxr(o)Y>u!>rbkZhNoW6Qszyah{uZK-4qK-5Zi4Gw1z>t
z|NeGALzY3s^2qrfse6wI=CP6X?3b@0fB%X1(g(^QQ6k44Fb*Y_&1EcCtUlmG)(s#U
zizGI@mR_`_G)e1#==>>6P~J{5WqHS$+6jS>AbuM0?cg1#J8qS)@Rsh$WRrBrp)T6|
zbeZ?%Lwku$hvYj;va_=z85wE;A})qB+X#fB;38eYvX2jP7S>}m?AGH?)phzbg5*_u
zpiNvzP0jJcpP={9pT2`n-@BvZK6RUkfgiY~7f@>C?K7-=F~#nC5?w2AX~c!>ot|+k
zoQN{ygzVq*7tbM<bFa?=)CRo%d8Yq#@I(CZE+sR>dc~gllQDl`C_#E^y%qWs658Ht
z{{UpJVUcear`BCVw$qC;ncLq-G4{$HM~(rykG6AqsQf2e?0}Lml)y$ujg@T4lv>|*
zw@#&>XH<E^)WfCMnOhlAlnwp%O4lL^C&=Azsu5pA=K7xu<ED1U0>=K&3giBS?6oDa
z(Z^dLZVYzd-1hcmG}<gz1v;MmS@+@XBy%gaFDz{0r*$&Hyz=_|5gH^}1SzKM$+hKp
zn|zlOYld6Q&JP2j3^kFx#%jn()wRkU?^FLgYo^<G%*ODSvYl(!8}HTui}LS#vUDJ!
z%wU1l$t-}J*!I+|-dlG^@LVy`c(0s36jn4T@JJ4$2hS@QE;8Hcvu4jLrS3Lls`=cQ
z-gB9QPaD!hIuU;%a}p18yyT3Q@YFzho=zHYX?}*gl#aVZ)6&wK%wnKbofo;ErVwG8
z-=xyqOY62Hn-k-4r1djW8SakmX@-{1F-r?IZ`&A(uI)anngS&gE#*kSZL#Z6&#!J(
z(Ai05kn7nEw;XL1_E%EiezZ&1qF3g}yy*kriWBJ0IEgMHXO+5+MZ4=8IY*B&bY%%y
z?L_I>LKOc^RlLRLIFf|L^T^$g$7zH1o+Uj%1iIsa4{P`G6G*4O=46#zc)RF3cOQcF
zrWnsk%mfs}xUOE9Z)`kXXQC_HY3bE(+0rWF<xk*3<V+^>4qd6@Nr@64xXMQGnkaZt
zBR=S71zFxL9!QRwLY;VB5~qC>$|vTK@`+zON@c#(1jrZNne2n?T~hA0UnTqil}h(W
zPWKEiZygB?gYLNNz`hnTzq^#YqgDV^4=5W=`~1qA8C*JmP#V>*aN)5Lm$QqDz%e$v
zj@+9a9UUxUt|`#eF`);2FulI3cIalfpNZ$4fsRfRw90cs9~-nfAzdzTZ2=)(jxn1u
z*;A@3?mn#r4MJ;cYlopNP6|uaD$0V6Hn?^rHtu==srtA>t0f+r^z)~Za-<L%rz8w*
zd(g0~2;Jd`9e_?*wTV2J-mE_8bJr|0D7e=IEw_P0phmjmCiJ#<mSEDsC{W<`igd6Y
z&!0Y3gZ}=Ju`%6&lC!EYt<aR4Jvev=0+4uo35J{m-MhMP0@zTF6uMw`!2*Lk@_WeT
zWxW?^eS+llfTYnIb1vwS8Png&b{YIox&$x7vAr)po#W?k8~pZyOIvd8oVd6Fv}eKf
zD`}1y2?;mgcibmhd87qXLE-tVn23ljyv3BI3$%$a_DZcviOI+~pO}y^o>e;C%<A5K
zs>_f0C;$2LaN|<s>C>l?#vC4a2q$FUeFc5V2H6EP0XFqPTY8@9mp%0CQr&x_(p=WT
zdA6;3v=4MIG$dWlFJ0bXWe6A?8q(I%x@+?~JUq#7bF~j?i?6Dx3N+iK5-X6$hcJ42
zZ{RG$aJctbMx~^j8aBb{<0!THNFiH$B(1o4`Jk-7>vCl>sW~cNe{0K?1c2`HaMUs0
z)1pjFOhzr%WDN}sq}PX|{T8%^LoXOIc8_x%pX|#y{N`HCUUO))G7G!{jf@0n>dc2v
zF>sVs@(IxY1BiqdIzPeJ)rRhLxY}T1*~q;o5qk8X5Pf6W40`>~adCay`-sz;m}L}Z
z><9gp3TX62+0)8VmzAM8Rj^GOgj)omsl_9?n1K-Q1RbCra^XWDm4}yCu!^IR93C1v
z9;R!ouA>t!wf6fu{qf5gZPEZuTZPMMGBc2#7I?J^X51ehSe_k{^?-UIH)Wy((piPv
z%y!~LMt}cpWJ2KRFwUvoG6S%dgAD3y*adY>dALR@Gl0!Y9*3NlS6Q{HA5{~kP;x6R
ztCDARzcM;B!~up&^T2C7ULaNCD>SSrClWU&RQ-6+5YFh~nppx=Q|&@IAv!!ZmJBx}
z{OId50sI3kSV=5v>+1yQE{ul}*pVfKNKvg4Th_PN45$HWafb)s{)o#-x^?ySaNQP3
zxKw8hl-?w{HT8AE{()!SJ?sbqG<duy(&zJ0Jzb=?!O0~+yLYj86?%!Q=YQ)s1Te6s
zeJW1|h@^n?TAH51bQVLCvH~ucO_B!<m&#ncmIw@s2IC}aAT2FTf!?!bO5_&V;729F
zl&<uJ1a&+fx$CXmrx<AktE{Y~YxzRh<>$9aw+h?jL&NoIuQ{W|Ftt|}zjK6Wb(nw^
zfLrYXiExWmx-<4<qq?NMudgo?)zy14rzY*w#*f!$)BkeqHhtrrnOJ+*($cp5gDLPh
z(s+x^0J0;w*lq@`iJCLLWx}^BQB{b$vGvM2wS$u}#&+t2l#d=aH#gGa2<=~brwohr
zd#UpjN|>wZ4OM82cgle7IPJxyslvX<9SMr5JciDt@5m;k&S|yt=g%v_HCbT=FP=WV
zPymgVOl)jftm1A~<hD%cjn%fd&$@iCJ@&(g3&@o+`b+<u2#TMP1{V;{XTZ|+_ZcNM
z&~mxCxeMJcjS~~e`0|VcKU@}qMS5i?i=dg5xhnGaZ^xnbos1HWw`kOrizbqyY$mBj
zC9dkg#BdVWTegb3X=%v~;xnz$?!Bq6&#ID;UT@GRAi2<W$bVB#jz|*xXY$xnx9JlU
z+V5SKocqpEEhd57bOy!XsmcJ?IYAkJtXe5`pUKMI9I6S?ZFgV(J)qE4O5BrMOEB(Z
zEjPb=*U*Xm^XJb<1MhSRnIGK@TH`$S%s*sp)!ikp{d;z{sYO*94z#wmxi*YfxdxhU
zdC<tU5z4EI3JUzkLQh<AtUN3aSnlZhjhi<ipQHquhZ7CoOFM9T3iN-Y<kGu>dmYZo
z)0-MZ_bVr~jr%@g;U*EzFx5u)x#1slQ*iN0f_Yu|F<UOUgU1H0(=%SR?<+6kBrNAW
z_-8q>Cp6oQ9)Jo54HFOTk>~jMl;Pf%>cjWooI*K4KTQ;m#r$8yy?0QP?bq*%`dA)R
z{8_M2Rj>dGiXe&<6$L|=DkY#IH53s-Z#H;TYNRMguOSraohUqlf`C9m=!o=$A~lcz
zIqL@BclO?A&z$qeo^zaWMj`dS?rUAEeLt%m_VglX3$1GX_s-Gjx%mU(;fD|~+pm9L
zF<{FA*W^BrQ^0wgg!|khgj+(AgQW*On?y4(I_4!SSX5&oSSUrNpC6kUsiV6HgY3vf
z02e|C1~;!ZtQA7U@mXU`AV?0luP!_EXTkjmhE5kO)?2|oulXi;Z$!ggy)w#;{2Y{x
zIzSG(IA;alw`gg@r$oM3!U>2YcYr*yV!B*~`?Bp1u=b>CZ%^2CNDvMCKVuy%IC3zE
z5m)mC5o4htzgB3`5{I^qpVqWlnH#CAMxLCk7=&xGxP<mZATdDb10^25s)C<>HW7oJ
zL7oCua&nP@yds?7v)vX2)^ME_$012Q))ED6z##M&hV2d~6mn(Z?5cBr@Zf<5?9M<>
z`uzMQhNHZzMs2`8DfE8}9ub{P#7-VayuWYgbsvl6x^N$&YCv`U0HtX-w0ZUR8Y35@
zj$||K)3<f&*1!v2T3R#^W{7&63?6=qTvu?pOmYEfg+N>2m>wA(2AQzFRG;(PXV0ID
z6i#&&q&o(^Da$o|56lv4pq_E2`S0Gn`x4p|S5sSCWio)y9mDpvkl`D(rJ%R~bEY0E
zomx|KbNh}RnXr^5w4$CV<dVQi7R+<?B(R@gAHRI@;@!>5|8;X|7VHX5QGOoUXpQ9Y
z9|->VGG%u;#yTFZ3uV4?c6K%_B&6jO23s;e`io}zy`?3$4f`_FbB!uP`1$jv4Sgtw
zfGD}`p)bLYret7^SO0M31j?p0KNW<dn@w<R$034Y6?rpV06nLO19aWEaF0Dmz;TBT
z97r;$@;Js+QBf&!pSOS;c&)Sr(_dKzyc*}G8KF(gM1&ytI_SCTECewL))|EZk*$cG
zepdl8ZibglQx*sg?>${aWU&DZ#eJGOxkfo>ZM&jY@YM`qQz#51^qk*k3!f{I$r?L@
zOBs+^%Tf${omUvgICtT~ohs&Sf|=WkP5oyn2gI>^jlrA&KPfyq+Gessr}HB)5&>>>
zM?8R6DVV1fWXOROQ2T<r7ooGB8pXV4YddMa{SIJpB2t9Y@7td3ZMkszbXo)3gbl2r
z5^$GV|9y2ZcLK}CMxJN!`Klh9IMNYfT;dWW2rBoqiKqB|XgyPwF+I50Ry|TMd%eCQ
za_5~4*}*0CjV9$y{~wx-61MadTE7+gjn6@NVh9m+*jYLVn*+`{9u2!}|8ej2m9aV>
z2ihy$I^aYKK$AeG7!Xby!c?Q?0O=<J7zrQ~6f^Xof3;EGrx%)XxUV+s^6S5sr+V<=
znS)!&+AH-TnELu2=$KA1Vl3$1N^jO*Fd@c&7{>a}kNW7#;E=4&^)+ZMB|QUTkqvk(
zTykEeaDr!x)+6K=5TSp7yRT`Nji@=`LKXcAeOW$c5@8kcC19|Q*2`>5neMAl5#ARM
zJi=V~(H)#(Fb^J}OOp1+>q-cmRMi{q4}1;D4!r8_QpaQjp#Zkx<HwJ}#J|1)z!azq
z5>S3>FA@f`lnH1ZEBF`)G6QltWTLOHfP@nrcnLxiHRIXfPfWm3&UMKmaDS3JxElz3
z!lL=Z#Nsj;j&j6_7M#Cxfxc!7zCJAQUEt{=IUJeY^r}*&l(KjhXv~+N{LOYQe|1qm
zXzGiKiS{EM4LFue9J216Mm6*n7_IH>_t2%>V*xv5phUk<z|*Q%_MonwVWxbuuR8dF
z6eKV3RZR+o8)Z#fqqN|}lAQOAzp!|>EANACfE?p7VadWL^YD2io8b^ef&<a2OLW%t
zW5sDyIei_f(lw$JH99^ss{%J<lRQk?*`|Js8Q=s>2P`NltOht^*Cbq?eR%n@PL9r$
zWoh_UPtuwDT4aF|{6Ij-dekh0kXlc4$P_u#lNc|*?B^fElUmjyqfcl-T1h??-S+#-
zSYY}G_@K9;4i+ic2gGW<D06XO%p%ftKr(RF#AgD~q`q@~vY;g}^egXmU>*pcIPqCx
zYaOq}U)#3}0rLp9AsA!vMH)vci0Mz8nhvlhCxfurQnhasc(1@BVowCb2L-T-RXY?M
zh-<|VQr;)ol=K8)^Z;@ccM)A%HC2|QX<?Ce7Xy)$B<yzqzgJ+2Kyxi&-6n|2)N};^
z44|su#>XsFVWndg)qoBF_t=vWWf1)9m&OCjqH3-|B+b*2Uqe}0>*2$bkTbaVX!=r%
zHT<0jZ@2dP%-@}+7Gz?^s;=tJziMD~`HV;=<-Et-E0$!<8!5eWm!1(2&!&BBZE|cM
zx3AQPC(=Q8?`r#8R?~9-_&Z=Mo;)~d+g=2_Rj>Y^T~)=lx~V7Hs=sS2&iy(PwB9?|
zI-n;i_3RL2STx$XMIzCyIzCZPK-%!-_HA6s60dZJ)j(AK<w3O}NOteYggn?RPt+IU
z6WynSAH$BUuZ{S$z)N>bXs0iv-xfo=`0{&~7U{(!`_8Ys9he|~j3iL1B6gRtNL%bQ
z3$gC6bO-M<c0V8aHtfmjB+XB7lDK%T9JvZjyVWUkcdyt(7y&}VhBSaR-~z9I;pGCO
zdTh!P$Oq<)qF%>_Ibs0C$_cR8Nexw11U+*qBKOVku~EQ4)|QS!@Fzl&0f3oZU%4(^
zalm<qcYAbr=K<B^C}kJG5P)nN=mF$`k;M;SohBlU>@QNoQn0j+V?BU&jcc`p)F@n4
z1c%kmr9*iQpu?JEz$qfZ&*jS<ZoWudz4w^-zYD7fj^W>bZvhyO5lz|2mJxkT1~zKi
z{!{4ke&b|{J1i7=(zJ!V{P)2iZ^Uj2T7UhxzpnbbY(>!2KCR2#J+48_SArArEM*d`
z6!dRUr8MLTWR@Fcml%hoC9Pl^v&uvsc7wqs-xDY<`3Fh+_W<@pK!$pBe<JMfOAJr5
zFXAHrnn-RrAyBnCV<GSB3pqJLYc=7Qd;FHCPYug$icE}(m8+Obm*V=!y@YF_ADG{r
z3@e8vLzrrB0k<HOu08KdFGTkHRO2eiImeU5aP2rcb$~(?L3O{)You*BLpi39RLr>v
z?(6J`?~^C_<PlOPfJDE7`95(MY&x(_&P_i?;otyIvS<=jW&Sc@Ss~O_pv^VM$zlpa
zf`j#dT?AJ?6#?N&NRT9SKa5G(PJc27Kd0`_abI6wa|;UqJOY*aJ#{ZE6|jd-;=Pnh
zAf>G=%rC3cb?6DOo%J6+OhR5U@B`O1mn;ND@q6NzldKXqAksqNh{@9nzs3W&rMhT!
zprZk>Xhzbv1@41DJ0O|>m&OXX6&~Y>0i;4}Z2{Fi`}Rq77uoeJMXToRWGfXnPfhh0
zEz#i0O<%R`=2W|;7jeX7^-YbyBvt;mp10%hKjLleh2~EAqjK{f?58{WtV&j@)avfM
z3*ugf?wL;OWB*CWZ__eMY3p>9Z~f=)MO;JeZhA&kwo$)67~}S$0**-vMl34i*+gGS
zywAn?i$m`$?~m|R9cslFEIpdU6@1iW(#^TFr_kBZ*@TEGaLD;aXdUwu0t43#br`_K
z6xvQ;nKri+7fHyyMHgoNxUs#&#;#Inn|+m9Sov?hGI|t0_al#~bLU8rP2V`1k&xu^
z8l*QxwG}vmWB{?&a<u6Qz-!HTla1`lZfmXViUQ&^BzD@}rzd7^Dkvb1&{St$?Yrvp
zOrmyyu~+jKz*1P+4tUMK94L>2m_(>@_QT<3r}9c_aGIk=5yEaNsB3UjpP>}n8JYEr
zJb`jV%dTq3ov4m=O)aVP)5!?x4+zVU4T*@3&IEQhkVY{7{<A;&!h@~aq%GHZT^lAy
z3p;0|(k@pVZZAe@F_(A)r}*y5Muf##R2ECxX9>y2q=D&chi}DL>`ez;i>+$zWxF~7
z+#@bDX(egDR;^-i8~oM~{1&0(xJQ2-!yTF*x|k+3-KOnoeC4w3<Co>GUaMjIb<lXo
zD}wEltPy~1^JR6pnaj71Jo2P0d|}3SVrZ%-kp7_a>s`qu*CjBTYAuy&JucE<>WiA~
z$e9s(tRZwCOMXP4*@HfnerA2Z!RA~qk`BBt3my;`faez=%rVAV6$0vc1Mt}sCfMgX
z;0=)n@z;C>oZPn8csR_el6}@1d{v}?6$m95@E~F?zJ{y9ZR%z_P>lvk4M=t8&i)kl
z@stKmR3`^OWjn3{1F5cfjBy80ewP$4pb@eS@UZ@1$TB6Bzd99?zZ8MP&fRllz~TP=
zpAl92qpYbUJi_qETYBqx$N-?=U`R!H?VO?JWL92NJ`K3Tx~06@`XYO>r#^WAU$c9r
zXV5mF|K2)-lTL;v+GVW+pHiz92mz#($Z-)lV#e>9uZ_?|++8TW{+d}{N+hh!CzOL&
zV;mBuHs@u4mTFg-UF6&|r4T68A$RSgX|Tf1AhWww4ZdN+z)Zck)c3e{Z-fc0XMRj%
za`&!1;c)l+x=kDONslk>rk#tGHZPntuCLb)9tthC>w9vW?ma$#&a6oQFCzni9+5zv
zpozLLNJ3`k&*Clm>GZd63x|e6AZ)!hHp(Zf*Ecb18^j%>=v8FZm0zdmhirlj?p>id
zmptjyl4+xJ#@wS1!BJ-{v^R|L?}O9@1m?DvjUvYMutEO6014><ekvA_I)rIVOPs9U
zK=1>|?CE2xJ$VIzg$!V`W674?B@SW}HFtPiKf)V(o{3;xo|<ow7Xv=_Xq;hAd3)*N
z%)kJ`7pXhs27V%Ve>(6sLO(NKkDX0@bKaz~^WD;UaFT&D1b}(#A|-bB9cV3gD+Epl
z<g0e4FdY%han#6Q7aVqyo=di{Ng>_)<tPeaxN>1s(OC%zpN^Wl$X=b2Np5deknD(u
z>)2e=?VfuaX+Lx8NM|ff9z$t?f=F`K?lkcyb$fjVKgV>=`}nelmWi)p;m9zG@#VX<
zNJV1??_yslbq0l6(sP`>mj^!8IXw!zb_XX|pZGitPnA*F4UFs9rCt7MtG3aKLF;)J
zGe^G2uibEpcUQ+r%qb-Y3AJ0uEtOL6OxSN{1*WL|M__mLwWY^D^zlkh9SjqM&7cFD
zR6K10IlZQuR&{(07uq=K6J<V;Ml;oG3q9$+mJ?OTUdr%<)e-;?z++`3Du@E{E&_Hg
zoPyLPVX_5cZ3MpwnF`e#xUsUo?u@Vo`5;Jz>gZH&nKnSRs(xLthJapQlA3-Rt<H=1
zau;95c=qvqtK`55n#CSR)mgSX_3_fjQy`o8eo3Vb@#=HYqWUi<40@SJM7)TDZGw=$
zVDbd@)tNY?6s)Nk+L3GOOK$lpt9%AZuv+fdN3ODu(Q=8^lZ#Jb+yX{*YRp8z8n$N?
zI;MRB$*xn(BGg(-z^EdK=P(_)1K;dR2nqol2+JN$r%He8>HUU~!XN^bI*0MT!ykTk
zY)1QD05^GNDT6?rv1)dl>Nb(Hdl>Nh@m@aZ)z?h+J$tn1e0Lc=zP?WU{hWMFt!MsL
zflj+x+AOqYW0|Bbn_p(@my-T;-!DBC$gbW_3f(zYoiL=7<K@v(S<5lCRw~oG%bGtY
z?zy6|u58>IdMbV=ne*t;6!Zih(6to~@<Ci{X6<Lg;L0FAV84dCc+FGrQA!jQpO-3S
z8rx2SGaJO&7+$)LPA;yfA28#gFD~lBLWYOMr4d=!h#kGscc3`lw$rFzs@s$M_Mz^y
zpquvP-z3!f`-W!j!nuf@eaAlYJiMu#Ha*Mu^+v!0vuFx_9i^QXDTfqWa>h-(y<_m+
z0l|?0igAWJ{yMs)8%M0nz+xz81!UEj;_}%aeRQzya`Y`F{b|!-AY#glxHy*uJJh75
z!p$26_Y&J8|CToFBS;vgQDFXpR5o4fSc}-I#%3-8To2%isWnE4QIz<-Q|kGBd#OEy
zc?cIJfd(1GB}si<o6=w9sn6ga(R&B5NkD%IPr8Qu1r)zlK$u3rERw?cRT=l3=fm!C
zkN6UYNBKA<APs6}3SJLH0y<EX&uS4sAq+=IJV7?c#@G|UlhKzfgJCR63glOjuot*q
z2t6@n_XF}!h`cBSC&Efcbd_L;1>goZULz4OlLFw%fNelh&~J{2RcFb~ln!wW`M?|#
zOyHezW8_7^H=>xmdiBbL?mE-o_wMoqA)#-(274i(1m1|ZFr7;eyd!0Gbv^hnJ2-gU
zbXy88mu*V{NXP5Ro|R0d)6P3jZ+xb5%l^z{K*4I2UU6atx~930G)EG?;t|1w^sxF%
z7a<l-VrE_=qG-_+5mG>RZ1nHmC)<nnN;UVz6e=<=6IJ|lLY8;#Xq3OOoXL2+Q*Qm~
zXKEXh>f<BJB)pQ}mr2VevYI-Z?`T|794p-j^N-myqFH-Gdmm_Czn_3OS)|c8)+=2_
zk7$S;Ic)&{x?k5~Zku-CW2&phn%>_ttJ>$cZ4K0<j(ib|PIG~SL_+b@_U*u7sIx)R
z1S_;$WgH|5bHD9V4a;^k>zkLSbI~}b`XhY4Y-vlC6N%G4>X9Q7F?CV*1l%Wn{)tGN
zkq2Z{1KE%~aikz5-7->AhH+y%cJAb6fpdv~g`paOaM@8>dU|?AjL+MrF9-q572%`B
zx&8VZB8nzzzD?{{`AseNPeb1>Y0eq5GJrB~Sm~B`F+Uv!k06JA8XyUQq=*`M5ZX9`
z>$8`VBj5tVG@tL-3n5|BAMi3PHDs1S@pqN$YQ9CaOq`5+{zZ1A`2zy<4S+6$mB~#2
zArvLFz|0rOxqN=-lADll9YH#)ekY%2pm~w=rP%hpqsH`a@GnF}MVlp}Z6F}4V-ER<
z`E@_GHI3d>QH)Q!i-~}o0~S&Le$V6E!92O~GR$(XwMHfBv`V=FXM2+lK0@QpoWJRX
zc34!S9~(CCp9>}-y!3<GzmKCJ$B<d{iq(-^5O<-QgZrxTo2bgPl=D56>NmzLFunH*
zd}Z~uR-B(YtWWJlwZ$K<N}=elH66Wu@IOa0W)GgGzC6OxGWVst1$$%DIQq!0>q8de
z@HvdiJYbJVnZp8aV|^yB<Ll>bl20Btt>XfiYY?WWT$5k92a65KBSKu?CnuYm8(V&x
zKxodvfPMUWkZ!$bhepa)Km>+#>%!~w_ppvg8W?`X!6%c!C+l&~JBD%!N;^o_6QRmO
zO$5pXu+FD>A%{+F6SZDnT}j)2JE|uK7Lv1LZg$uNQy+s|aX^Nur?<ab%E@<v-8_sf
zM8l9I$O791ekgNmsQB^Yhcb<jY2Pw$3S%cAhLf~zyA{M@etB2o0|7F6a20|g&pwBe
z9$@L+SA8&6T~Dn%LdI8Q7Q;vd@s1BruhG7K{rbzXQJ=_u#q=$d?tXfMZ$)*_?+Ovs
zyJt|)<E!T8^YRHjomQtla>8Xjv8tQ3?tw^51gltvD_oco^>w8GR~ct~JH61ecHn=f
zO-gq^^bJu3ffm$0c2y<z%7;`lW*hRzgK@;)Bi4hhJV;OWh<C9OsEKOI7xnIpoyBs)
z{2aA}G~50qR8e=(QBJeK!}x|?%Q(UX_AfovnQ*GM=@P`;vm>``;c{)c6;xrFM47NY
zB{ZBCQ`v9EdRpSq$IthG0?%mA9g{<!D9qdkCf;fmN0Go-tdR1Kgh<mM;QhUeDVhD?
zJKB{7`@F&6UPc*fM!ybQwbInyLWMMvh~<MsMGn3UNSxXh$ps+mPpxLqO^p{xkhK>?
zFXI@H#utC~nqZLr71G>L)Pu7|Y*(nwr$wIA2B#8s_!xEeMBSB~FkJL4qn#m_(6;qE
zA9D@>xga9(8c9@5f9)%^!YGkY({>#l)(3<4u+qgrN#mU;US`sOxu8%t3x-ixCelpx
zCB?G$In{}NXlVJ5#%xJ;r{2*KsJpDM_=65><gSJvyzp82b$^bORqdfTkJ~<<Pw2@j
zCp6<Hh#E9Apz$6fYa^S-H^;O7=+ncnKbSs@1aPCqB#G;2*N`Z|wY6NrFvNHt!;&TD
z^XetnJ~M-?clSZs_--3fiuzc+*kf@zncHEwMINq3LUjg_Mb-_0jtppFQ^Ao6ELV)j
zkm?MPNJMJSP!WLKr3h6DsdGCwo-ct7u^4Rm4q!q^K4ha~?Jye&ZiCtdRE-GIj1N8e
zT#Mr~he*xSSP5JVsDS!9g|r-+%Jgvy^ASdYX48_eX@6S%(6AH&F#+O_)<*1(02M+-
zN3Pab&qLuCa`A$dNr<>B=Bp3;F4}RFu-tnGC?9`*Yw3&feUIVF{)<ijq<Cif$z%^3
z$c^E%3Q3szdgNUfHORbQM!}|Z9=$s1J|)TO9WPn~gYsx`2yq@C@BO%=4g0BT=`PV{
z4aP5kRI1CCOFYGEdLGgUrY`Y-Fohm^ag%@-zhj<JpgN-srP?6+KDM7|ff%)9zO`7v
zZ@R-ezh?N`8%$U4Vd6dRAdANyGHR^n3*Sp{;!I1meV`R|*%Lruqzno+7+!Na8~->5
zj!2(_X?S$Y7RAzG`y;KsrPd^^gZ!p@LHvf&8qE99m~)UV^WlgUfg#g|G%#EzFXuj$
zhBE5+ch&aeKN8c-fIyB^o5G<X0E~?;m-;!F7u2b)qH>9Mo=&F#Z}?F`S5~zy8=D{s
zq+wQ6469={O9RoWG{}bD<!j*C5CbCGL;Kp9%iFI+tRPXqNc(rmxjEOqprt$JGpb>i
zX70Q+gAcBMbY<9{Qf>KVJB_=`7G(cD8B(C<A%|>sDE@p6UA&HQm@%lv1LT>EsX$6r
zZAGD?96?Y`MEXWxhQ{JVd%*8qpp%oBoz(?(1R{0>6hNA`yXjeQ5*EKqPemCEd~2s%
zjYr{bIxNZQ5_}0Uf{4;em}ma*fwG=dIA3UtKOKvU+qY=(LQP)U%yVU~fuh|B8JpBC
zS`fLCp%?rUC+1Os5PU|E9uayz=6TS&;t|<OF$+6;io*4TGae^cREdwJ49VNN)N+y!
zb)N3McjTKVu_@cf7J3ccplL~Z#Muz77_0esE`@yR9=Nw`M48<rvw;Zj^dxOdkU}qp
z`ZkW*Ji>Gm*x&*@fNm8XC^c{3_A?9n5G?j)6%B^77@(nAr9a~Jicmvxv<G|qWp&1@
zN^;D^EITnX?X{D}-6-D+?X=lTXNWi*zFoQjxxRjI;DYoleM9Sh7s6AqrI{uYv4co}
zhB#<0JtHGEL(z-UJoCc8s5N%TCuv$X3B-2S_c~6>Cx!35wtzJOhG+sGhL<a4&~<NU
zmFG@^O5R^^)r!sPIZ#?~+==j_1yN99P*zcChx`p3JA#D99c({ed#y}x*r8|7pxQup
z^A)rq6qhlyWzf{=>ZZ)ef{DF8xJnH;S4_PauLO0kMt{{FZz?(KY5BUkvnm#P;ryi2
zpsD6>!hoitA(iav?{Nm2@=Q$Upkv{U-sGCLFj|T0dLP~Ho4cJC=FO5N4+ys<*i6Sb
z&z|r}E~ihYT%>cfZ}3I6vTZtta;YByonqJd@dnPBf_ByIf{`mAwu0I))UEHKrQyn^
zs6CQL;b3EhFOO9fgD?91p66Lm8G>Y35EbOxNwU%gU3;hf0Q0h$=fEfyQDc!rXA1go
zDboUVx&%enir#I<(rDonZ)IQRK)lt^Gt+On&JEQ1zu7ob(x-p0)*nVgvZEYIY?81M
zRU1vb-~Zkf6&@CuX`Wl1B_85?WNWF9m;O?0$GJ7B!TmOU>wyY}1q%a=oJkPo;&lVB
zXC?#0`V<QBDq#Ep!4^}}Gcq%i3jwJ&V<KHQSPyVWInc6a-K(8D4x(pau>L0T(*FhJ
z0By`}*pwH$_c12Unf1V;{6ScFmp*w~zNcJ4%H?%9uqQwddJ$2qZs_YeI(&sdP{hj+
z>>3w=>jA2<480&kEDHZ&4;k5bpCr~}EGS@ap9vNL%_GQ#g;VDHB7)<<PEzWW_<a(d
z8^j;WjoBWMIsZ<`=J25;eu;-uG5(YPEB$3>fm}QCZ~#JmESF)6vZg38otJ;U6jF{U
zJgfWjQ@hQiX&V0povo7N%$bz7lQHb_)`|1!jb`DsJ428MlV+CuFYyY?>tRXY;0dA>
z{P*BHZidLO&xWXtf$Uv&ZZ}73=RkD|M6jn&04oRwxffy;c6pstTE9gXbtBvycY@Fs
zuGLQXxv42{H+^7f2+<&;aPW1l+J6lk^}Y?7&v+S6cj7D7TT4^@;ji&W7eP47ja)Sy
zw{uEi0=`Ldt{Qoai(A=#B!I|uJho&&+@!>cavSN*v$x_@bo&cwxdTRqc5b{J9)LDS
znFH?3^A?U<axMW3Ouwz$t_~B=P1L2myD4dna(fX?f3B$YHqzXNSNkmdTyp75c3+x<
zO0yB#B>TZ%TD*%3?HZ<f%m=mp*3dgsM}sydC<U3e7UhltA}>b|l=18nB!${EmfpY>
zjd#J4i<m^vaGA7V;C$J+p0A!d5O=A&9P!8PYwM^$fAPjz#oJFFGO#v9oV%nms#38t
z_^_rlqZwu@L+xFf)0cD*Xear7<fwD@fb-vl^MeG-GjRj3llTmvJb3u0@M6TkQ6{^3
zoaRPD@HS1gboSS(x!ZQeoxV~d3EycXzG#SMbd0Iac?h&6q2yFDJJRc`c}6n7OY~Ye
z-iCU`)i;V-P~P4Gl0scL<(@(7&$-Ab&j-TE2nYxOAOw}0yyTSk@zC^`)Nbk{ieD`N
z(vz`#b+gEYVsHCZz2Y>0Lm%MUWz;@1;xtquyg~(~nEac)r>>t&Mi31UzTbRn(FEP!
z*bfNJ$CK5s3XF}%FS%B{EU|xE-S;v?zpI=6Q4NjY+L+BYRyMXD$Cq~$mNP(3vR8d*
z6na$e|6yTlyyE|_voto_dEqh^K%Q*eK_t>$HWDliV4d2lL9Id9*kN!^v9V!yA-HB(
zzPJewCwimJ03d70r;wh}471HInh<9_J(dny7P1XDSBK&Thzw~Lzs~yyr?vP4;4qj%
zL}udW|A&E1O{A);Afg=jQ@P3H^Yh4%Ztq0&C-At2%~tvAvRM4Y#JlQ^9%l3ZdcShg
zg0rgWMw7MpW<#~6hOT4~FQ{_hxf$%6{m&#bS%(R4119pb>wkK&J<ez163%Wi%dd0(
zc|E?}dof57zFkh<m!+IujC?t^O-L3SwdzL6zU(<k<VVJVn{C+CvN!1jM708cqW<(%
zFG4lR<<Do5-gw;{r<YyKz$w2DDFd{66&89Y>z0C~{6UxWxU09l<Ine`ZnR+U;2*H4
zTLQI!A(|ue+k91dp50DDBfcc~YJT7!G1LG3N&cU>6@sP^yv)0T0fct;@+uQS+RS#(
z%ie0bI%kju!tZ0b3iiLQ4lxb_n`fDS<69`3Z4A}L2Ke6p_{`oW`PmRi^@G(2WWd!x
zr|>&+>gP8O>cb6r)<v_@<7t=Y_U$Py&+-@>o;B-UT~Z#x!cN`3ef|Tj0&qAZS2!kq
zj>Q|Gm4n!A$jX?0L+?di$qP*}Oo9_7=k++L3&<*sApSjvpaO(YAc{uV8}FC4d}2Aw
z^baLv&dUcAv6>&k8xsWG6rNTde|?h6=6zbqh+cG5Q`2<LNLo>k1(Rl9JZc}=XDg+m
zrcEhU&F)Y;a;QLj?q<?IY0uoZDGz1(MYRs_ODF~VZ4tKgqs-5a&%SdS{ctJ%(#da?
zD_+$gTtlqJ{U`I@ZzX)YO$9k!PuQU^pqr$ZLQU_KRvP|ggys_*NlzCNku*?pwYxY)
zT&YIsMU57#$6iUS%u0@sJ~I?h)g6UP=^L<<nBtdukVGzd-Z&0r3quLt9Nd8t<JB*k
zge=1qC=YOr?+aOdb^LGXA!p$;-o!SdMq7yI+Y#<g#q+f%N7^fkCi?;P=xUJdZ5f^7
z^x*DYAA7tvn_nAyL2QHEV`UuaTwx;DWl`TN_dK-11ScBQ<L0dH<@OG#^T{XoDx`<U
z_!#OhcMV&$Uv~+ZdWJ2{@m|l%S=-A+e(Srl#k6W)MXp+K!VX-Dz(D*Dd{RN0_Xye3
zdFC5?A9wGD7XQNR5+;r2&r&x%$BN3E8P7SNTEku%1wRR%PTt)KU(#C$b;LV%Kap2~
ze)oK2d{p|8beU{O1Oad`2C6vW{ca<tZr@t^;XQN)Zs>E5>n3z+cCs{|^yX`|*cn_j
z#XX|CSPk!<&y>9*jZM;|4R{*F?&Q$^q>Ik-A+WKHeS@#r6LmO*pT65ZA&$<7^vt4_
z`h;8#RjO@!`eXgY%~Wqk<1-<#=jXkMKX<%7I)%2lGg9sn6=ssg_N|Dxj9qKkn`BJi
z|Km&hp~JC+vQ?+Ia^JP}x`kG@OKHCON0H15@KXl<V?*fMw`RatyN~||v!fv$PyDsM
z7H8deq%>ZnvQl!qgq~@a4)c_>2=4BlnD4Rl45uUgW8ISx#I+(Fr1$r<gM$M><@pzv
z>0YEE&Fq?x;~P2Fq;{X%{CT}7e;enz3DVdle#&6@EtFRLH9oyJ9Q$qV6K~cRgp5B{
zPSWb|Nvf%|&5m7rX79Cdid@nqI;Sf#J+{p=f-z;d{q{oSu24Uf(L19pI6<-a(>9Oj
zm0t;4zT~&53(4X$+D<ea8#74F7Sp75|MD#;epTF<9uY8EeR;(EgI@Df?S@{Tn+DeD
z3yWFj(9HBSUFsal_yeK;AWx<Pp|fnASB8ALJ7?S9FO}WS7*S+93Q1+mgX|FzF3Njj
zNZS8et$U-jN&m3nKYsi{J)l{ilAg{TqM)DvG%2=ot;O2<eQW;?gclE8GoRLIPbAF*
z6@}f;PJ5b75>9!(_1QDd-m(fVx4Gw&BR`VNMP3%qBqX>@kxnI5$hgO2idy8EI$Z_^
zbuQ3X4ukNnyZxmAEh*3$iTMjfU@_n4l;sdBm$~o<mHm}`vY$yh&xxdQ2;^F9VK2>m
zQ?sKtGqnY96GE>TUZX=?(kl_-xlz6n+Bj0@py^=fL|{99s7q;>d@kYpSjhB%(IE3G
z++=%Yrc#%VjE;;id^-t2rqKLKCUWoHUMY*Ho<5ddV5m^qos;qVg`Ur$^wTCmWT9We
z=wqE(ZBOsq9sJv_>tlBBm{AEP@$zR$*ELcu#a8Q=R8Nr^&3?pU%=%lj@A%-gxG+IA
zuQ`)N-p+RFfxEjUtnJ(L_+uG9<UHjd$7@3}g!40FTqjf)+ye0J_4`TJZ?w8#xjYn2
zTN>KFnOQFO{W4xGZA`DZ5h^HYtEExz<1Bn><yPv}91aC85zN3h)9I;F>AiLjW%S=o
zk#ZuyDi79Hie9PSH~qzKTM9U=Tp{})Rd~s=Im5@h`s3pjq*V}UPA!HJ&Is}5T>GbX
zZQhf~<P+lER4vh03*MfBsPo-ukUVBsgvokNOf&02g4lbnm)a6k5A#4f%tB;ObMqS}
zy@2_(Fi*z-iK_)CpwwqrG^ZWJb*Y2ern%RcSJ7=}kun<_>Kp3T4IP}sa+vi<aC(6!
zQ`q9ye0ToC>hj(T4Tt<n6~CwYR4i3G@o+IZ8|N_I_SxT7liwSPy9eIPsW$QUkwS5=
zFQz%h_4Oovq&etPP9&2*wcGR1@|R+*4VldnX!&)amrHypk`BZKk^{x&d*G?=YKB0n
zeW3mWlj1t!5i$Ig6x1u04)<Z=U8;}&s$+TgEuFQ2r=G-DmpYV$-HDVwx*MKW?KH!N
zYO8W!QQYE@cizVDmBv_4z~qGtnBr4+>qRfET&Y~_t{D^IJUKGP*PeA`pyKC6ISvQe
z3+`Fvro8rxcKY2lzCKyKlfVAnGZ@ATd!k6E0+ah=@ZXc>sj+Qw_ndzGYWs+)(i)n0
zvM*Lo&v2GYc`QIF&54_$Kk&*&8LgjSkvNj8q!VXf!n7Ltz+-0`%_3kVBXkDzG{Rh$
zt=7Ju<GpiMr{KqqxtX8%OU(t!#>T6=uh=C`9Wgfjd%E84;Cnx|c?Xgglpgh>UP%91
z%`KV-EiRiRB`!Or(2{l<<aR$TkVaXUJ$kHXpUiKz!Tk-SaxCVyQatm=wev;4c=<EB
ze0txWL)jcVY+%1LR0Yhh1ne}MgZu4XC|Q0`_x`=itGH{JB79HQzfS-q{JpWG&2mP+
z<8z@FMR{N)wxikS^Db>e|J#`t#EgvezEjdtodi+P4JkBCrJ2)Rj#4<v7#@<=9lg%k
zi!)7N{>3>*&105)<>nm)Wb!?)1(w6~8;r);tM={@{RMm93_v$i<byDFe&-luU0%9(
z9jTmV^}ChpeD#0hBsgy=AT#Ia#?5=PtjnE2@72ikLh}cdF!uZ-zCI5>r+80%^UZ)Q
zOfE4I+S$gzJ=hvfVP&OT$ecqN=8y6tf1UXUaZiFCUklaDSpD9f8b`-aK9Z^{1Ah%|
zEq9CL<|~u1H8zd)zZ?cfr81Tu^(9ty3;MM}TrAOfuWoqX18q2Ca4Ex_E7IO`SseDl
zZLq^_I#c4L_gEXN&0G-WESb7Kx3r`OjapD2ImH>WJ2VB8TNSA;XnYu^KD9=f`dE8q
zqqJ02_n4`G;Q0#p022gBTnffv<@}H)+fj~b*5|^$q}#g*D$lr~9vB0qH5hVjzHWuR
zD%oAnGC}ezhe)EGQwlxtZ7#|<X=5j|h-M9DDy@EcO7r`_W1PPmxo)Ea0y|(i!g)$m
zF$3?@!o<Ey#_IDd6}G=SrV{v5*r~<EoAIkwIoK#|yoYtXq9k{R+;U*6HEAmCBKwqV
zhR)sq?E_@9PFZ&D$As1!5oMMYtp?b&<@7_n7(Z%{EmitaVR1G?6IpftFAf>CMGC@_
z9-=I(G~7@m3g@w>LP^%Xs>f|Qv;U&uV)wxj6FQuC$c|j?!JaE=-yJbOcgaBo*Zo%s
z>5T&`-u7~go|tL+>HZ`18}?)NQ<4)COjTyJNx`>q&F=gMF+$FcK}4exD);ThiA<XR
zf@lHro21Rmy?)1+E;i{FO>3kRGAZAOT<m+2_l<fb>D_p0)0$TH(0<~KgQ?iiJ8~n%
znjS1sG{ckixt2+QTcqFHJkPMuI>$%qR-=4^+t#)i-`I2o=B2>-NYQ&j4)Ld>7Z$ud
z=5qlmE48PhSto$dys%B4O82c+2%3yb4PKMGs>?E(eJMCG{VF-IyP@0k$-oTDE1=l6
zGwol8;+W>f#&7zQ>9it@XQpDmtWIKVcljD!17%pXpz`vzf2O&n6S-uzEJuguw=+-o
ztqMK9_Tp4`PD6+B^w=+nS-t`OobIpQw7I{F5-*9@99=qS<FqJr^_g)0H`2+ZuwXA=
zt@k||<2|nV*h!`IlwUdc27iN(aXmZk0GsCfQM=yK)^`_U!^2acZwl$}k@&??dQYCU
zTHv$3V%aVSWh5ADmiAizFSgQ{@7t`?>I3t(X~sqWzOg4u`$-T97mLZLT%5%e%2h8%
zU1RJ$I^OX>i(0q*Mw%6~Z~X*{>N6j!=q8AQGnFdt77lAJMAM9(3$ci#KBhjYJ=<O_
z^1L>%{^|r%EqTUAjXn@4xptr_SW*PC!TP2S?6F*K-Q=N;iX!tbUZ}S9e{&o6q&5^V
zX=L2%Yawvv<4C7Z8p6RJfjz5stOBPTls}K*^tx*{e_v0>?Ivt(6`Xz9+73`Eb8^Q0
z_&K;H)<{FQ4jUgYbsd9gWQG@L3fYF$&2FMs9iv8D7@7hze3|=Q_ew5B?MV<s5kEM!
z{M(uqJ+MlXvHNGh*0y5WapGA-^c*8TD8Ul$lc7=(BZ>COV{ZaQli@s|&dkWAUjBSu
zjq-$i2K6?sy2VX2-}T5)`Pe{<|8i5g<*#wAdcL)bjh(K{Qlp@uMz|T`OB@akF-k%z
zbb(2^&|53UO`pijOAFlHTj&#WIa|!+8o`p7^8!V*>MIE2uoESL9g!}@-?`CxgoBD6
zqVd=X%SYzq%W!od7N@&f!qiCqD;XOinXR+jZvG-Fj}Iq^<>?;QuSokD*DHM;ss|p>
z{<~1KTkPlwoX%3f+NV?~D<oUSx!0ZdeY}NDN9|iH*0b0iiF7{&m3qD#=3;jIetr4~
z)~6uhhgM6(o`7IWej(1|+g$=L*ilNlNaE+TzzDz+WY=ubT2AOu#@;_NGIj?S9T2%T
zSU|(R4j$8|`Z$Sm+`(<_cGX>P{jSwgGTy0X5YXm4954g7d6nXNwerlxhRApfpZtj7
zZoJxKmA)s;z0}rpOlrsV^3a*L+KX*(Ss<EX(nEE49+uUF!ga<D2$ax#MXG<m#WgIy
zpW6Dj^YN*V`}r1+{U?>%ADynBUP<Vklxd1zOoR~&7lWO)pZDHzYocRdZ^vivi8{t@
zl_OaabuDGK{|scomR?8~B1)MU;Vyd@>DoOrq6U2tvsz;v2)yeXLR{Wi#Lj+hUQVSy
zB&62JH+s&KlShmMD=*p=-;+5)JH*#@H~ZPv;gR-ROznNg2E%A^re3RRh|jkac-zBs
zVnDPDV`~2bHAX5SYg5AdyMOByyJX9xeG-j>IeE^E;jY~#wBgxHBf&8kr=lt?-dm#Q
zPjXogL~WN|O4hcf?LH)(@C5y4FE@qq&8*qRL&~wN6zeC5f{|MYoB<hNYxaTn@l}}o
zXa!xw_Vdr#*?#_t;4wXeLYZbi2!w2ieFJZ8N+=;$pIU;!<|jPC+_)pY{j6M*QIvZi
zL13)2l|S_WuQINIhnMoTv7`-ae5@BwlA|n_=RZ4-dQxabKpbgDhy0qIdvkwd%=y=E
z;0j@1CcnX-%SrgQ5PiN!kI}DLjWg>~c3CQ|i9S)wq=C^RI8W`JjZwi)mlpnQkN=@=
zcM5f_Wa{Elh2r@3mxXP?*%c8nvFUx++J^am=v;f-%sa;QHyxa+B69`D&QPp`()t#)
zq6tEFony{^4`f}ym?KMyJLrnf_<ak1e=_d~U%2meZS1an7fn22gK{}iG*@;?=w5FW
z2{JR<zMX4ms+q1`cXw!Z+uM3BG|E-|=!5CF@?GGOshzl2Q+^)zx>kT9%d&2mksJxr
z4~LIa`N6AwygK^X1=Jk-Z_OC13J$?T!V|SJi<Oj;??W<NakO=zhHKiHG4<|qS>h#8
zRnzal6zj5w3JL+=H9P)&Dye9@O;`5amlgk1n_`W@NzX(%#RRX7BObZ4d4Rw33G#J&
zV6J_My#v!-$uR628S`7^X^?R!$^^>pAY|SZ3|w>JtJOKfa^;Xbd+acM;PlFl;xL`c
z!&>HwWhk6dtzz9!`<XYHMbodP4IZ!JOj?Ru?tUdxM9wC;menI371byg1jwAx#Y%9v
zC@Af16KQGId-6-vyFfIrVT+dg^!qD@0G;Ys_GIWzDh`$9NvR5BD>0<LZkEq^d?}%x
zb6q0eGrHq0E~Qh07_P&UA5L1zblNi2Z0D&QgcUiq3p?FW-TRwH3Exw$>>^Y&V?67K
zBaWtpQMf~5)ze#Nbxf?H7;8Qy{AP3v^~pPDT~#yl(?^6vro!QLy1CBVFwMSa{1^WF
z)ES+3L+3bmxqDFbiArm#Ob&<hTGZ}mZ!(*vKMD;qM8eC9ufKZZM0QOY$c=LvW*(Fd
z)m*JgAFHZH{N&95wW2Ng_x&oa{m08du?VH!#({wiO7Qi)Pad~4i_;O-!Q)^U2D|QU
z&9HB@fbrmEVdmt-$_seu<&vr6D8$p5mKw1BOVIr4kh4u!_$<|>{pfZ&*L~^Yto>N<
zcFlQ(*Uh7-96H9ay6#Hi4PJ8I6g^b={aredI9{!Yy}g;*ztVz^_=c&Rqm4QBoex+t
zw^~_cp-GD;b0=(N_{1xTdHp}s1akFZ8NfhHK-fOw(qnwb?U7OtYn~UE0)7EzJ!{`7
z)cXKm@t2kEr|QPRr0GsCJ}G!ZoLRooFq7g4GFvXie!0;w+>%K1%c8NJmXd1jL-Srd
z{nXxUZ~WT!dUi1e=1Xk&k<(;7zP&UduXj-gj*JMo->%MC)2<Z{!AzR2(rv)Lu<xQv
zY`?f@x2TMz8xOi#`*fWw9pIEM&2!66TSz(SE-5Cjb;W%(5T}2Lg%0MSW%~!w2(_WV
z{3eI<3Lt28#Bv!HIez@87{rcbcrza|{g=h*XzyCcZ0un3GwQ6ocw_fiQ(k!>yAeN8
zalo!C1;bd3GA*!(T3hVCb&K0<6as`BQgRHfvgF6|@hheI9H|rFJ|zA$0lJ-wLje1H
zKGvCKvi*Zp(zF|3934R_xn7gC7L|}*xgVQzpOBA{FOx3TBBBXT_sMBfS86JG+}%7P
zug2w;mzn)D3>AIVvMx_iD%V{~EKOPHYEt&2Prte{9;D_>{F-Y2cURnweKWa5tTjXM
z7%=2HEZ1Xg)1trag-}%aloGHrC~2waoO2gTj0wmof4%zw%vBY5!SHA*D}vi}5)YOR
zd0O{>h+Rj=PNR0xQ@KNOt)8q@7c09+^LEESsN7lMnu7i<L)j&VFQsKBfg4*Ra7`Gz
z4lf>)G*8iq+<ioB*L0V1OoxMZgR3WbDEjfr<!pB|hHwM%dHU)z?z6C8mi~?G<LoYW
za6Iz^ynqH(xx~Z!gGAk$v|k=Ek-{fYd#L!HDY@<|XOw!PMhTQF1L7e_HX&u-yz^YA
z!FK0a328h$NXVm7fo5qjas6gu^vla<OB&gyH#jjQ8>LGe_~Y`qr1fX3GQ3S!QY@Z=
zmVJK|s<|~D(X{u*K^N%cn8@OauUv#6q`GL)K5OL31`)Bj24arz(+EO!PM-id$$XYo
zE9Ib?5lN>;SFC4fn0nm<2cgKe!3~MbSBgZZ{UD`DO)oq&b+6zi{0d?~B+C~Vil<Nc
z{^)j1o2Y0xoO#zwELr3XgbJ5Mz4f(brSFWnp3(Ie+0z}rp!TxDr+g1z>Ts#K@|sI_
zbb!Bz?WgmZ4h0jWS2yhp4Ohp^=q?$$ZY}KSmQ-43YhAYz#QOL+f%;<)?mjRHJ}jrj
zqZjl(Z#Zds<>Bq6$<$_ax#1GSyeq04=s|hvI8wfy)8eG7<D#U)U@qcnfMXFUW@7$=
zKi)^PH~RozSL?lNmft_g-x1F(&^{JY^*e#DI{C^4FAT#Ay5U7-n}ed656Mzo&W%Og
z74tjS9KIaErF`v2lU(m>ELNN_1lJ>6F#BGmvcNP~Cb&02*q5i}+;atm%6<2lrSwoR
zm*HP2`N6|S>BtyMlWNqq8z;tme3tJwpD9nuLvOF&UGzJiKT5iIxJnHDQR{77xqeT{
zp%9L&J^J;XPYY`q5O_c^A^ZTHbb#0;iYi}peJ(kf^RCgQ<p|~rGs2Wook!uMI;xdQ
zEB-}mIQ-?a(cEaC-ax~tyP+fJoP7Vaa`?iUvP7~AwWm|-E8Qis(t{OZtSAj;h?iLw
zpbkc$E>*E6R?c1Tn%;0!#c3_wE6=!&3M>@+gc^-r+$qHwGKfJ!-hGz>yj=pCGGxK{
zFw|`m{DUwox0>#ac@HETe9u9#Wu7fsQxS14(>qmNnU8m|^*#j?-Q!T5)>rXbsj7cD
z#^{jK&<`6U(~P7oS_X+>oLh6KNhf?i<cN({rDQ2s8!{%>aF3i%M;y8|>)t+I4whqK
zO+TInv1CW}B{d^f#jW5-J0w|(`f{RaaVWk#gQ4ty14ojPsQjLDvfZ=i-1Wid_S%qn
zu)DYFU(K{lG<2rg8!O;)DrRP%RAe_mN-RgtRVE9P4@iFERQ-8vaCO6D*PnBwA7b@n
zweapU;^Hg2wfMTY{DqeB7F=$8NlkLMY3~<7*@b^)8I3dPLQ>Z>wE5h>EEs<)auJOL
zk0trqI2e;J-i%Z*Kw=Pq3j7-_Pg5`>#p=l5rjUSf9$kMP{jqJ=TjToM^pJ2th+;95
z@r%Da6+aC>f#77s<tmyT0!`|r<I3E>q-gMRL$cUDPt>UyS+FjAM`w?qzI=|w95TKA
z!g-fCUp&k5C|_4zX%E5Uw1*z*_O_J#o5|hd%VGK3QoycrpJ@DMX70MLXu9jpcKK`A
z<B30(Tf~-)kG?IMNtx&s6{zwl(#9uA@0-_xP}964GTz;=Lho=0A+WqhpKq_q&imP(
zm)jDXz9j#~K_b1y)0?p9twctOaDIl_S+m$v@n(VODV@jX1`3xVBKWUt^{eP6iZy{W
zb|r|pD&LB}nLJ<g>Yt9UM@A7F!1dtHx8E7{A3aIcGe5OH-|>!7gL49>^-G@Y8h>7=
zBT-_g^7oCBHEOvsr$<ZlcI2UmPb$F1C}Kn57`+!!`a4|PI#{B2k;nEz(unFhGb|h+
zGx*$}a64d^_xxug=?}OJFeJFw6m)r}Yhd@SQq#xUMqvN(L?Sc%@cO)&S$J>g;2LKi
zF+lo7fN>jzF|}4gjlsTZXlia>HQ>*r`|-^!Ew&8|cq<RU(8E6=38bJ1uB<zK5>FCZ
zx17S09Km_bq!jg$X8f%LdW*Yk4Ht+~L87NAj+6ls#jUE*uC1LuvE*1neSS6mYfs55
zA5T_xLyN4Q@O21x3)U-~gY?duo`Fo(L;EtlHT!=qmlp}w^iWjZtkctq?fUUZMq`_G
zKoH$x{45=9nRSw?Y^8JeltN@a5_F^|s*y641ni8W)6L|iA%EZCtonBJ@=6gVBXnKg
zxJ{Hl#D9@wo)T3oCYk%zjWKLsXA&xavN>oMrGLFEOu^eo_ICeZ^5Ug}aLD~npl(N<
z>#Z5lo`EcHl*Q4L5MTTRIZSJh1MxhH%Htm4Kj2h*8!hHOZ$DI$deU>Lt&bi;%%DXW
zn<jYEO}NCDwh#vL4X3Q?POQ;J#zft|&+vK1i3&>1dOv)oCnm}_<aE(jzWGWlW4KRW
zZA+U<F7cFx#;9$wE#A|G7Nl<?UVH=;tyt7!Gejs38E6Yz;<`(dfz-GcVSOGi$7)Fj
zX?(=`-1l%B-!&yZ9?R|=8!Mf;0ez^}X$B1R8fDYNpc)XwyB<MpgUr9%+A-IA+cHuv
zsi&*+v=GNH5YDYAUFu638voj?)?Jmq%v?=frmv;y&Cyo0R%Ns!akSkAiAlM>_>hY5
zxhHejr12CPZb^x)gqdo!4i$}c1>8d2uOoqr!N#xIHH`C{&k|UBL};sv?=!i$B34&=
z`_t~IF?A~6H1d7`8=4**AC~=~YWI$7IYWZq+ADnU`>|sp-(9E+uL|aVXXy_Pox<N3
zVx*~`p!ihO>Lt#j>5g^odS~W@O=i9gSq{s%FX<2Lbk+X-JU#z_mmr$a5|fmij11={
zIOM51Z)`!@%^{jHpMsyxwGWQc5sTXXdSX8M@|HZ}OCifsM*((nwpO1;fxMilQ?|Ke
zDJK1H>U1J|;y)GJl|&cqiW?8`p>#dtAG_b<mC;#P6kBwRQih_3*&(o3;u^S%(Jl3Z
zFp>`EjH;&^tXbaU462%h6DCT!&w9A^W1I}vIwKx^JH%<F=u>)9z5asq7{C62UapoT
zl1#NR#^W9UWCgkjFlZ|;^f$AkW@A1sz9n}nh&^tt6zhS!w~Qs4!{QV;l?^Q->rGS5
z=#%H%*N8HgQtSK`fugGDq9MEfi(kUC?xdMc{2PeWHL4}PQ4jPrFS9DDn*9~8t8Gka
zvPn%o7N8T#q6zF}pPP4<82S(TPLbxL7L#)C$v(+BDTyr!qQ_;nYHDMN(#8&Jp3w(7
zVq@GM-#%DTu893L5N8g*v=QC-s3N@TYt>ry2ac2Z&KnlDIr#UbA-=@MBoP}Sm^xRz
z&C?KYjmCN#7&AR(^?RmxGl86AR@iT66P+l#f{x0jwT-Pv^Q?B9LF(#kQEW)xK}JMU
z4l$2Zos!#e2Pdt#7-5;Lm^KF6Ayeb`&&x8hvgAU8OPi=X7y-4>mQbV>@O4~^i7Y8j
z;?d-`xg~)Q8?VTAR>OOvR=@c_KhOWKh8Ox7eZ9(fOWpwAvH6)I$H4ut8Z(%T$5tA#
zP}o;Dv~jJFt_<i9;X=MQIpcPtUfs}hPnS%;|NI>)$jQ@4`7C=aXbR`6??(k`J2cPO
z+X9_u6P2j58(D?SyX_Y1X;b7k7PLM5I!VFTAaYww>Pqt-W1+W*o^f#CZ+G$VC?}u#
z90ZbTn0W(l=V!CQPM4fpSRnl~5PY$C-*gxLRIWO?HBjL%RE85=YUyalJ1QozHdHyT
z*`AB=z`}AF(uqa8%k7}PEtt4@^F7jX56r2}b;x`ffQ*RLq%2HPOncrI+t71<?fdTA
zd?m%VYV`xzoGdh-zV-!bq`^zP*YFO+br{nqJq-{AL>GqaQ+H2KBQ!_vtv@Bs4Ors!
zB4n`=q9KJD6m#J&|2e~if7Q65ko1@vsl+Yixi-3(NbS1+61of#uo<Y!s6P^)M@u=_
zV^JT!0;H+PX-s`&baeBU)XYYjN<R9fr>9R>`&K4-+@{HkL<+6_hIx=%&$UAdcFm&G
zj@p|_fCfSkjHDo}tc`hZYzf^PvkDSn$ugaya-K-XHhgO?F8^TYKy7E8L3u2<gfvnH
zEwNWahiQ+0IR1sKsUP=78gVZK<C1nA->Kr%J*ENtGg5x+)?N9jfHi~e)We{s1(k}{
ze~*$UZ}!!&H6J{DIPLF)r@!{}^iZ{ao(8cJ0ww9V3H^T8WA6@Z4*mHQTWH^B7$UoL
zba1~a$aE3p&Y$(z1Q_~BPkld@Zq0nUlkdKrXgD4;EeO4IbCwKwb5P9n*hts@JNZBe
zx`#f{dk?D3n>X#BU$ZGEFn1kk14Z!W(7w#=o2@~}S7cM&Z2#H#_x=A@1K9qjv3r}1
zM;p(+@W0)c)E8N#M?;SDqcG5G8(YQ+_IBBzdbOBqS)%FPo83)peq4?A#2U8`p7%@0
zBcGZgR=KQsNgXgQM(3u0r^3+et9UMGub{renL3^CUN%CjZ`@SKdrInEzrTBE7XQr4
zJar0q_odL6&MU1O>R=nS+P&rHdi3_?V<9bvx^&+4|2~<sL&x}mheE7S{;{4@#KV|t
z$lilLnr5)Ls$l-ai|ILrDMLyeM(D%6-)98^id@Mj%_?9=+jM8W2R>!SUju3V<@vX@
z&8~SSN2!l=ivD{2Dfe20nf8*Rm>IL-u-ZrusfU`M8MLvLkQX-&bUb+42D!!XrMs<Z
z&n9d-@&Z<G){Kx(c2ei=C$26?n5UkmLGwx4+R$m$LYQczdx1fhvhJAQeG1xh)=D$+
zlXkBkIXK?j8xxxkJNV?8kjt76%G25RNr+GJuQ6k?M6(SyA((I_v#kp(knPS`9#9GN
zh8`XvPA)c_#IF*wak;HFXW{d6$;=sMn=n%Ia(`b>*5aSr7FGK*jM9Oh7WmWb#YWn?
zwquVD*d)XJ$JKN5bHJgt|JvANWHw!?6kFj8V>H>0BtlyMiNs=uCF?b1c6BR^H|71&
zNn`I@t=Pgo)!RYU%H;iXlVxy9yG~?Un!L-ILJe56s=d1_n4YQpa*wbEA2r`ZW*_RV
ze*UbxNIUAE=?xnt$QE_oYOL5}yeqG}$~&He^*ecKMm8(H%@+{Sq?7u^R+$MuB5k^g
z%eq~y)BWT2W{G|~@aHy6==i;`prey(bsGs}4mHZo{k(!|`(9$vXknJ<&Q_$N(6WO)
z#3uK5#uDIsNrsEr8<0*|rzj0|mtths_;LNS+24k&9^2{v$NL)|^nYXvX+CS8C@lZ0
zG>_kB`Sbr^;-TkIeST^7q8->g=+5lD2c)zAX?I_b)gx9n6@pgEwmeib4VXPPP*2s1
zLK^-y&lfhfvx9%^bVO8?C06LM0La`C2*4jJQdj%O81;e4v;shs4VbsB+qR83^}oAD
z;$_lj^x^ygh3w|2u8a+505(oApsr}Y2WvOqjEx+;-vzm78-Fe&ZbOJMYz_PW^ba-q
z{a63cANvM0VdMcH&H!8tz;MT9o}B;%m(y7DsXH4c^7AfaG$z~GL@;>>Vry5({R8{=
zCxS?G6CkZ=w`saa){xe0Ujk&@@t7tHtifXi=;_dNb}sy1ZDf=sAFAVjC^`R6mvPfb
z9^m4#*&Ie$^oI(Id<4J0|35UC@P7YCZYbn~v;FUF@_)aDA6M4LkDBj~9TPrxu5fem
z+4b|Ahk(wHk^$Qv(Vb*CCPn90z6b8feud61BvqNq&B%BgVjk*a)F!DadhPzX9hk}S
zp29)Gq8?Eec~d{b%_AZsp^5vTgg5n2wh_1f=sdq~>8<v3_12z({<HHdu|n67UwMCY
zOC*=TdIMZ&`=%A+bnf$eic8sR>TNJOPwU7D6Fg<#uQPh5Y^K;YQgE@t-tWJk;C>H{
zJX2Hqg)!Nrt;`RBHnf;qJUV+#L}lvc%|bB{^8)Rw67ynWb<y-+6&z!!qPbB1%rzqe
z19`&FWk<<*q88Mk^4;ID@Nw_M5*35EzEK84=NGJbuRgg2zZvPEN-JvNY4D=s<6-fK
zp6GgZO}U(MP-zR1x5#XfTzgc~1C#kOdOz^2EHk2~TXiwO`+6@q`pA;@<MTFLie7fl
zSIXeog3}c5aOXq{KooTp84q|@CeCaxvP<{-biJ{9hhO(_GqVnbi*|G09OBpepN$(%
z^9G2~!+^X|>aLCVJNuwkAD7~|Z}kR*36|a^<^>ZgA0}<5RMa8_w+FmX7Uocl^PCe?
z?ydZ`Ak85!zvewkt8>IjxGdOlT{x@Q>dmkLP6ICGHovGyNe2<6<jbY^ZUetWCHHU$
zsqy>QAHA;Yc=*{+X~hh8`nH`*B66a7Z{&<m15azOX*Oj6uf6bZfwsg2i;olK4pp<6
zj#(mKg=XZsU%s%aBRFt9Xblrk3jDviyAG(P(=8vzURf*B#{pDes0v5`0g)0A1q5-B
zq7M-P>4c_0#Daw)k)j~Imw=+Q00BinMS1`Q>C!?I0fA7m_e+?0@9myFZ{Iol_PyPl
zGe^h#^Zmbi%kSRrcNaZqMd>LPHC{SHBhB=-H|vch9O`l?N*H1B3?tXPvJ{c$;Rdut
zbm8jDR@N{#-*Vv0cv~B#wf<!G3pb;=iA1*p2k5SqQk|ZY%T?3elkGw{&g0IZFD838
zm$gx-269VFGd*wpTS`0$X0dXri~47!S7PL6KQme*$xeO!f7;8(o(WCRS{3z=Qz(|L
zh2Khx)IE-RSDnJ?8`I1J%Z5(l^x@8XCw_97etDrf`OVV|$4(9S7sX>!P+)?nHi^bw
zR%VrTe1871ey7&n-Yvo0K0aO(ci3A#GPJyxdUuJM(?hDdT~dYK{$vwXU>2MH>=`$%
zNtKO}ZqR0?_Vu!rZD;#2($d)Ofy-8z7cR5mnx4FH|7~BnPwtWh|J#FL7eh>psb7=@
zXYSDiaVdl}IF0wCWUb5N_TwsTxkaDIYRG;5T;)%Rl0B%2o#SG>?;r+zOS@eDePT(?
zc)rU7J)x~MA0c!bFqXS@-A2Sw6C;nW<cYS?vcq^EATjF1-nhLo-*C&&N6BQaQB2_N
zjMo`OSwrBlF{aG$+jYItgZVz2KDuw;KF;3O;%Rn{$$r&fg^Zv}(b8}}E3@g7>$|tc
zr5NunHm-^AxqPi#$>&6JPDqJpI<?!*$Z<DJbuYih$ZLPzZ2dx5RRTGl!m2edeLtt-
zfPZXk?#tZJ$I+rVt<IMhh<iFybCO(axr@j_0vvoB+{ar@i2*xLcm8rcl#VIzu0Bmn
zf}I!PwLIN+Mp(%6g8oyWtFY@17r@cF_&>M?*_x(iv@h0_cKcLECr|W~*Q^!9IWaC6
zj*ODKn%CU=lNR2r@I;ArqvHC)C^#J!rv@rLya%`SPuV(@l3?pM%TKcl!$roVzDe9@
zU)y=_V%Ug|7E2jBks!epY%A8;I#}B{SL{Zkb$QQphSw64>UvEDaVjcyf_pa}Lc0@$
zA+9p9--Lg}EqUybtC*{>P@0`QuBr8{XmX5*!x)vu$UfTov)A{}L)v%bvWFrU%&j3=
z;-s13m}Zw4F7i13gWy6#N9Eq<MO8lx52ZGPr+to;b3YOarIbd@(#21EpC$&(wq_)J
zjkI06q4G(U-SLI7X)nNyTI5O|M#{2DL`Q@J)}O;TfjUc2ktE~iH#HZ5ROa%nkMN<J
zd&<}(Jr&n!gD#ORKiP45E>526KKm^7%;?KA;kK=|NAPpr{YSt5=r(PgLk?^Nt4^dY
z&U?``b^Y|<{xyxMB9P+rf;YIfLKS2XI#Q`IQ5m<ln*%aw;zDxT-qwDQofsWv*c++k
z)3DS>9hzy%bO`k{0cJO?aTmOSX#ku-n+~zUk3(30_w?_09v`17vS`G^f`VXcc|}E2
z(9@JG7`81KED_`F(0dW5>4SM&H#gqe%_q|;nwdq6CQdoMuxUQ{ZvWiysN-<@P)az~
zs(rdX@=ZI@HoH{O$|qgd3(lFSk1u7a)Z%rCTsuYd{e0JB5au|xpd*TtbThC+2$46L
zR$ZEak-y#zlPq5ErOlRBme%v{^inL)Xm-guAjx1iPt(TfyT;lE3?(kk7{ZfHY&^pF
z<wOl1;3}aSs3E?mY4H`)dc_5HP)kXB`FxWu@z=F{rArj0rM+`C0}r;SSI@`HEZtja
zO#6skf%R^IbdS!|2iY2-7t}olY44n^n?Ms$#f~L?WGfa=rVrt{YGV{HKmiB^Q_aHz
zV5w<oY8L+5CMHLoxHED@jAl$k!Y*(W4tw>m@PmnFBk$}HE7~4V+K@>Id)}2Xzgg?k
zx3DXvGG{>+=J_(%lF5ARWlHAtrQZ@@_oZ9KJjwD-PY2zAgKLuDvZBYQN(b&+rKW)r
zL&`hi)md}|BG^%lF(_nvdHP!eY%F3@GT)LmaZig#yK8{RuXL|vcGL>!mqb+@mi<v-
z>p|i7dD*(U9r=5+t-tB0S{8K7etlW5O+>x1P9IXYD<XTi2{;^yjtKE7q~@7ekWBhV
zOtgY3ot;Q+uT~z;>$kmsUnf&Fha(2(<Oqbxh1cY%hd#6oFz*}GagI4|=T+xPf7PTv
z7vAoh&aL2~i&$R2f7sNZ>kh<0z|i`T&F#Z<D;E$<+zsZoq?_p(E^pjMeXDd_7=+IY
zaS-Il?5LGB$+50ivK{NrpOx>Q0$Gd`Hp{8S+rJ+&ohTgTz2hFp<hm&9H%Sc@`Pps#
z5D{rQAcEacwe4K-qenGActK?MG$k+%+cZBF*==Ym?fV$TkE4Cle$>}T$9$Sy60NX5
zqR7|sG6K{EnyIbbQJEnHjMLk>jy90zrHz+XAQ$XjqlK_(L{3G#wRmYlDlg;Z%J*S@
zFUGB8SQ_<Ghk9XNacOvY>)ULZd~MpE*5CA}{A(?$x{{&V5tt%Z2eq5Ec}B^>u%=bs
zpT^yw4yMib*n`&QHW^({%XD8Kh=+!%$YOA$G8u%MAD}2n-(0r{z7q_N{!d8vFIJyH
z!$lHdyr8S$dorJO9~6_o!yOhNQb2siz*Lc5Uaq__KX0<6rpG_tU1kn!^TLM@7hcPm
z8kgnT!^bWH6U=*KxL4a*C(7UdZs7jpOZ@6WNBC9ci3LKJD%#Xj(G0z)()+?V$1xNp
zE#pvOWFAg0Zq2*k-tSc0(-i+m<gnYFaWT7&^$}YVVBht`FpYYG@Zp8t^osg3lpPxB
z78|xbkUX9>4)TBI8Av0vsbhQxaTX;8@AK|WP#jFcivKNpqEn+nBd7@mGE#Jikq}|#
zt*XaN_O7x9sQ@zffuuST{O#-gpOF2o@$yzJ2r8Wl3ZPlv#<G)xK~z<3eCysVTX&Rh
z^LDrcY_7-Y8(@4>UV@4seCf-I7CN>s3bVO5TBdXFXbAEElQytgQ0BL;Vei@Ec!Ouh
zvYqkNyDDNLuNCE}DcBu`yhHneFaV}}djLn4jGbS=#l_jDM`l2Ge_u|P*A?cKHQH%p
z(pdPhdeQfj6}>C$!p+$(ID3Cg!gE-}jil@lhoNHMrFCj^BO)UvMrUxnru?Xp_FT`z
zT{2Jvh{oNeW?GCF&+F3k<fFOmn9Mj76P*BBOJ|Yq#_%Ql(txx}?#ls?pLN$K+un8f
zrlK>wamSc!>j|OEm&5TIye+UJ_Y~90u#OkYHgrmygyxKBF`b+@nsqI>O+DwF7J1w=
zTs+$J4}5AVUA#Jy%4i|yIkktBbfz7UJ*2@?fsLA|XhQ`Hd=v1HQ7K~S@9gY+bY}2E
z3#_#Tk8qsK=ZHw-EABy1`wa}ls`Kx_)(+z^(QbM(H^_OQF@Y`O=?d@4L|yUh$OFri
zy!vb|iH1#%HT3HjII4pNw6W}Qu}Znlwtf3DyRX0;8LXPfYHKYvn1AzZb67UN2j}Ug
z<SpM>;{iqUF56EE3Lg}z?F&X>&^ZmuK<yZgl>t}a&0f8MMMs`dPLg46_SQ}fwe0J1
zx9{9}4>%pM?e5~IB9~ND(4k|N&ujh+8Ros2vaB@Ld^VWz8}aCPvQYs3bybiUufN<y
z-BU$8I8oy~Dc&<)j?a(~QJX7L*9cxpIuq`D?Y2fg@BA$RmvY6qXkXgO)b3aOo>7g0
z$8LN*tT^*7F^rrFD-^KfBQhQ3C&)$*yM62Tn7|n*FJ(DG<(_b@|0p1<Z}|7K(8Dh^
zy9C18a9?*(^G%b<ekM0Z!6pxl4om(mr<R)4b|o^%X?{T{!%7@isY0@Sn{0de^85ab
zT(Pr^(T&zqi_>B7=zzA86!w``Py#@lgzIoS2qu%T3n)QJ)x6hF$w0wv{T}sIBvNsC
zrn%+27f>%Xfhwr7U~i*9pT#^@%AdTZ?QGGGC7n+JYfYO7Hn%j4%T)Ga+?(P^`OT*M
zVzM{#%=msaOUobk3*7lwCb%zn2N*7gU#1ZA$m(9<+$tmFE)c@$;DveTF7?}Zvcb?D
zomj^oTQ{rX`kw9fC=tS0Oz`t(g%eLvCxNpSXh2PVw0*}P`@pSd)b)w{JzLLt+dxh<
z-1HVdCM8v3dosOe<V0S$tY2=HEsU;wnFTcBzbuUIY?1c#91OWEYWxb}g)i)Zqg0!K
z(BAW;RkM{K9}jTp--`tFUBV-^32+VFuItIqINGj8)0mhT1bSjHvZ@=ISO*5*@W#{S
zm17q-PfdLR)8Q^;#*CQ1{10`#|2~`*TKHds4OqSXN1(-j9!1=`)Mjh^W=9L)3Cts-
z1&T9fEn`}9NvZd#4$wtVNl7*zKYH%3U~K}HM5(>f4&_f|z?^D+eQP74^I45Xus|Kc
zE)@BII|{!686W_GvP4KB=QwiZJhL#FuAM>_3l{vM17I5>1_Lg1{BVN`FdP?<1<oV>
zvUZk~ATev#{}~WNMEXfdtadO4^6JcLLd@wZzrBMAHy_pjz9>|O1kdsOQKvnW=?MQ%
zz?x$Wyin(fgi2Re7wTRJbg#%|D0d&)M6_+JR+TreUR{D)@{d^;mp(H?9RwTJjpMk}
z5J-y5=kw@U!>o1X$7Rz=&V!&TNsM`Mc^?bgq`fLpnErF{0JuI_1whhPzt{b#Q={-v
zLxb*L%`$UL|95sA^%7-=KNIgO-@b~K>uNyelpsP3(KT&H)m5aIDmmiMh9g2~=>jtf
z`X%&tET2GoobMiN=DRRSOp41NXH{pkUyb$<j3<T?HS)yma@?+Ur$CHL5ZBM=bzY~W
zBufmjG5_(Lu-DhuPQWK3h%ojcF;muJ*soryCSc>h1qRunLozPV(=EOT_v=ACN3p~-
zChkGZ@@RLKSo{evH<*hGO)GC-4cjR1Wk#u(;lY}ORcXdtsPfX)Pz(CM^1mTi2)m%{
zOp9Q7Ak?L3^BC)GEQe4GbfSh;e@i*K6`Mvv{#z%F*i)5n-)W;jk%}u~)f9{PJ!(Y)
zj)j!d#Lq9Sn(y3};sLWAxbCXl95vHg1d*Wp<3Wdp9<IP@xWGrP5iiRsDN)F*@#Dg2
zX*C6K90?frnx$F4Yq-FwFjRQ$_mi3B)?ZsN3@KLnZs)=Ugn*6w@j)GZ2z+5(hvNoo
zISkJkA@*rhRSCFatQkE~_Tdo)5MKI=S7S8k(+ow@>YZK-b2#fzxd)cZ{@^dU{`MtL
zC-|YCRQrJE%&YJ?v#u_$6$fz<__8IrT*uSnXhVgskI7tM>_ukLv~o)gmXu#gfU%Pu
zmevgn4G7sy@{X_gq{6NMX!^M>L{+wwX54CbA4_|b*$(kic*XBPc8>zQ;=#SK_<Qeo
zIi;&;Ht-#&6UjH|A=c-AFdpH-!cHO09yt#q8yQVE*DgvA-#tJkyYoRf6<(-&i*;6%
zMJ1+_M;-(}l+Gt@c?9&I_=Ge~bf6p%#7}sr%v7M5Jc5XV@l3B2SX##Csy{}gXcJ?+
z>@$9Us+^Nmv8@8|Fl{2(^e>JAJuS_T`6idfn@GlEq(40fR%*JNLkShI)A^DB4qGNz
z98?Bf<#+Uh>^7QR&zMfn_lZbz9}*`D$eoF8E!!v7@WT$b>Y3snj>TW_57q_vtDg>#
z+06Uz!T8Z{JIM)77TzndXYy{0Xgmm@rSD91Ffyn&%k}iwUma~;{d{L)md``f3xhQ*
zz@K^o2+CmGhW4j}_JKQ%F7vw7HK)$@6kbQ*GI0;kgDp1cBX9(OQ^l#VJz(npila|e
zpX$eE#|eSIfsh4oWXX#ZC-QXHBGj~(lRMXqs%j9lS5KnNbL2LW>!ms6=`zsyOIeDc
zPeTqchXc^d>|lq>*U3q!=gVHE4*vaKcxmwQmD@l4v~~cXctEkP0<i0Ky_JimbTRH4
z?~u>sQ{Z^+X3VGAQ}Bi0>U;oj_fuoRNb}wr*P+rm1c(Cya$lcGJdyTvwG5z5QSn5n
zIWU&1|2*@$?+!5u=0~>m6im<6iytonETad9%`Ih2!nC4yC>6TQ(Y6T)gTYIKc~L))
zC_>_XtZG=}?5~mP#DGS;id{z-Hs7xJA|Pg?S~TC~a{X#I7~(7m9mT>`n<XyD8P696
z*r3DHYPW5p*YHK~B_?C%>N5NZW}(Jg?2vphm0~&+n2ipkuI%rda}cOeY|M)v{Tr?+
z{?<k<#e&&lxQEV+IHQwOeu5?1b*pC}b|5hFcz_Qm)*3#=J`K5)6%2^}qOiFy_!Y2^
z^64_DS0?M&RufJPa**pDn|(e7mKSYEFw`|flosD^3O=|pr3aMSTIRApOX#vd`o}9W
zb{PUA08$w<VMR;^fu;1*EC5F6iZ0UxFb~BhUYY@sYI?f!{DO76cFxsL_w)=YKN5qL
z4nSePhX{3QDcA!2h<h;1GS4~1;2lopKGT_tT449iP+iW>!hd0~Nr1Bbvw{}m-Z6j+
z0H_d~=FFZJnI^-pF*X}m5$?2p*eR@<orI`Mx8W|$>gQkIVB}q`%qggIedV)rY%!pm
zfYYQk;mek<+;W?2Pap3fhJvRKA&9hY{90<MMkw|UKD;*3Mu``}?rCY75X3R0Y(OI}
z<nke-<?T5K?h0%t@)`3xncvqS2h;{2f)sCrox!OFNEH#{md?<)3^UwUVU>N}g{R<X
zv{F1#Q;zpp3e}Md;q(0{Uh?FC?9-UJsaevDbgCjFODGgYEbNzRMcX67GuZZtQz34F
z5W_o@wJp(eUFL(*AV>i$tI2W))TYIO3lrMM%nt&c<A`=_T%DX#!aE2BhbE>Cf9bB@
zM=~~b)i`rS{q9a)gpqPFZnSOk^HV+1;#;oVdAzSxs$LX$2=htZ)^%gPSD{gmv5nwj
zL7i;_{gI0{5Tz5q!7j3x?bw7td8-~{qmGbS0qI&dk=vyl-AJ)GG~ShW_PV=o4ip%H
zf~^E|C}KkZ9O@iBUeyM2*g*W6U14vyGsd_SJLLg{WZ~HE!QS{erSrx%We_*(yiqZm
z;tilJ?BvokCwGjlDavJp?D3dVM3#qYT2qx-<12&}K(Fh*F`EpzarOQ}gs8=SRkp}{
zK#IMl$K}FkTJ0s0uRXXsha#ndg+xNzpXOG0EI|;83S(Xd66?z9N@2i^L50!a*a<^}
zI<Z(aB1kksho;gE&0_cQPyuE(05^yX)s_NuG6=M$7iX<-m3$c`%Y(LA+cAalL>^WB
zsZVl%_Xr5di`4AjZKNkBCs$<w$E)87rhJ2GM={kG;52O_<(@e|uF5v&p?M<0bf(YF
zjpfrxKM|yo$2$|t$|Tf?UkAoXObZdzBUP7~yNFG^9}&UpIVSG4JWyskmmTf3P{~eR
zjI`Yg=?{?`*ENN#E4-QANw#hDuK_AGPH7^584zbU>j<F})81JHt-HtN&$=B3=k`wB
z1&G|>D&xa4E7Fo6D4P8(57XnkxG=0YuHBKz(@`Mg)U1xH>}_NyPM0uaioCGI@vJ4@
z#qAZg^B2g!ND5|@zNHZ{q2K5oE?R-1K-o*}oC|FB^Mu>&p!W7s%pRT_YLyq^ps!oE
zL3pCZK_J~g8FEsNqlhC2eYVp#3aR)g@agBI`8*w;wK(t-u-Ra~asn+3r1&v?BkD!g
zQg7Z-s?~g@B*RqReYj)0IhXA^%=0dYE&~poCot05%O6l~wU{q}tK=V8RcnwI8zKNP
z)$pRA5P{jE6xeOc>{BQRM3wsrY7ZdBFsuV?KpTi=AYcQapTK2^WoNmpE4Q2FlF$WE
zD%0Y;6*d!y3e}hvG+uwVxH#;FbC4nemta6bpz_Z+06q3|u(JYLLWd4%KnM;;wC6bY
zMaUJ(GbGv$15EzpL<|vxIFkCcUUn%zl2d5GY>H_B8*+M0liI(vL{#BTO`;JFC;J1W
z)o+0u*CWDz^)iQ}P`PO4r3Qf`3))Hge1#yVq*nmbj`!hOLsg;d*ccDMdtnl5eXL%7
zrm}J)zdZyL?@zZiv-9pH^}TSGWh*8%wG}V4_F``g$2q|*sr1O%_EXK05a^zHGsB_o
zt_Q|7Am9k$(FYx}6QYsdLK0o^lgEik-?De2ATV?Wh5b<IQj!x2ae<PMVkrsxWWb35
zNHm0bwKn>&1J@K-R-^_%a+TyN{6iEg;SCY^te`N{z#j|{sU)C(wfjScMn^LtSlA+V
z>?DN9ET<(H9_RrY1pqGyE1(5#f3;b^+ow(Fa2jc(P=n9+M07<lBouYf3YeCy7{_WC
zDnXC{T8fZ5`N%pz6VKM`kf?ay@kq-T9pjw)kIefG0oc8rOY#G)fLSqIES<ipA<$Sb
zbN_$@HfZ)=LQj@&-@~m0Wk@lY{Y;DujaT-$xM+*V7vW<}7Y)yi%q8}o{vk_+(_dcc
z0U0u!Z}?D8oK8J^KT3wPV-0BuRa(=nMz)jV8lM$P%6Lv&&P!&&c1&Kwf|Bhs#>-8R
z$Qp<UCbwQ4vosodml-e)!s6s;e_O+SWTp2I9kJ2Ia2t+~asB>_9G9<#He;3rkh-SK
zGsJ|!3X9_{HVpeK`r{SKl=YqN%}kX=9L}{8&jVt?y@6a8On-q^2%IT^{f%pDO9zr3
zCsmmlT^)V`NrIps&@jqU;;q&OmiXQauQRp0t*Jj1sX4@Wj@ZsHhAoh3hQ8wTl6j6m
zwEdShVwBZh?btz8tq+n8e2L6Mf_5_W3uTen@Ni#64w@zk+z__d4u4jzm@HC}4JbVK
zn}&0!=kUE9$(F{Z`<PwIFmxpRWV}#Q-yI<x3~oERT1L=<;Tc(o7aMQfm;rfjEKCm`
zH*sF|4dL&Ye`b<U2JVtdNQ<DsCYHU7x}z-pxzsLp>KGLHp*eqmvR#-o!$=uB8-=cr
zLSQ`sVpZh3!3Ro3JH<3oI{gF2<KlkK)D~ukM&izG-n2==&S3%jnYD%BL7e{B_Z*!L
zB+m_Y10xjBp>uU)M);)bj21L9_XRvu^UNtm@_4HA{rmSrAY-j1IV`gaFo1evQ`k5W
zP4{;nLK&`*&>Q)~J*Y&B<hS;6Spsw&Ie}pE>^S`E;imXkr^YqEShP>V#eTTYW{5E9
zT{X-hgt<+2k)U2|*p?9H4=@-Jh))gY_%3Ibl$Mgj2K><3$ZJLKfeKWB6rX3JIH+wX
zAO&m?RV4Xf6Xru^P!U4v$PtK^`XHo(339-5y8gHC-i0WarizM+ed%E1!XKv%nA7xE
z({`CJ?=kz!ul^s49vJOEm8TJHxz*3#NN8g{_1{CLzcSWfwCjr8+}9Ms&jel7&bwZ|
z<Z6kvaJGa$Fj5jylA;naq7t$OlE<*p5?Co|5eW&bghXeXM%!Qgz|P^a^%c+m`UhDL
S7$^*Z!Ks}-nSJ7--@gM32(<73

literal 0
HcmV?d00001

diff --git a/static/nic/ic-process.png b/static/nic/ic-process.png
new file mode 100644
index 0000000000000000000000000000000000000000..d8e2292fb6bb658fa6d9dd08272ee9fd31a3ec5c
GIT binary patch
literal 24035
zcmdSBXEdB`)HW<d2oVxNLIe@LB|!wygCJUzQAZ*{)X`@cCHf$Gi{5*gL=7%dj2=Yq
zBN;8~7{ch@OYZXA>-qKl`rh?g%d+Myd+&3fZSUhaN2r#DG8F|Q1qlfWmCBRH&qzo}
z5hNsMi^$J`CHqgU^1wgmt>o0@NJu_JQ69b^1wXUCeDX}4gv67Rgyc;i*a|Fq^NWPU
z?Jfz)@^cariFYI<4323H+K)g%x3!+?DxRF292^|1udnay?09;5&d<*a3kw$&6<J$b
zD=8_})zyWEho_{ZKp>FG$;rOHzLu620)a3-KHk>Ww!6EVn3xEKLhbGCL!$%oD^thT
z+9x(T8yXrafZT6CfY!0vfyJ+x<?;5eR@!<RRhR<#$8yL(m(jI0GYjL8SfAqh^tjAW
zptquHy0Nyk*cIV4w1n{u^h6?&I2`Wq@DPPUVMc1vXmsD~=ceBG*0!&mgJa%gRlWO;
zPafC|EN+VLm=CY(OZ>L-^0h58Bswzp!~3Dt$`O1)K|xtrS$t_@T48+r`<9@zvYaoY
zF)cIhk*OX&Ztn+IQ|o)YqBG5GUCSD>U4mk*JpyeJzV<Mi-1o_GX>SWVW^|zz((;eX
zdKV%JKB{Qx=DtsHfjgq2{H<-R0z!T2>+7qks+O0RKYsiOdlTlH`5`wq_xtznZ|jGw
z-H`C;^pN-M=9bpTcSVs+qhG#!X=-Y+_X>)Lh<NRcC@n3msj0E@(szi~_Nad1S^LB>
zQM0$VcVuLwv9ZzI++0CH!O6*KdV2c9hY!ig$*rxezP`RXIyy;xcr$pAzKvTn1{YHE
z-99q=k=$csZbN+c(%a?<%YZny<O&T_3%~MKMNPfP$VlrX1-0iAuBA#&`HIg&WQ~1f
z>@yxCs+6^DAL+YExxZH)8ygds5s^`Sps4rIB1%rz%Go=$EF{7&E-o%MH5}+c`-OPn
zmJ?2w;2Co@<;Nr_QsyV%hl`F+3|&Y_uBV><o>6fNhzASFTvgN+$>uMRU1eg))i>EA
zAu%dec`T=km{@BH&AeunvX~TegRtQJhV}fl684pX=<}wr!B?*ed_OZuHT>Y2K$*b#
z*LG3Ul7p4VM=!-nmmCD@WLaGYB&L4nTbB>n<2{c~_PjI1ZnLxV<?^!g@!}#nW{B(-
zN^J?r0REs{ER)zZ51R4+%n$3cw_cgvL5{?`J$awN&HF2oBc6AwHI~Mr%G{M%=b)t7
zyD5o?GDPKlqB*T)$9fqW)#)?j%rVCvEL)cIKXw!tp-IS?G*t0rBO&?D%mH08c<?%#
z-zJ^CSGv@8X1|m#wfXe0U{M9!AX$k;4POE(8_{ef!LBZP`fp0FT@Xy!Q&rJraxN8I
z!St9^=#_`t#NEDnZ8o9ZxZv(yjW&O0N%bSqQIS;js+8ZOq$F?VUJw{_0KrJ(4ZJNm
z+f%l##Q0L~P)}1-0Uy-kTYP(%INfY{C@%{aEY4jGFuYO|;ZILOa`*mwM7gw*-7ays
znAfCeKtm@!HE)!0T$gvaNR2G6$VC;Pb9Sy!`H3swUR=^2_~{IzJM)}`#4*iyiMCb1
znQDYX=&_ts45HNQ#rPHUV2(aRA|KQyTlg16+_k5W>L&nOW5F2`*#}OTM(JH6LTHj`
zD*Fec3iX7S;+NCVLr<$#L+gHJ7}3{+Vd4w*8YG{RkbEX@!P)=5C@SK8VANZBH9X1o
zV+JDJ|LkW|TzS!~zQ)IB#FZc5toXMYZ+s<*kYAK7bW&fhdYmq%$U-pk=lgclI(czL
z9v~sf(ps}AV4CYeQmikVb5d;jDlk7739aK+y})851RY#ioP2{gL-Ix&mjEq~F<^2N
zs<bV>Y+io>{>y@jNpZL|TMZDUP>A0W&*gkvstkD48z$WnQ_Yv3$)E*Y7xqxPOe?<D
zh<>`<4(N-g)@5=a*A_~w*PrCT`ac?rr=CyY?hb>s3PFoaJQT~H<w(k&+Vtybtip)E
zXv%Z|C%?{mspP>c3xj6XdH2wyIg?INwSn(@CVJ~jSA-ye^8%Mp4B%Cv)d2(g$ZwrQ
z&pba{^{4@V_W$cfdhh1G>UD|aeb4GtjH?P6;|JS1DiW06bYraGnk<96bcU<L`RBR_
zFROuh=3id~ch+x_e16cfpqS1;bIoe35%#C+Bp>DEdY;;&?|#g4(|N*oNOI34GYHtR
zCQb6VoLz1t!F-iAoT8a0t)F^X+r+grMgF<yeS0mD%XGo-0ytnyJM_HAnKOj5G%T93
zz#GuvC~6eLT^b=00$6wfN6ISA3jKWAkPJh49mViw7i@Cwv^kB?b5<w`?i`Nv5{6RN
z3+(Lo|6gaN$H1(LF9``bXzLAnd?3x?Bk^H+`Rc+)djqy?1(U)mzK`$PfHrkDBigN6
z?T`*eVeVL|0eZ?ccVsq_fy9Y~aF%lmmw+|B)1)DYB861h-}}P#H2j>3?~}VmryT*r
zWKKC$qqlbYc>p{1!#VR8c6P;5^<x>aLKE`*{2x*m7bn)lu@Yk$ZtlIBHC9%OmR`mr
zf#-3gPZwGx`8Y?Jom!Dv-zt-X-Z2_qHFuYb4lRy-)WmAZ)$z^TZ-}o)QlNlgK9qL)
z?@lAFl1tU^_Z(Xrxfed>ul=}_E+#7T;2xi4$FQ@DlB!3BnTB9TyHg~Y=97C!un#Gy
zXrvYSJwn8_1(%*?aBXh*!8qJbHC<UVQm3$h(`rb=laZlHBkSwrSyp~<wv=>%u<>(;
zxF6T`e3E{3$ni{{vokkW<$tP@sQcL5-N_Pay5?|(<|^n?Lk2wJM5_g7f^=B^k>`2u
zOBC6ZZ6YS#1)Jj-BW9GA&=(%}AG;T7{3GBgEfdoMFPB@>Dg}lSg_s<d*Cjecjs<GL
zi+VykwIt-E7|M6w!r}c9qD6`K3!)H><^Y-ATjJ-Tx%hWGGtNridWjBa?mh$!y)T6A
zH0<Y8)Zj-9k4odxf2_ZZ8?3~YUXo(Vmn<&nCM%$REAXMFSXse}ZwXKKjQlUjc9!~X
zZQB<rwrPb#Kh`jij=n5>9k<qa2c43V>u_mc#zjYG(7CXVRMr4o(XY&amvJrw4OK3t
z%vbh9lkV^ZGNK<SrYyA8o^$1iLZoI@&<v_I3kZx8^AcCp_Gc8SPkR{vrr)SVzS#||
zWJ-=NRo%s}-OM!kl+UCoWpCRxsL62z%RP7MY6T$oYqpfiiW~dRP1XGwE{{K(=!W^s
z&%Eh|dm&d~e|C{2s_B`7jDZj5(xc%ht3+Q`nJH}ENzhfY(>;~Sd|9PNsx;p{)G8x^
z1vVEzb-LrQs~c$|laYDCx_2e#+L3}wzPWkezB@;-Br`0^RF{yk4=mf1j`{sbd*IKG
ztO{5U+J{AtR%^1;(9*!%zc*>Iqn9$3SUI(>SAunn9_l9|XYcuajb?Tg8tSm!FT8@f
zcrAD}3z@A19h8ZXeVTRm71=bU=w`~X^?7si?x3F?U9{}oT`_sxP9+qgm{MOxzjtHi
zFTNx76W5eWJ<LEcH0VEVZG&FS@8$I*iS(iGn8pw46tO{%2FWp)M2Z%+o%Q~hpq^6A
zbO=$Nim-fYP_6ED?%s{B;q6L^3})}$oI^qDaKoo2*yZ27$%f|?`1Fcx%VzLv0Wv!n
zv3)uqW1dTV0}|{eGaS(Plk*dgJ>33P&KD$SnUkxMDr6mLBhpy+uPj->c$PHcRnEUM
zXz(Mu*-H2Oo3s>wKch!6;M5hM-4qR{uK2(5AsurtKwxS6Oh{tI{+_QX%R+)a{;mvg
zMYh$L^!0=D_|zc5Qp7`m@AW$+){E6w@PwpUWA3&2*>MI~)qtX0b9F;pleTbAiSKBw
z)|Edk!PU^O2yl%xqA?_?VwDo;TAZjNL!y@<;cAmMe1{=IZc7FGjXJK06&o=?{#LL7
zm4v&5Zg#(a0g4=s+;Fkw!vY+|DvMWx%>WK<7`?N;HfkViFYk76$t?wdDgVlKQ;{op
zwYlks)oRfmxi&8b^?|2~<W{A|K%yf*FE!clOMy%)%6c1RKtFqNNS-Klsk@E^H!TwJ
z`AJSFB1(;+?b*z{1lp^rC<m~<22&hLrwJHlw&6~+pnAt)^y48Z8AG0Us+&{TIogCY
z?U+T>Gf048GcPgTmZ~8c_?pLHx8Pr9pA=4mFR(tZbX6V0ceJf)f|c^vO!%d*ybhiz
z7h8ckwPxpx*NY!LIg+jG+Uv@-hzzi7e$^HK#$Z>=nmb(r($ELCn|`Hb9M&Vg?9_?h
z3d)FyrF1&3LCjCJ(JHMYE_blbD(^TvnD%lwNY(4!AjH(z@5a8(LzqSU4j}FkQ=J*n
zoPg<|d`G*A)neJZZH)v;&H~Q5Tu_tHnqZBm|0O-`%H1bykeBmaHn0TvP%-pdrD(h}
z->PAO%3@qG)6FkM#(-Le8U3(-87n0UUL|stz4J*JQTZYY9%IHFFIo612!c|yI=KV!
zV`$KfsL&!qjdBwTXG#3jlGAP8CHTklv%G&&vUyp+^GlZidH?TEa@elY#?f6biQ%j`
zelE{T1cwx*=Xd-Nbt*tpqvhB~wE?)j&pm~<^t_X~lYw@!F<_Q#LF@z$c_b#AeVGQW
z`#QYk<GjYVtj~H7PNAMoZ?-43bQPZ@a0zZNv{%=rpNsO*#U0v+*Kv2&*+{@l{QvTb
zEHKH2ZQaJDUo&^GD-$T->0pi0R2A2G_hrxQI~^H);5$>syT6{xoXp-L2Ga<=sA*Wv
z?deUvqlG>}Bgr_hXW=9j9_#tf&*ow#J@~{JwFCYmx0Xh&YS5)wzl!vJMcFvTJ;A!d
zV*N)eD7btW!YOQ)#zp=XBRL~E4i0-l*nBaX?L(lKWXJO6e3P6OE;l!I6|Lyxbu4~i
zXc>(tr9rct#yt23p-J!79^hlk<~2Gz*UH`{7t#pnxo|D$%}$&rd&AKBd-t6P{<$91
zYS$$RNwz-xJ#=lPp6qN4vElbZ`gODmnMJSQ_(Ed?Z@gmtXX4To^a?=&v-0OOZ&b&b
zvVIVBUyIuwPv-f+8YQ68*BkA`(AL(_Dk)$&xkf7SfE+tSTY)6I29q0kJ*<zl7H9wX
zQofgav^))&raQSz56k}I?BI_3LOTEJYlGG~#?iCjEfVKO$dIm@Fau;lEn_=R+G<ZG
zxjYSj`rc|U6Rb>W6yZvob8z0g)4B86pbo(`-LX7C8}K7_CuCZ3mxQAKw#&f7Pz_&f
z4!2l(hB+NJ4{Gs<*PnW{ct&1v`$WL=L3vy~lZf3{A?OkzHlgY%s*Viw)I>OObp=*d
zo^B{5nTHs~Bp>6Zd&m2B-uCEx%;GX>WTm&Xu-8|uRVULG7&V)<FBJ~)99;B0go#~4
zk3Me`TDD9k%dNlmddevMApFK=F|^bL2894r#ouq6z8+~H)4Dc)*&|1f-m--YYU9e+
z?@NO|4N4oriD@h0gG~F|hfLY6NRg|@>GmgZq~{*qs&)0!_6^Cq4}?YMk6pAO_YDWr
z7gg6J2)BMTU*38-t0NqTypY}A2&-5{nrjgldrFo&CZ*Q=wex>APic;3^|x&EE)CNO
zNs3tw6_GjC%$w@QPn0jX2n?3(V!F>ouaxUQ#<_)@b&nuTd-n_Tb#bX<VfG|(V(t1+
zgLSeW!fywRB&AOFgNB7+7YX|puu^;@U&F*2sIiMP_%}m?BDS?_Zv43#lp;`jIcb*P
z;c#dDr<&R@?09PiXZ>@}GA70Bb;fU&*Ut9d^E@D2NPoxo`?4BV9_pf;=h~M1R><+w
z>()RQ$NkU2Yq4wF>4)avqI!$PdFRef)?r#Hfe#Iy*(-s=YRjFpc#g}eCI+VJ&wvu+
zmalKo?{)Ox4sZEtD=k-Og;G7uS4lcOKiAfLxV2J{rKQXb^=Z-oj<Y;JJ-+dvR5^GZ
zyyWF!1d5-*G`$t+F_BUS7Z}iDLm$)@=XWMnUO{kkH=Nct71<(?$!6$ubq!#16d%tR
z_TXm(=`F~oNUmWo@vUWe732L?jf`0nQF5sfb-C>I)X@w{5kzn*ZIwompX4KWI9&Vq
zT<=pI7VCX6H{0edGD&0MEgGTkWaX`myn&yz)fsni_2K?2b@G4!wt!}1Jg#sQGilZP
zgwQNt2F>!Ue8?px#L10aD{ODz;T~GqoM=uE%dE@1xy!`z+lPw(t>$iP_axb_N3f3r
zf2`x;$E*Bx3x(XvmkDR>zZ(Hbt;S8arCoOB#)bV$YD&JW@sqLlz7Lx}7WMcMOS5RP
zw)<OABEyuhV<1KvG?6)axg6+p+wp6al$m5!`NfVU7~U7&?y}t?U%f#mY=-N=tfnz0
zrr-S&FqF3<D++s70Yqx1P^@}BRF7lVBne>#(X<+lso@V7^A2j@Lo<6Wzh}z1WdNu(
zk7GSClNl+oHAWN}ELnpOoqe8HNJ)<rTu|S;tD^H&4v?j-rpNEyB2@5<^5#=G?aisQ
z*H<8fN~Bc#4lfaw15!sLSEZ(g*<WfAA`i&UYW%h}NzM4dS?%6fZaI_oF2#s-ax>oX
zWfkaNQqZ^puAz<Em;GY#2*_wCyxh32Fz5}!&3|hm4w<<Fmpz`83tnP&<`P-|&W>Gj
zN9w2lQ2nU>;o>l@xx9F)IpA8gxD#|-$eauYjoCE_GrYA4(^J4f>IQE3Qu63=$YKZ+
z<?bEBA+gJj-fxqBOUe|OQ+~VY=KMM?QZFJ&o=U?kn*9lTG`CSWF?OT6zScdPZ^+T-
z9HAjQSgfe|bUfc|PiDKKP6}@o9#6Bj{Em#)PuexsP<I*)mX5G3VOt}KFiuWOxxun%
zBt$$i{c+Fl4iw%oLoq;pCv*gtu<jbHuEp>{Z!asJS9jLv4MG#nINGZK1Pq9TJI&WD
z`WynE?n}~;nfAwOw0qFkS;Nz{l!2|PUK53?@M=Y&$*Rp4o?a@_{BEA2H$7B+-ZU+#
zu}8E0rpJ$m%bPU2ZmuqEO~Idzyy-KQ@K{QtNjk(eeM8<PWB^Z^x_*`Eq2O9xEAL@Q
zsN?|MFJ>)3=TWcc(@^+VndtIT7W~(-u}cx11@%HtYIL?l2FzoXC<Xal8Al^K>U<sE
z6NkAYWP`sO16)GDJpBh3jV8$V3}LP#oYY?JM{Wt6)LNR`@g0mLHz5q-JQv!Mjgef^
zh*lW<`R!owTQZ#Mo72u)P3F0Can<fs5)XOcZV|Vql5`Uoz@uUTC*`s8Z9>txNO=3}
zQeB$%S1FwL(OOMSBto-d;5x2OFf$NA#_3LotWWnKW2vX-kg3hoFlDs39-f#SmMNca
zZtt#9_3Xx+{)>K7fPaPxO6p{t8$g4XxJjVr4_~+zH=kuuoTPDi-eSt)mYsdJ*Y8f-
z1O2PZ&o|QSxi;I_Z)3eaKr3p!1_zTh`25GwqS?0FGHy*4c8<if1Y(m&8JkN!2c|$@
z)T4Iru)rUx{GtUPeSx5K88gYX7>C%hFnWF4>=`8)6IRuZL;IWP^1A0&g`DBXzb@+4
zC@TPal_~goWacma+rwOB+hKKr53ZW#F4DL5Y>#KkVM=WPi+i8f4t2#2FVhHNN}ZdR
zJRuAF&VwZzv56cthem$-hNXkNwB?m`PmK*&vD#PAhux<36x!<*o8=5>V|CF>n!qyN
zt9kZ?uigW+gMka|r>@t^%C_N#*_f1=>*(ZuYbsu<y-``gHGK4!PJ+O12d1;QAcR;D
z#&+YYO+6=iPoc8rb!y~*{8f({j77^$i8)e2WEf&49#Z17<r<z82)R2<!L5{U0u$LY
zF#^y~k+k_|+|Su;&oVPJiW;St$isgqmTnGLa*y&i+z=?snOb|4_?k2!@|Nx9);j?o
zd|277QR8KMi|wzp=ziW%iSkdk@vOd^3E|?4Jv>9t-A{&WhvxdvCXgBBOy-0&^^44#
zQf==9#TFR>I|*Z1DVGTHfOxM%!B75ZeYX*>LJqG>HM@?cBGy$8R;TMSMsJhhrj_!F
zYzFdg7q#)(bNK2LBy=w*b1YZ$oD2>2hVfwwmiy*{18p~7C)1O<VvKQBE8ZB}VoCjU
zO1|Z<XFrLB^lx61jD{ph5falI`^UX5qa*c9g|IpM@#_04<{RA?ystGFX9yO^P;W|u
zvm{AQ*A)u{zyD@o8FZIta`+cpp9~|9GCh+qcO(tI2sQd#C&767z!Sq~G*?D(ghJn-
z53f^|REs?1hb}bmG?_p~)dZ5>$`6-`*VzoL6wHpR7FMW5aTeFSP9Y_Jb#DHAmg@yW
zST)Z|sioYAx+!6xJ&WB$uY9qyqV-W}0@LWzzHB$`%8#|iZ1Y`7Zk{1F*@~GNH(}aL
zDn6!T4PYFE<JhIH4(oIq>Hqm&Xuj$8sGIc*H4lyc>pN1XYY6678tyh@wseb-(rX#B
zk}2B$ELhKF&Pto3`myhE5Uq5A@vu_%fxdXD;=(FQY!L-n7ZCMkX4zb3CROacG-3Ba
zl#iJ(z~V=7!ci10OX+3V^8rzZ=p0K3%bjFw;veX-p(|M(XjKgRR(v1}(BLg~5l-;l
zzH2$pw6Nt{QM_CX#;sR{NMvrFx(ni2Z0*tY>ZUPcBqH3)Xk0s`GJdHdVEW?qyBfhd
za-lZZCOx%>_d?uoJv{iv8=^DCN=1}BnWJMw=-WDMv2Bs$Msk8Q&b~gggq2b?InY!K
zws_%sO0PW|6a^>Y&3SwyzA~FfOv)%H9zXFSek#-FryoLxAIlsiCAneZd?Jjj`H3&(
z(3P}rxgvBFoO9Q|Gv--cj*-2-BrbpKY&&4$JHOQD)1FCc$mXzT3#6A+^_z!Ce(HIu
zU14B~bK{+$58>lo7x$kjtxQIwehtOY{n}bs(S2ZJGP^CfgK0#5?A$e<EutcD8W+_|
z8ZHtU77auVzGhhl)6ai28svG{5}Ex5G02Bae-XBI@)c@9SeRyeI7GrBoTTlhYq(gZ
zx3%0rpB%60qChn@W{YTI>?oQtlm8xCK>MWp;kK37T-O5MoG#|w^Tq`vW^yjKH4<T5
zX77n+B}mYV?e<V;^xv%yp8QeQ+vqDRfwMoI5zeAB*YvanziT#l4sz@2qVMm!^d?uZ
zby2Y^r@smIrbda?fPv%Dm*e@&%N>Gy?7%R040}__?V8*1HYJ*86t6sGj2?VNCic3{
zLMxofUaz>P%qE83);0DSEI`9f%Q1mj<Hej!ki@%~4=agm!$t)Tuk0KRTg&Sio`v8n
z({D9kjI*>JD}uW*i&~eXc!y3%v_sriuIPA**9G}xxLkj*C(Ko)g;q#!t=#L!r~XfM
zYoCzLPmV`wPmZ}_HU<{5FId@JK*5m|HCNGJKBX~Qh>a*2tdr-NbA1%OLjyBvZEUH{
z^yb9uX(+!>K})__3bI=Ykx|s^@gF>sGxysj`hq|`bC)xzsDI_WiP_4WD#e8UFR8Af
zyjB4VXR#3L;^n8kD~u1V9ACfNaSMe^_pA*6m}<JFHJhJOyQP?RCe35fb~9C1H}m1G
zn4e)upEMlf#YFFcE6$j*M(?MreDkwToki!tvf9mbFWdUXck?zbyPb@z*y=Fiy#ulr
z03Tm;c}eGo@tmcIb^DR0gL9pZLoh<gR#Fr1R*Ln)yrRfME={><`53b01zXF07f6)>
zZ}A&gT(7mRHHlKteZdfuh(yDxU8T)imc=8kjWcuMoDsdzaNVuPMeV?0;O44^&OK9&
zB$2(#UYB7du;+A5_0EiXI&_y6d|0*#Zwop(T0D@=<=RuP7r-17H~p?_qulz+LQRJs
zLSdt<NoL@H>b|mkn@TZ4C{3K$W?^-qQY~rbAv~BGD&ev}w><BXBqR&O#0V+tE1eE&
zv^I&oi3O9YLCBCo`#*d%yFMQdcptBJ#+BmA#dce*QDTf?79WQFzV^@kQSy9JCgQgb
z4NRgHse!7~%&hNd)DQZISlAYY=EysQhZpvdL&?c;5hObCB??ix;rG#smoZHKMXk05
zExlQ(HwL(&R)n8bw$->mudL#J%{V)VUMq2+)u&rS7En2N3f&!r8Ud^cxCEbh?uxPr
z3BJo!Zy`%0Xo~8EiZka4%jZuq!fi5KM4CugQV^eqsdT2BNjI2F9bUkcvY%pwLo6sU
z=K&t9Xx&2Nazi4d#>DNdml8lqSSI_ouWJ}FhYwq2HGQNJLA0w&W`mZ$0YSjrW6(Qs
zN`wlDCi?wW1VnF*0XIy8f}DsfQ)8IKt*_xZxGIp?rD54gv}6+_HhR)(2FHbh2(yA%
zWRVOFY%cE!kOZNdiXu+s55gLc5Hrvw*NVX?xc&BaU4Ilr?Y|8Lrvj41XV2e6iQWQ3
z*URjq)ug8g<^DN>l7<ZiS#YkY!OOvZ?JX_RK&q;Cr_F-y&{Wc6e`<m$RlV>Wp+NAD
zbI*dKea4QJb8L*WZ;KilTDj=B8_J$*{0ATXW0Nf4RCT}dFZlCRcyC7-@v(@l)uBQW
z-J^`jgWnHQ{=rR;{1EI`uUeU=$*8ySb@=!8Fi5rB-<axY9hVMHs!?K$mrmtD#Ts(L
z$NVwnAJF#Cgn*H$*44G)_oLE}a{kgb(m(y^io>+%`ztiCDV%q2EiuCK589gRcKB^;
zy)X8d-|#Fh!WcNHE$>)?{xSJAv!oPZ{po(ytBWWx2ZDoH%;;ZWYQIE=T;2=gHwZSY
z$e-0nHfMzru_FU-_tap3UYrL1X7zF23(5aBxbc{=_S|2nYxqqtn)V5P((-@=3{I>&
zY-7$5E_Z2w4bJ?hL7G8JMV^du?SF(U7;dgtsrZJyy%&q~ro*WlLr+CL$FdQc<9-)*
zTxaLOLhKGmQDS-?0?w>hzww|a3cp|9#?IciHVf}=M0biwUM3Xqo=%qJ!@k=CG~y{J
zBFEBK$m~^o>1NOI=(bCW0x<c_2L(A0S?-oZi9C+v#7QZs5dcQDbfW0y`pFJ{pTBEs
z%Qp~F7dKto1V=XS(Z~V;Rg^Ko9j7=flykdjb2+Lu8Df@A+?!eR!PTt!s@5PNzi&Z*
zf2$RI$Uu)0JAbNMv;jpNJH>ZloAW+bu(a*I(t#dsSMgW&hIhEqv;D_mu$dBN@Um6d
zxO|&RJ2wImm5#FiIg`tER{E>V_>N4W0q_#p0i=w0WU}FxX>mQx2>7ZO|NY~r6X6Er
z8pu8B51sYKAXmrK+RYwLM17KBWD~mS%d<;+c-vJ>xEzE0<+0ybiS%{Nzr(wOFVNgM
z%(mahDMULF)+d-}s5{=TDt$H(B3xMB$p4;nh^Y<nC}dbQ%QFOC^7V0<7Cpduc;5y<
zN~yO!PGdC!adS&LPY&P;zP`56@>4qb_jafw<QE6_g90*EQ1{Dfe^GNPDA^nj?Z5g!
zXc^$4!OKjXun7`wRjox&dx+BF$Hrn3nvf!|@L|$xHuv)6SqZ0DHD1uzsPeEPz3W07
zO2rT1d!>O<q6<eF5Mx1DX9dZFvF9BC`^?vZPYBJ9R}@l}XK<uUaTbJuOARR_@K6h;
zs)GVqKqNw8j8h23U?-p0%161Kkhj)w1ya2ZyG6YpPF%beLCs|Q2Jxj$7U(1h`U7B@
zqQjN{lnH^S8BVGfM>W$#4~jnnE?bqHCWLQ=gkSJFl#<{dak@(HfGL!aL=#@2jgb}l
z{@&?sxC3HaAK9_dA1;8pK|Ynh8M=-;s+aunTM@<Z7$msBf(4xS2jKyksoT~xLSrBm
zi&MYa(|XXyOgO%YBfWC=kFI*eNoVR5uWs4t=&GzVZ&&SraR@q9Ng}+?Rw_#ilrI*3
z)6nDgeLKkpWY9YgDlki#78x)Apm}Vsz+OGKlHb{0|EG}4=k^}i0e*>R=>9bt*g{9!
zG9zg1N<mB;j@c-O1~#I#(s}euZ43w)_5kC+QFV6EtYMZg;lt%oymcqq*Md5QiuK=$
z40e#BCS|&m49}u}0Jd}+BnLIsSShBc5AF*RZ1)Hk!Zzjq*bAyDmAa2Ux^La+fDy7s
z;@`}i1KWa1#F&2xV$G=DfqdLQ3U5uf9<ZENy<(IDdxJy%dCE+QpL+HJE7tM!XuEmp
zuyZu9k09M-a~X7K!5Ng833#-Ll7VsuNia+mAOVze?)0P~!BIiLldZ?^^xz^P1oMH6
z)&l597~>m63!M!L;sWXxqdHaN7L7ndP4$^ZE1+xQx6fmkKwkWBr4mm7dF~k~L(XFS
z&sOA`O$Q~|3p9f4)QF}~1iE5togRZ^Ukw7gfcBg_wFheej5_?OVA_`lTZ5*ZIW-N&
z4PBZxK3v}CsW`z(yQzi}kND~;0JH|+vp7<&10U}wtibx5bcsqVt*0Bq9gyw#?}Qad
zVAjgKsr1L~FFbVe&ECr+<$R+_Y#_nI9gaKdq*f@uKuuT%uX|Ab9Z)_~S7;rkSi>SI
zhuS|&EeS>__{d(T8LC5^v)J4{z!Inf8_RpE%NoTzW*0=81MANa9O9J>ui@Xz0x4%t
z-Nb|%-Eu%9S|du~c&BuOl&z!5Zg}9w-bpbF^~A`T2G6x~PJ^2)kb7bCskjBxm1QX>
zO^0rYjr;bQAZPF-cPN~A9727|Yi?$nz(tKIWbxUl_r)(#%gpR*(4Z^+IQ%_gCMnqU
zB}tPg)YC~pS|!{W^YgNvkxJ!q9yNdBvT66SbOq+1xn!k_eYCuBnYkjp;WEJ?TB(=;
z&$S67D9mK^4QVnHmb_=yXHY_{Sl2(6f5CB7fD8@3`L;v<j`QN1Yk2!^NgoBMi{4sg
zg*d}z`H-;>>w0t@?0hSn4XeSJZwgQ=q7lCAaId{#E3+=;nwH{UJ`{ukx<9ih3&1NJ
z^J}6I^<AE-Q@POQy6ab0d4{hpcD<{pUt#_<aRo1hb&2XNxQ>s|sbj-Z4RX)pnoepE
z-`Szbt2aG&HwUTno$<cg`Mdk2FWZ}GRxVKy3cwo+Tp_GOvI+Wh^uOqY@JKUh$%vPj
zVL^g>1%Vkt=HR~beSEZ@ur_iZ(<sN7ZvteZgjn{ydCjD?G#1*?=|$%-sph9U!n0-l
zRW~v1E}9+Nc+7|wnD{AP6@{4A3Ycg9I6NqfNS->7{v*N|U{OihK|vUIgl8_Y_z1$i
zpUNv0vE`r6#dg6t?uX<De$LD3>(}vQylqH0Edh$Zf+rhF|I$~!-N=fq5K*l|e7cr-
zbL9%2YncP$_=%Oumk{K&dmg8L@6Sf)jQ-hJLfPWB&cw<08Hx_JSU>NsIc$cWc{mIK
zHh0O=XL)y#)5UjZ8k~n4T%t-FM*p~L7<VM^<$W@?&xq&BK(IW_E)-(JUORWX3RBf%
zx1^~f4d`(r+d5)FlTpN5pFZ|5Ho=dUi&INj@SX&B7PDra^|S^7Q~nB*rh_wj`RLA6
zvnKZ=OGwRioN1;~F+Dy&<LS&K@%><`-_rxOQ3MAKEX)tw{mVTVTT>@8WpbxMdz0B1
z>$-}PUHQ?Dnr&PS7XQ{nXA)9ADOP*m*?v^A?^wi|p-nXybFh&u9ELkCl=o7kvSo?0
z{)AiJP*&}rfvNtH$V$j?mh=$F#9gFMM4Qz&+VwB2>5P`!;?0~25rFqmZ+c^iFq)C<
z3$26!_V9B0taDPzJaM_04{zqO?n4|R!&6VC+qEBC*-r)|6s`qhS`YdaI<4frb~fHk
zCjGo#ukW>=O0CkK$=oP}8D;T((jOA_N`3d|5!DPOZur{iqSEN2xF)%C^4XFVOB2NA
zM7Yn}wh}tJRLQrd*2E;e7q0*i52&015ISd14~xRb05kZ4>nBCPE!+`m(FU>cgBI4u
zz#@&<XoZw`B2P-mKJA5FKu@2{g$q5%C_nR$mH<T3Nn4d5DC6!gHta8y0`Q#tbTt|w
z34$j*v+e_j&wZUMLlAY!fUxlFw9q0KXWQ^#ATjJUWlZ(pvon}f0m8AFjM_v)SUX%6
zxN#N#t(wN%ePHq)&tqe0W}4OUi)@K$=Tw34wY=5>$rr5$lgd#(D|XVJza?u32QrVY
zMjh`K!ltG_&A0omnGo8E*n_QH8Kl@QJ#P8|VZB$Xs;aQ}Ak&9YEJ`Xh&4UeVPlKN;
z8>*mjF>Nd`eDCrMsO*yDz{t()740}E84!-;Q23iI6a=K_{xsa7y=6wC@#J&VAqMg&
zmaAUq(~-uZ__qT&;6<z2E{;m&aCL_8@o2Z=JQmCZ=?T4|<Dq-?J5xZNZA=88J%7Q+
z6iFFjQH~RqIL(*B1MND(n|YnZ`JG=*_LRfeFnq@~#=t=1%*hV1a^!%4?RbtB51;YG
zdE?RYjz_yOyT?o@cw=koiaYE!LEjn+k42cF;F6dX^y+<K`I|r9oMTR*qr79bWPDk)
zx|ng~7SrOQVo@E-&(?#E;w4@}7vn0s#Q^L$M|UNRD8z390V17DPvn6~0cdCCvQFYt
zh0&QiBA(*8ICa+#-6|!YHTrs7@u^%l`cUKN%suVWN}B8pcZ8G!Eg~TLVGN0R9&zqz
ziGd7wmSg_r#hy>mh<ugl=ru9lquR!{1IfY*t0-bB9>bzC=u19tih@((dWw&MP87Tl
zM2wqn(7|%L8#Nz(cx+Y!mt%yhd{bG{=+zp_E{}AXO|f~A%CR_L{ai``MPzEvh<XC}
zLK!OES`V-+dLm<2@W@X|x7}^OunS;`n)SANSm{=irU{Q5H3$yL43)=k8n2evC;<K8
zMAl&oYC-aTy4i#Qx;V<p0zS+aMdeyujvWm0yZwP&SvEDOplPPWNHCm;B#g2We72g(
zW<7BUx7RV=%7#FlqLqAlslx~W_a5IY=nmBfRL&4Am4M2&#=Dx@)9cRzelN@E4VoHd
zRan?t7-#}yQ&ZlK8`rKg2VX(!uCprxGat{)NP}~zdGq@k3ZiOs_~0ATLI;3Pb+(UH
zo6I*A(lZ7la#h$-V&;TMm#kWltQcsU8|Cp#S$><gfsyQNl=BU~im$W#?m#$(9@!rR
zXae}7(p|MAgfEvSIg@oq76KNwvVK;Ud9Z{ugbn+80L=CcfNMqR@6u?iwqCC7#MZ@;
zX*)iCVV;iQ`V|<ow^!WC6UexKHy$xR3!f>{YJu|(eK!MU2DBl-jF%?!ZTZ@A3r(Qf
z3qxhqUkyH%h7H_8iKU46BXa4{v=yd#krwIqtkwM6OM56qJ<E*&TKT7SOM&A{(o+4O
z$KHd3MG~wyu*#+pw!XjU@JL^}8Sev#GT=);<4fBhW(Yc8ZR!ISKC(`DiVVo1rh$oA
zpC>2@Kq-V#hK!f`Ij{j5yY3C8k^u+RnEM&of|k>{g0dlOt$em0Klu&~rk6z_W)8x4
zM`!p5$NJowAxttc;sj`J*4N5GVC3GKJ+u}~VL2mMu^p{^d>?3g2N9zc7h{)qF_=70
z#+66)mFa0uj2s*8=OK!ZyKqMZ!f$X*uv_H}czob4dpL0t|1n%)>`F^AEuIdFUktN>
zx~L<!>6N|za_;m6g8%D_LQv7?yG$wBKZzxr2S=H&@`*&>BMmpBjnJfnXenF?-fVZ<
zEd2!?J1^FvMr+=57~oV#syXYRQbz?)VkMw6*`RAT%sbvs?3S}*iN_PkcNUR8YYcd?
znJUByck@B|1Oc6{;;y6(j0SyFb$n@5$byfcc7Q|Puwl#duYeJyjpnX3+sQAxqw#e5
z%}E*Q*mdvU%2s!RBn9$ZCNghz@-=UB#vLy7=iZfKy3dJaN*8^FcYE5ndMogB!A-X!
z4}VdD&~ZTMcktRP4<)A1z=!U>aDcAd6TmR3GcE~Y-CReULJ-PeQUS&#DF`%*sduDY
z`ly{1TxHx&1fS#a5VKvq{f%%T=~;GfhC<!$i@uw(<S4lAX&}8U5DGVZ$j<d}tPy;Y
zqRGf1fSqyVUs_o=HG8=7US`!a@<^xuijcr~hAP24;V0YQeTd%hviHLJRJiFx5mf_#
zy0hUcY)t4TEisJv5*^DYCWGw=p@9|r(>h~A@YC&eIbbqQ>0&rhfvq{q2p=Maqsw%|
z9PBZeN$>V3w?}&4CO!HQ_mcXTZ~fl<$<dE544WIuU?6&dV9E67ejEpxru&sR3u(@S
zeau1r?(gQS_#?8Cm)-5{h}kdqwq@G6Fom0|nj;V&HtgFoe{u$V*4s+Nr~M5bf;F5k
z<r-e$*}ZTg9}k#e@9OG@%IrUDK1Q`3XpO|MNFTmUILMcgy+p92IaL>oAhU=Emvg1r
zfv3<D!ZUK53q3yM=2${blkZcvS3lZBCFaMx*?e49UD%}k5W;^#c#!1053bg^?(GQM
zxj||bfT+iH!La_wCLNI<DU;8>vY#dg+&K3qx53KYupl_|O$6K`44ezPDGdo}&iURV
zLFihMK7OxRcOND8@~<RHlAE0mO9p!4vD3tQKMil>M)7Vu?^iQVf!8Y_WME5RDxpvS
zZjk*W)sUb%@3TJ)8A@M$QD_@bxoqXnPP4fbe!$|ZdM1ck{C2+pRC-Ywlj`<YUd9|B
zLx)$+Y-norY(+keDBU%Y9uVIgQ%+xhwa!B%twGBHhW`<M>)@B)&~gY1i?I+kq@-u<
z7-ANNmf165-rc0lL=<10vO3R%Nxk=v?0z~S!X9Tkp6u4Ht2Y;zvmyT(RjvS*&0{we
zjV$a3{de&+ssa6XmT>t@&(em<CooZL`zzOjYq4V45WC|o$8r?^@d^zr9*jT!aVD53
zLTSkV6(SF?{xglFxQJ(9qWnL?z!dQOpNxYBp9Q9rLgeTFcHRGyp>(I;w^qvMGQslv
z-zx$X^#o{#f~Vt6To3tQne1f>3{wJ_^V8zPX<$nKV{sAYpsz(4gcnRtBTO3*M`Oi;
zWw?!)3n&QWZ})(aA1~q7!QS`(Rd}Cp3l1EFZ{SG@HlX~!J)^`46&u-zqJdfdkD3n5
zN*g1H11F#PcM!R>c)|;Is=u=}QIM^sfw|(moyMM=!<6#<kJaf2y|Ndm|5ccch@!q>
z4ZcSp{Z}6QHGC-BA9<%~KbYRbIz+m%5K%|wAOCa)fs-T<U;B(d1zVEoPO+jFMMQsu
zsD<Kj@SfX%JJrJI=4|<;O(|ArXCn<vzZLn_2gEt9D(8*+BveBK_7V=k6KwAm4SFuj
z9<M3y?(K&Nc<AFw9(s)9K#A$Bf^SZZ7LP<d;P35d!V&PUsH(JT(*VOn7MRu5$`wj*
z7v#^%tcKg4+!Z;|{1G$D!~;HtNKok0VfbQpyewnWj`mT>T-{SR=N(~yX;kpZfX9v4
z-o<xC)v;e3-?o@*MdFH>X_W&er&*!)h91%thxab^QD6HRp#s!TZ_+lETBpO4fl^Hr
z9Bg_xU%qhk#Y5aN2a1B2U0zd}sQ9vaqpX=J2?3YVU|H^JJjr3kL$ft^b}R0fjAmY8
zz+c>1=ezfLfvRLn9*}T(Wr5F_+wD6M|M3}{;5RY+4uMIX+(QibhCRSJfjAwz5Hw5}
z*q`XUj#$%^+;st8GW*+88>zT?EEkhwA8-;D+}AWtm5vlOOD^NQLjk4`_lx&ovXo31
zN!~!spq3DJ#N<azYWLb$y)Rt%FzMv#c=--~sL(XxhCN|mj^e`*yuR0#OtAd|A(A3n
z=cm@Lgfk0{78Va|X$)jOKe%pBQ1xxPngrL(@M^uxXm;kWW;~OTtRvAH1nC32(^hW~
zv$Xh9KbD&~W;*%8uP^@8suI>K?aRMb#+)Uzaba2H0CvqW-G`5R<c*_5^PU0tF?aWu
z;4^9rC63*W_mLuQ+Ov!;0p~qZTXl--fqR(ch0f2rq41Rt!6IRB2Jh`}rw|>A0i)cZ
zJ670`<sd#1twd;6n0Zuniqzpq30LmZ>Bl3;(qh=&iG&di_ZN~QL{GOhDk{2oqu?q&
z)!2LTS{U)h_HY&B-zt7Sdyy$Q<u*e<^B@Q}UEEx+vBmfJB6wf>?~*4`@Kqq{7;T?q
zBYX>*_dvM)=H&T*s$dPcX`3=OZ=84A(Q@CNBbC}y5*oCDmrf!kSfHJ8fD4<xF4p%N
z#PNa<a$bR|L3Emc@mtY6O+d!wlZVouu``h>>t}qArHKn_moL&q4ASCH8f)s*(-E13
zX3qzInl!rI|L{nIAMC%5{!n9}u#9OOJXjcidpa_FVrQFw^amPVx{Nz^2cHH8QK3XD
z=)Q&U$SFu~tSI1jYux-y%-4nCqFyFxy4xysL!osCLROrhWPEUi$uuUPVPu3ATx6@G
z)vk}KX0Y=5;kQumyFRL8JH9zw>Qy5nZxH9CJeIzt(3r19M9ekvVmiW!<Q`&6UN<i#
zLoz|=Q0)B0PM+==0aBc46E{Zj8Tug=!2uJ7{dA$&+a!})2*Y&BvHWJhTeJ0Ma@1rn
z;Lc)Faq>-*wM2(LF&41$JjndK7Q#}>1KG8`%^ZRQTOj+BhCC`mBDTNHS4AR(Or-H6
zp&%*eyS~YRg7EFET$>9*D3B18B6o02{DSUxkSVpj<O}!l63VGC)8~YYg0=8GY}MkB
zcp)1!eN6R~bNEM%i$l=p&sZ8OLBJ=2?^ESv{@yax?q&@foo%5eI<zh!wXeLQ;^GGi
zg3VuK8P_DvR0C&U!+@W}y~S@Q*VWIADVFp$3t|f#zotCY#7Pxad;Odn4+jL&y>H=$
z$^Q^unu)CkcK4<Hsu^IiH3_fyY-{;{s+C%a4`l^<CD)2e5InU4z}u1h59OB0AAU-a
zs<@JZAO!Muja6TonXxhL+>|K#!D?5cdwL>SXdUZ6B-<-PK+^7D{QS4lCd8<xJQdn3
zZ=t#-{0{UdEo{-Xa4*6j2(b;O`5+f|im8jp%8Y%wS%(A%AWqP?O7#>4%1b`O%FzUO
z4AQeox`_sMTNZq6ukCwZ0K0y1OerGQJqrP8GH9_T?2N0GTv_7}VeGBHht<nOK+ZJ^
zgG}SuKTKn1Ey6|e7V?4hxn(YB@j$q0E<;B>!_Y=eH$Qd|cYE9BA=*>a6@%Q#S@z%A
zuOFmAEB&oU5ZWm$6Orr-oAf2lMIV;ipB!o4{+Uk|e97!1cM#HJJECr^=Gx1TzxPuR
zY9@fJQ%Ja#{tOK+Rui~3XKLK!x}PK5brv^#?k`vGv@%Ifv?DY#fa-<n`0{i;H&Z#i
znYv<&h&=v}p*>ts_}qkeAfqeT<8OYD0>fACxiB@cC#*5GGcaEx%<#J6$%NC=xB9I|
z(FV=BPS4#YmXm9?lFk(lfiEYLPG8(mf!MEjF%4`;7AWpMrN4q@UlJC!nv;Sp=!U@T
zKV#p_Iz|1YrbjhDc{0!qLUnqKw2}THO_d=8#?}U!d803raSUJMH3irLy($BX+|t)Z
zOCA{zrptLeiNC)v{z#KM<s?4-MW+7Z#fI5*FFkl+7(f3~eZ6KEkz|{?I(K>Hnh~8_
zY4qgzQvloeFGBG6H7_)mzm=D-Zob0%S^b`ghJK)8xGry=%2s&+Ta-Zo_Xh(?jqCmz
zJk^&LzxsQv-Gqq>NXum`2Jyb_)k{eG3ANDMTsHEM!#V+MGZFA7j1|Ok)j_-~s3U^%
zkDH?ka00r#5hlH_h8skRV{OT`3t1Hm<DG-<>xIoz7CPJMzE+N*vk|o*9WVZ@pEj!=
zm!TdYcvrnHwydIrm++vgWTHE1hzXE8Nn-k)JSSkR7v}27nx_$2yDJ>uAS3x7Z|M;3
z4+L&kB$3A2DJ<)*3q(K9S5{lKv~Kfk&FOk?SRi|T*s*(C!+Sioy(cVzOKo)go1M8b
z;L1>9wlx_V`{?=H?$G^oxw?uZ!*WHBmXaSd!uBa%Tzdw51pU)v`kxWC;Y62xvQ<7L
z=50RZd7?1l!=%(&#wcFcW$V0RERa<A<ZkF_*7wIP^|7TN6eBg_pDfJj6$;vK=(%YZ
zym?$NYgOYMkurW~k^Wb9im+;RC$$GX%v6^uKw2Zi_ItT%?#fGfV4MM8Ky_g=KE<$y
zE@Xu}PORsPMj$xJMKSkR*FQ$jvZ7z826d_0$1LZImueTkciGEsEq4fPZF4|GSO9tp
zDA}Nrj<4Y_M8sdMn&`Quj#22BnhzZ5vO|L&=rJ3P_^8ym4VDdBMQ0X6Z5gLoKu)n1
zL8-p?^2u?a&D?`PMt0`~$F&-I;?xb2)1hBCbXy|`ipS>ERW2Ly#5^|sN_Ar+U>tnf
zi%vRgZ>XB4{$+W+dV;PIUGi}8*_uANGLY!pFzBb=Oi9#u$!KyzpY6wGFr{l%yAj9!
zY@KEGxI^YZfG=qV5LTz=<Qa7|aug#4ue{v+C^*l1+h+n*+z*>=I(W-o{2oD2l0vfe
zwIb@0X`w`6hsu?Pu)g`Yuna__4In>^XbO9)$G>Mh%8KO=hgg2QYS>@0FCkKqd;fKQ
zO^9<*_bJh11Uyt2eOJ}6Ec;z6q38Az`X{PxU8H$F?X^7%VI=LkPzWRVRfzoxXQ|o)
zUc(U4Ur#d;^-9yO=D_cJyouVc^(YSO8~mwgV8N|?RpCo{ZlNjXxi__n^*;I=6;;ob
z-nJSI<5^BnttgH(NKl2|a&TT$;DWe}rki9maxg}i$7tGhrEwAmu3$}hB(6}^x4iz1
zsjhwZ=Ya4lz==+=Y$Z6T(Cgtp`2VONoBN!?t@BEMMA}CE{>x$4913p?AG2wJ!*d6!
zak>4Es-ti-MK^=xZmnAIb<kYqJBvbyLb0j<g5EpWXdEIQf)M71cH1)FHJY1NGW?i+
zjpu8tUt!oFtSywlI2G|>NUQ19Q!eF(#Z+Fi?(P(mGg;lbZ%0eEN}px)Ez&5%I!?($
z_WXVbP@Tj}zO5k%X_8YAKmb9>-J@x@K^Uo?UU6YrF~H$RXr0z<Ryv-SS7!Ju_yB>h
zz*|}SQv0nKgnK|#_ouegf;0RMHLmA9g75fVtnNi_2qPziyvX=z)A*c^u)caczglRW
z(nxujGYg^X?HH~jAz!fD#n%6-ki|0Ne4Rw5nII&k0ADyvzhyKh3$T6H1xUNIze_Pi
zvca|5x=Z(*ov9eVepcwDSmsxVc%`$o^ss7~W?dh<_cM{$^ZunsYEVWgg@Br={tvir
z)aE-To<tc6V~<5)J)`3#Pgd-u@VaIEPwsr9oV5PDyNQEd#y?a)+%GF;WcbzBEHS|j
zb(j?>@jh&ycDA~mt+R(0ujA6W+w;REC1(E5!<?*Qgj=4$vmS?5_1*x`=~(B!sH4iR
z%fZ5D3&+LVY0>k)Q<osKYrSe5i)4^q57&16&9yWgb(?4u_utP*;Lo{_Wu0aYITyji
zo*q`L3^>qLmtE?XDf{Mzo8OfM`6oT}z1(NQ>Qz(h*oG~Aeq*b<TCluRCbdd4BSqRK
z)%{!GsqT_bU51X+OV?|wra7>QRgG8gK!>Fv%XH|K-#IpyYbA*P>J$SXOn^fl5cPh7
z{WbKs-V+Rv;c$3F-Dmac^y`6xuWstjf^ky5Ht!n*JK5><Q9>cfj}+6>-l64Y$NXEn
z2g=}~kYWGfJ&$1vDWQ>8gx-8Zg*gz3xH1cV8w>>bnZ!@GN@{8SYzvhGe`$$^Ak}gw
z4J%YZ@AcMHNOo~=v3uxf=o!eAptVvV<Q)8!RuUXz9LoRi<C@dWoW$u@QB%elm8tFR
z#1zB`r=z41G8~zcUMNVpB&3<{B1Pyja_Na~T+V@JO)?0ythF1%2JHGvSkO>hdU8q_
zD;+D8hM5MI*qSO_(mR$R0f#wR+T{GSki!XV#7l4tn<kO%p)BhV!=GzXwB6f^wgR6z
z`&O+sX$IobttH=<j&2FNR8gw+hJSEcd~T)eJ0br#nt}$#d#|j=)13p1N3971UX*%+
z{GMtu$(H4c#=Vy)ZTv5Y@&u%metA8hdr1Q!W+oE8XA-oq`-99XNioj1V^m2|S_0nH
zZ4BX?V(1YcE-^6fwbfZK`hIcSQ@bfe7tJ}9Ywnbr3VzA)P7iL)5ciBh=^22Ij7BKL
z!5fIR)g899IvD@b36-U>e8as@F1o1NN5I2LacsR~rEP8$f+z>DJ*h&JrdtfYZElxD
zQep{T3Y6E<ECSOtM8$G&-mSG}Po4pN_Dv++lR$kXjETZ6Vxb`y+t7a^Yn(Z{Qx1ru
zdN{322Yah0g<sCfKP^pq2Hb2)*v6gPtUfnr{z568Q`0b|P<X=Jp)v{qu|v)*z^39H
zXkg3lr?zL9M7q^`-1vH|UQ(zXua{EB`6l&y)w^X#mwhjx%uv_s33>TYI9c>*ie?w@
z#i}k^X_0yQIuo%yRrWcu!N)+m{iKh8AikM%W)<O#ld{84d!FH>9+O&+D9{>xJk4L8
zX(n;jb8{lQ5Sxd;`=)2Y+`V~a{w<A*P4^Z2;n`3)H1WNmd!<O#J4*(ZAKq0ft;mO7
zwIK){6d$&Pv2$g|7QL}a0#xRwJRZ2QWc<6}k*#Z=N3YJ~PAgG1v-AUuBrz8`r1%RF
z%!%_>N&NixgCVG@2B0~n8B%VyO?)#wi$zh0))Xa#zc}#^`DPoEA+hS^*JIDQCO)|B
z>{GjC6b5$!|CfnhZu3C9+Lnv_+bDtW7b)|e?`^V9)-5LXjqm9EJoy5Wow%L8dz4D$
z!s@)`tx#)5fxRc)n?=d}5h>OK`>*FYJwA@GL$z(`@?Mp?G8nZR3{mJcm?ab%i}jpI
zdg0U$dMh&4<7M$yvl5nSf656(MA@@Meg^(eJ69eKb=UrtXpzTAjgUPR8vBx^o>G>{
zK1dBl2#=YDtTU5Tge(yWS$nc?Ls_CRc&f2SmXK{QXp)S+g!EK?XYh9Qdw<vOy54`@
z|DL~Gj`RKA=X}onJ?FUZ&;1G5K2X=a@57wOcGgstG$;x=@jXu?Eqx!)sABFp!Sr2^
z2Wp<u<~*&ejP1J<12V_IyeRpjU2v9G>pc8geCHY;U{1l{UcDKnuV>s}wr}mdbV#Nh
ztF@S%raPCNDt7i9zWq1@!5k4HAlkErB3-+qF1)cSc(dE_q96Z!WO5;_{wFPpw0b6l
zk?Xwnna+Ir0aGgyP{s;FgBlJBSto+{eIMQX!Wh0b_;xIjFE;+tK3^B>X_=;G8^Ud_
zhs1~1oL?)^0eK?Q;`Hs%)Pgq`mQ4^m_MZ-+Y<X-`c?o?^vJ9#tl_i`MRqpHBH{*MO
zul8iM0^@kVH&-1E%n7m2vd;X9DVkU5_N&#Yf>==6(jfl3ILi(>U`j9~w$@?>ltI$S
z%~QV4M=(MNi?d6QS3LZ#k3S0f>J|9K;>$+>!yb4U8rkt4Ue?(BVP6(9fd#b*>@CmL
zGQ}0$qSU?(ogBxyd#>#v>r7x;<HzETi-1DjCjy3(3#@K|U~wriC{~oj_|)If6cIrf
zQJ<sHjx`f%DIc|Ca0hxt?e^&Hx*GC#dR6Oyb4bqdCbH)VsDAa0((jrQbn6!k{HJdg
zNmtzYylHmR93db4JU<oLnz}z1N2jRFmvBpni$X;a`h9AJ2A7Z7qSo3|cMN|=i9=#K
z%RP`_tfvm(e|g-x3rir%{GB->1&X-v1rrUPUl1$)lshr;X0lJa)Z;p|4uQ1Bd0|S>
zW5kMu`&gkyOwj|!`+VDFKPkPdWm<s$S#pkM*u~wQcB^2Sy=F!w4|NI4Xa}F;e`Q-p
zNBi|ZRvE1C%X+`3Owz0OPyPM^=gS&XtBoNeHm!oALblrt4nx?J*BGNJ>osIzrQY~9
zUg#b%kh}aD3NzKhIw0<`cyp(6ki|Jt{-M0W-v|93#^YXoyLFl>oAX?GBx+Y1CA#1k
z!$!Uq_2p^b&SiMIjU7+tr!VMaV#ctAIYAxXFcom#7)MZXFnUOo{%B?(>T1%SvUE)(
z>aQ!Kt!^V9@U?YnPp2MIoYI@DjNVOWwmx~%TDZ)3P7+3TpOD})GesV6cbHr#GWr2N
zM>SMQcb9+m1+s=t(8094LT#zNSU2*iS`qyUjMd>OoSIqYAJ!d7PN|LdbTymVlx~%b
z;k|Ns+G9lzrqQaooJag5T^TU}99*U(t7s(E#fjVE{T3Qe7AM1$Oq3Q^`G_zRiY7L5
zi>Z_V0%gQ+5t?L%!`PWhe~8k1tVxFcW9+om#*u|?6!CxLnd)k(8BOX<lNl{a3Kd~t
zQ}6Y|dX@AO2GlqhT;1$wX;c(8eJ%>pM$}QS#>qaM&G^BDnCiUyogfyyPI~5UoI1Gu
z4mA2TRp{_>VHA&e_3Sml#!Tqdxtm6QSxDu+^O$%F+^k?_#&?N0?Dw_<yiAXxxo@zF
z;4{FAL<~46|LhlA=xFPAHn=#u*>Uu#2IgALE1oKuWY8y!flnM*`S@BVdQx4ZzA|q*
zL~D>8ymGion>G83CLMTWt9@D60l1J8ruXLO$bpZlIZ<`Ew%ZHgiS!pwKjXHDvWJ*!
zNbRZ23*kniEB&Gbt{F*`d7S)8lP|8Cr5R7U@#q?#l6AL{Bdv<xZAS4&>Qyv3*rwV@
z9y5wB^Z#B&wk|OU!?wj><E!v$ShsGW%D#eBYK=$2z=`Q*x7?JnH^&yO(<KsZiY41l
zZBD|tu6?cRpcFY2pa6nv`qBgPnD$Xik7*JEfmNR-ZU3+@b6fc15sFVH6QMLJAz*HA
zF~JdzZYUW_$vZihJ$^s6qTl+toE2Tdc3cS8zM#Nc?`YG$)bGO0o;<h{4fu-{2f)cu
zI_pzOYbOhM8T<L0Jo;ien6tB?y+ftL_k2#@-nIok&&+q(9le)tyXC4TJICgSJ&F|2
zCmWcSCaLP%hPhD?wsNkiuHA<*U;EAw3j1s1vvjM`P+pOc>n3uh?%er4k?<r`f@)Z1
zsB956Z%Ycyt19rvizswgo>4Czx>J?Zr*>aezT~xv7RnS|>}k*|_im>9NO4&6S%Xfw
z8d5IO@EZg1F1^tYoj0hIUM2SQjfk%FCRT-RE*f&W%9TeiSGi^Hx!T{|0zkW@N7ctH
zHa*IMR~G8v3sCnuQjxq~vBX8sSx|_QvQU{-dakZ;V1d=M`@Zp28g6<-UDO9F>*ywO
z4rM9=BDk|X@|c%9CoGjcl16{<woa+@wuBPXJcZ%AF56<|<fF@b!_O8!AVgNrJT23p
zco|r7(s4CfG${hJMm}^<8ncvS=9fK<iIiYd?*dxvP*1{LwfHLYEj?<g60Q}OSJ5xQ
zytaAlO~OF$GBRbuze&3I!T<86#I|NETr8BvWFI~N(*EyDCgUcr^X4o_4Md5Ufje*z
zzXK$E;GlwaYFNnIo|a}4_IC!D%ffNa&^w#tlX~c<_OCRxzI{O4>}^xORM(&N0G}ZJ
z3@e1Odc$MTT>=L~l~P}@AsI#u7hx5`1nz7tyI^3<+*>eMT5-fH=BnC*B4>NK{puCr
z7Mx(@c~a~CF?^wJWI?W;OEb%E0shw`BZT4~R)l^E|Eli8Q@sZh>o^j8ljY{E>x9ol
zp62y)y)bG`PQiTGQ&zGgx!ryaQH1!6We0)$*f53@eGTH9ORMh05`DwYIxO|$+vEy!
z1B$haZL<4SvweT}7c5dtCO+8aQT-;XwkHq0*N|RfU*Z?3nOv5rpK;sXf?1(WO}j;`
zmZJ-*-P=j4C4*1o)c$_T*jLXl*BvU7yQ?KjEZ&b4slvz?KhsOb9Cq!m0hC%hfqBbe
zdRirarQDn0`(Sg>VQ{rpB))j;JiHu@ELOPy)gM{gdG4Nu9{Q*5$XTajQshOwo+6WT
zRK=DXA<{?@NyJatkU}Mpym2e)6fvVJ-Xkn||Dq^TsC3{eCaU?w*B5-MxA1E(|6<l(
zxnKW%@%BBq9`@(!(N5=`7GqUj;{+!98aDMoA`$R#KvmXoEdSV@UtfG<GZ=P}w9+!@
z<8-XNoM0aCc&<U@+f<$WP-Ss$*7|dnHvroJNpgxvHQHs1dXFiv${b+t*0PGbEjb~n
zGOjI9$a^F3ci{*@5(3B?oiS|VISt}|EjY00NNA%l`?I(i`WT+AVDpY&cmY#~DK4O4
z;2?;-FBo1BOpG50xk)_bmqS%L!%K^%!a>#`OL{s?5-Wk3s*?DRObxgE@MEe2)7xpY
zoS@n-09Scp6tLDMv?Va&g>Xf3@QO)~klX|J%Q5}=Ai}=hQM!+jtNv+|iT-a7lm%Bi
z_G-_oPK{c-Z@yQ0lwpG#pQEom2>3W=`p_hMX(oK*Jo;)>O;mT}G|&H~<r%RG!)adp
zOG_=W%7N3o`j?gl;`0DDcsGebV5n^5)`!ov4jULaNU^dp+X8(B_^<){En)y@S*@dW
zk_yzVU~H&38B5?L>o~284Q%`8mA_&Mj(Wm8J^r&{i|__K@hTAO?dthUZv*^RhIZZ-
z*ld*pB>{L`JIeuSXU@3+zLY6r6yz5JMkAUDhsbqP!RzZ3u{V++7`PIZ^q6GH4EtBp
zztQ+NyMB%!Y$s`YJm)_BPIMJyf7X}J=q{0Pw!#BFCX+PXEV2r6KEP+WPURR<%Pky1
zR#e2h5vZIY>VZ1ahF@sP(e>j58B3h(Wu_N=5d@LRjbA{BuLtmLK!TX<3Xnmn0jzAp
zLnP@&fTF&%;W#uA4?r&$TlXgr;sRXv0k%bO%z5Pie$v$q?_<QM#YkX)Tm|qTJ!*U&
zKW%oyvHmggf8dJfhRtW#4P=mU)t-Q$ld_5XeqM;aCqJEBtOpci{?*7npMEYzwj3R2
zTZZwyi>VD<((oF|W8&Ij^KigyTVJbeS$c7G=oH<5$am!seoTV*;hy}`9p3vGqk5Yw
z=&aTlXf>ka|AA972S0yyCX?c8H9|FIB<j_Z@HH!JV`9J^Xh3(Tv<3-<>Qt^|)<{-+
zjll>;RK~60m-WCwpk)r=OCZ3qFhN;KwfVcgrj;RDPT_$lo9+-1zqjlff;BR2P+6;&
zE>+s~!-_%g0{@o!!o2u^A349F1tx>i0B-eypexDp&lIX<n|L5k<xK}tmSfaSTz2rT
zO&FD2!AJv^@J(X2(Wcwo2`A3)nE2dTH}h<1$kaPbj}LPmuu8A~oFL%9!{!&8{3Ts+
z4#)lNNXvQt9a=tVdZ4wR?bIz%#KU=chcvZMsH-P@HZ&2<mZVPy>e@5D@;(=BWnB?e
z*|+-rX0zqdF$u}jR6BEE_cRXbtQ2jk3!3aKZS)>1w9+%V>?bcdguIdVMp>AV`#1!U
z`lHq5Jx3_5d+HGx*Ag(<O(ID4kkHYDHoP^<=fj!&T+$<^HJ~#B4Zr>cSz(!Lvr)U2
zFxj>%tWV?P)AFd=YP0U(*=iQJ5twWkH8bJo(eu;i&mrbdcQ#&-w9c><1xi0Y^y9wu
zzJ0nho!!||^rhX$&j3!?5jJ?k*A-^&KHiy7;aoU79h%)GBni(&xx;B{`d*1dru$Gi
zOGTe0<EVIGTz<&eTa3Yb7e7Dz)f6R52PY|5`rn2F6MpPS>w;G-Iw(3o3cD7dquWLE
zn4(Zya;2g0>Yw8sx6G){a0ajWK`wUYVU)dpWIlcv`zN|0<^b%)fcU8>f)j}1#7j3!
zqRJDDr)=S6m2*Aca@3aIzOAHQzK(ts6N88V1Yp21QF}dTu78ESA+alBmX0|O-}cu4
zyyFIba<R8*KQ7liKQF0()y~KeaK2*`6sMSRKCX<(HAvXQ;BAk>i${)Yu&=~muNe+I
z>S#V6WM;Rre2#b=LVXLM^ga)6EWWC35*NX=f$4P>7b>fjhE25|UVa;I&90}ZPB4IZ
zY4%Vl3kM7P1SkAmsM`}=m<3J7M<BE48RZiijgsTHde2ggUCvUGH!|)+ZU+Z>Hm4kP
zfW)}c<Ene}uvSF7xR3J-A*Bhm(yC`tIxmCT-tUMeAR|b0U8Uz+xQn173Ja9S#J&u)
z&05{J4eX7cz%S}P2BM6Yp9P1MS_Dhek*sDNS^4_yOl@UM;mph}A6x*+v!kfgHRpY9
ziU&n*rYu1!i|07I#wQI78vDTKG_{VAD~<Pb$cB{-XIwU0Qb@Dx9$OBrT%_&R4|LDx
zpEPCjG}y43@~X0Qc>&vXNR{Q;0X<sfoNG*3?Tq}4^7lB8eSOS|`O3U1xhZ*M7HF<)
zSWx6pW^dx`fpXB;M+5uA-U@W|Ho)dNY4T6UvtT=u#BexoV<g%?nfs26R`g)Yf=a_7
zRwX`A%cGXN;^^=6&YZ?%HMXcIKVVQ9Rn(;c;uXpEI#u+S{_g@3Nb2N8g#?1(34rxh
zm^2hY7??zPE+-P!^mXWUdJjKB4#+@7?{x!WfQeL2@}Gv{?|uSmvNWU#qhoF;15mRD
zW4<Z?Nz!zh4Bg(dx$}Fi`lYqbcrRO*_2*7NTgm?|rP5}=6#`dG4(Q4DS>3H6{f)!P
zYz<enx9%<(h9|oy#K45kSdKf~f%uZe9s5%YuY>wVj>|fKx76-{w(60itKH`XIBw!E
z&5L2YcF)o|4CehIj+Q;=nfx{HsS08o7q-sohA5~x2=d)L8tgB&<v&%L{V(-<|7wkI
zd;qDHaHn|^n2_<)Kks+R$<I~W#m5!=;80OgQAQ|fAe1z%m5*twXlkn}$tx*oD=9@}
hx$XU558%BndAO1O{|8pr=mqRaAob18l<Hj!`5$YF#t#4h

literal 0
HcmV?d00001

diff --git a/static/nic/nginx-envoy.png b/static/nic/nginx-envoy.png
new file mode 100644
index 0000000000000000000000000000000000000000..9b33fd5bbe94ab64255dfee4079bb5c7dd19c6c3
GIT binary patch
literal 152518
zcmeFZ`9IWa_&@#{6rl_$ifk>6vWz8LD2>Vx8HFahnnaO3F*qfSy(}Til$uZ>NA|UB
zM+Pa8EF-dHn=~<Y-^)4g_viZ;e17|Qobx#6(K4^)zV7ROZr4PdGd;bXcP}r3Alr@3
z;0Or9*@GY)**sg}SE6NVY!D8M7$e+?^S9EcGXidjHx`$MWWTJqdMaK)?E2ka{!<R<
z64Hyn18E8z26v>l84by=coiwJNes@2k?G6!|KNq<Z*Dt~5EiES7lOiBN7FJNUPg<C
zy_^0Ts$l#`?X#_KjsA;1iPm_mF~^Tr?0`QhKlAgoi`9LX)3vu)AK4w%=v4Us{_}t9
z6|}OpMQ&s&9eY?6NRZ@^T2LPNp{CY0|1&cn>(A#T*7;A?NBS-nI^CO?oQ&@%5jPY3
zO=irI8Si2}l_v9_zItVxZ(V3`EKo)dli5Lb{GYq*-5%kEc~QO)WImi3oo?}^e0|v>
zmz6*!$r}zh1-!UbBHR{ox_sk9d3+UTrctI6eq*EbYjVNA3;ihjtd&(VEPKVQkOJ{-
z&b5IG-~9>kLdd#CWQpuQTljWsB5xe)!y_=W7H)2@Eb=UW&KHD`%e+SM2{xx~ZMAiD
zK3^(z*KH7GoeK%scvLaICG^Lh&QG6)!yM1-+qciLpOi(THKIbt#z;H4PH0|480?JG
z5&^h@kd3tqNJUYR>RKJAz)d}B+@azXztl@aVt;t}R`tMzX}rI`zna#&$X$mU?upn<
zAa(02%z|vZbD_y0YDcXZPvJkF>2Y~>)wjhv+O%}{aMZ!&RExVe6lndm#Ju&_1qICZ
zl9Ccy?)ga{XA@05z4g)a^1izTV;<pY1tVH^8XYXX<GB0V1q4DaySU`s8855a(0533
z`)>!BiEz}N7WZrzJbU)+Ml0RJajcs159&=!D)SRD<V9`mM&$CJuZ25uH<&*L&+|33
zOg$Q)<=S61E&n<_J$-&)VBjHhrQiV}ST#}xDP#B!jJ~oe$fU58XJ%$rT=O=h!oF%m
zW|c0?&-<>_Fc0A0j0Z3eWR;>j#Yyg4m3bY)D8XWeodIMrIW0a;U@0iLoG{6a<I0=w
zxhu6;$Xv-rEh-`{^tgMDi^IikJ?=&y?Ek*pa=qD8(Z`leiHL|OT3KEW9$8rr!1<`C
z-X~5a|Cyg3*puw|?c298dD{9BTDpi~=Z&TmjX!L*Ku_^K#36{Gzq?N99{Nsd?Lc2&
zpnH7tb3bF7X8#_gd9qfyhb;T-+FI_XV~&h9zE8S>^8v@q1G}={xqmuqs+trO7(bSJ
z#3TDpUS6K5e3G`y<;y>6o<4mlk1QNxl6rh~N^bO(SRFGpv`sa;P?GV<-`6*yl35dY
zqL@g&?BL+Q|G8G_#a{cC+Ih)$Z?5<L?Ndyw{>OJ9*)2~iGRrxMa480Bb(l5=Pb($3
zuZiBH!WtR%3efUfS3WwBlJWPB8s=4s3uAC_urmAMyiu{yCy^xl=-|6|?|uwec-d-{
z2C&9br@HgR8dVu0W@Ej&0aUXu9u~U#wyE<Qdc9Ta3f4Uw|FiDgsL-O`=|Wg`4Gc}M
znZAYux6t*S#`MvhRpH^`wd1TMR;<o!S?}>S*T~#m*t`399dzfT)V9_ou=h6A1`zZt
zMz<iM`}UpvaN`j{@j%u+e6Gm(S6?<zb?|a{k(6HPtonOszSQz<$Q>zVzTHR81ZJ}N
zFr#LPgx2SY3I>#NeD2BTi8pY64$``Op{VmB-s5qq@K<Pwd?<QuWw!zDz8sAgpDTbG
zYHv41Aq4!Ep>vo~Y1~^8MASL>9i1<caDSV04GNj+DG))d@d1xUG+QYyPtn8g*Voq-
zGBPrZ`no>Lg}Fpbsf!@QOP6Go=n26pW*^568L8%aOy$-dy`ZI&q<$gb>vz`;6I!3e
zi|Ya=)gm=|Z4#xI23Tf^r0lt47b>oO<4pMd*w6id??0DS0;F*p)4fF^2Y#jocncdo
z?bg0#A9HPNM$I?HuM!s@44s7=Rdy2JYsofQTXD*sQ*Z3o@YJ51oD@Pd`RjN0_}bg$
zSr(`@(G`<hHL$Fxea)#>x##uH$tNuc+;PZ)&D#*^`^heWMSaOA-N_svIn(#hgT@bB
z{Mk~n&F_!leRNjA)2H8&u4QZF*0lW>5wq{T%UJa#-6OKJ)X1O9J{4G<r47l?WAjX$
zuGl@|zlYsYTqu&#-Q9ht*)!M(rvPQ6KI*kpIv?>!;Zli}Xt;jMWfc!b$&E|;q2Aow
z+=kEu)8Lm*p!qqEA59z3&oI@9j*Alz;OD=detrk%@k^I3Ia^pH+#33e`@K`4=3o0B
z9gG}!Mq{q9!qBSG*f{PJzvTRmyv??`j`e<Cd=!y!j+V(17-KCtmD|(^AYtg&#S*Gb
zqS9fgP*~e<6~0r3_*^Sd=Q3z%ymbO$=v{g9Hi*Y=gQ^zaf&KDH9}J;_tSg{JZzFX#
zr8EfbJ~S%k%rCgjnV&MjdC%bc``Ou99ppH^1!)>lyMV~SyIrc;K#|sC(ZjT*p!Jv&
zXq%ycK_lEBchV_gLy<&0EefIJ+SJ@be-qu=ctez<ZfNMq2U5}Yn3$Mvp6PS&d2(rO
z?H?|yu$r5iBo6P65}W!KAK93-K(3YMuP0~8eLB6*w~O<zReo3NBZb!MeI*Kc#e+vR
zHLbTu!Rt{?H958Q#G75k0xCr*TH>OjUw5+wgBVoKC*{OE%eUQPun~O;j6H~phX*4q
zH7zyZ7|)&i!!=YDThZ`9Bh2Y+qf*&(N7HWTt^TS%4cB$Qabuv>Gd-1l?C7<0nf7Ed
z!vj&a$IwonI#mLArdhUB3^A7zUJx<()zE<R^|DL&4EqspZ_jwq^0!EoVfE#f_+A4F
ziS(k3T4EaCiX1<Ex*3H$DegXjK9*=hec4{a)FDodgrNmhHQ+?4xO?}mpr8@b4o$5I
z`6oy(By>d6z>U1|Tw!}(^L>KrU_%2}G`8NYCx4)-vMIJzmw?B_U|-T`2i4WogiGGO
zeZKI`t)T0%x?2gyIXDp7no{ykpszFbeqUJ+l5U80Ew0Fe6Xvf29Z&-5Dk>^`$j;8m
zIrxFApCV=E6_aEpBU&SZ7#=sp?>i^^Bj`pabALa-mu+bp*_3~B`xXjYt%+qfp9cKt
zJpI{#as+X8b8{0H6N_>xy`i`}N*mTsrD=M!LJ@UKEr5GA|12WTE!9QTD2AuY!F=Kk
zRaH|{+j{&;Q7<PUSNMub>dK+E0C_+O(890@E%c0(6eLt3p`^g1dEu&U&%i4}uBM~t
z4o2|GOx%~!chA@Vf`X5bQ$2dL<jT#Pzvjv$AD=pXy0n&alJ6%RkI$Yxiy46*c#)3B
zdTcPGRp;eL4|(s?8Qir!O~b>ly8sr)FYMc@cb1$h{jy3@Meu5=gF?@L=rmKPP+d6H
zWGrM~^EGT!&<h*Ijgq1wi-Vp1WQM<Gf!*4zV&WPTPy77@JsefT?7+YSC$v;;ubaHm
z`e@%pIpN@O&Gt2%&;6;2(jTlPk)|thU9bNM49H|3rgeRTvr}h`o?7&cO%@0>IwD?f
zlRv;-YmJyVLF>{c)i799jLSv6cMI#Yv=18apd4OdNhX-$TJ&%|MZ~j7)M>2Y@0W-}
zU&#%R^Z4pJsWIKl<IqqPM!m{4c<vO_2tOwYxqmF3=}TW+=R2BGj2C*ZN@^%xeTjGo
zC)c)!78zmGKZ|-F^(*->Ev(kYCO3PgQw`01G7<?q(t3TJot`|QyYQH1QI?cyh?oCb
zGrjMMBWWAL?)Nt9_8s`LbLUPgkHM;d2<D2UC4Re09`{IafQFy-sa{sqNW_F|vuC%4
zn%ecUsr<_I%r=r4PyMe|AMJrOJZ+E%fp+lAN1MDQG!4K&6RV1fp=}j!)>6&yI8npg
zK-Ve6j_{Y~2iiM3kBr{9aU;7c={{8d<-oudrMKOs7}~5%)^_-V(rIlqS$eid({#VG
z*Qlb-?#48NKk{{GWnI#{yg$V8wp-6-9%K`VXvcc9K7RbD^LuIazDg>6;HS^Bd$Z>(
zeVk>lGZf0H;z@M9al==)V}&C$7&D3%92ofc@y*fX*6Q4v0k87@7U*wYn9*tj%8Gb%
zKm&Vi<5J1>-gTqz_Y9=%<%HKCJr^`MW&{7DMD0+@5!?CCIExAQGWF@_AGp-*wbvJm
zw!+5*3Z)|F^r-rOKYKP}fUp|_bgkut6*0oRd{a|IHsf(>ZBF8{j35nVlhkrKn4=E;
z@G?o&f3|-o-@W(SV@LY;hgk~@dB6*~@6c>L8l<<eSBAKKXcpdN=~RXPtxR_BEjy-~
zq>hfxh1Ul{PGRON<sxNdmRa;vRVD7@ZEbCmpNIvn1)h1>7tf3Jjwp_Qfu<00FpHa(
zI3?a(4kah4U|Zosbt=p`efo6ABZA%D@TZPr0?$AHtV|@7axUInJu#&OpQEu-Lv<SC
zd--KjAathNVg%Yc6k=t!XZoci0(-G$V_>s^Ot0EWKUpYrZco<=+4@Tmc{-x$Pfx*)
zWFtASji6A?<Z0dNM~@DUYPO?8by!QQ;{eME3EwVP2I{DWBvC98mj?v91U#)>VRzJH
z%5&@~5#D<uOEn?R+8H&McnX7ke0(nGQSH$ko(4DaYX&{j)s5`sXtTeLF+b;AOv(<_
z5OS4#Z#P^q+h#xs6x+LZ*44$OtdCXYt*xz10*Z47aeytzjLVwn$Q;l35im#%LkmEy
zSe-n1vW2}if_#M5J9s3l43pft@1jQdHUzp$Z5<sdTWxwL`zIfKW`5gc6?UWd+B<`%
zHvx;EMnbV;f2!GoD`VG>1{$Q_r{pamzo4idKYaM`?$n2+(*Ga&Z<(B(HGORt_3DeO
zaQOFoITwwzc<v}KaY{K){pg@2!cCt<LQ~lZ1PMXI&MWjFDOIXa`1h3vmwfc_YfU9U
z-LR$BPD?k4MNGuu{t#tuAII;3P7?=*O+v@G$QjJW8JsNVBJ?TUSV~P!;_W=bq*V=5
z<F!q>7oHYLF*#e>C?!ZXcH53H+et;`*6lMLJkn|a?(D=by*+F$Ojc^|c^6xpq?m;F
zn3|a(8<yLw+c>phn@p}?N6XS<kQ%@iaAgMD4A++7n>_z*aZz)VEA@-A^v#81(B@Iy
z%i1!xQK|{u%c{_y-r=-vy>CAtgHW<uUJzUb1r<ES$4?_QJDy-IkB{+6*K~gSR$*0W
ztrjJsq=&96xQ8~5;GqYJg&M|=tnRDZgU`K(dmEA-!im`Pcpgxt?xzKb3AS-Pu+CWT
z@Eu?)vj!bSGn?rH29%xqnwN|(UF!Sf1O!e`ADZMn$}C^~uj|hA;{2)1hj^M|%cz&E
z>@3@W;!Viy(n(!<r_8U<?T|F0Szwa=x$#!q%B)S6|9jtoMD*}Y=?1GXw7pCg)6o3S
zZRC<gZddbId&bIwroJhSKy`O<(M(HK>LyBxgnv&%Js8of{e8^iVxjeA23sr)J+A8Q
zCTv*1U;nG@mPu_5F)vdf)al-g3`z04d{VwLe;oI(qoiP6L0k0U>?ZbFDb!a`TxyS{
zeA3Rh-OXaov!>af^`TjL#EimzF2ue#%wOLV?szL5JGP5nMHltHc74m1$&#x+zP?7J
z^@E{0BW{u(i6Pv@0$4#oK~<_p^u?Wqotyi$2iojK%zV?WDo;IX$kV9`5iBbjj<9&S
z$XMsG!=Hct`Ow+fS>V)sAB!CK_b=TlMVT-_ppv$Pni*sCV;<iL2t^Oy%9}Tf!N$;6
z695Plu*o6UU_+*)im0&W;9OApM6{2GK5v_6$q<Z7iwZ+i9}t8>B~iD$SJ_rFGSUsr
z_s~rHvYU?gDBqAH9IlaGa4*Sdr(L1dF<41#)2fnSwLRtn5tt^*mzgw^&%piJgKQuO
ztxN2AA_G+i=ei_-V|(eW3jm~3@H8*}Q2T5`ZikwNMhJgsu0{8r9Lyr&gFRA~mZ~mT
zEl^kPDQQT+t2C{0)NOYZt$9Ms3kE1>5r!@}nAMOl+z8br8G0V}iF#z#2x60Fnq8aN
zF<z@&t`zSz5_|+Y;05|I3%9k%#a;&O^Ut{Zj*CeZNF0lnD2whiq`!{FHlH;yNmmH7
zMuu2ON-DI}(|8Pn1F2yeBmLdoM+NFuP+`^8)dD}f$}MSK_9$`j@b5q2Z8h(8UO&w<
zx0kfO2f>6*aNaCS{C)jNNz9=I<uj@*F+`1Vdn&KAnam1f)?MYD+U@?Y8Z(;f1a!)l
zq{mhFtFErDI>kxwb8oK^=mF1*CA`G%A5QupgXrSU3mS;#%~weAm_{VnKkOK{m!}1t
zczRCrb!n;pK0$J)XL`FbzZvhHp}mMEpj?k@uCDSzov57h+ch6N(>V_vI%GOAH8mB>
zs(8m<gR^hxifDK<N12e$0_QA;>eaX13`=~qHKv#@%KEbFuw{CQ>lb+`%VU!^6+7KV
z_vKIN36JkVJy}>-s73*915ofB+q6ZwO036BrRh!L?;K_Rf<(e@*i5gQo166+pFVkc
z6%)VUb2IdK#eKWXmvf%Q#y2{7eq>d3KyTP}Sdx-8@yV+^NY8clwVA8=9`^l+q?x;j
zI0y-quyG1hS*IyyV11G~HGwfv6~i=BQhP<cXB!$CPNT};)VDIAsJ`tsN|Unt5hv!H
zh|YRO%&YNoavGKd+TQo5V?3EpIyNrL#e`>W7HB>nQpc(?hWl$xS(-=Op+`1zXllPS
z%v^Cra~UG`zmGAibI-p#$>WK*Mm9tsreBEnks3SsBt<R|pcu~*wfEKuBJ15>z8Jz|
zn0*V2!G@=%MPqwwYHCg(E;nvei`U&Xpa_(fl&oLAdGihM@1~}vnhWwtdOP)l?=n|@
zXtpmAr*@)V=UcwIUy)xaplWX;pR}Hs__@2=uXIGyn9Q(xWtsOFpuzLv^#Fjg%#i~<
zpdI+)e%$!>7DJ|Eo6m`cQ*+PDmo~6uJvsHT)DCXkpGKgfe5Cet%rm*$e__Y|hIi^o
zuv1K~Jk8^IB=isx(Wi|#j5NiZS4{R`kvGhd)6p?8w(6Rii^{Ga3U(X7XWAc0ZXIum
zTm8(c^5@hnr_n~!L5Yb(4~yr`-%Y|_=~XE0|9$3@MCQ1<F@^ycumetUwnKCGj;+UG
zBTOCZs5Hc5pu{RXs^`1=hOuhH6^iimvvNuJ0@KSGs#n`<h*MP9X~iHW=nS`7E!F6s
zz=5ccVLvlFYgc-?MM&-FQC=C|J5puZ5<8U+$l%QX#CerhJ<ZPMu3=gUdL;ZqD&jWA
z)VfBOUu}xsb0gxF@6&Tqw5}D@H0MyT$?bv$?=ciowltPjfC}9otLfxHT0d7z+{bfg
z=!Wmf=|c=Qi@y34&^+0D^h1)4p#!7LbN~FGKmC&dgCod}qfIvEipi20THY@>o<y8M
ztOdE=nI+WxB5w@PgS_0_rb@SRbH8dz@o>pwO77Wn(XV-*|1n~Zh!u2(3qTLfAKA@(
zHO1G}7_k_MB^ir`XK-?I`uFJSJWagqp-0^?Dz}l4%G!oG__n)NA-R=VVC=6Vc!kWM
zsvbKQGy<q@g_6TpC%aqG#^sKbRF5y2cK#$#5=CS`ZS{yC4ch(T<&~A5hJb;I0J~=+
zn)a+?Ou7_L@OZ%B6$6ThFz>y4&@iS@4p941wmoeidznsGaj!D&T*!yD0^#=9mB)`C
ze=-+tlg{Gxt1V5vhu(R9<TyeZFg6r6)aN+fnylonRJ;2798V$i3lS^%q&3uQ)uwdo
zJj+s{PFp05xuP;?OePR^3sxU@Yoi~l0uBs9RU+Cc4Lc@C%HQk!DC>od*)~<qQ18X>
z_v89~du*@nabBO*Y&U|szWp@u_n2Iy-`|tyhp{o$Y4yq`3xDPWPm32OV_%4JD}aKb
z5QZjBF;R=|RrbE}(P#sC+S~5sRv<kGV@JdX`ul^%78e(p*n5q-g<~qLXN9Ah25pVr
ze11pdsgaGRc%*Ie=9f;O5AgLdITzm~sx;E|LRm3bZan5<&))T(xxq<S#pD%GMfs8Q
z9`oD?hW3%T@f29ISws-dM+WI8ijj7Z8TxIa7AWPthUQ5WQ`j&2n^Kx1<Qmo6=Z_WK
zqgcko#cjMkFTbX&c;{_*oH2&h{Y^TnATZPadE)OZ5c^mam6aih&(p?uifnVv%ctXM
zT&fJw!`(uNz>XbyvjKKev|}Vds%H@ir6jy0Dzq_5gqhHCc}HYcj#IQ2PtKNnP9$$0
zXd{R<8n-jq4%!*(gPa1#el5b`(1y5gg>EFN-n6Qkgs*O6Ro$m0j=T4lc^ZQjw5{$e
z^0B+SqzojjC(8UG6|h3&)bd=?xiPHF<Sv7%eRX!ADGyEnItF;qN@i@lgEy)L#JE$6
zXBqXU=YsF=s$Dq&&Qd_wIo=2&DHr!TJ4Bar>5Mry(0jCES@C0IV`L(cD1o{O&xOO8
z0%Nn`k>1z5CnC!wFY&i9t;-yl1;Q@uYo~m?O?yx@E;-e=c~y((#v>h>GqcU=1R8e&
zy}GB4+V}0-ULXn&aa|74*PKXO9NNd)(ku`Y?TpMlt&BwLYs`wNd^Myjzt6^M$3fP4
zOp>>)e>b#$kIKr*XQQpj*^d-$_vYJ_|GonqkkRBU@zpnT8_6$1PV2=3csv7{Z`^f;
z$eW<0-(3J@ef|Bdkk<)>Oep9}C@x!DTc=Np{evR-++IY2s^K9K7ae`ZnICu_b#mps
zD9fzb(=M^)@`4@E!$+>gw^OiVk4+9G;Fk^XTCUN19uP8x4LctqvuRx-5j`ifyDO$O
zWB(cTx^ILz7>aeK6ERnw7iS7MAago+w`%!WstKBFC*r>4CWmS%|Mu;9AaWNNP|U`>
z%12;#`mfS;%yk^UPnN|!I%V$Dx5+XsUt3FC<`ECxmHKEdyk>{--66Q|&NsiuR5_Yy
zRMvzV(sDo3$}R6O?vMX5KI_t(|0724A{LR_EM<tz^s@>I3JC+oD1<fEX54>B>}-q#
zawfVie`;`BD4fyit{=LOk_KmE&*G%Ad_lYx;82Fe$tiC?^w9sHsz^%er=LFMP)dqD
zzT8O!F`J%h6Q1uvox`%P`5%_gcV9{~rhWQCoT@d#>_hB75<6n_B|<6jJi`J_aSBpd
z7b!jGfBF!WS$4=6$5$$a7>4GHa2ed0B*`tEc2O~z`)#*Kqokx>GM=_WCM%=8W)K=O
zYKUf>JbMzyP;Nqp3U=*IFK8QQDV<ap>P(1@ZKG3?<`q1va|pTTqp>IFxbNW}EfwAi
z)D1mrqzd|m^AtOAX=mpZ1ZS(ZU^Anl{(_Jj1whA5KB?k^??4Z)v<<E6DRJr|ke8!~
z{y`ZpTmMYLWGhbXLCfXY77!4K6+S=ppfa)w3JR#H9Vn#Pb4(}Jdw1xiQ>RYN0yrKW
zZj53Z;R52%ve1XhQ-sU~ke%V*uOmQH6AhkzWPJSi>kW3y-+)5pk**kC$0Ev_nxeeY
zdb`8F>jQRHZaSuXwLLuz%6?<HM!y!^xveMALY=2$upuG_=?BAZxiG8QvvbFooSytB
znJnm+);x3V&{kIViivr+0p+bOES$4z_8i27p#cLqbcrkK?F;`-Lk4x6o1(YVgWR5;
zTeN<9&N}SpetVC&bNOz82mQ3;@fh{UZ$Vw26{jO8&l5@AuP?HYXd{dnkexE64ATPG
zSq~_)7I?DE4$Gr~kNu9~63f_W+6OHR&BNp(w<0&uT;ZtzIz<+1LV~q3Bo1b!q0(h(
zs}*P&gBu;HoXVab4bTraRkOjO^sWw*`NDgYPjou2iyKiT(J4+EE}dV#Byn-3=kMUZ
zzQIF!p2%I9??!Ps8Q(K8k#nkzMKa(yVfOLR=Y__JiHQ;;@|<;BpY5-&U%%Gi)LtZN
zt7n)psDJJy{<foa-A^LiNxgbDUmJN_TFTtwV2$s6nz$DadXXH>-2#8(rucZX0gtSu
z&pUdqYcbK&mMzgWIBtG~J%GGFAo`pzIgUFJF(Hh+z4`q;2{Rg%y7XI$XEvtwkjytV
zkil*OJP_|`J%c$+H=$PvAhR<w)oT3pP_7=7Qv3t-aCK9Peq+E{U;O)8VYl*<f1U5&
z=ZCb7JL>VddjRT8BR9!cuV$yqXsfGwbGy3JjD+pChPGHbI!AMraPK);RhFTvt^JM1
z;jq)xtpPiInXDMxTMyB24~Mathw(`SO5SyLce0jkM*Qk~Wg8=0HoB9LH@_j&iF<wX
zP}EOHQaIWv#My)|lzaG}l1o`~w|5EBC@x!7?XN`}$$nVcDX4VZ2*312F4FE*qH9Ff
zL^XZ&R`uT%*FGOIcdM9q6+1Ewo~-1Ru^!Z7_*4ZLdfs4M_|^Z#Eum?1WH<HY79Fjv
z_bEAe+(?4(SYBac$nMbahP|3<Y6lVt5gNyZ1T*5VjvQ4>H3=Wl_K58Bdk(l;V^%+&
z5bhb~<L>S*feMx485~_%-$I;vHqy8>hf@OtA5sC^HnMSee8h7ppo6u(*RZpbzKTbh
zjWFzogy3$`XGr=5{}*hDnU?6$eEqGFDFH`adAomQ8Ag$iMb*&L&*ZdEV!mW2-hNBS
zJpu$*bI0BuFpYtc<fCr>&0J{?cl^3_C~y1r?F>mtNqtzD8o$QKT~4r`ZpaZfdBZwy
z-bv=R@u7sJb|@@9RJtin+=Fv*zv_m3?5;XQigtkXLN2nK^Z0eokO0MGH`%O4dJsuI
zX&ID|#a8nu1Kol9;SD-Y$tz!6ePtU7Je{J3oiE@=0d(o2x7{)3!UGS2CQ`zXkKET8
zZo0N<X1n&E__78P+lE$;??xbS6IH^8T6x;h>jM?Vk4>{Bks;II^_C~a5>b6#O4F~;
zq$M4;(#x%i#_lIhHE>iL52=vC6TSQgg+DJC(g>;jBEWd{rYmM|YG<^&<fXms9so#c
z`mjJMOXZE5y@`p5XtU?u7%XQ~%C4rAjM-+%nAx1l^AWl(emwiQFGQ6_IJ7-h_g|@D
z7~`&TEdGIG#tvVc!Y|UJAC76dY$Gwr$Zkquf?nGW+pr&mT4mMjlqLVV1qCC^|1I@?
z*^*2dzo)@sp>Z6G<Chz?ckp&)CEoTI4Ie$5c65OAI^#Z{bc1OW^~de3e}p>Gg4H*J
zf`WF0e*b#q6X=OTBxuWTdFy6!wpdoqKDy*y?xEqt^m{t08H=g||3hJvwM4DVU$G+v
zE2*Ygw`jn^tdfNdC4~$wKTos=ME+$Ci#=ZT^$&UD>n%r2iq<@C=AxB9>{DAR@cfsc
zyM~scct)N$760RQ_wEG-yOJ_d>uk)@g1(Puusb@58+eTGWzld+K*rQ2)$!aEIg}6*
zjZGUaN#S<zEVQmt$oKz?!X<cur%*jO+-0xv(a=j}FCr@GHjxTl^H+Eqns+E%{QI&!
zLL=n*=!O<tE$UsnhfX%a#Bu$44`8GK5Lu^qz>kM~04Mfo4Bm1^hWa;8Hjr-A=gJ3_
zHkIlc=p3b$ET;Kr#E$xWeA(6Lh}(gIl81$Pv$bMJKoT;|JzsGkUv=E8d<`6x`;OMA
z;~-{s-r2(UN$lwL6ks-65skOS#cPjKl^zmmUYwIlFZLS!FhAFME~!Fo<7#xdHIJt&
zoCPMhsgY9ym8GTZPd|Umf|*iy=P7vow~;@fGOgWSTb>^`!Z3zc){XB-ExM(<|Lv6c
zXa4-@^10`4akyt`M{gJ$N(kVp;|kq;gGy!}-&z!hsC2)#b#GvDBj4C-B$?Y6Xao>e
zN0km;+te~-J}7%1EV0qQsI+A(C_OWdqNi|O+lE?82XDXPJFa9`b&CpTnuuGT2mc+1
zHTOx>w5IP+&8;aAI!M4&U4w$skvG^Esi_z70RnHFTboTezAWDX(}<=tJhD9bSx7ME
zIRO(4hN(olmiHK!Ds%0?@*R}J%(vn+GDC998+$ZY$hW&!*>b$K*fB9UD2FxWh9ihm
zoqJSCHj(=-T`WOqLWtlAs_snHl^hvbzZDNEZ@%7$1ic;0;?0|%x`$?=uEQgRoKlz=
zlen>V>rkQl_y0AM<_yw5jQ*AcE0tl}qdNeu2UNgCqsRIAia%G@3DOPv=Zc(yhai1o
zmbkaRc%n2xB%ba&eqv{5&%Wk|a61D4&2kr~`w!xCFCcoN`Ya7v;u#PhU9VkBO}z~2
zbx3JxseN)ADK1j!?3HcKq;7iEX9<vpMT)!G4b4|Eq}X_u@4C9WWTXZYCMDf4hvb8R
z5e04xKlIjSRuvzzYJ^FONMiJj{B2@;aXwJYmwXA9yG1TC7}}OC;lm*r*XX=cTwU!u
zxPK*m^(rSpduj&T643c6x3wNk2HV%iM_AeLz|iwS-%<DEgAWU4iC)gxQwEf@k+p6?
zL9#TpBjg`em4{I0)e+q|ixN*l^F2P1y-1Gbt7K8<Gx*f4Hyxjzo1oZ|m6#I~Wrt%)
z(cpC0L%QY=QeDGTis)F+FvMMQb{h*X_a1)??s?T)fH&dbr%80M9{GYhSy)(jk-o}<
z+)wq;{qynU$xVk>zX~edMuX(PM>2Ngz<69K_z$JBJ;2<|F~upV1qWohiE&MeuT<l;
zo1Hg47yex&;@X*P1}@>?_BlZVBvkY9`V8GBCd;LPRb@fy$Ryt#56CvbtKx7n{PnJ8
zW*z$-MeXtuC!^!EIS@KkzZMj;T0lNnWUquoJFE=jLC1K9$tU3`!@S}e+1Z{vL^<hR
z9HpczzZDrn9k;R)Ip};V^6eo@bcPg<0m*K(Vm1q&Jbc+tL6}#6fxHo~Y49iUMmv2c
z@-|ULOaA&wf3C%3F8pvfa0<4a`F#!i>B9*vt7?81?cVrKSw?(C9ePw*lUZ4Hci3|;
z2lx{1G8N|d^0#?;GmDqweBqEvBuw_ukBNMiODcRVTsh|q7|$PNy+7<$5_3h?$KU@n
zIHzBrH<2SId=NJ%qvp={rL8+XUZDhU_=%qefm*9>AucU}ajCD5w>V*Ix@K9wJ;-Il
zaN~~wkg0aCf+e{f)B8nQxMQi$3AtLC<JFuxlH7|ka0I^!VwgGcD!WR)dl65oi2<R`
zTQpptEI)8ZsL0MvB_PGmG;eDntD90J=n#Y3kYxMdfGrSSxGLtXCb*{h=-p2yvsN`S
zs}&HtxL|c`YRKMJtnF%C2<HEsJU&n5A_w<`f0wlFAp@xYHoX!|9S;bxs|{Y;-Rx<}
zc}C26y%M;&>Yx}msa=kCxjOA?kS;ATK4N9RDnk>CEd&}62OgF;sF3!8oyUa@<CIxx
z$j4`Kddq#T#mk3#d>NlXXYc@>;3ab<#E3>12gyE4q{M=FA*J^M-Uw-n=yMboop=iL
z`T)%*ksv>KcLq^+8v=*`dvjc+$kVp;i|;^DA|V8TX#aWn`K>@AaOPbF#d>+rfejGl
zCOKMS^i*<$;Z0hiJNeRU`&zr#wv~QG*fH-pt?r+TdwSU9Y{+idLn`XL+l^?f<X&-c
z@f)tLPRR4b<p<rjqoyj(5~u9JQ@&WZ!usJ$-Pv<CYxkNsl8)1JHu2g{bQ3aAYrbZS
zfczG6b<CTVh{qJm0R%I~FFBId54&2n&RCw3A>h<>@=sRpqIT!oR_>_FKF6n>#C@|U
z@pmTVW+JgKvJ#gMB3RI;Qn4g5+zWvRTSs>W`Us9d?DqPbI|Va9bJ~YxCDCo#FRMg7
zPt=Hsjy8eP=!3f1<|t|^>a3S${Wcm)6*REf!`)*rpjF-{XrL_kPSiU!@pn2fCeW{_
zNdzk~=Ti|A#t6>do}vFtu42G5T?rB=cMYEYGNX05lGce3?lQ;B*MfO_$=TVtXRq@E
zJS`u1Qcn#tq@Pvgq@59LFKlQJ0(akA5c$3k-M(wKk3u_qzgTaGO~R8Oq=sbT8cAbG
z#HssWCuNTZ^nlCyWo@C4xtrEy9D}Xp426*456irH%O2klCfpY|%+25<pViK=%Pn3%
znR|Zu>g$g;tfGbP#ilClGAPTRT7S=~VkWhYo<g?IEq=YG=c(|7=sm#fIA#8}-FJX5
zh{2pc#^kGEvN5#5Eknz_MOXFpE<T)|oRmQx5O(lLKSvL*z#|nv;=qygT{G6C<l$mX
z0c;l8l%?^XJ{66uD%e;XMiv&Io$2YZSrcoy=Uu5_5*sNdr%h>^YBnyqrL69VoKogQ
zhM#fi=NCT$EvF(#ul5703Vh(D<21q&Dfc`v#t3gSAWEF7$lp)10c6gEYaFJpo^a*|
zdK<%BNd^IN7yQ-T(qUY`-bwMi|2hyP-#Sktd=M5~lZQ6H0!OWjRMsh4Vi%G5NdzGo
znkU-m>qKVh*!EPz8KCZI&o4(CJca9lyb8bUX^$^gPUhU`SUf=^lxrp7*Sc6$Cm8J7
zA1mvwJ-+%m#Wn6hLB|SZAcAK(y<D@;+2qipODOe%J0K4SMq_)xr0Kz91P)}ekRh59
z`I^wV*=$GA!D-EQ4bYl<SXE|V9TyWOcY&{|z;lNHfz)V50G(cYv`G#5DjS(aJ?mZ>
zBHOLd|8F$8_48lm77u2*Z<4^WPoTtdyy2?jAg$Me+w=-O{ON%8*{rYV&KU3;t@122
zP{)O6k0{Ia%By>v*ppH`O^`sc=Np2Uod~C9SgO8|VJBl{Wkr(f_$Ca~TpYT~sPUcZ
zPNPhS0-a0=I7=f0)I)3t%X3Hmkiwn2QfK<rx#82c2oC(La6ed+ZQd8Sc9Pb0OvW`*
z!Dedeatu;cke7F37ZR5$z%_I&kI8*gL~uY0i}jov8XA&wYP7_cEArP<n`Q@IIh(s{
zG_5K}%3O&KcwVy#Vt?UyfHB48R58&v46Omq6=ZZ~!=XLBr=NiB6qA#&O#+2>>waAh
zZn;0iLR4Jcs_&ZjF)G%?N6H4-$l_D%slCqb2qN7Oj?*L6Xc<vkE*}D&ny3EeQ|y?e
z?~TP19jttV8U88dL1!_rWEAtI5h?!q7<?`h8rvD%THV64V9oaNSLHT}4r9(>pb2*B
z0w;QfvatkFol6SBIr{ybopXPKj`jjO#v`NMBwF;8m^bJU{qt~gE1LriYI)yS2X$j|
zb3@i5;wNyeDFMd9hE{^+A@CF#o|QNxU!}=Muya9RTf(;bk7fB$a*-AH(30H0cF26#
z<6N`T&>VX$r0WhTW5-YuV#;~$rR6JorR3J+lH%e46I^QywjGjjB?@*`i*HR1dA~qA
z?NQy(2pt5lQ3~l=uF!vPa&T~6#+m*q4Bd>n#jVN?b6jKqT#56vCxE^RA;W5<ZYpBJ
zg`^it3BCx?L(uYjP*3hl+;+KMyS6Z;(o_{miIvVOMMOUmYxhTH8KcexS+e}%t0w^U
zWx=(y2p{&xU@w6Jyz`X#pG$f3d61FYIX|+kj+#=QZUZ+gwp+=r|EFeq8ZEII(acO$
z5~#mvDE?gxdTq)}8`3QJKavNsjvx>QhB))9XL9(%G>N!oli`bVuOKq3D^Htt8Y4$z
znKD_dQuhJ*b9}o?lBX&#GPfZzN#(RoOFWIUI&J<OytCtaH)q60^AI$XT&qRxpym_@
z$Do}ssticg)n=Gx7rcM2b;15VoQ!VHba7f&O;gI8X2sH^jUt;PZyu7A9H9vj6IIIm
zN)&b@^Y0D)7Bh_RrlfoXGx`ws_R7W@yC60?+D1Iw@uHh;Uh>^kNHM&U3|XDyMg9P9
zhX4%ugnZKNBJ{8*Nl&8A9=y(rm7cpakeux7@$X>c3?HPgo`TRps0AfwlRvuw1Bsiz
zaV<KRN4f;rj2XsWDZl8p#z_k1LE^3Xno_9u95r7QOKip<GZ1uh=MyQOaLA(A_4oI$
z#@@1_qMn@3Jzul0H4V2S0{+uve&uY17nQuQ$9e1(T#vFHIOtkw=8YTwMdg2+s9tFJ
z-eOsoJ&7%?BnPRTeJoqq{2PPq1qxs6`x3!-yv-i^v6`7PyCG!OxJmLLuVHq>!^7TA
z<S((zaq`>hYTe0+35O2WAV=4cwaV7RB@P^4i_c=u+M7Nc_aW<D2oyxXO7`nu&CX6t
zXkLzd%Z2n__uD8_tfdBdJYHo#UmX}=Bph4#(VP97uG*4G?;Gc=jE=Y}S0L-n{P`Q$
zP4BJJ+5BkRZy1QV-{}4O3Iv!2dAj-=H?G9%qW(`8R7G*B-^(`DQbFV_@4Se#)*TQ$
zp5l{%I#>Paf|V&5$$b90!9Za$SYPmSi$TJ=UzYWeNuV@)S`B>12fLGXZL4LO9{m|!
z)*B{k*kd~7Uz&cY{mdS2`Ntq<>OMpb%W*!}Kx;jcgtuj`te-yCp<~4}=PMl+o#j%E
zCGBz@<Rxh=ZR#;E{u@h>(PESa_fP+L`Pjznj>lQ-Zsnf=s#><g6~;JOA#*l_9cP=m
zoYl7V?@}o;jSY@!6`Es$?vXE+-6DD>);-?W%Tz*At<icQL9LHvs@Roep(JuPp=ak$
z4x^AB_Q1}zq_E|q-xM#|%<i1IM<$GRhq&avlKnEjG^_Vsx3l;F>4eH|_Mhr_ddKpr
ziR}iGL$;38SJZt-o9~^BYU$`MeK-3dJ;+0QPxjusl~pWkV-Wa3QVh2K5!$L>G10b-
zp1e6+(a@}}cla2!X79y+<G}&Ja|OI|MY2nJhu>Y#Z1ma~KqKHbpT^K?whS5KaIqs&
z{3q+_wbEI;HoeoiAAOh2KI_l;K$wSLKwt`t*Gb`PJP5Gl#X4|X0zs<ZFqcm<ZHk>|
z&3*`0@eMxIT$CZULCkE?o^H`xwwm*qoV)(VnViZII!E3(hx|37*#^l<K=h+?MuHua
znni*C;{mR|TC`HQxp07S)y;E0$Vy^Cc<b@CwY5?X&4ZAN;siPj@_1nD=<h3@71>@*
z3z;R~Kbwkhz5BXT_iA)6q#W*}`j-xTAghcFrP4dvV?q=<F7L~1TezitMPJN|^<x79
zG-9xaW$Ts21?qpXOZ&ZAkFH(~s{7yJnAMOEiFOYP)23MOPI~$0zup}+x>WD&B%v=G
z_U6A4qJYQKxlyA<KO>i@yaxkQdJ627fG=qF3am+TEY%cj8l=N(Lme)IU*{M1=dXAS
zwZvV}X`<>M>ru$-xU%#Qo4f^?lb9NRnf@PH|946L_wv?9EcRFW=}xvd1t?0r@jmwa
zfXdSBlNR%|DVfI`A%;P#pH%&XK1rOi2+>|LKf>~UpK!}d*n2tv7x16Cvb!||4Ulgo
zh*A4;HvMPIX)sp+k3d|3(XAju-N|>Ub;AmcKyFKNv8L7&Hez67ZHK%tZz&{gU!Wj>
zU=P1n+m+E<*;n{jt~Yah4I-0=<AX9Mv|4MEpHq47y~i3SD?(jVuicx=8;=w^j7UKc
z@fTTNPMBAc(@!sIP(`=o;eStcOcD)z9saSfwh*n;kHOMR4%H`6fjs&OU3pB|&1wDC
zbEGLFkqMhP^@sjXn||9LIXaSlFMWj%vZpR*r1vbSI%mJxJ%bxqs>n(9jQra_?W#<N
zn#x(<;NJ@s2LhO<Oy`8FP&sxla=!(64J7=@c@;>0++uPyA}xPkrt7}!0C(+IlEBjs
z`BulIR!Wlpbn+mS2|yBAcv}2FT{2;sUZDMbP`y)GQL&l%tf^tvmKPTnU;F&xtkK2$
zJI$xS^E>G3?U3x3b|mDJgqfP1Al1XBC)ljv{CF_4Yb@bIrk{<OH+iLZ3h1T=wL>yB
zJ$e1Wq{beDwwJ5+5PH0ChCS-fR(z~dYaN~p+`P1T4cC;ihw#CW-p?NjYLq{_9T{He
zJ9}v+cBZ4dt#pQ60XGA_<vU>iL5yUCl4?t8S78Ms6Ju!}nX_w!)tU3Z&wlanWqlzw
z{%4+BXKwd<_G{Yx;jz)-F7_HERvFgWqSNl4r4|yOt=$)VJQv@-zW*5`8fZQ1b4CBs
z?l#%O9f^|I%%>_;yxoQnfOylV=RR&`+Z$>(W>?nh&JT)4r~@Lix}BMA-gBykX+OTQ
zz7Mj}XDx(_TDcRiHKcm2Pk%4YPGBUoc+1A>ExRZR^Iql98JnEddo(?J+t}C`K>i9;
zOzyk})gXADyx;=fkHY{{1d^ZUL3570mO0=YKpig9`2s{DWU*$W^@qP=vd$4|hXDL`
zaW=7OBkt18X|4YaNw=OWwC?J?z5ofisC(!JdR!a?MIfJDs{iOY*kjF{q5#$ob{*+W
zZzHj-@YVdGd{Y0akaYSypB^U!q^NcDiwF+41_J^+$BT4{vmcTUpVgy!NN3%3di8lb
zgyV_St?E%$nW@Pb8Ud&nj3(W%iA5YB#Ys#pFU-!)2JPw!E^)`5Ct?=3%C=Fj8Kh)a
zRO7oKJ$tl)IH$v{prBPINEreJo1NEdABL9R35lUYX>ERTw7nz8&Zc*?7*L*tp&?z*
z{O6y4l0Y)Ogpx{YlQ=@NfoSIA&C#dW(I4&Y?OmX8cQ&QmkI1>`rjSH%yCcOjbp@h%
ze3Xfg%@TprP20tenjA9^;TY=fw$w<%XB?m%<2c?xC&SZG55N#gy#Ii&m5!<a2%mjG
z7CQ|n&SB`0rj%EArONh&f*$9RH$O5L(3cYu?BXJ)6z1~M?b2`Zh8hwzeA!=JU42bG
z;`(gB;GCmqY@TgpNwm>bZzYhGA5K-U;1k?G>3$ez)ez(-fByVwJXz|}nYAa?goF_s
zuux29Mt=4>nwCLJbdAf(xlb7bvLq@gS?dVFqrLi-wnmPmzpm*WIbu`x(Iu}BRmB^6
z&BG(aNHqKs=)M)H7lj13@7NK$Tob}2m~lP&J7l+rm3}i7Mgg8sAE$U8azBvHTL1q2
z`xMBu@<z6Q_fCH&d?4d#pY$P(?HD^!b%y6DsGm1r*v!gle6H3)f2AfwE)>!iHj=Gg
zi(s$J!y3hLD$gx;aHcp$ms|08UO;oj9U9TjWOIW7AZAryr<?iXlAQ4Fa7RshOmUN_
zYBHtbZTCa$m>dKgmOfM0efUBZ<|_Bg(ym+K+q#Ji2q6|kHZLhY{ATsq`mYPGEcZ3g
z3uLl->HT9X>$gP1b%8`U!&CzZ=Jn4L0r2k-)Kv^yJniAZB!8VZ@#hEyp^E%WZc^A_
zx{=NeK7)mrn3z>uT-^Q5RQ{#^=5*{#aVx5<3{XM0>kR564)E;j5I<20)65~}={ZH0
zyE`}x&0?CGe*`N7N(+&0Fp3?aL(Z%SOFC<BZ?BI)l$p+7|0aX-NSQTeqv-!Q(JKb~
zLO$#q-3Ap3o(ecRe|0ZEg%GjvWE0Q1z=F2utO-cc)I*@;TAl~YOx%r-0%+>$<MT(;
znZ9rT{{3<48X8n_!_Evit^G|@!!whuEvo*T#vDITI3EErMGj%|6s?OLF%gIaf9dK{
zdoX?B57~a3wBjy<pb$8TFkQlTcF?-cf@;B2=YJ1v)nK_NnPM{h7!+&q4pt=2Ck8#N
zV?goP+4%(m`5<|YX={az2S`33JVMzV2wPMSRWG-hz1*e1OJ>xjP!wgen98iuL_#gd
zFp|cPj-+NhkIHhPbuTA_?BWeF5!cW&-!CsJ^v_^Ij)W~1j|b@QG+0fb)J#>(DnZ)X
z5_)wl_!UW8;m9ZgJu4uyR3@RNpMNOf_>J$=U?1Xh58p#GP`?zU8<=TnX$4Bcyius*
zJWnYTX7Cie>Qgmbb?|bo8e<B!-c(kt1&PbvF}j6A=i+l=L0cS7|Hk#}{YKIm9D=Pr
zXTbJLBTT9wjIF=OAkae&KOiE>54?}FNH7Erz)dp7=hlKHn)sU=$=^)!k1VW45+*;`
zC~B12<p<7|U(F{>$|Fq9<8bQ0QMO@)yrN8`%`vDD4#@vE;p!P!tDn$f1A(v|`5mul
zv@0)0G($LlEn%8uDHDf@Qw#<Bnqx`*t(R4lV5Y!IsI%jog~~1%#v|WJRobEq@*E0D
zh8TT2f{+IH^W6qnLvD8zk!S9pbi-kDZ>*jfkEi<)fs|fA5e4YZFW}W_#=@(v=-I`4
zFIH2GSQ8WghXU0IQ+W?P4lzqpoE81C`YRoP5Y~lGTTr2d$^AH=T;>YX9B=Cpy|g2g
z2^slR=86(`U4lYlOXqd^svT*)8b(W{vf{C0$%GH(Ic?QUp-z3&>H|tU=y+UDO8*s|
zZ4T4)z-z1QUOxWhXwOIx1CnYipnm+)4K4UwCAYj2I7x>wYDIpaGV)>6i|QvneoDFl
zvc}`+PNq$d0t^c6M1CD$dltfAa6P?1*x)tjOQdyCRjL`z8wKON8|ehsV)Sqz)TB`7
z(!Y_-g41UU2M6yLuIP(7$NGzp%Mw8!4M>=(7>8YawYa-48mrtS4wEVC+lEANe{Rsa
zUc!dk;V16d3`J=|JFgTP6^$L2qXmN!1B|z}GWduoR!<9vy$xm;6zaaxcV<b1SCEVn
zN1hhDOJ`AqI&EaMdwmC3sl6fw*PTfxaoivr24Y6<AvK`17=q!ydN$)K7dSvW^5)MP
zQ1tgYx1)ZkHhbcM{7GL+08_M$>!y}qb!~b15*{-uFWunTa;ra~a3iQr{(q0&C<-{g
zk2Sx3zKZm3cQEzvDB!LC<v<EP<F+;m6J5KwPBhT>kW4!stG6O(1B&D}=`l!_7KPux
z{}~xXq?Bms0uI+fR1i`>ypRkL_>gOP9njp;;A}h`jkQ0I&v-{4M~2`cdtrvTAaOYs
zJ0>KJa|B9_M$#ZHl>~d+5ZUxKK*}vpX$k^aO*mA`QFL7s(zj0%Z!0;CKBm0H=UPH3
z)+^h9_@RH#$nv-L%h-`ci0G#-J%d4-YmjZF9?T-gVC^?Y`%Fcky0}!SpxKY3f_Ou>
z)&C;rPu2XDs{gUC&lo^1*U$m!1`u4>sB;jI<oHz!M+==*#pXJJUaqM<4^yb!%U6N&
zs~{m;KOV<1b41$NYg_WCB--dA4c$Ehc?x@w)8;<;BbrKTO+imfORccp&#+^s2_H(Y
zs-(to9v2PAAbk*&hb-Tfv3w~W90;OsMl@GcyhV`hLst1y?IH%Z5Ep0z9LTjivkQ22
z&N80RPGZPue85ZWSh0}~3{XG-rO9`IiE@xxrlFl4VaKi<pP{=WUH$!4z;zWakJ&ri
z=jO<-ULXqU`)8nsKc1E(cNI*Hz|667C>e5YV_!1rS8mJ5v)OD9sjO6l(3B!evj+QU
z;LDeT0$^-e#9;NgLP2&H6%6o<7i{+2u@fvtIunLV<s-AKc%&C#MKpg#K`mt@K^}kW
zP&Q6Y);+;r$UK(PZY*p=I*QK)qf9z)J{#!L-uKEu(t<{$U{2S;gP+OP5#r6g+;xyL
zVtgi23;kxk`GV@K04qUF4bjun%bc8<IY?4On?tZve{y>IdSt8VHt8S2k`m&G`^l5_
zucdg_l_IlL#hcBML3PL(m1JgS26wPbO=tvrr!kZaQMhAf)PRyWRiUpxOxeE>J9WmW
z(huxAm|G*~%?HvFm7CJF;4jugh*blcmk8va@1zDI^lf)Sks}UcFeSFCxqha;Ws#yQ
zBgb<`A8l@mp@DIrHSy#wjPgFwk$}O2;0KiaT+3J7s1!-VPW|VJk`M-{g9#^a{?7Bv
zg&_Q@k_@Q#F!X6GD+9#I-Ov=vBy<`@D7wT23;Y@a7WRJd*stBXRhF8n<S%~J5a14m
z=g!|#6*IU7`f8MgnXYdz*zN{yx@nZAh>3Ze8Vnd;+ElDALJl=~bJ_&5nx|*#&5K4f
z$N8jpd?9XF^|y1o<-x~|PY3C3;1L*X#vp=%YXw*mgz39Mle2vs-K@KBqr>;L*MG9o
zs1`(oiz3dTzRJ_YIiK|8+XjX}W*GM;v*P()#6Eaw^b7Q@CyAdv6Gb3pmwZ1w{3W=(
z$;zw^4n#2G%PT9Z&0%8^!RnX9JUc7JWQLZerY3JF{MoCJ6=tA(Hcy)3TXVyl5fk<1
z!g+^b>IYW2TFK9iyh}A?Pu(eKBmK%)>|7SC(RQT&^Ji8{_i_{@`(?CWn07}Jc#&XX
zu6N^`-q6t+y)PV}m5Ut500q+|A-)*1^~A3&&U8k^#7)FF{zW8f^%|P%@Es|+%~(VU
zdN@S(&>{D2cZLFu!T}OKE7r5Z_!<D^;#c1?Bmyszjr)^f@bm%qukEBkW%!x}Y2-jy
zSspx!G0sDCbBZql(!0!<EU@NR$?0pe3ulX%E8N?pO}E$of&^*M?$8}~9FFkZVM9zp
zOttnYd?&<=rs)>-sOtdn#R3BZ3pnbCQ+$w!7p^-z^1A?}Y_2*T<feti&Sx)v)xgXR
zOmzSPno$L}slrClzRIbQw-EjXp~Vu$f;12%0L%>kTelWpf@Uo%xF&#Xg6RhG?@VQW
z$@G+zvZ@*bP-OQa5MykfU644}S73~5zVPachv36Ugc?x<&<&H%L5WneO+D(x;};!l
z3RG&s_`c?CJN?O|Zal_m%#7>AFIhwe%H1t5kTT(dWC8zsm}(C|m$~E4P{{4uw<S13
zA!1@DY{-Zw)W8h21V4gnz%?K>kX8@zoGI>s(NG^>VM7fbX;U2-`(QV<E7IrBClUCE
zB4J@$z)x`lv@D&n)CRA84g_d6<d7{#)_Gua`Ps5_U_{6{{_kwp{W2=J=OffZrrf0N
zLP9GtNT-{_3{5fUusgcO78vj<pAlRgp&RhUPanGCLHP#>P4o&3h8b{Y6S=TkAz+(3
z!|l7Hx!8N1^|BIOy=>WS2s$u$I+5B<<P1d{$gYv1v4tG=Fo8z30lM)By2$<1CCFzd
zr}iOrqTUrFn%5wDF`T!viq!V_9R%2LxO^DFD@)I?>33dA)`>0B4`pu#zM@Kvufx|I
ztVxn$VeSW22cBROu_!)bm+vFOUSxYy%KQm*mFFf<pP%XxP-O{>9K~m)OO9)rzUp4q
zg#$$ZDYH@Z*c?yzNVJNWxPYL;pOQ%1>mV*y4Cm4~!?Sr`oT>B*Yj5TFxBomOZ^6&d
zt)m);Z8OJh(@nD(+F;OJ08zuNxVsca;F04P)5C9^Yvom0>jpev)@6e15&#1~AD+c(
z;|uI-;V`e>a(rtj2>4M+graC{K6AyxX{^^%?-DY7FzoA8VY9>~@HGkfQ;<5t3%Hv5
z8^YWcRDvRMwNd39nyY8i@&yUyQ7T&&z6C&wLp_Qhl*mip+{jNOCcYhbL;RcR&-*w_
z?%M;?Y;Mpwet?LY9vd5b6Hd4(n;zY2$j))xR1Iyy)0|*V6uwNw0)o+EGLLDA-!%B^
z?VE4hwe~xSD-{&fiB*-X+lR>U*ZWuGr*YrhqFM>lR$e!6-t<}eJ(}C9R9h9_F|KqD
zpRpNfwdxPqSQ7yy=mm_>w<|aG!)S|pOzTIB3o;my<M+`JmM<bRLcIIOj)aLij;Vz%
zZI0c-6}dnE^eO7TeG`UGPtI9G()k8V5xOHR^P&n5n7y@vkSa{c-hlB+30oK<dw*-g
z#S=1YmvlRH?06nxoBnX3d+Y-9HorVW_+@3-|3}n&$5Z|P|Nl=TREkqFvT`b;VHPq=
zM*|U&GSkT@A!N@=MMOm*t4Kmfk!+=?oRVxZO32R6{@u>|{r-KvufJZGSG_prIUbMu
z<95H@u6NGtrXn{xyFVA;R@fP&sEjwpbQiai8J%=uqjuEZZvY*&$`FC0#*F*XSGqH{
zP)UR{?uSYBlorJlUU~*kCem)EzX2vgy>w%GA=fjBV9)u{7t92bYM+)bGCe}gbe3XY
zx;{59fRkB=5+OIKUoGIOL(Mlyz^PJtk_nZj1MP=+5GSqVelRzQ^du^j;YTGcyXj#N
zr?DF>IL4)eM*EMo4nHsuLORXE_PJ}N^fn^;GB(VOx{7bje8)fBh96rycJ66QyT~{r
z5!fEvN+@!*jP5Ac=Kruzmp-b{xYFL*nvRpl8k3>b@B<HfSsbBk*ndBkL%wQ1Tkgtb
z4Y4`9tb)Vc<%n(f!NjocYWI5La)bWifwylDY|!{Y(j>*q5k#>1-{GJp6E+cdm!*hy
zeo9^j9tp&aj<T;`e}lNuvu*9K%crvt`>~9#?T_HpcoK7Zt%v}Xoe&@ue30y9G8x)#
zpmkEK<8-q{LqkK}c65Y8{+vQ4G#FK=q3K4p{d|FT=g&JsNI>!EY{Oj@v$f~-g*p>{
zGC)OoBAwpUu)8#s@HW={Z)qZd=qU}f<=fxvnQfTipsYxo>iz%UzI!c7TIivjKwlAg
z6fEE6d#Zv^#<YpwDr;zNZtiGpmB8iLPhln~m!C!53*xMV7JxLC=$g8NiT%j0x;Xwl
zko&<tHp+$1)#3JG$~TirUb(YjpTtu)%yyX)m!5BvbsyF{#L4^^$DiQYw_maUuvQec
zG``fLv~S`hZ=eYr(%-XTXJhg0Q@WI%@SdRD&}YFbrQ0oHYL84Xb3$<cx!1mlLTm|&
z33+&ZfT5uf&giNbQpRcp4mvU=fv!D$?Vl_M2qP)Sa0gwmFlM?#cftfeoSy%MZ*q|0
z#B!+)QRVQh$*U++tImk6^5)rK-Nftqi1R9(J0kA~rX3tFs30hbH}grtA-X^_=WD^Z
z-?w4&2X1MNFYjhd$==pV38Rdc%6b&j){1P-Yf=yG?X(2Wqlp2E#FrGHZJaroS@v3o
zGwey})Ahf?`D<5d!w~VKyJ&PEcVTAkS)uyaclBp}-{v$guJVoG{H0^V4Ge(@tYt?i
zg3f}kh-9SRhV*?tzCSn<TV>sM6YKS~G*REs5ao*`&2L3rq%8W6Nbu)1-IPf6mroad
zl%LI6r*>2@mJjCHJ<dlDJE&Zz(KLe3-%okN@s`GcRp>DG)4zU}Y$7O+kF}h3mapO^
zMf4s_dK6yo7sf~!?${(I6t@niLA|n^{A{}{4*#pNoIcmifD&`Q+IhyNFND%}HaF&?
z>o)_fjXTF;;P(=e2&L&b7k4$mr}9C#ZG#lUmXk`ch4(M`D&0*h%LuNPe0tmfR=?x?
z&B>!`%Hfq(yf=ccEqv%)rEC@UxaDBCBZ0o*#lc=}71m%oeFxs)mGl4$t&mfXJDs4Z
zq)W3$MjVY}hymb4qI5&z*#E^aYK?e_F3+CZ{Ai{WymsvHZo$!5<Uiip1*B#@@HBKN
zU6(xlO!Y$8&z224G8%U@Cgc>UCg%(l%|3eFvfv;Z`H55C_4%be>p3{mQp6v2H8&T$
zHp#l7&&5X#W4-9Hz(pWZV#Ue)lYv#>4#SJ9v0$MHA+M-(b&Ka#l3xpNN}=S0oZMRS
z!xlVG9~1K!<kBjoFVi=Lzke^?t9|#c&n{k9X0i!2!p(aw!FK$FRamQ7w(Z&6O&Y;_
znp@Tobjujx{~ruKM<Cs-OmIQvEGGV7U!x;<4seF?Q6;g6HFtKF705gl-2VpFo3&R)
z9KWB)-o4R25q5ov?dP+~MS|>}IZdKo-NRXzj5p+>-GvKU)!eiWLFaP>LVD(@`QgET
zo}4=1b)HLecDrOAtR6f8yY>-*ZxA!-%_`{J!4TY{rA^7>BXET3dP{5OtUEvMKNE?d
zH|n3g7kcc)YJ4}mso|~9ih79Nqd<dN+tlNyQJq_YPMJWBIcFnWu_<!WQ#3fM@~Ei{
zu_?(_m2Z9JH*Cc)QE#OAn&NURhRewf+=QR>N&nY`cJ}V(iuKzsJS_d`Gv$UA)qJOb
zpy1xB80Us44c#`*KwwmQA_NaQw@$Y`iBa}&bU8G2U_AbzmQXJIdh5FNZG_~jh5;jb
z7$$SODy9nWDGkQ6hj2#O{<3|#?tNOm4RID6tFTz%gI}a$Kk5*a9ru&}Ra!6;{0fe~
z$<!|QmqjUGGp*Btl%t08HQ1U=lFabqHgDc+gBR;b6dilw*oii`c3S4aU2;29FVkHx
z)+xEUGH+??h$g-9mUD9gI**x~PZy4bs9s;rw17LT2j>QxAS=&`!NyFns_JU%#UBBA
z%X7l!`~KVFs&#s>>$I$LCsP<2ky_xh(W|8tEV^B80%FZAEisy3ly?5o+y{7veU?OL
z<VE@dL|<s}4@8M%?jJXC0P)V6mJYl|H!{J7_{wd1u(1bEi$v<fvug{Erq$10$Qs+E
zahd4$bjsW}@o_89F7u+P2yh$n#>y6ib_B)L(gFsDhKgTFdXKHfJ*uR&bMCyBYwc+2
z!o}_GRLW<pB?vm3{}J>n7RJiU!za(*PX5Ry!gA%|rafQ9=6E!MkHL(uP00z)(LBIu
z*RU%{`)o~XDe(+I9Uv-dgT=WtE;GKNNKAhL+Tl_H{~p5ERH6}!mL*fSU{#E8lW=>`
zdG5JStejcXXLxVi2<E1v5K79vKq`4YKJI*_O{h_I@4$Ct^5n@yycI_)D=P&JKJ#p-
z^Pt9}_PQA+V;cNt6+!FnKI3-jlJxoN>s2u!;<rY1Ca8T<5~=H(OjZ;~3Az-^w@;`q
zH=G^X9%W!(DeYUqJ9)@PO(1{&1@>-v8+ntV`d@yt<v%LDM`UR1)y^5uUiDQ;uACS#
zvJnYtv(G7gO?U<c+t3$JxXgQweCL4C=cp<U0&-%)g)^6*o#3M5`PyUVScp{(B@C~}
z5}?qm)gQX{J2+ig|J8#XMBhY>RL=WyKeB8{qsqxC-u;`Lg_+)*)Y@0WD`$`A)3l@@
z;CXSevhQ$iwM`B#Lh&Z=3wO`^6gtO7tQJ{sR^sWr!A|E9_nu3+2DidwI2e^n_6&xo
z>+ljH?zFmX9gbNAl*=B^OU4wWrC($f7yDeMKMjZ>3MI)<t2)P(t+Zmi)?N5K^%zf4
z(xrE+SqQ}c`2fs_DdZr|j@@{Y^t$}u44g?qVd}^8n``L(Xh6ek!Ot?hrxMIYncDKA
zr?Men^UB@(FaMjySrpyZ1_%x{<j+%_$a^o!E3YL0Z7~yh?{6{$bkgrI!()`E`T324
zyu5Fkd0$zujnCsRmTlL5AaJLq*WyWjne=+DJ!N#PT%no&o!FIb#jkZJHsZGho&bo#
z8PyrsHU8@fT<+F2-5RM4Z(&44h1he4{xiO{wES}*dqWE!hk;o+#_JX5yV_nCSE<6^
z_x9n(WYHG+sI(WHzwTgl^@>sZTOalQz)b<jqbjwg@@i_Gplg{DC5HB@=fVb<UYqj3
zc~Yg{aFbz?=GM{l#{VXh^mUELCnTn?h~GL{8^3Q-mr!x-qv<Jzzd}^0V0LOs<zm<z
z^99M~a>zM`IF_;R$Lcc)LV$5$_JV^%FN4WYXr%1qobTh~;=YgRpZi~%u4MVMk-KHL
zV{@R@TI2hCpIw?GD6q__-q-4&a}*c}FsGQL&Bk;syLPp>y<MS7^!jTAqt8_hf1C0J
zhKBe!r?NQ`6y&IhRggbr!Uvxt?1sB(EIXM*H_aXS;d0-gwDCedoI>m6cG{F(yfras
zO~RRLD8%k|)C5%{xH8H>ff3HdLSy?SJ&E45Sg){Pt;ocVM5&R@CH5u-t?!jS({NC~
zM_42Z9G2Hqo1Tk<`ve~6S#i=*Qjg*!#QkR9E=xuNBqq0?@2)qqiDW+yrIZ&hCVtHF
zNZT{6Z^BXm5xOJuxcK6W<Knxpe}_-Z`Nknwy|(hwwWfI+*mM^K_i9hmvwHr3DPHOK
z>LMpIg*>|w+rMpub7u>B@&UT^CM@sdTJlwc!T5{v?SNR``%fbPcjpL2)md8o%o@KV
zT7|n$+I4-$COP)fx<=My$Z566W&}g7C-$RZ7DR6%N%U5yh@T~R9&!6v@mMRkhj42I
zM=zAA(;GLCeHn9(wL0c)eb#nepX(TyP6py!x^#HZgkO2<?9%=4p6C3?q^}>otYYD(
zT2v|hV^HyH1Uhx+k-NSJUx|H|dRo*yLuD;?9J3<FUxyj*f==^zY+;@A{#V`#(*wVY
zCD<!bT6v%;)=ZDpbpW-57=kjx54f4S))U!7pIc0ABwzTo*9HjupCLPb>uVc**h^FM
zmt%VrlkOQ<VDE(x7@#FloGd<1;bg8X8{284%W&z}*4KLiIf!RP*$b-G&W=zX*4UKM
z9e{cipK8YxbXLIwTQriGc1|^n==WNIcY2LY=P8eiB-9Ulnsqzi8r`6&AJL<j$xxCE
z<j1q}@^UA1J1>OIg-3mlHs}OiVO_4vGA!b1TT?H(3G}!9E*WaE_S1_Y-T293QwGS)
z3FstB;kaF!K|*Re&9f<Rq<<HXq5L+YsSSE~f+Kqrg^jiDqsnO{vY9XKlq-LVl@I=n
z1YF|hCo_3K#9V5HJKIc><9wDnf>>)o5mGNg2csTQG`h<kO`e^pz$O^!bKQ@8bkX2*
z4-z8E?3J2Fi;w9e!&Cz8$sPveHF7z~0c@7&-A=j8Di^T*<UKO^*3<K1Jj!P0H+oFw
z>vK&*!FDI2za*+I%%I}p+o^Oe>@+S#BMgZs*Ee^~=A6`8ddpk?g(l3h1$(U<LWlni
z|IRz?xPRenUl+@POCB9+J)aPdON?bTZ%(MCrQQ_w|M!#r^GuIB0lWgf;!9*MI*Z($
z?fQ>37cW-rk*r*;5$tHQKID(B!RMO9?tQHLA>?km+gT1RG$1=_o>MLwu9uTqUK>e*
zA8Ae?Ek3u%miY0mahn%nQ(PqdUm60;SLjgMZzepMje`+U24nJ7Q+T$Z&8~zowI{T8
zb(LR_O*cq?o^>));Z62}47o@q(WBaRWS9NT*ti}S7U)g;wdV9~%3h*t@(eatbKnr9
zNu@OBc(elJieWoG$~LZ*HQh>YiN0^DA6a_nc}jZH4HOw6iQb{xG78tNJblrSEdZ`a
zBe*Bz8EnJ$Q3jbIcB=ywqH22Awd{RyDmg|?KvRE9kS9)skkP7TCr^qnA9IfkpG|No
zFT<&(__oZ7CLNx+49N!x&7u1SNf05caU62mdGa}DWRww8AT;GMY9ESH9mM?BbSKe#
zQ=%r!@kt`3{06jF=)$55b_#tW8vPJE(a1ufiW-0rtB$W-ep7$Q$wv1__a<Trt9BL5
zc0=6*^a0QYe~QX#D9S(`l9X)L^eRGHUcPGFb=^OXKJ~r|$NyGqD|gu%o@cF%ol_*L
zFJz&&kcnK<!QkC*p+T_Qbhb4&d+hzCnpHL?{Fx?3s#~T^6##{@7k_$PgN={*?fsVA
zznieSNstmMXy;QK{?m*oLP-@+V!_!pD@Zr$x?YWP`N%styM^su$~m^ZLk^*wzsmEP
zI5txyg+XFutN3K|3W>iNZjC9%Q}1XC4jo0)PLXCA`q4ZD7`65x!Ep~CmSmY0^dW{9
zY)9wZHUEIC<kRv6tSu2N(go08Z<&)4``tL}LXVraSUA&tqe#yke*Ixu=|S-NGkrBw
z``MZ9!`M2lpK`bU8QZ`6QXHC=8#K(U!shmKGI!a-^90srCcfDbk@wanLj|+b)8_X-
z${VH8;fXf1n4hG&&=4RN=3HS>w58V|M}6M+-*k;P{(guYT?2E+WtdS+{o2vUOEE}~
zatf1}o|);CEnLLQ;sN<gkhZ8n-cS`2z$W6Dv9SLDcGa(_?)IX0h+0E<Gu2`<^IOZF
zk5%=n>a>0*WJW1LZZbw&Eo&%_TcWqlWN6u?P$f{1T68Uz2Tngrr9FELLkiRd{6C7^
zTtpfWw%TTipd$#x?@T*?n6Uyqb+0Q!MXYN@M4<%JQ6EREVlKP7PHy^ix@P>8QeyCo
zkdRQ>E+G#h@S=R2t3W^80t}R?Xc#y0-AuW=y%K9_yCc+>|0OA0Y`OEsz!hSpepSqC
z{JDBlze4)4ms;st2dkQNv%j@olov}K-j<9QqcH~u$83{eZPe7zu4?B8{8Sg3uY<OB
z&HaK7_x5;Lr(Jk&7-J!HxHYNt!#RF^mKzMU*}MV*uv_s+S@;GG6{!)z73z5LZ_^Ec
zTU*>ZN47zeU-(HIX1MfDx}>PQeC6$_L?CUeNq5D9PMPEXM*wDIDaOBK;{{=>J|@MJ
zT6DXibybWEFbtb-{M?JToMT&UL4N)hbk3#D_Qm0yYZj{&c79KqM59yrKc@3Dh=~mT
zCsOJXr)%Wi@d`wzJ5dv#|9QSlXhRRT=Qa>oG97p^I}yy0B|MrU+98g{(iUGL`1_$J
zp11_mi^afYC7yCyv?H4l?p^n(gl?#li>1|s*d2tI<e|j5{Qr6tb5#zv)^}?c%k60}
zjY_<CAlY$jI?`%k{9xG_hi9V40)4lS+<2^)Md_GD{rD5>A=F}t{T<y4{%`1Jo=<xT
z03*ae_^A%x*B8U5cYMY%B}M&o?982x`-SzTbnqTL!BZ+@A|PM~Jl3g|*W>aWYTdDL
zzP8x5d+z+~Sv@yrj{aZuKL<Sd$0WtO<vzTUNlS|Se<}nkTi~<Mc~!5suT?jDu<MPp
zk4bhsDNp~QoOI;Ih>Pf~akklcQS+q5F1?_m$$L}Wt6pnOBy!nZEK>2f=W}m3(mF0f
zjgk0IQwN$@2XutZ&2AA^eID5$cr)+y7~CezQ_=5OGG4W9&HUwsqmf&^L<@S)Y5)3N
z=AArLoLOyXEqb1hSg*eLcOPEOjp02};1$yrZ?t5TR=;h0DzOrhtvBma<gNSE|HtTP
z;ioyL*&h|zelo3*XZ0rHZgt$Q8Ti~8>7`&4*Hl|7=Di#evuN??Q}fVd+#a4ZYR2Ns
z<q{nQ+nJz&!~_-fS;MmQZ1vcEOTt+fR}LG0{V$fj*X!fV^^&m#58{$Q_4zE1*kuLe
zOnGZ3!}ZeYo6$wD4wKmlnPxW9=Y-1S*n{x_{3$4S+G+IxS%y0}?6SHnC8Jk@2Zrq6
zBQ1VWbM*KBtfdcZ?~mMqWFZCHE0-{TUVUl6Miv5UPf?X~d?h@v;j?%3Z08<c^zv0Z
zLp(}P9~eXfrV>C#VT1+Rg|8Vs|DU~(?&qA4`n__~;rfbtL*4)5=`W|WbaXb(t3J`Q
z$(bp?+P~ocN%iiErFpe&=DH*&zXH`~N!AgMjt10LM;t5;jXm@KoUYt8<x%}9<R#(I
zCE5S|=ZWDv@oB|QT$+>cZjI2zoq-J~GH=H6AUXcL!(6E*I}bEhwAbm`lYo+>`K~K}
zfO47cUsMXOUvoyAE(fgKl6{(TT>N+JTrRK)em6cZMWYYU9<vVzcGH{xet6eRfq_o)
zQIMA}B5vH4c@^W8En{PclVtm=-R(mAi8nZH5ac#nSP!xxJ?*Z2eOzzTLTcsz?$+rF
zx`nqYMi1HQWo&^5f0-(0)!vi4d|M{RSs)D^$S)C2r?-CEc#x1rM|lZ)$UNW}UF?gd
zU$?Um8+Vp65|EyKQw;&fYqUMiGD*4RX6C=T;`6^*SN|V43BZNa8$%60A1tNXZ|%>0
zhrnqo6F*`M30w|F&jQY0!+7u2MBdj`lsi0Ew+66&J3-OEtQ2S=@?K(my5G8cq(AlB
ze;<Nn>SOE=x$xPJgbs|3I^I5No9gc7rVsAnf7qBrMTytso6(Zi`8|;-CStSq@=n}8
z|6;4bRO0Wwjin=QTHJTsTpn&=qmvr_Ez%7gGw{g0Kl)}l_U>I$NSjyljo8y{xhM94
zO5%cOGzb+cbWqB%dwx8pBZceZzwE@v)4bRGM82c*<g|mj=88_->#}9HS{407vX^^C
z|HfV`7r()r!}@tLx00LrsNTQqZ8A#I&KD<CRdY>@QBX8K1pNm6spV@#IH+;nP!l}9
zJ6SCrCeGQ~ihbzSZM>13nHl<YM?rR2Gm~e}yX$MCfu&5;a3_f7Z!vqgleGNO?8kmv
z<ep-7KNXh_b3d`a!?Uf!>?j*UkUp0_bSblP|5B)aztURO+v`CZjObC)(Jff&ctJ0X
z6cvxu)2?;omUhihEY5uPkC_nUNo#Z#I)z}TFVQ7J#u)<#g#grwUx;jlD)xp(=d>cR
zo^r=d8FyOcr|Bo>zmL@UCS<R>=N$9t+&SMBfEZ7+S=}!G--}vH6u;74%H%eyeX4n}
z=w(_7T$et|N=jhOUi+o3_w<-MkMv0EuYuP~qlsOSC9}Wh(hOJ_0>>6IRcd|q6#iLQ
z2F&&_+}eKzK0gqDgO!Z6Y)t)b@($lFTQr(-S*=w&<U8u8iUmCq`&B^{6U3oQ$Js}(
zcT@f1?C6A#(y-*6mU=$D;yY6-_qJ=V|Ld0oi&2f--LdiziC%bX)2iLPcK;u)c$XgQ
zf42YFk)l!Mn7Lkpiv*TN5;ooG>XR}f3(Ii~=dNy1teq@TAl30-=lsm;`UU!OG@Vg~
zf&(Y8ci<!ypdb>i4qqh*LuBN2&IDxT0`MB9;Mhl7<Q91!7jv5NO+>Iiyf{9a2zX5a
z8p$>IEKDy%*#m(eIshK`9@LKZVf%L9N*0Dkb!PdAkek~(P;ht(vx_yfyq?L}T#a4f
zyzw&!9)@B*xZ#yUf|U?iDCe*Fj1%f)l!5KWyBysNBJZ`b+}H?8)Nd!EVs=S^;m-yQ
zfiq!zd#cQiOGZmoe_iW+LYynS&ZOLsO(ryU3~(&V@X0O2@B(@wX|j_;v2)TAz1&&T
zIq*10#l{8)1G%rSm5#=D89v{J3VS%q9@O++DJt3+xNT$zBBTPAfxEOtEAm625OyIG
zSlw?;9r&KQ0JhvRGEJ@$y;lrAH<Rij=*0<f2{6S<-boAc!*yq(Vgrg1=}Y2Rx6TNH
z=>uqxW84~lwy>4m6tq17FM^Xz-?bF+dC<?nh*H}g^zVco{*irvqoa$+dsBv86o>Lb
zue2op`LUBgRF#^8nPou7_HNWD35$J8g90+`gQStU0z8KV%%176gT9Jw6(i$RSgg-w
zek$Ei9*l#dloa}m3izq0HXIdxRWbM79M}kYD^4^ynn_V#i;s_5#PFQ$>K10Ywe$fe
z0#hoG2g=}(Nu|4Ub+@0Oz4r9?i;C3~NnUs-z1RoIa(cQ~bcv<=1BFX=avIvMrJ#U-
z?_wa+`j5k}YSlm&Q^7r{%^4e`mmp{^I)tU;(vDS6dfn|&9D{T!>&o1H3nYQ>U0o{`
zj=y!PF6NtLjrMwVrUl#W3tY%=;=!1Tr80}otr03N2N2Fp<NWo3_{i(JS1t*?IuBcO
zB~TCLYn|ggWF{pvf>~^q5953{jn-c?JyHXz?RP|?@C{#LCPyY(-s>vjf;gY#k0wGi
z{M@1udj5Ccn=ai=8u83$)|1TX(<cu2DGR#NWaMz?<6`I55dy?4lOh1xJLwQ*ENRG|
zhR_zT-sV^Ecj)q)RlO1m3JSzP|Ey_SaA|N<5nC<N`ISc8L1=e@GQ~<ZK*dj`MW8ld
z8TL#9Jxzj=*Tg&NM%9Uon#ea95}ux&Ri^{j8l2;!!@|S;{ph1mg8T2$*}<ME2=~IX
z!-4wlD(A2JxZ(T;pHr@Lq9s>Ghg_~F;N7?XRrCdE&%nv6TaHw1XOJ#5a|97M1y1r<
zFMd+ixxTv{VK@8NH4Xod71}DQKiY?cwPR|-J|Z|+i1n`$<P=AHd*#%x=Hse_8cqqq
z!GBn3&u`1zgx1jts_>lRmmkOsyCY~va)0x5f=<*qB2l|Fd6up%{09(EF4ARlmXy;Y
zJh>_!YXt9vc4W)&BI>0GT<?OKb?t#|LT}+61Z8KvT+X&+JvNa;Lp!-lA1LDBL_ZgA
zPfocl1MI#bTP_(|AuhFV!w&C<Q4_D=SQjGb^mD=LLQx>=I4UlZA3B8%@Mx4Avv+tW
zO(XV$GY?1m!nLRgV}hHPD#Y@l!L6ePZ&K^CLJsW)?pIE%mr6N*t)rEcM@{tLb%+K#
zS~H|QyJ;S`$<`+EFeQSQ%Dpr7Yi<AJPRr>G<JBnjY}27g?WtNk!sfhJuAIVlm)BlA
zyBH}~3gFUuh&`_+byUz;`KjxX^0#ysNK;M^fZ^r1#59_TUjfXnq1h%sy^O~KM%rc0
zolS8BjuNbJ3jA}mwY9CM_fLX2C90jv;-HXS|99;mox%%RF!PHpykapuimnJ?=gIWh
zJ?i@oH?vl=n-sOLhe3tq3|hZ#bs0vP{++F@v4?iI{OH8Wu$`<F7h51b*+b~!gyV;0
zH}s+GmZ3p9x8ec8O{y~^!a0AP0qb8!^dKP`vo9^bEHT)Hroz&VuCO}R7n`#;ueuk(
z22MakKnwwdWj%&}KA22E!$W_M^Ve~5+f7hycHc4h`tX9w2gxEM@@EJV$nme~b|$27
zfc%al=)<VEn%*`L{el;|Wo&ehN~k|T64VJ~5-*&~^&UMPPHJvzQz|YiXZUU2yu?Bh
zWI^)72fcX~k@q)az19Yj$n#-6ipDrdo0;`R6|s>ti9VnpR7s@~v4>NmaxR${#MJb5
z#(x}ISbmK7Ycr;%tUJRWco=bB1FbA{$fb^aM@mTWSCOLvDQg?qrtdb<3F{f1+A3Bh
zd;)q6jKSKlsT;73?<MeE52CNu3NQE=V};vvhomF{X%u*p95@sMsD1SW&AQJL8TYk#
zuz!GVi&+o}dr{-=Bl!vMUsWM$qoyI@rU|9H*l}es-QaWW2-d-JYF`&|>9))Q`VlK|
z(X(Qtf(0eda<T4gX4J$MKyD^?Ldn|}$bDvE;rBdFl-mi{kdGTRrnDr~bE1?$C0<25
zic-S!R!gTCDmW5nLWYXqh8p7_3_eqP=H?GpJ1=Wd#HxGtdnbD2Moo|jR-%P%i*WOZ
zE8z)v6{_!x<YXgU+a6kp6mdRmZfzikoa;wgt^LxJ*Y5vC09M#G41E`iGSGe}t&(ZD
zLvSPW+w`g!#=vT`<|Rjb(@kkUSfTua?VdKx|A8xvoaL4c>6HOF=`E>rH5ESRS;p>j
z0aVC_P)^TKY0Y3PZcS|vyKhhi!_)!J%NW0bnHupxfaC4B00@gOB3uEPCo?_Ph;%aU
zZyJ$`$5&omq44X^YjRncpI#2<uVX|q%#YBx;|-8stT!oVtVp4iuoE%+WUDTAMFL_T
z+M}3-g>fzM5)FWACePiZ-M7bt*$JQsXiyq%G|l@Ei$EU3iNUE^=OkFY4~qT&)cVC5
z?C)N*MeS5WpL9d-LYcl)+9KIz8KpNuO!64mV4v3%0OO+=WY7%G<YV?rY@||KEYUvI
z(}iNU$d$A-KB|RS>eRI@e?m38&RcFL8O648>LY63jE4;+6y>!+di;>$S5j3>boIa~
zdk3NfyM_kEf-VD`db$E>uKxh%Kj*Fz^zBYJyXm!}9lMiG%j?Iu5P%WO!CF{^e|vk7
zqWZ1m2^3`u#0$==w`D|6Qtp86Lr$)}kj0ecCc<|0#MLc-aV%@T&bgur<^~H+98;Ju
zV}kKi^xaL1lR0fi>H|{UecF$G>7DF>EG#Uqk@hd?<bB0gaRXMmXvB~Lc&VEiRI;O#
z_$s`x_tYS<vzoT34+06D)(;paeQpUQZ$pJQSxE`MldjC65~5Z+>jG-34G}p7=(Y=C
zt;Cr;IRB=$u-$TVxoC@9%~&Cy+AvP|SJAXlfQ9Ba*=kAHGAXJK$V&9`gxFE+{k(s4
z`g3XaV{_UHLzveghc^?o_YIKfz!trbcnQBkt|~A#fGc9im0=G*)q<P(?I*bO#BU{U
z47NiDB>JAL%qp5$NdLe5su+!QLnRsZN@|Q3w$bN3;mVHg@l&Q6!PkJ{L*y)I3)_Q@
z`mCheRcoFH_tP+nWouqj4lGXp@CQta+!ajWJ@GdMmFmFqSS2S6^oujh5;fO3{dsSQ
z1j?bdy*qrgQ_^GN=lY7ncuP>eES=@j6vXE-v|o~k<|LNt+lBDjZEPYiGR6QrlT_k_
zP+0CoF3o1FiE&?SI3kAB2Nl;dDN5rjT-%~(4P~<sZc$azQZpUWg$Pk6@1#k?OhHl?
z?6nh6UTcVFN5>*p^tA*}rW>BbJxQT6VR#8JP!cg1z%xOXe>0W#J7)c-g`;eDf2YIt
z<r&g69|o@c0QhDF{!8<6c<K@QpVwEh)LV5N5N!{w^j8Qe<<g6FbReAopn-nr3vb;;
zPG&K=$xLF`U4x=$BLxASXaE0EWwr93l1G5$vJfub$%J^u#Bn%G4Yl%*NT?FeK1^+R
zp1<q}={$fwng}*IQNo&R5`&_X{c5*G*0dX?VRXUY^(@InpdTP$$)Gn}i15&7(5M0R
zk%9AHm5<80K-VWxju1y$F$|7bZbhHX*$#E~*{p3@ZagG(!$XNjYNvSJca;^0r~ZH#
zKD*`hB~+P15cVSCP~}<Yva<wAS5cgo)>!eLgsWXmxR?mV6KOJ36U6zBH}ZLx#q<1d
zco@_lyjerH*5h?tOZhGPO1OW;ihNb3Pg$YMcXBJh#(Jv`T=L_+0rEGMc!4FU{Ylg$
zo?`8LYv^Yk8f`mXkToKG1b{%5&J~X{L7^6Rk4%yc<|f`x{AVm2844U`gMoJ6U*%FN
zy&O$vM4#Ak-#=D>XM5^m*QwJBGQ_{Ku5Yl2;`9^1sd<;>l8YJp#=7<pJN61afEebz
zMBZPiikTHX{NTfyYg@>x2%KJyNZ_`MQF*M1ZkNKvqgm5$qGZqCWR2YyWl*+j?v3l@
z7X|h2_4TgvSUME$^@}zaKYnbL^hP&)Y(e*XIZfrDy&z1)e(!zKV&`s2vu{N>gE*5@
zI<whW%WY<AN&u2{3h@o@Cz(lgf;ZJr`-hP0@mGIOm{pA?Ybe8QiG)Gdx~p606X>uI
z3+r<k1#uQCu4C{tf}!_0^cm&B#L|7EDU5{l<X$UY$8&uijNNnt*>L)Jr}!;L5X%bb
zhbnMyBjl?V^9*-nX~{wg8VXN-#$WLrC>r4lw|+{_vyqNcY3~sX6hk@vZKAgZQ$yxN
zv!?0YtQT6TFVDbKDnW=H)}JbXqsMCEqLY&oxDGsIr3>_*UezffRc}JaZImDTzUsh>
zllDtH$x3^WYtm}_#LGmUAEX~0=%)8gwb#^P8lCSEUU}1XPCpdGo={*i|1E-V8=FBA
zA9@x|uujfn*d2uD2XO8a1eJCa->oI@e0}Y`*)KQN@rx3^+7i8}l63~9g0>Jmc)Vs&
zk?f`Gp6_{G^9?eb!I8>xF5WK2N;^_@deL;7@IB&pviRn$$z!5pK<N0N3oDEbmK|RZ
z8(1-)zZwe{ZNAV}@>^Pf#C@&kZSBegy%h+z?`ghSIOloSSN@HpPz*k6{9qB=Oa=Hl
z%~?6MCqge^lg1<6#QyE>wfX-I{Mkmn-|nj>$1n2!EU+wkGn=Zp@A+NlycayPiXgkZ
zlirrvPztqZqHJMQ?%9BI`>)dG1%@}r*v3s^9yA#;X8hMnU!7=+gVOBH0^WZfUn3qe
z&={rPcux<GBUymSQTgOQB2;!*2N}RSO`|QYrt0tn4jq4WV_6R|OBAaG$*(`kM-Hwc
z&mXubvUnA93z=U$2=;Hmu?8JeAF;JqH<iM}eAxm+U@$)yL8iOTzI{8M#QCeCNORI4
zD<318IuiShdRFC#CX0#$ZAngHSiBWHlXEhY<A&8gHo|$XH~J<W2xX~99>V{biYDb5
zz#GZQt7y+-`6z~GY{XNUA(}Ch7%H6ZiGK|_tIlWhR5618S8yNue(}^p`ArcFf5E9a
zh(Oaf6U$b-na$5n_q<<I{kAIRaI6;-vF7R-G8-d?Efl()J9o~EEtkigBI*ATQ#+Xc
zr5FsRTJie7$jNbXdwJ9C<;AKP&1Vw5{ho;hn*tB!+YNtrj@RMRWPQKzGJt*nc&L?X
zQB8yH6P?%e0oVq0sAzgVO`hh$&fnDx5O7;Z`@s>2DxFRwLi7DoW%iIGgET*ZJ$EOu
z1D!1@VZmEKT~+aO{N^TBB3b-almR>8%y+`%3Ur+Ou?5WND2CK{Viz}D;U0Ns-d;uC
z(U_p=JlxK9)e3Zxok5-<^qCASXC5~_Bxp>5SWzB<b49BA1i+LOcPK|b5|{hg>ae<N
z54!{yKHpXfE>k7LIU+Dvl-RX3xk{S7pTSc){FW+^llok$-;g6^*&h}WG32@axm6!9
zU7Llm1+Jp)>fx|M)JjP*<sB_6yyqi8N_Tn`H;KHzNYw!lGBdXIb|{}%GJ2_)N=P^|
zb=zf;Zdj=kSk}XSi{~GJVd6scvu2{jt)r9>2x=3eGVULLgKcZdgE;m2;%QO#%2wK9
z_tI>ax&<hi<xa%&dK1@@B?jV$R_aypTiK&XUxOxTe=2jc(eZ_tNQN_cFflXO$fp{d
zPxBH_4g0mvn~-xt)L?6ij3sZy1(EmPTkOv%SH*O&?5Fnm^hCIo58!9?x|{|u)+h$A
zDjbgUCnnSwE2?6mq6|RcKJ`N#113zNCsY!4D1k&DOy(+f^-q`C{~z}Eq6PtY`8M+E
zEgLixiSM*{(d0u!T(Wo(GMh&h!-97|?18H(%|L?XOw4I%xqC~s;XP(&!(xfQ8;BOz
zw{*EQXrjsL+@YF+H>}p=8eC6kraaG24Bjoz9Ei=bnV%|&gEDQ_Pb|8|I^+*0x#$TD
z3AbkDo2Az5y|Ct|5>+RzX+DLhpxJWPeS!2hp&80OvSIaHld02v+A#4g_uczXcU3fk
zZw3l7e2MWoIU=k}(m(ja;u!6DrF4mjy`QByzZ1@z8-uU;SykUv+K^xR1q8m;!GB<N
zw6ZCS50-?PUzgHeqqE#-!a*N>2W+xfo-B!kf8Qt^aE=JG&no!fXIlFJ`IdfKY~*m3
z2SZq4cAPjDap9yHc?|;%)AroXYBEqR=WycWw87vrYZ~b$g1lBSu|b@-f^9hU*X+Hn
z$w$p*_$Jt|jqV%`ZIWmL6S5Smoo}J4DsIPQHP7$;Y#T|po14X6XE?1S)b#fK!}zF@
zeq*LLr`g8&iGa|BU!P276eT@8GpG;ly`&>2)RM~0w7ewcFdGt6SyThN-cLFdf7hh+
zfAA@RJqT@LJ}NnDT65fwAuy)(_AE=9{!r~{f{`#T$`0)~K>1X?Hc~(s*^D*aE4d#1
zKb;MY+bX(TGc!zgd$IEK(`;y>FH%Pz+@}8H{B(z1t~HwFqP@&Ek#kpc9>kurkv+dN
zc3Y$a?>!xES&>t(MZSqda%!C9jpAf%*)0{=axqNgqQ&3j{Nl{fx#i>ce{fGQT5M|{
z8}phvVm_2Lc+xGQsK0ZqeHJxKaQjk%2OrV%ZWb^1^I(<qjM+!(AKu8C=~jAeBF>U!
zEhtS0;OlWRx7U2#q*A+6SnczT_UkfFeV)B!IdH~s@A@r+K93hox{3YRR#g@)_wrsY
zT`jj`Tbth0na?K0$iJ=%p(HQLkzc+#QQ488%zWU{&*^iQTMGqR((>JX=2qOdafgn`
zPIYp&pCm4sd-$|SJQCJb_@l=+n><7cq{LWXj*zi&c=N-KG?1w1d{*zW&d+O~-X(?)
zTzdP^o=hfh)?GtaIcskVDmUdfxx->q+fk#WCVg&QsD0LMuFwzt40M|7pJSqt+Q_Bs
z(OFl@OJG=`W<Yz(G0a`NnQ`)Qxv`m3!!v!Q^WV354W_46@l!dO4_M|olL|4PaOrhs
z=8zdy!La4H(G>=kszkwwmUj)EPK^I-WMfrelUm7s_RKRAYz5*6r<!44{z)(=77cgg
zn;VIx)t`52%R4_)cUai%TR^?Hz&A@xVaF9KDs2@!>8{CB{UUlV22-kH3K(MIKb<Rj
z*JcBvb#Y^3<AFCc>+l{Oq_khrbzZWGLV|8NsbbZKv!s^kLq0jPcdR)WM3c)qilaZB
zdx7L-UG|VJf^m;0dSTP%CSE&rIldc+W1yjAQicclvij0gy$wFg#8kar+}{K5s?eW4
zd+L>fmQetiECmuqIfmmQ%+7&o#DVv+q|U$M--_Yrb8zIC<PR>Z3ZlDsm?yB9_^}tK
zFiP&JMb_HMGH|`sS3hz-Ud0%=9EizeS03&4COAiZKAut80n;0gSE54Naq&F*Ffsi-
z>ajYG8}0_MwbzeMv~u_qa}NtxdOsWCm`l`5Du*iGSba9P9F5CRbdL+AA13Lh)w&8C
zu3UO}Q9cy711Iv`mgEecud#Brn3@&8syhN^Pk$ETdA^il_*TLZBAsx%d2C=uc!3ZR
z(_NI^)ZASB^VFE8{YdQ6QNHg9N47N~<i*XPf)huV(tCMg%Hz-V<*#28Aq)+u-nZu9
zkmMqu*mmFg^vCMU+Kl-vffu4~AG9zx&r;~P9O>~{BJGH=v9Us+?v$<2uuJLba(_ST
z7}9sa2U`cZ{<?j*U{w{|URS3NZD`2Qt?!dql0clQkNdztT9Q1$NIGg_PueTDS~&69
z*uq9k7(6tkPW-(s<7V}!ye1cuml>BhnCn*jPm{*8@&kC}>s!rREg0|6jo4ABDf`j>
z9ei9~sk(}&_S#*WaY(4iY$J(OcgbKXZF{ugv_2kDX?TI!E+rC6s_JR=19TPEhh6&8
z#y7=r-B)`Qnf7i$8Wv7Bs$jKOM6lWOjFn=PW)1_F+t$r4y^(n;8msdan3B}jujSQC
zT337s3{-ixtG&P};L&k$6?C6G7@$?}hOI~Wvy$vikBLuW#yFKn&?SI(c5OJ-!g19u
z&@^GrD-^NnjCSfhexc@+@E*fe2aaP|y^1I97Yw%5!5@pSZF$jTBDSl2O||onQ@duq
zPAomGAE<{ds?n^8f3DW7*$oA(gJd-SGZO3He#_;F=l~RUx-Alh(y-hZ)wzG&*B@VR
zI6Wb4UjEIpVcFHPsj$xRXn?YL@W)>Itdb^(7L4{I>ES(|WEZ{GU-I5|oG95{=T6j4
z?g+zFg!{@^n=+I@g$c?~TQ$XMJMO6hfCL|E;lfk9EFNc285XzrIwiBpaR0o<M=CU5
zxXDw)uH-?jRURv;iTw1tmAIoLDut$`eORCR-wLKu&>Ji<sepr@+NtC>KgH|5{?(pG
zr*<h>ecK$AB*vepY)Lu9P|=c0t*Nz&(kF<>I?K4ZI6L}tVkScF+Ex2BxGz29MydIj
z{EI^Y-IE!!&wU?eB$CP4D2-nS>o-Oyhi}bjTU8-x`kJ;@xbKHJd2D!S$S1nr%huGs
zob=!r22bu_yDCVYC_q)gZ(3G+PIfL42iyX7HQQ^S8~ck!ow4k=p?$XO<UbiF?(_2=
z4*k|y9nR=mIIKGnHFV*^1zp~}2yM7XmDBW+gvLfk{WXnHE<6REvHo*(W_r38CMzad
znwtw6r5tYEbgf42_td4iXXoETUx>l0naFQ`*rm{{_sP-7L=;o=j%rC#>4O(Y`(8bL
z+7~}DbUUL=nLRuD=Gb-36(9M3MY4wb+)qpH$dnPiWuSm;pv~gHak=D`6j$8gJ*0Hw
zMuXPMqGMLdW3KOB@>ISw6Le=0KR6=y+=w+$-6zp_plEb^?{(#c;a7TzNPsN<6=4mN
zkt)m{+Dx?ppm7dw#6Y5&pSPLO(1M4n=PdWv|85(OSC`}RYcmE_Gv*`F!#Ifb%xf3-
zf+>|&aBa&+EEAoAlETr;Gas%weN`n^cg?b1IQvy;=y`QUM#cmnA!#ywEr=>bqzpf`
zpe(PeSVN_a!NMQ?9OGB-D!`5U2{3x!sXuk)Uu<6WeN`U2jJ`uSCR6+1x4<;=qG@@f
zyYQBeQ4%MfV4y&8a`LY@sIieB&W;!4p1K&HKjZqn%c^dL()(cfXVi}uKRo!T4<RUN
zqL`GOKcSdo)Og;?^a2k7NdZ<(1gr|6RL4W50=VObOy3X@e>V4@81V<$?2Q%La0f-{
zrrAHw58%3+3BM-XDQd7PUWK+C=c%%s2x?Kz*F@FgMnKnzF|NB^p&wyTG;VHc^50v;
z7s0rwn%kswfRm{3!iVG_PkfPnu^gYz4JAs}>}$|i8bcuNml(K56*D94PQuFW!#o)4
zBAKAuY+_%Yk^u}sSALV@>!xKkx`(3uY;H>$fI-=&rQXvA3B(%IH$+sI8=IOggaE(e
zC&$LPG4z8DuL@Big<jTHT<?R(A61zwI8b#~1xhi!A(j$SRYl1l2h5qs#x4dlwT+2x
z2sw6L!|H&FP!c@cYNgl{HTKxJzcF7G=&8~PPog&Qm95%3pv5`<_5sfKoKKh68<70{
zA7{+o{K8ju+Sqtj#(so9OvX54aDCUTNAO3ZPv<7|s$!6M!F(ckC#MhCkE9f5UgxOI
zQSkJRDH<a7lkdKHbzFSv*<d+V9Cze=>UrzWWcj6Hxn%0T{ps9GN5oVz(T&|%6|-X0
zs8^ir<HyNdi|I?YLHV!o9-886D5%!j$4Xnh%c;7}KfBw=?-b=Busb@y0?P+>Y4&Jy
z=>OKT-;K+OVI=`wCO+zcJ9q5ZVS}c9hd{X1I{T66p7DQYiSi?9^<8VPc1r<u(ZM?@
ze1P)@u7iIu#&HYcrtKuZWUr{juZzgaFJBYAV1hg~@$dW_ODPrOYc)NG@;@C+=zOsY
zKIVF^i0ZMUqLG$+s#F-dU5Teb3oL<7yj00ql`#eUB+zZYV}&kl;hhY@!73WLX=P%|
zaLbTUvm(j4ChcbV&KLGNJmz}wmty0CORC*EEWro25F;blzn5%~*L3nw={1-U<*BqP
zJbQDOl}1e9Tz1aRYXX8cY}QY`tzU8_2TRziIbWfswj3~M4w2>#DJ5hd2ynfMCEa)9
z(#Ui_<5Dd0m*!xl+(yk}>0$1XnPHKdk;ZypOH<oF$FGxCKVSIE?x#>Fhnb<O(s5yH
zub#P*0SN}!G9QM;l#FE)O6R}7l^jm%q674eEGdfTv`>HeWJA=V?jZ<d(SC>}dM2MR
za&i}_{#Uk=i3cfsS@-GUMS1&oiPyWXFU$C?pta9KrC|ro#(Lm^u?cfv@IS2WPZ25&
zKv>yZ^Y>#<m9iZ_#*U8&_tHzzk%582A0|FI!M>s>FIQIxl3ftkrVr%vNpZ;>3~g$&
zpoavWpW5Zmx8xAG(#|_+Z9h^;sIBj|u6A}OD$wCegm-+*pz$_&LLX3RDY7NLS!n)@
zAO{R_^|3lt1AqRsWMnuoy;xHrc3Y-~vhDPa`(+KCo&HP^6IVj9G_0lSoZw_Ghtdkv
ze*y|3jEc?5JvE$#VstZAK4Y+^O<iqL==$DD;;+=7u{Q&U$u5F{Wq5!t&kv*(Fa`D~
z`a#tmR@9x7x5j*gRhVVCy88fu#`lU`m9M2yF&-0T<1CZu2E@}uiGQHS<h?`3N@RFk
z5#Z-8jAKS0nZq{0t%-~1$e6#E;m)`u7<k%VDz|AFd<#h`&5826x+;c>)P*TZLN5=|
zNawcp_HvxuS88}&(ehG<n`2fve3H~P>x3@j&5Ey9&B>MPm95(ux{Iq~c9SRe5@UO-
z@Pb;_sawnv&2C0UNlbsq^a(%x5Ne}u%ZQoUkKt->44g)%hzI-Vuve!iA-u+3!&LM4
zKGK{A=`?Rbu}EhqPu<Fj%oc&cfzyN(!yUSnIVFFlriynb*@O6JY=kCXKwAC`Ui5px
zW|$YEO0;!!Bye2a(qELFmeJ++=kZPVbF#5^&y?!H0>1tt?az6_|4i6izD%EN*DMcG
zZkB5aJUPYo$|YY+eDJf^e(&12xEsPQPBF?DpuzktX-)Zs#*8Msbo!)y>nq$)&M{Qn
z%*tOWrdEe*!;AZk$HLSRxqdAw&C_V<rA(g?l~!#yZHxPwVEtu>Jf1Fm%VOrmHub7G
zZR|78SQ!|I)A<(~C(h=2O3YVJE@xy&vPh>I?$`?s-mi$C{pqErcG<j>|7Ll~d{(L|
zhTDF`$;aEfQ`s&+Dq~PGAqtwQxsm0qm#*(dRP3`lEMAXt8~Fi!;z*n-bm`5)epXMs
z#w}Wnpapw3hCuk%xS2Pbm=gb?q8EYyqiv*jvhhRqkiWiBbH-pA<u{)4d7{EO-onVQ
zmA9Ui(C=bK55o5`_DM~nB$mH2MoS67i_sa}*g`t#>f+(b+2Q3aY}qnZm+_mn8!g?-
za3tNGW%9J36ftZWPWk!bRdr`~F#cJekMSfP3o|4Aywq^gT~=gsxGwV%?pUTHHMe1w
z)U>bXiCqNTitfq5hV&V5Ic!dz4D=DuNW<u)XJoXw&}${Zyy7cd?dN3o)$_{1w43dP
z!GtR&^1@ae#RrZZ`!a_MUWTuh3*07u@z8DW7jm^Ku2awSQ#y%9fM%@}E_$Mll@Y4=
zhw9hNtG2yA(PtC`Vul5}W}9<Pzq0W|o*(AT1T%g8@n%*b&qoC%!yrPbG)|V(GpN9)
zV<~X?B2x{B1w#S^^?{V-a`fA3;n7J-wewSi>E>5H*Qlci_1wi>Pa!`>r}UTN*GcQK
z8p-5`KTw67RuNh`ntRHZZcw66(NsZ(!5NPR$Nd6QPIh+qho13B)KTnhefwMAUG9|2
z%GbliaB;Z2jPvA9C?HQAyULcXLmD65-&#5{HBe85iBK6E-$h?sih}KtpX%W)xA6ZJ
zBBqq$YU!S6j~{V(Z*uSCR&0y9lyG<&%hZ2VSpX>)e<tkco9tpYDD|fF>N;}Gbq$Xe
z(Y;D)k-BMVMcJmFf8VlNhF@^a%*;HzeM3ka8eT?L#bd#-YJNop&?^nJwL=q7{hh0J
zK7`Sm!{Yqh=XqY))~fAgyZY76F6Yl8PQa1SN4u_ZsQq&}?X?Yt5e&9%L<^_Opv)J8
z$B-CMPH{b9Zce9nQjMnP@Z&C1zx7L)iJmkvGTO*|h5p)p>z-7K!sUA@^AvZ{2_u*9
zH?=9*k34|9t-ksGs$&1w2~ebCo7%=v0{xpr?|{`Kd^?+cV}V1vJ9uh6V!H930Wpqh
zTM~4I(E$Df!uOxkQK_x9F)~!&UEFa1Wi^jIUerHbf>%(E?dll>3Nqbag~j6Yv^KRx
zvYI=&dmQ5=OirAT`^xJ&yfdd{q8U8NDI;U!YMA7NDqiEWIE9A4HBpu{dFtDb=SVEk
zdoW!psCCB*`uvo~$749v-h^eRq=kMwe}FTO{<Kly==y-lO%IP8Kje#BbwkKis43Vj
zFpc?{n|JK79~nR}rS5I@N%!n(#u)uw+?JlW&q>*MR*X)b)Wx3Gs`zJ87n?05r#|!L
z;JeNk4x8&0$76k&D$i)%`}BJpA7mDX2xIzlzp0py$NjJSjX%e{Et}e{{pI62Iwou`
z?elOgvv5<nHX~!WFU6t!sjIMq7?{sW5FEC|>XdmXw0H6x90~B~AItYYbffKScVhg_
z;dQ>k>X8ePB1(pQGsrElEfjS%=a;^8DC?Y_9S|7qTiVCf{NVAj)6My?b@`oF%BuK?
zXPKGBo_OVl@VS!hsxT#0FDo<CNA|u}7Vm|GkM_Pf$<wpF-g#2}LH}7a2!`(ApH&`u
zZyOVzjt%q~5iysNSX%hLp;I&2fXml`N#X9`;c4SosQk{&qGsLWbFzH43JRIUJ7*<(
zTPs}-?k-lgkz)8T+815k*;5!6E|Z{Jo22ZKjbrb#dT9@ih0gYcS7|-%9Yxo=W;=El
zNcCqgPL7*geI)*-&7SW@jO4<<N9X>kxf_Qwm3G;+S*#R%R$Ex`9{pS(vG8wsxJGUL
zRKE2`zmlrj`k}%H_xXL7Q>@tu41U=Mt5vCQr&m9H{`PKEkPwobVj)XN0KaDW`u3HP
zbxP{RSbv7=R~j6%oo>3>Ok0_ILRw3{_K|o2nrJ^_RIElznfda?*nNs;zLDznrL@+<
z<n9DR8@(Dlj4b1rG$ms%NzjmSKQ6*J`Q>rSSEftyfxTGp9U4)wq*&j`kD@;wmmALZ
zGLr-)Jxi5>JYR<30?%Ztl-|wHSrFCQ+BZkuY*DOT+qWW$spO<O=@xU-AI(KH`_qm|
zHLsH<Z{|gew44_ndECW-Pl(T$(stz2)gLD!nr`}u9nIMo5&MU;hxHEquFX&gJEa7*
zV@6Wbek;*92YN9VyC3JiUFoB-i`(9?Q5pE6aW;b0x@Xnl8WgCBj$vL&`7=C-HV#(2
z9T?tKRC`;=ezVyF)vPoKh0kUBD#;T!=|uijE#vjeE*N6T6iCIX&aJ!f$yUyKGx{$L
zS6eW9YhY<PMg+?AU4(}V_>|4W_klb)#Aq`h<E#mqjRNe86#AizOm-pyQDd4Ll*`42
z(Pu(_U0raWeOBi8o#Q?d{S|-F${$3~f6&yrK6(EsoGy7Fklfc3jhqa;BGTku&~e4j
zJ5fP~JJj!k$-)CWbsve^vM3+R+J&;P-KFi;=$BJn`@ag7M!S@Zj+7r_B*c<@U#4Z8
zrqUF0hZgeM-7KiFG`b)&EHdJ2sjf%K;lD=LRFhL`)tWccPtU}etR)BZ>4Qev3s#s3
z?3NfF+XVod#kGXJ?=-t+wKFgaH6CZb1FdB`lF^|L7L4eB9kExlRyD5T@bt`|wVk8J
znv~^36r002Xx}Da16GLDvET{)u>8ej0n<-yiERQJ4j$FQBO5aY7s@OdzioVA6;0(c
zyCL#fwZWx0F8n}!io>v@*?{@X##K>uW4CVIx{kh<(6D#B0k`L9dRX1Tptm){+J6h%
zWnxroPY`i1-t3AiPn)%JvfdCScmgMff+n?<f9QHj#Bog7?jn5D6aD6%lSWAD^z#Ab
z@ZHNw=CQhIJ6ZLTAQq@Rzb+|;F)1%m(UX&E7hqG$0j-SKg3Fn(jVyL67_0#y_a=7l
zpGEEfjXL5vdtFx6sd>81LoEq4-yiVy|1vzne_B`b<fn@P7VFX9k$Tw`YEMEl2jvO#
zpW3jg_IbFu`DNhbFN{Mj2QDt0eq#*tOyB+rcwUpI;sLXEbIa#(bd9EBr}Hj(`qah@
ztLVjGVBk#gj9FZIyQ-(=Ys!bO3l8`|_v_R2B5u}qh)X}mm{GPGD#ID9an**##u4u_
zuj#BhgQtwX!Ck<zwVGfPHi;P=ypWZX<DvOPUPUNJ<x%*9xP7iRMyFm0-p^I}mPh0j
z6)By3y__g?ggw6eK>v1c^D;k$MTT!Hrv-k=-F!Kjr;SOjdC|IQrGF>$YARRRj}(UY
zgvnOD`MLOvoq<3w{8a`%vw-`|8TCsl5Vdom51rKPl`>8Gv)Ag<G5TV_CBF8hntfO+
zxHEl}$qV-OV&NF2hQw)q%703tx~a=bs>dkuc;@`kmP|@Ivh6jBi}D;S;oI1*Ml<Ma
zy1OD>#f7)S%xGj22@M7uQI}8;cl;_EeToP1Fc$f)`y*rb@Yq1>oOdDqK$d#ZqZkLV
z%SJ5nQ!R$V82=jo*F=p_or#5H7JezeqbdGYa7xDdckYc?0fpVnXVoDL&*Jov!@|NS
zY7X1Q2b9kn1N9h}u52P`P+D*Fd&O-CdEZNLGGAdJjPmiT+H$GYj$t3pnr;kvkKA*c
zeWl-OB0W1>$OuYDExm04-Q5_CS|5D;9D976t?Vr*HC;<G9EDIo^y5F9+Jb;H49J$c
z>!<C}?@@XszG(9I!{6d*Xl%^lx%*|)rcLemj?Ji!sQNn==yD?VBef#Lh04P>@6D*6
zT}q^HQgnK$FyYf|?r{vOjyIx29GQc(Q@c)@;oEq;t3QXc9UOt)4k|)p6Mg}Ql@gYz
z|H{}K?m-1gRKo%)j6!IWK(z$C3fVhjb^Ld;>v+tnu@OMn_9x!gO$&(CN^QeOegJQ<
z^%QHp32bL4-a7CaIsq22xc#%x{-E;a2!4gp>bg7>Q7+h!bSbyOd$?evE*=^j^pDXI
zjR4NzZM~klp9gfZ2V)D@ao48dI^cLxf1W2W3-Y5W#wL*>s*CA&48Q1zgTn~xl`Eo*
zN49NHNBleFZ_5fEj-d$De?qScY6a`guxHbEnQ+EJv#*SS8Ou0??jYonz2M~PDH@GM
zS&y0Li*`l%GnZ>8GYqF!u5P(R*(O3xF>(W1+Hy_w`Ds72UN#atplI){I+vB71Vf58
znCP~ISn$Vn`nMlp{*jF6l^5J6C}yPe%jO=r!DbFwODH%Oc?ftMh8ogOY~)os<{cP(
zitv|>^$j53{RgLwI=yAVuM&SUPm0K$n6B)}q?|H!2y=d(f4osI_~UfO{8syseg*-o
zmDw2Nv()}V#{}nr`=395mJ0nyMHb|g{mKE#SA2ejx`SZ=A99j}D^l^l5fQ8h{&u4{
z+`uv03~^A8vJDt`BSI+R!`Y-6l^i84YxS8H>dIrRKFZ{mFHvm5%y>J020`Nh;}a)N
z6eD=#Kz4E9WFFG|jXZUOI2rSc@JOUl$m2}JkYAS*5T(MzrF;Ee9@`>6t*x_^GaFFU
z-5I#kaQY$s{*#QA(V|gx9Pzgf({#lHgp=2IOX42Q5{i}-$5nrYGv*`kibVY9El-Pg
zxuyPZX>ILn=1XxR>|`Tl>K(6ZXt1xD(MlmcTgb=qXM?cJ>oF)cwMl^ysZ1Jwo-b_N
z7=SU(sd!~OAtY%NMon!T@JbP9d{l(WQTO;MspJsdo2jCF)Cadd9?kH!=VUJZsp4L8
zXdz63<G%|(=s_yz{5=^V-wS)1K6t&Ujn&XCEcgkr2oza$tfe@YJ1?~<V^F}zh_JvJ
zKNsB*SU|xE9yLe)+JJ!UmL1G%p9PqD?9%&<dY2jZqhj`~c2)y~)r}$0$EcAwP6}a+
zPVP~}8{v)9v!v(Zcy$4>Up96Rj(lBWdWkAMIRQ&U2U`wCbYu)-J+em(y$m3)2M}h~
z?FV9{`*r(fp=!x?63M9X3JTTj(<&TfSxka@2>X2Y>YAw&)y_(k-`9xIhwwre;@FQp
zWek?Lu1<8Mm;=!Tu!O}#sDhP21&xsZkG-$_i)#Je-b1T2(&?z6qJ&b?$N(NiKw$vs
zPyuP_E`_1x7$7YeFj6YrA)um!2na~4bVxV9wc&jKhv&t^oAWv6%*@{V-gm5Zt#w`3
zhqayA)bVQ|d_8Ym?Yq%d@8W(o(1GFE-CVyG=%JdY2!yRV59ZYxh`Dmt5>a6P3^om1
z25X>L7Qp*N28@%R6Ey+ob_BC3&v|HV@`rZry?^jN5Db1R_#zPbQ2}U0xuCV@sH&gj
z4|~KQdu+2_#79Zw3ridmck?soIH^H}y0e-%A<8+;aM2A;CT4J?R}^-q`L_s8pI5}1
zf^G+JeNWzi<I{n5t)h3S5`=eNfcEX&mDioG_P)>i9<L9>hN##th(f;GL6kPc&x4oa
zUaWP{t@C9@xIt-;xu2f_uGyOd2p8=92H(Nqz^m~015*mzp97pU3V>nI)DHbw+OWc;
z!&UWe-rO)m($XL=4hU=R<c@5t1j9HTdNNjkjp9Q$qZnpsY!CJn+QW(xDC|O3mx~A~
z|LA>0FnUGwxM^#MFOt6!kMDwpAM{XXh{Nq=WFQ}$lMju!H{TckmO-o*rNF+M2^UD6
zNWNgD0o|-pkc-L0SR%=ENOzyH^y7EktB(3bvwxd;hi<^BeFi=O?M2a|L?SDq2)?QK
zuPcyt8{=n>#w}rtKp#Vb;UXB)?VLlRy=8cB<yYxM5;(vgcCWs+kK8Ou)D~nC>)4i9
zz*F22GEuFrejuuCFF|Rd6pn*KXf1WnV2dm8A{s`3(#tY&>IWcAp0Lju7baP}WkcBB
z5MizX4(I1rg~lHomZ?jALzD};=`{lGJ#NhgwgCZXP4Ihnw?<B0UMgtY6a$r0yQ@Yy
zpu&M}r)b_JVbLK<)T%sB#sm-MA$jf)PsvQ?yl<8M1H{SR3}OIF99%w)N3Uz#cc{%L
z)x!-A2?@KfC;*vJD+Ij;MX}AZG-Bd}<}nweo|JTAjTc-}Qq8^y?rdWW>KKVoK^S1B
z7!C=$)Ze+4j-bVHA*2T8ath3{$m`ylP^jGd0onXBRO0EvSv6)PibMSF4L}zmcaLF>
zyMSN$<SV~7^RvuF000)-dr<lAFxW~TlR9KOdvU}k1>`-Eg;{Wput>7?u3|&$ungQM
zGZZ@wd}^l4nINv<hdOaH?gd9}1NPe=uR-#f-IaVbh=5Y4%nAuVdGoY+UJ#2U4nGdg
zDsg1E&VUIlLQe3++6u)V`FuAk>}a<;Y3*?YT5|g7dfrda^^H{+O0q;|695z=35+FE
za;he}vs?P>8XC$7p6%CKtK8~)y2>y!L)M}JqTnPGRN9Hhuw6>@&^;ak&je-~@n-}D
zOCVriwtV{|9J=|S42f0|e3xG<=0n+L;&6zWc+;uPkP%kQ@WyzW2Sh8|p0Xw+!(m0+
z^l=x0`Lry*1ZX5nz3p)uh<@_qiD6DrKU66=E!8v1%e{S}$oHVd7RKpNU{SXQmF={G
z@y(kzp?g6%7KYXZ`pQ0m`Zk75(tCO00;mJU0=zk~ch-nEvJvdNzYjpErOKRUOX&0n
zXp}|m%3qX?Va?nyAGhfPcelfvyjW_tYVjE<2hI6N=D0Rkua|K0a4Hr<`b-J6%5Ava
zaDcrJt=+}|36RfM?kn2`$T)hsx@-XDx`{W<dGkga5Xdp97{fD9S}*M#S_D@PNL^u+
zb93!Yo0J8-ndP4xgX~B83SjuB5yD4c+dBej0gJR{O&#g(3zKcT(A}4J>ABNAS)KsW
zz)SRGppPJW=VPEHVc6QN+xDC(n|jUNDmn6Tpb`N$jfb18P8lejK8Oe;e^;SM1E$(9
zA)ItHfU?&T*dIsC`Mj+8F%>^=vEbfd#_*%pnH}0F-c?d`8}yHPrGm_~VU(!XvH~@T
z>H^b&1nI{Bl+8Ayt~q3DmQOrC@za5oA?vPSU{|+6^xd8iJ}vw?RILb6e$~p_5XMuZ
z-KB89zod!nP_SZdQ58^2DHWlc#7oW1ZN(7^nY+4pE7H=OckdQo1NH|id1S$tthTic
z<Z9XsY?*h8n$O?;o@Kok5-^Ybq6=rZE1?E0qfm+nLN^L@2VMmB%;ghL0dxBaZk2=5
z>y-~`w(4EpYT#=O{l5UUb%#!tZI>2Dh8;Dx>i5rvWTRd&X*SO$O{A0`9cyp>WlF7B
zU}Q&QZ_G<+99C?D#c7I|K|DJJ$f!J?o6@Wwt#^=Yk`67dzKau?kYHoS5FUNH1$tV$
zkJb6}qngLA2J`7t51(Ta(1_|=eOiy$okcna2J8`Nw6H3hYXu`<`=dWnA2>~%MXYUY
z-$RTWLv$cP@O~USHj4qEC)21X^Scg!spmj*Khq$e_D19sMPNKvGt?DKfxo&}7KYDQ
zvoMpjwp4#Ds*2e4x0EA+1q18CnC*AP#jAz@pOvs#<^j)p4`9MnUL!-U$i}`S4}vjH
zjPA4wcTmi$_}#mA6tx%NC7A9On0<Tkk2^3%QYIiU`da~&JxvO&Y=GWr=AX2U2T%^9
zHZDUTtZn>9s&xng@K$30>32pX;OzEARPm<N!Rdy$;`!NxO!uL@={d%qYL=Buvx2W4
z?C(W#6n%V=9|wpA`NV*HVoSpYunSKGzQMcY6|ELqHx@MH2N_iER%d;Htwf^UIi#Vl
zTkmC%+O(?Dmtp(o3L+c{3LoUxq`KXD&r3j?1e}wo;Z8hM#d4<010G#@>CZ-f1*VK3
z1Q}NmAqq3J_CQ(792c8K<Rz=CUGFiU+CtU;y(Z>wwLopO8gPTRL~j`cs+Kzt(J|v!
z5+SiWX;1=P0rz2xN&{%{4nk<O5GMU0uXAmWCq|Si0Q$>!oPdI(i<6gzC8V864r~1f
zl<N(l=1Yx$IxFX_hqu(75?CqX@DAF-Kc0kA;A^#M9w2OHYG>=%o_}U^)L}XUJ?6$y
zoLkc14xmv<IYqG?mPYsGvVp=JltGG?b847s2cUFn(-g%%xnR@}v+ug)mpw?(-Z!|q
zkq?K}c`?+U?{Tw*G^^QS{6{A*s6G%relJkZhU97o3l<?qXHf~derN#@Z-Si~nQ%1V
z!&XCs*`CWbNuYvMjJBafvY~5hbutX#(dacE|GCc>F1SJ}_XzgDV0bPAsc7YU9VVg&
ziz5OyA{BdWR^Sw>o@J2{R2Prg2F@4Y_BldaH%^a2mjfSlfsR`U(Lub)_iT#Bo&+q*
zMmFsQ*|zIl#-U|5x)P?#HF_7Wq)wN|z;Sa+@(nSQm`Ra4PGjJB8GD|#wzeFK&=L?@
zpv^1b1g7xM2}V5t%cs$sf@8r`1?SHi+YDOD<<QXYCk)sjt&D|>$}RWOXIGk?xt2@v
zs|6qwj03J_MDth;U?22xw~=2EwFJPC=>?b;vfv75xIEll(sa2Xeq|Q6RfKQDxB3JY
zkA2r7YG8ZYX(MRYxj0%hGs9&OK$;phvO2veQ9Q)Pz>i*;g)HwTV$0S1N#8aNF@vq1
zgyH7(>(@ogAbF{V|M?sB*S(GGoyBGv_4q+>JOF6I?%&7S8lRw}OckLc6~Vr1HITW$
z6RQA2U;PC7c0dJUPy70H=Um9bz*8}RZ$>spmOi@AT$sek2pgvl8T2mtV35PGLYc|G
z2;x-JurUKYc1u;c&52Bn_1)b%XD%Hbog5J9*n{?g5)J&2!xrbTW-5qwf;YCNp{=H~
z@!B3t*=sN<mtac^faaoUC_A=6h#WHF<@;q;Q*M0-9<ei=33~I@uhNqx!J!I09_7F&
z@GH#Ao0A7=T%cjubiQJ)zo&CChH1$!fG-d-IElE+XN$V4nUM3(sK@yG1pP1X<Bvit
z2>-Rj<*XtJ$oJad%u(+60wBm9GzNf%?K%^Kmz~*3+q5;mJ=W^^e9}O)aFIz&BUunc
z`gMvxvM^i!?C#;(&Jp>H#3>rU{Dqb&ovD0Y?mj45wLyKKZQ;;t!@F@KI(WQFQE345
z>(%IXsUdt^x`OB1Q}u8T+Fe8O*WN?0b661oPx+3{&i6mqT--roG-mhcoG?`Lc}Wva
zV8@A50S305@N=`kJ|B^|0?j0!4Yu-$<ytrr<b7^Y32{mW2FkD3PPaYn&R!P;qw<gf
z;#Vw?c)~|UhG%e!PWiO7j=+D4MIA;mSLapmUooYW2$&0SzC7iTeOCkLPlK4-Z?EMR
zIg&3hS$^3-c7Z!}b!bi42)^D1fMn*e);#E8FClzX#rwSk$PTsG1P)mv;y~gg6zIWW
z=?_Dhga*Do{Ey;*<SE<J-@mm++{7cV!$0<5lC{8WD*U5B{hFB*O$D_3fNaS;jQ6$f
zzDD!5Sv(A4+UQ?TCZxB}<`MaVApWbHtLr-Q0we;9fpmDjX&a9d0z`qIDwx7{R!?U|
z@4=;G`fzu}Q0J-v?wNv)TjiLPDN~#a2uTGOty)rr_*j0Kg$+-V@Uav7Zsh^1i4&mN
zZy}A}0n_CnjEDv<k7NNtcWYo&?p;dgqh;85RJ0mk+;i?JcTXhTkp>crQC#<eGZ_B7
zudPb!;CqKcUeky#GlwR~dsYq1x|nWK_1Ss>Xn4Vs@UqNhJf`W5VAAK3qN`SS_OX?u
z-xS5yQ9QBTKUCVP;@miWXV_0ou`j(^OYW9tyO5lWg?wiF+W(RZxXo-e@%FSrf`NJ|
zuj^W<#gh$WIaX~o`^f`A7FYep*LyxjB{1~S-)h79=Cpp32x3vlhG4BQ<I?}_-Egbf
zFAA(OxogE^NiG)Kl4kDcF>ZTDEv+MF!$t{<ZlMMa0kdQNpM6eveC~;E5*g|&AK73l
zC|P=6@ou)kyCS(|L6&ai;`xvg@ejqB8XY3*&y_c(pYyz<M~e&$v-tyEZ1XmogHH!~
z`g;AcFaGRYmV07uIzFE}quiA@pDXKQ@Mk4?UhZ0eTytfKSN?6@e7B+e-+n*R#{AFS
z?(5%0@Ad!x?T^63!iffB1f5kGq=dDS<Bw=PFb6|p-Sz@rF|3a}rAIC)k8UZW01Qs7
z{*b<*-w(6EYij3B4t~MuBvofLFi7(t$@>Hlyrl{b|75MKK^=EA5QO<J#=L*7b7tUY
zU*F~}$l0LTP~_+D<I?S(9ccKT(GZ8U1CNZGGqyS41a=+{HHa$c8M5Am&tK-l!VV_V
zRO>bn4^1V_@#hTP-w>~``7&{f9%OMHBdYIubHHe=G#ob?Alqi^%Jtf_j+`|C3|#O?
z!5{BiTFuV4rn_^?eK+n^0Ky7%d}C;XF$XSLZ2H-yz=_Ml|9fDQNIMBZ=;&|<p-^#z
z!x#Kr7vo|*vvndcD^x3gBx~3KiZz~$Q{!QW9;O;30qn7<I~yi1*AFM613`PWDZwS8
zF(cV;wHFi)!soX{LU(RQiz(6bu|$qI?*4IvlB2B-UK7+7-x>+&k=f=?QvL6{dYPEv
z`%D^v#Cm5gLcyZ<i}1eMG|$oSdq16<KV22Ba-D(<P!qFo0={&)Ud;!66|VZ<3VNU!
zg<U7s2^);VV%nC{iO#n6cBL&i*Yty+B%^_Ybh;r%I;KI#NqY1kiic6}(>wrK;kH+q
z_KQg9tJwK)@FeI$KKT0o8y}qmVGMMHV=n*u>6SXwScD7;FSDLAI6>*u4~CBx4WTro
z{W|!pDa_AC4dP)-eE}7mPt$*IMGO;YBm@x5)vHGku8$vkNNPd1C=%#8K?KELicRw}
z;U5);{R>u=aA67*J^SNYn?)oLNEDZX$swVf|EcIkVn%n%=^XaP4coR076lHo24y?1
zOO8`*lX7em&p=}41Z@)*cdmV{6{Glp6Fd6f&!odR@;`c(aQQ^_ZP~SZLsVwx$XYQ2
zaU@hZD)eNY_jWoLKR$}htf}9wZCoHx`b3fCYU$aj!fNiXOsX2o(TF4wLjQXsv;=j2
zOKAa*^6=chj?IkB@x6nWChfRSYM&6o9Hl(Zg-1x36{%%|!nuE#>0zYkEBVNCx*UFP
zB$+Bl)jiQOIn;cyfbKA1;$!W>sH}p{Il2<tf3|PmVR8|AU-jVImPq5ZXU?O%!?oU*
zDW3~pARi|3#oDhA{f(&Do99Um*xisCPj)fOy)9scD?D=WjD<r`wQS(2vCDNdN{&AB
z&nKzL`*auApRXuoBH!4;o=kiQd1=2s?b0>^MMw5Hn-O(A0S=Rcxi=Ab{mENZW^FBo
zZv7*)<D16hTEU~PIu=jH%|T@mQ8mdQQKA<yPO(nlZtanVnFw;N8L9PjuAI{&5{HGz
zf+0>C5&A5Yajc%JIjCqgJ$mIDh{*o;+DrXta@=@1uFh+gW^I-2n&lUz6cw>l&o`|3
z>D!u$3m+zg8K~kZ|4=F+Lu(9VbwW#-9LpeEZw{;96Cf(e;%m4tmV>1s{mYJR(R-A-
zQiv{ii?VAf?N2D?R^f-#J|{Jo3^zGZCme-IyzqtPO-lD<J4<S#o(I$AB26<l-rGe5
z0c?2w*Lm!Dks)WU(ma`mo808x!j%godF4}QeAg<58V5XvqCp6Y?u$T%a-{t}OgZt8
z5qZ+2+(F@4-5&nW+bcTkbmTN<MGDkH*(y(%ND(`sRkKPxj2hR`oY;&N21z00^pR4G
zsXbd1rw$wI;o+B;SVx;0-<pu96rHj`@DGmX=ULvsKNbtLqE+v|%}@u`slV|x+vK1O
zP`Xfm#JP#xikhqmnroV2lM%iB`RMj2YmK6w9;;CGx`le0JU6niz0`(6-h%&rI<dPw
zt}q6>AT&<V2vsiB2XRdE?yWaV&6SQVbj11}jW>2@?>A<mIsV@=_&Bh*czk{K=?dHL
zrh*3Hbcf}mV%MGpg`1q58{DLJ@OGy8!|OroUv~SP`#QPKMV>$09<)MS9@y%InY3Yc
z${zI;a*P?@1nrge?M;OYhcCB$*Y6+oukzw%saY0@qKc5H^(-OjNtHU%$vC#qxDpV0
zTygdLk+)yxmFxd5SUhJ+3)qacPLyR@8PmL!cCKp9V8%KjuivqT+jMWU2Lht#!9kPl
zg)oH=lnU!gzQd%v2;#f9HPj3cxrp;9XqI~b0L{HVxK<s8cHx(<k4FA|t*~<lbU&p4
zm455L<4vHdUP_rCju6bNRoER<sAmhIgCE)-k@_RTKq}y=^&k*T{!8~ej+x`H|NgKr
zeQtVTXIyXeYjbjhW~vnDe3C26+>gbh2ByAjnFDOzIk90Ck|R&!Wt>JznVi3VmxkBP
zX=+4sN=x$2VgDkpb0()(>Ir-!o}O7tUb4Lv<m1s7F|n@p^)-&`7x){`{2gKX1`kdu
z6HHQFx+^awB9(1H-6vyO-&tjN-Q0-kXsnxKoy!C6gr{sr8h4BIVs2FIEymXj6W`?3
zM@tS83?0hIdDm+x0l6u--NJ$dPM7~EFee?{{v!!O40E-!B||Y6TBS&bcIG@VNTzCZ
z{Uc3z@SrKM>pj1{T2j+k)MFCK=}?LREvE;B;nJ~~5Ml=KXg{o&X}A_16qIq4pB*w~
z$jxx=oR1fVV^~G3z8or@T0i>gWRvB{<7d`Vb4F+9eHq$VrLWr<Q3XaerQQGY>4Nia
zX|{E$EK~m#KhGCFOn0I$@-#OR3w)c8I5pPlMT#3IiJX);oPE7{gf3q;L{x(-P0CrK
zmGc7me5xmZUh<8|B0s~wm)H0!t-d{*IDAEaa05Hq6hs_u{i-=~ZA`N+oY_*Vpblf>
zvlH#;ONvfto`7v<U_~)zs>L=zm)PH*E^QbD(j})q&#W@a%Gik!mN6G8o~ctnN3TfW
z?r^_Bq({xxK!TJrR)=}sZ{Ft^7EW^k1Qc@U3cvDaj5HQHp<9~w0K_kKt%o^H@w0RF
zH`J($pL)N|{t<#iwB=P%%AYk7^{mck%3rVgF}L<wLQk5fl~;z@@QR#>2-{eb8Lr^?
zDKp(|&o6A^hdk_WhPA}JX$r08_B3l=vX*wB;IdqBT2oC<WD9e4ATQofS!Rz6HzCos
z$Xsw8l6axY8+N2Q<-SjeLv4TTMQ+0#`AVIsCK-WLj3(Ez^`Tb(?<8vW#DK*|X~Tv?
zn=Jeq$%NC|ugqXAfT&XX`?oi;?|*tE0M<Do8gAG)1OeM3+AnFcUW-C<A*fLvl<i4G
z7MuF{r4#>)MS3nB1Z$V!2nRJ@{d9%cO_*#P{XPA9Z(l!&rqVgelzcc@a@F&(7@{L$
zyL?nfnup)}kSvjf_C*baAsH=M#O__^Lo%XCGJnXn3w$nguh};&`K6p9!`xNl4O3*U
zJ~L{rXT@)zNk)v&s6o`I2hWe_Y%i7XDO+jP${D69J&;O}aX(WYJo+#tW%f;0m7AIx
z<-6XqtqOa-zGIw2DBZ_-JjG*FIAEhiQPD0+$-_euQeMR~WdzWpJi&N~Km|p*>!*&U
z6G@ftfy6OX^O;GvIJae}Nc3%c%h)@P{TFzw;?6&d>MeE7L|e>}LNI|fOMd;}2x}@>
zv$S44!8i^j8}$n!{kaB;EBI$!y39{v!rnTNlN6P1m)@OOh;&jJexs5`qc!PSKpfFB
z3OO9S+uGtC%=jlNDPq2+fN@sFq&{;XNz~`d(PSM_iYlc;<2u}tzf*)W%t)i|$?BBx
zNQaO}Y*b0TUu1J7Kbeg8qHZNhvy?c@)c(04+{)=9OXQ+UQDV5GaHBrcU=ob3smGdu
z)v-HWV^M$q5E3{9>m0Q0`9xxx#~{5Gm$2`H2vrJ$v=0u(z?-L|t|;<ax^vdFnhUyI
zkU%)ZEWy}3LBgH`sa*mt2#lq9RNX{J<_L(R*k+jj7kjv?A=Xeh$v9-X@ma448g+`j
zf!gZ`2#O1ssuf<(RJ~TzeF;BwO0`w83CO|=p(I6YvrP{<+_?OgNAI5X`pb~4;Bbbd
zXniWQ#_Vn*+xF5Y7xNC&Eh7yK8BuF;PsZHnd#ubMh5lu-@?fmIlP_Zo8*H7hcSM=m
z`7<i`JB#Nf+z7GSa!+4*876vC_kp%x)AP2cB7;}W<`S~?Hy0ZchEKMO<?=L=ws%Y4
z-7+#Yjh)V~;ThU!^>BjLypg<$xq4s%iMUPapeF|oV$0FLQocjYR`N^iM$qQt3EP5G
z%efNp8z(`au~x)u@zyq+o6Rn5a$&G}(q4@hYUCVRZweYIcPO9ax9clB1jIeH=UTPb
zBnS3~Ss=xg5zd^o*`Bxb9kvYzVU4>Q`d0L=C5RjY`;syM2I|p{)N_A5ee2n+l7k*;
zNFRb~28_Jg@YZe@yp9SFbC;!|Y}!1RIRWg%Tlqof8FtUc`G!~%qX$VQ1|g-+A{}o&
zG>&PibWkKr;7311h!(U5Y4rq|6>^3M?%0gzGCMvKp{en|&8_i<Eo`Y-Lq$_7m_+LR
zJra3O-*XOrWu$9%eiV6ZQEq|@ngUfA%SyJxN`ZOlgc`X!91a6Nf-am9FuUtZeWg60
z>b_cY7EuZs8UAjx1@P2t{}y(huUfN!GV=OIHThs@OrZoazo3clUljnJM<D2EhCxz=
zN3KzVp@CD^ModD2WWw>097HL;Q`%|u#vTI?02CX8jrut1yb7hk!%FnSy;f<BaDZ!F
zzaF$!IW7lTC7`2$(~A;m6Ix>d-1{)XCA<o*Fgx4kmFORSqzjs5{xWIGGC+fakcQL<
zS+aYd%_=m?2+D&o4Kwt`*Ep8_e!7R@yUQ@+P!YWQec^C(qngI$vH94GG{Q&AMe42&
z7k=>k(5R%R^<nY}Q~SNCy$1af5?y8%76E)zV@;~Bd`vVx!+OiZ+1K~zuI*;hNQBZC
zHZpT*uk?tk0{Af+%U2eDLlQb1bP&nF&!zXQdgw~@MO$9YW<6PyAin8&A}Z3}-@Hcp
zJf~EvNNqJlBF=vsS?ABsUvu<k8eD!Qi2*G^5~%&|Pn;VqTx2`V<5IL&UNS<b)^$_U
zJ>rg3Oh{Y6?$VaA307L<za&}+N7ifC4S`O+&*aPa;wbhD{Qh7mxtij?IVn0hAAQxt
zf8+Mn(B94vGr0AY`K-?Lrmgr5oz~<Xnl0|&-KNk=e##d6{!A=Qzv0#?YXn2jMEUwe
z)AL&)1p`G`b0hUPTy#SQKb(jH6rF<2%FLwGs@`^onw!-|zJHL?Ked??%VQW!8e(Et
zznM2%I<n!e{)R0QooVss>bYuDOH^*9KN3x^IafR;RnVQGbLJRJBp?dFFQ_+=X~*2$
zkglEwCF1mw5>|MLq$#QFmK4$|k<!wfclT!gNuFpQ4fI6wI<W+jTFL6a(Q~kQ3I8Z{
z9t&02nbZ_zfT|HH*|fSjo$n!O-?#h$xR5OVFuA63^YRAAFKg7NnM_+&n6h0SkC8|>
z7ct^FuZnqhE{O<f$W#sSWnoZy7N&TM+;u~R>@J3Uv`MLY>7?&s_K>A^Hf5UBq-@kZ
z3(}%N%6~=g3=2$|ePJVQTjIk?t^IUyUhTD_J4?FUqpGI#_t&RKfMV0fHdB79Y#AqI
zV;l2cpo4u=IaYi>EnPkX-~<vlo)+Lg3Y)4a=(<#Bf(&M8iky!Gh?9l_CEG2QSD|{N
ze`t5r6o9}GC#k%idc}eYf_oNE#hRM|j?d}yok&E5(@eDsw>>daVjjh${Im3wb%Cke
z{Tkitd^=@reslQF&wJGq8IevS4_N0I6PP+aHtuQd2P;p2NQD3z;}QPR+IDuJWXQjw
zY$TL3n3C7GT}M~fe?64b!BZsZYx&l{wDLFfPc`{4!=6&lMEO!_@|TYbpY8n?+Z>M)
zVcKjJ*LAb~jzS!1o$HI2FB>TXp;4&_`T<;3R2pBKdX7BEgXe1_Unoj)D7OK6n{&qR
z)p**?iwPw7$KOM%;%bV`E>77+5v)ZHif9a=sS>I_T@Ckh1-XLgLP5?CfZDmq$&C_q
z{xMJy)yvH!G8Sd~pR=H6qdFUi96s_uC17iMcXoE3>U)LvwW2PhID_m>1atwCOw3=7
znoSJP;`*<{Hi7sVqFGL#-%s>}Vj3-mbh-j6CtoG`vs1KP7tcj%K?%2J8M2?{8Wv#_
zBkI>x#D8z%B;GK{zLC32_AqF{)0!lmDpH_`m4__zL*1#;totEk)JAM%1ytz^&%<8a
z@ev^%K0T>aCp-dWkc%ID1Tq@P|GTsfJUi|Lh$c(tL*=)Xk4hH^M)4WWc`Yn>v-B!w
z)=;V(XbmAlbX?2E`iI#&Uk7|Y=boo7vLhEn$89DUNXGRu#Og0uxu}V;I*w~><oRLR
zGs9-*M-u|s_-mCfaebgDc5||gVGhh1js3%HS1`bqlvV%9-03S&Z#kms#9_1S=un2x
zt+2506cYWd99Ss47n+R9L50i|l=$7CCyV-rANk*h;@xFNLSTE`n*BP}dkESBcZU9c
z{!rwxT5T6Uy*jL(`>&`|*w1tlLU?URLdVGYwoJOV3|1w5?UX<zF4eKS->=u5l1f16
z9-TZU%67fiZ(-N_P$2ih-xrfjSNp<1u*+ii_mYU;rYnS6E|LsYhyNR*5G4PuVJ-rR
ziUj5(W``R});n$+(#nTAKmPtoL$i0j>~)DAZrAw{tCVoBy-&_9T|B|j@A&8`J|42S
zDLZpSJk1pfhffbqoh_~#%|B)SWHz{nCCG7PYuBNEx92q1$u9<t6A@&I9El679+fFY
zUARKS|GE@?NzJXmilG9LEdiHh-`?dQj@c@*?yX;ISL5AD*JtWCmf|s4?m@i>|0%QQ
zSo*F4E!AV>S*gsLC#H@(AkoQm?;`f4r8$f;JD2F6a(}~{BU)>z#f$_oxWo`EM_!D*
zo_c1La+0`Z?27D6&MVQIf%Jvc%6FRt=@qhMh(Lsv!U+_X2i>{%TkgDn2PkJab}<E-
z4%PMadL%Kw-uK#xJ$@RRJxY1Wt6*0oFbwmv{57*s&GzEh+2t`LF<P|w&D}$R(4PU+
z=DW}j&WPWc`}XoG?^)A%NNG!nI)?|HbXR)ILGdMo<L|p@acHPI82RIxN6F71Ha0eI
zK@6(NAPH?8EhP>fbvJNVY|7#ZhA7{9<3}%STxh>_inQC54a6iqSapRS5h`$>t`QRx
z;{qE06XF!P(lC%rfyEpND`*=jXwm;k5jap_uFM6B5j*08l%mKTGXQuFBB2SY^SC4%
z@<0%vt|2q?789K*oJl|2a*P;ZmF6e$l4y!qcnVr_H{r^H5Ql>+52KM=7k&_;HdjEG
zVtrE4_<LI&@2C$NOpckBXZm>{4}d*nhFQ-@RI8tdyoNeB+`9C?#)o^C*#Z-x6&~8a
zSBZ&}SxszV)}<2w7-KEKg=QM}s~+?c9drHUb1s%3BDX(3PKP~BLR@_3IrO#;K(x2x
zrK3BHPbpwvh`#*a)S)I(<mBLZ1vO7ckeOr*^q}Q=ze!I<{P*h}N^kzyzI&PpBIYRg
zyZjzf@!J;)Y`=Qxyn^byIMR)Z8Cb&I28S5w0&*XEuu4ZXkzspBAH$b~?fjxuBZQad
z)jR4ru4|a#^69*3^7e}OL>EAx`Qux9o%DqPdk^j1!tNi9-)_CX2~8Tw3ol99fztI}
z4_^a1NUf-e)f#1w0q-rw9WmHYfuLezB2~5Rf8mPZknuAyY9bx}SvY}~ZC~7if%{HI
zOl@ewOZ0gUwe$L_*(cIr4z>Ko>*)Nvfyb|;0%Rxrpz}n03(ezs`X^z8iHHBqT+cWF
zY0v5xm^~$&K&7R4fnIw<>;hD}!EGc-?tYMX!3Aqt+%51n>`{w9dvkF>ggkk20OzW6
zaE!QmvawZ^gEkm16lCvZ>-0H;9>LGlw(*ktOW@2x-XP9}Px!X;bVA%`gFhqlQ2%}t
zShQJ(lMW*G=o1^F)%CV|9xWf=1Y9RSi)iL~BhQq%G3@tmvrgc^n19{h20xyF>gH$L
zfJ~mkcp>A>GGi95(8MW`-~Fg|$?q{6-p`_i;RIF2gW-r)@B8-6LKt0WVF?1}nj;N2
zl)1>eLFx7!MEBqPV9hXJFRQIhB*fe}m=mfGMH)Geu$*NB2i4_VSi-9?iBA;RMyxy0
z++-&2292tCAkMdudV*lt>l{0vLYzD}{-XKfO}w))^lX;$k1wCdn*`UyYLLu6y&TIR
zH&av(NdXB$EQfxX-8B%N&m%XhGqA-<e?G{}IZRMsUCQ_ApL=Cl(JQ&o>P|Q4yYw}H
ztNR-bW6_ogcr;fbbLWy8(R;nC4pRJp#+r02+`R5Y+!qtI0=u_A3ZeFI)JWLBGp!Fp
z#G)pC001`d-8I~a@u;+PwX_`T0gsmHz?4}c9uLcssq1Jg!m(<USK)OHUZtgh6nfSi
zd;0ZGG{G7y#(|%(T?ck8kbyHHx<7s9t0)3#Y~QI}GP6g1kRM@DhkmbI?7e9?eM^Gu
zbHWMk2P#7u%4US4ck%dXuR*^?3uj$0bJ@!xK8|IVV}yB*ZUm_yxd1M#ksm)eNq5#w
zu8b<POJm>uK?^w(e37B~5hiK@!iL2;q_tc1pKf%|dE-uTx=;V|l=X*pj_nUHgsB|9
zvJKbVa48afGHN*ePiksh2hU4+6X=a!Z=Gkt90ir()kQDjnMjs%|Hd87QH2GYLyREg
zI664^hm3o*h2^W^#5ju$^?Kac&0?L15uob^i4O=w{Fc&KbBYh2Q2cLwJj^13@4SdZ
zt{*B$0V3dEFzc7S)NW%*mSdUZuqr{zFb2Goft-$&&YnkfRB^>{8N(6{6*47yMO=o<
zmE-s4x1g%pCc6~n@U!$fG!v%wf+Gb5a*ESCW}=|kl^R}YMhG8qWW_H)Hjp!f&r=oW
zK*9&h&(KRz6#K>~bMP}mF%xfig9G&Q0UO~PaAYm#%f@-!xG0+vf{-MI<73TBvUY%p
z)NFip4EB^2LU>w!-&0!O;D}2L$mp@e8S|lKVp^*X5rYuzN|*|dpeP;-lMef%Wi<#m
zgH6DGnFe?oHEfXo4N_JRAZNaM)uf&*6<5@A9LSK0YHDG5H{UnGDc8jm7w<ciRs`;h
z;|(h7HHvD~CT{Ti1lqhHGw&B}WD<|xX?(eheCM=$T2x%@Q1{X26d$sTZjir4o4J<o
z3>yjaTl5TU4Zps`ouDG|Or=C@0n^K?`u)_fPxVH>Uk2%e14Mo`4QYp!7@IY9A2v7t
zLo%e-X-IXsCxgW6BjVv$=wa)$i1Gs7w$b^Y5Bg}x`8)=_tmp!5p^e*L7kXbnA#^II
z=#k1T9F2{;*bTgB6ItqbE=jw2RM|B66nUKlTK|hZ;r;q{$1#2c1ovE9!W6d6?eE^*
z^pZ%5e$Ywx=4{=mT)9V|)a~r-e8Eog@6hMhv0CTrThwl^o1h6T!}VKEA_53%I;ja8
zg&s|+f2l#K(@2y@<rsISbAs#%2+e3oOX5x^edVZDK=*x|SYRDy|GQuc#(;o-?c4;c
zs~4eEg&yqXQ%;XThvDYkb#uS7I9wQqa02=j9|2?;yh1f~b#(^;WVi|RIIpp2$!aI5
zWdsPNl)TzW=u21~E$(-?fB>1H8TacuAC=Jj%#1I4AlI>=BIF?yd{YL0{`947AL?8Z
ziQjJ?Kqm&Iq4(=<A2mCSh)GJuR{Z++DnG61C)zylf1!j5vp?^v`=np)oj{Wjn5-|)
zuFKA-*yo@ViFbRLvIv}Y9wAQs_9fh+&6jbmr$o*r!<|?QU;^QS#!e8t4|afcEt&hF
zSLA_^5tx-8_DnBAqgrsxECUD3Z*Bu1MF8?&T_fk%55|StJ%i&Xj7jBI2=8{fKhy_2
zbKn##CVr07(FRTwCFOo^`9u~o#rKLrLEWx%K%x8#0dQg$RJ<P&Cg5XLl;^*1@a^9<
zwvW3vey|{nt!4AF>yOwrlvM?PVS|eF7aa#HB|&rGZOHh0ig>hM;BNynqN4)`vA68f
zmkW<_ih6NaXE#t}ZAOouT*zy<PEHOnkk(3wi6tKyzJVy1l)FxPFAwp)yKn)U(KBIv
z*$urc36gaN-F!gF3KUZwUwH`<TrNq(D?;(_8;q-!Phat3jnibelz&6?8*$aGKIpUP
z(70{?ijp$wPF*m$C9Rv6D*d4VbaK4`SDcEV<F?xl2Tvp|vRc&eF0=eqaaozyJ=nHg
zACvz)cr2VE+X*2!)u#YG*fj)i9fc#6#5G5Xf1!F^TYAuVkU{zn05R?D?IQo+{DrYr
z*;8p@2Fnjw9mpbhq#)(s!rQk(h#@Bb_9VRYhCwZi1!P1(Cn^F`VF@^U9;Ys6*FyU!
z;g6;`HpS`fCG&^2d1d^mpKe(+7}H`ij+2Lt!o6lRJcE~>{`~n!<;K!@jc6jvS5T>n
zA>RA>=REXG3PGc2@vIDV5=i<?Tu*@)K)S!9yXr>-|AA+Yg-C4+><e}i;f-f1JY+#_
zyD-{y9>-XXUE@^tHoT4pIzzxI0SWLhDHYVy>uJBj{F`t(uXUu#x&w<zCwiOElLZuX
zR|f#Zda^io@cq-LEJ<*i#PUmcJrda5DBD=~AEcwh%ww{}++KXPB4~-VTmRtsIyzpI
zm6cg!O_~pXm1xMPfe&|JK17~@uSC1v`zqe^0j#-JK?P?`DrPAUJq(m3lEg>a4QC2w
ziUeyYf0Z4_N+Um>qjNi2-#og|p}+W?Aw*{6h;1<64_Z{w;=0zy;f12kcf8Q=i~MK}
zg(pyDL|cK;PQJ(F{>05lpaO`aG2TDD@2IIw!(ankgFZlB4=5y7GInqOcdrb$^1pV$
zDerRX@Vyfe()Vrc>?%v&zIEQ&-dM85q-sOl`d}a05Sz&ud4K+ydItO{;RD{fPJWB-
zSO%<Nu4>KXQOob`5uxc3VrHf?qKI#kY~lhUz96DyZ2XlPf!_$+k9}$0z~^x|h#?;?
z$~tC)#uk`Em>^f7P2d-@(6D^_l?X4mNu48>yMFrjWB|FlO$BULTR{h34y%*%eIxqk
zDCo6-J3tLIS?(C?+kQ=)B86C$9BGG@oTBvp04@XWfI|jY5kCYP#*bs?zI6OkJEDKE
zgV6@SG-9quYNjowO@;eeU2qD4oscxmfDw&ro)hl@zNY(O?C%lK<Eb;)GKE;P$Lc)0
zz?GX#Z#o;{M`(}u-unmE4yEyTo154;DLIgw(ZG8kp42<p!xe>9Jg=}klVk|XS$z>V
zSe90_9_H|V;Ln=(Hc;4|4&Q_K4FTr-*{esaSO$*KzwDC~6Z7?ks<tq#hu6VpClK@g
zA!PyS9{Au@IHHQ_{`Y^ZdBr6p{9nKdxtCs3<t8SVqjEcXMFduG9ne`{#nO0Ogf<M^
zw#9K+O{6M1%)FcJVT{mOtdK_}mV;Eh)jz0<htwVMer+a(4u;4{eR!C{8h0;!kUl?-
zDp2oe!b5*GH<Ob+nOP^*gof2HHka!qI>WflugD+#>qji&gwiK3Jo|z(>v8X@Rb2S0
z7z39+yj_o8x(Ag3w(D`L(L3`*RSu9eR;aS9Jl`7(h6pqra#jl<^U1yhrH|I%_Zmlp
z=omWULMM&jUX~LdzYGb`#zAetS0?WADK`Ds%N<+HWOYfPGI!+!<Lk$o0`O=J+;b%8
z-usb-+#J@#Va0|apmAorfBzmFE4t}yF*c?tr?9#>ecOW#-1XG#)!93Kesa9sv34W~
z`Uc>b-qwNmrqPM@zhSq=A`d^^x+5tmxo5V!y)pK7T1(@6DbodxjRaZ^oU7Bq=oPrb
zd`1d0=>YiuP;1;h5(w%(F_=Jgex?D1EJ8u_ia9pvD<~}5qN%D=`~$+o<qu*)=oa6u
z@VI-}tk=z06Yr?o6`&6X!Tt_axA6Gks@iwm)PuXArR|N^F@F{KzYWu#&n#6TVE2>q
z*S0(FLxWaE@?jTWM3Z3W(iSD0>kA;wz=&tYL*#5@ZJqEPPJn3WwpQ2H?ySJ@L54PR
z9!+z4i#HdTSN=HU?ikaPNs?An*1#SgxSu`)dl9}1AOUbUBb&$4ZgkCO-8I3VjBk0{
z`Q~^V8w0!e&j);1=^Ojmi1d}mFFlSRxGGg(HRVu<*#8}E>;a$RU%drS6UDpK2$4eN
zA4viUKjBj12n38vJ8&?-pLg!+%df6p!{{5yr>Rkd<rL#fq6jC?8m|C$@5Wh{c`!?^
z5>KS1mZN6nzL~)@a<NsMp`)%2t;J>>*FUNy4#y}EP8PBEa*4VRmMD1MT_})WL?eXe
za+Cmp#rCN|j6%&*BK_!76cC5*R&6h~v_(E;PyMz(b75O`+LHRfnDl`A!Jn^59(K?G
z1nq9<!~M;Mx!%EmZYYrWz5bFUIlt`mO_47J((Zz$#Oyk?IO}BFX6HFzT}qO0jVBT&
z%$&k15Oe_zkp<p)fAc*Ay@DX2Mg+cxgrsC!6(Ep@u~<Y5O>m91IOMVSNWe4+=i0tN
zaur5@oiV+}@;v?tlr-|L;N+o6c1($04CLS+*Z<bn_B)y+W^-eCcZhVj4FOZ0{l_CI
zxEglr#;y-cKY<W?;(vkJ>RqP=SsjtDNRoTpr(0abMF$_A+7C88-5{^ChesOI!Rv@$
zVURR4yQa)UTc--8yM-2rV<r~p{j6-^Lu=3~m4}K9h7_%S1A}m{H;@b!aGyIExeh)?
znoP18JF9{3-@l`A2Ho!#?y2C85#W5Qm%=b>a?Ra4h)lSz_|PO|>NsV{h4<YAgTY<&
z*GbV^2sD;%JdPd;tax~(4E)rIEB{^<3Wq(g@`$pl*;BatS3#ZCgwO%TI9B8fg@~6Y
zI#RbRPykIV80PqKthKeZl*i()PiyR!yCo3nsfr03sk=biVpQXchKIyz#LR}CET7ur
z=6?$+G$?WMRG@>k_4+!rT9rMADAaETgGQe4XHDncGbjG&(+5xx{h(~jBR%@}7|s3z
zbH8=xT)?GVXW-`Jn%?gqB*btL&zOhZcD(E0FlX)Hu*+!{pJ+#+1T!Fv!QTc}EVqUE
z>)YNlZ<}910yjr7Os1qo#s}GDgg4Ryk%SD~;c+c=%EA6&a}fG4ph#VYGE^cHt&OHm
zSq}od-2mGX@8Mv+A~<OkFi2QWMhFh!i@UrXDf(w~M2Pxe6Sh71BTVB(0*MBt_VNZy
z_03(_73wIZ;B*R-`AH7(taSZp1PXGyxkal_pm*w=9zOhT78D*_AOye3V18JN+ZDRR
zqte9p=azIbfp`UO4t=*PZ}O`RAfksyJclleIKqA;Kp9S$fQyWPmq9lK8GFD{Fg=@J
z#LvMWERq>~Frc_YwwYmehC6YwzPG*~6Qb>KfZe5G=Fq`4eo_^T52FbPZNT=w0<c~c
zNEG2Z8ek-zR6Sn-555G9kezqV#Al&bj|U;`Xh|N7{eD1RCx6&q2nDlVk--2|`DYM2
z*t&B;vW_1+3#D-n2qj+p*q~3sP}5WZ`i9gRY{g>lsqsI`Mgpz3A<pho*hg_pLX>9l
zZXFpa-@bjzK&qj$-c1P*h<L}+k<iqF&hr#qVivG%2_jijRggS!#5P-z)V_>2`Mjlc
z@C>eK(8Txj7zaNI0$@<WW)QR!ZNjORA)VX`h2ROqi~~KKY@K><$ER?|HVXsuXs5%z
zWI#6}v@7E7`<A|&|84IbX4gR9O3%dWb~c=tWgtlJT-%zSIN=0<50}6D{`#KKV*5B3
z5&RGi_!;PpoUhzpYt<GE+#)1*L?Lp4ODSRPB>ziQToFJ5x!)(<tamk#{(@F!(2Y(P
zK=9KYg(GL_;bjI&Qo@|w!QpSC#~gs1@}$Gh;Mx~QDi`Ok-hO@Cwe&DA_2l~Bu`xh+
zKm%1}#PyCXJ;SU3MUN{VwZr?OiW-2?a!`CVqbb1yB#U+_1JfctE)mZRdv>|rw}!(6
z<qtMn3|T~7R7k#EHxK?uJEPFcOZ#BI+H)~7bLr1zSadwR8NcpbRN0H4n(mW#m&*?^
z<&7RsCeV`JR<=65X`9Im^3pZnmb8OvLT(|$uaX=%sxL8elc9_V1f(<hsG2YjML0vy
zNRfLG6g2ceOqFx)UM2Vgm*0chb@;>zNaiu3JY4X!t3dx5V%iOz(leGxHmfhxVJNm{
z2%1OIpo8KEkdORMfG`Hxa*u`OxO39Nik772yZDV)fRA%qR6o9UA!Jnm9_{q>0|^61
z(EVzQpZCz(2=z|8weXf&h!O#|xg{{Q!a#sw7dZ1f%D}DC2co|dD2;{zCutV$MINj+
zC1s>jm9}_&c_?049bmga+lnpA>o-30geNOMpBELi@M4$*`HnB6+%oP)a=?1ChpJgK
z-I=k}RzWxy`62RgN0UDmA)^F9A`;oJ#rmtw-l&`5ln$mT7dQq(?s|e!l0*@1rWJ^N
zv0%1ch3chM+Ev%(Ww+A?rrQ~tjbG~;?g{A`7$~e;qICHFS-T59{%?2Rbs#YXa2V}Q
zsFeC5%ap~xQzjp`ar(+a|IHvOU)78~uYm^@P<Ji?hum4D-71Qm6PQN*{rv$_xM!wa
zts+0;NebTI`HCuyf-p@yQf;3*>%#R~8DB#+EMaT^TJ%*pl*|Ufy-<FJx^*@cntWXg
z?)PZgLmYDsE2*cWqdq-5>$e8QjsW@fzALVU1d^F!b0^`<5|<k7H+n;y->Rldr$XQ&
zi8;h4VD#=O{Y;(5F;_0LqGC%J8r#m9Y0(>NYr8~DmuCX|rD0_G6n!D|!*uGndDD{_
z1Nx`}G+TxVP4Iy+06hXv;H!-R&*uv?$~W_Zxp_Q>577S*J}OWRAZA4Y^lEGQHsJ^Y
z(=QW9zyi6T>o*B}ehsi6`pHMt2bf~9^&a|WpbT#bvdiZJi$L)I0lZzC>UobmgQC0I
zrM(Ek<GWDz8Zn}uMWsLL43aQfU{7)Nln>Q&qHr|GjDWG%)(fzUs(H%Yc@xn9B{4y`
z16||}I-@T=7wKoy1`*0`GNl4A%w96?d4lRevMu%8$o|zl_V+iWNR3Ww5<dt3sh*ED
z0rpGg$i}U}YdFelN3|@+-BbZT1l3L&Xfd5P1tSMeQd?*P%i@QogP8TiX;9*W%tj8v
zZdBIESq<iJ6yX-`mj`klc_kC`9xTS50;O9pUEzrVzD58$o;`JnVdFi)_ZFC;1)w50
z@VM0gxdqUZS*m<M^yj2nDS5%eqzjnImztgZK|i)9N|c=;`+8SVci)?6QAgG|IwFxF
zE(yOf1x#=dBN!rgQUzZCR9Gw?&KnyjXvd6+WlgcijLH7l+Koq<w}J?0Wk4?7nLz~p
zQzqh1KKvEAhm!B=+KVPg6hXt6Rpr+^ApW>C3|~y#Jr&4|J+F#ybLSfO#pf1w@3Pfq
z6TPFR%Yg&^&=$Bo^*OKsfD6%Ug8Gdv6GS-t<0+(>4Xoh#N^j!hBR^V!=)DsN>j}de
z@M?yM!HK)YAJ~D+kvqA`rwvg<f4M8Yh&6v-ZqWPyAd-SAA3*$Yx6R?*2$}<O{k6{v
z8wCxkS}%kHP;+M``luUS0f0?7>8yB6Xr}qc0>>6}`KB!>UV%td8>%k?0+bcl^O#!l
z?mi%nuU`kb0NW_hyy+Oxrb<(sJji#x#+)k4+cLDZzYWFt)5J{%d=+EuOu=PKB#Jx`
zoS1-z*}>-WjA(KW+YD+S{}Kv8{)G;S5>?RZI)vPb_$Z4wuF47@GHc<XHT)a^juDtZ
z01YS++=mYqZ~2k7$jeJ0V^Kn(Br?QyK^r#+^1`p-od5;g5O{chK?VB_e#Mwru7Vo`
zCp9jFCUyK76x<le>Z~v)aKH2|qh58|fSuxwF79rWXgo;*CY`o+K)Fy!04vQ0nUWnO
zE23aQX(wefY>-8K7t5W*z#aFwIv}57f!)kXa}*N8K5jQjW-MdYnVce15Y3<il=)63
z!MD+Epd4~!QP?J>*lS&pG?-;!y69^J16@bzeg^Qan?HN>a2uGa1PFo3Ac(|(EJ6U~
zLp0Jlgt!w3ps8GC(HKz-nt(Z!3xc-iq-A6j{7_v=#<-VAs#?I;i|u>Aeo$_9{!sZq
z_!tkeMSG8-boFM64kQBKL;EmPM*k2#zQr!~!m4nBZA2fRUq3zLX$8FG4rzyM9fKOb
ztyRt6OB<9O0b^d4fDjgf<x-x`nSTIpq6$uLW?LErJ$KMF5soClD_R69iUj=go@b0H
z%3YJNR7YxuitP>Q0@<<m5(!^SL1ttTE(YHSaLl#$0uk9>XL<&1E#etCogfkPd_P@I
z2eqg@vd!jqF)R!W1-eNw76x!O?kM~u5}U;(CDXbfFWhK{m~Q1Fhj8i>ux~|%MejG{
zWZiu|CIuwdM#v-i8AO{Btm-#fK{zoDG%J6%fn;SgG1VrjOc0Vw^Z7ni+#-~K-687<
zBEmMic5H^*5YLUI!0tN$=}2-x?t6^L#j~A?nnO(qrSn_HNNV&ePD@{g>xd{SkupoN
za9PJ6sNp1hSVsH#6*kgzdr-iAP!K8$%-igoob7v{^TJch3oe$=2`6;iWD%&E(Dg(=
zxE=oF8Y`X|?}k!w9FXzw%P)Z_`k*Bdn(neJK}k&ENE;;}aB*nCs+P?qL-db8^}GzR
zFGA0%c_E00y9?$X2?9oSO*gW2cn5j^J_l4}+Vz8nwL}6D7^IH3Z{HUF?2x0w4DO!A
zK!_J3PGJ@x{6ohZsQYwCI=HCeKIq#DV$48c8KMMKXo?^clZnj$ZwY8VrRqPXW~xD2
z^zQbg?qM?zrI#F*c7@eM)w(rZJWcx$lPC7d<lO9RbWGh)8z3+z(%LA2oBa>;kPJ0h
zynP1etN~J^7I0=Qw~37xmh54~d^mq(KBy-o_E4ZRS2I+y?toV4x9;vcEvqd_M$od1
zhNt@xeus$2Lqo@^m1lsDe{tawr~zBSbHp>)`t%@c0rEgJ#S;w7Z7^a%aoY|?qkg3z
zUf&_%{5mas5k%Cyxx||5csSFejD*&x0zqRlEuXl8ROb;}qDAMaWVWb~bU3@a4FvP1
z<ypIU-b~f5Hu%w2KNk#;qmQC3$|30Ei^6eORJWocFA0V@2R^=q9;hiGNL~;t8C{<A
z+wSJYLg+fb3tQJ0(1jTR0Um!|(D-xxyd(=|db53Boo5!MWm#(ANcm<^QO`DJXgdV0
zBw$s69wvwz)Cr*)%_H)WKcnXubs}k;@tIf52y|SnR=m6I>357H5z@v(K3$aS&|kA$
z&h^)3gm|WjEhL4GQ5K&Ii%)jlEm{;RW;j^5EVai|$Nl6$CNojvwJ>9xY4~M7P~!k~
z5c??hcy)e9IGM)b>^GkD8nnV}+rW9(cGGqX&Uv%k==dkcDAMm~budzOW???)6p_HX
zpbflYJ6r3+^n|W90i;yqvWQ7s%{Jg=s|WHS#wW2o<Vx+Nwf$k*quF;Y2$N54|Bi#>
zDjr-%G;n_)<kbc1i2&^`LEt$HLZ}UbdU8D7d32Av4B!xWHB%S-h6q**@^@gi3nIVd
z+A6An=DY|b=#r*{wD6BIpo2%(?*X%#PjN4#5(+hM_F?|z*ALW|V4^hCCR*obMA5AV
zT*4Ld#;gab;v$sjWiyE>BQL%p-N4rmGUwMR0_jw%_Ow^$AU~VOcM0HrNi%Gu5(hzY
zXoy$Hr(%8!8jdQB@$txd264B0ZRaWm82h=zzPa)|)8d_YjI3yuwJoNSes?FBkVDtf
zpG(x#xAmcnhcn?O5(FDHX#pN*ptBN!R9oi`IOGnHfw$<Lk}8MDkNn6q=-Uqqw+Un}
z!m+i6YW#q|;TSRnrmlwqH@f=*z>E7r>UfG6R8H><tySo(oVHZwMZi46HrEfH2V@rq
z4iA6AVMj9eR6T%-#E#zyCHP*&2LL?Dfj}z=`7o<A10eb8@sMQgp-Y$!cWV`|XZ-s~
zSM@P~Z>V#^Q7yY?Z*Nx-Aa$F)^hzToQE{E`IodWO@8|8?ejW|X@`+!sz3$Y8Xw>b?
zoP;c#Cl~&JB#-yPzRs`K>aazYp9cB{X>vi}tqKrowszAoMj^x9Vaxc%6lky&$T<6Q
z@5_ZYuANZHN+r<#JXtHGY+L!+A%=IPa4~T{$RG_BkCOHTop<A##U?u4S;^O(=8f)s
zI+@?62jXoXfZHC;Et^8H7QU7Bd<%|7`GNNKg|fQNaO)vluO%d`m(LlMIsqzV=_j>g
zZ6gnrIK>72Th^q?MfYnc>6mX9*cy&0i$8vhw1X6wDR$8V`|Si4bQl!q;~s&Xy(6ml
z(D0iU_ge0E^G%+ann6qE83PI0Iu+bjgx`63?psUaZM?j(&8CNf%}~7A<p*t23c|=R
zn|WORoUGXTv3e~!X7|bAv)iZXC|Vq+K8G|s|1)pD<>OQJdgV4~dw?jlAmWiVm4?HC
zAA<#Yy?RljwN;f;;or)oDT^-jJ2R8|Ys=D8IrbjoPYBkhNQ2y<u(c<cBq5S!lY`s3
z<^cT;pqBlXytWCjfQ;0&unIFs^e9_u<BcHWJ_K9Gtr_3T^}>o+=?onAiB^F7asX@C
z&4V5qK$RxN%&g7`LW*6#2RUv}ti27b0;zZvD(h5jS03VIEdq#SBUp5k1%f8qKh4fU
z%YJ*AuT$Lnyb-hVGaZ=M=3#+$p@0pkF)IZ`uhc%g04R|RKKe!_Wnw*2D+A5y&hRdz
zT-L9sx_&1lIvj)3H0RSkawkpl*8Tu^XXtRi*}s7nrZyX>&bSO#dRaYqPjR>4W{9fm
zWn5ABTbQr;C{#%j=*I;K`Vo^;;RI`as5Pjez0;H6M6brxe6ek*@-#vp6NoIAkl*IC
z%?MG)V-z8K5yXgrc|r<g<Yx^E3HAlygw<esw{TkS(?^b4lO2*-7>OP`h8CH7y;zaH
zpFfi&nv4d)<#s^RfAJA(Xc+;gmJ5Mm2~-Rm0e~tX`o9FNOriLeT$(*cwM}Iq|DG7F
z?Yxtah_bx;_BV1@q_(hG*&^**#fAwzO$|T}5$gOGU=jI$h!twEZ5ladNAkf3D{b+&
z;hL)x4Yk!bC_94Gk+xjhQZV1}qke{Z13};i|A2yz*yp>~!^-s4D&eiQLdotM{I^N~
zEKhyDn@k(hCyM2`NEV3p{b;||kONtTYhq0c((;$U+X$uwxJr~mXJm_0eAt8;fQzmR
zR7llmgdji3IyTS?1OxJjzUA`otk1FtvRm?i5mX;+#bLF`mKi<1ky3sk=pQI<P61x3
z0vS}A3AABJ(mm4A&d9{O$~^{H<hV$Y9%2osXCoNNy(Ye9IZUpJ^Nf`VX0yy0_wqyh
z(Mrp2SpTgI>o>7|j+G1a+*}#N_4Y9N$Ee2$=!f5gUq%URqTb8aWJ-wtd@Oahf!&V+
zOt%5-Y_nUtC$By|TP6&%2AVqA<`%h6XDs!i)$;}LPZ$Mthu;AC$#L!qFHl4hOdh?P
z{_F!)tz4Zm7gNVaK>jV1xai|friF)&a}cK<ZDcjYfgUBuavH<$dKngeEMR#!fsEn9
zCin=|3or$1ra-3;^uoUZiaMDJENUk%+D@5&v(A`!{bq(Nhay&fGmCRoS8lC|({Uz(
zg}s}E=T*jPta6t++Bx?5-R%|=uBX9(i!sxD6~6;!E<GSL(~ln1xSK99<_vBTKcKGy
zv>8zAO@Y=_Ihh27fNFL*Z?TYRhNd+?l;9P~DohK4l72&bw*a$q^L=<tEs<eJiM+%7
z^1ZTT2!=!%ylg!@O6(mRB!C(|w0QhG^b|U+bm>*3ZT}Jg0mgB-=zHX>@N`F_31_c%
z;u?BiI{2G~)*U?Y$1_G)Uj>704e0$RgEc%9xcYIoPHfK;r^_e7;5u2v{E|}_Uhg6>
zI)KKl3|x4rz3rv9K(zS@4OzuR;#4k@2VFJCM_izUUN9@rfnjm~_yVFSg;zRf@LbS4
z_XjM)Sn)tH*23>brSqoOta{J<cngB%p^s4=LSgaBw2X#SbVK?9nBr(CEOBA9pHMsX
z-7##v^P6y5Qh*oGhRv##Zo{<GM-TU~S>A<$doSX8V!1t+D6m<b4^-fo4`a^ywwaUL
z?8g)kin##5kB&j4cmYDnb%1xh8C5@y6DAZ#!k$g={q-|N*m`C)0k+(Ys!byhM_)YB
zxG~Gi|H~BtW`<dDoh|raM-#6Aj40LPHV;bGA;fZMRQU|3=AF0iPcy#95NMAB>L8Cm
z`vPzFUDOUX7CHV(FMxsJuPhx=M!PO-tKxw|g?}4|B_9@ACxfH7Wq|Rk`L>&fa-rgB
z%vnHZY2Qs`pNqD`l31!QmneK`yl4k~VMY1H2<lU1f(-Rm`)xgd`MKc^O<XjN1?z2!
zu52*eb<kdAdL~KCqUo#<U5?GKh+sQJ7q3>|z@9-Gf%XVd9J0-~5r%;0I2Q9c_|D|~
za27JWRjc?~nFY@F7^;xa*3M(E06{E5tH>SG|AL!Oi%`YPWBs!derQFy{oP;)WzQX^
zj=1OB0VpkQ5gf$4)vsP{x$0v8os!o3RVweVI(Rs86W<Vtx+JB5Aq~=y+F~{x|Bt4x
z0E&8T-(EsGmJn9D1Pn?LkS+-YK~z9G6r@ACJEX;<bPE`SlF}Ul0-`Li#8QINpmhB2
zeZTo;&dhNTcYpE3{ap7It(OewSkv;U$bg$IF9r8<5%$O&yfyz4Xv0*^-v*2Ay)K3K
z{szjFj{+*IJxfJ?H34hk{tt^wqb)HBE*8WQh%F=gQn1Qghr;L~D4P5Nfhfr|+79cz
zHlQG>K+xo%$S(NShs(V=gR`tUq(aYbF(gM*U8Wh?;>1|({u*q6Akj%<K{Ta;5zz4)
zKzGp*sm+M{2wam&-^Am;sI2PmWC&0w)RM#74EXqtOX^5vP{9erH8rpXu6|nmXVLkW
z3;Ln_+mX?Gx5a)Wgs*=*h|qASC-KvI1DMB$<D;WVxVs=X$-7?z$uW9#tkq)B-YB8;
zJpB7?#)bYxH1Ku>GWQ~Ye#}2SEA8@Q=4Et(@rbYy^kvPUQ+>1yMAU|l)dA!G=9n=0
zbgWB}-gUfi`5*RVHs8K}{aV1>i~`J#L8I!&_5KA=aDPDG5)J32QNXp-RRY7aB*stL
zd8BT@<|%+^TCc%4jN48Kfzm762uGRCUur$~<MO?UmkWddSG33ZqU5(D*o}&SuPjey
zDiOWH-{#Ib2?QQ16%{}Omw<G#3iIYF{HhJ~>Sw{vfQD6r&;nx@F3~#T{S(+00TtEN
z|AheeI{y88=yqRJDb#pW3=}zm;UIaDsR$r;(0hL>n0{YYrU!X612toRz{d7ir4YXQ
zC*1e>h1MPNl$8nzq_6~_ydX~9%zh}&`u^(E^(!!VMw}v=q6?sj{tZqCkGXc75lHJ!
z#POIHIr}8th(&A&&AQ%?Z%o0!WLw-k+t_S`89uqbw)Phc3VUGjW?TYhO>=YhAbB*E
zGW4);O*CAYqYaWAiFh{IBPB$ybtV4a+3Qg^CxJwEnJazJda$&1=4cVnSBc0JVqaRJ
z{-g;<q^t_DEtE1Bh|pEqDue+2fMe@U^M2D1IJT0?4D|!6I^ZJ|1UA81?&GLu-#-11
zS<{^wgSZD`k1v`k8xJ4t0TZp<$orJvS&A1?0lf7~@C4%Ls`M|6Tj<DcDI{{gLXOM<
zYkIx1;yE{%|9=6h*#IOe5THHEfu~~Ji^zDk80%!*krQGX2;=<R85Bax*G(G_YTy;_
z-(D|;Ql_J|n)hq?r?InB(Bl{Z3vCnVM0|MCQ6~i84xiu%6%_=q*|H7GE0G>aYb=~z
zpkZY|8IQ`*(L|Gkawu3?6@Vw&U1#TVpupF{Lp(2n`;ve8;LF3GCGRV1b81^o*ApQ0
zj?M3*NOvphK{F+xU7kbzoemC|OmIm2q{*8?!bkbz>a=SQYZgn&>u9P-Xah1+E%*e0
zuV55H6BrHC2r*xm#50;Z-Q5e@EfBl&3l{uG&=%UXcXBENgS}lmbs&x0e-5Yg<Y)=q
zD*gKcdIw7qI34&6@L;QgS5N?5=RUvL<C*7R8sSn%G|pvtn`a!O4NlJ*Dxu{8>-Jgj
z$C}z&FOCvV7UBdH387w^$K9yN_jll<;k%qOfm)aYe%nzYCcaybibCl|+IYC?K{C+{
z&vSMdjoy!h*)K46{o?OUdC2;pyYu!XJ7I`a!UH(TyK(Jc;G(S&IHEy^__P!7q{1Ay
zm|WpuX7eLHjU^Bv(Cb5A$yx~KeAvpq{9<|z0?bK3x2<|$v8seq=>ursy72rAzOCK&
z=pX%~(rXN{zkwrC8<q1I$~7l2f^$v<H+9QN+v2u=#*&s5rR8*o@ril#ugp6+bjUw^
z>?#U_MzkbXKEO^{>-8I(0kb)U?|l$%fP_#Ij%r>2{{{sh>Rs975z#yx14P6aFqS|z
z>yWnn03&{Se<<PIS(f28iuPb7xUlJqZb$%9#CC_Ha4T;<%~Hv;j{Ntuo>R)lE4ci*
zBCQN-38$$QyaQ${ihDBKDg<kq)U{*z@86T<9Q`OBfTO_)2yZgyd}gwo16GZMpeHtg
zn^QEpbieTV@eZyA-<2K06#ob3#uzx#sR|963{6GdrandVn;C~m<hbD(TAM{kXuiWk
z9Eh)!kIba8)#{HZClm}eXXl_R2R}RBg?A^^e30K~T}kX7Wg&Dzd@~7$z4K|M7eY-K
z9SPv}`>)XR5!ebi_mY_P-yIXaoq`9k5@fX14Ma!mN4Gly@LNGn$AXYnS+t<>QT7hF
zfq<wqG6?L}gyihEV69*>4gFx{M@_b{p-(SK-~So5!-~h!H2Vc0S(cGD57d;cH$h)U
zFS`5Jt`E>cgLG7i>dHRwWxBKr&R*|Em0aykV2vH}|0TM?*mBU73mhF^fJNo~FqoOW
zF<8vAx%pd(f}I{wsuUK!Z-}qBcxtwh;0oDz4*jDC-(N7hu1?Cg*4~!9Xti}r8Pt6$
zRN8jYrit=g*Xwf8LoGstLA9`3=ffj*oe|2>wz{^M8t~2jJ4r2HOT1Lc{M3^r?mT`g
z=$lYRA;P7DQsNb2is_yeC{>6};PF9kUYBO%^PDVkY+2YkuyUzk67I%!S^mICA}GXe
zl7}Jy!-I_FO?L<vr~%>?)6X+;J>XMEofCJoo#4oeJv6MwY7%8Ii}(O7e-HUiVI0^;
zu0k+FXp%+aL~!ZW?BHD=1tid17#{EI`x);(43h=TvHzMC`*Tn$*T1aZ%Lj*oUpTM#
z=7a<)Kf<3$muOrO<6HY52$@=Gh>_;@v!2GaM-2Y<gO1}f4HvfFV<rD1aX|2iGfj{6
zc<If?<;YJ*Y8NxP{`<12I2EIOv7*8S^<<OlXbOZ`lo8F%1ioPf?_F4kp@k*P75wKD
zyPcEV+eJxNj6JnFVofsP#g()T-QWMg8yTE?(uNnfg@)M-&0)buKRcmDW_TlyeGj7x
zyrT0(tf3Fji=zxdC5q#IBr;!&jeoS-bR>73>X{<z5GmQ^WC>El?jJv*>M=QDb1P@<
zp;*;I42{o)RuuzjEyQ1UFRR@mEx-hWgXDRxUK4?uC<IMW5%bI|q4$F_bggmrH!$+<
z^|%5qG!CL!(Qbafw5iIKyWAw9khz-7LE<uUn{f_kzZ@(*6YFnYR5Ns=0Qe_5Kg>D5
z6di3<Y67NK^}=5{S}lB)%io)VF&160_21%Xzp&RK5$!Z#mOAYM+GkAXGtDS_iSi4L
zgmJEUc3!ve@Iz=6v5a^|N_IOGRRc$e8P7ivh+qYQIFiNQ6Nzb?5t~&oSZULKehb+2
zl(#8eIM~tr^r{p`WC5UL4z{D_$O=v;sLoiyOW`Y`ey>d*aQ*-{{W^$O=28&DAIj>#
zLSOR~r@b#<0ZA6F1<9K;q*gs1wRFx-!y1?$<qP$p{Ot4Ta>Yd+Ge?T?iA0SrTUVfP
zrc>b&e_~f_*?=#L?{4(${t@PWm&y~aV3F+Qyc_pPKkNkuI=@G_E|`Ds)TncqS(03@
z8bz76P>tNezz{tB{-*f}?(C+on#dL~M;&y~p;mCbHz&wF65`VN(>RLpFOGjZ3K(b;
z=yhXM@FB5p9xo`}r||QbB^*<5rYU!DhYLTj@uJAAn$D89qWD-1Ycnt4ii4nzr-w-Z
z3+S(6s4$z6W2uMAW&WsZ)bCkIHUa`KG=Dx(Jpmm#!WG-y!x7B-*~TS;ODDormc;T|
z(Bb{YQ~ewz>!Vq0<vZR&-bVy0<&+W@)C+1E{1weWliDgcKcw+3O(g4S6QNZ@$eP;}
zw)9Blen&k_Lv`lrc0OcV@qUPKP$lj5xc5T(Th6bcoO36d!xprkl}O1%1W3v{5f42e
z`vR89O|zZD#tUI~TvFk1ETEf-GJ!~5S~DcwBhBw*<FdvHgr{jP4fdjd`(ER+0*$ks
z`b8bgIqQep5$o&Ww}Q?7BWsPoUKYT9d1Ka2XXZ_dHuVz#cgog%I-2`mxc@lG)+^!~
z*}#UCg@8=(>Y2yR#|nvq+jHpo&`es7{-ex*ll_6m8%=$b7HXbt{In4+n;MAfX4iLm
zAAZ*C<ts4^GpsjH7-A-oZ^rbDO7)CBJrYM(36|E_t<sh<yU{6VnIKhEUa@|jTFMk1
zI_{C>GghK)Pbd6!d>EcoIWUlhg9_7ZCTKPkM@V(=Kn@s5gi`aHH9?^}b!FsQqg&%v
ziQAzU$e)~_omM}*>d^)Ck|2zcKCkrT7f+w4KYM@H*%v0!=b=zqFuwfFKq5*Jyx&V#
z$AM3PeMol{c{KNVp(XAb*Afc#hZwt6+4EXAG<s_;ihceK+AMKhU@+B^s#D`LduSmm
zDkk}qWO1OglY)0r+i#H~xV4Is>YSN*>Zk7{vdkajI{h7R9H&$$XtKlGcg)l;OJ1XY
z!4_8j4s;BjugYwN>O&JG$NF6Fbs&<JnexK6f3Vx9NyS@s^d1!*S&4>`E)MEag=<qG
z2G_8+K3)13Lx~diCJEfz&9TC^hNSJ<nND2(@vVB^WiDy*3rK`Z-n|R4O<x9dy|puj
zZXL8-4*yJU;&0%67ri;1^50`Kj}!1WfOrN@a6_fJL=_bT7TjN~fiOeON=ER^nlU{$
zxpnU$_lEawd7bU=fbk!Vc*07<12T1u%ZV%G^S%|-HBuTUNB>%|Z5M~I#d?>m<K?OA
zhehAdOS(`Q`7)`5OS~57P-8|H)NQ)>Yp~(55=QOMmU*Z>ws}XkhW<#zsc<?$UpsLv
z%UwZU@6G4b=(DtSjaqVH1Wd3wI3n1ObbB5npYxRH@cWXQuGzk$%X$&)+L_C<W^0+6
zOh9?hI{J@8CT1Ent`}mDUZoy(TR@-=Ua*8}<%!Llt|&KxfEy+DOlOs=LJ3^yS?*xW
z#T+Na7!if9lw+a`MoJJ+B^!2#mgJP3lW^`CE@|9}0d8mXJ?V8ZVB%92*$Q62c1^kz
z^gsVB4fpPxOj{|2r|)NX$501R>Ywg2INWiH67JxLZle8I=~_t6Mah*EMa_h^*b_x#
zU#T@GockZx+1ClyvfkWPrVMKT?6azuTAxsm9Lqsyh;6;l@%yd(VA6^jQG#k&#oK-g
z%_*%%Ywh5EpbA=cIVfT6Y=*M4sDmpl`#1Zj>fj#MBu=&rDMY?{n8-1G;i8}%bZH1!
zn|_nSpdN0K8~i+XRZ7mVl1O0)Q*Hh0-lNrvWL+V}XtG;bbM<9qt5O&6@etDOqWn};
zfhMA&%|}1WUp%?d2lBwruiw1Uf1szgcX&INp=pfSvBKorxL&#aOmt3*FY$(xH$6g;
zd{Oap_^V@Q<!sq?30k6X;jQnJmn9ccmJT!uDdb=1<pv4QJ`k1ro2(m(Nad(A|LeK>
z99sIqw4B$KMe!s9sh#)`A6JizIXjmNU+Fi2!SbMj{fUFZyB9DGoFdaa@bVFa#@HlO
zEvv992Z_lug9cB5;B0Q=<Ev=m8}w;Pc`Hm&-@kcWQ|Ub0_>k|{o51W3?6dn87I_((
zyvNLu+qDq=Vg)`ESq9g~oFqSFzfcWNPt5KhrT%YWqn3^65+?~aA$lMGUe%C%ebMG$
zZhmeZJ8MA>v8jqhp@V_h=14v{ZyLh2WGye}WgSCJjwiesY*{zCs`s;j^0W!g@h@@k
zIj?>4pRL~%WD)sl3u+3I4|~?Ld0USx?$7!xv&#JY@c`#kV_d6mguO!F^jcZBPVX<p
zNt+ysVjckT1abEj9SFUNv`^m~$GvADn$|sj|55gJ|NL`2ghcnU#ok>BOOFMq6>C$~
z)2|PP#?%$K2al(JvOC%kKfON3Q`2rcK~emaJoELS%cvG&_&t#m;Sn~7dA9ANO?k($
zk$gCZ9h&ZNj>L~@@nm+w)b`TWx4eIu=MsqCxUyD3TWhmQ?s(RH?$xusMy&O03nLQY
zv``R?hdn#q4BDLW+bmrj<OTdt=~MZFXTyTinD-3j!d}_XxOHWZ{<M>y*50Q*@#x8!
zl+v>%*9FyAZ{93`YZ)F`z;I?lbEj^jesyvXqHb6WespTODr_se|64^<&mN7{cEZlN
zC@wC}W{>JV1*hf{z=j2muYB9Y<7P`FK!Ci7@Z}9ki(l=wR{HBjMhMUSfd^MaIoy+I
z2=5Y~;vd$zeO*G)uSHc=C4Y$8`p(zyvV4Aqr=$AzTQXIZIlIHNiSWd932aGo!Q@3U
zY6%_`-go5ijeE0VwCWnfS3DItQh9R8LteSle2>>WU=V)!{X$ssHO;!~$xfqX7SrL}
zmtTGlxrfg=9sGnSq}9AiotThAAC+Xz^L8PNKn&?7MsUS*e_VAYhz|~JiX6y;q9WU$
zP{PcTX=C>o-+~LF-+#6dFi8K?v9)~%K?|#v@^-!I!kXWa15CA}Yg|`YNstt@!VwCe
z2kWvfJ^11=rByA`x0A?cOw2^O_#_^K80K<BC?xbAG-!D*NG5HkGK^6aPDE7ZFqEB|
zIL)3XTA-xY{cS$D-@O8UMw+8jS14zxseq1Wn_5K5NeHHYNPOT~UUtBALlA|?lU^il
zIM)4n{{d$i#7P@dQei>XrKm!RenF5RWS+<-%Y-vdt2R5^c_Szq#LLIGEQhe!7yI`<
zfkd}Ea(16#qadZVlbe^LheYx7+DkGP(OlAy_`Xta8;qK{MEuAc_g0t4dDIumL`y%n
zYh=Xq*zeoR7H19GT)!s~q)*!YG>|0uZ+>7xBHKtvS=rw*(Ks7NY3mN6*m{-kdy}XV
z?r_9>%J(6k(RS*JIqcYOuc6+)|CwgN?Z`^WTUd<tpr_kQL@G7W^%jAl*A1S#CjlJ|
zD4O1|pEmsBlcYbKPLb?9wVWS+quxj(Z+{6(enpi%*+@$ehs^g;<KSdP@l*_I%*|%#
zTNpb9#Zm1|)8QE*lVL$W&bLjczLk(d=)xCVdd8!9>-qzJdSaSyd&wXXzs$tMR8mx=
zYAF=q7&LXpGaYxZ=W)RQGn&&{@I`x=>yr{89?`MFnuYkHe+Mni1zTVDstwY{LkpBn
zb?DhbS+sgu#G4Wot*H`*SQ|&Vc2hED)Xcb}>5k%BJtbn!9nMIu(HS9;QVD&(6E)^I
zlgwpmmk0<W60QV9a`&ZO_`!hgt~8QsT``wS`1ZR+`<wFVwlCm<b*Fn6;8aEdWy%Ve
z;dOu(>FDSnxY{WtrVyiIBK`+1Qyyp&;B0p<%b)xB?`F()2ICQItyK=?*VHgTklziE
z>;y0MzbPmwA<;K>y}+xP8vNu&4EWSuynOjGO3q&rfd!9DoLOfK<bzhdz74aO<&{gR
zB>w@vr=lVrAYhxeIMfcegn#YtcQyfOXYC02{N4@EvtBaVq<ds^MC`FaIbP&P#7FJh
zo_D0_{4S+k^izIzV7}TDeO66tq>IV3XPTKfq6ysZ?oj9_ij&SK8By$cI$iyo>BT@e
zXUT7anJPAP&=#$dlA3Eyp26R~jMS*5gTs{+7rT~`x|VH$sY6%UJI4v_NA99W%$(N^
zYFQYmu5@~--Rri;$agERo<~V1p2}dgj^;5E^S^G!Zl{d!<@aeVFn+Mx)*DsLob(ct
zQ+MjhkvEO(kGd^lwX%J%dQ@vcMmf@$SK6?$S>>Smk66fZ=0He+piQy3CaNKmR*5hi
zsXbnEx`2xXk~NQFEr7k4<(WTaI%G76s63p22pYdLFyiu8S1D!hn5eX2R*s_b*niTN
zm_~z?nz5gVvzPZKrD~8A2_j^h*rM7nt)-B^6o4-$pNr6TGL10{+`3`9dM+ZTAz>Ar
z7V9VPL!QGd%+MmaBkEn?LtuLBEpR4t#u6?@KtwpB<<P!4)|hZN>SA7DV&}~dXR%!v
z^xXMTe7kDH1+M_(#585T`JFk2?5Rdt_F|^{Q#SmFR*sNFUCeguBOz>!)wgiP{C^qE
zLg2_g2Of&uKlRNh5p|&DfGtI0ZV%%eRkrF4zF1peGMHCbNGN}{owyB})VWFf@(VO`
ze?F9V0|dXl-*V0h-Vn3^7Rf+Qn?PdPovs<i$2`ub^JsrF@$=^!h_q=}D8qkcI4hBa
za4JV4R(!<g$-465Xv;1VQ<_EC&UeP7%KFtDbg-Xce=RQhe`stxktb&q^dE>F#Mp-u
z<0Cwi*?YqTDf|~A%odhB`jKKvSyD`ND(ZzsNa;UfC;mHYn!TckE9l4$Dsu_E->N*B
zua$SgRxmHusmqHrFA<AUJ9`s<NsnoXlPA8V)KjY}S+}+xG&e`NiCt_iNGc{ydPTJ(
zMu3i!W>(BwsAX?{!B|_WxHKGdFrVvsuzfs)U3kc?N_5nUWU{L*>qd$)+EAimAq7A|
zc~teJ3|pD{N`jE0dlTK5&@lFMVM<Z0z;cD~WGC#+mi4Z$W-n_T{oTg8f6AFtUOZ%O
zN1THj8$~u#!^7CsH4Ow#*cOIhBMg53{%TWRULGil8lShv3dB-*z64fLOj%|Su>GF+
z;WutREUl<W!eppyZuon$`DLiqSk(&t=xEN~tjgX~WAgI}%)wZC{i~DzK0f5=p>QN7
zI$C8ry7yL~zDb*XMF#R2lmQ8^0t@_*B3r#uvzD_L<brkPw;w;Am`*Pe$d+)Pu~&Iw
zQ(WydEft^UW8F2d_kx_`L2^CP+kcdd=WW=9h~>N-ws3-&&E{h<wxhp}nPZ#ki(~|v
zm$b^I6AoF9R`902)Uatg7=~28Q}wqUmOQZ^CHr{KN!emUAyuiPA2Y_4Yg=ayKlj_c
zdfmx5YPI|I{9+(CXPQXRG;^Kb^bLOttVpWJqPOwCv*+Fc$5Q^hK|Btg_Zyy4-q}fL
z4WClXP8*&HD)7I#X>gsW|8r7C2021li|&nC;4L7_#^4+<l}K1zJ82H4Hv^++xK$Ad
zXjKV2&&U`D{QJ2wT1+kOG!>0=!z}sukq{Aw62XT!d4?I^Re?<Zoj!n$R0y?36;$dD
ze`Rbh2?bpOLfpfvbFgcw!mb(iqR7_8gc0xpF5pCmW(OYGj(ME+ynXvt+k3Ade5OjI
zKe%7e0o}Hv^`T;I;c0LhxqHzaRebfE`OmO*dXL0y`CK$}Xe6K3MMUH@u+?O>Ry5`f
z8?k1yN-25P=&WO6*W;50vzuo4ep`RkaOxS?F%uJW?)2n~kTXQ6MI2dd?<Ibkaq1ht
zZBHa8k6nqA6>o^%yYzywrmT&)&rwp)i=&(Hc-|~yriWThtF8Va-OOEwZjD23B)ydB
z#2(Fyc4c9~T6sfb=0jCvawDg=@9x!)>JDv-avexoqInG3!g2!%FIvB*wCl2RY!Wwx
z!*ktXDPL8t{l?vI{kTrTPNI2KiV2ZaZRtjP!u<v%AHQX3yQt}@7R;^*e}~-irv~3~
z^zKT#=-N=tN;E;hnfanCa?-LkV3MwG|NjleI2ovwp2Db8wSEm&Ii7;S`Q9>T$6(&L
za19I@TX3d)Esp8G2q4$3wcpgxZDZ<7>SK}0>C4t;6*CTeTY>!y^x;PqxBD5y>TUmy
zXvLB4bv?+?x72czcIR5*$ds-?;N=x`c?e%|CSjZX%QmC!py--ok&0xC;}b6n{!fD5
zD2sl^ZZi0tPe)QY@%Go6L}9^VdEQ83?m4O65eoVUVs3rWEvJ57|DsLxzoMZAjRCAh
zzo?`7<IbIqkv5c)WC8IUHIo|8s`i!MIr9aylk%AZZ^e7Hv=$Cv01}P-_z_-IG>`<@
zqtMkwQ80^B)Ho`mJ>pny(Lxsp+DR~szyzoR*3{`gogahF&rp&s9CBv|3u7l@TFO`d
zYo`v}B0$nWbNq#}TZn1i%5VNTL)T#%rQkGIXe_({4>mT?GUEQlF7S^eJiI16scl}5
zRGw*PZd)-7QzWs4mk~=<kA7Egb#){RrxLDs_moah=Iq+Ry2fnRNn}sO<)4Hmr~|Q2
ztV87=)V^wjgcEJ#%X(>d&b~VX?nK3tK3ed+py5_a2rsggHmNL@o+MOKl7d?LnxVMW
zS^d&X=mpNptZ_rEBv~X>cNfX%3PKOn?-1kVg(wV1V?TGAi!v^_5t%<8^;Nh2c*m(r
zS|DS);67igbxh)@R`f5{kl^8D7stZFFg#TfSeD;+GH9-gQkbC(g89TtTQ4i~&Hd-d
zo>xxO`Rc^t(z49DER`ZaI+mI%nA*)_V6CEo(6d4fOWH%wVF#MPNhFb)5TD?|JNiUc
z>Aj!V6*CYnPl0O~X%XiR4WWe}0)|y3w~kLh=Oh&#4T@HGscBezL$!KubifYe+5F0l
z3&BGh^JpJVL2A9UYd{_fQ+b%bDwUp*A;10bhtZJ!qen5oaMTjfdf>%kvkLAdGYT2E
zKf`vv3|07Dv<Gyl6B*!pt{$fwTrXN$T-3Ztp$wm?1)u4xj1hwXHQtP(OAz~{1zX%l
zwT#=*K;yn>n?BZ4<A{?ymTx>9Mc|^{jrr-BGBtU@kIxk5orX;g#0(#;WM*dGPgqbO
z`Sf?AVbf`#tQg9VwmBDX;|CAuqNC+cwmS4H*L3<CtTlyEEOWPbUJPYP*S^&<VzoeZ
zk02@lCa(n<ow&{NeVBh};W$zR$6Nn%_^h)!E!haS=g(t3OmH!--k`bJtS#+P;1Iry
zqOb#VRGdQB$Z^#b#3PsUboifPJo`aJzu?&L^wFdLnj!1vU5G-k17-%N`>Vwi-Ph9-
zhkuz~<0$bhM?T0FQv(Zb<`a~vDX8p);KfzfIKnmfe6&D?>As_nQp!UEjnKaK*6d_4
zv>{h9f-)xVBe#{?=eB0{Z1I88=GG_7*?Avfj@e^=OhqvFFDmfXty?{Qwjb-@*`lAK
zl|6HuY;7O=0ja%oK+eq2@I6l3@_?cPS+?p_56G(2+GvbQ{vqy&Yj4yI4=&$acxC@L
z`t#;LU|?t3p(2wtd28X?o;}8hL3zs^qQH@PulNB_*bJs>1OUCik0Og88m|$MKfs2e
zC;!^M`tQH^zQI8OXtNfAXI>YpsCC={_*btrL$MB}Qj=#lIDmdT05(jEo~dc`>u3gi
z?{6N{{|!vdoxD^~*I*?5ZEkcm;zG{#D3$Ix1H*b$jx-W4uj2wYhZxJnwOINF;YI}m
zd_q!HdD-BF=frap0w0pCiC4eJm)IW>wp^1WP-#_r$4hZTx%Vdp&)e84_vCWoVSQ@z
zM{d`?A+226a;;qV>z~#+7!dYn$X`fqJzq*xx>JA5lX|q^_58VLk#<f3SST_>TXkR9
z?g#(LX3%*DnCgtC%ZYOH@!7m-!K)%eLrSJ1z^8b*9*R=*WYv+F?;flWy4MMf2$uno
z9xT*$k+$h}Xv4e}q94q~k}C)84*~<_#Iy)R3&1NP$m`7qdv|2PWJby-o3y5eoG}H?
zfx3nBz_@FrX{l#9S5L4Jv)IY{!xBR`#xmdaMDITxZ`yb&?y{_#Ms8|81=2aLIE3JH
zyD9fkE$_c0YM(sU4H0R9bJ|SC==GNb3`E@gVk=7KmfpgFUVm-2W4X1vGe!6o#;m?|
z!vDFoMU8&`6{V|NI~Jv@4!2*}B}izumJX3fAA>_2W%MFt_pk!0<`v3v(L5z9Sl}|x
zjeBdbyjQ6+6U4LBUB}hW4%Uqmjcnx(MzP#shp3AyVO4A6)`_C4q6MLCSPst4_|}B1
zLSWNq?*Cb$hJh)RT68#H@39KZ!S4{5?tw_sJ(Gk3c7zW9UwqL-f*bhdK{GY$sX?Z9
ze54SsUca_$zGKgo%uh;)FSNM0*vJu{dI15UIb#8divu!K^3JGkmh;AQ3h3YAarxeY
zPr7hrY1;HG-Hb{ovE5wwK<VDSZ{#X}3qFdGAjGtoOIDA9nr=*uiBp%e48c0oh``by
zw)%0?0uNl&_m|;Etpn$SRNKqN+~EiDX4F1DJ_MMtg0j`wze4~SlLoS#RU${egeYKf
z*Q~^W^#0^L+dNleOTrnLoszPvB#iRU15atdNt1M6`|Y<NDTuW9`ZwhXM1#7^?J+g|
zlQp;DqMn`0(42mBlr7SI$I>Bey7TAvx3!wy_p8NCzDH`F%!kY9kB>zqktB^P)ytdk
zPXIg-4Br}(e>Kf;=6q$ztm(#>b*+V-?1>!i@hNa@S>C;Sx25JE|JxH&JtJ034I5?0
z!ONiR=x<v&qeJpp_l$~co0H%ILyK(RSTC=igA$6ioI*(biuT|B&Dw~v)nc0_M#dV)
zSZD(loXVB19wlOGx}Zhe9+(4h(0k(lR;Wpayr24uHJqK?K#nw-%C=-WzQh6xK+`&K
z;=}6k=gq<TGm&z68H}kB38&M3_FPLuM1;?TBY61>L?HEv!rJ^;dR$@KxQTd`lT)sp
zb|az%?D=_w>R0j?a}~qj(%Ak>NfA{exqmJE;3`KLtLkTL+^_=~<%PDux_4OjflDcu
zYMpQWqL>oidq^RsRPnUirx;^BMRa4qv(kQ{^0cSbBF1}x&%4r=Ac2yyb6iJG_j?yo
zlo+!{Px~FObvQyH#op>eN;?NPvG`q;oyb<65Qz-*LiIYkRRxWb;=LBV#3jF2_On0W
zFWdpVdROpInqM_Lmjcr|mcIZpctlO^vo%`}G8O7xK}F(m5{f&1UAr0HVS$Pa0h?C~
zpevNls`t2VK?!5Ag>5sp#&H)J&HP0Ggxv!F*P5T0I@*sHUxX!2e$iubKe;#!phBxF
z3olpS0CRnVF)_1RJqM?Y%7#MbQSVb^dd$+(M2@+_q$Kep6lY_@)0<zjzkumFU+y}~
zwaS0RQTE?$Ht#GiJ+%yPIXhbQKK+N@1{+~IH5OMwx!trO^OJ*Zz%UN(Nl&sWS3I`N
zrD-?kX6#QF=eS}*A@-a@;b8yuBa)=Z2gmV|t3S0d?`T652*<DANB)Vbu*P;d+HbXw
z-IR33j`WUd7QPMZ12}5y$g4uUnzd(%D)dP=Mj!)w!%DM+z2=K8OO7-OR%2{U_1#=W
z^ReN4P5z36Wt;1SG$Q9hX_|iqPRKd9RX||f4<T4mh+g411IS#HOz7ZNjT>K^UESQ%
zxDxadk|-|(Pfbn5D|`qR#N$9w%m7RIoCuL#<cJsSFw_G4ZJ2pt12vAqyPk;NNevaq
z00-+^i-9<E;qmW#{?LwxUCiy-jWnJPVO`U+dwREkL;2?Jm8hj(zm)DwOo>yXJtQET
z&mwz5{qwpH!u*#=-xJ;EEIoTW9vGSazP=~lHH$}Y82$XI4I?p4lUEsf-TeIg2UU);
zksWjPAbcA{z*MRfk*40fw4u#Idv0gj=b(xU0>?}i(NGWt!50RBjaD2GW1lHwYSejC
zf;8Xi#v*cIt;oRC+zt#pYk^e7D97zKV)l<H5z9_t>&OMkh93*FV2Z)pBH(T^`%VB$
z$)@|&6|QYm%&}N}XQ<`;?08iTPG<wV$)D~TK|F9hPz6W8JnYJ3O~g6IHS--@dxfJP
z-$gcgR<wr@i2B=9xI#ihL*pG+M}*@(fUKY#PXYbU<OrnfnK_!g?7JJ7@4s%1Oii7b
zjfzFxN(fWo8cEHnJqHVxDOw7mb9@BEQjbs7G||O$(zThpq&i}tm57-fQ@(fao-**9
zE2gH5>&hDL8cn(N3t(_s2(dKHm&@Do$BnZLYL`<q1W*(;nBtfc_%YNy{d+$e?CtC_
zfx71ouZUjd)wgDJiz(Uz)UbbaH(1KQ3f;Yt*2rP+Kk-f*S6D($+=*ne`VUm(_NI%Z
zLqpkzfUP!SZ_pxl;$qpSY8;tyg=mfA@id66YhUerahGbki6S{`l%0EpkTm~0LIB{X
za=-%LGdIV-5^m;6t<R0*f(L1H)+LH=x+xzocv_#ZvkvrdaEI&HlyzkcGT)zCCV|P3
z?7|AAH;Y%P(ThhhrKwXkC{$~MKt@s$6`9iM$YPO*_&9Y}K;+!F#8o&aT88y>ESW?c
z%6830u!%iGD&--M_SR$J@dI5O3)+=nBtDb}gfyHe3Y@Uv0G5>(LjH5)<BdL|P-@C$
zx_!NZ7`D?sZ6%;KpQ>~1?eFghqn3+?xuBQ05OlJ@o}7^p3&ddD$ArJ4RUsS|OU}t@
zNz?|9?LETF#@DE>PAHAR0P^}RnK0~eIsv`-?rgSA-=KonIE2sdO0<>HuJx+~IXt5W
z@pV;uL=N^76syq-I!{f=OrE(I6X#wJNx2lFfKVaK@;$R(BkwP=ZTArU<JtWD4crF2
z2rQsts{Hir&^L9362~08vQRhe9!A;HBKjzlS0sb5B6Zsx`r94*XJLH-k(RM3?U3Ej
zp&z9cir`eZL>V(c<!Sw$J1zO;JylHbrJ`Y%Htcqt#lO3fQa{-FmJ)kAm7iiOPZK(E
zSaD9{Im<UT7kasSH=)2|$L4b`h;$ApwtFCl#WH^eU4O5C%1GA{rjsgKF=}EjY(Ns<
z>!CMbR)M8GcQLY9#sx+E^4#3V)xos{<1-^Z+Bd(vE!fTW{ab(UTSHbBaVxYb&I>DV
zY(&XaJR8aXmzA~uFig7h!SVFu$f5K`T>+`W1GQxsth5N)tR)eMKX*jbc(~6zaNZD3
z#5gqwMBMw+MwhwwPQX(?(WGx7gqZE1DrL70W~qdy=NZ_5W4=%LXkTvmRIuA%A3Oa|
zVlzF!&RJV>U6^{)s7BlIQ-d6(!WrNxzpDfw);;?kW0~w|IMo;26~kd?fxAO^Yo#EO
zsch8}l*c$4+12n8i(gA+t7p5=Yd1{`Fnj9rG^*x4MI>S_6Yqk-<lifS2Qxt~N@p&B
zSExxe$BtvSB`ePjQnSbOYP#?9mQ{~l^%f=g)D}@<_zyopxI?mO7R6)CEO-}(!m(iv
z1j|ex#XcvZH-}B~LB?#44?#kAiMi^B-k&_*RwRh3jpRC`&Dj9(x9AUe{)A{vI4DEL
z=LTq^UI6Ws3BcVhpvSp@NBw+W6k9v!s3M?q8WQaSX=!tPd^w#>`!liNK22X=wg7$(
z_z19(!<G~zv;!uOiv&>M2;QF!Vn-W4rv#cxd_1#+B~Y;8&f6db(E=k5AOKf#D=A-Q
zFvQnb<YWUDzjjGBNUuz?FiBTwR7?hB6FZRNh;@;qus(aLr4=s?jcv*->C{_=N!ccQ
zDQ0yS2XDlOShJ1QIJEm=(D;KH6<3SpUpg^0gwMH|gzxOQ><-rEp7SxW5UdE?rPaLy
zd%NT}s&nJ|GC(Q_!xYu8Yy&-DA<ZVc?Nbk1tVRkilzSIcxcbKeh(k#PzPFJca=T2A
z>&i55%QjYcP^w-y#@2s&i#yqu-Xnuuvt6Hvef8EwtGWS{<*)fQJhi+;hJg~+8^}TC
zP$4R&s84OplF%<NtWxBl7*;+Qyk9)$%skT_YlJqhNDgC<Pk%9b%$`P*ORD}UEPsn;
zSR=P;_F1?GLHs>miS6D?2u<rE$b!@{T2{h2($4}%)!{?=i^*g@C$os=u&#I0S;V3#
zUd`1yer_{E1u474+=+r&`#a;syT{z|1V0&w3rg#gx)tqXn@W35lU1o#M&akvW7SA5
zZM26k_@vEvnbdO1%b%AebE}O_gZRPzG}iJ{s-A&CZx5>%i&lns=>tAn{4`fTIC+$@
z`&~Wzv~AMZc*@OU5xHH-t=;}Zu481SPzU)ZF*b_6o!<9D(zF@%96Sk&T$<1hT8eJh
zF9h35iVMQ6By+vy?1fFv_6fpU{hx}l$pB9OT(=+5rk=-i+}-+uXEpbkkOqM21Zrwk
zooA9)f(Vb8Z;j8S5qy<xoo#9c?0ySi_}q8zNFhj9W@l$d*!DZmN5g6|T!DncK;0JA
zr@R;9!IbMt;VYDUpbRY9nDo~csDp{2z{u`yRUEGj&>ja9e=0)!I?!FrN#0wXznOG6
zV_gg<ek!Uvb$Tpf{%uE)_TB@-yC2SlBftjw4+qwdV5;RD2<;J<LTD5YMV}A9wCg18
zxbE+#M4=WDWga^$BISh)t&cI$8;-$_i@$imJHJAz)=JZ;U1LE^5ad>CJIV_|UgRW1
zVWk##zW)|0e3hijB_Y9RlkLL`t%m<4mUKi>_ni3bw(43t3}VubXoAHW_y<_S^BXx!
zdmLV?`=lqSMeew|-=q0{qkv<hqBA+qf8bjThrrVh1oeulf@Lfo_{Prqm~wsMxHfCS
zX6bywP!ftN(~jOwwe@0R*X1MM@SAkWTgdS&pE&0SvMQZ`EfGH9eFsDoCm)}~MEsCe
zG~fa)z%xFjmzudVH!V3cF?~4QJ+u+3s-fLm&@i<5Mr^M-n@ZKlgEM|ZZkGFKO|b+w
zwxX7shErL{BE~?j{sI?W<qX{EQbXau6#=1d)vN5vJ>+<$BnaEr{3QRn64i1Ltq(5k
zcRLaZcMf#HrlMq6pEQtUPH_`}Dj9sEJCZY~jB?_wrsNdPw(J@mBF4BtRpcA$#Chf?
zPYK=kyqZOuMUO6V%52#Z@SswTDf&sKj}QIq(s`lhH+)pPS`W_|Hw1zQ_Q8{Y3rS-B
z_0^S9^h6D1hwzQ7TQ%|SQt^<2vz|Zl-<vnJ4~~HA;CH{hdOjEH_tE(C6H;jM3-X~T
z{v<3+RRXnr7Wzn}Tz@|ExRqdiLudDSO{1OV{8+Og>LbTU)OFV8L$dp5uc(r@&1#g(
z#B^WGB~m=;w9e(C0IHD_*Xc(mP4gYp@|^%Ygu%K9LlMpxcmzb|&{Imi@sun<>JL8!
ztCV}O-;HlmQrZ&S=F;k4q}g}*Gz3MBJw4OKG^}|rELOtlZ<|J&0u8C|j<0RF$KesG
zLoHNnu+`^wQvQ^#SvDVK6&f(IHrX&y?Ud8rt~ATGd%MT=YB)0S&42&h2Gs8FuQ_We
z80qyFiGrbUFC(Zxj`!is-1FS>3u_Thck^P??_&<QjEWIY=;A?XOn6Qa8A`F#UJ}Ph
zv+nk+NB+`EJ@0e7Zhu5CnwT2B;6|Kxdt<t8`ckuXa7*u+v>Uh-M_R18%Sp?;-Hf|#
zWEGiawESQqmaDnX#AuJ_C{ihJTpow=wr<N4;-c^%(@sqSp0e)O7Vv*FW{d5rg7vN!
zXcHTPzZBINnOJ^Xs+S0zF=r(9+XY4B9}6kn<0yahROWXP9xVqg)*<no$}<OtaAwcB
z&*bs-^N5efTgR<qrAAN$$3brd_tGVQrCRA28#l&wTr{h8)RxK8<vXT)_0JjOH~Br8
zK>-uPjA+fcez`C#xy?UQ7R#SG669d5RQHB19pISXq$A~Uh<**Q_Ku9!s2)PvvmFG3
zD$2?P9+#~@;pj@-4*_xb3H7^4OjDB@>85o~T|n`(V~Z(<@bD_Aa=Ij<j3oUO@N^x+
z_f8{(rmV@os1TYAX}00c%TT{(CE!WR1mMgMP*U#vJG;AHFW!%cQ(soOMlVZ%s|5L*
zb*kZ%I_0yRRpy9EFI%k!6E;!VV$miCzJyALpf5LHzbwC?_E?@Z89@8?3)-d;Igcy1
z4wi$W<eLulh3UldLJ*B7zcakg7S^_krIAWcSRzDx8(r45i6W`l6X0p<Enk;&ba-r}
zzvm~V5>Ain;YxnnQfe2g|9v`V`x;LNR7A9`%8o<FbjGul2XfZMknfz;HetH%C#{ku
zi5Y3+-U<p(Yk#U*kU{DfB;57D43#bAVOPAYmcSANd&`EKah}d!O)A^DdI`;M)K62t
zc+~EIDYGlA+wPp5%y7{A1b-}=xq?C(E*RFvJa@cHyf*1lNZ``L{DR6h*uLYnAR*~r
z@_!xwgihIv9%z-MyIsl#H^i!OQVMeF_FHP%;iG5UtUM-|%8_4L4?F$H&z_jK2IG|~
zd8qwyWF2`h`zy|_K;^p=p2Be#O#(3iBnI++_ADVqz}(2X9F8(HF$vJ#+dlp8e{YrA
z_fPKP@zVGczKWclb=mI3nCaxA*XN~chS7H-lt!jmUba^k>%Jq(cj~Ma04up}f!Zl9
z`NKszSrkQc&b{KH@^|khkg;82vv_x$qoO$;=R0%6o!vUky>zRT>hq*BH=h2p6{|?>
z=Wq@Ml%h;S8C!9XapF#K5S5s7YjOuyYS58TV}tJ>`lmzN3(lVZSf2|0Dv8WCA`jPW
z@VrQbT@!w^<`5Dit#g{4mXYCS0mcgxpldGM@~rzWxD?2Qgaevst{J{-xmCpr;z_Pf
zq-(R&3)5-x?+!mIjWkI92)D;?Rf?{1#7vE+lBT4wrYn51S<`AdWFjbAogXuD_5jkj
zN=x7=(3!-ugU(O)%XgYMH#a|fl7|jk@(Bz7pbk1e(em^6dtQHuBJ>G|!=geG(TZX#
zN&AlhW!+;-?X?mBX(%Pl#VW(8b}X~^X7(S4=HVGcFbE+~fA+=Vp_tSv|M<~AEKM6x
zky2k&O!K)z4-%;OscxvedWn!|yT#M($VkB&{!_j6wbO^5jgP`MK-$8?4%3!>dH?=S
zd0CmKnAWk*9gXs)y>uC1NQ;e%H8eOhF_<~let6Q=-<fmvm(R4>{|hkx&^SlUw>WA;
z>CANlI?poVH<xqMysbv>ypnUfh40Jp+=Q{YvU#9U;Aix@Cq9zN;WxG}u)y{9h?v7&
zr!H3lGNicD<FToUr?>vf|2ivtiVendVP)Km=FMFB#m!Eno7AN1MvuTB-s0q|pcVLz
ztQUOiZ$<rbi`@vC1LsG3-=3x!mSj0ZD7or@uS>6gChD38=Zc9~AEml|nEBqMYX%}b
zZ;r08BGizBm9axD4v`yf4-~a)Q7>I6pZvJi=P^wjft)q`WO=(q{$!5&_vk%oEoKo*
z!V6)FIKu0kOX_E3#kCEBmyV2L&<sArv0}_x0zqQgkKO>Z;e5}!jS2DHi44J^u28eV
zPxrDco>9*K!iul)0xJpSlV6DR7;0wuu7VGyt=p#wN`{jp%$z4nLFWoztG!;1U$Ava
z{(7||kCY}PjpkE6zqgy%3})*J+rWtM<Gn6qDv83{c?{EYUM->r)|5|Lm~{B&whVa=
zZ##Hq1v`DMI&~A4@X~-j3UGs|He=8y2{Xme7NW#;EyR^b$H*e)Id+GYsWrH0uc#es
zbNm-*(~uY6Fl(A3M{`=ujV$D-I+dZedg7n!ZPs^seT9~Q^yLAeM&tFG`GRf%$-t>k
zxWu#n%wgnDE+x^Hf&JjyV%kGJC~9imO<F!QH_H{5l~KW=CStN}MpSdu9qNSKfbCeb
z!m>3}QBgRIK+>xG>EF@bp&`cK?nkR|b~z`2zPB$dP33>Z?H)7CBLwAsT|e<%GE3HU
z4tM(1ww?8wMv?sQ1oxGJ465L^G**{9i|2OCfe(+bDfqgUrs2sVQY|*wB01g1-#Ma?
zY@rsn2t+5?^BcySU1Wi~_DWw5`%Qj2=CTo*Q&6tUg*%SJ7JGVK{-_44Qkwl|k2{V>
zW0J?1Frp}#d)A9(c?Y&^r(MgY&5;i8(CQWtV88<7#@geP4;Wb`a-JFDL66J<wV7&=
z*#XAs%nSD4*bw54Gn^mV8)hE1gYj3&8_U`wvp;FD(_N$E%;T}U6k9Xb-MsKahTEy+
zYBD%^tPZf8C7HMA4i68Z8s?{8cT*=tE2y>t+j<gbT=)T|tQz`X4gm^U6qDR<U*U1R
z9Qdf(@y!C^%Yp0-fDSR(j0dv=RS3W()<8}Ff7_FjhBEMaZv3y$X4V1+^ak(|<8+*?
zvTf3>APSZ)ok)%C-%5FTSH!ya*~yB$gr(MKF^4DxKF8zs^-gJTeNNh8H=+$50S#f}
zv>2=P&*ak8tP98N@n%_D0xZ+cVmzXqY*J5tYawY0UsYTufAswQ);M>f<!R)<1NU8C
z2aRIR=)IKStckq}N9G#Gu*<p}JczY7U*Bq`*mYJ3^iC3g_ndK?XgY#}zR~6_^C`@w
zxqH-R1_tAwq3;)wUNrp#vuBnK@ywOW18FHvn}$GxlvFriW*q`Ams1sGyPrkFWa52`
z$(p?vIQHM@Awzg7#bWr?Mm-4ei)=irH#=B47e0#71G6uPB9e;vg^-yG9uWm9mk=iT
z2xrtz@35V-Hvk8}DA;7YKbEZ)A(ga*y~19-Onsc9o6Yeyb98)sd>=<%8%Ps<*F^n7
z$e`uu&j-kRm0mL!epaaaPF}#E0=o(g6>(@YuI4goucb|Ja2egXl^A^$Emm3^wD;Aq
zyZv02Dk<1HoZ~SYa@k6S5DyRSL?lKapXx0Vs4GJkrgYlcG^IF@oix3<=FS9gVXz|x
z$+H*hGDtz9h`YW;2%Hko>`0~7pVC}J5w0;lAfi>0w4Iz;6DxOMHna~a%o&73yFuZq
z?+WxG11_drz$Zn(JUY5koXO>9Mj`|Ei`inJx`eQdh_G&X`SKHO?^F4`A96}cB(HVv
za5k^kZG3$BlJ>AmDDb{|-|_9uUdA$l5Cjn=+ti;=Mx<kYQD)8%;|St}pr(VZ4r+<z
zrKQtZh$#H|;dGmy-tpF=XIUi{xJDzx!wPV)5kSnWZQ%b?G8F<^q%aGW{0;~>cHT7q
zeQWYC56*g!4c!G~QWFz2C8lQ61p4LZCTja~hL4q;Ty@t)Zpfg>ztu6=BudesyO#4T
zPR|jd#OcGFY5TDiYP}_VchQlnVhiCk3}u4N^frldqzc_>li88T--8EN=LaY{#6%np
zwg_Hox161dI;#I2X}rCEU78~;_ou1hJfe~LlYyomV4#)#Gg8Um+3f+`?tQP<IC3(1
z^9%3m40Lb@wqUFqz_IhLqy)vCHo_;*&Mhl6Lmav${1Sd|geK~<OH&GZ%HX=^fjZZ5
z2#}FSv29_v23ibMuKQY}GJgsZ<>pULPR7b%*gzO4L(AE}a@HqDqm>`@O4HNc`Ua_!
zjL9*Ps=wwy3bJ{L%SjxmocxY&neTqOZ(-lht1uM8TNR*7hYlw~d$j&$h+C5;laJS%
zf7!lkZpT|#Tj456Iwp5k*v<HPpYJR*d7;WsC>8EZnYVE-&`3+@`t?O9G7~KIHyNQf
z4_8_Q>++v8fc8HNiR!-{{q4u*jSX3vXuzpkT!XiIq@l*n*K?jfR=2R=1ixq(4kU_z
z<LiJ6OH|=2;wLs~(R-3{g)jwWZWTtXUZ+}lvWHXyjY%^kVcdsY+)px~a1t|vK9D(Z
zQ0lh3nN2V?9v#AG7$^glU^(JjK>it~{TSfSZ1d*w5%KQ!=*zpV+afl3zI`Tj=UK%`
z_aqckzaYF5WqgmXesg+H6M%nsFxhE);95l+_WX#Tcia<W%berCLrT%nn#8GW`11!9
zA64hK5cx~}cizZyUTkt*>lLh&NV|Mx3B{F8LlxDc4-yzsn&}1dnQ4QEaGTz(a6mqG
zyr=W%(OWcd<d>F~%*Y7w1Hk<Bu1Y#m>764^G;mv><BC)VV^T_M0&1+;?gt<mu8?_J
zw~8)DQ*?McgCX!JJkuID$dj_<hkA%JJ(Zgmyc^fYp5RkF)RwY5{bE%0UZiHNg4C5~
zN|;iUsuntdb;5Ctx&8|_Sb4KX0*QcM$EeIvcB+Qbgnqy!aP%<%>$tM+d8L;r;jJO7
z7zK?Dprqv!-pvU|3OJVU&KTiX;3LAKkDvhr2D}`iIUB52=yi|PT-eBwi!Kvi^wtQn
zkDjg0rWbK0t7CEXq<*<+=>_}{ZSYlngX1lDzySGBRwn1r?4m+Qnf?9-syKnaO+%T_
zVoo}7;mvl0!I#5;RuV;$rhn;UeqNtH+{<5yCM^*>y!wsZh%6X;hf#@SrLbDi;aPfQ
z2m!GYiL1ee;k7*`A(?LkIrs<lLBf7$sk;%GuBht?S70;j1F9e)!V8k!79x-~KxQGz
z1y^fNuMr3%Py*^(*#hPU^h`j<dAAt`3>OQPvv%?55{OHEcU|`O)Kxf;#-0{-M1le*
zwBOhtyvTSnlV~(sqWHk=n)#vvH|0wclDxM6s3fymX@E6epngd(#|6*rFA_0ikv8mk
zhaKVO<|YgrW)jX<r*AB^ErPu2Ss%H$f&)Jb4sN+8@d`8r{Pmh3_GmePN59(c%JL?<
z3LrQS`!8^f_&RoTFJxP5HJYGiTI?5Ui34D?$JJU8s3x<x1=fPYKveWD;$<4<lm@B$
z`Bj4ZQmamo&nf9_r@h&kXc6mk@o@LKBIY*4)S~C&%Y=SD)9A~i3|Qji8;dKZ>O#2>
zqMp{5U28M^qz{d~P5Q|G=aZ4(T<iZjZMF;y{FZR=+0$D*5BWjU6;b|_0J}Pq--1-i
z{q%_jg!}d${_o&aI31FncdedKw9+>H0NAsGfDnr<gGCT%Vyi)~Eu#ykW%SsXRD<?g
zG#w8Y9tR{R6|gHRttioL&6Kx?T=3rdXg2rhxl_9>cX4hxP5a@6;)Qp+&K>O9U&uN-
z!T==Xw$d*xWa?_e;nFX&IZmP5R+~}e^PeMzkA~(NGZfh)qg&mVefOumijgDg@=t0k
zP~)GUlF#_?75G=?DA``4C+lJ>_|blm71;2%VH#?x*mel701jVM>pbi9cNMLD7rfnY
z>?@(D81r@cS!z6E@}a=$g4ogDRl-^i1RsBX0$Y!Kqp$=E+xE}$fJg93`sOP;_!dSx
zdE>q^PclguVYets->w9nNLC@n@D9cR_1<I=Hg9cc{gy{@`U&xs!6;A1of`+U;w42|
z7(1jFfoz6_>w5%pyg5J`Hcwg2Y?;SC<ofVXBY{iII^R=J<#_y<v$GZmcwsQJz~HVL
z2TrjGijM_eH|IJ+wf6YAtoAS(yD0h&=PJ555(_qv{NYvIzeLmuYrRr+{;|axGI#db
zroSFZma=$fHq7G*z_wz*aO?}1DsT1-6l+{@G>d+%+b*UB;Z{^-t5>6P03E~Vi2B`*
z!ijkXG~vO{T7f4LPx!&RS38w}jyC4Oi46Wyokf+-(VEwqq2bsEss(pz2Al~=N1jeJ
zen>E*)7`Ls+V8teWrX&(sY5H*P<U%3gEy_Z<H`rpZ?0-Xa9Z5-Ge=P0c7?Q?ZSm#P
zg|%T_(~B;_e`}WvR_ha>`A)+gc)*Ex%Txw)h4^NJzWa+7`v!Oj=^)Kn)`vDwP&YaH
zxdG{zLXlv!`o_jGV7YHpcz|(rS#)#JAVL9|ZQ~k|Up$h)=n8{FYgCY&D6AhqPc_bk
zP(=@O+zD-);cwdjJJ30tf$f%Ij5c8)A?&Sjyk*%*lIim+4O+m6+=m?($!^!?!XPr?
z@>BcJL<-t9$*PjFve%|@#~GmLpO-R03)MPGUsw~f{dfM{K%fd%A*T>LEYz5O1g*>n
z9oP^eifpY4U*&Bt^u&JsdZ*5*+fa)X4NqHIr@cD=E`Nw&p5)0^Q=~p5^5K^ZN_9=N
zP&1yB!!I0zD*)|~{CQ)lq-(w>6y0Z@Kz}ARL7!tK6JF_(J#~hoP(9sS26#^NFR1!H
zck!-`zvD%K#`jn6@6qB!z0hj7U;|tWANIrIpz||vnor2~+O9~XQWvi9pMC*j4p(4Y
zc`V1^nO<FAc3iB$QBl>{C?oE-=TP8x2L}S-enAv27LYLhJu<D)U&xU=2sGkS;*riw
zCus8&xfo)vu)4r+75x9-q9?*7MKzrP$39y@B_~VTtBn15%}rzd*HT|_fSNv#XWug3
zcz75N5%97^0D-}`SeAoJlcBP*vM=!V?3<LOZ%IkBDDS}|C5UBjT7;5L&J#?A6YpM0
z+>r_Y5P>T**ZH02;QI2$uYG1oqiJMag`yC5fHol6wy_Sh0Q2~uXV2qtUwIQqM}$C2
z_(vU~v<%Mc0q-+Y;iI!df!M)Mg-lpLB1rN~D`ya*wcTnFlXw#k3~g$_;nTtdeIeMz
z)O5xX*qSZ4S2DAx|MLTUr4R{cCWJc@VSR(HY0otw&>n3A99(WD`T=zGQ7m@L@M0BE
zk#p)-rd7D`u3S$2@=tA~(%hPaa|<Ru4UI@}Eh4v~Lg(gKc3bxJKRrZF3&>#v!D;dV
zH6wy2>Hg|Rh)wP~{-0oy%FK#4S^YXCQCP>@SB$pl-N12JBXzL5-#|QHFDRzf0by@G
zz%d&ZbJXHM8jzPbm(C9>m7=cD6C<pPVCKg_U)q~1IThM=Z8_&B%m3+*vJF6!B@Pgj
zV%lIA6R+>!gz;LWQpn-jUfll?_1yt6$N&HD_S6t5?V+K)(@=6mlR_HTKufNqy`wD^
znimbxA{UK|Ym%h8N{+5N4bsw*RNBAi`FuX#pMNOt_uc#b8qe2rJf4q-VtI6!5&p)>
zCotoDQQ`T(QZ$vb-tq9E;1sAklQ+Rd89rg{|8{$AbdehN*@4gkDF{G|wm)?XwLhQH
zC9}5CI794L1Wl*U%gQe9<4Euc|NAWgTyWR3XSv~NjdM%Nh315f0P_ix+6pk~Xq1~-
zI2gP}w&(`*#kTy`7LNAggFL0+OJYkx`oZBX03m4$!@*17HR&h(uNC0xm#2q}616~_
zAhj6~i}RJ?6LLczA03yKmM*RDDnkrW0Eh=#*hwHr83#SFB0xY?VKyC|6ZSM3`IZ&x
z)PO(g?3N2zi$<sgr_s~iTn6K-a(&E@imcBq(R>-k`al!&7KnAZS>p^*UO?jV72@Pw
zP<pMAPe9*}cvsmAcp)Bj^DtYJ*T702wVZP~)mGKLNASWyT3Fbeps_7Qb&H{*)eFdo
zoN?`K4COs=6R_0A4EsUAO0{?(ITe3h`wmcoPC?=<!rU`Kmg59;E}aoH)LXd@NX989
z0?r1)K$;o<(88hG1%57W7O{hVH*RR2k{t)2&21*(VCOxby?@f&#Lj#&RoVjxIFg2W
zy{U;U^$gJ+Dr0y`fTJewliN}{@(W@(ZRqISxj?F+%5B9IXS}XBir1$VqZf#O`9{6F
z8#D#Lvm-JD-qwabAyvrgKhh3PG*x{4!vjrbBh-uDW+zr~_mzT}c?ea^tV6ft!Y58z
zXq=A#P65H@5q)Mv?l}!?QyThccVf<xsX56AfT(|us`l))7m}m~+YwA0g24~DE+O3I
zzE2+9v)YTy5Edw)MAX~4pqNHAIiUtWDEWs&6&(f28QNnE4~#N>fzHmN{ZU_K<m3b#
zpxOITQPFoA(dy*+0-MpH{Ire!!yEzUreIeK!?AawGsL*p1wsV%;9t%_8hP)`(+^An
z(EjA4&;U(3%O#$XT6q>u)bnN6s5}u25vS8*SIDNs#k=S|0B+e=&?w^g7B^1cc1h)1
z+T!pzhZ6#<Y;3l1&fq0cZIAXZE(Acd=2)=1?Evv*p@IRf6?WBs1yA|cO+|pq-J{0r
zFksZnsTTD_S`3y2fl_Bf11uabXliE+D`oz`JlM2R`kyQQbK&jO!RH;ZdtdCo-6}lM
z4zi8^`NnBlc(LNk35D~|?i_&n()hy#xvc+w@>E%-0rloTlCKDap*I|*TJ(rfq7Q&e
zjygIz?zH>$>T5}FK7_{(2Xp&qK`{m{_K*GVL6CkAu+&>2fYH*3wub*OK%Bh;bWG3O
z!W;R@97lc?D@Ax-2R!66Foy0loo4VzfApwpl<F|{f(6NiNa8P#*gF<#<2y}sV)#t1
z{xN%&0oFFLQxNJRceAs#%$ZfV4gItZoc_P}X}oeoWvD}Vv!c3()!#A+yn{D|H8tm$
zqG5ENLI@cZ6cqArtf}AQXemJR04apY<AkNQ`wAr1<7JfILOYhZJa5<Hf+}@@jb--h
z{2K<hGPsbb#B)a~(?sF&q%~-vjhuArxgY==;eXQsE0l#Eq4Kyrfs6eH+oSL3ln-^o
z3gXXLHu~?J#eFyIJCXM0suA_L{okD@+}~YNQ84`=<yHb_3LXb-3o$A^Lad;_7FQHx
z1OlUT3r28#+rpWrH>h__uTUK<7#&3fCXt)_7_;v_?(H+=m16MC3QnUc&b`}z+mV5$
z1)RzDSffXrfVS^p3=HOk=e?aDpL>P+<=^iX5eRm)EdV(BtEgtlZKS6dtBuby{bGSP
z>WhIx>Jwr}s_{`?=C<lwqmn;g2=wXr-$UPSO}_B$h`p=cCasUOJ<A~L3C<_r+A&3g
zb*cw1X_uoWH>fP=!vAJRJIB9-(Gj5bYofeV1cyGoVa(pA;2Lon@3Er3lJ@7N<^Tt1
zI{i;ejO{(H?;(g5S6?1<d{RojgSn<&HE<xK`=1ZN5iqd%2Gliju%}5i7~)ni93Fd!
z;g4<vmO%Ze%1rBX{N4X7W|)^&kGv;NfT4E>E&<`b)rP7z@LT>j`f-=m&e(i+d^QYY
zy(y!h@C8WJWXj?c;Xczd>5SBg6HHa+u3h1^K+ZTi3R8DzT93|bMf8DwQ}a21btX2K
zX<T}j_!w$(PV!1h20RG02mJZ6F1SVis>Rd?;jkIt$>&EPVZjWX3+?>zOAp?}Fj2wq
zM@Q-}P}laG<480lXTdIWMeowI0GD_1Lyp6+B~nI)8U8JoB54rXQ@~;qJ<dX6gb}dT
zRwg|B-|T~%?e)`w?2qlgeO!bEAvQe3PEn)1<BP)?!)Rsd8~l6Smm*1RmrV4}|8GvH
z`=IB;jVt(c{XltMwmiR{Bin@1bF6JH39N65!D#O9oV24}d|NXZKVT>j1{uV^&!BU$
z!S?J~Ur@ZL-cy#;Y~(9iC_m5TdJC=$-SaOO45yXW6&6aA>!bq0OTax~ia!5JG44`x
zD|N+YP?PWf8GS**L*MuOufYshzj)SpxRzxezI9cQ@b`N%Qx+J*2hfXhG~+7OdHHvT
z?{r@q`syKOnSEh5D_Ox3MVh+09s=bM!ORG#8~*Q8?atuuqG2Ub0V-gv#;LKX#wNjA
z=7CY4+!DidGI-ro?H6AdM1AB81e$N(!#F#}Z2bDS%3g9RtK|VQZwM%R4gi4E5tvHV
z)3D9d^N&}YHe<NVsBb?#f`dHUGtZ$3JZ2PV?~2ZUAfErC3(ig`!~X`sfcn{K{A!b%
zM7<Zq#S^7~jh@pr0=~$-5KOWklKk%z|NHBuO^xCex!&)rC#ICEZ?FT=$A1TD5;8xT
z9+uJIKwWUjnlIaXaNq5~GWZN)#R&MJeO_nja{i4F6XLYLp{VE*pW3b^sixSf(<cSK
zyBpT4GPmr0-+$|XL+n3>7DA_+IsD-4b%8tRq-wrw3B`;aDyaj)KV|-@nS&a37E(v<
zX5t0vVltoGN`)snQE50B2`r=#{x~~}f2Y=B;U+}@&yHi)84+hUryME6wx#oe{dd<|
zjS}mj^0pr#=Ih%x^8Eh|=T4aZVCI=F%b~j!B*B}!=dhB}?khM*51v_iP7NjgP2~xu
zD`AGKc~lCW6j>#uW}l5eGwD@na{Cgv>8bqyJy?~???ZsF%h*-q|C{0497}Q25Vu&C
zm6Z*sd-cmJDk&9klwC*v``AAhJ~RDWD7RzSxmDCi5o^P1Cqdb<-}j*bo7h2wS`>M{
zIsotPtIZ8X+1ghypZ~QKtMS86n-0_1`<4OxUHwb%|2=41)Az+Qo3}J+457G6wSV9L
zcaYxJKUO~S@BY5V>i|q+Q|b?Zxm^5nt;91o8C1h?KtA@!Tj7zBFY@br3;g0K^wun;
zR9JUnsU#nnRBs6$;I?qAkDobe8GJ^z=&sgpzxWJ~=voU}aouHk-9|LvG79h66&Nu}
z|KC0V`>Le~AR-Bh?#RhZhey-r|7!NbNbz)ab!owPcGI2<hkC+)cg)M(M-_Qj0Y|`b
z+O0PqV+QS2bBD4W?oSC>MWFw0SItFLoqtn(?HrV1E5fgXYZGx-Wyy*b)M?-WhwoGk
zTTx%Mh{+l()b{S?>Hv`#?_$PdB>%jkLXbT=Qy*V+;QqXrlL8k6Opa+AT>rLOpQ)%g
zWAr~R5v<vc2=}%a7xOh*!zM1=wU_%FnWN4oKB7ig|6LQeV^S8`pQ?Sfz!xPv4t(}6
z>YQipO)tq+mkpKsT*6tmU5{??3Y|q&nD!1Ni(bh;QR8>##dt{A@vxO4JXk+F-PM6}
zU=t>Q+s5Of7O(lE0fj7Ae#oh&f%kPDLE9_Cd)&^qu+05?rP3K+D*U5han2#ECaBS4
z>g&jlQAZujGJ+(f4i0x>EUiFDde6Sb1I_096QnllBPgboS}Tv{e0T2N#3m&|l+;&%
zb=qrm=dM+x7tm=XBOk8SV<2dkg;NGv74xWh?c9>}Q#yG~!4PF~{%x<X4~KVssr2Vb
zX6VV2%$XihpIU_;O3a1(P(-}lHEJ5eSEY96W~&*lT(yqxnXZ__bXoR!{Q2RbuJf#{
zZ2C!s9%sM!X=6;`^sr#Xsw5(F`0!7Gl#}iNm`_5KLw^4_n&pa~+Z{fcnTa?<zxnHX
zr=EPRs(4(Lwnl4LFj!SFlP+a`xbtY_-GRkh0gz%m;`!;x+wb4Mza07du3gZN*m6oz
z)faAzF*Pw^yqI;KKM8fxeYj33WWjQ)?HFw|kENc9(%vM8eJLlO(`AevdsE#u3F*9R
zwAWR*6{L&!A%^PLllEx*{d!-5aOuMvtcW4A%IAP#&drtCHD-j0Zy&aWv-i<}$n@|-
z1DY`avKvC+d>*A9p9leY7nF0h^{>p|x62AR%AI*y_5k_Imtj5#q5#JPDs@?4V!uI{
zYF(UBj9Abb5*yAjFIl$xIs()C;8>}vZ5GWKuiJt#YR^*emQGg{yX?eT92ZZH?N7o^
zJp^}3t*Lo-@KR0CcGN*!0vQUYlaKpINO(%3WV8W@Elp8jJpln4$OjO}Rol}llWuho
znFMpL5Aq2$xw!|mHU|~D2nSoV5f(&8Ey@HXg1ms*>*c{J*W|`9Y9l+fWGoHcM9W}u
z&mvAEoGYAjk-yCmZ5TI5mF-n)1{R+vAoBkhn;P^oFneKVXl5wgeV~9WRJO@^&au88
z|9EvEd&)CR34}=0)97D(2pD#vyQo+!Xo6bf?yIDckJ?&l*Ql}05HC6w?;;O+d#cD{
z`z4ioD~j`JRSOuMdP>_NL_U`9Q0yxk6Oc-F4YS>8jA&{MArEyWkFoT<asE|6z-5CH
z_p6eU$yh+VMqD7TFc>91GD`HyS!Zcgo*cyM3$^@gl#fYM;#;T;?QqPvLcu3o%?)hM
z_-%psR${hx>grXlS^n0)_z?o#*<O%_?d5>}U#g1zPtYS@o=rmvpFX_}4qqnY{UUqF
zi3K9g&`lGR0w^jU>Sdj}#T&pcF}?C9F>e+U2WVy$bMgu+nk)x$5PJgiAJVq`fIg`G
z;v3>f1K>360s?CFpb<EMKITnn99I-MU^{_;v-}beaodG2+cS4Hr^Itt;qYOdHcKTz
z4lkt1EqAgFQAD76iDwaecOU?*L<(qp>-%u@a>8(-lW`l2Ll^2#TXm0)Tno{M=WLP-
z9|^nO3%&5f6=^vj3!zgtueT?!+(4|=&F$Y4Gc;VfMvnc3Z&Qoqa)R$IapALprDY5?
zrE7fez1rH^G_qXtXrpa#4zh`f*pSlGXQ9n&a$Xo9XK>=w;C0ua-m!d*ogc~0%KAAn
znrDQPhH{7}%HIVHY-mDlh297IhUfzC2kzZ??kmmVALIpV6iPpYmaNVZPpqmzJdnhZ
ze=OK_Xt;X8AALb6fMIv!0!`uLu<a=#uDbD6eAOrSxw7Ou+|pt<uCzku5H*B2B;Q5Q
zIhYdJUEkwFXRxS`<Ls)sgI~ihv(JU;dn;Uj&|IC*Nx)UsVK&9d0R@cFu+V!JbZsM^
zO4RG01uw__%Z%b>rwbxp^Kwx5S?umndsbk5LFD)Ry+c$bZ%l25YKi9%ZRM7#?(@K(
z&l;;}K73XRtno3v{EF&xD|BsyOYU7C2A1UGP5R!t>kAo{l(o)Y@D7q7CR&*xO##%~
z)PcM$z`fmBRZ+<G{iHc59&(LxNE8N|U0o=vcc64ol<n_DshOeVMZ}=wc}enJ8(3G{
z{g~0=iqI*|sJi6Qoh;XF?Sm;J-%{qUP&DZf?n5B();};XZ4gx-Q7*Ur<iR({{w;xm
zb{!EKhT9CXRvzf@_dWDMhL8#QPj@iWv-S0WUp0DZFypPELfb-J3mWW?vl7K0stA&v
zWVlmp!31S&-+==*;N>U7Q(e;&HlRbK%ya!~N<7m%asz>F-cvmE7IwFdNF(;nOgvXK
zR=GGs0XbR?qCKHqRX33EC!TgqvxG`uC{1T&Wu*m}g(b6?MW$6r92X4*@2-d@_`k7r
z&)XmTyF=Rg-l-q%uv8CH@J;}8)LR6>GS7$FzTZ3IUABw??}VSX2O+0sPUPOHD>xTE
zrvS)DUboN_jyh<|gSj#vd@*aK3O8$gjS^|kyc8zu%E7%~)h{+toPhJfV=6)AM7jZJ
zAVf|)?rVoKF$l9815Y-?KmuC6(!2URxw`9BmwuM(@D;xIYZyx8ab{mg@HID;KQ@!^
zQvJU4YWVDk(8I;6>o+T=6lG+XD=xl#>$L7|-}{_g+u@fzd}5an@pAL3br!xJBlN{*
zbqVJ{GJ&&a@Z-n33!=?EIE;C3RmC1;63nk0;jTq?kSL|xcu%ywm6a-sVP3{>GT8E`
za7g(gJMF~g)b??kdCaJX_1d6+v4!sJgD@cCauJ!kW3kaAytuJpr<&!eK(DMJoF+0H
zS5wuy{`S(WUvPb%>fWR+c`oL2z%0B(rTFGV<hw4p?KnZz%|*Ix=yB8hW!npEYP)dC
zEKJR3*5(B+o_o+zRbhj$gET4wa^~DQ|2r;xK5EO<v!&Fq^s=G*;#JFP-Ckii7Hr%D
z3Fwb)ev(lK3~C9G`>_Tuv(KChQT8)tdj{*NPj1G$_Sc0R5WRgvG$-H^iZireUJggQ
zEpAzic$Qk^9RxWdKrBbX>d}nu0u6wM3dvorl#`V_MqBJH0;%JFI&`F~NWas#??u=7
zm3j^-0bYFVl%r#Q^KVOpUM=~$_8cu2;Ax{&U<c5Swda<gRb4wX!k%Q%xG5T+)QC8S
zMh}xPpWjf79Gm2_<ZV^8He+3FgHFr3|0EoJn0S<FtQS?&wO|HYwaGKL^%}*|&c-IF
za*Z7ay9^BN3(RIC9GM2K511`-)n}@6OY**g%EMDvTTiifrg%&<9z<@V7D`g=D267d
z9Y<Vm8Ww)Q&j&#mAx!M<Ze%y)jy?v9c@X$1O^+Xs$<t6Vc%ytL8AB1a254?yz;IYj
z$b%A3wH#ZWRKIzUse7Q%1trkXcfJpUAaiPE62hW3i+HEBj|-&fuMRwdrfa8_-v=G7
ztg7DO=WVhS(V-%DUs50ioCW*#PEJXPrdmM@al5E*ItsfE@+KQ`gJjz*4I0qws{nd?
z8dxf>lN<0(Awpjgq869hMGRD7jVLeEi|Y_xz4{v=J7LfmRxSPNQ&j~YcSJmP4`L6@
z+Lb_^mAh4geDF};IAl&T0nmu*@+!QQ`KktZC~h+QHZ-Gq5x(;d4qNf=ioOZiB9^)8
z<sX&r*jjat(rELvWMe~|)elCTHF@m}T+DmGPm4~(i5A@?hMSx|-GM1T_j3UltjLx*
z%3@b@Cv9l%xVqUezqB%04~99kwsjpY7YXZ4giT?Z6Ji2Ad+*?%C*2}7pvMn%R$jdB
zUcoFb-hKP_?GE&48$f#p$eHbAf=?r1PTF!)#X1zuZrp<fB3dly1Veuxy9oPgceS(Q
zLr%axuiU_U8LEaTsp!#n<4bGRxNqPgoc~FP%+0tFu6}U%6lw(?(9#EVc@BzR)`G@j
zOYHh-F;sNoC9BSxsG4iD{m-@Hjl{auyXA7$QR1PN%)aeZld%u>+(8qR%_-RefaZlY
zJb7{@I^(xVyYEi<EI}ex#t*G!1y7TU_4>XPY<?l{hWf#6DegQol$2UCz4OuNE|^4^
zEaNKNA*3O4JG8Z`!e?)vE%8oAy7Vq+XC8oEL)%pqDN!8GYiKIUm6K&rS{Hgt&OU49
zgcu6GgO~dV>W^mhs1j(L=Rq^gQP^Kf(nTQZ%E*nLQXtaj4ALkUK6&y(36I$|C9jYn
zz`Z$3V1vzK#c9b^D?fWq>|IFeIIv`Cau3&lIoBB6ZeMf)!`tAQJ6emO(EoZ350e1!
z1|G07+jTbmm3#YUkoUG(D>TtsP=Act1==Z}x42{;8F_hjrkFQQ;+Nyo<rNioo{wv@
zC3?tl-^-{1xBPT5cxWIWkRqq3=s2U@GYlX1y!&T?>cJEX9;0w*r<df`2wfl9fRC%3
z9UGojv}4GE!;M;`06CydWMD5x!W7`??|?;XDoMz+_5C~Mb;m#G2*g{Lnm=7WHz@OX
z5qhc~U?>HA@hYcH)-&<-OvDOM6Usc?r#^qqEz7FYSnt@$gwi4}+pKTeJ(breM|~k-
zSFkK~iaDWm-a<TQ@QeB$VuPW{dMa+#IIi{EVxagwQ$!qV<_KK5R%r63cB)_UEWt01
z>litJJcLIxL_?8-V8uXiS}3<JjlYW}>Z4GEwI!AStAJ5(=vc)M(?x@`@09uSlky$8
z#OW&dK?s2)?`?ndZmA1jGos9Gc#c%#1jGYiz0e#9-w28{(OgADxIAb5_I2%s7WHlc
zbCNtsecliJaPp%w)2dfKbG?QLN>c0{2{PRP6Htsc5qr06lo&$5?LyzOTycgAv<>rv
z#+g`g!~1|?17Pa7ii}#6lDsAN^5;RDeT`=>nX8WhVTCo3<(a!?m$l-DfLA+t|Neam
z0O7PK-<hR(NHca3O|E2*GhzdutD{Q(F@caPZJGZy0V|?rzN~{xarG@3B`$&o8wOS>
zkAZ>VX5hI8<!}}C2w-K5S!Qp2m6~`E`#KBT3yGV2*m~Ps{9=YohOo$BlsQ$F2OYz9
zB%#)Wh5bAZ{`H{OZoxER=S9ZvWMqR?tf>H=*2LG>_X&I|WTODG5-iHa{1t_Yd6JQ)
zy!^7nb3{1h<SxC>Tk%-!5qNn-4;k}Dq_`R249kQ8fqnG|C`7P{v?KbO+_gC+uc1IU
z{R(_>_Gm0JB3Y!Z*6xpvs)CL32OwSObJ^f#8J<+wn1UoaLyL@CWG*&=Ki)S$nXf^*
z>x#4G2mhTjWd*Q9$m*EeYvIN-gvdA;PVPQ5F<g=x1FKEkt%+1sA?W0>$}4vjyDos*
zM}Hm1_5I5!$=|NKxu+y=Si^R1Cypmgiy-|hVvz@-lR0xD!|MgtcVm=)ea3GNH{mzL
z%V6C?Aj9FU#{QVGWdc=`pV%Z-ycGsE)fXxB9J=1B90|o{CZNQLh=n@|xKZXYMcD~@
zWHwQT(b*BM;~scP3bj$@+oDq|cuQnKv{aYVQT__tc?IWpe=U{+IIlS4pxOiEqRAkU
zn1aOOW)1clZJlCXLe!$nnYovKCt*w0nbiu~h`lDVd(25qip5)-K)S#f(i5LcGw|V#
zu072)_sMzG6Yf48w-LlyPAyH7eLT#nQ@k=9;_BvOD7aBBj*E^aJQM4biW1*VkPmb2
z^<jwR@+1cw!_p{s6BSB4rD#O=CVjoi_a2SJpORg4pRB>n+9b4oD^0$AJ3cJnrL}s(
z<fI!D_SPER7}r@IHQn42&;0kF+@aW)jD?``81vajo<lKkT)E8s()EpiMRFJ0D^+9z
zdpclS8jjZ9?2HV-Z!4w3(h7hNFcp6b^wJ|h{X%qyrgNL5>Cutb{U?}5{R=luo@xtH
z{d`DqF+#DUy1uIj(ngyPge4s4u4|ablz2uly+Dw}>8TSZPDH$1ZXa=)7eoxD#gCy(
z?_vjd04UHtAFSuC<kZygntD)yaHKZ{J&BTx;}R{h!LA3P=-qbuU=&l|rw&i#!FTP4
zTD>{yPXq-okTeZOS<<q5=Bd_5@c3h}fwUj@bLQZk7Hpg%G`{ICXXgwC2ud>)j@08C
z+is?$jt>wU4sD96`78yl7yz&LbsA=K5)RT7z*n^k+S(E0OToL~*hh$m9%%6dou#g2
zp|XGr7u$Vfv)kKe{D-89BxnTFK~V;dL0#M|F3XBQ439i^>=?pdYGLD*%Ztb8dQw(b
z@R&6EU-se$7YVp|Z3{b4oLR>gTgloptK?vlp~pQ6h0644SbBd!9AH~q+Q5^-=|I+3
z5l-WziYDK;QsqY5gWD;oO4~*@Bk4hT>I*o@4R8eBgj#L`JfZ=Tp5!5^%8{Z-4u~)V
zU2;&0^K{k|76JMoEYuo~a0`tBnCUU}JUdh>M1;Ga0@&MeXl9%PDzaMmAQA0UwNCte
zw^5>J(`~RBOKY?@4Kv5Jo5AUAhtnS%mP8l6bXYZX*hsWX?j#%nJLe(d0r8s!aamWO
z*lP!u82JmnQ!^M|B~TS}0$|h+HIU;Ww~a5ALmGr!;_1kngt9;obJAYi>=43A^N=sC
zy_c%am;r863~u%^P52V@qB}AbnlK+jc3y*AiCnh4ZIu;yrP?38=tWsA2e<n+JT;p+
zDb*JpbZ?gM7`g7^^35U@N3EMvQ&a3?KS1UXUf-Y|^qLMs2;f6mHDGVm=4{!A0Dd9u
zGS);^s8Xp8N-=NEVJ46%kKEO`V7*8axTgz0Kf9-uPoj8BUX@Ki8uAHuGgLX8&*=&8
z9*maIH;&<?Eu@Aa5OsaT&$olG@dNI}fJ0Uc?`TTEi7<`bptAH?bq1i+O-zo2L8r5O
z|CcX91t!J$n&#EF67AroXt+sCt-zD-{VCZAPseriqR{X{rc<aV47CVMZ#r1iCJ)Lg
z*&p5Oi(ZpQ5>Gz1j^mnu84nTHIVzmi%VoqaQ54JdHq*-6qm;lLjdpU1Qd6sB__cKZ
zkZF^>jm;VWW?fRpwJEV&faBWT0*a;y>YNB(X<~2(dgonGYsvsUoZj-vN`pb)hd&KP
zuixSNE{Fue%b-zzw7J2nZIBX9+pU3FP8j(<9R+joJH6O6d&ijhn@;LwHnIE23xHKv
z?`eINhn=F}^;Lz_Ed9`Hrx1z6>D~_>l)tyi=?!7Zwt*}mJUtPtZ4x!PR|-kE$d_eh
z9#t-U)YCNzFmxTBpyI9t1BC{B{h<=ilW|;5M(-E2>n+{^pduYSShA`gn_6WEaG^Y-
zYRqL}C}M8jQbmvk98GE;FMxo+3Fso85pbL;=F9R|0*9sHJnRPAh_Cp07HaqiD_sf1
z9S@<&X|Q&90|zK;s2nUDyLQyZ93?;;1h*M1?5<*7QiA7fWLDV#NvnfU`~BpI4HwBP
zeIveKMxjJ2c05hs<CBaCr~}|?F=5p%e8#L|k*UNdh5Gvg0|nbpycbZA-pk^2e*HeU
zfd=lj{ZZ85BRM&F*UPrw8j?Sh7cR#We)^2`tdGG%)nh1*m|Qmzb5dkH$LDOlFjwxh
z_JV9H+)C%nDcL$|NuJj5$~>z-{b^YmXCukIua6!~afFZZfsb7#>e(|t5|g;tJb9#N
z@Wh$5b8UNk4yX#mVE4GCT0GS53o;D6KTFu#@(!E`v;)M`g)p6K&?q(ZGTtRzUywt3
z`{#7UN5JJZG@uQ9$N|kSA%bfLrNvRH;_zFE>SFIsgV?n`;l+!O`-}u9zVvOvOc{X6
z{NNDmL<zUZv&`Rg>6Z&mONh5pYM+8HQtt_iKB_=3<c2VJo_KKvam!9-U#K7Wv*3Ji
zzQ)xjB?^kYd+n$?PNi}FPK}@*C-F#gK!?`40r0X(LrUZmWO&mW8;VA5ohpETikM+l
zT|a<yRROx{%4tbKj%--I4Qy8eqpF@7(i&<DdS7e^UW%oTrirQP3Z#@<K;z^fcKtG9
zOv87Zc-(1PJ9S>W$3e9EhLe+1bHnS`M-CTn5wa(P9LTP+6Z4L`vtX=%O6AJCfZ@e3
z@<Skz-)FS-2;N#Ae02LPS7tHc)z}$78bgzE?t5>DTCh#Y5agTt^!-TVj|$GAjTUV0
zSnfO!ttG6yY~ltiVK!#D>YiK($XEr3=?N=U!pM~75u6cV#Ot`O9c}>|?S!FJc$TXz
zBh>Sl#c1yQ`7}D7r_##~3`5_x6*SD*l$S48QYnCJdn)o>-C(shH1v?v&9kjW4yLth
z@$&NKE(HTwimrI<Uv|}GWp}@L0~&scKXM6j(P^;D6;S^7ZER!_x}5dq{Hs-y6H8gd
zhIe%#ZN(_@B|ys(iE#+P1W}XvOWhWd(K}Y1yD;;+t)|IH!$R%iR6~t?t1>OJL;bc?
zVSSyykoJjsON`oU<T0<XvF>V^wVpiXb;}>^?#5vvYn|T_J&uMX#1@?7kv9ONm+oqN
z1Q5wOYFf%_Y+~=jW?0=gLg$B>qJbSJw(|Vt;Prdt_k;5*C&X_7bT`;d<ULiMj9Dy|
z>AFf_;Hxhi?BJZNI|?yv*94#oj8JB%=5`M08@CdLfqBP1Vm^BH{RnW|NR#x-zPv1O
z;p5<50egvsC|`OT?>sqSWl}!7G3dx|@i9QZ02@^eD(frM`T+zK)}$JDNM)rZx&;rO
znsf85sxQ2Q@uCP_rH!W2*nEHj*$o<1yCWv%4lhTcQ}5T5)q%Zz(@@0Zj7B#}Q}a2`
zW_;fQgTfhmdkXy+!1O%rY#~rkh#lykBuFB^V|#BRWzZFL5aBv2$;Y05iSPYPyvxHU
zo<paR9tY^C^p@7k?<|xn-pb7QM58RRH_2?DkvhJye_2xw3JeaUn#YZ&A6TFwz)h%(
zE!7#Zjch7BhPq65v&9me+}AFA2GAxT9o9q42W2u>wC}HXM0?%flBWF7vMZBEP?G*=
z5#U0M0Pmzme)d>bRVTOsxR7=KkW16qPA0F>q?(`zCFuPOdXm9qM315LAAfX)ng83Z
z#Az&~WY>T8qiTxh-^NLc-ozS+6-h@}HUlv7^5jzLII}q6qwmA{5>K3#xnCo0mJafb
zaa=pz-{!44pOkoRL#Lf1c_jb}R|e2E=ahyLe+>OB>5ki5Crz+07f)t41jzvgFXd-v
z;5c0bohi<hhtak6(zUg<9n`XmiHXUA_qA)``antX91O%GX?1NVr17jYS#<{0c@J+S
z1r@L%km;&)BKUj8WPep|_to4B%sFh)a5_+vP{n)lU#NZJDRYEC%oO0md)*ul7l)rA
zsmCN*^mrc-duM`tho&jNM)#HTv21tyq&{#Qk)#1D*bp^<Z-hKeC9~KC$cJu%mDLL5
zsm_5kXCqV*R3N_$sUWB%MA5bEBH;<xIO&$f1F>A6X4NW@!jcjx+Lm~iiY0pAC>6yY
z1jQ#Ai*$wY@r+D}f>TpCxJ^;rVGAr)CVP!4n2<`Gwlz9KwCHS>Yuw$l37RypxPT)C
z6C6Mo;SnGGGy93uA}Y=rLY|YH_RN(^k}*X2BEVYpvGI4*J7UVnCaYUdfM9}9yDeih
zBZuI$IH{n&Cfi%UPP!uh2)jW1n~awf#~Z-vqfV>)c8~WkL4z*|70H`&vcPRp3*d_a
z$k&Mpcemn>9W~_c8|N1ok)dKUl>e<+LOJkm-7$0WrTGY1o1F`gA{CtX`tibrZ@yT6
zM6P;IbbG4MgZYf5<Kl;V2=3Ais_tY?-BbyEm#|Vi^6O@Xs%$Zl0dW)l;n}_g!?nv0
z^9HyyJ+R~2N|0MpkG^iazN#Gfn|HzM2XKZO0bDs08X)vQmm^R-kQrErccR0eYr8p`
zpqjCO3vSd(eoozT=`+3}7P7?#<&FAz7R`@lH@M)~yh+5JlEY)7WQxD$-a}vChXAR^
zPNN^73lD=@@~H2_3F4gU@+8{N>i`pCRsLBYk7?i2`Y~zxpc_Z9ZshZ4+pz3z07HN=
z-76riO2I-XWvpS&L)?<+swzUh_DIQ$aIoiuxa#EPU#6@oU86LCAKncFdY@srC{gQD
zFvkG)2~zi5wuym5@Gw9?!&gk2dmKpWhg6ff*)WtQpfiJvuRu~+8g5pFq&~$&dy`UC
zP$`#r0{iL*@+(mMo<{`$4*@}g%c$yjro?Lmlyh6B_3mQ#(S3+LM>{lJ`+K&SyX8Gp
zDe3?)TZ^&h;cp>!p~;Oyz7J<X4Y)sG82;Mc!>vz?z-d-_TGlc^&^>=#+bih<kT?6c
zDtqrY+KK>zr)@-3IE`#7YYEMy!jP3YEt_tXNP=C9#fs!XS;4u|O!r6&UGynQD`9rV
zf=iP;jd{J#5Qq1~#l2@g!ceO&I+NF)V}weRJapA49`3hBK7U4`_O1S0@kG*SgV|fg
zQGcSxwE^B0E?Qm9R>L~@oHlM;`?OC&y%NGK7P$0O4}g|ZMLyDdlhkOwvW%IL)P2b6
z^H>k{t1dRRXKAA$rE(e4J(XPF56e!dA(2KX1JR<_E#3@o8sCzJJj}_yf+>lH{KnRX
zZsJU0DAxK_wI~-k5nUzqxeSItjI;p4DWvmxEzlGhBY2066jO%pb$Ha&mDG-3>OCtO
z*g$H!JF==jC}6p%`%OVpRrTlc5dzMDpP3#<_e)G|_Z+h?1NZi)S(8n58n?;kL^Hs?
z?!0Aqk!>X7D)?#sQvrLcvs)kyJ*Cli?Me0SFUng|k7u`Vix(p7HrcGUJW8Y2Lu_`N
z9KC`jlNjbMfM0Y-E!~B$k_sw6YjT9O1)1AmH(|D#V|%{14UovEps~7ZJ=PL_fQquv
zolzNi8`01q32p`k^5voA0Fk>^7m#43u=}O68^*-1&<SdSB9)k7f0qso4Xsfpw3%jX
z5As5ORsczzMMd0@)*fHsg&27T?58!<^k}XhR^v>!x`jQ_ulNka5v9yY8-V?tNB!Xu
zzXS<bfD}dIW=H79?#N4P%}1aHco;_@1pFej?-_~9_Seu^6aE!_i?FMOj~i9PhQ2ua
zxNo>1oK(Jw5EvZmCmCdcc<%j1=PqUi*y{;bwx(+1(6_K~rpQpT0y9cH?^@jlR1BB+
zo|e_mK9*}2UZ598Zen;91NB7jK@>OuQ5F+2O=!}{v#3;OAD1Bq2tXW!n|*Sz3Vhb{
zNF~+ZiFXm)GggY5wE+4&khXBAd&P;6$>e6*u}mtEKwI!AYYS&i2nd#(m7T~&zVaux
zp|bpRMtuh?9mvD4z?JQ#DkTYQr}uf(+)j*tP%^_tn}Vc@s9yQd@&$+!fD};KrsCqg
z+bHo?1T<E6E+f1B0gbeVA_%1lC;I|Z55alV!IYDu+(r*U?X^3S@5$<~5ed<1(rxIt
z6!=hPm|#wtgJ_k6Y^~C8pYDC8-+&)v92*_!O_T4+1-5Sy>+;W9NceM1;D-h_Cw9h|
z7-}mV)bB)AEbX$+kFhKXLZKL_+5A6U2_srWsCyMnK6@4Q)HAo4GN>Hz^K%REa^+IR
ztAXBc6IMtj!V5;VsZx9~WGHZa=~XvYhEW8Vp*3r-emUGdTe?{~hON0l1F?A^1HTx`
ziunynowda@-evj&bAKyhXmUijJ^`Td)QT!_%MXTrw6Ea7UimRo;%V^`v-xu_=<wbo
z^#>&#xY^%Lv1Jlaghd<dF+7Uw+qaKT?n1>W`z(!5zJlOhG!+D91zy;_((Ze~BlrEt
zTUIz^Rz7{Q8Uk#DGW+Gij2pH#oj*#m1Io||VNF--xh~an-NLSi^s4QO#jK4;(&$|{
ze}0A2$-M6Qdb_u{lgvJ}xUR|ZplpDY%B*VXdru9uSD$_kPM)nf$zNPYGwhN;T6-O2
z1G80__DKMK${s*DHPmn-U)}RlAsDc0w*8AV`z|NwU$z<GKmcl60fmPE^qLO=w?=bD
zyqKOl$xyUVY&<SFp6k0_rNem$7F!`=tq?03RaIjVv#6E#(j>UWWD5zK{r&l6`l8I*
zmrwjH53EdVNHv$Cu1#>K3z6VXS?jETx+&G?KLcf*8c2-Jz_){%qLLQWa{m|*^?FBL
zN37kgiDvm5Yue_d-&<8~l_yPQ>6U^U;;`gke0RIC_&pK(tW1%VlRh8S=XW7C3D&H@
zh(;xJFK09g@voTEUcWWfVhUvCzIR-0)1U%vFcBgW4;4H})ahYt``f7d9hBl50r$~n
zog6<)@LVLkwk|OX83O1Jb*dE5gqoX)3$!od5*<b@@G(;&GQ|#GPQJ*Oij`q}(fImx
zNZ6$6PQ7QY3k7dU(?Y$)JV*Ia0oV7_V()w!LO0UtSXBp`8KY04(xBlYIeUvjz@_76
zr`)nH18j)9tIGSZqN4B&`N7)e-YYfo_YrUic^c5Wq0QS3zvH$U(md2dV_a<wI!qiP
z&@(8uDo;bqUdWp+OAXUs(K|*L&2>o`p#%)q?xX;iVmxO(3<2~D3ea_7%Ab)&Av5jN
zWf9p!D$7$yiy!X?NH?>zNPv-Fh>GLV;m%{aa&8;80Q%y^i=wf7?})yY-mC8^A@$H>
zvlz-m(?Zf5WFQCFgkA2Kv7JcZx|Fr1xW{|(sEGIt>=8&v@#Ie$*9R!YemMSKu;k0J
zTvyw5lz(Q4r)06&+;ivoC3!@7d5WfGmSTol4nR9W$F|5{wnp8|UN2qnc-Dpt55_O)
za6@KlimoNy@+kHxWQ&2L*e7@Ll-RpxJC|z}VlzIGX@4EK_XIafizLc$B2=cICF!xu
z2&hh>P);8#!hk3;1bpYG0Q#zJbe}$PMxK{4GrUS|D}t6!?^NKL-DEyC_y;;%jz1Kx
z_M2bi_{+0c>qWl$q3qMn9c;k~HzwTqQ+WBVi;!9w1rK&Uw<N-vyuyO|BdWIfG$I~1
zOOHUc_6K1h6MUc410wcUrm%UHy}24*>Q_GdKLhkl1DAN>o!jO4AbgtTx`*L<3>PgP
zqjXv-J?QT<s!*sFV7S=S&68<!F5C9=z@|A~Q%yHK`P#m>mSyyWExGO~X7lQI;ue$G
zJ9Tn^hB#q7Q6lwkUd9cH=*-*_p$UQ_d+SH=BI`pYIx|11cdI#&^Y*5k^h)%g=gupi
z)q#Z(2Ibrh9i5TdRfb#WbGMQ{)L`n*Gk4=Gqf|{%L5TJVk~*4s$qQ)?MB5N>^~ac1
zVzI9M+x0bl%e@9l5OD~>Y6J~t2Q=BZ9%m0YIWHQ)2S7$#^!oLB9<<Pu1TBWeyAYw#
zhrO$+$K9<pV7Qv@rXf_U3D6}k4Z;38p6k1pQKFjoy$?3ATr7wal&EVkVY1xabfQCZ
zH@H>bzQI6+X$a0(HY5N>`MgPpxLPj&gEXTT0ePw$fNs{$G>Q14d?yY{yeLwQ9g>|}
zas*mt9A+}tWGVPjI9;R;rtBnPcNJpc&})Ru;#CA%w9X#R%=PAbzgX1g5sUST<=Vc>
z(kt2c(Spl}S?NySUkIG`TXjCmd3}mh15mE|l*FB%6R*3iqZA%M&Hn-93Xixs3NX`q
zD<~>1v=e)|?!70L&Jd2iUB2SI>G-j+>E~MOCU!jmO2GS*P`oT+@@`GEEp#*fgs<w|
zkgZB4^YopxoQNt7!X+C8QM_~r2{dCVkYE2&RdJA{-t1=E?;$&pXOvhD46=5>E~9}2
zL)fKc{J5_fs%vqswmdoOZk@4n8;8`Slcp^yEucKR+Bs<ZdhN%M*_-N(aPfP=*hI%Y
z^t9Q4z@v3@6pj7M9i4ID(OAmr{a-<R*pO!~eA2uJ4(vh;x&h_Wrz&j&gVCTs#^B2q
zaI5M*R!^wadE53&e~7iJ&&PU!!>{R?8(89Mn+)ic$Bye&8o@eYnyUqLEsx<!ciRix
z-1;p<cPLAl039u;!+hyj4LnhIZScOJUhoTZR5lpY<~?H*AU!Yyok{?OX@FeY$s`Y4
zhH8c9P^D1&;Fxv~`ojQQUHr;#Zli1d=pdo!B|wQe0dC3_0YYB=dWCR>yO4-F@VIYU
z|E8hy1xTo?5x2sw7!9CJP*a2Wh|mlAf8Gln>3JG8Dr`?}y9Akqh#=_F9R<L74)&C!
z<5S4slktv^2KIb?vkM^D?{^=y&pGg%Wi_;8{zlvK>s#wE1n2-mYWzu9Xf$G;Vd>FC
zfYXxE5OQ;)zpp*pJyiVl4sqc=M+@XcfkrnfJ<$RUDLYeyi<y3)w`+6$vILLmmt#;J
z;<p_02{w8ZbI06K6%cd8@aJ5Ya%KqvNO=9DM`957nSanWH>t;M(zW~I*~A!?mwT&3
zY8$6ck})!v-3@?=;lM0G=UeEo??c^&jnmwHH^g<EOhVGu%vjoeL0;_r@GIZ(KUY*k
z_D8Ql5g{Y-XgkpddTOa5i<Dde`e?Z0@RKB&OxI_#WP3tNwP<sb-K;vqCr~(s$~&Oa
zHo4UdpiX%cyE`%1V>;T?=jU8!Ef8YSA_GqEJ7Phm)eaAKc%YZ|6hM2Nfc@Ot!vmt%
z(N|Q`cKj@%m!}V?TO#;dG{Mb<f=m9m9%vu$qE)dKcdd>dM@_MamCy}L5*E<7*+@0v
zw7TFE1Fpth0mHfwx8)^1jpN!il!{zA016FS7|IS)G}t{|%+mKZ3U=K=cA_}|y_?GQ
z-G?Y|XJ_XIN%dVe1ddt%m~rhX7&uF4|J7n2_d!lVM(#H(jfA_t$O?;^C0Hgg@x$<6
zi^z@{YIm>E!{3mmkNBC{RcBkkFm?n@76CuF6v;Z0>US(6V*55sx{x1HrQnoor9{z9
zAfr);)dohR9Xyz_2;=~FpEc@_C2|0GG~^oN7{PZRtk2nt0QOnIR4RRxPWccQ^VS|i
z{^&(mI_FJfE3>VHrHf$*G(#g=({zc0QFRIA(NDIkl@EvO!mB=2-6V>G+6D<~8=;D-
z`0*$@Wr=&Iwg9B78>}mfo4qiEkI;=Kfn3<t+*O(A=P-EvYUx0^?;SSrXEZtR_OKmC
z^HyZYc5`1(*y76iKBNI!FCU=E&!L-Ojq9um_wYMnQ~<i}ej>e^R-KL0&aH%TZJ74z
z9_2d_jXBNF^VM}{Hw3xmX55Ej^S%~AaY7@!Z#d$#{ClH3sL>qNp^3k*TN^jZu@elW
zfr7FVT0-sRVnsPH9Y_f*vcVA}fe>1IuUhaclYqHfhGy)l8wc1Y>F8zZ0RcMkK<?m|
zG_5BdYC>LV=I;9m)hKXRyL5gpSVE;@gky|RTou;saZ(Ky_4yXZh6wkeMn7t;6S7J{
zPzTi@>YZR-VpcO?boS86I~oN>u-4E^=H+qP(Q!h?4HoWN<z+u84JD(u6=n7beGe-w
zfR2qmXo_JN`8M+O8x>!l_sN=3>#)2$aZj9)o%p>|!6R52A0}#do6ps&oeZi*ivWeP
zm(JMfBoxHE@X^I_0oXJP;LKVs?WocKaxm!RML3X)=W3)Z9_D!Q#Wz8!>WLQ3i9mk&
zuFl?00~MFIv0G<kerRfFbi~KUm#hk3rFt2FI(#y#(+pl}eXu}p&jGA9Sz#WXp5ktb
z0Ytp3EgdAG6(NBwgpk?Jra$&PsN~r2irbd9+NLyuhMKvttoqq-9CGe4kmtLJ68{FO
z=<0N1R9we3iY5&NrCM*FjZ-7D$jHc#x+6a_rJG;BwuP>iRyJ1Fk>5e5!8suja0QbD
z?@r}A_bQt<e!3Z;l`8Qovvr5|^YX5$u}ggZ`nBPudHuY9#M!fFMaTimv0M+TH`1D0
zf9&#7tI4rk>*eRJS{u&~2~&SGCw+E|+FmiokXEnNZs!SC$$P<?tbv>$UgfrZPy^%^
z8JWfWoi2KpR^&jHLIjC83VdHF5d2xtVgsq<J8;^Elz1MU)b4o)MUIp3wN7aAaYPfp
z#5|gtHFdXZmEN7P&>V^qg|mc7kgz$r@YH0Qiftu+ovI}}QWEoyw|gQEy{lS+90}I>
z1i}k>IVB*&=gM-OSRaomIH|k%?BB0~y&`P0GL>SPLAc`D+^Mz@DrUdLa~0qLOTppw
zL6xJULs{v_i&1hlj!AX?YrFEDKh)@NdK$aEY<r>*N=#F)akDiM&5hSDhXOkzfP?Hn
z%l9Rw9?Ee_hPrktgT3?!_-j44_sdzq*VhRdSN}X+C+~Ge{NBK4H!~0O=9(JyoKup-
zxg|K-x8~fJ3Jw^WUWoF-Fj4SykYjZkbqt}jE*5;duAMg=7#YSQh7Y;rw_5H00Sx=^
zx8GhQn?(ibda;Sc&I<v*uAr=|ldNkOY$1H0#^{I{v|EB$Q2`WNcR{APBakqi=4;~W
z(5KjR!30E$#NCeiLM#8}zK$Gd4g+R{_toYLb6;;dqCB+J`)GQqF^-t!S>+uJlP*V7
z;~G$z8^V!VC*L)6)wVydtE$QB%$bjnM%wDDs+fd@SLJHEJoL_K{_g6~*ZLso%oUCe
zMi;U>W^s@L#eXk?-CDii8hwdHrRNmCj{LJI3}7AK{^&^0gJ|t*-0xbOQK6N47L<~h
zs=zhz5k<`Bo>w0obpv(qg6y!BAZ7gsJTG@PHa26L7U&;~$#U(c(q-Fc1!M$y8V7ux
z2qL88DNgg`v!f&E4WX6ZMoeWyNPg=3*yEuG>g4J_4{zgSLZu={sWeW|Lh_Q@n5-22
zQwj2$zRCl`lBuh|a`nx<EEfmU!*w3Z&G>6{ul5A^N7&3>ZJtm8T-al9Euvr*2Sdv8
znk{d^^|vez4h}>}Oap%A>`25Vt(m}#_BRc<$D2dCBVWAMR&)Djt72!_EcBL8ii(Q)
zb9tYJ94T>ItF>u0*^XhmK8uT~pXNLD>%-nh@Vl@6_`A?a@jTLq-$%`L+lOCGJ^9$u
zKC9O4=jU=k$RFQHJ<t_+T1l=M_a{bQA<SlTXW{o^BJPgL=KYbI)20arbyqZYcL61$
z4ZTEj6?3y3p&k45d7BG>+{5b(^ibV`wzCWbz50@B`WiVjUdeLs#tI$IR6)j(AFN^<
zx~a?8;Jk~$R9esNr;V0Bd^mR>B<7%S_OI~BbY^AfSrSUzeTLvDUM$Eg+Uxr;O5Pqn
zcW*&4`}>Qw0^RG-_!k33V-m<ZJO><$K|Ro;<?36mUTpv>32Of%bTTug_p=NN=UdBg
zxMyIBib{>3;&b|<Nk~k_jcM4@CBSK<`-^uuXE0f@?0vwAXY;kc)hpqFAvZ0_o9qd7
zErO3v`L#;uv0NJE55~WrANVP^Z+K6@Z+nFwBJZz6EK>WIe33zc`exim9zhu)6Twr)
z?!#}I20H3$?dNA!ZWNBvHFH#rz8?9zv)=o%xobGne@$a?TlUqT_jqf61EHa5r|_jV
zIsnH~d#}EqDUptx<FKK8Y(1}FSKe@#LproGY{a_rk+#3bc?PCv=n&sQ9Gxe1#NMS%
zc0X7vx8gR?gJt%LuVn~&bQ+>tgHnO3gM)|QHI)Kzx((j_`&Tewg0{Yq(&oA9WzS}4
zT4GsvHlXZb0PQy_A7_p9l|%cP5|F}IuU;KKm~tURrP@Ai(U{|@bKaN5p$LwyDn{OY
z`{;*swID6^5hMhd4#1CKK8vZ_0*GIu7X2+9%5(}r_J>gdtSb1*qq6V^rf(cNjD!>6
z??%(mww_4Iy|OZ}HX-*>O1tU$_1E!UA;6`EM*$*5QqEvk|A6DjI7B5=kZTeG%V1x6
zF)P!@w!fuOrrL>PS6{>yV52R5ngbi`!0FS1jIn&=Q+76FQ#0UWXY9%e!QHqX82l}a
zg{m#)A-=(;RzOV#nWZRD-Rntb&KvYdmg`Diz&22Mi1g@K7)r%^sUK`41q^FxnCsGc
z2t5gU_S7raEgz(I=(P7BR2{`VXq&FNX#)P6-Ox~at@-2D@S&vEubtF$0N&HMrsMI7
zqk+67lk1<Exg&wb^}SNX6_Q1r*R?BZ{m{m1LA7RfP%s?6sZ7ZXoH3Efo2xm+eAbok
zeKL=fnYPrk@SX3(bK;>IPy^e<e3C=}n^ZSL*a5|iug1*2P+`slgkIXNd|pPaTrX*r
ze-*D#f5}QLkjE*wG!!$n&4YXdY&LYoq(Od6saOw9UQy=GlZfR*;LR)M_48_NY>tb~
z<GRb)UZ!v3e{KFzZdC@7=s4sBkR7IePpk{NmOT#ZoEFIm5#^3>G&wTRJW^G06Bt3Z
z?n0Gg_qRj<x>B@g33=ht8b4gyZ8708c~CqQ({_8mM8o)?%bd>7<LcC=w2@#s<hr1A
z8rC4~&VgM#hMd_{FFj`(8m8(<H=ovp*4Uml$q&oz|Az2zj{^IA5_AkYrkfO-fCJ7!
z?Wwk#g-#JqbW*|d={#^T{$e7myuG~vbH|13<K=yNf){q$DUyPSW~;Kgo8pzpw-q<I
z5Mk}>V?rgKJ#Le6->&}!W}?HOS~NU}^Pcq;za(2sCra(;0?W{I!p*%Vpj3t}>g~G`
zjUA4wl-aF68gmWxbBh}_)M<t6eRU<b;jAJ*_|{zzw<yS=J9T=YR<l!GV{>vh)F5Kv
zJN>X_R}^D&e$}FvRMDj7N}r>BjsAi`P?+mp!~>3X9vZztDiG^tp5TMp=cLskrTT`Q
z6`?m-uAaz6=9em5%z}_6@<g0%vnDH_2*jT)nT77LrWB$2JG2O723=75B*Zb`T>?*a
z0Gg!+e=kO8o-{(gyF0kK`uElCs@+93zn($!Tusa)1yF0;cl^PyzO?6Yngegx4mU+}
zF?h-{9}c!@*!sm=^j&Tvv`s*U^`aud(eN0n_>00~%#FbGnmu(jXJpO{(RK$^PeGIU
zT6=!FH|dFj%o*qA0?VVPdwQ@yd*tpmg`HC6du;Hy%a>oIvumM4JF81PTVKGOiRR-Y
zy%cHb34hcLdkeM4>LMco^lwahmw$$jHeb4a{YCW|nTFSAWGZN*U!>gAG_KVOZ3xtD
zZZE=A>=;J~Or60w;BNtDksl{;Fxr4)kHq`}O~ePcYF30b?(Gfun0z32lE*KPC1klq
zX#9{pE&DAb-))i!K-I2(etukiY5MjBvrjUrYx*ac&gpg+czDNU`Cc&Dz9_pQP$=09
zxvn&3vC00=pSPI#`0J;gU4y)S<QIj14b-S>4-dK%nR0?HTVKhE$McTrxXX{_m(xNM
zhm=PgC?vci85AqH$v`g|LB$vzMwlmr4Nt$fv$qd8@g_1toXE=Yd}TY%$fX0?`a+$J
z`O6A#u^tZA|9-wp+Z5H>Hws+cAnG%OpYMVWo63vwkrD;Hb%>$n1ECOxF#K6=!<l5N
zDq=buS;yjxzI7ysM81kTcZ9J8N_jj0{mV&Yq);dY?^ezI*GrOUWD0-8&k($Q2K^XK
z6boBhTN}OlD?)Bm1fHql{o?g}6Rss22l$LM9C<pWk2<$-iFnrF?S{2U`PB0IR{Ys;
zKG_GSBstX0)!q|(T~)Co`aiyWIFL84T>||lgYN8x%FWZ;-<W+Mf4?SCbh!9jlvMg4
zD>CD6=T<!kg#;c%ke~k8m$IWXFAR)xN>0zu&!=UOjyx3-`s6rESU}$T9!!D!r|oMT
z8+68vg*dWBpG2B-G`zAnEI%<sU%n+e&EyQBvIvBtwNiN&$=5WW)%KTPl-KNAZeT~0
ztLa6d0YEIhqwL&a4HBqI0mwq)aqt<7@o&ge8ohJxr~1asq#gsqsjdXT&PIUKj|U`l
z<ekaCMN%XZwlt~+uPOhm=GK8L!mjHHkCNB6+f}hd{MkRLTX`K<&Oyh-QDl{5X8>XU
znR5l>+6lB}Zj&qP;X7|s?KHEt(IaceVbPVCNsXtF5|%c!HrAOjkY34}3i(VTjmNnL
zgAA(mrI!N_Ae<uD+uJjp{KDOL94s;fuTyGRqFU;BuuR8#FzY9dErnJb2Yp$6J%#Sq
zxj#TM5JyT#NEl@t6PZ}#x##TGc}4Xq{E|ng{fNJ_^Vrh$?x6{SF{+hVVf^~*RYZGZ
z`ms9)Cnqcz1Af`A!D|<wCDxYs6>;W6fW-4ce2w?v%7eu*`z<8*0u~hVUlBm(8Ol!C
z|NTJy=~RxRcTY*Cs<K}m2pDdEfj$}(V#pZn-t&;Z0P=+L;=g~dhjRuxRtAk7Q^ke@
zV&~W?trz3R$T{<<PDf~B_Gfm5IM3E7@h^aH32Im~^*Zs8!OX9zM}LJLe^gt0UQ0`>
zi$Ks(w0UZAbp6LqS?iMUj^&0?JRW~k*l}<r{zu;|A3Fkq*`#y?7nbQ+{%>Qn{W7Vq
z;6}W!Ud{a(;>d(_PTWwV@u1+Fp<d&fKZVZfnrJ$Bn3>(MyTAatgmW*w{5#&$)8i#R
z0jX0#aQ&S!teW8_10N5MoHk+_?W?^lce%cAo0NALB~INEy*Sj@x3qFM^;CJ&okR;c
z{^z1eWv~X4>j{J`nikOW<P<Nm&$Jrtvl9WlodH19RAKI`0R}kzOK(xyh}qO+-Lv@f
zQIuqDe{=7|jRM10Azt3zyui2F?7-YtQLBkPB3cybwqvE3T@Ot+W`N*!bIa#!Ibc-b
zIvE9d9|qV24=dTkcx8*F_MW|&*dWSmr=z3e&Axc&T=}`DHxnaKs07++CN8>PcU}0V
zo;$q$ZF{GYn-}p1-<Ou89z|!!-AC`%^z4jGxa!wyt@!y`lq7hRmw++r5-bxXfG}rw
z<?)2>p9YipI&yo%i^l9adQH9X37<gxQWWy=MY9SbP}@H>vAiza?tAn!%E@I?7WJpB
ze`CQxaZMKagr8qdnkFHu3}-~e-6oxA{~iPKYj@b-K$oDl%x08mK>PP)KLL_uK7p2&
zmcBv1-6^X)s3*5XPXz=9deb58zSrC!AGU~GM4{?l;V9p=Qvo@*sNGW>?@~j5Z0r^8
zK{ZBKB33&F`vAKxhpZkd@<c9pJkS2Iye<v6rV~=>XCYHPY?RoQIBn=Ayw8Xk;cr!L
z;!SSbx~3@rGV}o%92bwa5l4B91V0d&kYESd01IPdW8Kb-FMSaZPh6M>cdL^245#Qv
zyEVDup82`Ca7lu_dZtMpa1`bDhdPOWlCdq=Ma%OVG`e-?x*tFKu$MTcw!AA*RB0mX
zE?2zDV|4Axq!Ixa=65(Vv>@ZRz@xPeH<G#t+pRJ1r0I+jXEUr0)YR2g(i#HVTU~a7
zT-&eqB!kXwwpp%tA=}E4cFY>&n;>8Mjbzoitk=7F?r1^t;*)fX+ki!?82I?{dI{He
zQ<HK(U=YMmRy%;WLuL68auiqVEm~v^zXUzH+5gAVm4HLJx9`_J_L-EFox()+B0Ei~
zX=7S2k}X>Z*>`C$m1r5ukiDs-p{!X#sZ>UYMzWSHWzCZ8|7Xtkzpn4PI$tNJnfLuI
z&vQTbBGB|tDu%+$h(jA`jqz}E8*Q+RB_;pJP>*K=jf+N{I7mXbY0O_EPD}v(%MQ&s
zHgcufGymX2_bfjNx9gNSEqq~Hb#eHq_m7CK^>O6mgG;9-e*gX^VF-M|BFaiO;ga{+
zvtMT5DsEp|7X%J7Z)1dO)H!_hNza!gs@s+hV+vvHC^lI(ze;mn8|xB{=Cp^E-|gTv
zqH%X*5k~K$p#vC6Ny%jPT!3?H(D}RXw`HSWUmUfy>t1Jt&nb{z#F2L*0%*%e%oROa
zR~9socG$&CSZ&UTJ8P@2ZY;6Y?WO3O;yCJOqVvki=9$~`(3sczx=WwtBp5t)8pWEC
zPne=3DhdkZMd*sobvNN`DSPtdcMGl@=jn~e$nESRMr-A?sd2^JJE@1Q1Pj4I4r_DV
z6r$=fdPx>XXRdtu{{6fEBQQ)gP*?Zm&^pB!xiVu)b+QNdM3Lm?G&bwZmJwAL18c#U
z;1LPET>}jFurz`6Wuof_z{OXA`_ASo76TKh{u`PudMWt+qqw#c_jUi&dF|IX_@rB(
zhraa(QaG%(bH3V%b+PnZkDDm2op$R8TfWq3{VH0r>+@%`Z8rnCww;+h{Ho}8(zeTt
z0AS`5RYYqUa5TbuD**y4xqVL58>jFe`G$kd!NDO0yb>&Tla8?K?ox4M|GJ0t4-9pS
zD>n9GA~VTO&#fnm0LoW?dRh#0H9$!(XNK*?*m35jkQIP)QRLk#gt*fc(U!5)20n-D
zgiF<EIb$$ryh)v)Q8rr`X-c%>ZesLxa`s)qg>l_awy%Ri!0~LbN@c={zIYH9Ad9gR
zXxwVncNeaUnaRn?P9n?=vJZXuy|gHUD&~RBUJuSF#B%0D`f?M#@EG~AgV?)8*uE6F
zi6JC#hhn}la5o)BeUKM1)Myn_h#Q(yhjjh@VV`kM1n`vs`0;5OIsV2H>hexGB4Eq&
zC4jb?Xdg$w0_QC_#AzVfXiN65Qm3~O2k$W^5feMRtlhLV4b02ap6il`w9Dw`?)-x5
z<DV{S9@vYDZP1uMjk}1YMS%$B3o9?V79>}9sc!1?-Ra8(_`-eQ+h*>$-t%6rg%OAg
z;M1}{i4!M}&lH~7(^!m=RIqasdzXjgzwlI__al5P{4N_OJmii<fZ|#idBeDQP39}>
zGagZ@t$83ntdB5Be1l&edOW;7zQwC*4fr#4XHkAiF`}R$paVVU!g&?ZXggQOY>$l5
z2-giQEn&8Qnp*a7`hjYbuJKO&w=ftDOKCu>+<Sf8j&Z+(xEVu!qSC^$?hl8P5Q>MB
z_)s3L8IGYX$c*!-J;=-1T1q!+pk%o2*dQdAU(obVx3Ho<kqU%iKeSe~qE|3ij5KLP
zzk+H1g}7<wX$ZAaC~*Rdz@5MIVB8!EF}B3p@ebJ$KH7`ip;u(@oZGOF#hIZrxL^R>
zD@s4MnlN9_4USc-c&rG%P#Q@W91@cIrU{iJ7G~=w@XMEJT{9KTR@P+b$4h8=s^CVB
zCcwu99iaYkFqgnc;&H|<qa_^aINV_3yYl<h&>+@vBeXL-nB8o3Zlpgr9`X1)qGl>k
zZW`i~?jn_7MM(GvpL0i6R#qGG;+^&h_Gbjo^$O4l!-mvAnt+MS)!xW3hP@77>Nw7r
z4y=tGZj-?#*5E#Z%ks$Bf!MM|oJ9TMr7zmSYX$|2Pf$RB*EX{V9uu_~#q?!Q7=|>d
zKg44vsLSoo@HQ%<KC=05kzyt>hj-{E<Gl8X`4WI3b`%fRt_xlN;YFjQ0ihv@@Y@IZ
zBsli%45&zd=)zGl8lLdR%ke!oNJ#g!loBa~WR3Y|>he6o(wTOHkN5>7WaZZ*LByQ&
zads(vdB5w1fmX?lw@#1XylF7bY~^O0S3fbotJzPKy%9|NompuOtgVnFn-88Kz$P*h
zy&0KI4M!rjHum5PQ^3JxXJs2>?FFc+>5H|912}OhAW+;L?bIGrC4J3kbxn{DUhDt!
zdohX0JlD!tfDGEdvPi-ux{vt>=hzk}zry8;l*IB_zxKX96>9Ylz6+*Y+v@UWpS*}u
zrjhZZN7^c<P62VqXY0+kBh}}p?+5642LuPtJmYm7l|iu|!s)-D;IS2Z&Yt6pkwKNC
zU$+x|I*ASP<v(Ro@auN?P~#YXw)3E@iRjec1VpKi(lYYt#&7USt~!d9#vNVOl}EAP
zx_f9z2~jM8x@JG}xTq-e31yD#o<X>D+0AW?h@|TWU$zPiT-<~BaQU`DzPu3otY6!_
zX7NP5@g+C-%F$T{p>v0u)QyCP1|p0$!Q-WpZQRGlr-2^<uGAxrf9IcDuYt03MtS1z
zE#SRm(kMCHzAexRxN_)Hs3k2USFGY(HXvyha$*b8|6YmWqwLpQg*@73#!GOl@DB?M
zTQQUJx<lA7LET}W)jm{c&n6cC3gJd5%?=#M>la?U2#ClHOt2|TqFUS7ycOwCDRg7r
z4?URRwelQ5l4jVsd@*}T|C*niEn>!%N1n!3WRsJCUPPVk*9VRGv~0c_Fd1l2TYAWS
zgWC2!+)Xr?lyM{HyCqLB(;Y^8$>Yl4;etHd6Ty5;3DZn#S%$E&4-7Ymv-N;!gsnt#
zk3C9585Jw-Qr2_zS)GC$6i}n{%g36Yq``<Qm`_%e6+HhLKEeuxu&GQMKa1ZNfB7lm
z+u+^%kTSObI`<i9eFM>!z>)vBwB7(eeDn2{hEp^Gk4T4pGs@h={Z|LRaAs$`UjUj@
zar8=cZIfS}J*opJ104SnD09kYs8@_f<?!DiEshZiDU~V{nb4$$Akm#f;f#kLOwmuF
z7T*;4!>F9<0V*j3%VOXwW19Ug3op-xK=WqYq#2}p>HsCJjV*@on*;u(kE|W=L)Q@n
zl<bYX$*m~_KH7`LD<P(6CD(I~h6m#vm1H?r>!SmH2ExJKOrw;=CnTf=1O(uw6Ix*G
zmI0F)p0@duoU_|oN{!rYQYECMjEr;I2Dhfxe)7Bj)FUHd4=u>|OY)C=eJHzubLWrK
z)>=948TpX8qAI7CNFC&t5&1h}&^BNB_wU~UD_h&zXNl58>|%^ZhD?6;d-lt{m7->6
zJn1<S5)uYReD=@1!=dwK3F4QL>35g=p2?>LHK}ijca(uw1JA4>UV3mu_tPMa!iQ8<
zRc*HV-M@hJ0wdQ-S9KA-7Rhf6>PJJk$F1AuqcWfd5u6Bx4OMXzTT7$ZbI!hkIv#q#
z;X7PN*SBv^V3O%N+WOY%Pc1yHW8dADzE!T9!M&e1vw9Snc#Q`4>sz644(FMFeq_*A
zYnap4p#S6ra3$NIsm@~bu@9Z=)TUB-$dCCN<6xJcLyqj)5{#0)&`y-*AJX|AaUg+u
zihZ_(S43glcXD7j^n$vs?!S8gy`5AMy}3O+yK4I9y;D(E)GNLX!@4{u*?QgZzmqwz
z10vmE-k64j7{}1SO*Z%UuU}Uk#oQ94ERDHhy!P8#s+y7JuSPG`4jQsK{H&!XHs6Pi
zTYIB~@6NV0tK0C;J)-%5jyxU`ylQo*nn@JV62@cU5{*8iA}Y<JZhYs+{j65k66wfG
zt&Cly+Xc>Y=EiA+OUORPT5?iSl6mK^fCvW%6TsIKKu%Z2h_L>;@zj?iwG32Y`7fBn
z)7a-73UYc1Pe4|aLMVdjw02l`6m07k;swRo=@qn!Pr*S!#o&AL4h%Gx!D9Cp_7{ql
zSj&1hSlaj1jfd@lwRlus#Gv$N;*v;5rrB<<7^)!U-9ZElnE+wZM8!7C?@S@6&?J~d
zALKT;vh<a}W`(?F9)Tunr{2E`aBb@8>vzMYRL<ru-n#0m^%SJoN!lm;Z;XXjEiNo9
zz-zJrhrZ4pufJ)C+-^gHTnqiQv#Wt{zXC5Jbl~T0#qJXOO*fz>L9n|OZebqQX%cAp
z4Pqkv{maf*U)iluW{N|_I>_O9KS68t07_pOlq-0ZH$9*{pv;vsJ@>Zg4b0ayu^9+9
zekOuet(ya_m=$oh+N-D3uA1aC6N64(sc%T3wsH6ZKYNuuq=dQRh77H42*RV-B8O-D
z$D@_Ai-c&E>?|lY-UqGz#zqv2==Z87a6$?wogK5Yvrj>0_pqTMT2;%3fIk7!9CLnI
zPRufKLKQA7sFBSONrr?K{wPwFw^az815KMB6rRF-vIDIQo`Q?s64#}npxcvmvRgnv
zKw=x`s{+8YHu>xp;wEYgk-x8kJlA<m(dDOr_IToqD;PnC!H-uV|F|)dLX`dWW+(!F
z9fQErJb|+F(7!&eBKt-KNe;`_0rh?E&%K&=Et1F=sa*d~5GTA-UFeX~mI^jy`^$PJ
zJ1f1%NN9iy<x}^_eS>1Lt%AArqxHfj9SW0Ps79Wgdupu#sQ|RC93k&2rxavK?Yl!5
z3?zwTcDrko51Nzc`LYHk+D2=$O@H9km?EA?or{E@ESPWo<BwU=ODbys0t&i=2U(MB
zw5Kk6QG`;pV|29U<qZuDA(Zinh3j=7O~<W2Gt2(<o+Fkz69Nv{tFXcaW4>=}Y&>e(
zhvglbHnebJLkJ&vA_iyD2pd57Kb639UL26<-FvhE%h~BF`n^udFzE1+iRb5?{>`ue
zQL!{SKs(9ay~%9pW4cMy4;LdQzx7kuK#0H|<HKQc@L<z@8Ps2SInY3nF0VOXh~_~|
z(GpV0&5EJfOYLHw-wz|rx=GFpfB!xKiunt|6XUd&ekpnjJUglJnVCTx&i`PXH+WVU
zA_HT(pQ`M-C5e!lBS7oAPMnxLC~UZJ9{vsqsKLUrgAYAk*zqes4}We+5j$cFi2h%@
zmtl)xy_IQj=|t^G(c6{Tdf8Xv(K*k^otVAQb_x&E-acx;n84^d00L^SJoXhqHoi6+
zo$KuF4If(Uw%?pBI^n>j#>*aKv^rU~#N#W9S$6?=JUMTRs3oi3F=f>|{Ia@z$HS3~
z3TCs2WwMJ+H-K5o9fgZhU1d%2Z`B3j)Pr`$Kq$mbaNkUwo}T`Def)qdi8qFX?yO)Q
z$E876OkEC=BXSR&lzoFi?JXnVC9`XS*c`e8&%)Uo@2HLeI_=@~T}t;pC=D*jM`=P6
zHpcECr<X&XMtn1wVN^%4;DmF}cG9}Ey#_-L*?0hX_~1_C8+T)af&aWiYmmdC7@eO=
zUE<1x3Pvclai75OF?iJy%^pxt+4I`ruWC3=R4_#>zx8d3$Ba);3z=;nkz9GEm=3cn
zA>ME^sfv~QoNZ?3b1N<k0QwA8AuiW(KN?HD-gi9Aw!E@#K%w#@0{|kdn~{5)q6QD)
z#;~-2BRc6lbCC^VoUdGwI@WpM5+?NvV&ZOsOj=oMQ?e0M=6c6aez#q0?je2Bso}>x
z4be5#S}~_%WyBmtc|QJ@bLGZ(w_MbGVxjaHT0np&_+%Y26d=y4aL?o*223Un;)2!Z
zrx+26F>UU2D)o@H!f5CPK!e@BKFon@;NO7`-RE>5kI5n27{l)V{wdhRe(5TEclu|Y
zd?YA$7YQrtc?wtJp1Uq`b7r)~#%FcELV+k4!im7WUDo53TM?yK{)P=n;IU~;(zLy#
zt^zKtNVdVx+XpLMHFs117h37^QmC9+2)d#fwRZ;iUYs$or!l)VGn*N^Xlq)Sy`4lg
z`Ft0!<%xSBfu8&NnP}X?u+^j{W@x(LF^C6U+5#_2P-$kzfF#pDo*DKHjB%YA5^keH
zv@T8AH+_IWOf@*Xilrh#3i-C`@9y7xr(Sw7A@VK}`br|Q&~^IMa*x-3nf$#VJ^#==
zjSlN^fUx*vEY0XO13Xm4N$5~WoWd*IbCbQ_3!}M+eu=Eddsk`|Q0#M&n}zUbYiet+
zffD$3#BVMO$(wI~Sat^;vZctV05;^*8<b6*NhP?Fl|*X1JH>dE<!=+1@jM#aaT9^%
zqFXxt;IzMXck8@-^hnXfLp6Zi;?C2AwMlN7CQl}rywRrJsw2`Nf&2{325ADD894{M
zy}NLfzWN-&)kjT%LJR|e7{Ml80b1aYo?I+tF7o@P50rntvTsIehg-!Z`o4YByPK%S
zCoLu>rVE~1W1m<)fP0DM?(BOEB2LKG+_1nO@B#JjAdfE^nZ0=`kqDdf%xuP+qWts6
zuvDrual#F5XlJ9G!J*Ir9%{9_4f8XA>emhyoe!{|96$aJkvVK<Eb{gUzpCw90HDid
zZ|wgh;GlFSsRV6yUnrMK{v?y%d41d)7jV*gaJs%L*kTWjq8|~C?%>Zm`};6x?9Ir+
zDA@s?q2u&LeI%lBY5jy_k7Ti*(`dc=!zFGxJxLRY&5Oi!B@!mbj)HJCnWGV^>2Khf
zkP$Ih!ZGU)*UTUg>WszHd`HJDKHfG6?8>SfvHCd){n2ADmHgmwNJ1}1-n8sL>I8h|
zWFRe`YnvBx9&Mrafa^;O;iD((HaXm3=D5y*+v+?Ttu?>H#rZSb64I_wie{b$7!SD{
zePr{C@`>IOR>eLq7tigetUizT0Q0`RXYi6xot03o2qFQ2f#5Vn#|3<3t->>W{MMa4
zJ<B21n<%JNrd%wiLbHMFdlXA0!*@NX^x^BT4r@HN4HY}I%eCInNey!dKOr?^2DNk~
z(!@AFqMOw7?Hiw06*{q4`J=PCW>Ci~SmNpr>~kL&2p0qlVX&m|$&oF$6fs;33EPIK
zNP*p43Sm-TMpDv}-T9(#cHG#lb<+ZKOY@w0g7wSqvR}<fXn6x}Up=jcYh+daqITrT
ziOxih+^bjF;NBH=j6FbN&iq+fID+QnKwKdJsGiGY3TlWc4i1h}N3eUbBj53bVNL3n
z07i9w->E@Q8Ce(Hb`0HteEcUFrct*GkmJnC%l%=bu}~kEQI@MO3}FPJu$D(0GF;z8
zzt+9MuT^9rRj}IIB8z|@za<;3H9%MG-IHUa%isNvch>Eo?TX9!8yT&Nk=&NlJzcYv
zG_g4Idd>~!na5n&MeEuD{41~`IEu*R*K7QK_OX^{=z^=N`aF;2-0^?D&#n6yj2276
z{cF#P$Dh>SIncylLr9K-YmgvcLcoudGjjwcjPy~lZm>_+A6x(aE0%U4%;QZ_c&yC7
z0?OPf;84hA50B6<m-iPAy_MA?eI_;>K(RwBZh%a_GAQ|PJYwhI^Y8VRq~Rk#ce{>r
zvIOAP9)R2G!opu))tfF|#OAgK-iGDrgm9NLe}xz%egEz#jFdCAXp{#P*#aig;giq%
z`uhbbPn%cO{kN*sp2Z){9@_zpM9$`v(4mipn7{<SFdt~lBEx3~-WxuFYDBo;;@SDR
z<u$|Mmm)R21oyxwbmJz#E~|Pmy)?>L7q~MF*g3_T{E8YTS3ZK}CX>GeMq)m!X_UES
zAmtmd066K3o9gqRIX1#X$<9G94&MJ_(=#(_xdB;QmzI{q5dcR1n6#88LD{+w0nh>b
z(1|c|$OS0a4@qNx(FI~gz_%UHoXs3B3<;$IO%~v{0*6ZoA5CltNRBU^C8R8S(iX;j
zJXMdO_bZ(57DP-uBR${G1aIkxK(b&IDPADZL7Z46p=WYH&8Say7uDLl^mK)UE|}*a
z`})rW2L}uHR2m+^t%A*dpY(@$rODrVId)eMZtwmc`M1aIbO_?WKHKEg4cPBXb5uuK
ztLqF%DQ}ZU!RcC`+1Ys-7_85s(^-gY*e`k$6XRyKf<1Hb@4~l2m^vh`Xyb5YP0P9z
zJS{dmTZ&#WFsOY347PYoL``H>d{X}$)bfv|=2b||s}8?En?cqiq50Dfz+R|Sw))%}
z@A&ntlOJD<V#Ht-Oe}MUb<OeE=HLEZqTrqIp>k>!Qp?z_Z+$*%n~5}5PDR7PR!reb
zU;YK;HzPI&t3|H7``*D^VlLH^ZKoZBb;onBJ%KDY-8$fCd>0ho-^V`$qWM2|vTuyz
z&^e$0eFrDgkH*FrlV9KTSbNma&{8i3vtcYtlA$jeAcjf9XG-iF26%GQ0qYoZYt1+t
zV3!u8GlrO8_YJBG0G>8eGo97p4;f@~0m;&8ztWg1%ePa16;CA9UTC|2K<ffnX++&7
z3USAPDLXhA0sl%89%84zF(#`T(p0Jt-EEB}uM-Dn4SYa4s3@l=w@`k^v%5G&NfPz)
zIu*u=&1?=$@q$et-J21_Ef_ZYB^|;h{c8ixW>nr5ow_md#f_SY;&8skyI|!ykp_Rx
zM+kx8{5JI;T(a<Mu(JQQIz94q6^!X-u3fv942$;AV0g;4hyUM(YT3Tvi!Pt2;fv|$
z=?V1*Xz9L-P0(}eI=1gl24IL>fiGlpHIhO~dnUmhEdxuk-b%FAhFVXMUU3RH1ICEu
zMa4BA&9TaVdvF0_m_U+uEv$5|CiRm?cWp60#JT(4hZ?xmRzZ@?FZO)TtuFhdegk17
zx1^+`b!i>C5XIig{;erg9iIVHK(km5iH<$thp;1gkX9TW2(>1@kSB$33RJyn(K^)Q
zCxJeGp|{dl5P^|o^h{%8V<)g+ce$3sn7NZ!!qx~6-BLm`ZC!LZBI+7I9<n4B1pf_+
zEEmlk&}3DS(B10ujMBMRV4UL^pE;g@NPx{&l69q*4a@vrL-tK`99l!Qe?2j9g4wga
zzAg?R$}fF^7X;68<{_jlE>e~B{W)v{ahUwIFsj7k{VtBb+i3~{E%+`ay1yS6Fvx8Z
z3N<&zy`Vjw881kVasxAV?TGzM%L5!}Xt7Q~b;UVrjAS4Iq?{d)!Xt@WkibL=(n9B~
z999br@E-?HX1dCKK7Zr1jzuYD0Oo?O3xGd7xeo))DA(Q~SD3=zYg!7~zF267wPmb9
zbD@oFH}5|31w^5(rB7|sm-iyM6&uf8Y!X-#oK6_wpL;xBMw#PhOltTGAtW>##)Ed|
zM5s6>awH%zo5PZN#8TiT$CC$?F}<YIk{866EamhpJtc8#?ZnL!o|5Q}USu4^nOosS
zW|Kdi!wZ_Hj&x{~RO=l^GY@X5KW}AKWsifl%dNLE>lD0t($tzIiVZum3V6=+@83J2
zKUU16yozKj3&cn^Ygm-xN)TT@e75{C`IYNR$|PM|d?-LvR(DEm_CFMWrjM+{LvqRg
z+vVOC^DKF|<BSlO$)TRttf-t;SWssj&2WebK&tYlXaV-wu<-DLTbCOd_bl{$Pj?U#
z)bn;=)@?imW#1?Qvjj5CB(K<Y1Mv4qJYM4_)rY?+7&7b+egu2XHWsXp+i;h=?tYtm
z#52-&K?R1WAg?g}!0(X*ZyA>m-S}Q1>v-qntU(EUNHh4sJu3#V6g}PDUx4^g4Qbq1
zosnL2d=$EszMXoU8+td(d|Ja6%f+bGsU>;W=`Tcc(<vtaUo#^HqfJnLrqKB9jNxli
z719tGj-Z`^)D$n?RXo^sSm^Dl5ke@0W5HUNw<QW+0`d)ucf(<I-tVo@pglk>HTl*v
ziw?+((F{+im*3;XFBc|S{Wo!Ig2FPP=QTwBQD!k5tlI-^w$?RY=Lzu3$qMh)ZU`4h
z0w~qd^#bq+c)<Yoio}?j8F`h>>ooo-ebLC#@FC?h=d3|Y4hcVQ3`0VK>og3*_z|<W
zb6eyxyu}Wu!H5tfKRVFj9L6Q&Qif1OPfdY?n)5<84x>3QipAqT#MT~c5NJ|Ijw3PV
zQlS@>F_BvuGr<7oYh~okVcqCwDxL>0yB|=L3qo+nDVX22U*(bd2R_wl!BF9C=}2G$
zHxL7m8_^+P2`o~1$nI>Iz&P&>@kSUj_kssON9B|<{L-(Uc#6x^mo`x|@yuE74yMXM
z_RXfod?m!dRt@V0_f)P2cWN8&;Cv<RU)|S$$n?dW64HvhMh1(_`@3iiutZ`B$hR@p
zPPWbOXHVxf;WT{)R}#27sZP$rGTtZv(>`Eozt+EPira(%J$B?4SYv7eS_AI28uUeH
z(Ef2lAO8qoZaBDF;?Of9W>2qA4{}>5lhPkhc3#I=;a@5P8(m9a_+aDveMZAq$?hI1
zqDAugmt5<);7ENcY_hPlG=>;JxIq8oil`Sr5#y;$*nvFO5IC4xk$l@;gzP>y>w7fe
zPh<nlTBR5okSoo8-z1uCe(QdMYfM@`KO3&UzveSXvBL!u92VYU@e=fixN;?=99qDl
z6vEOQr{_M1J6w0Cz=}+o^VL1#ggxoXm6Wm29&oD(HINF1)9ox|eJIkrgkp!x9oY?X
z17t)*%<6bq&dyt_JDSa?I!!AiM=@@#Q%V!HE@JUr#A66l);DBO*`T}EM5b=ty0wJv
z*iD=ekCka>tf3I7R?mmrUeJL4?h<Sg!A9_I*EyjjRh?kIXs-RDxClgRxajCjL!i9)
zh`l=i(T4z~oP~FO2w$z8NbT?Y{8{eC+aLA@Z4>0TPWIeGfGEMxO<&6x<?tv}>Q!LB
zQs%-S+xrlMdYOQ+<UVPZX2=5U+flNqX)iBPI$Idxk%K@NU%m>5g+AC{*ir}=R7CF~
zUP$_WZ(_i0ha*^M!6eO;4qqcHBwQDk&)yVm1nbNhSl~oB#{(qXQqWF9F+OoijXaFC
z2Ob%Pta}W+q=6s+63pG0x37&#_+xY5swav7_6fG1``|Gu(dsT>Q(()jMCoPiH+#DV
z&X5D~vzKZu=T-Sys?|`jiVrBpu=4-|0=-&Y7P)>bbYKrC3sdp5dh*oLN%NWiMjA*&
zDp>(}e;{dIr`fMq*x!nwrmxL~Il-;&Cvfgdys^AZA#Bk=<Z(^SN)wW;H$pi*E!6uE
zDjk7>fRvtRE;cRjW;J^&qaib<VvET>t!RaxyYncPQT$qJ`%cWOyGA`JC~!V>?AWo9
zfzdSX%ii8!90#_s<E4m*@23M}_v^sqRXQzh>`cV1B|<sO?K>RLY&&CN%H_jZx94Mp
zM~0M^n)9fOOY(ut);(at*Qu>GX8__)JtsiPc@YSQ*oTTOibMOk8d1oql44@+u)Z$K
zg`wf{5ohZwsMy$#*GRid{<{>pIYXSd2POD5rN|vOBaEV5@+@>SsGHmlQkX9u^b$!J
zaljk@f~bQG-~^NxOT>v{@?pdR&t;14yJo?w7CsG>6ovet+;Ul<0=<(#C7s2uQ}H{f
z$-D9=4BC!WR#lBPiP^x;{biOnyB$kQAf&nhw`CBPM6&a!IN2SHcBxdKbNHU`XN|f#
zI-YYi_LegT5no+QR?O$oD-he{l=yPlLaDlDqjzb2m_mRdP89NlLYSGJn6QnV`uNWd
znTE+1AFx#WZK3DMcN7z6>tcI<d7!SRgJ>@}B!$!z6?s0hP`Y1CSz*^Y<uWRQFfNYr
zrx0=y$siF~hCOM8>6l0UhHos7wZdI%FcLc8S3k2!VrlUznJbR;ML#I>tqx}b)ccY+
z(ObbhD9`?;4z7>BqcqZCrCOapZL!@hYp39`v@&+c5iwC9zAH!ReA4lxZ}JZ5=Mjvr
z95Kat!@n1)uuq+Q%+WXqYc>AAd;&F2)7exRRQ*ZXBm?Uz)lLL?()4bZ)Y&@1Z)w11
z&~pl5^$L^<rKEsIM&5ldo+Cr$FxK<I++kP0NmT<R#GP;C8Yum^!Kx^X0JUT(`ZW-k
z%xRqVZa=S7Z*Ko{*7N13rS<UFi3{Ts6E`W>1o4I86hdaxCX{%=9PiBo&>fxdTMsC0
z>?V-;=}h>@1+ROHYt#kLeh;z3hA|0`1FFI(q?5|D0qIX!9OcX}#EB)1`4ME=ag;9W
zEe<Chx`R3X5(dQm(68J#4F7xA>3N6|#*lkR45=ValmQPk90n9s6_u6wwGh*aJPOHP
z5|`V9?qFloT?`5N7eQY%M6$)+uA=x5ppXS2-GB?XDH%z_wXAH|whCT$Yw|JY7tVXW
zJn&%219A8C?8V`7+KF!0-Qy`&VjaaYDTF0toOk31$L^|&v@Sc`g3_~NHuYMlSZIdF
zd18RjR{=#tGn;k%-Pb_m6(mlGfS=7(Dpnx;-*Gf2j5aTk(D&Ht(44Of&*PtRH~TSQ
z{^RqnKDv~-GROc!+d#$|2coC~wxQ7u4l;8VFZ!3(ugaj_1s2VWkAH=%my^h>?H(7C
zXfw}9DDNA9P!LN6`DtJ1!Y7otC9!B)V&_i02KZMBaooN*I@#WCQ7}=ni5$MTs4BO|
zcnCqz9g(;IADjMia1V<@8qVPR!Cb+hCT#D{ne(buujlKWugSasGv-{hlTl2xkdV+P
zK(Ch)T&jzUKbc@H2c-{2oxgh5D@p6(wn^TPTkMnGH!xS)0RcbNdjG)utFktuRT;{U
z=k_Or>-gSr!`qnNf4qn_9m|ci;#M0wx{%FWAAI0w6*zVI^fSeo4aM^M^L0_x?qPe0
z*bCP;CXX7H=+1op6>tLNtW8P>;M6{qG%P@IDcd}y(_A|tersht?45E&(5+nup=A*3
zt(3<4ABxr(u72cVpA=gD=t`M+4jiskaHyMwR18L&S#i}i_PFJ&7em0LU4LJn!QKd5
z;}L_PxUv6Ey=`?GcTPUKW%okBvS&<Qe7L<vA%D>F00o=jvT3e*)M@*U2j)gVl}sJE
z>^>5Z6u9?mNMO?G3lOwj0CL>EppUBtzazg%-op6EMWxKUB^o7jr*!ULd0Dz&W5uRN
ze`G4T%XU<Bzv_vO@PgIz%*zMt^k3?nvp<~HZ#UR{uc>r@&=a5gf3HqyRvgqHF%W<B
z>CgG`pp@&OjQ!8D+?+oiUFf+yF19{BKGw17{NV{_41BL;xR)n&lYsGjH)&Yn?r{a<
zzOP>)$k(37D|qS6<7%-=tqYmMf1I8kFdj7!-#Zh&M`vW-D<EswP<rur;vW4Az2Ugd
zkg52{dtd#gr_Mwl$O%#uF6hp2p9Cw^bHMC6yIkgHQot0n+=vK{Jk;|wrNnTA>m9Kq
zXemM`V&H7%8GC!<yywrKclh0J5mm8n1h`7sWxa5yA<^(T<V*LI?96Z4?+@7%gJ5v@
z;g^Yv0qgYxe|)Oo$`$)p*+V0#BJ46yjGcV!upMmc9u^i}mu#+91K#Oj>S9@JnqUbj
znACSovqYI9sdB%!tLshPd3%wl^LHlFFu*+5JT4#>w;Rj|0hSH&_n%J>71<NAY$>`u
z`pu8GHxoqn5*K>r{`Y!)ww^h;)js<1`C!Zc{k`0|SE~CqIn)!#NzS8fA=$xBK0Y(O
z`fzeMb{YQJR;TjM=TETJq7r39K15!o<}#T)ttNVN>|gyL=TOtv;xi47A%F1lj0GvW
zBo1d8`zZ%#F~Mq(I7R~2Nn-s#actUl_=pHX>-zrCLk<-i&0fpc&YIwynXSQ%v^-)x
zhXb<D);|_rsmr50XEp3D9Bhr%W7(_wW#4S8pE)M`rp~kEWsq1(;OI7U5CWulWSlS~
zp9Q~k$%u+y{}GNKJG9MS+NDr5bSo~cx5D2iNU~q#+XaDjr>-{Tj+vJ!RX%4X>2n)7
zpAUt&jMT*14FPK3?*<z0gv2PRw~PYK!~a|Stb70e|4H3w&-0hzg6{W88UOp8$y@HQ
z?30GOrsX<yV?G~U1XjyKn4r}Y%FjNtk}XwwxeF-or_zn1Hy&)t8S3XkX3-@`BoleQ
z{jv!}b4l`xB;9Ih=qYn+eqB_4fiHQpw^}Ob*%4Z&hck<99#nPs%<M-;7F8VPgKK9M
zoFDD`@BbY<FfcLd2(vJ4J?6^2oVANy@WFM!JNM^0v|#yLZm!Q=r7BbBlwncn7+lce
zZO!Le?J$?Fh(q@S7~&&r{O#9`9morCG82ZxGUalnV$$j2*lry$=jN4Z-Ur~hE)XlT
zI%stN`c|XCr3SDCSPyRYljDl=`8tb1z>nt7Fz98~fi%YPF^8jf%+cF>$_fbl(C(AZ
ztJ^cy!U~5=i&k{=!BxgP$Uw^e%iv%R%6L#bWc6^ohJitZ71Y3KuQ%=K6)z%A$RLoS
zR0TW>W0mtSo;_R(<tnl9O`jBC9A_N2t-73ra>#+>bFjp=YFbn7$HzqrHDNMYi<%f#
z@#}xPX5aIws8@+eZ4Ztsh(tOHv4OAk>g!U=(z}w=L5q<MAGKTM0n0+bcQCo{#0|?}
zmzmfkB`KdieT${s;yXr@rs4XO{zETopZK2|kSsDD37op|$#CjmsI7j-lAMS5L};j?
zeuV~$A_pcaW%cz@ucg{0zPKPV&3>GiFCvzuRaHxG%k?vuSu1+#>gbf56F6+Awz<7?
zdC?#7WaAO<sRb{cIhzZI*=4XJSAkgTVROza;JdpNdq_OFCJsHIwDRs!Ro&h)pcH!p
z-=ecQ_t#rS>th43Rz3~IY^J%?mJ^yM{3{82<^*m#w`)oXU+_9VdeZaDv8T}s_oaLW
z63u&${W=($r3Qw2$N0@c!A%-*5a~GXkWdj)7aXk9{4BvG=yBQe=Y9=vJ_g5mng!fC
zy``}ZSf=%Vr;ZK=?HkxO$t5GFAlDZ%e9M;Q^0g!&C>WVUzJj!~CO$u(=DTl>kwacU
zGGY~|!vC@MaOcMytN-@LvtXy-%tw+IaO?$xxEIKIOC0i|RewZRI@*>V^eMkA{N^2A
z`%g~XQ$#mxc%#%=BKUdQ=fA~UquCHR8zYm3p9<R<6|}tzcjF=D@l=6qhJ`YRn~a6<
zu<IM%RQV1a(g(l$dqH-7x~VN_1iwVsuT=Y^L$w7s<3P?ED*_YHrl8Z^H$AM_0kG2p
zq;%t=rcD)p&EKEPD3G;O!?P9X04-V$sN^2p{ctf%cs#OjYWi2$Le3|;;f~cbMs2^t
z!mCdqE<ru^&3?z5{Z`<}-SXANYchK-z^Z(b^xhUSN5J;5Oyf+k{I^QLz1sW?&ioCK
zQ099xaLX{`+O|WpH2DnYW2q|DKkoZ~3jKRcdTnTH?(0t08FuUXOHGC6_4P(BVuvNc
z6t9LFdTXM_2m${CHB8p{>P7=pXE}WK-{E5`(js7z{H&qDScLe3ODj!nx&~HVjiZ=9
zQn#(~VEv4mJxtTzm1>gO1E1yPIi{kWo)Gp-*GxCO9wW_04L~glAa90z<e;%BzWVKa
zT_tc8_9=N+2Cy7HfQ6@z1i%P*<QIg1e*xkTt*B_?d1)B>Z_&=iTCl$WtAt*-GDDs+
z^{^y&aS4fl+S=New{=9o-g2v10Ps>S-v=puEH%g9F4)e~vnU%Z4t_#RqmBn%oEmzM
zqS?!2{yoxl5@a_=8ONb^uX0{}cnt(E_sKg!3sVc3tQg{iIS>}CLaA^s0Lb_91j;hN
zZYjIe2#vsh&NTw$&Wey50;Vg0z$;jT-lmH<#&W>3P`Jm-q68)^7=!F7bL!VGZ2V#i
z0H_99JV00PAt%WCBsq>|oL3Dt?>Ywvqy;`y0Q0tjsrIkF;ZkeHzP5)@oB)Bv2ouTI
zSPrgp^RUS>p#NHO&o<ZmZ=-{ZkVoAX_1plcXK(?72}U+Nt3#I`NPK*Ap1x>HKEfwE
z-AybJbUBT*Ck@vf#O`Z{?kNJ!?J|gls72>P$GggUqkFdUb=)toEG>M!0+gpgb_aW8
zNi4qOC3tBYvCM%Lcg9<ST49ET6{<*Q;^h2DU_=hO+{>-5WgH#pm*~mdzPXgSjl8_P
zVqh#>)jTl9x-uS~%*r6(TNU%C;dRuK-L-<~jlRy#&ID|rwSiQF=knahI?w`?n$%ru
zi^E%Be5m*Z#%~GKNA7eMLrx0GJzaR_8v2K}EKU&f5=7NFxahrMFcgU_^i}%{C%tuQ
z)|fx;`UxV<&-VBCw<ViH@!s@`QAeUyFvIGHb!XUo-IR1*t0#h;?-x^aU6Xbzhhdv%
zj+WcW@bOBqKPN$_58f60>B}grOZU*w(8mNw(yjLUxtpB>>>~F=>q)l8LJ3?M<h?&r
z@MB9Wa7}Kw*qF10C~K80MK(l&XOFORt;#9*EIv?WYytyGUBHDZLmCIxf+WI#KM%<q
zid#DPz~n3WN8Eqw5K=&OXcZUUGlWGfZDGv(tVrW&Nl6Y^2idZfO9p*)6lc<H(-iWn
zkv_U@RgL(5FEQ0{^HZ7o>7(rjg)34B%}B^$>=$NFPj%(flce<nUEt=#IA1`i0eNt<
zcdx75xBkQWcbl88$%J^mA5H=3UP$w}27mV-XR`a27&j2@tm>A=!gc_H+6i1as_|k=
zsp=7hd!F#zr=47Hk}JW(LCyNvkOdGLMa>KpNiQDJ>E0qAnc=ws?w%Q=yr2qYW@V4j
zZ`Nn-`Re%!c}%0lncZA`e}Ch>xe<X*$p~NkVpVd<+k4$7p{UML9a7~#x|TVN+A!9}
z1$Fvn*|kpp%(wrqraJt3AmGUnKt&-naK&0Bm1A}vlH)eIAK5G}D!Qo>;Sap_qbNTW
z3q1|+Y_JEu+Fr~$toK%c3B7?8Cc+S)S8&GwD*<wlGyt$tBfZ$(ScqHbgiBcwYE)|+
z2Vyk$UVaH|lmFeMT*)H*RzQ|?w6*(mgQxp;IPL%eFC$Cc@%2ICL@mtd+(rjs$W1><
zBMh26-g+`!-BAIve$;b)1V(XV^#E*vJJ?cM#lAVf8+H&rCNfv%0kh@w-L7S?N;?mH
zB_AIcF9;(blKiTkXsj{s25R;IHyD}XkyhmPafMD+46Y{~c*cB~$g5;2_?xT_iGGzq
z4S<Wvpm(p)_T6zd@gIsdUNO>u*qcm+K%h){{?mF{sffC|`ZHjCg40jrNLzssD?GIn
z{UewWK?AEAbcZ1jCRm?15Vnd7Z2RWYr*7BBA<9D^j?B#zJk6E0uwj&v0@nVd%{1Gp
zjWlwx;HE1We}Q`48MmP2x}k)z+XfEX;0<*JRy}!KLhcefT0Z|K2`!B@!nHawrwURs
z5G$vG3xhyoH`zVTyH{sRM-<~}PS|fOF9PiiD`w{w+G!sq@($H_59vL>?DR>6dp>*o
z1J|q3PKDmR#*ipXR3!aNbrgfxv5Ng*N+zSXYsW3t)d2oM%Cc_`B1Zf}Aa7bHPK>ym
z8@NZKMDG)DW<&T^n}8EiC)KzOX7pPi?XUhkzULqgBw5-b9Stxb-jw`P3+oZi&4;X1
zFjo*wA@zbo!f=Zt>dDkR%FdQ2YA~Z+*T9bCB*e!HaU)IYpE!JBH%J%J>HUXskaV%Z
zD190Y{!R02&(J?EVn-6nnQSrs<nbS1=Ex)suU7!y7pD~d2qhZ@iEaH^c-qN5(k0{|
z0AL-!ed#pr!S(SFWILRF=dd*0`>QkT&us9^BCZ>zun=y*1S_)eskB$`UvO73k|SB~
zp&4*A+QS503M}m&<*FowZ-peEPk=`*;eKxEuu5O%k9YhDI;?4ak?)qeLNkePo!Z#n
zBf4kt)#V^Z%JXe?1cHDLrbGGx@XntdM*UI7j!0jBtVlgx53>*-FgFauEqG&HtTd@>
z!@&C={u=dOJsN^_iy*-U7w`oA1K*@B1*4c8{=KF8)@cQy%CrEWC$LsNd|Y4!&p3_F
zK*mrBoL|8<V8qn*o+Y&rfiu%Rfw>|irw5oRScNhl5DJSVnhS6J105MFG3dL6R0B*l
zoT0&msQ3ygpMt#z@RPW-;Ib?=^UUJ#mBK{AO8uLio$cwy>N}dVptONyZXSm=b{?H)
z>(d3lpc8Og&<k9+l<4coCxv`2<f-ooU9FwR=z+lURt6mero#=!1g6+8MzF81v8ij_
z0}3gaLODZ$FE}KEs5*`Eu&rT1uSwo6ebVBUGQUuY8+WDcnbnmQ*JD^KmYO@-t}euH
z&+(v2ovE7_L|*)UQpAq56Qj*ge=HH1J%=vTWdxjMm6UZmzuMO0I1vCD_1~606~07Q
z<Bc8KTR)SNOVQ&uDTT9Vx5_bwL8*hVpkOOd=%Oo_b^xZ9GtEUh-sXLVL97sa3@r9S
z!bjWm(7S}+KVQ9irHzq%R8ilfo|pq9eIVGq_;Sw5YI9p-tzlcOdb!-od*n~>-jxA5
z1oH*3>E~>`iZ2Wn6cDIOp(dZhk3dorB-4c=jSMdO;<+aER3zkzyZd;gDSFLlS7d^k
zWT*BaG$$Jfs~oNoe!J5H@6D`6gNF=B2Bn&KV-KzJC{|4-pAJ;|07M6@fzKYrmT+6}
z4^4s2rg;x7i8nTPHwZ+&mOh<l%e7Y70QFey1Bw;Ql67E!WrF&%4Ljn9FPyjQjzl%y
zdgvkb_q}|wHe2s7se<XFC<l85h4gp@CA`_4J$6*?HyC~i<}v}X0>Z&H8SBd#qs{5d
zcv{yX;C)W5ZYai~1v|F;<yoK^66*6OKUlnWW3!k$kIeeJMuB8-8E*7z<Rq6-l^A<C
z!X>;QTb0rGj<L>In;sY#IK`e@ic^;75yuz$0H^c8Sm@w3GZg{)y9!(Yx7Kzz4|gL<
zG$Y6oNCSM;O-}D5o~kN(Q(DwaLYegM<QW~UC2-~wi<!SB^A8>K5Cp%WuEoG=oYwuc
zF`|u<6+p<%!`t6EJ?Dpch!qr#$y2Zv07VUkq6D^HQ>n3F+l>L?n1X*}@SYDI@AQI+
z?dQP$0jLC{R76*u(418u^nydoXEAc~jH?kO2P^)^w1?_*OH1iVAlohBy0#K`^|D1+
zdbU3FNUAkbFZ*%VL+<XdY?HbP&Yp7?Bd2#58<@`wyNUi$0GB8WuRaGtNgaVE&<#tt
zMjbQCiPmFjHZw+b(nAZ;PT!%pNCs$M49Sc`Hwc$KF~1=14l@Q;XI@Y+Tns?7qgZ@i
z#fBq*{lL<DluQ<I<z__<HXOmhA{h0gcXQ|lv%CR-l!&Jhd_>LGL>nJM{R>EQND*^I
z7fC*bjqYx5SLbgW|7p&SSe-qa1!1!TB^4V_347qp0)1MA9a2kbICoEM7~vM=kv2}#
z+fu;TyWqKgj=sn(`=$y?UN$)Ax8ku1`J%4%XFVfTVooFADtnH*(T_M0jJWf~4!Oaw
zZvpIk7^d#q+(yOILvPHi&cHY$#MLO3y6I%YTw;^BnI)WxXFu}bU|cW;<2`3kaunb5
zGjw1Ilyi}T4Y?p0*H1dFOnPzP{&o*YH=d8&v}R!nVEpTdxLwrTu@6)RVBp4wTmu~_
zB(uetq9IfbnA<1V)pfHC*ks^O%aM)%Z+#c||7~m3sGo5I4p`4U#ZyKgb2$qlyXkA6
z*V?eOBseX?Yndz7u9tx|t!?m?T<3B4chq$CSUqrMUokjf<w8tQazc(b%qHo`Z|X7$
zfPCkO!Oh2%ITP00bnbculMY{+A%lv7z#f=FJOW<VTf)aBJhp+uB>C+y-`|rsPcq@s
zI#4hUF(RDO-L3`S6UmKz{t9^pren>;5Vle=()J&qH{kwNx$iZwv$6L+#E^yfQWEl@
z5o`V4Oa(!$nwBk46;y+TNrX#~z6r>(8mJToFh(1B-o57NjyU23krg**^hLWh61sMy
zc3`T6TTeS8tpNDOGh3tCbzz2a3D%MO2T&`;kL-t=VLlGs%tkg|>^i*x9wZG#6&oS2
zLe*8u<jTFiW{>S-w{B&$Y4~GeU?w_tFnAWFAMxi1wt`8#M3)BPtQ)RPSZ_SHY^m3$
zfo?{=hm^C=76$B^<T3U21Jc1T0)%5<@byjz&t7^94b~}8CNNyfY@yp^&GV{(dCB(g
zP;hV+@LKA?xy=(~c5v28Lz+V<yvOd24!`aAgzeFA=3AovV31Al5V*GufrA&;#Z>^<
z@7ady?mvj|5hvK>R?fg*c@Mdbr(Fgb89ylVKa5;y5V*O?@Vl>uqzfbQj+4_jt&y0q
z&_56+=0VTdGt4>*YJ!hoA1TxJ1Me%m(tA7kh{n8s-o!FFMdyKCLh;C>)%u40X)TAS
ziQUqnKktlncXb(@z(x7^fZ`j%p<zX&fP7{_Gb75oH;91pa|EP)Vtjm@8<FKqUj{8x
zl#TWDYNfZLN(&Kqv>Zd{TvH)x@7gu+-dE641FE4jd~O$$52c^KeG5zT?q%f$ALy+F
zHijMK8c*Q@HlQ0bhB?hJn+Y6Lj|m?;iJSYpHk-1?4DYp!oZMTmm<oqjAw+&W^A0yv
zO|vz{!H2f*0})2Gi)v#Il=2)()wCHQ`T5(_6v`Hul^LbAtm{S80Z0N2F(X~5V_O6J
z-GBqKA5j-5=nm}9yFK6^F{maM|7RJ(){HU%)A!n63nB+;$W`nGQ4nmpDyTl?^xgpH
zJZTGIF)nbcTuF@5ojc5xN>Jp@-%eEo{2K<KgMTA8-H~8)M_L>j#@yrO`#hNeaU)WX
zOG+BR1F#C#Mieqw4e+8MX+Wui$TgHJgF+l0!`SuMziB~0xPpPLl;ZQrxP%h+qO7b;
zacz@zYM)RM^#p?k_Mu<5qX>9IP#LNUwRi*9N)AqI5Ph@<_D3To;N{BJcnDuug^ZW0
zC<BZ6J3RVF#TQ<#e46d&0d>UkD`>qMV(wbC7*dbBDyCV<lD3$kV=i|Go=RE)=Q|^T
zAq=ve?Vl=Gygxn2ANSe~&~2-@lI>v94k%F*V-15?v8bvr;f@3rrZzm<{gh<m14&wf
zjcSLh?71c5{re_E2c+TWX83bTK&v?jX<s&;hCIMi&vX~#=9P^HXhObfiHEhDM1Z`b
z;SC&cj<2DoPqF&Vf#AW&1gcFMofmEPkMQv~)CZqNu1q;D7kTwUYJ)agBMVDLcTiyp
z2<8pJmNqY0OCb*=xh$&xafSJ<A79(-`C5x1mV(se3XBq>FVqD5a&>sq>BtFhvGgum
zc(UpDSFVSi7sF&>;MrGY%7ptcc;_$mLSvT<>7>rhexH%zzXmf`OIs&U`EN7HTa>&X
zX0xa_)Z^~}+7{Z_SZdgW3FlTbb-2oZ$Dvhd5n$Qr|2o7<LGBdF(Su&#)ih5b>}>q~
zxV|7s4-d{VgUG)VJ9t|FaZ835r-l5L&*w%~FVSs0C3#|i6>N9<^y!J!4M_l^lJ%3E
zYl@51-;K5`MS6>IYs^cUV0qg?w-umpZ$~z$9n>*X!@5bPIH?#St?L#L$dXz7!g|Lh
z?o*zT*6wjN;=P7j5?SmluigO@Tp6H3iuZ%QdBic9Oi29$=La1qP3|*SHdu-Gl6ggb
z3ip1&l^QDh<~qNqN_xk)Z!2D4WB>?<kR?8n%W*Bx#tX~Q2q9$l@VG@{t^>1m$D$+X
zk22G#FsfylpMdQ@e|O+EEo0$aK4?N!f{%#t>v=gB4C`6}hOMTb)X6nOlzlV!`o-L>
zJi^ZES6gD<?+sEpew*;lpv{v<=JT&|P;%&jl}lv~wF*gR(MF+{@<0?c{o!CMQ7==u
zE`@b9dao`3G#)mj=DO18>V^rL(-RytMu4Zz0Iov_u3VzgNiM_kofcFRk1D{=U00xy
z19|T!A%E`!IwpoX@7NQHoQrq<TMX}8iw$^cR&JOM55}4=_-WXV|1iEz-3$IJNNxu8
zDC)bGKLN!?J7XBL4HuxUCG7R}nWJu>$>D&0d6K)-v6Ial7@NG(Wmdo>wQcOynLXQ{
z+BZbe&_Aw$E%+V@9uBeRUxCb%#p}Qwvsc-wI6~C%M;ZL#We8q3ep=xwM??)(0da9V
z%DJ=U+df2Qr-)Z@g;bu))VGSc#|23Q79Uvz!!P?V!Nrx^v=MLz6)>dV8y?M$;l+;B
zBkG<^m8lxlm?_T`^p8vQMRTa(Qs51vhAtt>cHOsxxH<rFl!)mCWLFM)U7^NTj>qR^
z@mOvPK?IM5)m6@H;E@5_0*^RNd4o1_<e7qmbft=C=FI9L`r>y-tq<)jLm=AzT@WZ3
zL#s&Am=9-5e36?bA8_^1_`p+^1aW2I*T%}?ggr8g)@l>DDa8&#33s3WsmmUMq0zCD
zIf$73;ArTx#Y`Pz$YmlC&~Ey?Alc|!_|H4$SIkf-*{2=aI8^uDS`f^#0v*|9-*_QD
z3i-c?6L%KtS(IoX;M{uaGzN?46{EpvR38x1Hc0)>5i5zBOdpmZidcKv(J5iaJ^MvI
z;NgBla?_}a>?Y9j0*@YxJcP;aX8xib{+9<`SRtQ?9g#pzrAXGFnf+$6_2$daI(F*u
z!)Jda1ShAaivD3}wH=Xr@>7O2MHy)SYTNf!3}Fcsfn;D0@_BZ3@O92~v1x<;!~U>M
zN`c___cv*RXzD{7Rzb^>G6F9zgUloy;)JoeCCz?ezv~4~2i}<7j5SBsC<@gcH6db(
zMzxem0aWz`Fho<}wL%q*8cu!7YLOi!zBl0(Fmf4fjI&DKspjMN2%1`%gpaq75Rm=t
zthKa$t>$~h&gzhOsNC<ZW(-i~-hV(Ld@mcjdY7=1X){nMWEXFK-h*2GalS4jgs29&
zke9h;A3KVz0!Pjn%(ftKQ1i+@sGv(+Y<Rd$+qeE5DKkYI>?K)qBi~2E6z42UeUl@q
zK|4gNfJ;2y(F<FKxXXQ$AMrkO;Ctx6rl7EJ^tRpA%c>Z|zV`N6kfkSKlZ*IQ!S6TI
za&h`5L1p$DvH-Hu17KbSU8!7*6mm}CUWXYul1)iYFP3Udx;uHli7|$;1P_;FKz_IH
zE38o68J`CeEWL&HgV%f|m~noMUq-aS^D&01DAGZ)xbu!BUbQrrq#^FIZ%%)IcbOZ>
z1_X_cFQhXfq!8f4!SCNOBTFMO@Lk!`5936xkIN&e=#C$^r$ZTi2XPuO!oZHm;=1DR
zwnV(q5ghW93$tYMxTfN<0>Z+^pwR6C2IAw_&!wI#6if;c>HFA*0D3ton}4n83OnLf
zX2Y`0LUUgG9+8~feR;<%{aad?mmuct0+xS3=#d!0p1Y^uB`_isFnbTbP(XLAmNSzz
z{gFiL(#KCFq5TWLfL&w*g+G$C&8+Vg!xo^z!eQMC=!4`EJ2!!5D2XdiC*MV$TvyV&
zzoT`~2nmC%qMb3Wt~aSUOOes1k6b(a!D;dkaOZ`EMuxQ!`AEc9G$z}kLozM$`wUN0
z!!-aUf#Ld@=)?PqGp5OsaFX>q4^QPt{mGy%|0#_+lQ8^+-=r;FLmsv5Uh`QjI*Ot4
zJ+JpA%HPdvt64e370G3MWcbPLv{`~8eK*F=0A`arFuZar*B!-@!Q8kH$Z5aL7mFmE
zi+OQpXq4Z-Cnx(vKk(r_MG|<lE$}CJH;n{n=h?<^{x`@Em1s4ujS8T`&yRUoiGJ&p
z{Qfw_^CHY<TgS432k35DflSM7Z^M>YyT{5d@a+HJ&9h%^DV{QYPXj^i4!ZI(1K_#i
zv%oG4iX`bpgPAfDtkLte-Ess(hD1)=J*0_Do<67cI6zTNnWhR1Nh~T>p`~;ujWTc8
zb_~{Q4nM+J^BNz}djv{V7<I74fIAwxChIp)CO?7wi#%}xBI&;c_KU!zU&D;7c8f+y
ztSXea$ICDkt2H;lhKgvlox^+c#yZHH!5{u@Fx$vcaKe-gIfgwOu=ns8mlu{2Fx9Y(
z_vjxS+&m!rCNpx-9!wF!VA>M}$~W?lR_Le_W>!yW&4<Fo?kqC!iLq2&T)Xe*eEJQ)
z0A2MOTiMp(ccshq(l%i1v5k+5UFP+!D~pbsh)D_5agf-d2FdV8am~y1o08ZOUL;E7
z-9`C;tTD2^vnjqO`R-?R<*bw9d2f$`paXaPsn~8VFD*Q?n5Ue1g79$}{)a1vY_@lm
zDn*WikxNsF<MMKRy(~PlV|^llbnfNGl@-{l0xX8|cD7weI~?nW+-chw2AO#3;~XR=
zdVRuP4SA7G9))pV1En+@|4$16rYvtGKVz+&a7h-^n*6g*J#iUd7!R$F{TE<hPza|y
z=^`Ud+xMuc_0R(amNqn&)o5KxZ(m<_9(|PFgG(RLr<iUrI}W#l*36CUD^{D5-#!zQ
ztLu4XIT4a7xNhVC_RmgV1gDXm*JRw`v?~X2WK?Vl7wvD9;}dMR#Bv<GfaZJzaBuQk
zCu#8a$%hWulYR=u_|WmFPE1UAf-{3p>&TU6C0e}#3Cf0o(0vaTEzz9v>z_e+e_A_@
z>~4thaNVE)Yhq*=vPfC(VpFw0>>g{wl?Jf^a)<>KY1=SgoL0Xr>*9F~^S!(sk-KD}
zroU@!ZKttDp_hQ-3C#0D@C#W<&qC~&X&w;I45K&JH~`U<Xf(tHBu>;Qz9<gAKNh+v
z5>}43(1VFhl}=hqWW~#uhNiT-9h;tF?`p4)*I0TEri)c5Bxb%fn0w$jI(D6$zC3NM
zQpqwCw@Lki$}O}|`U(Q^X0+vY^&gkczw#88FWn(|8{P($yc6K)-cKM19=>XKL4GOz
z(3^Yyz~Pi+?YBV1oQNv{G3T$_u{2f#x4&jmJb|47C2$)TUiBShUjd?32rU=;kXP=5
zi1>zrIDO%m6oQuA#2LWlV_~@C{)fEf1l`o5$%r+HQUfub_l4(9Z|A{yyNy>?Nd1J?
zm8CTumIBxfG!_c;KQ3xk?@Gb%<wE52L}S_*#{Te~SFUsr8}!epn&%8m|LxN6gGj>B
zgmsIrQBUgCFou4hKU#%QP+7r(ZT}QW=&hWuY(eOXcI{<4&Q(y6Z2sX(2dKyQ<FRVc
zBs%!|&b~Awf4~<GvYR}1_y}i>DSZ)Qv8Vqd`$?i*=N`VVSs#1@yfzaY7iCMSAMj%k
z6EJ_Frn*eEFq#l`7I+Io5TV_NNYJCCfkEUk5Z{66m^m&r$TgLra;@DeROJZPzMUwn
zHUGMO?^(9?WaEtxK`nhG9vsFJ&GOoLhC&hWWou4_+1(h_m)S4}_5`z*vw0Tj;H@Xu
zG7dc4)8I11)*ff}e=MDMJl6aF|KCOtGE$Nm4SR)>Su#pP)FC^`ULku{LS-~AD@740
zE3$VfiVKO1%*ZHN$x8S=uFv;({y68>IVW*l@9Xt?j>qHvxTZe2R{2R~wa1<7`tDau
zb={{lRD{cdCJV9x<z)G}L|bFxs=RKprs_Bbs)j%oYM5tS^fE6!UGu7!*CI{#-q3`M
zqWxW-C0gzSy}eD<GrCxezJH$V*GTuuoL)wLcptIDm`fL*q(q4TWs=d~{l9X>-!hSj
zQViFQYjEFWU2S<NpT%+HmDkkQ<7`R_%Auun!bX1@GMh9`92LD}+q972&LsjU-PSnk
zd{)8gOYd)wV^de0dm(>#1;lk0Xvx<wOF!W9$XYbkA)=rZg%{8x;~UCya(~pSXIyuu
zzJ7bji<P#z^KXN-VT%Bnp+&#3O>$bw&s=7HM4kRA$*&ze_GBsk8EkRufLZjec(X&D
zya^=FV~c?)5ffJk69QZjPqH{ke*tHx@aq;)Vym&^p=YCIXWbq@YPPw7AVA*zrykip
z+@HDq^8v0l%K=kCeN3L;diD#Y_HGq#Qaq<~xF7?!78z@e3!&i%RG30u;93Djv+}29
zWfT;Am~<u^5_DK)kLehl38x$S^t&QYn_i6fz&(8jtnG}5*Ktx712s@SHnZiS!hQxo
z=L>h<u1UIk`&R3@UCGt6ZyC|>4RRpPGDPj)H<mUojaa2e-UxKS0^~g%&y^!`J4HL!
zDT0Tsx2lGlp8h)dQ@yD`@fZ$q<Qfg`4ejQyt+~dQ^*}206Y+%Pz|t=mj1K4whDg_(
zdo6@gbscinj+bG^$T7H-vQym@@;#}DpO87uhgm8Mhx#xQ6cgXb>N;Gbk`Sxk0>Sh^
z;;DoT-*m{<5x%O#mMCof=RJ;e7A!PRCa%DTeQB(R_|(<)Ji;zC%<PRc(~BZzrn=)w
z(H{Q^-b>&y-*C5vKjE|SU?(^%nD-sD;fu^I+QrFvmNK=yAU=R*ABv|S%6MQ;n@wI#
zO%0Y3MnvxaLFx8~F7J><yhhL}@}c@*KdQ7g62f|qkND5fQ0Q3l+O<S%mrOH?T=332
z)_HY(lVRfv`t_=fsiBd7<jBQmPM|H`OEiSF4+|e%dz1&zso?7*&a9eeUVbCjT!&*7
z8~T}8qZg+HG$5L@E$Za`_FA>6z+r2hk4dSXl;Ht6!mq1hV4<+{FEIIIiqY*~J37wC
zVjT)xLaVdoso5)-xv+`ys$rJ)fSZdeH#%1nPM(B4p%a3sDez=w>fZbE*AQ)qv!#2{
zYhY^|<}0;f+}SNYF5_`8Q36_bo9Yu#zG4*$VH^KgdG6q+Pj?S6jqItO@m_$V<E`r5
z$?_PK-bwZkEiyjKpXnlM8)L;zleQ;wKO?~{P&(ko!%bk3d<`3qC4^@o+A_oE!%Xmn
zxE)ZdmQduH;M8u-6F3<f_s8t$Q#qDBd7&W@08g<{7uzPV>>#oE?oPdwpy7BT^Al@G
zB<m##%-_|E$Mz_Oj)o8*Jx+w<p{jajklHE6n|UMpYv2Lp1jTZ)qva{zJKv>K!xL-9
zS5>zNNMef|Af@i;WMMIw7hy-)=<-|?a{R9&PZ#vE66Xq$zqo>0siYt4%q?6TW3H1%
zXr=BZo$zqD9hfc-&OS+3&Ay|jn9W^vCQ?3L;k!RU;F>C-J30%5g2fdc+Y{#jCfe8;
z(_k2G)Fl%q_@pS#l5`71$gPwaj<j!=)amv|^<=z8SQ!{@Iy!{cqZzwdbg~AaQf8R0
zGuf<*pzOH2_4<=8=}1P5?88mF;1)3z4qZMRtFBqEe<V$sq)mlf`9uQ!LFg^0sltht
z|8&^c<f#E(qOX&l1~GM6>-<s0$GKFmj))XF+u7O4ze>y27*Npoj#h5O7pdF6EaMlE
z1J%ai${#|32xh&0?ZF*lg6|K>hEo6IZ>7_4)Jb<D`y5$4Vm{5+6BE~e$JaPj!;e+H
zP%*eRz2#zqGzs6jS^ni2Rt8HbqdC$X%l>Z;p4lySkOs}-J?_q(i7SH|SCgE3lVB+^
zpl{143OY!CJ&%TvHNjk2V>?|4B;Rznk*<+`V<$5(s&M9r1_TQ!IwGe9-d!dpz_=un
z`Dvfve9Gf#_~F6xTvunsn&?_wS{h`t>1KwL&pwCpdBf<4A*W}ODqwqh^Fj^2;?5AM
z!_gyDAK3NoN3_faZnz>7y|Z{q%>~&gkP>hSJ}gk;qdofMf4m=lLZK6A-w3-q)<*nu
z$}@}D2y7-O*?PEiu0>=}?{fq%R}82Ix`dS*#*;yH(z!T}AUqR56eS8^&}`IbcB7th
z&#^Yz(mJo&hY5u#N+wj@t=Nn-6=V;B-2+c_33x3%03+XySO-gRFHysAqCcI?+IE##
zjqx*ejyn)%l-Afn-xR*_`7~J>D_|D{&$Fxl+f_^RwCfEUakq7RhVlAPmVToLHrSA@
z`9eTvF6eMpC(s{t3pW+4cWIr*4>J;PHH?%zdBzl7${c>eNiJlD?&vGzXynlymA?FN
ztV*L0RuDihe&TtQCzh)>Zd}SQJ+HGOU=vi211YihmR%C*_vcqZta{?~*T;!$kVc()
ziy>^#PbXa-)5ZE?F>EwrTU+Gu!~GawvJ`b5;tb1wC)d0XJ@SX@gMAK2qr;zmA9gP(
zBK<DWZxqd0_>J;;2VsW<b3UEMrP$>0wc|P~2L;`E8-5&OvXTh-0W@F<Ze(hm>De0W
z50|hJe0|IA1~B(*ZP1X3L3Zk7=<-iP?!DY;_I*t<M8`vH@|b%sj&Z#X6<&IC0~H>=
z!}rhuP`In`8wh~kr6UppaxdaNyX2Z}sZL?|XGf{<E{^~D6M0{#k%pqZL4kc~EWEBR
zv{vr)IY(Zx=b9q_?P#>*0m{vcm-fvjvhqp#Il~4wKLmvdrUx7famCm%ck2VL>8lD_
z8Y$LeJZ$}dv$RK#II*dV+m3Ao)F{k44#JL6eBX7R!!AU7to}wC$ygx$A9g+#FqfLd
zS;GWDRXbl9G1E@`$|I!~c)`r6+9p9ykzmQrKQHPG1YN?Zce=>gKO#aBP)V#PcIxDI
z?Wtt6%6LP@rtj><v5H%n08>+_PQG>09RA7P7Ob>}G*6<q4{;CyrjBOtuf-QTyE2ZC
zAHsd7i}k82afAXv0?&ZBf~`aa9-&m$VZ>4SCEKQc4^rjgiGHs*xRfWD3d+%lSbFl_
zRDhKDv9{sXZ#)NUUR>*V{HCL`HH4~tuUCz8Z!0qs6ZniB_Bl1({rzjoUX{BD=(RGg
z{F~W}JC&n?f_ZiQ)<8$yo!7UZ`fi=D>FDfqpg8QBbY3JuYVZl_8XT85S(of`Qg)~2
zQT5g|i24NXKL0H3Rq}-YF`|}EZTXGwOz_5PlBm(Ul5lm5Ha0*qyzBiqq40miG0&JP
zK@)|yQSR8t6er5sR$C#}q#-o7E3C8p7`+>YqJ~m9VLwgz4%mVs%~sWm4V4=t{^6w0
z%w}(bQ<_FQB`&<W$QZJt_Jb#vH#TgW0TrPj2Gqt^*Q=m6d`x_5Z>J&M-_aj`eD9d-
ze8nw0HLy6aLXr|Tx-VR*E(|8&pd+W&^~4HrI5zl<`y?-p?HByY6oT$<dx(5(bSJ4z
zn(0`0XOBEly?H1=@M{U|oD2f%#eNG8{KC$WT{$L8TWo?dv(Iea4Z9c(T+K*_e7WS9
zv$RLBb!jcw`|8!p*Yw5xf`fzoVbeJY4^hAH`}<;qsqprec>QW!om~X$(|rxLHlx1g
zz*u?T4B!#tcJbAJaq^a(AQ76_#zy-F4}GAP<J$2R4<cTJWBF`P6@2H_h+K@5-tsjN
zKTi-wvU^g6!}xM1%?&Ipg74TrY@kx0uLVSMeW0yvPFQ_kc2(6{#ublX;n@3LvF(S4
z|BgeHimr4pwJ0ct<j$Y7um_D7aJ2cTTs`3N=ldVxg!;lSg_fC6)`KCOvff*nnFkg?
zLtcuv))f*QhH>qlk8<+mu{4!d?mvMWDWCwD^O{Y*C9A>cTa6Bcp8)XSLO0@xdT=+^
zk+(j*UtOJ-Hxq|Z{ZiP#u7BX#)f3wz?4&D;r#oS7j%*x=#zw0LVoM-8B!u@pG&T|5
zJ{>smG(1^MY@R~o{)o*B6Y)C2?j#C>JdCqg^mTGxi;KBi@_#egTSpEknpw?axcT-R
zhBBof7I+?IbrR;c%2`l@2M!@fy*#SH2$uAQcPYEm?;JF@e#8fG#j}t^2QZtqV~)@k
zfrD&qDX{6va<2NN3C~&NjVK5?<_vx$>vDy)rI8+jk7HX(+T_1?g^#W1W-C9vwGjXu
zS*YEn=K?qOitdZ@R~LzG9-mkFR$=u~kuqT+ZwnF!vpG!QJNomP=^sCSFg7X6c#M(R
zpPzZ`2P7xGjrqN%(P`R{^P)xF^Ob%%3lDeG7l+M{3{oCr_E6=u{UKj*CQm$+Lx;U9
z{nwyl)88x4M-<TB%<NF-NiCY*I=|<;7CV2m<@S>*oWDIcg=~!Ir#9H5_+hC*e^3%;
zxtI1xX>P@5w?~_j$E%_uq6ulv#qojP<?x_=MuBq{(8=Q>StNb$arZL#<b4GhoH?y{
z_Y#kqMpeNiaDk_llhDQ1bR1!c3lgTK(ub6l`?NHA)pz}M7reK814)tF+DOti8^vHv
zYh37JUeKPWs4IlPL;%`{AlhOt?WCsPOh?B!T0lK?i3r-;@a@ap=P1e#$O<7VV_*?Q
z@c=uY>aVNvmYebzuar>-cIaud5!jC=Vh$Q)hp}A_ex!}~kC#)G`UYPeU^UlV>Y#wg
z93JTZpDARQ*AD(=eKoNLAA_#8nHl@Cc%6nbGf?Jz0C2ttYPVIEpFuKLXNs#YAL!}+
z{}!aky|?`j%W#~Qs;@|`{FNO2{*K5Y$>2RpM;hEZyNj#9mggzu{#*YtSlQUi4}7mz
z*${Y3H>Rp-C92%JX}ISb*~d9rd!}j1Y+k>&|G|P?OvAj|yE|riv;?Y&Lx-c=lVGT=
zpqrWbQ5vP$lpOsnxn(21v1=oAM#>?`VD@i4Jg%=>!L#;WfEmcYMR}gQtCrc4s^WfZ
zm#nDU#Q)4K-TvZTY=Vcx*~)%X9l30_bz@(HTcqBSrpL2o$f3?I@51gb)LS#gbc6PY
zLiC=x$WIZu7F?PQXGXQ!2!eFxx%O~Qqw4dkiV|slP19Ke>8lBy51HyBs!1Y`&oqGT
zFw?Op`Lly97!!LRps=;#J$M?jU%dF{E@n&b_W6WRVpE(1Bi7gX8TQE;MXHYzQ}(Ck
zQP);24P?FjH15V0RhRh}2t(+7o>cN%kwz!@%r35W!*#ZY$1wQnV?DKoQng2EOI~%s
z^_*64wTZu7Ep2-6I<ljTu}qrk!jX?J6R^laPd!zhtJTBXY`qjXbN8S1qrX)DlUG8r
z1TNg3^Z+oe`TsZb`PM&>mUB(f!D?sW0j-ZG6}03!ePYuh*NJbXu^Sc!SO0W-95%C-
zn>sS1V5P{XRWCJcSgIANebTqes(GQ`JTY9wBulH4=AuTjw(@E003)XF@L8R%Q*hU<
zFzH%6GIsJ^Y~Q+-C6n^wtDjF8kP=*ZjM%<SZRytJ_RBt889q65q2Q^E!)abK$!Fd%
z^-g~tN)Pxcbbj6bIls<(j5FZn&;m>Obopd5&6OaGd`@G7N_c(P-umq!Q{}bGX_y4}
z`Oj1-`9}YLN7Eazt<)hfPVjdCX>6Ks{?~tHzxOz_7f+p}7}g-Tg-$YR^s0gM!A9{e
z*d|ungn#T>SBf*FB5lh&9DU9Sd;gPrx5dX5ne0kpFlVCuKQZ=*0yj3;RH9u>|DAnv
zr#9L6xtQa87TwE#zhc!W1}|;RPfOb{g%eF5ct_R^@3FU#r#J=A3jZpBAU^6_TK*+-
zF-{sZNM{8?Dd}eo4YSP4F?wk1s=%kaK$*U6OqGlISV2kCf~>#&A<npiP0XGBFmjNm
zSD*O8YM%ZPNsjA>Lm-1P4XE3CNSSVEpV{jrE^4YFWGFtr$x3JDKUI`x^GUv_u<$rh
z?mqs{d<!fyzp<^%16~2&XqeW%FozipYt#SrFN@nW=IZZoNc^qew9~W}UwnEQI_yis
zo-Xeq{sv;;_|NI%{e4oEx1XICPs<ZHKRhqyqhjTHrz|LKPr3S-W{SJE<l~L^Sw{sO
zJx8z3y%+fV)~9Tl!<o;#_%FnU;;jM{a&zOQn_}G+ui!i!+i2r-ZN4>-l})wd{3|-j
zzTjI9vxP;WUE2X-)ztILe@cB*$xv`~C4I@Qs7Qj?wkp58+|T{$o_euUTHlX`AkqAh
z>q8r?#R9$N&uq#QN7R%Ylhv`OXG^P#iWa^Zo-m;J>KYusk#s}5)MV-hzE3&K^Do4t
zYA9RkKeCf8JGUb9^Q+lvo2NqCxE^nXILj{sHV!BYlp=Mn-fU4QtofWNY}R{Jc+To_
zrI&!!j$c%bV;_8e?`UqyAN%yd$7!H4(Mxt*yLB-BYtWw!pHc4$Ny?*_7pT#-fBGd^
z;e@b7)@~vIFCI^BQLYKZ3pqa4HB0pAd&Aoiz!VIQy04E9XZ{7Iij%d*Z^US9!dR)3
z$B$CjDmLh*Jk}Pv21|wJ)2}m_JNo40DDQdxU?aUi>R{aR`$9GIm7OLH3BpZUFR4D9
z7meMf{tjT?rC?+4O;QXMq^E{Mmltbxu;>yBIBtbQ6QH1rHK`6*8G{Oi2m#XgOqZws
zoW=dYc(#g>hLelTzHFS$Y4JB~X+y?gQqa`-;gejFQBmRFj+0(UB>f@OhZdA)GkW9~
zV=deYya-YptYkE9tYIugyzk4I)veVtYG1#6S>P1)-6@)RF{TZq2Q-h`{OfHvhIe9b
zV++{bRiV{^%D8F{3J0^Jzuy^w!4}S(^@4TMl~yq-20U;tyxZ42^(A9&Ys}fQjDZ1j
z^CE{>-1GTNb)0{cXC}B^N-gC@J)U0g+O_Cca;3MpbziC?bl8SD#zoY<hkU6+%>NJC
z84oKza1~xogL@AUGL+GMz@VA|z1u+@!@d1fL*_(QQ*NmM@kl2<I!-_N4Oz|0Y-tMt
z7lSLbbK3`(HaZ|jbM3kHns|cx?)ga(wf*V;4E_CA%`n7iA*Zw%mtdh~YN$0skAGuI
zOVI#T@7yoNZFC_OE$U%NOFNC}u>G4jOo=0qgF+8zI>q}TAKV^s%5E^!QV}-)y67ym
zSqbF(DkLPTX=;>!XJ9*5-xt70_)(0M&~p#a4xP8jwHlK*p7c*FlX&ovX?S#PcsXxY
zx$vc^z`IrProXqweQl{q;c;M)-3Un>q#9b!><dn7mN_Ea9AgY2kTjZgOH|Bfmwm6k
z2kd0kiIBZDp`AO)Z0TQVw&L^XEqP{}`uBvxN|>O|P(Y`rd`&1|A#B}+sF=!fR~ad3
z7cW79cunl5ER0L=WN;UYeaAY*dG)fO4hO@{6w1sPNh#Zi7Z8|<b>^B?FsF4QnLz%W
zj_*DFmq_~=4Bar@PfJ)MPN1nEj;(DIk!zq+Wu)U<0nz2AS?}}?83b(f%vZjq>MOi6
z$6dxC3EF)1%%Kw^8=J8ev|!1T_D^e`fq(V{r*-UpA^_oCXM|G4gia+4fzUXy2M*ch
z$^r3isrjY4GYGh%Y;7pV*WO!pSP;EwP+NDCjn(;2?q}6@p=2Mypg(E+E2y@U;YNw4
zdbFU^bQ;R+zV2Rj2G$S{iKf5T^?#N$@cIAR9;sujC(g0-T72@gdc;Jd@U_nwW%X{4
zdJz`9tqpjZr(|UlofV)m%n0wB28W5esG1eN$~CvHR0n^cr_z`K>?B2+X`~VC@-^_g
zc3DgI!h*%BUMM|pLiOaVurlM&@uq@YTx<5BaidU{T)R&lTy1TnW;^x*ZL5+IH4uuO
z6N-<J<f2A56sS?iT5GTI=a|Uo;4@MTiXxPi`@@|X2pOAPuJ;xB)fctYo`2e85ZbEg
z6F=!=afX%x!^J{qyr|QjpkI;sea^h$LYF25fjqI2x#<1G`F!B$Z=KPFxGyC%T3spz
zgY`c)rpM|d?#lxg_MA{Ah5$G`Awpr@PUnkf^@AQ9nxALY7Ij}dD#O1r=uSb+76M8N
zei;6C2S_%l_42mX+xN1n9}%%8LOQ?hPAz4<)aQpxY4cP3UN?^yXAsL^k`0pdgE;oZ
zt5N-uR%_Wj`=5Zu4kFb1#3cNV-e+LMbrW<?EZY_GqDZw#I+7dJR5I)?7D+1pUg9rV
zLNqmYI_5~-j_59SHj!srQ$v0#z=PGd3hMF?bZsmV%P&dp2MFnTs4zZW5MNYs;-`bz
zUlZ#;$ZWjz8>M9CWi3^#=B%<0i`DxSuN@O84;<X6?DW$-PPauMw9}ZHU^^iY8d2|&
zElPlGZide8zH~j8vE#1jvL4)NlvtKHrsyY5%v4HEJrnC63oaj&GYGW0csW^nCalKW
z?-2I5*1r`bC9GTRm3Q%(+5A!IqTG2GZ9vpE5OlaaR-_?EHxiy-W$>mp%Of3uJ(;`d
zDTb$eI_bjn)OI;yYW_VjGpnz}8S%`felnJoZFO>SDOP{~w@7kh$9d`NU2nDCEGbLf
z)#p2mfEbyOywt+OBY5)vCwrxd$o^E0HQIi@m<>=JDD;j;`aj3UQ-XuqzlHPjO-@an
zrWa^|wBs+>hNVT|txI4MbI+RGW$Y;M?!$=!R>9do3q}DD4u_Hm)yM+PCxtOzj*)*+
z9r5;Fs)dto=dQ3etO%Mh5#x$h{{5jEA_dUI?neZD^EK~<N>}X`Z*1=4zr3{9I*l#R
z^wB`t9KGr2tGt=j)hz<mtT7EWs!%4d*Ouwk+{*m--BmfOdtzMq=exUUTNiU#7fsmj
z9Wv-2?K&IfCRkP{GAemSydj(A+qHKJo+Oh`-nT#Uj`(G_S$p+veE6aS*t%$X<*mec
zn&nCi(Uuk#ww_9m7J$~J7fvwn^1Vf4-6>2OHs`dj?GR8t)2;Zibi9Vu*bLkqTa{K5
zs*BdgyFRR1{qg*BA-=@yW$E_Sch)jzmEO@q^Xn@#5N~AO=&NSV?*%Nl>^z#ihY{8H
zb<)>KkY=rGUS+1?B<V;0kq2wBNv;_=QEY%nvbJ$`d4hp_xMOMU5Y4jN>C?@JLRroC
zKPaor{)pIgQVGiwPFgCA?I}_2jySD(N0YP!MX5REn2u2$fkYO{T1||*8qr@yp|_7k
zwJ4U<?1zE42lU*f@E7!8uq<AGx2a88tj?z(lX!wz#R+0ChEGRiM`OKf<eWI2<^rRD
zYDSS4m8r=(pY(weLBEDn+rlqTO;zjfJMIW8)M)iNUzT6X`M%^pS?{-gz266o#~K3o
z_#Vb}$;Um4`TnJQYYv`Xnzt*@i0n;Qc;5QTH99osd7fNUm|wT1WBWqXQql1cHesZK
zZLU>2uSe99DZoZM*n}Xf$*7~u88*!xfA44ZW^#*vg?lscGSN47W|bRn4HnC50x7ND
z{ix$N7rXwUm5nJi!(w*>gUT7n?F=W?yPSwxh{YI*0-^vCahe1ONaT0a9=UK?NbGiJ
z`NPB#nfd>4h18(RIj5SkG5)p4Q6iN4j18ZC4XSD5*EY?sQF&hnAd60R1B7ewEt6~c
ztk+?{5Q2o{RhEyb4F?fwZFB=AHy^=rL@lHNy8$WMD@-BY&r!x-5EmU>(#|#q`CAnq
zwZpP%=;(vY&0XOeT`KA<gOWAy{6O*4xmy!cWM!&a4~>q4$T3tSJ>DO^wD0ienc3N)
z0Gs4|AeQ;3O9q2%56qtsHkvCSa=pwB>0c~_XO!(R7|;($zj29vQv*j$E@TDoIycI#
z8F;Js1ygU}#<$PE;AAr<qVqxwqoTF90REThVgiFfJ*VJ99gPh*8~AZ+WHs8sn3wd7
z1nEQuqd-_F>y*w5wXnH5f|A16fK1$nod^`;qP+_Xbfv^q0lxm=dr(Ee2Fp;(U)1>+
zFPPtIrkfMZC$I@Yp%B9AYkNre+1u7RC<ZF;PT#m?cN6MUJdY)r5|ECusRx|ZS&?s@
z=c0PVFvLn^MNE`HV){*?r5A8c`s=kcSME9YHmE=s77ugW2`nfuDh=wDjx1piV8+U#
z1iINI)LWRJs1ZXDfqf$s>xws&9ZVYv6sU=4%AUR!j3K3yI=+>ie*uTXjC~EWJ7%Yn
zi4<Z;4kCOP&Uz)HLnJ-7=fSdBQ-NSp9m^hXTd0BY<9r5&lXs4wAEzgFQ%d7>vT*uA
zfLv=9@FMnb1%iyENKB$H|BKh(HT3pjsv&I1fd=Y(qloY%cH#6zJ)N}_So(0)P{<#;
zFl(p2iy%9(wjE!M9!bFH(7JaKg-qaK1Z_RW65YtcA_Y6dUJTrF5rOvaHvVQBcA{1A
zIPntuR#1doY}Q>erT5^b0F}~0AoU}%#EQU_l6GLM^}aP>q4VMlLgZ@6T__Kw5Ii6<
zS~_y*=PtO9kNqzS%XPnC8orW4>%8O^mS+0eiw6>&Fk-rDlYCNx7jLGaCu%c2gFM`v
zLMKE9Gm6eo`GiIol;*Bh*gfL@UnFLp%sh5Bw(WAQ%-5fo>#T6fT8xytFk6x3Nu9Ur
z(n&iZA)a9n*uN_*|G0=Jc%azY{rL4OfY$l|GD4IhGH)fuK->~B0YzLKMXP=@(-f;`
z@$`SY38BJiH5|Vxcp{fVo#!bXg?&!zXX92O!4n$XH+FwOro=xhrXYi}Z(L-OfAgsB
z#3oJZ=Wcf?G_)SADoYB3OV3S%*A{{U_i@|WYzCuRYkMhtDy(cMMnGs!IGj;bZ0`IJ
z9bZjURlfueLCa<@@NOqTaUN4s7^f4+L;hytriYKx^u$DjsoW;@oi#W?voJRR+xjLx
zxPF`_RbuewA9D;W(|1T?9lj0E|0!iqKkLum#x+j?Zc$jO&!PCii_t>yS;98<$kC`%
z2_sSUOk!FuRm|q#v3T1iHy#fVNAodw1Q3+wECt){BhFz(B4H+R?b@{jOU@MPS3Z%V
zYT6p(;RXtb!#IHCA*S6YG?1QS*DmLJp(bce$~@bDr)&*N?LPREN~02kX)aQSc*8)+
zF8G)AZPe=#g@$cyYuMVyB(jtL?ZfZdG`oXH`8hL_w>2w(pDpm?(%KBpPYXzESk<pU
z25xZfoX1HRG7?!YZ3_`10wg%@^dt4?qn;ABU*hSN5S?!h5y)9MCGai}p=2<ca8Vrm
z&+$cq56p`YVZ<*${qpvoO1N_JyH^ZvEIU%MI*h_BkLP$g`n<X*NP7KYD=x!)9Q7mU
zNB0ms@SmK+7658UHFou1G*5VIdr?<A!sD>_rHP}8h0cmh>wNCsRQ%j$iFu@-q!ZO_
zzl~+)w*#RsVq>7+D9F|f;<z9{da!`y(p=fX_8*0v5oXy3u=*FvKry0nAIF_F7(+Iq
zF6aNc>+q+08)53vEN=h?3qJ*=hvJ-mC=HoJl>7nB%pvJ{b;K}P8g-7wS@-V^T~>!S
zVw2aE96o4yC(e2qh^DJr8+EpULV*|$Oc;0vcBpfL#yz$v!~V=C;}VoOdrT-k(_@KA
zNRqLE-rO7H>0OYcs72Rb1rkPS>Mh38i4n(jdVs^bEY6XHExFX@C)i%5E|y&BVU~>4
z-aojcmR4jAx49&?5Fh25vk34yA1C4bHR^OHjwn9PxN8x|I*b&vu?av~s()bRi(ok0
z2w|hn@w8Lz|CnU?g+sfAkhT??$X>x!Glw89YT~~zOHN`t+a`5-1D#zuBGU6nAhagH
zi&(>N(E&MOll4<c1n;Tv#SFHPZMW$qM{qpM@I5UWTMnGl&nu@Wt!@VCZ!YO~kWEk?
zYbv(HXmS=ThvlC*<!ZVMhAMy;a0glkL@ho_)TNmnLuD-iz#<;w4->o%ZgJ2PDJ86&
zA|@j~z#J-sXvY1dEd<yw7U?9lJ*m6M%GpKc@W^|j6jPMVey&J=eUMQgNF=m7JQ164
z$_i8o243Q6((;{eh#d^Qz3}0v&)#DcmDU<2RCg^Zedfa97RcGD6l38WYIzv7X&{0v
z<G={wpKTnpHqAGv8LPdwWQ2Y$dDgg_$Id3#&1~rw#hmzX%mmoT6{24G8{#|l8@CW~
zmK7(nv?hiri49f9yVy@_{D-rumje5<f9OgPCJWVPSwSApQ@&3hbww(|2uZ(}h#+t+
zTq&Wg46&Um?rRL!FG}~3{BtM&Lhb(^N7LajOETT;SxT84Ct(u#JF1#=|HkgK!bauZ
zzal$(iC>IIIss6+I41SCdgD-+=T00&;7P~8ezc9y#wqG|z-y{pmCIynT_&@ABJQS-
zIL$p&S|_c?mckaKWlLD^aq{t*KWZIM`r6yeLcAhNN7Blwp>b#6-Knl@_0Wc=mXgq=
z*e*9tNjPO!4;YYZwnDw54U4U-Wc+F->+sq1juDMNNmmtlS$?d<b^5`Dv<EAEO<bz|
zxU+Z!e~UN0)P-M|&FmS8!L;k~WB8Wb&6Wy>H(X~1Mn*D!u3rnT9w+}A`|AJnkTB^A
zquj^oXXzXQyN7QW>wVfCuP@oC8JszBLwLxFiADJOPSzc?8X|}GWzJsUo7KBUsN2g{
zoDhBiSpL#yY6QbqcpM%a<X3v&a_n<P;gLIoOOsy=d;5E2Z6%eI1`m%1=&Ej<Xe#&{
zt526|SLrGvs3_MM(!)&TPKHIayq;L*?($swl4UraTAS3=*m&mj-fbyxvfjy^<a_Y(
za`m@z7bJ!$L90y(X_5Xq{YYj%t#o_@Gk&0v*w|QE_cBwZkQhKz9FYm=`-#)zR;TeU
ztDv}Mn^x%mEVw<pSg3fA0?xK$$BqZUj2Ohm#RU~Vd-nYtE^U<uA9<$Ar{CvJDng(G
zfeXcj`mL=zymEhn9n%aJcxNzEPJt(>gsj})*^gWIk2KQ^gpb}>$?@qO?$`Si?8Hi|
z4XsCvQTbJSA?e|=?qh;ny#oW)uq-daRyhg{R;9ma?AKrZgI!%a)$S@t(^KzHl_a)H
zG!UntzdB2*ymIkDu>qA8dBW-7>Jm0c!N!wV+q{mMEI(QpC`K3i2C8LBjz`t#>Utuf
z1%@Q^6G^7JJPfodl{=PH9|k`>=+r$+@#IhiC<MhssB+N0DcDVK4$ITKRKLLb`ASn(
z+F;`1YBj%Be@DqCcvOF4BwP889B-dPH8hZZGCrC8vGxfoCgk8+k#9jz8V>W6AI|z$
z;#s-H#fu?vadEHEml}vHIJeGon8b}jO?z#!ya--DZ+rV6TZrh*L{8C`>$~?-5;Ff`
z4T=tmWl4GFQd0plafP0UcKu8@m)05-ktjt$H6D8Ku><PzlTN+KjbsZgIUf4jkH`l&
z(dFrgtEgbId=)AI3cLVbH7n+0Ph;1ldy82hD^WA+dW<Dl%ci@iX_qwq<l7C-qyQWa
zP0V%tsjcq@zwD-Wu^ijn;Fg`4RNB{k$60<hWXgYVm5=6$G}9qqCLJ_2-{*m(Q>O6_
zudI@P>su<lnEiG+u8>Oe^M-w6BWAJhoncr?P^Zs7HpQ@0RZHNm0dlg&lgEqfbMhX+
zV7QmK9NF`0Ov};i%_b?!dD^2GjT!<z%Z92|QTg#1{xOA?dz5gbu$;)Pm&OR92$<6!
zz5~EpoW#4nM1!&@%(4GJq8rbwwb2QigX94ASN45B<2p}hoYL5x$^xP>OM3f{80ZTF
z6ds?kpdG5V>kVciEIF&EHpfKVW@mCPzLSuM96{lfRxv?8O-Gg2cmX8MK|U2T?Na%d
zvhi=6drq=j-|SAwVfTALH1jm%$4gmMbJaT7oS}SXOgsGKfWvHYI_Pimr%alu&hf_X
ziOpxnR)hNfp3r;c?RYTBtlDR8cpV#9cOs=_e7@E8KqB|>4k@$pKk_!!>W(T;pFbae
zGBFAPpcl9pC+6JoGIip4;_Dn3Soit!c{0v=A8*4hI~gZe*Ns7FpbG?&npKg)%Ne=!
zo(i6RjxfuOCtY{gh}+akf~l=|Cb|%fm3QshbQN*sLFdC*{TDtJX)c*+c-8#(b5(E?
z%Xgf6A4JK}X^qCF&c<wWQtZqoeI{3Cq6}S#*b_aQdY~0H1qs2wDrY&X2@KLqquwU;
zU3=n^ITbO_3JAdHYETLEEz!j%%W`{dBUf&ADqb8rm#S!=Q)DxyhEx5Dp<#Tu^9QFE
zvUL3g;Xa>aU5ybuFFS6~%%?sdP-HqL#Z<Rb@2dD1TtkwvI=to<7K5;aW!F*8548Bl
z<`!dMQ|}%U{<(M>K!PXIp<~*5JxQJ?Vl<7`rzn&Vn{|%^iG4Q`H_*Yk#Ds+~6|Dhr
zm5Femd$wbe#D8v%z;GSaXi8jhu~E&o8{}aaTEM^{K1ybX#<P;N^g9GebA#`=as&D3
zQyK1H2fVtD0l8dOUn4$%L3S8WUf!ogk{}H<>B7_eu=MQUQt<TZ`ewr7PUD_*(&kS+
zot<8eeW~drzuh`c=V*vyqe}F3chfw6Y#`)9)$ceP-igV;!5M*6UF|!5IximJb9W;(
zJg+`MD9!EPxl~UV@WpjC8nkQn0Dg3A|AWIa4?aHH^<|K;j#cM{F9y==BdK@{amYU6
zdc1ldrm9=gO)|9CrDAFYA%8*H2r1MPS)e0e?d0RE`4_ZzOD~6;;Sx$GTYrE58rq=~
z#C8?s?dlQ1Vin{EZDC=XzkL1bP}pfpbp<8rt`K(dCN5>Ia=M$`!?%xW-qruPs?l*V
zaxTp!Wd|}$sfWV56*nJ2<<!jCj{5L4!Ic{7a4gylo5EMnXZYxGhH;bht;zplVP=O?
zs`K97SsA^Z&w&;ZAesuqS&-ve1n>WYW*gX=koar*>A?4`huG%C@+vQ>%#&qR@J1&=
z`3@?clj7r`3yy)|<GwMFz9_3)S7f$XsUBn*dY|ga&hW;>S2d+;q&_N%GwhqNpz$5y
zBzHW_3O3{fd6XWyR0_Lwgf|I_!Zn{w`s;6Mj`Q@LG}DrNeI=T;G~vR~EW5~wWE~N~
z)U~q;+W16h$C5~Wh=+|&T=CZU^A3}|I7#Ee<0Zw#e?g`broSErDTyJzsfQ69)OMa`
z-XEoV`CMBc5YZ@l99c5y37!U#O?TCwiYZVH-M-DRnL*-<Fs+k3F&&{+M-HYr0_RmE
zO>aY*VvlfnevHefVY+Ri4tg~#A-9d0nb@YRB7JiU3Vusa)Q=3r6I`cX)Xfzia>dH`
zm3^mNF0gc;*`3OOwal;rbE+SmhMc*hvu|=db%-<*yCvuKi0StkkzKuhX*-A^d>T42
z0WyP-LLW+}z=KI^jH!`*)iVvNgF=FLBD83HR(?EB=_J$#mw18kt>@(R^p&(78~FYE
zw*!&qY(Glop&r7Kql(ln2sx{9`li4cHq9kk8cl6i15}-)Y;fOvB}gDX2+tV&{Mp^)
z{CLUKjm#{Ch>3&g9a4$D{Ddx5_tx4qav#G`DRM%hViu=P5la^nb_a8BJ>zAQTK;an
zt~%naXREp;e~nY5UVXxiv{4&rS>*C&T~+MYy~!dY>qw+g{bG;bIn};F^#twM@Z>S&
zDC1pWdVhwVWaa1UX|o7f8W{|5&g&AZxGse7zbH4jUB~R)BT|NcU+OMOgqH?q*pcm5
zDsq!fJa4bTerxc<_`DQ2`6k;l>`b?@u>YKx@KMBdka&ErB;-e<7%&PEciu_|h&OWY
zKGFOx`oI;nSBPw`psQkLO4)todHd(j!&If~Yq{a9>Xj*8H{%?ieEM?G$-zM%`xj@H
z>q8Ale$LO$b#Y;(b=@I_w5}x`P-A43x+_n<7D#o4g81WZ`mvjqK3uZkC#)40ZN>QF
zs2WHKtzniv7!ZX6sW3t~JxP71)fSaP&ARyKk1562ZWDP}4P{C^i4=g<;;Ncn>6?L{
z=XLdTXEwkqd7vT3QY#cC6Fpge=3r74e;sYBX4qDn#>Pe_hAOIQRMqrW<aA=caJmcP
z3heP{a1`g9R3P>ytbDnApo}f)dc(3-E$vZOpX5WL4^?063^A(k%2EHe#ruec3UQUk
zG>ug`l-$Q3TW85BDyXmVj$Fx5dq<;?p*D+1MhC({OcH0I!}~4G6oX$*65!mVIOOc4
zz+t=G98rQ85!xV6=drhOrFTF)dZ+!zAE|M2BD=1$K_$y@uvC$_7{<KQCJA1`%zkji
zI0%Yr3&`}_+@^kZ%|qsA(I=C_jp5N^Kacn1h{eQP6_Zr2V)b2dM~~f(m#?SQptU;1
z)5l~4Dbw7fweTauyj1DVwM~M4HzNvAk7{YKXe`9sC>-$N-#!)ZoURqc<>|&5mQ~cL
zCgvpQS`6CLF~^+3&Q<EO>FMcA1Zoqiga-0F5pX*(SobEa<sRlgybbw-AZVsQQg~FO
zi!bm`+o%RfYJC8oQGI0Xy+B2Gam<7Wh18C=_8exh2;KOPO1iG_hzx;DgpCyE-h&}3
zu!Apdl0M8-w`u{Q0&?ffkFs|7CYOXe_g2Wx^9s|}D;;<}d!@l<=+W7m`!5m~c2#ZH
zbzb5M!J#rDMPaGK1#9v|I$D*X(?U~^C9HIu#aXre&8OIli&!wd?f2@9qCy1IYeSKu
zxCkdAqTX38x2Rf`>;4rn*<clvB}6S}8u8@iOHn-a)sTq0X<Vg|ZGG)raWjJNMNW<i
zb;zx-NIA&2kad|CF)@qhL;Buv<+wA?b&qu91ZDZ3kGN-f@q>uC+gJPN&51zZ8s3TP
zeIYL=ci~3HSN8wiF{hg3rKNW;;2l3%)R_WfqOqW2iCw7-;urqd=<2qjv)@3FbZ-gf
z^gXzZvWkknU?z9o%@>N=b0>{E-k%tCFH2!-1G&64U@*ni$iQ4glVII+#~f2qc%0$^
zq6h~op_lTT!D!V0hA#^MpBjM3#l!4BQZwYp>oI<3$C9JxNy*6cblv(Vt&!v=w&suh
zpFh7vIH7ffu}a#n;mt(qk88$w5<N66EG(j&dxH&h0^!F{N{f4RPgTNJ@H6VFDZ1E1
zJtHG~+4+;mM;1!GMF=xr=V{p0jD$k>8zwjIR8;yUmq2dKN0gn~FMIxN@g>WHNmI0+
zjL_+up+ZhZM1@J5ryo9eR-~ugxs&VcwQ3Oi1r7A~tHeeGfoI(UV;>7q>YXVfnBZ%_
z9q8xJpMP6B={(v=XKaZUiAk{h9p`)!0@?rZ|F~MtSUcTTeZH+MHI)$IYYg$RU}@WP
zNnvigBu&GI`O2Lk*JNBb*ZNtJgQ7<wz069UmzRIVqsI^_W0jiwB~PPQ{`)b0!GhFx
z&XbWc$ueV=xH*dI3^JujmojNhdILNzn3*{P-<XS-4a{YJ=i*?MO*~9@1fy$KB2p%}
z%lLuJ*gP@qX%<gp3LpEUHe3L5IWJqYl!(Z#Iq$(@XGf^6*G3v*Hp1|tT7aMb-gr{z
zPM(t6N#7GEKDMH>ZXBOa`St6Usey@!KVY6d;9JUv=)TYCI3^+?5h$P1s&-l<oJhzd
ziF%uP?+Uqs5C$ol%r@gZmOAO@q@Udxj}@r(Lb6_sPU-}xRuS9X6)wcR*Z6a;%afmL
z+N03kLE161OQs-cwv8fyw4xe<N;vvpeFy8k!7pD%@eJ@9;UhzFx^7^GKxcCT@RdTl
z?weFkD5WDrADhnFt<~60_mvGI_-rH8x!2n+ColKqOT}kJMe;G~Czq;->Bmam)9*37
zM&GopWS3R73i=ealET98`439=-Zo>{sk_I}%#3$~nfx*{vve#{wq^M$XBZ=gr0Md3
z;sYaZS6|?33F|0`4MGfF^VlqXRIwfuK<H!~)5d+rMbbalC)|mWiMY|5X+5oze*P8~
z^XQ8nZWl@rl@vy<&x7N8uUg*zb<fes=~-^BB+BVLwzl&*3rj?HO!?8&tgI$)9^31k
ze+{h246XAm>T-)8mexFOWeyf(-}D%7$w8tMZL#|~`^Xm&uWxGW7K~Ue7T<0-^b!YQ
zAo<^Jw)AV)Wa=`qvz?MV%R>|EP>X*DT{LP$K@G&L9&Um|%Dit7$%W5k#%jcyM5*pZ
z7yFvDJopxLDlu`&F7kI0xzYj~n(oX^J)xEguttaq{)E8&!vcIlB7i4S&vLSzeu#;4
z<nR(yAF4e2DsGG@uz&vXXUC7Le#}Jng?zz5G(b)mKXHWIO|+!}oH;ieG4zbvT^KOo
zcCaG%wDAnQu-n+-%6>>*{>5&3zTe8O`3P>pxHORZX87LCZOX_2{4x?L<1L!rB3B<7
zwRjTv1Nk<eK=znp%yn1x?{MOfc6R1*-aZjppK#xf%-!(DZO(M+-e7NWl_6(XQVw_R
z(>8CRpjo*N#ly_E6MT&hB#H~Arfr^DC5<SI*N>b_^v#swXiiq~Kd%=P!j`DumU`>J
zzY>H*tR}8#lffud>@AijF2C+6-c3J!YVS57G^BZ!?Q@*0U#2_=0Crs8v2X+qvJgmM
zoqsa!ThnPAti)8;o>(TOYFJTTUI{_TVDXe}z~IISXmK{cw-dq?CJuVWL3~0Vpi9`f
z+hGT9AwzU=YfSm+louq$M$Y-2PJYW?@%leG2@ARUK5RBvUKw5a8~uJfQO1TT)qL|F
z&N^r9lxETNh(tAue>QlhO0O!e6)7A7nbOU-*K{z|`Cr0_!Xgce@?E-%g`Mn$o#$?S
z*hC;*iTukkr+@ji-sk#_@YLkJ(IaxGtt{paP==MdC_MvNX=~`DUuS2NvDsDYbbE9X
z27Yt>%E+13rEPjpS)Y4l-{L6XRjTlMIj3a6ZwebuU7E9eYjN9qU$oXhFmkK=<D_sX
ztJ2pqgYLYZ8@#0gckWaFz!|R@J<^9U_D4%j=Br9k#xHi_-R%b;l(NG?T6+q&Re5TD
zlRve>7jT_@le-$pH4PcudDrr@-cL$R`}KVOyiIG;2Yc6kyWT~kdd|GeBvIM<A_O$X
zAgb9{S7o8Yr0v2fY)pJ0A(-agw{PDeOr{P&RcIPwX?%Owtx!h<)!?>+2M@YPG`X94
z1B0;@&uj`DaC&$v42|MExn+aja(d);md8XaQ>t!!q9zkps1fxBoM?4Mk$D}Nod`gr
zOxGc&?kmBS&2`!BOyy<#xk;kzdeE@uL`O5LJw7vtv^UAUsgWZJNO@tFt`B(6*&fwg
zansdcAXW1YqA)PeEAK4Gj=@%}fv2HNj;T%vr3_n}8TlV)$e>I2tEbP=VaOU!dSInn
z^MR}@madafCPGi$Os>%q_|~U~l^w)EfzgTa_%F96?%VM!rChrfH*wAR$IqYo7zkHE
z=5;x;Y|p*peF!z0s!vd3Z}Z!p!Ma-M+?xiOyFC^F!CIE&4XL-%%00zXl<$?>iqAl2
zif#y#ujI_^Y}0ML{&nPfPT8PLE7J~!(zrx<w#O;}#6?+hs&3vLp6a16t&ZtpGg1At
zC<yP2+2)~EjY5`?!R6|W%c?0B+hcbz8#mPY(qn3~j!EVNl70!Y;bz#vz8xd>i>14K
ze|z<!H+4woUkRsmvjdnH@o<NIE5MLZOQ7w`tDK-VRpIpkkHU2+uvbqxn(>Eyt3fGE
zmr=OVp0a**3)>fntg|3rJIGWAKpWJsG9D^yfhR=dCE+TH;#FE~PW5#5in=wawA|-{
zl0SI4j$cwBH3rIaQ_e7{P)q0zQ2JZsEJ(p`az<lg$HHFvq=yeXu=NbEhu6RoMWJ-8
zjtZ=(f8Pxqo*r>~r}ILH%Jed_%jy&In6n?P@EcF&v9rNz)B9%CYqs>qn+Dg+-O2;c
z$^TxC`zGr<n4=QdL;iQj>eRm@?wKQ2Bz;waga#IXwj0>*Kf0>8HTwQRthYr%V(<pU
zbRMnyV#PRlv~a5;SB)Ci&6SawO;1kYo@KiyGxpG~tcF;o3YmfR<s=M0m&Q&emNm~S
zv+99()Rd5jM>#!u<dkgvKkAS?l8#9F8HT#qF?{+4;0u3+PPG7XdOkU?U)`wnJv6Se
z$_8`PZh+i8vw}uAt2A9N!u#l>Stm<q1b8*alSG1oOIKbGvdk4tk<Oi2xqwyJd|~?;
z50|phxc|CunP5?VN&D*$lib8I+9N0CPGX=KsXnw|ftssG{G?{$O*SD$Skcvl=&zrP
zu-g~XggH`Gv9nYG98ZK6Dpp2}JMC~bzSfj@T`WqrK3{3EP55daAFC&eZF<Lhe4PSu
zF}9LlIC<ysdvC##_6*hnRi}roU**thqX-%tn_t<G5D{5vwL9}gpuzHhhkHc1le60U
z5u00y8^gW>!}sssceTrr)hMjx^w8oAb0+GI;;gmJs?}0S#?On^lk|Uz2>KltStyqo
z`wo89cNy~GOObkd`)7t_CQsP#iOT402|3VIz(k2m4L+38YO(3bc@a-KS$_C*66+Jf
zsUjsBIbgxk=u=UAIDH!z+*<PZV|9(mqRuXe%oZmy*7p-a1ic|@6hocB$OvP^nv0Sf
z9&M7onb?XG>%xvNQ$AMY#~Oc>dW%y!jZ4_tsxhGl#io?7o2|P!vC-(+AFk4>go6U9
ziW8R)tW+RIG{oA-mc30DqC?8Ao%RXllo$g#pWqCGK0jW(seJ#v<5z{#jlpo(O@9X2
zT2q@C%xpnJF34{FP4zCXA*UT<J0rfZZz&Q@ijj#Mmm^=u*MCp_QFi{k;pQXIm1HHX
zjA(Qu<21u6fY*3Zjk*-oiY)FnzqAnt%?A0PSsQJmWGVvxudb}eo)Dp;PQ(2VKBjA2
zWnojn#7*0@tDkVv;kF1^ADj2hDN25;*E#l0qd|%9t@NzBl~o$$r?-w=$wlC&To^C$
z3DKZ>sV|O!0ed^*B_3y2Y(FsZ4A$2%Q`fiyhQ4A_bC7I{4sWxE+3n^$nTVg}eQ#UP
zViba*FHa6|liT~`GbcO7#w4-ypgdB+jok`8p8eIrmWJK<+L)3a<qWepr*jjwSJW)2
z;h{7Vif#t|xI?rPebe<tKi>THjlf;mZprC)l=VAC3jt5`$uF0Eb_7a|j2v3_aVgHi
z5pf<5?R<TLqj=L-n%c+JGhM9rZmGs|UUeerH{Q-Gfh@g+t<4CHY${0+SYpZlbR?n{
zn<+(mI)M;&<>p?SaXHtAY!~m8NoC&MIfR-E9XK7BetTpo#8Q*_vF3`J7cWjg{GtM7
zMh)XdFTr~g7stdBRt{nJlX9@$^u)~<mFr3mKK3D^%U9!SW@mX_LAE4OV?9=Zo!CC%
z0E_8)<rzi|x%PtWea4e#Y=B|+=C)dYT~^j}eE;P+b9*PJj=AkA@AI_V&wOs#c7Y~|
z?<-C+9>6fC|G`jf+Sbug_+{V%h`>i*wOdT!GFrNb2LDZo8;@;){>#stulHByH)P0s
ztasz-<&<Tsr4=l=Wmh$`nuiVEB8Nm1an{5{36J3~IE&rj;#oWLR7`{|s>SBDSeS7z
zX6ElOTMUaBxPT>T67<?|D_)9GS@co;drxG&Z4aT0+WfPIpiE9)o)jp69JZa3eEuKi
zyzmNCNh@sm!U{e4*JC0Gd|EaAcL~Q&nRBmfq|ElPZytJ%lizpK-={pqY3~)dSX9x%
z+Z#{HW4)7=A4_gQUgEyMz(9Y8oGuAuXf!Whu**SOgi!%kQu!%&jLMj6`Q#lsULLh-
z6vbcrB@yYeiLg|ByiOM)f<J#1ql_>dwhVQzF8!HkYh`f|5F|_?@^Zkh&Yh)yXO78m
z|5;C!<)ItiQW6sVuR$spk3y2>w=aekQL@`v3gakii2E`&<uVzoMP245Djf%oO)c3e
zv01zG0SPKhOb!OjH^&>~nLn=k)ZkS(?)$*0H}|Yg72ji;q^dm9*QyESy@V;Aem!$@
z)%Tq9_b1B(+uUB^-5&tiuzPu>H8|)r!u5=NeOE}}1plYkHPgJ<147ox`e@#YaG8v^
z#Z!lFR~v@DRp`t|$;6I)g@w5W{+V6FN>7P|QXaxuqwru-bG5!{3pknDGV{-dXSNX_
zfG+~HsPex3;8u>uG5!bUx!b%I2f}G~O|TsPemBs)>`~2N&}x;!`ThO4d1Q*6ftm$A
z&UtU@04#qg^Y6=;JMi_Mhg))TOfh1k1j(waIQA-0ZyKZ@DmuERZwD#L>I;Ac|8a(`
z0v7ffpYJz=<JbHUoG_hE;sQ(|MdGWF>p2UH8f{iuJm3Fm&U>80<G@bbE~bedA&I1C
zyzi=6_6H=-Vj5j*RBPh04|9HbY3@s0`YCp5RmRZP#+};#oXct;vf7ZQOVTDe4jxlT
ze6qFMydj}IT_Wy?E@lw4*A+nqtGE%5LwKdDyPizS4R_sHTnH)Mgqaa<@~QnMu+tsF
z$*&8oMb#nMcnpZDaZ!!FX{gS~usPIQ>`gc8&?bKkGYFO^t)Bfs+pBG@iAAQmD<C5J
zc6nOxR$2_Np_=k(DoD0~0fR%9%s3~>rO+@kQ~v^hl?VDi0U^|t5EC=`n`N;k+Rb)M
zv)Hije$elaLMgdLs+EO>e;&bb@MiF@&|r^Wi^53cJb0P^gHqcj`(|9S(O^09{>)xg
zNhoH=em6-ON>$FjO~Qj5P8pKvvP?Jc3-#G>%Ky*%WRGe1$Jxr9fsf;ZSz_yFS8bl<
zIsaIgI(kIl%_qETGZ-<j&vCa^js&9L6F5u%s`&gT=>`MKc|Vr2Ji5TRFe8^|z5KSb
zK}k=GEg8qZR}9>_tevyE))&SW@p^&fhsuXp<-R5VXR9`bm3w%mm0p>R9}CDvEp7>O
z<QDw%?797)&!+T5m$%W!_3Uc#m~$0(pvpL>t5QVa<oz4JzKQWSn2{0TY*XT0cLgSK
zPCdI_aLYBm^pPxn@=AEA=JUXfy31(w^1`ox;gJFaaKjEM^&NT3b5WF>>fJ*sE6yCl
zDzC-*_B#Er>A86B$U-rr@1O0Fx8rtQIOyj(%Rcb5vnYMRqit2rZbjm><Le^p;^Kj)
zOw8gVaU;WP=l*@Y(zHWL>Aok2Yuy!3Ny&KBkd~1vEIA8-*h8qIY<xoUqrItNJE%n>
zTo^~UdOD3L?(9mEc~`vEPmwEyX6Ev$USVHvr)-B0*|O#1n@Mh$iju2AFD1n1&vdFR
z2Mp--zABmz+S{~sVC)i28QtbDu9;RAmAP-MopX|JsIhMZml~uEJAR3q<%r|{x$rc1
zU$46gmubt;yj^K+;j-tsKY!z@kL{6goxjb7ipPF?c{C{T2g7;>Z?rU*GS7KFSw8yp
zN>^2LeJ;yu@|pHchX4F;8$Vy^G;wu?Sv8Sy=oKt}O386oFY+u#Gh7-Ju(9DXrEn+P
z`}&-U&zGc@&xo@ygtA_G=k+(#rkiBvq+n9f*7J3|r1)2-s@n3}y=+%)iE~aLG%g(@
z&7CQBdp60F`{>$es*C9cv|4nUTarXc`e;*<6N5q3vDig=WNoszR#8UoRJHiGbUZFt
zs8{~J)zX=!fzICpKm3Xpp1v<8Rpm4}*_)YUjSnqp7nt={Ozl~VW(lg5yTA5IV!ZA6
zq|E)+t*d^@JJ>=zVe@%MZX#x}BT@&nXyKoa(D>}}c(&m{HqZ1x_S*YzW_GNFxj6f@
zSL_d>Kl|@1n!ajngv<8z{d;@GQ;hEz-@d!NFJ(071-x`B)UQaW9vS|jiI2HEVZn9j
z-eb|jK#{MpS<rz(03pl59LmS#_j!zSGm_IUD3@o?%oyVQoFUq@*gW*n1ipwEr4t9;
zsB0}b2LR8f=o(ZodMZq}dxT{a9!|I0&b>9n?8xWOpM^&9zqZ{7m1q&)jfVP$*;A9!
z<snOo4)e|Jh92x>OFD84=;vl`r6n>B%nTigc+AG)kPaKtfWDyOGxU!vI5vKMflVxI
zaQsxiX~NW9l72IhESSn)2^{dpiK%Pl_Bmp}U)qW{`N_faQiG%dS<qrnjyw&(U8++*
z&LH4rv(0p-+-rqD0V;iV-4o~Ka-ygibYFNso$4Kpd4DESD<R;@v!+{S?N@Hm-DFLY
zCi)OK-Cv)eOX<G%{2gFw6kJaZjvrnabZ?Tl6E9)n6{`O;4VEhIk=zmdDYTf~N6iNg
zhFX4zv*yLJvKd`B#rSxoZI|sMnS2y0c!5IO7R;wDZ?Y=!mKpVUR$7c?4BT0$?w#yz
z8?AA*>JDX9kI3O{bM07dGYiP{tZ$cYPEp%H;9}B^-I+pyH|-iVa*Fl~V)DYlX2vqa
zQqt#shdbCjWB9B5t5fgyt)KpoFlnakX5cuY&?1yrW|I=QSoYhjdiT`q?gG5tU!jJv
zB<jO0yW23=`UTmzbai(2uVWg|R9gM_LdE}){087N4>PP4!lxMRy#E|@@)Cz~E1zHn
zOv&(QdG56EoN^r<p&-jt2hvxs(pkAYcMU3OjMV5Hb9NHT=ME+XUJ}}6h2hBzU42G=
z_l*a)+eDr}I<T<V>l*xHtyHVt*Kl(TI~_w#FIjmXL*%XyEz3t<AIL~~1{X#XX$)0(
z`?N{=hzjl6Z2yKs{g=k~>xJ`s2&lUp&dX_)&1TgFD6<6yk2c26$wXEhkGlN#$vx%I
z`-lW3Zx?Im(+ehKZ&cVa|JQl9eOcq2;|1<RE|r*()7{F{bnKT7{QKvAK|w(=IuBa{
z5h&(F3)PjD$-J6m&WwNeTyD7Y*j|;(@SnBatUD^7`Wp*gneycegu+n~PkX&xCX>0v
zIg`9jCsTNpH+7zExO8&W)v-NfYY|I{S4-4YuFT<r;rU7($F<Wrp2|DNY|foJ9GymW
z#PPAHgv45g{!1zXNr`eklJm}o>-QuIx|WV8`EVB-bRN$je>F}tQA`QTsv8QdPM<&e
zFeJ2l;hk0fNbN)7BGCQ*_Bj^HQ-$p=Dr<k*m!j$~)g%qNIiU2#!zY^jP;8o-Pq)mo
z%gj3wd7!=3_-Jfw3;QP6TfC#;Mj>Nir?E)-#mJ+WfG^`iIYNjRickK+BDZb$;+XeT
zjLh#!1NwYVd`RA<%4mX|Fkn?5>AN?+DN4#AeUbQsPr<qE3Sr%HQj<gcjmz~)$#f6X
zTA74g<i(pt-47X_Ki_e&{a*!*?whm&w^JgrQoES`UwhyEPj&mp|F(CCBAa9-915A?
zNJcVBR;ZJckrm1wS%-`UA)6FsXJ^Y%9HE4=$p{(AUf<WbKll9~d>`MRzV{D3x_gv!
z&ih=~>v~<!*K;5e98_<CG1vu(?$#XyUdD%+%G3`vg!NOs7PeNW;(#XR3tFu-)T^6|
zgQcA$ewL!=iotzfQcN-6sHzn2Zxj6a_90g$8Oh<2o2`S{P6#cDtI{1Ow;K^xJ;XQQ
zTeWml$>2T4ODE7lHb*A4WlDc+kv{#IuVeeIcik7)2aVFGX1sa)#G@+xb-&WJb+%8I
z5;VBK7AAycdotR)e%D-(K^}Kb^MFmZ3`_=tf)}e-?<YY&oC$kHKmbGgK;=NT&%Y^C
z@O;~@LuP?pz_eFNxMG84c{=mu>#};>T32T>yN{fU^RL@8SU;<|?DEU+F+Y>~;tuFD
zwP6OufKPHUe|`?;r|%+hFm)L%OywtMEgB-$GMs$+Z0!~!Go<oxHR;)WJ!^$eQj&pt
z%_v|UFslvtGBo6C1av{Epzm~S5_?%jZz6D+@#?E%iaT*e4tzbw)o~M-9(~XUg}XMO
zgQft*ZUID~=w4&#38)a!=nnYP3rK4Er`tLtM1UyUX~^f-m)v3oF>I#dI?!Gq8sZ{w
z9SVMQyrBsyDlFVD>EG!_pXF_`zA?~6q(Z?;F&glcLwCNx<1dP(3$(hWN(;RBKq#&$
z;-qQ^nKzN^QYyz>L)f#CO;L7+i3QQ;z79BZ-V%w5XHvRG%|QmMmuu7v8%&>gZLQ;>
zr`;*}_3F^+20mw15n@dbm9dZrxqsf)*0vk2F!F3?jt+R<V<Lx0?Wu%jTY67%xIjlj
zHLYUDY%DA<2cA+m4tgF-kfT!|P<Y;-dZt~Gi!r=$Lm6njCfIl1zge6=?y_4jC7(m0
z2N~8i&CBp%z-V3qEcZ=$zvU`DxfD%gB2n~iRe-O1B2lbl=0X1mK*#ys^x1WA>1%m3
zaGrQ+^HWj1CRzc;rdvWdP{MV9H&M7K9jsDJf3bCjMZJ%wGp>rNG9U8BqHWDAuj=pd
zfI-_3++|c`DI&q`0~%>yM*$6x6YA(Hd`XNjr<Hm3X%E826?$PDq`CW+z%JtkuGPhj
zf4}JNhjhjrsP>ie-V=ccG+)?vE{pT?KJGpDp#Hrfy`a+J90R|(y|=7Jyn3A0(ba{7
z=6*}dqJ>(?BR}+^{#`?P&i4gRQzn8zL|#VV!S=88StqzT_|;eIw=M>fULZo0h4GV?
z5^NB*l;1e_Ue@MExqa^Y<p$pxV3>suLYRldJV0gnM_N~6z=!LBqk)HVv_(QyRj0g+
zaq5S=P>(Wn#5`S_lw#wh*#+Fa%d6X)NOSwnV(7`JqbCy3e<e%2HATNU((go8tIn%i
z>7YO8xwHHAfwHq1P-@oj<|EwhT?7$HNut;@_(yGR@W5@$&B`aJfyuEj%M<sFR+9|d
z-5QGH6~3~|P&Vmc2r|G*^J;esxEXz(qKPZF&lYh=syW(((aA5as;H<Zu14Y@8ZK%Y
zXF6eG^cE+gjV_j6^M|RY93=(Qst+)`yv-NrqETOQbElBv!AgH{BhEO7_Y<XW1srnr
zXm2x|-RofOQlt&SpE9T26g8$rZM1Qu9hr>k`0l|eA|wrzArXLDle|?CPNcvFdquQ@
zE$9<rk5;CUDSRRkxb`YRKpbTOCx2g(Cbv}oq-|mJRef{<VORl*>Z8dT6_f}Q_$i7B
zC=9S0XUF@bCqpFR=2Zk>uYFiWvodQu1cLcORnj(S#si}+pXm&VYrBT_5R-}H&z_A&
zb;=|YX5oHOoV@)NIby8i&)d{YuvA0GabP}oW8W2jQ00O*=?bYlgt{vp;#MRpvryHR
z87ml=Nt>v6{ah~#Jh3BnWeTD#T-U`XHA0x5cAXv|yyuYyFbn+z^hRQe`xT+=X~6HQ
zU?1LWcl-R!JOdNG9SFd~6~HXTGJ9&r<v&-&8@(o1a|QB;e>Us^P=f|ggJC-jx;z}@
zfYm@_ybjVL)wl6G`t0F}@InuU=Q*4fX5kwWq;Fk=4-yg*phSbb{`$+fyx&?De^u(8
zp-v$Ly44o>>Uz+}fveOHppXN_*B^PT{~GcRB^g>>Ul}<RqGoPl8vqk(k3o%rkURqE
zgOa8NvxsF<NWAZi%wudS10ot7ku6#4Wm!2T5B8%OT;cpAc~W@G_%7@rkEHRxK*x2m
zJkpXo<qTIqA`Ks~8*R&lj8_5P{}d+#*e44Bc@lt7nU?>i4Fax0n#0gWMhr@h*-(@@
z%`Q6mRlLt<c6VKn7BVA5qQx~GNF*DOS{sByhy_i=Wf)To08t_S?r`<$d!2ktG>QfB
zBJBAwktg22e_w?%2$p6-r4w&L_beM&HY<(v^w_`@oD#l9hul7`Xw)oI?=_?>S#Rca
z+pI4@pnX6Nt3u5b7cB%lpqqWobZY?h(`&Z5QpSaXWPEC-d(0``NY%J<ecOQf<K5{$
zY8S?-q%7w`HIPfptjEl=)!6McDG{kAo1`8-dJS?lq<iiDR@#~1@f4=q=P_|-xq^*n
zy0vU=bIAvXE<JQyT~<H(;`hsJK|wTnlO1!!NXK7{zBPl)lqM+oJg|!e=vx(&zmu&P
z3+%wKIs+Js_Q+-EjX|$nZZxkVzyXBZ2PAvXk{fRiZRF-(?EvI#?92gk%z$I`wrXxX
z#;o5S%$qKXuJ?g)fjhua!r3)IT_Cwc>J^6bYj*=LaQ~a^LL`3Al3}X(7Rsn2x}3S`
zK{V>{s?H6D@z+Q?$qJc(j?~(nq-{Zg+H_nxL@`04Ru;O?X{eF{fr=eLx|L(pLF#%^
zhO=<}`t>5qWKd6h$g_2Fb^KXR*h3+^M|&&KeH2LSlpnsVKy|yJ@hR>_WZn?FyA|--
zz`^SUEE-Aih90)x&r}@>-zFIGf`=f9>9NB00rR+X_+c8pc7iI!3JjMy*S7tHgF2xe
z5x3P{0dw+9Y3hf|QfsuieTi^Yna;ne1NNAQJd@!U$*5uW6NFp(YJLTr&!hz$=vr5X
z;p-*7;8WnhBM64T1N5%v$$?ZCWY!9ijdxDF(Ngr1NRLCbJ?P_WrRcj!SGE9TN&vRG
zhDOM@uV39?p|Gh=Lst}IWz0m^Rq;tD5DALMG_5OAAfoFc?7~)=y_DO>l0N&5M4qmR
z7v8Bn4_jfp!Wg?u8tyq+CUC`@wYOtICKQc2fgxNoca+AbCg}+UF39U=EYzMMvH|@|
zmUmf5hyW9RcB5FX*h9W*?jT*XHKps-)y>zyF9YZQVQ?^0f$S#mZ$8P)t&6^sn2^x*
zCO<zJq};=*#Ae)W3h#g2(f<hw3y}W<`$E<H_#H<etaQ)J%s3)8eR+lhu&JMc*`h5I
zxvHT~8gXoOlYNPJ(lvsOA8ewW^8N~#C7$tNuY8Uh<(S`vlpTtokOZSHL%G&nM2U9%
zEfjY1>(@6;0Pr3`@JNz2+WOASD$)<QDfkX;!W#t$O?3f6rVt>W`$y*0z?`WWW)a_^
z=9}gAb-|zvMyq5&8aYinQ^W-bO!szp3%Vw-l0Zdt9mph_;9uMcXFqvRd4Gh^(a7`A
z3`OPrIBH2(x-bQRL#+Ap;LEKx1pC)%_b)(-tS6lMkpCg4S`{W;$({*}t~Zb>Vg{)e
zjr|g5&Ij+V9UNGyJrmK!E+jH(Hofw0rB6a;&RF_pPapeEo-kP2?0j<;%xRR;r>%xJ
z6R9%eTavA}NXws}kPl;W5pG`p{D>qEO8==}9y@BeeWmcWKNHW}GYFqRccs&@@Cgi*
zl)5>YMh~ubP5vHxN}Hr@@!Y;S5a->7&(hj^?+pA?EUXz7=!UGpx}Y)o@<`Elz{w#v
z2PlJD75%R{G3MZw%Z5m~Ln49@eQN`RiS&IKG3IXHhRh1`afJcT!{ddsaxeps<iIpg
zk1GP2Ey?RnKs5r}@Aouf0_TDx0{*Ydc!Dq_VnPM(%>MHSpA@t02kQ4nWBTY3z_=rz
zaj2(6;MZc{&RT+BZ!fYGZ86UrbH&Nt-WwoH<=62qtV~QcQlKM>F|3z3hcA%D6JP{t
z%~^l{ibC3FyTWeZ+RQ>}l4PZ*rN00Xc*1ayw!-282w9OQaBnqz?j3A*1F(1;1ar-p
zY)mik8R(j(MWVT3to6GCv>g*b;toW2?gKbBf;H=x1NKP3H^5pHWS2>K#|$9(P5BJi
zl0yTFG5q_3IKu{gDg`hF5+8Va7V>2WV2>nkcj*baqy3~|B)Dq65ckR`Ul}~QEfmt0
z__AxDYvif8{pl$WQU|+3L%j0^%;+ir*8c@1%d)d<V^hh+YS@8(JP_!NYw)dJ2O<zJ
zj3^uB;4Q(6wZnNr0<nGGy1I1P5hPTcn5B-}(#7~QuP*Sfz~eoKa72ED`F0q5l8w3Q
zLy3&;3|?}z2Y%@QWxu$be48lZIhH<q11erI5(EvWbu7oZd6J>Zx9&BmBtd}AJOfd*
z0Z?PShXv@y1L3<)>8}k-ZloT6LEO-=Ago~5ufy`v?Y*Z8nHk;8z1KN7IEpNQ;7P&+
zHZjD*|J>>}$oQ?`kbelA(R~sRhe8d34oDf#?dyf%lXJ}G;kfW0H754lt8qqRjN_&Q
zo^WT=$z3{`t!cg>Nm`wf>@P4cob7{E*@zTQ-*PX{I0E{&cMzy`6WHu$#5Rg!r^G48
ze^l<DLteix+U*9GGT6OUD-sDzUD&|f_#M!~$3ZQoEBh`EXLrD@p$$Xxg)5}h6JX3H
zjOd|f!OlFvd?A7|?U6d}2G_AJUv7rqq%v^~tt$^<4xO$DMmNU5h_9pyw>SK`l_e9-
z^Yoa6ylr!P!O>mvrS9E~w%eVCn2%JA&n`|o=~iz@Smv?^b%n~_ZOXt)9~`V`$p3BS
z#j8<qlVj-PpZ?WU$6fvzRkC(cK#U>?26{T^_UL4mhGh*=Pc0ZV0^L&|edC^DywNk*
zlIImVNPWtdcTXcqioj{82Zq!&;?T#Y)aXsi=6-EqVPf)WgLryf(cGl%TH;tZ?)*%W
zAOhMeUZ4)|6RnC*g2P?yl)MZaLtog}IG7U_8xIc>kU5y;aE7%o=5i<GC)JPx`HpPi
zCN?*|4CbagptbyJzVM5%X9~Uvj<HjNFo$~HzXNWbaKD#djcXbrOY%}C=mAQfWAITz
zIXL-ktJEH70(O4@bMmzQRZVmw#38A}RD`67DABHbX@ZR27e@sB#_k}EoF3u|k#^nt
zn`4bFZd@riVz6SepGqS%bO9H|65aqvb49?%QuLbr(8f4M4bg+5K-v@mQU_SK#JqbM
zVjBit-CuJ?kylX3RkQc8Bt7WAoQMYj)h-B^adGUyTU#?*o&5dmG8f>`?QS=y(xo_S
z#UeI9llH&bpVhFu2}58lKoTp!s}LT&P_|am37!1b9EAgQ(Q7p0IfEW79-;lU4{=45
z7YwBskU^)ak;(P_FkHN?StIaFQ!HRKvs7D@@#%IE#C+`OUZoPqR)1lNzz=!IhcNHw
z0;3$V;^K>eYjy?gWO$U5B~8~o=lFy#SNr#OaAzO;{_f5)bWaW#J>H<Ww&@cXdglG(
zK>aU;=`FlUK3c$V?8lE6%fPXeP9{8rq5=%LXV7zR!g!<Ad_f1vvNfAFG^1>qlcMK!
zfopF}?9k)OoX>5;&}TohuVpUOCSzjH3lZ;%P=FlS!;49hc+#Hn1fg!SOMJq<+tjob
zLw3=H`f^#WRznETe!hb@XEULlER1sm#BNk$n=Yra!GdN@3!Bab7oaJ3J;!}UAm329
zsvzYsUCh7whPEjp8g-^O<Txjsg{#4=jD_aat`jVvoS*_N7hlkl+9L)*R%Ngi@6-nh
zlrr-v?bB9pL#};1ZQ<s0Ayh2h_yyiTj`XKZPb1yIr{+vfey(V|m54^;@<bb(wfJIu
zT8Txqpe4)X{;4wqijBc{>&+MBPf8(zEm8#N9_|jC4*~U-tDS^Rz<4z9aKHV!iOF;6
zH7oN4TQ#Q8UawQwnLl}{+7=crtY_IXSIQN|Fei~H^L69`6lfRb-c{s2RS7WnXs|%N
zC>A<OLx&7ia?7b7zmpp<<P)TBL(#<4>#QRRl)f{_HABN@%}<Gy@ph3@uh$?j%BDqX
zxT{RuHrgysgvsNE9M8M@*yQi*GPHx@)P5G;&utl0j@Q>%7AY$ne+3EJQ<$uZ8QA%&
z0D7E4pUtVOtLtQE!Qc3U%e$r9E&%8ScIFrQs&lm2af(Vbnk48R)&yN{;o&F3G4PZ0
z0ywq~{`kQmAN!Rts8uR@^Eb54R)z69@<EM693*KQ92+tgfnin&&=Ht8<pKYy*t${W
z5WMOlkU`HI#vrXGv++NBKV2(^qvGZ3*LP}+=HDVkF&oq1e|Ot*z@Ih*U(zmj4}4c4
z^e+(Rc2`8#88LcyK&}E#@?%^NhTU`@z2`b!VHpQ-7Q;}bwY|MP4J2#q+r7Jf0yF7O
zi9Rc)a0OWFV3ZP`WvF9c=$VWX3c%$gn*q)lH_uvK)H&#Z(MI$X(p2<CJ&(vNyF}-g
zi#sZTweI7S0>=tv(iO1E2*9egXzicj>S&vpbx2~ZaO~ob;A#;`U3QUP8wAv<{@%2X
z209AYPa>5*+cp*{zqLeRV>zH%9v6x0M|z-v`vk475^{{Z8Mr12EoB8$FmEiWudhG(
z*$8%4Eq|K6<QMb6Q)&9$pKeP(ikyqLI~*pZ_tS!GZA*FtT8VBlyJ%~1A3N?Ulaq;^
zH=uo;gK3HXCGbpq;P$61xFzZ0X{??)4TTMpU7~Z>O+<x#H=F)<Wz4m1RYsdx+M*D?
zpneWCB>HB?KQ-~>AEg2qRy`UOQap*@+^@3T(quhrVq&r*!ZpPfIcJ2BNcC{owMg9_
z+vI(uBD0vIFVV4hq9W-XYUUK8<Ti;8Q@{SF6EL$X<?h{+G8tNE#~4&SOlpwvob*|S
zYu#s}0t&7%kr!)*w6Y>_BXvs&?3(mvQ_jSxUTL#Mxl<!x<9sf%)1VzlypDNDD3V!M
zH!O!2!CG|@5=C=c?9$L^uJ9~KPwuT2YoqW=XM;z`fz%@hEM%y^ucoLomBosym)fQc
z{+=g;^x%y!ICV4ncXW{kGb4!O0wM+E^|2XNM+&sN`C%n~FD;GU-Fb6cS{u)9q_a+X
z0jd=E+^3ZHs{$&iEb`=1of=x}qHR{*`v4T>1>!B3*i%Js=NZj=6t16tZky%<o)ug)
zHj$`{WGSTAu_i>~wZ<T8)6t-TXcUg@23EHB>+ah~yHhelBILP?yA1-_*9>dUv+^j=
zr*kTeKCpyy5E<Vj)bRt2`A6jljg1BqIUSIX2<*m6``0bo3uU>{jB1q69i5$HHy=^(
z-L<zz<zI~|?<X6&@%Ouutn%UsrF9c(Bu6WbC&^i2{uoN)hp;{zOOU4HIiAGSD~X$1
zKzoP><svFA1a4w)X1E<9vjOHnULv(vM!h)dpvJ$sk})FycIN?*djduwZG=cbFfz#G
z*F#zKd)WW-p&BZ~mJ3dA>AxjCP8|we*yejN7mQh$g%5UgaZK?m8Nz?SeaW?+?&eIU
z*W&#1t%hQt>h?q85YGiLk8d0`U$rnT<}H*H6lfy^8#w?q1(KLXQ_s8WfC(3{9RpRK
zee$c^dIuA61?K6~Vq%jum0HosUGO)a67A4rrl+TQn7b}yCFq|6;@W_9V0}5rg5aPD
zge!L82PvAwq!W>70ir?=4C!`#w6(Pn8&bsB&@c<SzoWfpwRV}9Phfl?ug_QEr4+rE
zpSV)DG2)}6qvM0iQv#5suHv%fK{t3<y_a(y-r|z!o?luz7?CnoY`eH~x&t}5gw6nT
z4rWjzoBO~BJK(8z!P$v2bIUpOi7*6#qQbZg?l@lEFv-dT0K2!w(%II~`$5Fbt$h)a
z(YKKDS>At0g=j_+!iNE0vqoHHf>NM=O*MK02^`Caylepb1+?4adKHIrqjXJ<&{}IF
zoXOrkt1Ld)fUjlZvUrcmii#1L#m@phCZd|#ehsuu?lAHfB?gfP#wYuC>j}O4$nIVM
zw@@bXb`TA>Gv<uT>)Uei$$?k}ZZfTfSb2Jzvxp1^Pk-9Mzh6WUwb1;W?C<qR9OS8z
z*<=$YZfa^$z^!!gGP(iSFhI=Tu|C|nek$mFw%+8x_sV@bjNa*>h3q=gpS4Twpvy?W
z%>bojG`B)UiTWW+=`X*hndZ1aM$0{^a;Wlf$E1RR$=*efC7MA`R!o$x0iM05`RI6;
zHMlpHft>T8BtQR?gR^tM5ZTO=Lq4~7UcZ%vl<veW{nihY-ii-Got&6u@q9}`=c+Z&
z2c+ScHYHA532{u43#j*L(4j-;nirbxELTq*0R{{!JhdbxZ|Rw?l!!d4H1a|9x`>yJ
zA0_x`rJ{`-%-y8esCYu2+hS!+CQ5TrcyZvRPk~d_6%i{5(8Ym6q;r0Le&qWIM$c)6
z^8OO>&d7ewLzU$0{=2XmjwIJ);1;(+h&VQ!Ka!PB?<s@Ez`-E9=Znf?`NHbYAyr{G
zdgic(W#M%1nPeVpKoU*`w3b=OL#R|GAa}MLs$9M^^9y0>?xwj*8yzW9F8;P}t<H@&
zqBtw(_SR_L9Yzbhz&2#aetz9T)H8P0TQc$abCoc)snAF40@4JfiaFD|!h_WXk?2nq
z&=M<Q8-VjYLPYsPV%r|T#jK0CCb&JstD(sQStli7ZxgyTX@|bN;_NwJuvGpG?kIso
z1%fGJGZR41O}&~q0Lg2bpbjS)*I_jm<6S1QDq|MHP}nE7W}jd+%e)3Adl^yA4Ikt&
zPUTp|(J@9=yr>q*pH?LHy3P&y@k2nst)lVijOiJv&?mwhfqr=XLAIUcJx~NG15i!N
zs5;rt$g*sWZBU(G+IK^Uq7Mw9iU9;ahw^l(onh-7_rEWp^^A)G5yxz6?35A_dqqns
z^Mq%C;6&e@>&{<5>UK#CV4w(gO8a>QTx^0-8@q-`Lo)#`ext+(+4s%wox88R8j~IC
ztDIdAILQlgbK5j-MipUjc8pQdLo)6H^D!l6$vUC~oBLp1RNdp2N(2A$JQzxV(K_$*
zOM(!njm_-IH5Of0E?j5D5I~|glL&_yW@zIaG?rp7Zhel5?Tm{zk^xA$nf=|5vVz8}
zp3|BT#B&K=@UG*~sn9K(NK)*r84$*A-7zyWn}=d51$w4BPsq>=2N;LSdaH#^1#a+M
zAHFI$)5S_S$^Nq2V{*A)YTPSL-xNjq!7DQB;i~DL)t*@j>)GC>L%L3S7hPMIw{{|I
z;++p|%?xy$WF-`iyo|K_Xp6HO-=9mr%V+G(C2#G&{;hic&08tY`Kx}DEEyMso;7Q-
z-3SG$7(My4I&L$Zd_b|(ODBhqIz0{_Jt_?pGHVzhwPQRwsRF~3pXrDKLu?AO`xXAe
zX<!HYE2K4mzae;XyT1iB8jIm)IICUNj}CZF^|wF}Jbln<z%$n2MyJDi_0$yVEi^dy
zK?$#gK7=P$ZpVEc$mX&FI|a+Tz_}NCo|rfWd4xw``*|Y?B6?HD2EK!Q)e_rVnV@+n
zgp83rzN(`PHV9n+16|k2KiwjA*ZsyOKhk=c?u-3UWno2w4D45~`VDRbGOhjk+)_E=
z^=%QJZ|1yq(KT~G!V6Tc)n*rwR5=cO`{D`{^974LT`xTMiDynu|6Wv8F^6_;yo97=
zT-;P#2%jmS7rb2U+ZZU5K=Y{@svOZn`+vIqg;(f2JwyyULhlNLnGVp3fM3r+)|9*)
z0Bw$uBD`Qvr1hJkumap+LK=rEjda>Z3P3vv<dOU;oSh+9W4(@l6Z^_12QKX|MDhnR
zfa|6K-1Qf$Q|+oxL3Rvp{Bos}HTY(Y0B-l`)hnTMFt4e8yAPK{e?$-Tr9KF&aFu8a
zOx%Cg7F|Kd*%e+XC@v0!RjUht%PD9Y1HYMH0hBd+(x-g{=B*8i8QsM|Iv%_H`fDJt
zKO0BO3SKjL{+7kZlfqi4>0YY~1Na77zXLGI3{29=4WP}W2;-sshnx#-xHN_U;*d!}
ztknzs*Tt7!e`Pd(UZEP4K@x-l(;oJm_*&G?!CtY^d;s=9L8e$6?6cv*VvNJ(d~iIa
zkxG}sOF#6=E~THW`gKFY!E+A<e|Lc=rXL6@GKW%DmDPma9IX`ipcN1^A4sy*07h}7
zb1<$QgXE+Rv_Po{ed{#{7Ri~~tAUoJ7{>M2;0iwl_kHM2sBChK=HrM`uIO0a^8PEK
zHwO)&z3XIm@BWgjJ4O`Tn~{Q+;_t`)N{BUSKDvMW9xymV;bs#8=fWMRI-fTEcNXuc
zzJ=0n56KO3=?_M|D-0iP;+9X-T*xm|L##SBo1}6qzxQaWmACUh?NB$eulqHd8Tt6?
zarS7-vjVT>nS>A$PA^NZjT_nGg7J8cVzv=Ap4^V`%e0jA84*Y18D#!oQ?$w$8q?6G
zHTO;dP$N4GOhGR&vX!OtN)$JH2)sf{xQSK+Wx{R5b6^6RcWyhUfM2<ZC0?tyey({d
z0r#~ULWziuB8<1imY0_BPfzKtq%HeVv01v3#42x?4&NVgGOchp#^YZu^+WGzD$VNX
z6XyxVQab_*QRfdbiQk6UDKgOi9s{C38;SVaf&wnTHa`@7YvA;~^Nd8tG>3M#BXq40
z2>Cj4jv5=#zq!8+#ZI5K){JpUpIa6LW)ZvrUaR2@oJBfdX~WoBqTsVr8=ia!bYorw
zv=laNQOD+%mm9;At*KU=kO<V;Ww3V1gW#nbVhK8Sg^tNJx4^=n2F?-N)uihPUv>qd
zE;X5I=bQAJw17D=v<QKi*6+gbb*L7_?^O2hcwqx%I8OSs8|+FrU+XtNtcDB>K5&B}
zDWRgB@?(Rs-O0!~3$zCpZSaAN8k3(O7=whiq!Lm*T^_}OPa#kDS^$8uorGO5D~^Es
ztR$(aEc%=kb?Zv<(vmYHLfoDSaF8pBLn0w+?KQ&HMmVH@IDQ)@pHx8>78Y`f$9u`h
z%*$?n(j}hAwli=WpN*U|z#hC_-n|3i6&91-kdhjMI{acj8`Sl*tRC2liAHaz5THA=
zhxIR5i{;Kptu4TlIQK?_>08c_Tj~@H6N=}Cw<&|F9`easi+W<9L=FrOEA@nAH8uu9
z&-%#`*@4cPN7Ilr_13CvO_8sbSVG6?T>YCf#jLmN4uGq>b}^1;KW=W=)FpZwOyg*f
ze@r^yrgK##qcI)_uc?O|=2kQa)3>T>MSdEWkF5auCIk(kn1Qo*NLCVyb0#`jSwo%^
z`0N}*;D6XqYil4;)<RpO@O$9ZN^~VsJpy5?i^edOVkKtO7js~E$XvaIo|zHvEZqbU
zNob?XK~fP2B5loGuS>l>QHF#)Isu=g<iM=>7dFw}NK*pDuT#K&{0;##jqygOr=+Ju
zU4dHdI-O^jV@0}hPGIL^U(RF^OqBrgDb}nv`V2!nlH9&c1i-_UX{femU<d%?$vC*k
z+uPgOi9n>B|4D${f9@XWVH=c-fQ!SJToZ%CGgK+7;}`{N7mD5!AQwU=3uMxtK_2eZ
zLJZY}k&r2{b?*+z`cI#>rje}w`(?!1Ya+~|VKv6Zue_#aJI2YZ`M2ZqiNjITNS)J>
z3~D^<3C~Jw?lIhd*SS(vWinA!e1H7s2xCjem}zi&lSXo->z5^}teb>%yMPJ9!I!Jw
zl(AWl<HLG5cea++3iEi+ov?oK0)JTKd!(vvgY_))AE6JXZ^^CGOyc}I@RN-hf%H+-
zV?(>H1&sGZzR6m3ZH_mZR8E#_SJ<(?7ruuNY%d&iTk+i-c`&7=y2E@#VU7=E^;54>
zoLkr$w=`2d`^}Ib>;3ub#QhH+Qx5vAtoQFZfr`Z)@aI{^cn<Hr2n=0N;+EA+kZ|1!
zdFwE!kqq3{B?ilH^;b27-Ik67f(%d2MFx*AEx@Ml85@g(T{`hbIMgfgBVROQ1EbE-
zZ2orRMmpQyAJ^$CmD?vr3I>jt-GO5=#MX=vFzRBEcxJG5u{3COjKy}>ot}>NAnfzO
zyt=qJgJk?X_5j?2#)e7OIqUXhGp3*~$N`JkXP}e;+)&N1Md>a^86XWNx0WtobFN<~
zTxX0y0UYGi5icq~9z-T(+ri4^H6Fa^ZMAeqb=T|{U@aC))l;!7NY5|2<9-=V3qujR
zIjtBwxe-R0o|jHZhW4l2HWxbG)*tD*e(qycIqSpme7&fx+sZQPO3WDBSc)6_lIhp5
z<)XW7gg+xIpJ=WPzQ298$oG5*Q}h^@6eDBZHkX9;I^(cg&mAe0VYrd)RD)c4+ZAie
zhZ(<jQG+jCH)J+3CeydiF5TxFrM*|ZUtudnFg5iTcMhl^JAAifUF|cLgF0nKquDez
zY8m#{$~4-VcST$8bUu1Cl#hx10x4};U(DEy$)v_R?9{^87XH!(zeL@NIx%Hk9%yzX
zh}?(=3(Q7c+qoau>}{>e&!)Ps^k^_nWIvK<0bXaY+?XHBY`U+6-&lLb!Czr<^KxqN
zc~&`?QavC8npcw4P12(GOA40W(+TkGs7ekGb{Pwnd$oAm{!DkSj)ySb0_IKi&!@Ul
zpk_<EHSB2_0cFvBdphwgo0Zo@7feN3UFufxuOpJL+`!#<T5h?_L7k#XjnXV;IATTF
zXjOMtslLA{_1oZ1jJq3K@soloFZr+IS(n=uX4RG%CEQn}+tzs;Qo?2W8aOSFhi@HL
z##fzbzqQi9`>Pb^UUT=id~CUdhEw<W=EZV-7_@`isw{pF;`7*!MxyCxNB&looF}t|
zzeaC$IIfU6x8FS5I_|`|lzO6W*kHF}>l`Vij~2bBlGdO4sCQpwkZYjd2h_t`<8ENx
zQdS3-^KO)?YM-o2B_mA9fIc-ElHB;J0?hy0Nis#scq~6tO{k?Y-6Efi9s?!r!abz@
zbB1c5OJ~^|n5%mC!BbMTH|y_%v1m-1G&Ewf-r%Pa1C(HgHIVN9xT@572}PNS>*3uo
z{jyK1a@IlY^NXi=e2+%$y`!TmJFA;eFmnAEJFZO}U;kL@d#m|n2(xsK+~3u&Y>DH)
zMk}B^P`nrJD1Etm%+F^sfO>E|KgJPt-Z1!T+tSvrN4lsVI+J_K*qaVzM{_$aK0GU7
zzRg5j#jEds$0-gd#pEg%PlkR$twc9xd!Al-QtEp%?y2F&WSfZS`UYtHOWdX|id#2u
z!F4z<FRuv_TURC@N#25`1j$W<E{*$e_a>E+0ReJExBrqmaU~$EWkH;nmE>+eN){nK
zL}m*1SZiFs-;;Z58HXQ$l^nrGZDV%axpDvg-n3+3bMy(Bl|mPPI_Ooui;_C>AEW^Q
z<j6jc_o?RGdLsV*jNC^J3d@sb%dUq!_Q@JTESze}l_td#9lXC(zK>#7^#>HMdbggE
z;IzL{`FH11zqW{At@m){Z-3~IDIpc(+xPD^Sn|StjRd*AL#;AK@1C(%|NAd@Z3JgW
zT{~mvyuxqh9gPg#@NXm!ihRY&`Kk61L%?Gov19j`Ab<7Xnsl<#DS8c<HWEjkjH9ES
zw_c9P@qeIVBpD|<NqHmPWLu|$Tr!~d^DQ=eH#3)L<@4)tR8-WD+tR<{6B7J4fr|F)
zR(6a-Qjq?$7K;E?tIZu7o0Y<2i~>QynzWL$wW}sQap_HDWFlW>XJXUC<@N$ZM54=%
z8ldNntR<zTK1@FLe&Rqby*2Xvb&RJo+3^RB(G>5yLrrKqeXQF@Phq6+V$C~E8u};n
z%5{lfe!~93lcLnnaFp+4R+R~6bW5y&@sH`$=45r`ZnIE~$_5oau#v^hz!xHqCVw~<
zw*g#*f&zJWu;k`Dy|IR6%$Jwi20Hxo8g_+LweA4q(ATL#^h_7&w5ai`%&ICjH2ILk
z&u8_pL|j+f*rvb=xw*8R=TVAF!wD^3|GyV%)Nv0o$OqupD3YLL$v^&qn^N?LKS04F
z9)3kaINKi^Z3c&V8<I{gdy08@^j_7I$oYFAv)-UCwC?Zi?Ty;JL;aBH)@&P+=XEg_
z$Omh%eD=H%Iiz|57;Zc%-Lsp**&&g0sy0noG$b?poPo!fFGRc5vhs2$+w#>6^5?wD
z)cc-flX&X{ryWyA{I!qq+@9SM9y$E%Qt*(YIDH2uwugP{QWt{nsP|o4ihX>7MCR#u
zaFIeUtAGvmZ>YDO0GG0}i{;;8jX4@6rLBIk_{aF+-mfL7znQ<%X7^&+Enpr#L3H&y
zqPQqU%%EXc_Bjg#=}@rUzr}aSL<f2YwuWWK+cd&JdJh6NDiib0?(UQBS*lmlw5?1o
z4ckIcA&IBufR!(U?^2C0G<^nUW|1JBnF^-jX#)3vpqw}rbJ!Q78Zdj}ucU$oSCw`D
zFhm-EIMRaj^!AqWG%-e51&-lg03ARJ@<?3yKRl;T$b1Tb<ymCdt)1J2#FT5l=2yA#
zmG=)Xkr)pAxfOoG_6MH*EqO3%Yj5e>+z};HH1%NSSSTz&`nAVbb|!z?`e((R&v`wu
zllbnVM`O5c{eslnd(s=?C&CVT+SR66O3HVy{nW$hIOPnN^|H*A%FeYP*iMzA{<>cH
z?!{%GLedymPv=6upCscT)=?gl-V^d8R${{K?O!N~sQZhimL9#D?20fk9S43jw4)-T
zqI%*_^n`%gA6wx#a0@~S5oEv<<^AVpuzeN8Z$^MyWM)GH4^rYhqEK+-{c&IdN<sTA
znhNPqTg{9CK`i=%XBXz7{eTHO<^0JTtzlj+mt4<;4qAn@Pd|EcVs&eAGn2;-{60iZ
zAMD=X<^NC=JoPe`peLN_`ViD;uYj==glox?5G3cj9inp@YN+7e&bRyGex4_ea4R$L
z(+5=V&@38C)3RO8pbJr7Si_zsXOa%dUs*P?oxs6ni*w9q#`m<E85{Myd@M&2%caP@
zS+vU*u;!rnIn^@aTaB~0-@2%tc0A_dC-$FuL8bRaXJTK3TMQ_Lt=<>aPeHL*#ecZ#
z%ZfE1kCmUKCVCQAZ~SmXLH_J8O#PA+JjGsJP6-Er83~-uaFS5BGQl~^e?<AOL4kP%
zZR6qoG6-JC5%4>2eX0G-b-8|X5(bPPpiYGkxioUa-aIRGB|W-+;|HB^n#WOz#=U#x
z6%{wZsn+XnuNE^o35<)Gxp`@d!o1=>D#8B!Z5wrfdopB3YDU(CPBwoKz5^;86#7H&
zxerK~jW1nib~m~F{gwv#0C4!){&qigo!~Ej_`Okpd}_|kw^fE;=!fm#yW4#iDlZ}>
zm$JU-GzpM~+)Q%&TYbW7WV!Vvnu1vI8hW&vqW3%SQ;VXaN|gtv2+OrpYz14KJ{r7i
zOWXWcf6z#gacVHOM`r|++b>$n@)$qM8E23=T$f#9gyScUSCvUnb!RRIG!zm=)swV-
zhr451*4DfrtPZi1h=7C|){OndJH*8W*wr{_&^~~ik2X_E$QRskh{skF!L;)3iCBes
z5n{6g#NG&7v+BjN&XsS)0mlG){_ypRYRvq+193kMg2g!V<(%4)A;D1g6ZSR7)v5VG
zFhZlA<>(bzxssc2@8`EiUpKRUtKiy0f1UOgp_rJg2>(v}gs(4ec(2LP@Dr4jzJgj4
zioX8rQ@@S8UP-;cI+T%KU-msKE-<LW;33TTJ=3j<Y&EObc-8OFC*Gb@MhAbZ;KsuM
z<4Yzc_NPieFGqCqW3TC7%rAS)_-82L<6RrY9Aq~yC$_~<i@V~xuNIHDAVh0iLN2Ie
zXbC)N0wfCnD%Aj+WGV5x8T}j$%Q=;m$Kgi4RkE<#!qyNZ={G^A(XT-bH~(>S;^$GX
zyF=S7d6FD+@s}x=fh-9L=TAK(PJ=0kTy*i80%ZeDj>NfWBiozHUr^N1!I4%Kmu_DC
z#V&;ze^;t9g}Ika>YET9OmgxL>E9E)9JKrR_KuhZx7JQGf(W<8rQ28~`o!ryZYN>p
z=<j_;KNEV)TiMCRHlJJ)9QWo?>JC9s;*)|mF=|YF8QnRJjl3|pA=B=TH%g)S>?XxS
zwH`9Yrd}r}SpDy_&zE29Oh)#(g7O|yC<UbDY(}v>Y9qO~>bQE(?fB{~TJkuJpAXf0
zE?;FYNbBQ>bMj(V4Y-LC8noRS9gWCR7k)ft^ZsZugKeI~cOB8eN(KS-%a<8|oGxck
zB;S;N*8V70yP9+|SJIkK-s0F(W=mXJ2%K)j$294mb%9+Xom;Gj`<Ek%RE@3vGI~W1
z_u@}v^>&jtd+xK6gp28|+&rc(+FW|p_dcC+@h#jM)8cX?hx$x;AUX9qY_LWf$`lj)
zxC1A4sf$CW3^MKX7o9qp8cx2qa5-ZtB=BqW%m)edLr3D*LcQwJhQ>5R%<DItTiwF)
zhqCMKJpbnl!*L6xM>*bcaT$5O!yHsK-YSIw`42)%(-F#)om39T2mEs!cQ|gKRG=;>
zKtqJyd-PkY0mZo4yoSmO%D=dNba@`Ow-NEAA^z3h;QphDH1VIg7EEJesLC_pIb#rg
zU2kY~-{($~4HH@6{N)1KdUj*;SkNJ`jbfg!_Ne2!h&7k^VJa;^^b8@7d7GmTmfKBK
zHispjPTN|)FFy2q7eA0fR(&*~<h~!BY}>oL$1Yx39?TAQ-r7o>Z{v8@y2HTf`bS$h
z>&+WlJo~5NGofCbP?Cs0^urN|2|G%f34s_ll+yF!a19j_&2PRH1YW1S$%&y2Bn{!C
zrd=2`WcE9&%g%Yx*8YUPMF|2r{%8FT{2xmGTQG`!-~qFPSSkVgNm0C8)gbstZ>Ae1
zHsa+EER(3g$Iy^u`=y`xU$=tDjtFAkos6PlhHmKU)vGqk^>=LM%k!ZY&tsSA_&?bE
z_prDlNem$G0Z4|DWF_<$I^UOO6J@Y>$2MnqT*rg`c7DBXe9K%MU3y&oZp^=n=av?c
zR|&2tK2?-Lrx7f8e`#m-D5oZmeM3y)(Erf?-@_a|1{GiNRmKJ%z_)hJ&a!t>-SAD+
z3-VhDe5TZ^0Z-0G{IeX1kLdo>e|Ipfib4H<-yd;>3~B$ngy8qL6#rXv@MYZ<{`c|z
z^Q{XuR}ddH@k=aC`|pXtA5=d3_ig{bf04y6N!$BH4+mwVaDqpedFAgJ{cnZdI4Z+}
zREq18E~atGU;rJ2dx?S0x?Q2~*s=mmX^z?Q1B!nZW2l!fZtjdgHrRr42mo)3Pk^a+
z_r^IxL2A;$${4uxrdtQ@drF9kn$<gx)P6&HzI?egy1WBF;!@}Tp2pxQlzT+~58s3B
z*=-0|R&*@Piszs%neP6)+Ft2Yw>^_Wydt*%4FGu#YSK^`dU6DLoM+-?|6_XPpQpL#
zkO#9gn2)Rh**Or{$dc56-vKybaQ*sgA^p^?fPpJOZT)%gyoaafD!>@FaHTwxg0o_H
zXtVLVYV6=%c@p`+B$>v)-(u-$0R$X-P0dYA?o%-PpQ9#aVvc|MIa!eo8;+u^bPB;K
z08-citga0a85U-3n=>i~|9zeB#nk)$cz1}t<^s^$h=sga96OqZdnhuI>~+W#WFVUG
z&HMo|1O%SLAFQ$QGZ?HsFYW(tRj_0M>TdsLRP$r$(f|D!F3l7uX0fDl_Mlil3t(^d
w)XD!n`2UvDKkMoL|MKr6{J;Dl?zSCLP0@&_4(f^eBJiKKrarnz-R9x{0gVY4n*aa+

literal 0
HcmV?d00001

diff --git a/static/nic/nginx_istio_small.png b/static/nic/nginx_istio_small.png
new file mode 100644
index 0000000000000000000000000000000000000000..3d45342f37107ef4bdb1d85dc09305e722b59ade
GIT binary patch
literal 125996
zcmdqJ`#;nF|3Ch4C=ww#<eW;O<V?<LQWGL2b54z#W61fCN>ic(F~_1g#88Z!mEu{(
zQrbceB_@nChn&B+z22X{;`@W@qG|WtANTw1c0JunJY#Jkz$eLvAc(-JlPEg`;i4l5
z=TY9R@SRfY5B><p6zdeq%swo8dN4Ff`u(!WAF5_mWay(Y*Vb>}-0vy+Sca<X_TbFF
zBUXR##)Ajwx4IvWZ25fh64xo-lIO=bqkeO9bKJSgYkuqJb$!RJyFEQC17~Y4ovLln
zq|OR5?^ZqVIsTux8g+Hyv*qI8^fYC9=67z+t2m)!ynAl_|MHi)XD8%>Ic^F4bUD-1
z*xp0k6kRbH8jcnD!EE7LG-{MPOD2=Kk%ff?vFKWxY&WW>m>j)1`7)Ks*GaDOy?%c2
zZLs>x+-e)vVM_7;?a*xI3liz;Hvxai6AP2f_P0EV`PUZ4O^%AqcIeE~k3Kbi?t27Y
ziWht~IAd8XbaBc4?AcMDfg0aSYq1@HK0@665?^|Hd#lSW{w|e<I&xJ04qiD%T5u>M
zI}w&~b<TdjSDRA){{7qLOmBKbIIQVL|Mu;l8Y0j-f6@lgd;H=1i`4!*1YN(rS7VLu
z?};;pyR30I+``ZI_m<9}kD}fMF}hu3o4&dfO-@ecM;V(O!};p^4>i`f%iRt+KxMUa
zNNkfwDi39Kl~3-MF{DaKB>Zs4`FbZg4t)Onliu6=yuZKy#06X;VIWf4lC$;PxpT)^
z%WDWSkeQW5x6alJ46wEBc`DCaHdUX6rRFw~z1Cm6c#(j?tqMPEqm)+l`9%6NN5Y5H
zaK0ua@;S6R@{1KdRO36aBJ2BtLxRdm;P_WyceR?l_`^ph(ux|fQENreAa24d66(uw
z(jAT_LF1I<&C=+5p`Vb``Z>myxOEfCY0BDqdwV+pU(OVK9R&w=L-503*q(QHaya9<
zvUF3h<Bk-=bV8Mxkd|hUHEwVse5f;*VU+vflB%r1bss)|K^fIug2Z!8jdT%?GuqnP
zd`PO@szEYq8?pBkx}<6Q=lPn!h6tmfJG6*Ad*zT|4T9l$r4S*cmqz16h+lqJ8Bz^i
zsL3hl_XlS0%~-zW(U$N&Z;UT`wzTrlg_jrKpCR@ZptREQ;}N+_CdliWn)4k-pUs4%
znR?yQ*j%H4k=Bpikvxb^rdCNFBiy9>k_L+qE+)L5MQ}sZR33lOvbVR-PB}P|#M+y0
z`S`=HY?Q)Wl)^(jUIcb#5mxC;>^)6d$i92`?yJ|T@Bt)|GBSOaxHvV?WoavNa^KG5
zN$OO+WK9G9w%<MK4ikLAXIx#ITgW=4shK#^`fyE6&1><dN*7)vW0{VbI!ZBA;cqKc
z<Ij@m_^?Al%{@l(G2!gFa|@nuNaX83{8)|QYn@9TmBx~+X5Xq0r7c|_d;P4iu$?2W
zyStn9=)*7gSXopCj<5f9t^Uk()PebC7dJY!{CVFP&PTknR^|8g>h<oA^R5F{;kiXf
z9KQVuDJ59C=!B9sC-SpoCp<%A<9)Bijz#S|NR&qQCVF$n{Xia}dfk+?`$GnAl4*It
zE=%LE&tKV_=2q?aLwqXC&(H9HUd*~o!`(01T3WYyHlsb0E{|IWFLW;wE0$ZLn`N0?
z<x?A_RaLBg!%H?7$0L#Am6eFIj*gCLrxj;C$A@>N%Au;eFu26x!@TjYb8Fn)4A!Cq
z<4vEH8r|WN;21eDHa1o;IW@(6wBK?UBH?*A)vhhk+XhMW{!-c47?nCzFMyd+DX5YA
zNSWfeRX#OCA{#3_Jo!EC!=-Ybr?hexDW2V2@H5D?D8q|nr9@2N`qmbh{SsYrrPYA*
z@iTPEGbAA*mw~P7qZ5|55_@^+At}-tm;Te``1b0Rh5&*tal?^1I3>C%Ev~NvJXBUD
zTom)4^=w$|w2f6j@9dF<_hi)j?H6`Ag{u1Ud;S^n;I!g4(=7FNWg=f>QmEF_rp)Zu
zuU|#GHD`_e8uYT8^X#rl2;Y~_S3nM`sN7o;o-JB6Y&T$(6j)^D2K7ajT2kpXtFiVo
zL**}r79B764>&Y!|2u8%@MooaK4fr7Ol!7y@cO^q54*58CpK@Ww_|XJHSaW>F@~<u
zu!nI|6*|cDUGM+=4hZirBMYjrLZv%)`;cV(NIASC*Aygw>UAq2-JAhVR#x{#wp2K~
zxVY@%ej`r``52hJaHRR)MU|l)2;a@E2A4mkZkP!rRnt^c5=1nGm5{rHNP(!2A3yHo
z+RFb4Iiq*F77pMQ9L^Fk)yZO_-l+9_{`~n@rAM2+5ciKV$0`~Ub|{9*GOR5qXnRS^
z<!Ke_DTG&CQg}G><cU}wVf63B#`@~&#H5w18R|W2yvu2a{4~+eXpBH0kprZ?GRTW}
z5LM>H1U|CESL<|>LFJrbg+%KxnU+hYNqWkjL$ALN84PDKnNR}sh`pE5B_1XAlPZMM
zSnToRZHId{-X5$l6b__DOL$6?7JiG0igtXZ(@h-Do_&0GQdmusi?{v0lvh>XA#EKU
z*Q^hhj7!MI@%Wf*>!M9U=a?Ak_&*yC1jjsF=RA`a5)yK?zxqnF0Cl0j^Hm=v^6pf9
zY4ot1XVUJH)Ov~59?X;xTxF#2An}_-0sf?U2ZE?wpZ;dA6)%tHEN3RSOw}6(jh~it
zF&f#GUc^4Tc31bsg^)<3(y6JbQ2oX{{OMk-yux-w&}6N0(eTI?pU_-e{T$g@J?nw&
zqe17FC|l!Xpn6^%X}z)6g+7?kg{|Es?U|aI`fpC45E{%SA?{r*=b_BlC_MDe(e&!x
ziqefoilIh5L$>bUnW(*`ZDEw9*37|8Wu3s_EZ|!UCH7ZCqNAg|s1Y<eJ?qqC#f2c3
zP#fqLSl6%67ghV|-QB)hTOS{=k#$en{X7*d+%uVbncZ|PpBy?RM$^rV*BDw_x9aNZ
z!bRe0AMUjfo2_HyM&9;#?Xj`8ob_kX3zdC>ch9?y2lLL`_ZXuOu5dOOr*|HP^;w_Q
z$%@v<>e@)at8$INF^((Xc>3(w8~bzT1gwg_w6LOMj|!8t+7EqTu>8Yvmr{cDqlIc_
zyX<lq>xOyMBV<}PS7kq|(cgl@qvEG)^(Bq)V2Om%oAMWagb&@ATXm}STYpK5sI$9j
zuAj4EyH?K#=h-2tH4)-TLF1U)av3s?=gxh_z*nYq(GmW5cXl(y5PLVb$D69Ne%#~{
z96E1rKY!=-;ry+?zt@LM8Rs$vXX|ICl1C{OWo15p4QGYs2U%i4Wn})R?=d*2ktJni
z*`Gdtw)<vKfgHs7es>CcWH%{7!+4T%9(Ilyr*&cFa*hU#-yI(xcUDbrpkX4nX|{as
z>kAhVKAhYsIhcXJ^Dn={_!y3<p>Pd9@#5gY`;4qmL6`E13PydsKBs#b*-f)OSU>rT
zjnYC@uzr)c@cL<`_Z|}EI_=KM<)+sy%q}=9o`qHao$jj|_P%=c>VIR`VrM5N^zsOF
zi;mcq%uLA+i7!Sxxp-bg(JIs4(C1s_0hta*4^q=!{bp69y0+GBTCe-AJns|evu*iS
zM{}&@euTT;9M$vJPu8@+t&g|f;1VzV^1HLZH}vws@TEYH@vEc-J_U@Ut!*Gcgbn-4
zm&Zy`sh;EJgwx|XRMyrLM&ruLZM6x4a?Ri1!crQCSdE)GY94QIAYxZY4uHp)DhTw)
zm<O|~+hHv)L#Aj|ngojOy?ghZlGK+@jJ*V02B#KlkX-dPFq@vFuA;1>GIanDkfaOa
z+16H(1J-5bWo1!(t#%!O;}V`j-oCyrzru$^iA3Uu*D<+_x?D!|aL6DX?+qs+cT`Ws
zkQ%84pX|m^QA}{23j1ZJ6@$p?SYhGAm&b3nXAt383w323KrXzx^r5JlrjoHtf~I{_
zgFt!j>+5?jBfNa7{+<za_3O8no@Z|}p8&QQz*RJfDG@VwCcgU!|C*@qT(a>2fS*x@
zCj$=O`gib}5j6;R^{QP@l+!JbZ_*2X@q|^5I7Ya+hlKH?(~2!6sgf5-(Za2z$)o&V
zF?r8YBc92(VyUb`{bW`&vDY1Ijf5RnTEHo+6sm8ftR?>_2C&SJluxN%!V<}{{3Ak7
zOLepG$@}x)ptSJ#Zqz(+2-DC)i`b<p_>sX1`lQ`kdkc@o7vu3!NEhY1*!ut`BFS;+
z-gOxsv2we~=7atgO6T&)#uBXpwp4#NGv17&!7l0e2|pauup@9qlSTbxneud0Z%#*C
zL|EjZPWzfx`GKL_qM2XU>Q<ecoCJM+eAX_)t!}PZ=ZaI`YP(*;k#UtI;7m7qP9`t>
zd@DP0>`S3l6#ypdvuDq47hc!v-#{ru98)5PRu}h<Sy@?4UB%%>_cR(DHxrs?8B*`Z
z8-D%#`IT_%N^yFB4Vk<@UwGHR*8}{=In^@oTa}25+@|~Y@8?Ho{R#?_x5}R}m5~1~
zY2?~XZX+!SQyRZZumrI&3HWv~aq-Q!m{o`1g%{0PEj@nKc{eaq{>sD|F0~6dm$#Jt
ziKw5Nl(n(qj_+6vLJ&Mbe<aBcy>K9349T<Fw^NW);soku8QB~$MeV3h_$FwF&apwY
zXtnR+kU)@JMou9)h7u@E#WZ9S@;DHB2=%(lk_Vjqd|XfSIv_|-%v1qK+1(RQ*DRH^
z_0!NU+5kcagtz=anjfFs7qi3N2FKh^>yOo7-9;$`<^!%_x2yd0EQ_A|;<9S)tw+w5
z^rocR?ae1kVwH(o>&jOzV>djj50{Zo5qqCb)UPJmO=6LosdoF36+qHCKicll+nG<S
zi%g(okpWcWi{;|z)iej>Ujmty(rpfSLGJ8Mc2T~&=A$E}rKJ_D>QY}_RbL;0r>!`l
zE~VMs#k(ecj&2JXJYGiLqq+I|<;yuWdWfcnM2seX+xd>btt!Mq&Jo~8wv;t1&m`^k
zvKm_MgDz}mo0{SF*0>4FAU9UY?{^|L&U_<VNZMR_e26oB@E%_Aj>o@3b?jbYrW>>?
zhw7XT7uPFSt~d&`CMI}mBB4W#;aOFE)54Us#!)?Pd0nsW><@iDi$!xWB(i+I2XcO^
zSwNh6VJ1Q9zWNjV$ASKS!)f`GdlkNXb*?s7S|~W!^4N%KAONIdP*)^LJ#dhRQy%Br
z040p$>60f<ga)W*EwrfN>9QT70{*i3sVnK^#Teo)`~>vMyFZZP+Gqa+1O#dT-u#}J
z_;*~0+eVrA2o<a*{8D{<!&x<y2ayrjGqfKwb-2$*=R#vxU~_eK?}Fj1f<ph1datUZ
zSzXuvHOukD8ofVGAK-WjJwCwOr~p?UW4J5k)u`SnobLh6*q5-IWx%?Cd=)K6#XPaQ
zdfC^Pq$;t|c-EGxq#0z2I-toKYo4`HYj@^rP4MtWqIUEQM=R8S$8^##A_+hC!<#c#
zWA+PQQMhZN70j?gJyTCevn$eIG0lYR)mi2MJI#@pd~$+1*2Bxo>#}`%Thy@Ik9xm4
z@?sPamU26^0AHJ0H7!OZt1Fk#g-y|HcmA=u;e(ASg%6ZC8D$qdSfiz*6O#{Xt<KNS
zKW&`1343*g6w(q}bBrFankaH$$JPLQiG<EFvgWHkpAelaqh5)i7BUUdyZ-jpw!J^=
z%|k*mmQmQ|IJ}}GE|yb1_jvRkq!+kts+|eGpVTE0<f@Zp#bXw*FYdXW^6nfJHWw+p
z)J+!pS%5O<7<ma@WNUDALS6H$Tw$tYQR*>?1piwe|8x=e@wPO(>D7%_z5_KbJf>aQ
zN2^3yXQ6Rinc#~rEwHe@Z;uv`S5RZgKw+_Yl9smrTHSXOsNgP`sUz=L&XFU~4ZQ%>
zdFbc3A|sEHcCI*D#H*=#Ya#B<i{t0%AuaDIcQ{_B<CA+ZkJZQBY>fkF{h#F;jSU{p
z=+W+g#%{tJ-<g$_<;E2U;N;Gz-fl#i`^_JhEA}|wO<>3!8idod5EtswdMR=`CE@PU
zY1tFHlIIT+YxeLB0qg^y0(aU%((`Rtay|LFCu}b^n9Ji%=@A~Yr)hR3JKFx(lNKbf
z8ys=|;*`sW-ywi5einWCU55%jq#3%?_96MYpS@}?ojzMRV|zq5qwd|(`sRXRg|_6g
zfCqLj^o@roQQF9L=_303>U=5gca$k4;MA$a_JMoDzPj%QFb(ScMFpuV$IZ>(hjLJ^
z`1mw(wu&Nfg-7Qbq)F<UN<?QIGYLM)RDSyAbokJIbV(xRdqqvnlW}UENh)C}`Qv;9
zAQ=v%E6=1wJ;&OOq1P>k=SB6Nf1qo@n3B4G|GwLa>WBycvZbjXQ5;?cv`izaR0Ww`
zLTd5eg2Y}Ar2Ig>RbULdB(Lbp6^-^agY?ezU9C1Z%5M+ld#sfb`ZxmI6(84S;bV3u
z{D_Cej7Hcu1RT`iYF%4q)gl@A@+-0>N@ok_sSMWER%ZqMd-z8mF1^~-Dv3Q$Ic+;w
z2pGR1zp)%>{_wv1XZUi);^Lw@lAuETPlA;K_t~bp)%7MLJoF&3`N$hGH0;JxR5*Tn
z_wKlrYDfHV>2D`|vEWNHc{GU&@uYl#vuFT94jW%^AxU0Xh5Y-rHp=N~X>}lCW#Vg2
z%--*2u=YZ|{%Ky5YIhWsmtxzmd)>ZVc<+gK$4_sHChWm`|NQmgF^`a~RVsrY5j05V
zQb2>`qlePcueW_LXqy(f9P5#ykWoi^{``{CP;RH;7YR>1Ub>?%$e}+CuT>vW5PLCc
zn=?Hp1F#2DsUbTqxg=|`${qI-rG+4(Wm{u1M)f-MlY`=ED`6dh01F<w(5;wd{1hK&
z`r!{_*Y4d{uSMeQCM|7e7YuSoozI>vkdl;q8?5hALf(jV*<N(^Az2JFH5;C*+uYnd
zbdkQ<y<a5pT^;nwd$1W7=^>>Bamxb3OH=@vwOppXT#aon<`*`-jX-8vKG3EXWsPI%
zB?mni)l1P!t~&VmgW+iSka*|EkLb#qKh_L(%H)M3_HXun#Ga^_y1iYzaO)1~Z+ZAs
zJ3a*agV~X*MC?`B(nKqb92Xb~M-(&po~GIr^l0CWPqkwlc>Li$s`?wI!5rsuzg)_F
z4EDYL`SV{_aLj__Q9WSgvwGdpuu^R*Yl8^~H<uxh#OTmuS<(7;bOeH+6DTX(H6Ois
z9|SWgkdtC8tdQ1-+|Z|t@K}ydKUX)-BfdzCm`mP%TK}^FndjwMGDqk%+T^QOuTVgp
z74yXluJ1*7+X8Hml7s6i@b(ewD+~1?HEFW0ZY#SjbnJhi?>~G((Ob+wDwQ!6HQb`X
z8((53lr5L=;|;);ylj)$jh%>Az=$d5$RdRk$$zS{u~U#lKJ2`FR8s$=xw&~@ri`ln
zt}z~kOka}kS+oF!!TO4zN#tMkGnQsTjpM7$RLUJc0MKd*k}}+8I4E4ni*;4+AFMc!
ze8fooWOj&#2%2EWFZutDygS(ebudNJv(TdL)fAGHbk`g+6=wTt3-UA-&23hxizFwQ
zJ|-_pflx;4>mzJy`-8>mAUY>lsiDfeoLfy{H$STJI~XLN%}=fWh-uL14|R@}RKLib
zB4eOqj*6vW#MN0-l&CAc1IGVhB4w_>r0Y%+nSY`;b(f=>Rr9EuTD<X=X?Ev8fGy1i
zA@pV#<6wN~C6RS&&NC|K%iNKEjFWSv+}1b%Fa9CYjI*?UfD%!e1o~AHPknjh^Qrn+
zOQKz<Ijea%BtT|M7zZ*?;byYE^+X2;>UjZ~o6rA=50F!0O^wc7+1T-2zs|jmO^%;B
zhj{<{^J8xL#9ZX}1^$&hCtR%Xy0ZxPn<E_G=RT@bOe7?1ZE0#+clM;z-jol6kA}t>
zeG1IBd0oCLj%}_eEL3!Kaw?UQlJbIsZF9>b%t9ieiqIG05(@PzJ<U!N4v{J{G<QLj
zGY(o}a&qC>sNJpZIHnt6xd?GR`1<HBx4pYs+9^0F`c}5KwrluC?VdW}JPW_Z8BXEA
z=xC#c@=ieW&JX@amNWRbiyw<hy+GWRq<%yP)QLU|$t`gp=i(F}JMy}_VP(&pKmWx0
z%9Xi-I07NueV!O08YciW@E+Gm1%0F^eHLW4#~&^!GSNRWGc$EAX%HCr2^48zH=-!z
z`2;RwAh7csP)cNl&q;Z9pW3&xAG7+gF`V_}MAqzdXSiWS_#ItyLU@3ogZ|{hA<?<!
zQ@ChzA?^b^dty-b;ym=gKNaL=D)3ifM}-yHIL6Q09nf4aBKJ7tAAcyjJKoYJQDteC
zZ}*XN#IXuXI#u+AevMw$bmR<rEMK<cwXwaMo4+A-^%)Hg(spcf4FHUaT!xj$_;%@z
zqemZqaQ^h|TbS3IwXx8HymxCtu3z7HN+iCYB`EecQ%8Z|UP`RbnlMEg!{&bedx&w}
z^*ThZ_F%vO-$*(VL$EHg1O%EvXd$KQpH^BZxxvLF%l|ac;__^PF<zFrWq7INPY8A<
z1Fj#<ChDgMFK9F$&k2wDzv?>#9s4#d^ZKXlQ|_xhA}Rz&^RpUHKp@%(uo%MuNagzD
zgtU;#%A~~;e%wHs%Tx7ff!Ur01_pwpii+5+2=v8a-VseUqcpp@HQY?-G)F+)RDIh`
z`F~n*4f#?|bDm`T=;)?EX+{`n;gfgwV!EW1)a;fxV2q`9la&*N9ABZ#fSceyWvh!y
zi9Abj#(djBX*{j;^=|q5sYM=lkwnzm>FI}CZZv?kk)pJ%{I-zX{y_Kaq=+)D{JK2b
zKW&JQndzg;<06UPQ5uBo$#7Q}oh*URzvs81OHOM|>t=Of2M*ZeHqs=j4oAq&c!3ZQ
z90{~-uVj2gg1X|y&S6{~Uv9}DzC5jz8Z7N~Mj|1!gW9B+uSg2nA7^91s?BR%Gz)1Q
zIp^``7!7kAwF-Jb6FmQqZ)+xA8l~E8^<Vl(>PuTpT5<rf&BxpO0`#bj=j7&W!U56L
z51giffq}=JoCc0#rfk$%r@$L<Cy}aXszK5nFKIgz@~Jy}((|82#7)%~2E-b5e(%Jg
zl|lfA=g~1Xm9!WI>(TJs<YbTiadI4{5((7oh{+P&WH}SpBd(4At|1)<i3uV-U%@R&
zq0{O9D7sbR&<UR4*@oE7jho=l&?{UTo}5UMcr$lY)TFJBp)-e1@X;9nd!ptbG0E;~
z%V|Z{eE}(*?`pvlpQ=*ryinUIAv|Td43~1Us&0GPM{HGkhwlE5ot=sJ9rwh{?pZj_
zlku)@6*mcOZ^a8nJ5ld)8T<2MH<qp7hHcSIIfFhInY(0!#8%RBpQhF)5$@Ze#TT8$
ze|g-fEjos3d**~lqflRg@v$i|OA&Mp5K2@EY`F!1_O!!ttmq+4^1L;Rv%{MWKus)>
zLvw~lwA!Vo^mhDRZXAr=T)&f+n(ADTD(OyYYJkhcfgIrsQ-Ay+>MlNEenJV0;EN6%
zB%*slG|?Tu;d#$*Q>Z_fdDk{<^iYZ{Bg`ykRB9WW@PO9V89nS@McaV{th`GUiG@3|
zwoEwP&h^L9Gbyp7fBT+W|H2-baKg#kd8fX;(C+)ddAQ5@v7v$ssuG3KE`ZMUk_%ku
z>l|_EfVJh)>;$2Do3p%%I9l1Fl>0bOH7yg5cA-Z%zk2monAppYFnjVbs!Ok~Y5%!i
z$>Dx}mwhrmLZg9U?}U>}sgaZD3imzqU;M=_tCf^SrO8Cu0&+~*h-05Vx_Qvb4o6Z@
zFh^ZV>T6VC?lw^gAFK}%b7`W}6FgokO3GRXW^uVtchu5iz=|<PD|wS_9MD}f%#q9E
z`%zjZ4^KM((Cg;K`KrXpQF07I!>dh1$Hv};BqfaP6b@+-+wzHt#O(C#n7cmOe!mJX
zHIQvNGVPS-X@j^;UEhAKhD#rIrge^;$KYa7C=9MCMSa{0d0k#!UZL|TaL7X<6AJN{
zPoMrI2fe7hKFXBqTJ+YM);CABNa^@|lR^daXi`%+RYjK?HCYe9WV%9H2!*ofrTDnS
zvgnHm^uT&=RGW_iMu@y@;PA<lW|U%SX0Uk3Av6L3mNGYy<YuvV`%cUh4)M9>vJ`_I
zawiEy_}CatIlH-00hH)xb=7FHZ1P#yBg9@yHkG1>Y(6}#xY>b;+!ME@$M|gWXp|ys
z12~N<7vOC>FKIZav)mqicn%a(<^B8j_t#gK{CNV<%4sk5=Nqt}C@?I+0`s<HQ@Ry-
z_e6ckR~LFbSuj^cFR#25L^y>s^tzO(W}Git>6$d-4qU^I3pl6k{Z<RbwReX;FGmgC
z_j@!rsh6yn?*Wiv7#1ar1R?V&VyROhA(3odLhygO#LjA(SnF2L(<-867r*mtHSP1c
z-efoVO^shptGx_L1weuHoeu$~?8Y&L`+RC%!nUu@q0EE~+bK6_5l0Y<-JXS<|6+TL
z=|7pGPisYZ=G!wEB=S8DAMN%-g7G82<Mk;oY2{l!NhWw$8t3ID9@JCFZ&WW#Bh;z|
zc~x%{?g=pyqMSuvp@$q0?s<r`QnK>rrJ%2RAY$)kk0zf@GDfkU>hAXJC)1dSTGYP)
z5Wz~vDTJyUgek=570u6myeqH?O3pdebf@n<J+{6{%Q@=UI-36P`WaA(R&k`WV3O|k
z+z?9m@!UseRlIR<bl5NH3RmTx%mX_V{uV^|;3J)@`pP(-LYI(JYyU3jo~4d0CD)Jv
zk@HKajZ~qudN2(HLM#Z(nFXdt%1TSmf?+W}(bwaIpKzwKc4X=JW-`@H#1VIr@BNR}
zmO*VY9WN0b3~qq0`?x~B$!(8+?!jNUZF$B+3Cq{8LllbC=x9F}-8X?I0k1!tJer-2
zCKif`imnT_N(?W_(J`?)^>v>d0tP*juG~wuG)yv5Yll4zPFIn9#gF*5XZTVYOJ2YJ
z#`!dGw0&@Dbz|vMh^F^`;lpa}YacPIq9~jws%`!aWsjzRQh!OL1b7fliT$fF!%HT<
zq@1EuWi-*w&3fNXiv*8vyApobLKVC{@oz03jKosdue$QcOUh}PnP_798T5Tt^rjMN
zp^oic;dHWmm!ex53kpWhBd}&wE25nV$amt%g_+fjURccfZsdJR%)O7E9P;U%M!+Wp
zkg`#|y&Tfmq`E5jF*R&+pG1|gX&w1GUtAZhUk5vspL(~V;oFnq99@!I%Mj;Na9rKE
z&HjWU1K_L`lZ|Ct0p&$0^j}QsL%UFm#gFmMsqYJQfTj!{LmkpC^l)@_qYxy2azmwK
zXn@9*&(EV}I(Cy%?I?|kSzXQjnpQrapPz!O|3HmjygSb%HXPh0TOn>w4sKuxDw2|t
z5i#3_t${*IZ6PdsTWfQ<r0kCP^M<G6b$J$l{8L}h%T#`@1N%$^3p$0b?bB5f9URTW
zbCI4M$yNd~`qdvXrFJE~YXnU%zoeySseiqwx$D?QK`QGmi5v-XPGsb2Jt$-Mo6=rF
z6X*jV=&hivs-)z&u*RbLAA2)=tG^#ZzVzWybdvgAydL3nIsQ&<fjfQyT7(5~u{m0Q
zDovlit<ptF`v~8T(dCa~hy(aIWZDiMA)mfimzN<E!OCTbiu4S%OFX7B(nTrZiijcX
zMGQ)d55y=Yi$QgBb#y$MjL(+m{a5|PI?~A1L(;#ZvWrJLz;qL=!r3hdrEw30C1y$N
zu*5cZcOmX&*w@SW!rk-x{d7A5?UF}*GPQ9u$z9pUp_`t=Oql`mSRPAvbJYYhu6N|k
z&7~Ql0LU(;h)A27^hCX%Y->VY5M!KgYS@CnlaG5@_erAaMO|IE6Z;uhSab{}j~2`G
z>YSkSaE!3kLD2c;7oAmW%hZP1;ulCO#bk0w8~fvdNui0E8c4N+Hg6O<^L@3nwDjIv
zHR;`l6Ka~%YxW^*v-MIE!JWjsQ|{4szbCwM@Ie$j1CHnS)wyIk=1Al$xaCz_!uP0p
zf{DU`nQD5gc1ST_M**V;8YuI;`mE*U%a<iv&mh|w-8rl0-)wa7n7M-hm44pA;lNFK
z30#tTBI;rn^x0am>aGctg6%~TbE41hF|_;#C-*G^;az|o(>0_9-B(|QJ`IB4(D(0+
z0{@pfn#TULuwPhkeKzE$*E}F>JUd=ER{ngwGFdHuC?ehybo(8~jh8q5!#ZAmw_Tkc
zX_CpQn7tD=vA!S9o{g6V;RKas%n`h$9}pcFYnQ>LVf#mXjh<isxH6v`H)NKp`Q|a`
z$^9V*R+&NX*F&Gx8a^+8H|Iu{Z_3~L=bhN1wnTpVWk>COS#A5*{~Z0p&wwhbd{X?#
zC7O}oic4x$?R<2T!|RmX%PNP?8Vdev`t`-(Xrv`w6F;F+F?0RCsPUu^Pk6sfV@<)e
z`Kaq5c^$$Hv>mgH-#DXd2fDj+jK6eT54`+m=<oL*F+Z2UZ76|4YJdKG?u*pS^3-GW
zw?Ec|gk``23j=chhYppeA*_KO?oi&uoUAHfjkxqiHn2*cx`Zn4cpKSQ=;gBVVqizb
z%i_bKV|r|Cl<{B$0|~BwVTpI{+4NxC+9|SepuLN>8e+@+!5#@pJs*#P9(Pgv6qrJw
zHLV3xf9HZ3CX1O;poduf_<jlg_WwN&XMa{hs9w4&I}#TCI2Q-M%|-RN<fyFVQKH4=
z8gp4ULofTSuaYZL-YzRJYJm?dq2h6S-pwS#Cp+ipxVyHxdVZO(<R^w^XFP5R<sV?v
zg`b|_mie62AWTy!On{tI*B|NpsGkY&Oj1@=9kTo9>^|26hMe(#f!Q2rrP#daMaSBE
zDyc083M^7oB@M&=oMC5Nq(&Keu@}H6)&obZjYQr?>>Yp0=!*SxSp;g}4@T6dEwG@?
zot&+Z;#l3cGcgh2^yC-mF=*bWLQEys9M0-8-i&pl2%cU#Gx+o8Pd8;^H-B4zVw^}%
zq}ns&8wk$Z5ZMqHhuxkrTqBuKf!2rlKfPN$!BL4W(I+i<fe$Et=t6)-T<xF5y|qK)
zb4Oox$VN&Fj3_E7;Fxrd@2h)^+;$-i;3r1oC-Ra<r#+JDwzP)A-h91N*$5kAe2X1=
znSKIBY4Gvm$BR?-kK@*}<awWxxAqwDOdlk=lU%smZRR)l2Xd+Z&BUAtIzr7GQk{}r
ze#*H1Qg&czvGG^vFR7-Msw3+L(bj63f?qI#8tq9FxYhlZPl|nXIw{$oFtcW;Khd#g
zsPBx#+xq)7D^|Vf%+Ji{q#8>RvV|LSBRPWkR(*!ha(}WUA~NQ0ckXi2O|K(M-+7oL
z60_5dQ`$_GipG2=3?_=WtD1JaP3@N53&v7hF7?F>Yi;0tjmmj6(+pKfTbv?B85o#s
zXASiP4*NBP2Fi-%4kII+65tMkeNVHD_`joN><XV(n(dSg8~%E5+(+^8HY2K2>W53Y
z)JqzWt;*WH-Uu$dwgDvE#C`iUS7z!muent)ALW$2Tgzodr?1)_EcOC2d=2{6I{aI9
zMxUETtx=E<tA6$BGyG^Du-T9|F~x9Me-%W8lhpFw21kbv7iur`SkF#gn0`tcwrXe`
zj_Aw-v}+p@LS8WRzZ@REY}_-|M3Ua&-ofyJTIoM95tapslPahqzUR)RfyI&^zgC>$
zJ8C$L8)zJ01sFh;zYHWRdY%w?)+`)UH+;?`xF_#AIE2~$q<hQyV&n*^b_ne=SWj-y
z{j?M<sTbh>ed_)1;D|?4_3tT-f!*0hE1-M{fC%E++pvmeJCpVCsYV=0J(#o50p2dN
z7|;SAOhWm8g;G#&#bkMnr-K-C0eBCat6jiFKcGc$Yu-VZkRkEc#i@oAgNs%<y9$}M
zo8Y96U8_sGy$l@LjvjL7wueNLoJn&@#n6<u8_zCL(X_2*l|^<}wS^A@0h#FxY(Pf#
z98Z{rXI2fy#&u--_Qm(GK9P)Nc~1&<c**TErdELuok2j{nf>I!%PhkqT<*o>>xkwN
zaF?$pO^FhJ%f>jny1KHd4YXEQ-~yW`eyHF3%(lVf2|VVjPQY2P=Cevj&5IXT4+=9o
zC|b~92yjn5@7=xoxjn-HP%KMw=;$wkva<4yyUAUJD=RCvVbjX&CJ~}N2$>F9nVDkm
zFB^}<ajghS>-}*@&Y-)v&RilHeP3GFg})qs@9P3J1f;ZXOv4>oy%B#~8l-%1cb6Q`
zpQjy3Lla%-3-{Htppy*@(#{s1{yhvyh)P;!y!?d<vh@|xDr^<FPviN2MG%1YvKL8%
za>(E1H79mf$Tloym+SyLS1Hf?f<)en_YU;*^b|AYjr%$3@L(t`SNBuM;5IWMey&e`
zr09a?=9oY;{ju<&H<+my%6EO={%QvhM9h*$Q%@{68A7+-j|8VQHpF%?I;*dIc@4EE
z34el9qA(T08!npg@-1@-@DzBwNjzK3Oo6?5W9oyicsbXyLo=59cJf$!(WjkQJ!~jw
zfx!W(Dm$dAnhVTNNUU0fohz-kR|=^l>r|v>N+oz04DI-I*+mj=<Lt-PeoF<QJXp$i
zTR2bH?(9CuQT^;NxhH<48;lDO^R5tkO@J+bz^rD0*SZ%{5pLFsk8KVTXF^<b8K9_h
zRFZ3)aYkpA7T`!ba6+VD2Lde(!f?4`dfk?kwe-VIH3t!ATidz5OB%~|8ic4lgww_V
z2xJxV9idlihyVSBMzX1lJ3_XQ^f;nK^t*f4#&+X9YQB-SvLC6nxPhk1$HD2!2A|6p
zNZ?hH9IQcCacANk!coXh`6(YcBDd=RTscRjuim64xe3X?(!QHPSijGhVJ8Trpp?_D
zV#jSXg3jnQHbctibcUKo3RDSk;mcr;i-6X>1c9VJSj^Axp_5M=EIz}{nnS28*=y28
z>JLv+0$i51;g~>ZVq}?a1uB(t=}@oEpp9~X%sxaDXF^?;-b1a3waV1G;)c4hOEd3z
zYQ(nIdyw-fCC9uA8H|<iY?dKAN>A82n~)Yr<x|b?D4Vc!RT`!x_vAh-isc&w_d}<<
z<@IYl8S;`Pm^`2n=YZ8=MhbDs_5zbk7wi^h{Y((>;)U`l<DFwcvAqTqSiEHG0=k3%
zG0q(8bXsq(Hv)>kKOBoA9AWBwI<e2mF{hNYbpZ>V3G>@x_NQy2F(MI<E~ppXFmkXZ
zEN+i~YNoUhtnlz(BnWn}sEz+9$2000jDCKR&#}%si2^mp7#>;1$$hz>Fbp`kOFvNn
z$F^b1Q_54MIy*a$09`tanTk~=7K+%?SdFYuEthA{p4~8_sw^7LhGM4L?UffQ;48Ev
zFxM8X4awL6@G^EH09H*=nlc^XSN?mjhm4%TU@{Sev~Yk-1L^CCBaX@yw@pNG8Zh&4
z0qf5XxEQPOeaK=M!M7w3={z^6!ERqMx^N^;6YWyeS*7R_P5i;(fq7v#;1|9A7c2ES
zNPGlr2$rlwWqp4u=d&694crTk0Em;sdW~y)NB|)f&^(Z_d=*m3W31&O5dI+;il4Xu
zulLcxArI6QNvX<n(RugPbyZy(_1qwCgi(0-+FU6FG{B1MAQ69BT8~xNl<p`|Z$Dj8
zTr80bDL$^(2K>i6DHhhbhT&R6GvP*XttC7qTK(Bp*W0770!J#L%6@^w$7RZQFlwEk
z!07557{qRAJ*=v_0Re=T<GT!Z+B!)jB;YX|XMm|f=F#B5!;?`alXKM7=1m8L2`N$0
zYOf^|ILTHZX+&XbmZLV7z}3%G$40|L-KROc6@lc-=!eG#X0uN2+kk7Sggl@!Dwd)*
zXORT(8KU7}pMwIx?xvJAb`<R)B?+izDcDBp{KrT2x@{p!n?I7V>>(lPdHR6nuqlcM
zbaB;v`J%`fJG;*V&I8wnmjpCtL6|2H^1yZB@J!nBNwBpG6c|xkBP)pnMgF!O3M+f#
zMEVB?+_?VeBjAXp!xf%NwTs+hrglKTTmZ!l*_B?nvggmAe*_6bHCA8qtUnDS$o;1@
zAt9j>6g$X1|8AGKfQx<5IhL#0zV?18+7bovYy||xcye*P>c09j_3`(Gg@p;l#zr?C
z&!g8r1ZFE^$K`p&z&$b9*+WE{J(D<)ju4kE5S_8IM}GxNX?%5~6E>{_zWfk&948Yh
z%^t+3zxtFWt7c+F53pzpNEL#hKagqA#5n#9vy&&S0|inMYP5b6NW@qvpjVn>{Xxl*
zO!#4^fQD~vLN?kTX~jgQ&#rbR{&$erjl_Yro;C40>Mr5_?5b4aL@bB=!;@<tLI#5f
z1Ot8jm~<*57F_(lU=i-p96k^Cp{$}p7s?2uekL!mxJ7*{tWgJnq}sAT+zkr<BVH#6
zI5zA9=lG}R4Z?AS6{$E~$fUUP{K3vwUBInlp>XtsMP49bv7}T<DkT)S`NuRB2U%;B
zCLS--(Z|)g=kVdf#=`42@mg`VsMHe<LKJk#c03*kAr$_nWo3t+kvBLHse~VY<$0~I
z0*wgw^c<a|tjTyLRgj0+p?urjejeC@R5S*ca=f?mKZ@7U<l|rn?a$wBx^&U{;94zN
zM*wCG?&CKeb&hSoqf_-9KN1X=CYMkoUVUFdp^GAEOO@4(?Ze;*b&v7g|6!}#eh;_A
z-X<?v6H}!YqLkTy@hp<<lcY{r>jbf?%SXpRwDqWm#C2ujRZzo=kP$Wh*h#(a2{r!v
z<i#&+?;jFjhQpZE3&Cw8Cm{}1Q(G&@S*gYwAA#NQQ%zqzrIWS3Gj4aGiiTkwAdxd3
z%V~C}6eRtUmfu0rUKvzmQ3Ta?BQjTT2SOstUL~zNLc&A|;wsxlERYes<X5y@E(EP4
zBQwe^eBWa{=%)OCWo|7S9qhy^GV*HTb@QW>`>efT$Cm%ijizw?xu?cY8r3@oL18T<
z73#wUT#M9LBnBSQ5{Ya=!|dg6vv}1vO@>O9OpDkNcY>tth)YSK39)BGgcKxG%CESD
za?WOmlp#==G*H2>$u!Qemn0Gs56OfIkscJ{gy+4j!q8;ZR@2tw<-I+}AsI9M6?P*J
zJMNU<x@ZZ75YnYOTNocrk>PG^l^6I+xfDu^qQZIfelm^G(NXxvkPCX>j=lNYt<obQ
z3sna{{^hM&StU(J!ZXQkvI;IvlB~cIZ+!y6!2x=`fc&Auhh<tR2X;PG%#XcX)prg~
z>?u@{h3=b}^v<zn$evc{v`2khiY`di&j%;u4vOC4m57IDO=$TJYF{5LzYV4syh-;8
zSa70mg*p6R<$hgm0Nt~RFBar3$f_-JsujyCi3lgD%TU%L5$x9&=a{tqmEr@*AYve`
z5-f0wa*{{qYiTs(DZ6vLq1;g>;_(|t0bvS&G0)|0qF{%bcMb|-NwFhJ6MPdDwX|}3
z^bJBMQk<NeEPh|zs(dP*V8i{t;IS#{j>TA{YF3x(J<igZ<#+I8=AtGX693!s;NmzW
zY$$>d_PW}ZAP`E;F<8oijS_sCa+D||BXbJ5q5vXWz|8l$l<-`J4$LS}qK-?4y=!`e
zvKI~ctAzDq8P5I!6ao<`e@_ZT+8`*t&9?u;_sf@|4<~yER;lruFjhBE9f8)@UFdm`
zs-A?*RyznRRE|H86|jJ~AWS4k)%(Q=X$npoyZbL`Z4gUJe!mAftp@bA>+|PZV3J^~
zP<zKW%xcSABxcGWBOEdxdI&yV+nYotFTRAGj|36N;EAeB|COXUy!WNv^GgtC3MycP
zzwfD>Xu;st%gbKxL_p$WXPCOogua)O6Grt+9MEZiCg4wQ-0o0v4o1k%50l8xQ}unO
zXe0=i+D+QiLmopNxIAtV$Mi3Mr-BpdX~s<LLN1e{|B&gfPHte(WwLn(YW|GYWUDgq
zr?23>?)O5bj&LRVK%0MTyRNM%cN!H5+xM&B8q#V<S~xrxjzTSIXbKBk=w{YT)hQ~7
zj)i8^`V%=v2RJ@GKlOM8#(?}aHHW!PMQq<<oMe3?EQPpF;EX<FA`c?UN=iq;mcrnm
zNaPmt^XMlR+*ju_g*l~D@P7QHg*TLGi_7K7A2l#a=9EV7wSRNE9rsFid-~PVYD9!D
zDEP2}^CNCLcu-puK6^;Gf}lv{i+`$<N6kxP|FP{)k{Ul143Y3%+*!6%*Jd(V+x2-8
z(%4NAL#~kSaG0Jw`vq{ZMm^`_FB}014>MpaV#rMBR*xY>c^;xm_E7k-J2=h=aqp?;
z+>(daFC&A{Tv1+bT~l5C51DyI+o>t%#1=@F)}s@PDHuz{&zvqa!<_8<^vNB0U^n?p
zo>$f$eWfEX0d$YNtE4<x<EVdc0iRC6kjRBbRu76B!O_Zg$Cb-(M=(gSx3{+NL%9RV
zkqU%x6Owk4dV9!VX*CUEL97&LL@L7fP3b=!A;nTh$;QWzq=N||ly-wX2G*UWJDbM#
z*c0O~rore!(W_V2a_z3ZoT{e+tdJJ|ioppl<St$hlIJlsH)=8(W+%zD!MfV+?z_vU
z%SQ3>T)aC9#Syo7uxVganp60&IsM}G67Q@z%oJ)@l>b&!xJh$w9XW*GcN9n?kmB~^
zFjWdEQO6$EWTe@hMuotLn4=2})?KRVd(E8HX!q&Cqzm=f+B(VgFWk$cj$N}H4WBlW
zx<R<Z6-TD+w1p2`>z89r7kE(nb3~n&Q)=+3QgV0c1}K*i8iX<c@`1!&Mv^+rfE24^
z1sjdh5afJUu2CdTOFTQ(ZmNttRa|O$!TfhbWck{EVedkM4+lsjn5A|+nmDlyN#$gV
z#SG4{J@vu?TkFMI4fG$L)N9Y61F_9b>VF;^9KD;gFov13knUK9$X=+Bt+4PzJLTL0
zV`X#$+g34Novz|@p_9q9#fY<z$GG)vx8q@F-nl@t_KYHkQ*4lLYVjFycB2$})}x#i
zl-DSS?#5`wMI!c`8TJ^AejI+sS#+R8f~Ah%_kWjC3v&oZC%bBpgP33Zdru^dKse<L
zy(+GDrfF$tgF?{k>FZk#RakilApyKMUmT2ifpT!K76#3nQ~jx}cRA#<y8Ji-5*Xn{
zPPhYHdXlEM?XD)ll~-?{2CX6p?SH%wjze=n!Cu(}V{W9DOcq97(IiO?C-#VQTQeyX
z46Z{$Q=rucM@k+RjF%^-VkC%z$54@)LAdH!SGk~6>mr-$(hNZi4gi{089DYPt!8JB
zC}yfHNxddzL=u_C3-666&lNx*a*`P7IC@=b7q^)S5{`Vr1W6<WHrG_<_GJIOjf8bR
zIlR^7UVn%(QD{pkI}9~;?I@>d^5{2tULoQDCt_=$q3JfE*DZu2iEIfM2d31UBB8E;
z)QiP}P1Uaqbng?GOZ;t*Rg{${Ii$q~1M0RQ?-zc5koZzg#s=psz27p%shN&ih*wX@
zKl-1}i?((({+4$XMYLtle8MFl0_+SOByIx-_Jho~0CQtP%p#Q1xiFXcyMzY+7YB(x
zASfpfBoQ75j@Y2GZj^hhL)O28Vu9#g0y%4MMxFlE+TZ_klTt$r>I*OF(fZxE!ul~&
zLJ#*VK&sCiRh<urO!$5rKE?OPvQ?lU<S=;W{MdT#zi(&I%;|9Q>;%X3vw-Bu`uHe0
zs78FGg*Y%UVuf4hddFradd%F%(`fzL=n^AjTA-E9W(1Lnrp11U=`Et@0kivUD@Oq&
zeuZ+l2d)AVC1%=ET)QB*U0l_NR8kTcu|3(7ZS6pt=jqWdtIxnMR?{}Xf3Z;_?tpaF
zKv?7Y1Zid^BsjR5V**h-$sV3eJ`bs9!`EJsl$3-cnsK@SN(!RWKCl|e6rVJ^ybO)Y
z=uJJf7sbVTFexF4^My2uB#!wEtt7>L!v>WO?{x@)AW>=lx@P@&YD<xMQHG-<?iqQ=
zguiVaY2-#cB$D^!|FGSViYxc%nG?8uLE+&<W^lRvJ@rD!knhr*l@j3bLUefJ*Aoxk
zD3_f($_|>|gqo-o2O-awG-JLI@W2Dto*Z^6gk}@f0_O+xYx({qnf45bgm5dYTnpy%
zd}%j%6mizu*9f`7tR7KFtUd>AYE|fPL}BX3V5|2DXvN2YtxfUx6PiJ<0O+L5hq%6{
z9!oiKdbR=LLOn3ndu6`g6*KjyxHjtSe7`|*irwVbe^DOewmr+`$OVN=>8{&~*ck2p
zTfhaI5I`nOpkMn@)h+6ZpD@EN4?>*1blS_lzX?Cd&UeI}q8Qe&<#e4aNX&3)Lz}~2
zHq&JHs2l7aHHhieyj-yS*n;@w3X!aOHzCv?0*L9@u1qrIWOxU1!`}}$;&j=v4FHuO
z@rc~?{rP*-?1p(h0Uu2UyF2L%l-6^E(}g$i-TU*8ga57#XR^pni5+1}wYy0oSJI3*
zkwB`t@SrUBoA;C`Z13s`4~Zcz1i~WGgZ%PT*31`-jU;3aI@>djfUFdPJbC`*w{AgP
zr`LGcKNZkZUYa@}8P-L40n&^hN}~n%OfFtt4EBVWg65_MMkXhJ4;4gz8&E3~2|Qf?
zk{RKamS}XYzpro88Qgj_7K>vN0esnTy}nOKQOs|G&07FHB^|$bX}kqwGfB_Ca5S@?
zpo!@G+!)`aIZ!bo6jol0>ZP?ySfX|aGX>n0hGG=2SF}9{-6z?-KEP&xng`0rEnH`I
zZ3(T~{>U#qR;w`!ruKCGKRnvsMTz1Sc7bG(7%+I|I4Bdl;%1eI-@TvJdLi!f6Fuhb
z8B!3IY60fSPR>-r08bw3Ugo+9l$i=hYw5T?KLjo?C_Jt`7#rlz&0_K8AK>jle(?NK
z)UR{WJ`C1!J4)fDtCDsG!33nX7S?i95Qq-WN+GCfW&Ql+4@iKZu*{28WhgeQW9-1p
zV1--DqCD@$h@SO1A?_|za1V@*z0J>8kg@WRpipA7!0Qorrps8NOtjl?p_Mu$f{uJ5
zf7TyrPJUb5wV7C+wVjK@88U3Ood1d#;dhYNxA6Z-RK*jjkYZRDOfXhJnr;CYG5{D~
zqWz{CzZ*b*-&}*x@?&&;UMlAWk;8ibh;XmQ!N6yL@B14Sd@gl16p-U_%J;Vv$TAei
ztgpBLT8QOy2SGQ~)_u_EqB*<Mozs{<#rv`$=$tsnTuVTnAx--oCP=u9V*f5jg;ZN5
zPTn<L6~#VJ{ft&R@bSntWbV_9x2Uf<s?CLd7(3n`&KlPSR9`Y7jHXGj9?SF6fKWhc
zc&VDkCT9>w))(Hx-xe8E_kDdraz+X<J$33s3n9E2(Bt{vG0*Dij*5%^mU$DR#gk50
z9!8hg(L>mg9m*w*&5z(t0PBwJdF!kTH{x;+_SDy}_ay{>-?p2i6?^HHq-JKGR?Ols
z+~zJK{M%dGR~!L7wT{zNM)*x&b|R8{#n(6bA$~*m;YsOMistIl?56WBwV}&N1mVNu
z3s(?FY>Xmb*&B)*JLtDJzpj^jtakf|AiBiCnZBN@K5j$tA=6Za*EJu1koF@ndoiUG
z8O+aCo|BkhnBA#Gri;j~yNooK)ktJ0`nTbj4sC()tZTs(QND2x3$whJw2l8T1LJz#
zru2|l2Rl0rC#5vV_&lcY<CtVfZR|%R)Gxl1gY<g41ee0f39zIxPAkUlPVl%lReuUu
zdXk<#dlp2Z0*iO*aasBAXYMAcKToZf`4+RMin9jbDWvdYVY*`nF_ngy6&OjhS0=~d
zo3A7hWQ^iV4>miF=yh)<c<7zQF=3``6GX2=!%JTE<*Qe)Ln#D*2(~dn%e2<|3$?tQ
zGvK6h8U{qv^EhT*`P2nm9?TO)80)9hn|Fvn7KcDy<U^+GXS_QCXFOrze+@8+CyC4<
zyxs!hPso-O!d_yp3$6bFVb$Vz?Q98%C=f`pcW|&^>-Qd{_1&RH{WGSBO`%<hILG%K
zG;y((rlUg4Jx2dN36nho)wH|#=EBrW7%8|%$*!jPC3ergE6=tB-wt(}?Q;5+JbSh$
z_dtUoe_J+r@x45+>)+^2NO!s=#fWb-7N=rFe2rnQ{scl57ZnZRscg@HL`V8tHJ^R?
zWJK+1Z*f>L)6-07?H<96uPp!`?2d`tQ5;7xoZ%+1gdfj<SpfGlL<$Juf}RvjsGQ*B
z1lg)lmT!qzpM(}Afo(RD<+DO9A*R*tbOY4AkY|v+3vHf_RpxKw!F$8qk|2eokrzdW
zmo^W;Si`{~am^NKZZpj|pVa%X-PEmSXK<wG9*Hk#6p7Yf0;5%r2wt~6GPYE5Ps|WD
zk4q$YC4lIKbuA#5E975>VdpP3K7H3t!O6IA{=Asr5tA=V>v?xPzELQ9Gmc(K3fJR}
z{{nZbt4APlAYT3-42bLwG2**gIJ@cv9emScT+R_!MQLo6c<g{C3A6?HNhAbigdhIo
zHR6absQc^>I;w0!xoik%P4)7;ev{MFh6b{qA+avzd737n*@0;=G;V>3d@C21oR4GI
zY;Jpm;nm06Vej|mb0vC%6uYU_o(=QUF}!h~e+TauK6lGQkB%|W2D8@|NCN8k=#g#l
z?mL7@NwS{rr|1=cv&s7UwKe+5#}QYchF4CQ`9~jNAfY*rCPD3rkxZ)-XpQou2)Adr
zNqJ^MO_-aw-B;!150l|~s{Cy#ZED$_6!3qt)eGM&t&hTo_hbvAJ53^`&?Q^iGb9xv
zBuww9kB1B|#X_d7F0c;>M3Q<?z9Ib`gDpZ8kQcde%=PvR5Nxg>FmW0RAL^1$R+C`d
z3plh8%PuY{>47A`QBTU+gl(`Bi7bff=s&?|0<m_bNqzhl^yrJ@=g>-mtsg<Z$nzVl
zUx@b>z0T&<Z`Js10NThVc&H%5608n2enFl;mFk7NTjN~})7efxG8<T)2|<8c4;bOy
zuLDP~>*Ptody4f0<<iStEZLMnw#}~uYX4!!S15B8{gzS7P%S~put+kK`EjSeh|yAg
z-t6j+x3{+sM0Bc*hYtk-a(}D#ok9_T&G`7XapgtmTFm^RaSmW|14-%w`Dy=cF9A`a
z2qM+;ndwfIO@9sjPlDA+3u}ni7u%6D>=#R!zDgR{E_+9`WjLq2x>}2Ha^Ff_IgZhl
zReMy`(kwSa>x!KTJ>(vs$d$KCkrZ8rxxN48fBn4blOA@E%m`n4T^^Y{yBcJ&P+}va
z0d&(K@aMZXP+hQ#(|t~nPwEN_Pt3}1&gh$`IH>g3hm;P({|#{dUkt=<dWIrrne2>i
z{wsgFqHWG=_AnY_lnVfo+ZpuwZTxq6UR9W1(Vg~bj()~AF-T+sh^blyN;UrdsIoG0
zldY|VhC)avD0=wFZjDR4x>{O3=JYxEKTII)022btEggXxW<tLpZlj5)u~&xrrK_v!
z&o<K=#n8_55b2J&f|1aMCC@w3*YI9R;m2@Bdi-q-AjNI5t>e2B5SnN5zg*IzM?1I3
zPwXFlyRt(C4lmBzd*YB!9*93e25xuE*pUn12F3$lv(l7vZJdfnv^il^%xLk!@f}B%
zVO+||(eVSk124>U;YJOwU$$ssdRbJ=9@D=q(;LLIFj*(Sd@gW(ar5m;OKH}-Kv|f5
zZ>q2F2Yd4itMR97_)KMP^qGmV*K9|<NAdQi(&58aAl+NTB)VZIt1%69P?#Wo5}B(j
z<ZmMB=g>(m*z|Wu$dPFSBAdzx5883`m(XaqtJwd?-e3MzxqV;2@J196kT3`-#SThT
zkQ78wP*gle1WA$bAl;23B?va4go21gNp}jUNEm?BCZt<pgVa5i-~0FC`3Ig?_lt8r
z=P2xbT`T4qbBr<P8o&Nl&nmyDcHQ;jn{uu(;gNE#zbBD@%)b(7o+>D3{yiW<)%&Ss
zZMiL)4FR}Aa(<ietvTuDA9Z<U`k65)Gc|9sI~oKmv(pbqr0UfTorO&4J+Pn<$b<kZ
z8+kfru{&5S%XlFsPp@IP$n8}6TgR63eAAg<+|M*M6}c4^r5~Vk$@c`d^#wPZfo3_y
zsC%;eZo#W~+fsFO!YXt)|4TsJfe7H5Lc0Bs*2F7Ics7Vn9l^#dy=mq+{>Isz)m_%0
zyJO}b*f0;@JNa<FXyrf9#k<v}Vl(s%dV^Ip_CujcFygrx$+^0e20WCRUk`7PoQGEb
zeautCgLhn_cqx}`gZs`8mkW!s)vxu;N7pRsVs8jGwkXxe?b7jiw@FrrZCU^G53MI1
z`qV*>KD}mY^2^pAcB5YvdS-XTLFkw@?IR5Xx+zI1oi^c9R6hp@O8Y6RmFmHcABv8S
zPEdRO1NglC`}gT?ccym>E&c8?VNFSw%~0jLpO}lam^)g|M|P+`-B>gm?xA4dm%M3g
z1s2bj^w0Fn188nF+h1}0HS}DO+7*ANL-AHJUyV@0;ic65%A48Sm!Gwam47Akgyk0)
z<}>D+=~=_QDPQs53HR{6kK-@9EuJ?W>H6Q_!v%B6uDrYOK^AN~f7k2(_pkqNApXyT
z_W!#gx_d$t23C<j8^7`9_3QJ6g$*D)>6!(utAmzz)5>~{)*u#5$?ap-z2J;;ii%>K
z-?RVUdg|U5Mww<UB1akRu?u7Ch>g&BFS~f+m*e>DcN8j`Dl=UtYN?hY=TBOQ1Xi!=
z94MTj=+~L1PsL9&%ezH@Jk_t!J+9(zk)&s;FW_%91*@w5VD1@MkIq}j`$uk|$UyDO
zZ_`;A!ryd^XeX~|M#C1wG|9Pzly(M&g}_Iq2Mi5QQ8BckWU0!dd)CAyE1FgEpew@(
zmEef^DufhH3PGyuauY}I^+;3CtLeo(+&n0)K|5R-A)+#!Grm9#yJ@<n1oS^QRNv>7
zJQaiRWud5DQVi)X8X~mDcc1e4>+lOHeA;D=6;%;%Jb!%QhQv;2vx6QA-s*@d^hzB2
zx5uqd_-Av8Z%n@lWdi1tca49-z=b~1{O^T?>2W0CvCyMa*lrpg_PL?<+CH<f4i%Z}
z&)<bnJ48Z>$NwoZZ9N2)>;NNa#uCFSTQ)~M8X9jb_qoQf<Qn~bhIdE)_FhvCbPkT(
z#F?wM2l}l7Trb`q#-VhiNK6T3G=@s_wNgZ<<x(#0naO<>{-+4(qq@H5%#U>qI~8Ff
zXaxd05}KYZVY=BzjGltJbGsmOb>O5e9RWyG@rmruzS>5K!L-fPDP~*uXT|6OncD7S
z%5E?nDto-(Jb$m>H5sA?7K_H-M|shaQXHK0JZmX69-*4BA`b@*$fgwi8S;OXt=)tq
z5+WlX>W|HzK7b3!zv?IV;>CtA2xjRa68+*+J1vq-`o!q#0hZq1%pr3uvEzSpe9*%3
zGAf=>knT=WsJi}rk2L9%GFNx<QntiBS5ZM6hn#dw%ZHyLPTK8^sVR${Yx*?`bC7L=
zli#sI%hIq~@Ya#@+6fO=rJA8f%$9<}RG>5jOH(3?F-_k4P-ED47H4hDkZXq)I)Uut
zY=8YwO<dB0nj*Gu-#)rjF$%}|U3oF~?E;kWhYxMEE*8kK9+M8ez-p*F?PPu9fNJYL
z%ANCz(J=0fjFM<xQ56Wn2w!nOkf~7z9VFb7hc(V_U+)d8jRACt%7`B|9)D2u%*`gG
zz(3%o!X0>$t`oBS*uRBPe_joXY<`xB?ha;scN$s?la|k@3c9{nV;JeGGTo8|V45l0
zOz3Qm{3FB!s_b!<le0`b3Kjpc=qk6;H#Kh%VB|6j`fw+*>p>u~H*k>LiPVaF>+D7)
zRx50sXBOwr{%C06L@zttjj7h>)kKC&oSA(P3>si?7<N;74JYVnm6r(#CaQF~WWb#4
z-|Jv@0>ieO`fDO#ZNi6}xu1%Qfva>)$@&I#yLpYWa)|2hz~jkwt3V51MrpJvpRs6a
z;{hM3$oV95p~+PyA<4Oo=H}+9lyfjL(Ni`JY-U(Cf2cu!_eU8q{)KJ*-&<{TWX!M8
z)kLlVbKPKQD4XP!3Z~GDqgf3T)@XxL45Lh}Go%IZ9x?ss@R4{&0&UQ0d8Q;2zNhXk
z-iI<zdde1IzBSDnfUCTe-3hZh<5DPS+mM9B;gP1+^L^Ei^@$g^+gQ!tkC=X|w+gEs
zr=WS!){%h$ad2)%(@}%c)h3kb-=D=&=xlCeIz8%<J_b2k(nl-E{6>$oq;Atp#7_pL
zi5`f50mDN>8!6)U%s#?#4Ip+Np%MuFrNVZt4}zQJl#T`UV5Nr_e2Q-yHtBwj&-r_(
z?-|Vfy9|w!+AC^;BeeG==+GHf1af-LY`#o+la^+C0)EPkrbQu<>|5ekIUk{Ag0-;D
zdjGDK!`OY_vAeE)dnrK?pW<t5X^Q+QRq2DkV7VnuD=8DzlLbZaz>DNrT~s&xUkv-$
zql~Zh_~jDQ|6futiq1A4G(UG4yDNv~=_ZB}1nvJ;a~`RTIMg7S;{Ngm_Bf^O>Va!?
zTUd{Q8XLZjTGgI|B-I-dL4^bckF0Yp!f4SvBsMb?eZG)@pL0ZMHGS?W@|9>(vxn^I
z^P5)Ixr+q{o-eiTP!jZ9ihk(#`R{N4|NUPc?;05OC|fIL$%8JABY}z`r8V33pkVXO
zoFc+dpW^B4_9E2yicpr%ekC**I-Rv>>p2~2&wr&}=ivFsR_mLkR;BxRVbl7Cl~d6x
zzFG5OVblfBsL06LBmL+JH1t~`ntl9r?MiqR@3?m~l{VG2lsx5rM94|AlHD`feNRuo
zANz%+90s@7>ah!4SoShl_Hz?~DOICI4&v$GEUv_*s><BaPaf3&x`*<{Oos9}@OoHA
z;po$#>JjC<j@c!z#MU1&8z}9P0+er4!9A+aYT?UIkr^Md?fBs!^s=X|DYsBos9%4$
zO|qTs_oDa@*YMCOw%=_(dJ1HtTZMA#Mt6(MY|3E4ajl&qbPE=5`&+wT70q=Av!7Qx
zvs(NrXkPW8ftZfNyT!z)P``gqZ(&;H;8~iNob3ST+_t(S{ZTCMG9O1ysW`~{ID7o0
z^I;Lq>9j~5ei;~OS`%R_###8|a^6|*Ki>@C{wvm0gZj6iB&^eRIS+Me7ZzrQvx^%y
zL*o9tzCp4uL3a3Ex(4q-^ZFZ=JfxeHqp;hvYzNq$7`4#H5w^x-7M6^hO9|Ny6o0Sf
zsn`_{9{(cEPdnliDb=+5$pezH^EFxsr6rcx?M^J5mLnqNQ+0|fasTW+6cu@`A@2Cu
z^$i6bU!&c}a{CiBU!O;>FOT`(48l*^FXuhbkQoHhIdPi72gjvU;J`9|(4{-*hx=$|
z6F3X;*g9+BxRufP+HFM>eqtV?Og9TO)iyK;(ajaU_{Od0(2yPZ6AV~|;__seY@oS`
zHLt!)m!AO&OIG_lf!}~$W!lYpuvTuW<{Kj`&pBoapOn?el(dlJ_wyZK3qlW68lpB)
zY(qm&VFJqUqChX-+7J=xNu@SxMYAi+bxy)sdt_g19V4mKEoQ90JRUifTjx2pqHRH6
zWxHOA>M>=hlJPQIPAsSMW{P>z!j1>0`hRE{ct!<2S$H*-$iOb>fo4wDg)<lFIll~w
zw4d4)?NAZpKIY0K*$PU1hi7!Fab?I)+CY4m0t-b(M&|K`2CBO{#y+D7Gi|RRnU0P_
z$u~NZ`)?R5c5@exEEJ_Yw6o6beLNiWDhXelHxRc%ch^R*DH7$T<tpF5Ud|&Euz2;r
zkx#b#I)!eI+c@R1A~u|rn@l|)f8xyA^1Gz^GB(h3`mxoghkG`#$xW1ONXmQ}A8)*k
zv;FI38H%qcKDCaXBH7w%UA$DOFr?|waGcwd*XN>I*W=4pgHvwHZT$)~OXH9;J0FZ~
z3zM^B=M)(hX?N|9rokn9q{dM%)2{cEHk>NfgBl9+zqYA{@@u1UM|O6$*tR%#cXcW7
z2J}16#(3y(tcE(?KO)O2Amfm7)^q4WY^XxEtn)<f8LTX`qL-N(oSbK36_x~rbviD`
z#4b-K7LQ141Zn=4*ffQ9YE>2h&CvhEgg?#POJ3M)Zf$LFT7`Y~aq^otL!`gb1&}tn
zO?m~0*!@AT&aAqQ3XhXuKowjFNTm#Xk)kdd^Y|Masyu3O2jjD*#v?|;KckVAGFd!c
zv@qr?==$p({r!*I1DU|Mt^BHger&3SRd`543KN&+O!ahz`LfD3)uyW~eU|FIA~MPS
zbdENhQmoL)T|D=pL5ZV8Cz#JFrz`G)#u1ZKQD>v9VEg%?rSIB1IqxA@$#XhdW@ZY}
zorUEyPk#69eW90&JY1o>*bF=mNRCzT{4-@cPr*@O#~<MR`#~&!y2IetWtCf#Jyp))
zQz2zy`br$Tn;b_+v#DMaA-s~aNbgT3XkN;98hu?Jz&<{r-4B#=9!u5!(QqEqO$v&|
zR=(d_yW#NcJ9W`;zS%^@r9rgg5tqcW%(Vxkn|QQl@Tf|2fvbJ@F2(ter_c;=4Mo>u
z@`JV9%Hq_N+si3WgQZSJMd@qUJgB6Vp80+uye>k**vd$++tO?5DV4tkby19x#%(#a
z(V%5til^k%de4;$y@7Cd=#!%!EAN5TpkvJdG8}0~Kg`Q7O@DL8UizZH_t8xW20Wpn
zB|0GSxeN9;>APEY9%|CHM{5)OO3u=3Yn|d`#Rh6f*zqW<54SfhB?I*K0Ogm~M94S}
zeK14CjYXkAztGZvYE{amv^XBh%hQqXt^Q08icMea$4qQpDq|4~*&z&@w^a<rH{EZ(
zV$dpoG;8fy#U+P5oJKJ7UMlwT93@jN|E(Q!yr4MO>1*=w>Uy<3`wfZ~A7Y(Y2Dgff
zmcLCYk{Nhnk$mK<quyLm*sd6t?t-3BSu1Vps`&-#%JQkA@%X|*f!Kw%{-WP)_H~D<
zs#dw=SB>7@mn=Po+KM4Yidl?n-{qA*O~vp1EH@-B{7CU~8~{$G?Uu`Se>+9bE_aTw
zavEENLpC4UJ1{b`h?c$w<?BYPguFdsF=dI$d;G2*2tpH>7;P8%szD;#^pkxugg+H$
zm2jUOAw4!4XD{}D7R?{oZXtrfvK>qa_p)t#r=2qG6jeMGJs$PmsGMO}Y@IP80-vDU
zz;kcztTP2)#=U6y$H4Td?oEKlsE<*|Beki=V>l^W!{g6jV%5F`Qn?GG>1(I@XG&gm
zGQ|^REZeLLCM%Djk<l&mYy1wB@6@zoxsas^mM5{xS?^vXCyzC&2;Zo!)zI}`nu$Gv
z<zp~zyLeP(4ujz3cKI?NdB7Tps(09Vs``6Rb2qKDSft2bM>TzUCWv&?kh+?F+H9_8
zlb*A{G(snrmsM<iYyYfqn0!{9Jgx1*^GyHYyh|D84L?zLUg%|IfD=V^p@`i=#Hw(n
zQE#cOV{nFlHJxa|M41%K%un3jem?8<`+;$|sGg3p3XhbPuB@bD13nR_+TpICT`{}=
zRV$@=qC`}RoG@k^8u$S5|6?rwh=Q<fsz9=nbiu{C9<%AOOOcvGjPWP#Fo($u?FP`}
zKxdv;RbfKZVJDP&UCOa}ZmY+watj5JvxisnC~<T?($beu+p{~t94o$XoyclR!Q$`F
zjXdQwA--%fCs81(|1C2k!-ivZqfRhAoAgm`Zf@EWtHG}c%^BAoq%~goRejG5{}jHw
zoOPYIF~z_-kja-}-PeV&eCw3KEUWh0*g{|6q!MWSpc9OCEIoOmW#Xte8q2h#7-C2(
zTaw3}&;|0l+DwNWToNj(ssTo(Bl+V+ZkSViY=MgekV8l&7i<$hjs>ud9%@ISXsTVW
z8ognFqkgfMJj{3h@mDDwi2R39(8Vw%wzZPy;Gsj2D#COYA~3fuytB8rPY<$UFoa12
zEs^!V6@qK#_kV6;I#Rr{EGt)wbNL`870pj)U8AI|+5!{Q!#7iS6g+YS<=q_q-?uRE
zZs*|CeEm<Xqm{L_s=9hGijKAjKasY*65H=28jk)_KuV{d96TkfF;07oim&TD{+MGm
zb@dsX6V5vQ62_Gy6VeC?WxEr^(Lzum%-+mw7uWtvhJj2d7S7Aa$Y^qyoH?xmA4+QN
z&+Cob*RSO<M#7X9Z&7kUl2OTLiAFV`jZ=%89Q^ucLzDY6Et;;(|L#4p#}D0|M<=Aw
zL!;R|2`vI<ZZHZqYjH|gcgSs^K74xc+E=y|GgAi1@d>vWDeIUZ-$J-Mr{}e~4QQ1-
zA%gNc<EXyFP#3x#y7=yrQAXncwRk1qx4kSlpc(sC9$%DS50?5e(w-zw*t<`3mbxLz
z4IXN5OuC$A-XPqwpwRaPl~py74^Viy!(!C7rz&h5;c%}ydlttP=dDQXg;p6L$UH#x
zjf?$2{qt=v&ph?VCsrA};5ll*@^d=Mw`usCwS!*2pFt<<pG&N-RAqwo{hLq7Z;(C1
zy$Ah#;`2uS%Uf}ZUQlaF56Rc*7f9Im?sGs|ZN7toO2_9(cf}!K-UZtzmiRFmoc~nI
zDXMffRXv(I-m~bf-A{9~!k^JE3VB);2RoE_=hkBP>Pe%ouNmGaV5wKk+cga-&A55#
zVWfq-?-_L|d-!zgTTp3LJjVAI#*2$lJt-bw6!@yj@1bU)exmL8=@Gpb!|6@C#!A;v
zgf%C1e<`bEs1Lf0J<S_Y<5jGd8P0LOzH9K$yD9f;d>$3Ui~6Bc`O-oP%#L2gVN>}>
zgxr#*7ChT&_s5nLYFBJYf>1T-=4CMa+e;twA|2`rrQsH$pCxL%IVt)hZ}mx1McnE_
zt5hCNdwSn(+*}i4zPqzFOUb~1pQ<iHk!|nKKST2hpNv1(&+gtz$v><2qIShq#*lW6
z?`U#AZCktdThYn7SLfq9^OB(uM&+olS&vNQuHM3nP0EW}r=K1c(YG=E06WCEba&vk
zqbg2X#s92D(kHa0fqF>Rync)0bc3qc*vLr1qev9s>i1n{+3Ljid!2qDJCCHS%Ekjz
zlN8fu7HlygdpVWiM+jOel0T_pCY~NAST{(Lo&(5!yUTBQP{sB{Z6HlnN37!Jn}T3%
zoM+p6t9kS!8n_9i-i#UkMkh!4n<=Nc-^Pb1t0a=Yy5hXec^#nzNg^7!au>9Vhcw#H
zzL{ts{Rb<?s(Fqb*ssf!CVQVuVae6MejcF>@1I3-T*=;v-<_jKNYaTLEDdSVmWQ;8
zWkx5fgcvD<rO3(CE*qJOrz55m7WO@{P_XUt<MyJb{BIQt3z=g@ywr$RQ>kcdStcpW
z{>xdc6oTeJ%<u`v;Yji7xg+H-VSj|v77-#OZlm(ZVQ@~}$5d|qM}8=MZk+#K#dkQ1
z!pL)zPy1AJx-udOP|2EK(Myh!>M@9SOXEXP?UfcB{Ze2ynJBRI*lB4qrM2F*p1?aX
za~+iBEh)dd<_j6VnC@b0cFu;^f8Wq~oBZDak=SXJ<WWUF%00btuXgomG9W0gR4`m4
z-;_x2LiuWsRQ(EV<BF&Itw4=?r1Em?#MowLGOT25R|qFFcXz_mAjX>fWVTtzR$gc<
z%>o}&ZOF%zmnp98w5`Vf;KdT>##?<=9Q;Z5s}ZYT$<H~2<c3}KC#lP`+2!G425i-5
z#K_O>0*&J``_qgjkHl{$onbXq4rTyS_^fagN80Vc>!3b5kSkPV1Iw(XoO}NtA)wk%
z9UMJn-JDtq3?tu*vMvji3SidXdjF6yVL!N4VKv&G2n+91B1Cb!_M)@Ko_S`hrlsm#
zPqABy#u?RKd+dGm=UFf+_LLW!q(hNFp%0@+y$L5Oub<Y~b9Vb4uQ{!9Ygeqt@2_CY
zs387$D1UrKBQPG53X(PN$SKZUG@F?c4ajgdX@~GLi!su2@E7cZ6^!o;GbbL<$*~f@
zDTZ>-^1|#{VVN@*{|?C2OF0}u>nkH}$@POWuNbT4={YLng7MfoD6jz}tA)tDzYnfI
zP16u8-|>IDV0|Ue{Cx~tcaQRN-`cHCvS_X{x%GMGV^=f6!LW5>)^0T?p<P`CV;CJt
zCO@+0Z6UkB`?9-xK8x#Ke~v3se*?xd?62c0eZk1$1_-J`Z@EQrbh=L1KuTc7w&|o^
zAmgiV|K(5s$(F-8?<Ku``(Qi{!|CtwZ0+RMXPJWaEiHNDsDGi048T1eS7<7L#05^H
zE$f>ctLTqn#V>x@@P8{FDT8U>ic28BWVudoOxX0$Xr{E~VtTygpHEU=g((L;p*PYh
zykjLy6D{j%@*j>B4;E*78?%N;Q1WVLToi>IJpG#6IXNSEYxZMSuVil{aqk&nz9he0
zwl2)<E1_ric=qNEGbLi6(6fJw@a}|q`-PYkZHxSGm5P(xF&$Zh`>1m>MPH{g+iN>E
zta$1SM`y`%j%wzuyj*Eq&TOpD8%FciH}3!Yt}j2)Z0rqY-ULmZD{27GcRHtIiq_3D
zY^`8~4@a0ea{d8DkddQXUd}fra`Mk`N_<k%I-GT?ur1S3lsF7aZ?55iW_=<|aGfaw
zrxDyTE&!{kre8LXq}M6%9Qtn~Dv|Tt9~yYh{JZ_ZsfUjrU%{l2pAko74H1yda*us`
zF{up4sci`zV<)o13LLVw^-7E=`y|>Yoxc0%Ash{WVutz8Oz;htfV*a!joC+VhPTUi
zs_o%1&SGgZwmloK`DWq7(Z%r`{mJn;s^2`<*h*nh)8%~bj&}p|`bI}sHuX`bW^&jj
z-Th{QvxDi6S%{$Ru1Vmx>6-XNG0#Euxt69Pe+QX6;;gWWS}CgSd8e1pCDmp_U$odO
zW{kdksf|V3=JxY@a)iH5)%9Bu+i#$2YTALj5|ShsLVG%g-lm*5b7oyA4wBK|`>%(U
z^>nmOh7E5BmyE6J3G-gu1|i#KX{M>?r&;U=0q3?GDc(!NIa9T=lQSva0*nF<=V)1z
zUONW3x)r%rJfCW)Bub_W3u|9hA)B7Wvh5z!aat^^YGz|M*xIT+iBUI6=Fy%4BcEVm
zlpXW(V!tB&z|b9!#mOq$vbDQ9(Gz97qYqK!xM(;%=W|S7f3&k8@{$9T5>OO3(raZ{
z&>BI3OGM|pz>7AgR?8faW1Rk5$*@Ox{QfxiLCmY6Fcu4Nld6#C!5H)}8{4vj?e5Cb
zxOdOP3mT=s|MZl0`2pM1e|cCxbazyi>C;>cY$q->vk1{tDqA<Q*?WtP&-@dSW#;N0
z%C?(dftp_Aw-D-no@Hv^J1yPhG7qGb|Dl_^H8)eG>vV5~acC*7W}r|)dmP5&#p~O%
zEcs%*{#?t*%v9R*BRV<zcV+90qvUgO={wZn+~S<}hnhA7;wQ#>ZMH6&H+Al?T?X{e
znXKfa+P1mNE>A9Z8y~P}+)rYuGz{};u2ZJE&h3t`l9MaZ5*=0_UsSOd^vrQ}G$U4`
zS3~mtt2;^HXGAPrAEZ*YoG5RsW5LQV%@HQ|n@Qhe@;F70?l?TdY}diF3F^8HCNv`v
zw!vZ84JcZ&NlW(z(tvg0dQQ9~B>*ySa_q_z^-1nb&dK4yQChxEs;xdcym2#<Tm%*A
zu3H->2G4qLmTGs{V3*4eRC)vHEKT}%^|nb+anEJX1?@>d6?CVxUi37sFmM57cT~k?
z@&h+XIGv~ODu64PYbsv;(Y_6}q!bF2%@4TQqH{q3*~0CA-(I{CSpV~95VBte8r9pI
zW?_2-X&*BCvz^Za1j}Gl&E{K0ZD_cW7~{sgGFPRT3g4xI`~Dy%^>EP-NQ-^I{*O7>
z*5_jM<ZvJ$-8=7`%AXi1>ns|B26AKijnc*3`Yv=BS#Gc`kH&r{>*lV9Mz;6nmXhhg
zZ<EvC&N?%?OPbakMH9)FXJbQ?E@vZ|4ma@P#UGa7Y5&M+5t9ciBqNA~DC=V?=crRy
z*bn{X=jf1>%S7kc7Fz7e;w~_ESr%1&eWq<*3!^TWgDi_yWWQTt>zuQzK8qEHoOyb9
zE9)`hvB5`(6-=xW^qf8qQ-f#7BTW}<L0jalh9G}=4qv}SbLIKmKlOJX)*oZ<BAXMw
z?o<S~vAl{ZbYpOI>Ab->fr#cr%S+KO+)SPp{0lD4xKtA%L9cS__HAZxE6?-tHsivP
z0fk~MOdrnG^_Yaw8UHYj?)GmwQ;<u4Sv^8vpGpphVcx0`703iaYQxUcCHS_9VS|;;
zU_a3eEZ-=H*5NLu`Ff+*%v%E^n1d-kX~tD?Fb_5AASJfu-uR(7vr+obK>XxHIeQPz
z<`0~z{0)V37Z&Y*nuK>HgzJ|f%MC(n(sG)o$I1d#b?+m$D)FweMY_)H;w2GWHWTd2
zu8<?!DKlO$CGI%%&n=_CanEu02nA0WbQ`>Z>E?K=m4c*xu3vE_2mwOyLZZe8&{L=6
z@U?T3VcsE#9-IbqW!$L_gPN?H4>Ex>T1S!`u*_@8l94K!yfgN^3Ls~$gH{xPy~j-=
zJs$2hgsvBwdvqb!&eb{>`GQb4%y;@ntqb9B-&paA*TYATjF9I^qhEu~%nvQ!!20@n
zAF>^q@hNF;Gyn11*GT*g)+kNw4p3a&%3pP3d?5$?A$ghUajFpYPh<83Vx%#KFK52*
zscm=Au5MZCJR1Voo<)S)52cJkA$XAemr^Ov9=DT6CsUR@+<i|~Pzhmtd6`z+L-q#w
zNvRGOdUTYj1U2@peVAVsyKOR`y2J)jvUEqd?oIS`#^N)^TFL2seA(u+NH*wALb-U&
z_aeDeB%2UY3U`x%x4fE~nhmz^6;Nc-;JIuUMzf8np0p2+O?m++M(cTNu(VguV?qgu
z>SiOJZghREAYXxk>>lt~WaSwqeHi-j*0xH(x%1^yE9LX&IlVB;J$TRxl#Wh*RTt};
zX);h1zSlhFffDd?66vucx*Al4K7e)%vPjNlKnhMyQm=(p>J{h)IiNyQsa^}u<KyY^
zvfHe3d%5=O<!$_VolD1}&8B=Em|j(d*eVk46E-I2bTcpZNfj%ZnCwU{UUrkiflN;O
z<=^4Oo%s3>5>@<Dp?t^xB5Pb~MrZ0oIj0b-_zgS@|Af0?Qtt*0=^J42S1n_KeI!6r
z5uvWFrR5VwwCinh-fi#_)v$#1;dl&7%Df)Zg=q0R?s%}v%+Qa5|9<SXvb5|)eUe7v
zHxJ-zNy#Y?hhIRLiA$mA^5d@98k`3*mo4VQix+nYdChgfW6?KehyCiyE;F!2R79kg
zd`o0x{EzzV1zI_~VhxZ<56IcGH8ma|cZ5&C+V`b+Y1BG5H#f3Qc3iFl+`J2FH&KCF
zO&-_)6m7xvp9hNYgszysUP#WSre0`vmYb3B5C_G{qT%Fx7qnXT`0=mS<Um6_DVnIM
zS&Xdn@F#3lR^xA+-n#@PO<5IbZT9#Z#P3H$yf8H_TK+Ta3YuvVyIVqX3e@GN>^3`=
zg(7NuZKDob`CY7aE3B<>^wh;x(f#+|4><d9TS4`%D4SJOERC9)wzjq!Jf%eclxqyQ
z2?LwbHSMF5Nc<xWT)NhHVbtak??$a+LI2oc!KY}a`wO`ZY!yVGWGYfIe8ShSWuU5l
zp*fHeht19hU1-iBE;$9<@wL#vLWHoiXcagaI@Oz6&enqx(%)E?^FH)!op|%m$VkM&
zQu6y?!yh!I7}TLFiN}{iP520eyd0F>j~CMP_0vt)nH}Ku0>O!w!Em7;Ol_F_ERXfi
z_kNO*ti>~pmuqT978Jn2{3PRHs}S3d%`nC8J$KC1l&pjJP?_6EV@{#FoaEWa1AgSc
zO-<pxkTWV<U9_^ikY5*_<B21u7KcZFWMpo7`U5fp%b&E0%20vT-rod4s6~$o&A^X5
z6D9yLcpiYx)U*#&uagjp`O$ggBN-8dv2L_du?5RUJB%a#r)<l4rpe^h4gLMwNKO}N
zvN{1_Uifcfii%D1g|m`D0fjLRUr(WOiTUr2L$e=rFA=ZY5_vlA)hqM-HL2*GH_<-s
z#r^spW-yDTP_^zrSn|%FPq0mytG>5wGRfML1?THlLH7{}K#^2;HplBIV%s8|lN<~^
zZ*0_cSD|Mm4}_hK(CRq-S$S`weK{ysmgX$W%e1>=SmXSNK~fq=dN;N?d^<DYDRi`n
zV`_HRDGGxxjgVGagHxT8Vcq6i1n)s5#tn6Az}Wfxc&lZMaq-XOQk*MgKL^A_J`C}P
zpF)KElRF>$4e}s_xdMc|q&1MwI)7KPxby9-qJVRU>n;=!>fbVAqPPGd<+)FXDK5M4
z7{kn}(gqa*B1tfpNZA^0-FiJD7|>BB5CWNTl$NA;&Fph<a450mM@7sPH0LukMbf|p
z-e34#ru4uwU&4pKyPVC2OLP*y_^;!uFZTB4_g<XL>GJ0z@xO<l$!m$xjTY`zGvbxc
z42r#^apoa_K2!2d#mX>-M6!F&o>Fj@wk_8ZZ$wHMmQYCK#Uv<QxUj*WO`t{orV%K-
z2szgSsA4^@r?(V(o_VsM7i7Q7gkh9pqqd<b?zS?7ELMghKD6RJhhy5gKl0<%RG>gd
zp?+n!nSnzZbyh3+fai!pzKQRolkEBR;A|y<Mh{{aS0@i&!Q#gq9TE||z^|B{N*=tm
zQ_32SarE#ognIDm-Mb1fRYoC7mX;!<j7QGfk0XDlPE|=P<o#$F$2WhgxNdvAT02=P
zOzFcg4t3_`<+14K=umv-<ZFjR=#M5HDuMuEh`}U~Ck-rc9AZAiZk{7{+wp^`CZD->
zC!EvMyEFJLF+Mq&4fKNm%jpjpjm>$E`$84|nDaX|8|94U4daG~n<!-(UG*7Fzt+P;
zAl(xpY13+%-35k;YNeD?1Y7~Z*&$H`C6X~xe2kf||9O)i17Od-A*&JHSG$nY-jZNY
z;&5Pe#(euUZU+3^n_Tc)4Zlg$$-k#5l({P)TXTNhSD(0J?Ll7?B3Ua<PjF@^HgV09
zLo9^cvPIA?p)HMG<fOhgVSx&Lx(&^Sq3f$UIv(<%1`Ows=YN;k9&Be@I`KzZ$hgMI
z@_t?a^M_^FUJ?Lvkn<Rbww;E(AOGqV6M}uK6^~a}x1k@4tLM_NL6x=F6d$%5i6V25
zWCO%m-91mZwmI3lS6W(!48|CslV@Hc*GAFDeG3YxS#g@j!f>Eo4>Ab*-1hV5&vvfl
zVZ64bb2+a5Blxp@D#h6Ii@m6By{OeN>Mosy;;p?GT62cpytN?-F_!Pou{Kd%e$m=^
zn@O33jYub$h25&YYy;<^l9`qDo9JZ|+Gf#?auk0L?oG-gCw|eN31r9o32<@-809oU
z+)~^ivNNH>!X_zmEGAY5GfTi5(f~yiN;w<aw%Jx0VH?Z=7TqBndvmH0R3FxhDf)L1
z@EsHx-uB!3=rxV9-6DzOJD_^_hIWgJj<KCf&h6WbMNQN{1O_i3kp7)g#q;Z+VC2zf
zTrxV!9bPDYuI;^vx-&-}mYOirs)FgS>gE6?z;XfTJckJA)c@$@_B{GmP^mzX69I2!
zN^!-Pq_za*-ork^jP&?%>zDY@(NBCfSYCfter6*{6>6f6Y(V{fC5u=AMYs%I0)j~z
zNB|vlxgexHmd+0h0dHKUzDU{9+MRo9B<m_L-6RJDA;Ax1-yU`}c=$KeL%~L!5dI_U
zq2|kFG$N(U?r__O9_e9l&mcSPi3=7j`@n4w5-gg>L{K~8FnL@OKrR(|9LZ=DuOu@%
z(3Bz+!E3~G1t9}_7^t=QytZ}_*&!qnl4y!9ZN<i!!_pD3c(;o1T+ER<OnHaA0s%ya
zHmMDT=b<Kw7S^LEI}j~G9g1<S5I^a}wy-mBe4$>4z)bQ&`M#4e`<_=#)v2qiBW1ss
zr1L|b*%(2jy($+C0oqHw<YMI%oSWWh`yxB#D*p2$1sH%EO<GuShXJbDPSIA``R)6{
z-Eq!Nk6VcY{hQ)*b9oW0@ExFb=31%CJNNmsObQ-vDrhNiP4~nZO+znZZVpadF!5;>
z10l;mfp#DB2}DViC3g3U_x(Cx>8#5kBl`^InQ^M6qVF`ix2&STH?xYsZ8EMgIHAd4
zqp?8gpP6CXMs2gMX5+Bqs;Z3StpS7S2R7f#M-DpXGk^+&Qiy_qPp$IS0=A;GlRTL}
zBr`t6g`aieR&COh5_C=t74zs~$wAIHNsKf3MqQKL+LQH@Si^=e{IxF(3=EWzGoq#C
zb~&3YD>=T%!Su`S2-*`<h<cxF5v66+PH?Flhys$8ry~FCBrDHMVTu=W*IHQqh|<HR
zxM)LuORRYD0I@@n6ey+OH*<2{(B9LL2i6?(XDvlr44X<`GY7GfO^k&1DhG6*0Ny35
z1FMEaa{>VWrXz@$VTdkIkx>=-kc5l!H`KwC!d5hsWbK$zy-bo*I3&u?s|xs$p}=;s
zqNOeX7k9%Y0(UJrhC$cdIL0o&5tQ=k6QTS;4l-~{h{IM0rDGixn0*o;a}$Z3wF(Q@
zucm8{ptgUvh{&C~^s!lLj_o!Nk}dw_1BUge8P_)WB=<+8=wvdJ#rt@__D!H6#IDZj
zZDAF79UH*i9+XQ|&iBWL5pn@7xT}zj-uP#)9~oon(wH;RmJI>TaL%K}t?WvfU{_<~
zMRIE69Ncx{&SnrCT`bb08Q;+BCrdWDq%~|3^^@d;`OB!_kUW9L)HJ5sko}AR!d|7M
z{7v$Y2Xm2}8(8rY&1M>(Nzqes^N6W3v9PrC>vtvifUNgULR0BExBC%CNdB5pIKuTk
z(zD>dX=T*oLid>BkL}9;<KxN2nX_28pS;MGj5OGXGO957)r~rCVg}?IB%_d0xNe%-
zKNBEoggt`urK&4Hs3Uqd(kw<vU7h8ybw@};ylT%gU$!z>L(yXPEg5YBs>rFu!nMBy
zxGrp^uEVoR_1^?f%8Gn{hpgnaTlJi)*Ql)9v7J8fcBTG#&b4{3n7DKulJbXi8pYpQ
zh^3flactt_x}vpu)1ylqTOX|E*!V)~#;yA?k-0RvaiK`w01gh$(+A|JOILT;x90Y1
zn2y=k9jW70@Q_Bi5(pveG(ZiM_*xLSM^b(G%8BA5EFr;p6ypO&3+Zx`1H^dm?p=;`
zrvcLa0qU>d8qexapUOaBK%KpTrx&uy=0nCKz|6uTakZMmVYFov!K~;IaW5(=1Rjsh
zH*b@b1K0#6NGgieT!}p726=tGe5X5tJ@8Ug;D<R`85(dY3ZWSrrdIl%T2DanjmL}@
zy3LgFnniJn(6EIjaKb$=DB$Pi<&~cQ^&nm^)HwgZ3Yd?G!<L)xKX@Pk2nd2WOyLjH
zkt0V=s;ifOe|=#RPZ^Inl*R_S`|#mv;hWU)D)M~y@8868Z2Kb~_u|EBkQ(sKu3<w$
z7=`4*9C6h_Cv{(P&MM>@ylqxeh!+01YL4>iY2`>ym|`V##QM17ECtBU0N|7Wzikl`
z<K1avvW3KAv?&T8-@G+TgwUtDaB)qz$T9gTBTr(t!6^$wytwFb_3G75eAo#)y901U
zD8E2?S(PXfg4RpfRsxtS0w5iRzVF%mf~1zs1k6bHu)?JvCcQXO-jHi=R)FJB8r)s{
z)OByDljI8t5<)vEK_sb%;Q_Gyv?uXdM#e@`u;oS@EBuzT1d`1VxigQ9!)|~nUpjh*
zPOQ;Y6kMxGM}F&O=@tT-9EKa$;UL-!9|co(>m38H`8Aj>IkddEHD0_Th@c~?{G3DI
zd&x1%spT3DxntA(5dFJm+{kxQN;G=Gp=MQ6zaTPp%T3oGbHgZ|EkaaYss8v;0v55W
zi+&u!qSfs;IPQcDzxR{HG<|_}@x#-X*IJrY3)MC=uey@ob2wu;`SGEbsFy#Un34x}
zf-H`n<ovNR!ki=iy)LzM;--vR{fx;{8?*G8aZiCcA6QVVaC$wgZUtH<%}u499gU+!
z+v$=yzTE#(V`^zR8o~#=OdISVGAi4Rq4U`u%kyJtSk1vHX+J8|9@Z%Hq<((^b-*I+
zR0>5Uzqc~0qLSg!y~(%tCezaN;^<Tig5Pa8qA?<ICG3LYd7Y~Z)qiF_3tk?3@nU<F
zP1)KAX<K1Xsf@y9|7z*^sf*@b4RACL(_3j9Zc<;G3KJMFd~1?+rAl12G3enAyQq@_
zm1Enobnh*xWZg;nR{gu0$F5u)*;RUZPH(euqgZ)zvc-sF&_i^k6G%RLb>Yv#s?=k8
z-^HwteHQNLnYaG6xNRkrf7|=<X3xsTndBiwCsyYXx0x`56*=SV;H3O!x7XfY`D(Mf
zZZ+Gh+`4sZ^#aJvb!Vca&sS<OZSB4-H_IJ&Pa^%4%3(?NH4~yfo{e?_)^FavJ+G;`
zDy+(PcC=N>$#ypXWXYw=mxD1A&pj7r4>W2qHAEdRqQ2y8;4r=T)lTGA;4V9Qu?o5u
zUi<Xy<1$ZNxgwnBG`e}I@Hy9)!k^X`lESKUUF8HFMw)Glg{++&^HPRL(=HBS{X<`5
z)wZ%7Ej6@BN$hNiK6!MVVYuF{r@qai<!S97X&=0{IZ1udG}b8H=)R7Y*#2X%=#BN(
zTQ>XwcJ}s9`@`=+4EFa(UE83NqnkXm#95%C!xzbm^!#@1kNmejBEQ|1OwukK8WpX7
zTdaR<VZN{`wB34%akYECBIVVaH)U{A-Xut)#7ao+y8&1JIF;GM+d8_@Am#aL^BG!h
ze%^A@f#Z#lm{ewFW{P0|jY-mY==<wA1pL{7HrlV2CPk`z?reTb)^hIHn6$fQt$!mB
zxU9d?Ef0lQ2S#q?3IV9f<{lp4WnIBPcvT>#meee4FAH7GNR9${SJw!a{qFrN0WYk1
zTvGE3-Fue8DNP1kPq*wlT>7u)%mb|t$(OxX(t1Nio%s1qS2FyVp=o(P{d42{*yH2N
z=<Fo8L<9Ow{meB4iPI*$s$I`>F-9gSmh$eoTl<eR=SS0TpL>qJu|l**z~z(ExLRvY
zkuC5ZGN{svwq9y74!gWEqZjRdY$2)m-SeJ<|D>!d<mQuk$#I2hWXjCoyNDz{6ULzF
z(ys8{uro}YQc(EgID7m0_6pm{37*YHd|xglhlk3G+2h>5PIk^AloNK7<XihcE9>ZN
z-v7Dm&A)F^>iquL%m0Ll+(&#gFhGms?dM>625MX77LYDcbn{sivaG3W&qU{&kxUai
z&@oCy4Iv_cZ#Q|adu73kj^Gtw0#i}EJg_YM8RCQ4e(m>H15SUvXX&*#sS0RemB{)H
z-kTCs8mD35Mn9%IiaKi`3ek+~KiB*D`MLB(nh|7rOZmBg&LI|NW^z;+At`2Bz3QCW
zRt~04a%|zD;~bkfgb5x>Lq`^Yp@SQlj}M#netHBu*oBN?ceI4iP+CSI3brkXQ6%MQ
zAjBaY9(D^EZOx8Hu|a?xy551le_wh4SPj5&f*uCJIFmeZ6hsE4_*{F^VDG@s==o<l
zDB0}EPV7K508|`1=YLXOToN9$FjSHb9KQEQJM+IE8jcrn2pftALQFIlyUApF0=?5I
z1k-;G7Yoy;?`)!7c6B|1-*A$y#lpgz$NwBb`;)kZ?ZW7HZG>=)>)em+-gsN^g2f#?
z<M_lAj_$CvEA70<q#D7^%ypjIeK01_K|>?7Etq+0xBvEo8{*b(5v~#s`40{HTDTXC
zlht*yFoPbDQf%_uBc!Yabu$0+gATF?=v@KHJk4{#Nf+L|9GqK9DlS8>6aP~4!%gfM
z{2Z7~Y@l70kJEaf;vO6CC`<#BN=_nfT^qV&^cOOJww{+!9>^YHgA=Yo_+uq8%Kk*2
zqGx2QXvws&1=CR4YlpJx^?>*lVDN5#|Nf81@_aw}y871_c98=SXL>ovsu280Co}{p
zlxKBLx?m~Z1XIP+p6^@*;mHOZe7y5`$0azzuyB3htD`(N=^9Lot%N9W6Aitt0PB%=
znFOC~62SG7Bo#RPT%bZv%(hw|v$z9Fuq#w{>?pcJmDJeqGeXTN#Xv}0`?`G*VyP-7
zr7~0?81goOIOK`3vF^YHS3MJw^+^Fo`y4<`L*iK>k|YtKfJiZ*i`v|VlcZtUO*1TA
zb-km2mkbfsV*vPTX2S2H&l#I=8O*e|$gR#qa3eS!3@jU#8(AHB&f}q=%vKSG7&@Un
zEYOGCM3!Oy>?Q;hV0_$#(?7HB;GE}&z<w-IBbsat!VwZwPVflH)!-_xfLIqqra;Gn
zfId{`5YrTel5SR43Gb#q87SnR13%Mu3A%LB<+NK7n2%BgK5UHtmuLZ8gAbs4+<QgV
zCokZTXgCWYdjY)ZW9tI2g2*ePsR`B&cicDAHLK{_z#5u=d%2DzhPdmhM4VL)IFNj?
zxM>X!zg_iKa1oUtZrF(~1UD%^6cz&0U}@+^UR7ljAmC4i1H}OA$rNB%gm>*?B!oJE
zLJ0IH3R)LXD2q@i$<mw{%O5|H@)`l~oLcGo{by8u+#z`ahjPWelgi=5gX{^4q!gY)
zaY>6R+qtm!mQN!ifp_c(*9;OHeFNGuEwsGw3WViW{4=mkVdz!7^hV}M09qH|X%bYy
z>)%|%0#UQH0EP)vNNl4G{RobQ)QuM6eYoo5ebaC+WE%;|^u{OKOp1WZ=i$EXLsM9L
z=q^;d&mta3J<*0d@yydoKtk(`5KvY<(4xSwgXEYe>s?Y3tr#Z(?>``QjtUR2@?~TX
zwUPw)ijttsT3T9DP=&q#6fsCj;vSUA-2Rx)&`Y*jx92^QJaAwRPCzr$K8PoiL}1Yw
zHg}DT1mEy;c;+{3sdI>ueSnfSAif=<PYMu8!UM(wm24uB9g&g>N27Na2;Opbzy9hW
z5s^P_qs;Y4;E+S?(+6`RDap;nWrr3a)~#80xW)8q^zt0KfY9tfa(Y9hh<fzs!;Pap
zv95i*kS0_z_{n++<CR4Dpa&plYF&TNn>TwqQjO?i?LO_nMJ?NL9ZVN&;i2AhU5uut
z`rx!<fmI8@CJ1z}gZk*4o^~LzgQTQ4;5(Ui=ttntKBN>c%LFKIt*x%^Bn&@95m=_1
zJm8D|joj%72h#*n!V1C=NlG&MDiNiGNH-0`Jg=W(<K0Gih;Rq|3f_<{<-8W>1|0e2
z-3}t+mqS#7>&31vMt&Ye9=!;=>5VcvO?a<>b$peu`S#-cv%zL%7m#^KYz(HRf^gQb
z3(7@=@7FGSel8G2C|rU7@766DL2uu@nQOdk-HWBWMQ0cM$K9a1{!TK{?j$9NWgqes
zx9aCvum+PvI~|zWsJv)<uXqp)UyGKW<0b>Uk2}ODM-k*tZxOo{$oF-VYTyZU)jKHp
z78@j44)3)hdA(U&JiSAUw=h@#ej*N?PyyL)5Mei~dP;FaO#_65cbC#up#eO}W{?I<
zB4oxPS;GnZ0mH=l`TbpFguo{pYuB!o9!V{K_VBjT$2*%?8Ej!u=>dzNf^)eR@)}}-
z@J8mYcj>i%HR9J761$-l-_&GA;z~y$c@;@n$$kZ7>w$`?gg{%LZEet;bq6CVfMbP6
z)@gsO%<wz&a4PUPp$1Xfpo-7$@LutRJAKvQ;2_b~K~l0p7p7N;wazxS*f#V1T=?Qi
zJ2Bxh;_vlZa*G1jfy9lZl6SWrBYB4^jr(U4I;l3K8LN^*g`|fFGKSh*1aEL~;xq~%
zFNwSuxvMhd41{vUPFMy`T)VahdOM4785R(ss0qdacGy5nFWYzSjDyRYq;jxvTt|Y<
zAn!g~0Sc3uG6(C9ZS~dwlBC_vx+*D2z5|GLJ)zG~!N$VxK9ZI*+hP%K;+(5XK5_kq
z4e|ZbkR%+&+IUG{nVabN@ggC?2<hI$!V<*?)Xf!aMX)^|5c6>glAM&-1(X5Vadb)R
zI{x^Vn6oAze8s_OhOI(5*L1&~h$;xJC(oQ|?~>v5zk$oB$wh`ly#}|+0>6e_i$J?A
zKgoDW>_7dj0_<{_x>(^x-1~40pAH%2HbR-v!tChDvuCUBNOc5~;|nD|RR}BVO#kvn
zxctNj8LFYF2eywi43kbS225L*BPOVs-;(uY524-;lGZ22h)86S+tVUBgsor&ROz|k
z>gsxk2yrw(y)~Sp>G|``+t1z;%5Giv?O?oK)w=Sd2ql3`=>9$j6Ptwdn63xn6gkdq
zp)C++1<Y3*$oC_T$Z%yo51{B+;6e+oEX(pN%iRgj9^Sn6#08IJ`}Nc=0uiw`>UGL{
z?QTTce%Ped38OdnqL-p*?yvQP$~(S$qcXPnBqpCQE6#1Uj2g0|2Z1sevMhlU;8QV#
z5KQK`0n3+_@9_Q>%Q={nJ`i4rC}uzobg2u5L4oLjCE8@m&j{W0<jIphCfYXqyIMSt
zI9<2Bx&T(19HURIi%Q8@<G8p2C2pWOZQH6Fl>MJ?nn0CWy^3!8_U$F3PO84uYgo7p
zQNLqoO4bcntAMJWAg6J}s*fMRzHEl}gJz<V6k@{>xBFEsaNnQKv8N^$b_wzeF26tS
z`fDfyE)9(l;@rx^8i$ZmucJDgi$TY8$@sg1<C|Mv7?*&_oNydBSwu^)XiIBsa&=QJ
z`9gb2dhLMMx}u#sNbn#TfQy`<_!L`z$D4omiBE|NSw+0$mG4KVO#!<#WD(c!dlnxL
zwQfDEE6R;b!$HpN#0dssrNBnrCL*#<$AaHuqLi#S!uI3jT&wo?X$?(z{13iao5r5@
zxi=2D&}|92XZA+Nk2Sy6KE|r4j<DGJB+yVi!d$yip-z(@5SdQ<y6Laxl@mHI(WrE?
z&U;xh5BIoi!k$WV8r31>3+P%EH8tiyCwYUcYfp$!dOCfqXUF|>pKYTCB6?9WKu5vd
zRU1W`h&Kc2MK`nt6>R@nc^XPpews<cBthUE0s$k1n1_g$W@6q01QFTCh%HqElbMaL
zl9K#dM=ObghlmDHE7^cY6o{@1#$I-H-Mt>wzB;RhxHUckzBX01l<%2wPD9_<0*n!%
z_uxbePQvx;*T+?beIG@p%2rGbLx7aeOMyWF1HN(NMwRTacjI=sckkY%m{x+pnS@)!
z7;Or{^4)A5J)x|;Dx+}@gnB(bkK!1V50*_yMH&d^?&HV)1W967my;@wPjQ8g!xs@_
zx}aL|!TVg?1^iG>>|%dewvuf-cC6W_m8=2@t|i+#?C2IBGE2aGuTg~`uodt-tTC)d
z8rk?NP9qfRHCX)qKh+jf7Jv#WR`@R{K7hk$q2Uu)|MCnUlKtod?y8@n?%wqQj8>su
zfZym&quwtidd|{=XTYaj!SgjZ0;NE#6-Y`ULIDALMT@`H3qYwc(YTZ}G}s77M}j$#
z9NVmDY)zU>Y2(tN#vkR-3e#n~&~^9ZBR@77RsCM?6+NV^^s><WzOHC^hmh27oFmnB
zbph1z0L#`_uU<93e(M5suOUD4k9m^qw=+^k&}zw!kwD`%bN^waegau<A@ip`YIwh&
zpnJG=R>W}%$svLgOQMlB7ZDUt?8YzTy(m!`CKLv?hMeHdfQ1A~6Kf_(vj}yEzv73Z
zWe&K-mhjubVnrpex1?e!rbm8mz|iub5Q?M-U~jv@@0SDH_(63tM(&5UeXGfvL!vfD
zEE|BdpV2FSvz#~c*mDjface%mp8%mBmyzKRU_aDRD9c|}it@#CV1S+<3+TpDtb|Vb
zS6j!bse-K~epppdj*x+b3ny6sI8K7lb0GAcM|oLNdGpu+VsFFINy5aVap)wl%kd4C
zj@aU4@W%?KG)~7V2tZXks-#3m@|kDJ|NbFAOeh+_OBLVA>fBW&w>Rx0f`0)VA-nhP
z{hRUt$#HOk@I3$Tzkc8-JBe0A2tu%(e*^RN)=GeEvTlhn4bm!g0ubd2(hWilPe9Py
zf<QttN`$2#@>@h=!3)>p#33;VXJ84*0f~Eyl8P*qD0P5u*5Z=RFPx7fSDFBTHbNbr
z3#_%`CZ9HvqmeT7-cMD~i$dI5e@SpiljVTYq-1dw(4ODt-kWv(z9!ma=i35f_7LAF
z(sk^!v7DZBc$>2d^Q-ZR9fC`iYq!pZ8u9F((q-A&ef|Oy&z`87xYvvxUwYNIeEqOj
zQy*8etUqsllKUOK^7fK^P^}Ok*vWGy>138cF50B`@?jaC@($pe@S#JS>cI16__+d!
z%pubGf>=4;WS`$o8Pd4~8r>YQWXz$BO+d!*`>XSi0=p}MNFHc|l}$(SP=LHih;w+r
zVX?LDd=(#BhD=}rqBtW06cH|QP~Y%I_4)voPp#sL2LV*Xbs4W$P!%cwECiznLrPOH
z$YeIujaQtJYQI%ea~h=gT2h%w82>I<xKzN+!w6SuZee=MM4L##Mm!8HS(d>h&jqv#
zb9xXKa$&47i4Tl{4tZbP3YCM!@po4c8zf{;e*z9Mj`|0ALNfB42I}e1Fj*L67)i`g
zO1Ty|mt9Vf{r>&?AY-1Hvs_2`!;Xz>FOYQ{x<$@o{S<Ef6e+htObi<_mk=ii*@vhJ
z?wRWe3uB0Yl&I@)*|6$$Z3Hh-zzDuUqw}uUi80FPyoZC!)O05TAUnkcu(ttn_~{rq
zUgB^ek~K~<-#{BUQaedH4jkzN5{8EuDhcr~E=l$Wso^D7Sg`bjdnag?IMZdE$3nm%
zZVC`^;_2|1IzwO@krDD725&+JbO`v}xI!}t*YhXr8rCSuj)_T+LIJ<eBa+@DP5k@B
z>S&BDL0rWo+b0<}2|R>)LSZ9&O$d&CL6ZN2B49Q3uj*04K};eRIe!~$hyMEf+~2%r
z%s8V=E%JO2IFJg8O9+=aahZ?&UVJ<~J<S#r6m(HZsnm_qGCbpS5Vz;?o4xIk4tNwE
zo}!a><+!$S_=WFArVj$In<}uExKpklEW3N>BzIfkrnM)mikF-SqCn>HU&evaFHZTb
zeRcb*I<E6+XJ=(`Da5ivw?Zd_T~9oHc#fptC^iBXBCwh^U$hOu*q4A!0-Q;8ys3e+
z^1<`>#<Rl$2l!1ds(jboEQXpBsY89y^mIp0oT%KYpF%6vPsw&a9Vy(a2~nw1^yRf@
z5srL$^mp2`mR(O|J!hCrxuWxR6Xnw5N7uA3o`-FwX+p-7zO_m0*pkUi{(nu1+;6ll
zzR4E&P>?(%B=z1ByG87znwrj+8b#BqS2L<>Y6?{LWR_-)uA*rB8*NN{@gj;R{mcu6
zE5n6b_wL$NRb5+qcsPk$zRvV3{qxsxK-}rits1@m*?#Ju?a#HBj4MpbLPKOj-*M+#
z9cw*=D@a!RDw!v7GW*3X1dFII^{9N}I<=EaTX3z{W*x=%idD8w&AWUU>P)mweR9e?
z^RC%sU369QknnrG5!W9n!FoTgEg7HquITiFZ=P6~koMtxP_6nhzE_(1Z~MrY&Qjxh
zy+_tsj<c7?KVK>}<bd9HZ9@J>{Y=ZhxyCDJQ~>a5LcoX^qD+G5=G#-bt|+pwtG4_o
zj7Eu4;R{O1@Qfg-r<-*v+;uQRj$yQ$Dw{;DXPgz>UTeO4?q5nhf>w6Z@M!mpTatWp
zRr05%XEv$KDNXKgn}(w|F0_cwQtON2Q(Ox>9%*Z9Q>Vw;7Yr$YEPFqH`s7x8HdZ0p
z-p)=pGBQ#R%`Br*-!2{c$NApxtEQ$3zh>NaRTgBuoq9-dXa7)R@7WA?q$!}^qhr^U
z?#fSL`v_6(_qU|LKbBiuSqb_+36_2i^k64!EGI-8iZ&d{27FfO@9hv8e~knB9=cuT
zQ)k6)&COU_fO45d-3mXkCkd{)iaHGyk89J{yHqwZ`zasx;h<pUW@PN&m+<VFp(Qp4
z`;3d+AS4faTieNk>YYqsytS}5KF`!Re8&DYbv%Vl?3liO%!7OPYy(ZSRsTym#5wP&
zU~uiKD=2~Rqgy7_#d%%;BKP1n9$j5sIU$M}sDibf&)~!o;}pyuvC9PvOvJUhE#tHc
zCr+Gb!po4`uD4g&zAyi_`ODP8lF2KU>O&Oxq!lk%MC)F<G?&>loO!)<>^pe8Oe9nH
zMr6O^_`^);Ma*9p?hXkFiMes~@6%t_ew?u6<$VnwoN{h=hTCNKhewop)SozfexG+O
zDSKgQ*_zG<q(T}xQsAP{iz)~8_L!KOn5<jXDIE8~D*Gv^xLw8MINlMBE`k9k<=qN9
zMAcqj)ERcfH_MvZtr|ef+ImECy+@i=^sh!hP(P=5De2KfT?#wmA8L-?EbV*=FjKc~
zT<c}ioIu1+0BGWd<ICUeF7j2a1uqe;zhU9*i_pv9q;a^>&GqOlKD}LiMCHJTs-i40
z0ow}B1;-WTK!a;Zq|xh@zK4~f!4Q)y?g;8iN^;)2)|$1Jf@_U38+-oH#uYb}TuO3O
z5C8mVXvS^)_rlW3$1h(J5Z-gqJIi2=ctqf*h}@lEkUn7wR#7J03bS!5-CE~;hXP-L
zCz{H_A4?J1f1~h|CwK35o;`U|dX-Pp!7sl+NVUItX!lUlyGbW|6g9}g3Ez8hFJtt$
zQ+}bp(P;z3MXHi7!=u%{rR?}J#ns}~;vq$9uNy;qYWSpWI``m*lSXjb2V+HW2MyqE
zXPD=Ecf}p@H*(<?(K*QD<7@NQ7VD{J#?AU)HG!l|Q7P6QKU94gJvO<+SifW6K6U!)
zto{4G4bL!83f62<w}?Kel7zQjNxSwW9NS{Mp?2d{VYSub-w%FKqP&}^J84?G$|hU$
zKR4X_yMv;@@T@?8Jf5<QYe~3-)ks`>{^}L-nlDG_;fPO6fB$}LOI&<}Yw)!v>>&6?
z-(xXpyu7AC*ZD(-@ys^|Z095RZQ4TimOdrlW_i=Y*IPBN*Oof2ZhESvy?8|WrG-Pm
z56`QCCCf5mu64|l{XwkblvMi@r?=iR?|bs=*@4gR4@9``=IljclaX$@;Ay(Nk7AFY
z{|4=RB+JFw%=)6Rj}=rhFm@g(O;4YIq0KPSW;ah->7^~S&Mhq;Oqy{h7vG6TIgD&L
zlhQ)T;VDt~DlSfFbbH@A>b1HAd6veuxMP`(^4DAO@w*e+R384v<Bxb77^p*^qi?bF
zhB|I-+&U}%?I5Fcs3en*#;H@epT$F_1gdf?#%azB;_7>5w1hQ5gQX?qvQoT?S8y+^
zE+ridZd4EMhD}A>dTbK?rH1d3W<S@)jqfPp8haeMe9{-ayg@R*f23*Vr~Et^KY0#M
z%_wQl>thE0#X@*^xDd;hSD8gWP#U)Ona-X^3?*wQh=O(d5=7~2jvE;nG5BQf|NQ5f
zHMM9dFtA)NlZSG>wMg5da7~FSShH=gq@6S2sa)BU@Re>F(IM%ProQl}D}4dynx2R{
zzbP*5pOTP#(D)}Dr??cMi73rt7wnd_XU#aaJBetHPhO(kV;xygFKB$qapu&V_37;E
zKQ#q_lRh7NUjMY_G`98E&qOzTqHB}%&@Lj<vbE?MxPmFl>LBwsCfd<xlGKEC@;>0&
z6JPv_H(sk)zre+oqvYQjx$Q@e<lYWk-ptC-gxF%nF~*>O`Lb+G<b%w{pI*g^tG7f(
zn$0gQhf~Bk&zP95>m0*w6I$|G5v!5&4Gdiye#$=QT0CwFH|@Jh`G#sleTok}ne3LW
z$@Mz1%oG&|SPWt}adBzT8G?pZxZXM|XX?bxd!XXAcWvO{2?5FRZAU^cyndLM_Uzdf
zAs@u_y1J)QVx{9Wv1zx$Adu=)*IPSQ85+9q2}~J`+T}XDSbW9OEbSrq18Vu1_xlNz
zbYanJ<sc=LI=+%<*;=)0=gwpXpMrt{^SAa_uEbTQ7{7MJ!O+Ut@H5L&5wja^W@hFN
zku>|eZPZ#72Mss3ynSs;dSjQI!{~TOx1mO4BeVn?n$}}JPY4sXCxIX80eJrq?~CGz
zcKMsrHXD>H?wlCs(if84K+#mQRCWpNn<)M%9<ovRN>ZlrlRi5N1LaoLW$(2VoTiL>
z61aMr7#Ufg-H)Vyc`b{PB5X&gsr#Q{ga6yXY+S${k$cdtW<qA?|3lS#$7B7z@8eH<
zuc+*CQ^>k)k;qO&X4w+iD=W!fMMl}mCVOUYD#?vxmYr3$WJZ4H{d#}CfBgP=y%G;S
z@9TM8=XIXPc^t=yNX2xk^Wp|V8ERug*6~s8Tue*LHMlI+aPYhT9-w#AUcY9xf<}@7
znBpivSMmT)s(WR3!)_$Oc5)vZB-324)=qBh1AlH#7<nrdQ_}{#phWeeB+Qh>Zy1iw
zQ*hfVxyt%pS?WF7p>@}*ymE50g8cj^();d8`{zl+ye5(@>0z6aDE)b)Vak_3Vt`WD
zR8zBk(d70`WZ!pC8%?hvp{ZL<2ab1<#wL<7fwe@>Y{IB>zS*s^IWi&+W#^HvMkR26
zy-B4&Yyb=RBHw2#H8Dc0C1jm;8IRqjuDg!~v5tR#KW2d*$x8U~Nto%oORE*V@Uvd2
zmZxHO7-$$^TbtawSA-I1P#PIn+bd8WD{8;Ro+kbZNr6!SCyXi8W5@bsd*%w+U;5RH
z9N>Q+jMj8)yiN@suVpVTE|wv5qHp1vbAwgd|I;duBv{f*PkoPt#UsVXjb9KIt+7k{
z&2@ZWncSCusS?!sG=q`E;g;|BM`#ry8;0~Y7d@pO8*n`vqhxC^a!_<&@n|&Bhr-mH
zHsh<Myp(P2697}60%evK+_=8rbl@VXg))*%fnLqiZy@~^-Ywo1_HcA?R_swSU8{Ar
zeSElgytbxBCL)@Q_mfgS!g%zCQV-sjPKz%!QPSGT`u0`j;J-#$f`5-d-SY}}4#r<8
z0&RTjA|2gH+{>5udGo)YyQA-uuJ$cQ;DZuf*`(T4fChi>?((tp+|yFxM!vw3bwcLk
z3uiq8JFxHam$^UIN=mi!kERQ2XEvn<vS1^@?6s@n^W#+3%l+W*^z>#PtG8R*|Aa&k
zLl|3)8^(+v2~o(_evqN4%bR~c#5_M?(v2B9`Dp-VjMv!>FI(r2EWoa=MJ~{X@8pdg
z$H96tLCtqYG<OWDXaC~bHqNQ9r?{dOw{PFhn1;kt5}{hHwpH!3pbrPmLse&9dMa&T
zQ<4*`{kySvkxQu8bo{6m=Li3O9smdgu9*%wI;*#AuH(te*vyb;6`P$`YSMHuRDT26
ztClFaRgBZ*drZ7W8g~AgLyMUUIP_mUSR3DB$sef-lAj~(M*G(}{cQlQoQH9P>-=-V
z&q<Nno;Efj<cg^UsR*L<C)zIU0P?0&Tl$Y4Wqa*7uRAdZxq`QR-bKU3G`6-^{$N>G
zL{v1kqNphKRa_hzjy81aY?APCgA4)A5)QXK>95;p#`&pM|983#M@bJ&ua{(f^Zq4l
z!02~le(5|9FxSXWHb;!fhSY!#s+jz&ZPe{`<})7p8Y2c8fd|XlhX+jW#wvL8H*wI)
z4yHDf`_GP!j%xke0~*JUP0BopZ2Tw1`Xy_}ILh`?;X8={JrM>f&&x~Ze0O`DpJYAy
zzNL<_Lkp2t(vMl-*H<Ta_3Bk>>P7VKvG3d8w4xPc6#)V4)IO1sw=d<$+>zWrR7QOT
zPn@X>S3O6pM+^`Ez`1N@3KD#E9Hv=1?xT!I5VHzH7$Q6-Df~#DS9}y5?SPzAfJ&ml
zF6~m1wJFQYmV(U;KH^+&EV`>uw&#VQHERqUT0>Loapm3Jf9KXY%~m8Z!kAqadAL<?
z@BKY>05TEhO%;^&h|-^caLY=Vhz7gmHds)2!!R_o=B^8C?87um`ZIi2Etqv0K%HT;
z?%i^p(nm14L>(9Fg|Rb$j?VG`<Ae9PD($bZK@)OZU_!n&NzBZ2dHeQlGk>2tv$Tip
z<HZn38JWq_qN1CxWxSm)-EXow*qm-|wZ4}DQE_xWIcLEi#{y2QZ0#6!l{GQ$SYCiG
za}SB2aUDOkF=6|x`Lm|0g}}C>g~sa0j}K9NH8nN;&=ui=Z{f(pc<V}K1qB7PoSd9A
zubZ#0uRCzkH%?AYzQb0_YcvrA&PB3H(nD+OR>CY*OUwC=sVS4uFUjiIvVF?Ao?BSB
z3Me^up`f-0%EO*<6Z~7vaPuxzRaifKm=15*tMySX9HIj7hov2O=?q!9t*L4q3k)ld
zl4t*74<1J)_t%QD*Ag=_G92$E!2pE8=W5%p;VY<3nt=4<gjFx5pDFbR2;R2=U?VSo
zeC??{wA3#?eDJ{5#^9VSHf~=8+qbXK`B()E?A{*q@xi=@$wh++TtjYV0dwz#L&T=i
zJeNgP+4i3CqCQ^5MzTAOJm|FuutIh44LaL|gvG$D!rKIjZ<dO28OlPkP^Jklt<P__
z*YNNaOzS+pcRMlhyKpT$#{BcHuXyv(Vtn$t1V{P=Ui`rhh`8MrL6oEo`0Stvw$XnV
zSZk3NjU1q*-0W2*3kW{eNiq{J=YRr&^F;_vK6g)xau`Vm?wdzFNYz77-x{nkeN~np
z#NbEm(Z-2;M2GuVn3v0bZ-W#$!~%Wjf+Rn_mT`ozS}YSm&Vr8stn5<Q?2(75>U?x+
zr8L0dK8@-f{Nr3VIsMojV=_W9I_#2I^>3f<Rh;GtWr3XzS5OA{b<k8aloK%he#0Fa
zsj7LYVcGZ0nMcauXYDjWNK5(>1xs%B>{{|#eO+wJ1*l&d;pH+Yc{uXWNn^GSW@&2t
z3_H2UjUO8BWij2YE7|a0yJmIJ$nE91Ns)MSJzJh#J3b-dT>+#sfg`z4%u6N4#mQrP
z#O}-w#gV+XZ~MG6u)Vm0>C-&_0>|Fh0$yRM6exEfZ1~)P+s%v{#iYspsvRD*D)t+K
zfh<hR_?@kAXzGUVa2P3vQq5Ri$l52V*N_suF*2}98l}3c@8wlzKVHs)*8zDD?-Yg1
zes?<RUK8i!S&UT?T#@!aCxq9Ojohr7wbwq?3HOB|qUlNxM0XpJ8P&t(-1w+VSgRO^
z|3i7oZ_V&dcZX5C<=!M3-&+?6@r?e|F#qOcAZbDNs=?{rz6TSB7d1(_)8zG8bhP*X
z{I?J3j{MUvP?lesjig4Ei+y7{1h6@|XW=TuJh92T0BlCWIFCrciRS0y>k}pqL0VQ0
z{+4idK7#6)JAZ^df8++jbFJW^7fiUn`Cu0CK3j;iSC#ZqU%x(qrdJ6Dpg;4h1b4f#
z0DgY{*CDQ1*TE_4g3%h8<77FoTKxOg_9*N4*RW(SaVUAu#9D6Qb^sGvk@noV?{MQO
zz^RY)#qox1-<xFZ2@}_jykNY>Ep3-o^vEp<g9`Okp~=y@X5+e&r)OhT2M-z#L&&@1
ze9tQoyJbbTnu8fk!xz1CX&+EXB|jew9CD!lxU2NX4NeSIOeyq`f80@T#hn|qKu?g)
z^N#`y+EZQH$QrvMP(OK^2c;2;gJWK{uX_1`we^b^S5+jF`@|VK^0avp;?mN-EAZ|W
z+ocI1KJ~z@+Ti3fFf?QXzi~5dbxr6SM8Ku3=pYN@F`mAJlFY+L9CAoSS=Pa3$b!i_
zp35eG3V8OD68@nUyR^4B^3KlAVuzGkz3+wPs?4SKl0W=orD--@uRfkssf!)+KDFAq
z?^||k?eKi-jSbvyjlI}|anLpE{olEe(Ug!E(R`Kq*ceUkLEf!4W;7e++F=XX9uI+b
zal(BBXeOR7bXLVt(meF!{{UC?(qN}<xI#~UTUXr^&~aK(QPDvHq{q#JhprmOv5G$`
zQ3r#u&ekS|g@+brJ!-0Ts+u3dTY98A(70d1SczRIXH2nuD^>z|Xd3lmPIwU8GMD|o
zr?U}wUs;-@g&*DXF|S3iEd&P0f%lNW!Ij}RGTyfVMQ}ouEQ||J9s`v?>lfs8&D$bx
zGBP%wrwXO}{`omic{YHMSByI-*AWDQ4(TlmK))N?4&z6*YjyBTu*C->+CrWP*=rtD
zEf`mTEph|i-+39WvrGFp-RR&Kri5^L-475Y?+*VH4CO-hWhRq|Mg*peGieUD07=k+
z8URk~obp@E%1WJpL)4;jA`*297NqK-Xl{q1sqN>%-^@v1Lf%Hx`vFTiIkHfs+6wi2
zo%1V;Bu>YL$+~);{Bl-!3?T$29@3Z%mV)a(QV0(h3%mEKbN%0+rKP2Au%T>Xdxiz*
zNc-IyO=!DKN4yyom6Qk((Gzo|p$&dq88$s9<c-d@P{pdCjDXa%=LL41Ur_>+0M|Z;
zE1N(t+2Pgr+Ns2p`oE_z5*Ge`d=;|H6#&2n$_fj8H~@^nz|AFSvrMEtuHTvoKMedV
z8wWJ~lo(vQSAn|Lry}KZ0BaAR25o^|xy7<M{0UHlzk_P=-G3YM0?z)KGlf^Nb{s=n
zswD&VEf>3K(>@JFASAlYu)!t0?m^^<JPkvz?RGn0TRD@FR6^(}=p`Hvw?xx4B96N1
zFAUWik!x|UURiN*bITx+sfj%cMdXAbZ&M0VsY$~O#>U2O%bPk>lOYfx40ZMN#C(A>
zkV^)YF%oz@d>x3K$}zPX4ySR}_in=6vj|_d<9LJL(7(b@&>1HR=~PGgK9AglY84W%
z6RZDH>ga{`qp(hlEP1z7msmeH&J=OSAjTOEEN02wbZ+;^!@ywdrh3r|d_Od`-Dde5
zqN_2yuBwCw9Smam983DA&wifEA6dhg;92y7eAb8|TzI;=R5bPIaoHXV5+kN5D#Xc|
z`>-K;ym5MS?U`-U*zq~Un3k4yYY-4xIt21xq3I=eP5dt`9XvK|gXrj}1f3elVW~(n
zpW{zF;gys$q=|0>u78tO3fl4n`nF_9_}I%?nD?f1Vqt@z;YRrh+G5%sFlAlJRC+h8
zEe0siK$@c~1%h$JQ=4vZTj&F9HKuRrvl&dEdW=m<=f}*Yq0btEG^H1ipstt#vTzA8
zg8zP5+shbl2W~aAY})-G?Hb2MG25R~yu7>?HvJeUmY&DL^yC-rCW*g?I1H>j!IE}=
zxR|cG0DOU%-BIW5M#F*M1(o2Llj3xzcUUBDli+h5qqQKwceoI(@OnA%mVrjdDxD^4
z;DWyic#9&=iDb)dWgiwVW>vm?H3wO1_+_c^jX}bY&O6Ta&5CIH*SdG_`dCADb_)5b
z!#x9sZu9`@_|B!61^m><H{tK;+Ghj&K+YiFjh-Pwy3qh0i^iuWM<`?q0eZ4k0;Zof
z^dAAW$}=9n{=>bIAMBIiH8M8yVBNC(ttLV4k(HgGZogg)U$<fJUstl45>QkT(oA<^
zV0IC=tZeJ~K!j!pC>*9p(qx?`#t}yzW^OIEutKz>P1G4=3g0nD4%S!inn<#RHiBP@
zj!j!sWWw07e>YmETgy1NtOnc&g0C;9SW)7-l0xLOr2qH~SkAwgH!0hC_KH^t{j`Jx
z1qA_5)i+u@+1`%`?@KI5K%tJA16f!NPu+ap{2Vqz>C7KLCY{fFpfnP*MmpQSwkNpb
z+bTyp#G=kiFxRmC&zu7VwB#nCmVuHwr+RRFoH3j~^=BX_tZ$m$?1WPc!IaH7NgO+A
zdKU||F^CX+yAIrd{`sTpfExd|B#KHFHfmG?97@;hzjlfv=o$b;0a6QKAPt*=n4}6s
znyF71eM~fPkML12A992G&NxIS)-=fRpR}4qrMi&g<8nGp{xkM@yyU{%*E=xad<U@g
zn`ruzt|fO0uSOG2$4Rq3Ovbi7(Cj>*?wMF}XDO)lzv*zA-M6%ApSIkJNJ&b1$7)d_
zV6Xk4UA^d2{R<Yeqz;UQ4Q>{^h#sRg!e(t@(MX=i6s`yJPZLCUxs}91BL7_^C)~1G
z_QuHqmVqA+UDHI}#>Lb|=r3PvHUWF}iUT=BTU&b@kA?#H?Xe=exWi(D@A%i^0XEKr
z_wkC5!TU7g(C@m9jXro`??dbT@hT|X2oQlAbr8*bx-m^a-}<;c-+hq~H|QBg13JKo
zJjPg1&(Bp;={A?eh|w7kVXh$KFi8Sc3>X7z`)vF3)Qd(*i8g7=0o64%n(eb}S0HBs
zIJA8L;{Yz^YR|rThUne{jxPaXv=$&8LyPNLqEk!}7}&QYqMdBP4~+BpPK!#QbS#4<
z1Mn~PQVOnKfiSKC(6YC1cwu(cM3t_?hc*?Y1GCmuHfV-O3keN!<kWO^j^AF2jV7aV
zX?_tInK};Go|(C}wk!B!wojv@Rk27QfjnF)5fDnB>S$}D3o0wo0`%lF?=h5tFzEQ3
z4J2{5ChI8LXU}50y1H<HUo#D@2c2Ot8KWd|W&}Qwb<4<%6@smk^q~p6mkh*J93*KD
zEbo-AaiFN<VHKp75_FTW;x1)Rp;v$Wv7p>#78B8$8%kK|)Kvu9Y(kV_3a>PV9W|B8
zUA>*i0`cZD>zo|=s{iTSxpOBWHT6gv0y7@K88v|7vNJ#MhsAP$mcIm#7!G~5_9qfH
z2UgMc2Wd9dI#+N40XwS2CYls;!ufRX#?DMye0Ij5y0kW0iy-fYl=KW>?h)66Z5CAC
z_R;%+4Yhf9ZH%;Dg(I7=C_}hg0bGg@7~9m97MOc*L{%%;!agv^Xbk)D(UTj%?X<Dy
zn+f%%v@E0t<qJ|wt!7&!h(+4+B=r6r0L4|IqDN;51q!P3;srtxIx9@h*|X#>04El_
zG;H?k`AdXo^5ISEsXrw`AUyvbdCW#k7;<y|;2kz!t7q<U18IrGuP54I^~a=n9P%R4
z9tIu1rb)-q=ArXtrz0)Hr$)3X*zpmFnVC{CkJ6kb{ZZ0g)uqN7!!4S;iI8GfYxDd`
zhL^^N18i|s2h&?h;`6f%^5<zrL(eFX2b22&0P0wc-c36H&grj2U$rzeSYn|h*>P_O
zGlCOv4JctN^x;FM4o^iHe+p_U)f%l?G+0Z0y~09XkKsH?E32hM3O_@S7H(uLE`J6y
zUQmp<bM(j=WrZ_rDYzNljWtR5-6kKYy*vmR9kddn$9!vbR<CrUZFur2$BoVgw+>cv
z%ftRi<m(mb*o)Adrx~J%S)fxH;GiRIU6LAjqF$6;U^gI2z95ULPPtm2l{FW!ot%q5
z{uj>2%gs56TR$=^>DPCU7H4h{(|D(?zwyI%-tK>R-i_P^1@b+*f7CIU=BZw>{(Yl0
z#{3ZxID!h(A-EJB*MQ9>Jz4jZUbNY1((D}s@6mZ{(m+-im7xIc6Iv)ztUviJa1hT2
zcFl02PA8~sPMKLNG!Q93CgGIU>J(Rlx<y|{=c^@V{r>WKfThUW$2h1M#R?OhCQVs-
z+~AO1$T7RP4J{wV1RW=hVH51lDS+LcFf$xJTRA9BW>gS*EOy}ftq*=a2`>u(31Afv
z5piF-q#pn>_e;>s=r$1?*PE=1f;%jRAn^VB_hxlYYfwNh00I&+?|x^|Pcd8jf@lde
zdbYazys-_*Zb<USjf6n&VPp{S7>k6!liq<F)Kt(AE6ujQziM)VgK<0;-;YtmX^Cpu
z*|%9pQimFUVg)tpG8}2ECKdm7N);Aa<rPJ_w^j1DB4{v2Pbir^X>xRl8SVIe`cixn
zatL{)VH`ae7kgEd8?MBL$qi>VV*Cu~q!?Nr+;CRx+s~UCn!%l)U8~@{*L4u@>bfye
zCz}vCb4MLJh?^S4`VHe~UnbWEbeI7KfH$yHd)~h)U^P)~DwCvR{<@j8w75u(ECN=H
zw<h*(OIFt4L2LNSR~zLfRehY3V`s8Wx49M$Azezhp#L};ZaMWCvjJzltQK#MWU`J8
z3Q55i-<<1v`g?n`x9@I;2j4$$)>d+y19db3()=xAf=pOo{2@*Xp&fQm3r!|`d^YN#
z$Ny>jBsFClE?7cl>`;=h+J)J8H`b2HlxuIO>f`#?peE7`WD6E0C70#JMdl~Kz_3r<
z{V)8HaIY@{`nv-z5B2#C4Tt7Htv`MbulCYHMHux?&P{GHT2FUaPB4Cb+0~^G0MObW
z=;~gKpe?%jXB6{-P44<@<_ulz>;zY!CL;1L#ldJ)sf7at%#t5VeaZFW<O@6q_@z`$
z^}#y|_mFiWM3Ica?;HWhpa`m|mWvBL%CxFVr3u%z&cWwuN3~X`+%qbHWL$M~F`a6l
zukR6L?M@`63uL0SqK0+$qxLs|(1kDz3c_ol6c%lsc3%CO-)DeC;jqifnzrr!Cm8)f
zJoM@QxwJQw7KB{csc=1Fk%A|gk>TnJqVR<ANx&{81QhwE$e8b}m5o&Cd?j8#BR>mX
zD0R-At1(s(-#*J0QlmE2`f90P@E0uk@&tNw2#o(#;);{_G+~$8O-V<`#R;?8Pm2Dx
z6C>YYsb4RqI^e&gA&{Txjq~Uj=*Hw*J7_QA56!%K-fhfE+FeN2z%qtbW7L8Q1kyS-
zZm<y5#2XzMp$B66OJTn)^r}$_MX^J?nO+mQ7F~OA#dv?W*7<ZC7KLg)f>s@>uFCF#
zj)u02s1I-O<%1o;7`g^6`fiLaLr3r9FRWtp&ojE5_zxarats|BYW3T*nl&+XddYfD
zA9R(4=8KeFte)%{bg1JqIP>VZdJtDS;BbeUIZ<{`pH_54at`1W3U*v(Z(@V8^RLO`
z-wjg~<K=0Xh_s`!i3+nd!Iz%}qcH(C@S)F^JN-k8#BoVXil$v<yc_YFI>Y!-f^Y>~
z)Rr~7yn4dpCkQ|PK`f-!13v}MtHYP1QFRraVVN^AH8ZV@v!z18H;M(3hpI0#NFd+s
zz(6zjCCFsFu*{EGRnxv&u|L>N1AaMTIj}2HC{t6@X*&?^1pEc|BaC`>ZG950rmd-+
zxBa1b%k^WkmD}iwx0T(}<-*W0c9A(-nb#BR;~UIluJ7=yF9lBt2tVEMmfC48*{)AL
z`<Pa}hyH{F%~gsOVAJa^3_GgUX;R`8*po1!iSJn?1d>HFJxHJO){3Y#5t^$7c1cgJ
zWn6e+np80GjKQ$gW9`bdyJ!;Kqyc$(8SM-)B+zC>@*uanvu6HwSU=^zzukH*&C+a=
z2hI3~2d%`t23?drFcfj8hc|!Ds~MXqiD3)T`{u7?R5;R*vRVW6Z%NkTUU$+;ZP6N}
zlMa1uvj?=Ue~gpo!#=RFTQp>w^nNMLUEAP|V4)^fQDBr9F_>dBmwUeOTV+1i+FU8t
zu-^QaCVMD#03A(G<Xs1r|0^9XFPMbdKEODFKS>7Iq_qgQJ~{9osOG<Edm&e_uq@pu
zN_=7O((rcN83AVYx2VPCF0{$e)v_}lWqkP?5yc2PoW-4alOBCxhO!lBr1m}^D$dV?
zl;i!@M+_xm1->2TCSc;Ah)to?QMg<V4b-UHpICC>+*~$3q(;~js>ARiqf3@;lh?nk
zk+}`F+)Sz3mq7><5~<$|`<m<Ktp*=kTzWax+i?78ciVf*T8gJp7Ws7rPWThv->3T=
zG;jF6{kI3fl$r4!R|B+V{Gh4|!XKBxuPFH}F}Ksz>+|nztoHe0!bY7{ozgQBk{)s$
zc<-TChGh3FroOt+sq9^6BPoz!oah@d1(37nzf%k3vdf_UrQX5XJu}|Z=-bmqwtgU#
z<>G5iJ3j1sgeBWkR4xngKX~t&?~qwsy1|Rb{Oa`YpgcP@uWj=M*I;@-?F*ah0apj4
z{xq2Pkt;MfV9{68D2nn3Y~(=Ae45UJbvS22gc}5Oj#f=2A`@2@nQ}&C=IrRvwZ#CO
z8p$(+UXZ7o!p3>z=<V7^D_W02MnUU2p=qs;a>wQ|Gfuv^aXS<6$V83^;5uwf;llWV
z{{@@pQv{?C=8Vb*@wbI3vy#?6`Hd1XAb~kAqFgJ^9=Fv0E@^sPTK4`_qTJV|$aUWp
zpKs`L6-D``IGyB!Xr;+K34}T$z_{r-8HW<y|L;O^C*o0BSO7uZfb64X3@ZR;c%p37
zRIRUFz3oHD9SbKyW!il4-}<2`xA@aZoEox9-#78kY4TJOqNY1=x~FmTJFlF)wK#X%
zf8|QcpKclAtDQ}y%NP;QWNL+xZVb?_d;ob7P<_ET%6sw~X9rMmDKu6n!uc8MOr^z%
zx@qjV6RMS^r68zQcmA@Q*MzH>UfBMwjnH0PoX_(v?>JQ!vMgZ<b+11hK9{s1pmI1L
zXsOVsQ&s6Gpb{|O-N<GZJ2;NPp}9dL-W!1j^H}Lq7?d6Wo%ANw6c484^w7o+^!CO-
zxx=9}CB@#9K{_-dTq8lA`w`}HGd1)7B@<N*u}2R5_Ue5)<QPQ9`|%RUKEGkyxIAN`
z^f8EU7%!Yjbj&ZdA|N$(C?Yc~{n+&RW*H?8`$83%Cn)d|42v<yJ6R<IGO{m@m6+qE
ze5-VlfpahBb!WeE!flk0I7&TvKECVX&T@5Xp<6J!q5CVBqJIMM)qIBMiYGb)F1CeH
z83sf-_)_(pZ;i;+ROtKZE5d3_?8g3xnF#b|2$%T(MGzZ04#tbZqJph|zP^W+iYf%J
z@=d^RyD=))G&bm%G?ENlK8TXdbm+>pguN^l2;`%A9&N*-C&?uukn9y4NE=!|P17Lo
zh)z&y{m-`Eeb4Fl3-ia=GoFVRgg{;C^ecf^_aoNr!aQuHDQQO(P-%8=U};vTIL<#r
zQevb&T`0eYr=-meMjzuze$hQq<|=o7>2$a%GL)-i8aV{yZjYEU7Y7v)uXxH*N<K6V
zx1wAnvgo<m3IjtBn*Y0<>s;Y>wi}b&hV1G;@rOZ;^H8Z=`Eh#f?zY8z)S>Oh0V0~f
zm;dcW$&4{`YV)LeU_YZv#o;+~N1m>f?!m6TQ<WSC`-jL^eG_80IXC7W*ing8*Wn%8
zwR!I-ynmLGw3dy`D2qBa+OS_MZ`w4od;HDl#C)F5$NHB?0>Kq|0~C*l+#j6Cz^2`C
z35)TZhkfM@ZChati=Q6FuihravmmKf=CpJ+dej>wclmc<-Lvb3FZ|jyIdeGvFB|*)
z$}ke|<|C?dD`T@h`##~vL(M*Z^XYeW+gQ=G*?K3~N5{vF?C?S?n7*-yy4`BO<z{d|
zE3X9a_N1swms8wJ_`UyErHTryS6suGqw`!CwPqA0QSfs*`i^F~fN)hZ^Y`nTQ8?Yj
zYq$eMDi^n9Kg>04?i7$=1Q*YAq8rmMTKd$}?i`d3eX{k&M^c+^tp`*EjW^XgfYe?B
z-A8+{9Nm4E`SNvic?2`AHNB>I2h2fezz)3Bj2NCEn4tBvDhOaPG~Mn~xOVptHDkU<
zp&*U#ekq7D&TaGw-?2rPx)Oy$OSOmeb>pp`MAeKChhvk-7~YNUwVQ@+Ra?rq<zK(*
zw186Nu)GqHH?<IW)17`5Wm`5>qN-(b-G;o0)m=@OqH?M1a%ki&&COwhNIY_!IgnSi
zTY)LfZx9&xuY-^?uiJEqvDs1P8O8os!dWoMu6a)$+pMZxzgI^hz9$k3D=DKfZB6v0
zLX&E0%7rfc;2H}_5)nC}Xja<X-y33Dm}m?3NL98cbdQ$%m2LV$T<N(LZlE%jV{l4u
z2%ID`4gJcxy?yi%q)KHs@h9d*wgJq=>cX4>^lF33X4daAK%Pf_*N=XHxR?O4@Be%i
zz?5zQT;}tgW?CB0s;&E6L3egXw}IyQd6MGuyd$CZ+g(2nc1BLds~${V>Cgyte;au3
zmPPBu)!>JO3>PdKv|F6SRi4gwJID=o^rz;!+K=bn&>R1*i4V8lKk72^1f4?|6@d}t
z?;t5_`hj}OsS$@i=EnZ}*B1_P9G8l}3`aFKmOqbR79B-5nz7c=QqR<M18m<!`o%Pb
z5Pq|kyVpmsi7;GiX-GaDZM?HOj(Fftlactb)n9z=U1#T8pKFZ|5_~EqE6yi7yiW6`
zsqc?`&Bti*+4;#AWWvQO3=M)-T$C=;6oHsnf&CZe68~_MMdEq|ERe!L3WmThC&Gv%
zUCR`1CcU8J;nGDUP)BoZ^&AaXJZSz{Z@RJspuDHP5)Y9BVnrATWrjYO5!`<a+JYx|
z7WRugGGEh*)q>>j-mRvKJ>M28nH&(q$W1KrYPCt^mUio)-I%AYcjL=D*-j@15%t@h
zs}(!-Gn}rED|X=q)Ax{NfM-f76X)kiVV6S4ADhr#lsd_kSL2|q&1Mh0ERKf*Wx*(z
z5v)Q#VhM@M$Phf>gALBn>B($qgF+DoLS4lvBvf&a>yvbco6nW<T2Q~V<>lpFL(&R&
zathSGs3=Y7=|5iy@F6?<JMUClaiwSt*ZGn{P10kxgWOLo<4S~|5~FMNjol`_wHBtA
zG8fqHCC^VebAy9~>mV*XpMQJPqP6E1+v9`xnQHD$m+ACWKmP!t*;otQt8Go7ykUzk
zg6W$(D#2?~3QB%pL)M_Hqa!6GBt(4k-}h4JIz%w;9>xo|KBo)zqOK5l6T=;4raY9C
ziPKH6q@Gk%`|rWf&O`y3#l__W{!Zo0>1U6cC_l<ot1P6190#$Reh8!PkDA=5>!v`y
zo~jVj7%nObP%eTe2m&^e4>G|zW>6idHBUkDYJwjK9EBwub<ugL+qoyQBB-)a&(3d#
z4xm_km+tx@`5?=7%{`8f;lW+cveDnA1$UHs+Kfpm6Unv&&u~}#Jvg2F0*FgKkEu3q
z^@UJzD2Z}t;X(~}6FwSs?>jsCj}rh0+%R&euuH3mWfWii3<4w>I9RyrHXZ0_IazmW
zG%@^UIcL+bwe}XO70qUbt%`qyMvd8}N|hcsE+VUt7$r0l)WONp-YJnfJ$2Zg{UND+
zp)jH7%YUU5V?6%2n*~_EFe1P^iUQ`_3QQp*fmdqV<8~SBLVaO!?<=I40g$ZKLCX6i
zp>cIP9y<<FyQl3xiU?dRn(MMn1ms^5wA_6D;30Q6Bo-ZCe^VSz8dA-*P@RR}TO;Ly
zASw1ZW<fh|90>F8X^$+TIMsPW6*zK%*}e>Ruy7WEakU2i$i4eVesvx+F5gWA4fiq=
z{Vt0njgLu`XYR3?NUq_OmVd`xa>ha7rLp`%X5K4*Z08%MsD2sOo=v~v@5AytNh1Vx
zsg)v>S~JO#o+ERRTMGwU5W`|BDq)R5z~OuZ+>7#^CcW&+W?R>*`&s~|^8#RLXu_IK
zh8-CIYp(eWDYqXx;IM)q-)DnpL_;FC1HyzX6?W)&w5}xlN^%?R*IrCxD5uk#;4nG*
zAbVH4TB$&tRzXbpbDa~oG?lCY?REH~r>M=RLm<pg#mz}mGKAyUd<0?WD7b9Bh7Pid
zl1mJOXaQK<WN?~RrN#VLrfotwo{e<^*2D_skoED+`S_x`u_Tuc#juLNDZ4;;pZm;S
z7ELd;Sqt9>v}F>bZ|%dq|BB|HnJ#1+?lYim@fR?9cgRGu1LmZQ8A?!vE#e9ID{bX)
zmc6WVS^!y{Bv!M@O-<~<og)b@dZ{pQ_#OU)W|Sp;UPAR*wDY_)b3;Ib`vvtYk}Aff
zA7(gFg{_C*#>XdzBtA{!4v+aqh%Yh8D}9wUAs)&@izeu3t6%-kLt<h)?JvCvWDT-e
z={8t!4WxclNZpt;=hdqW&~}PnpZ{XC00Z;HfUWih1V4`8Tl2LU0DQg7!HWvh-RGYb
zrv(B|7H3H>&Kk@8IDqX|7+zDRdUDu`%7p;(AQq+;$pG~{`3IXd<%i^i@e2ADGD$Ax
zA%aD3x)|n{u8;vV(T)BjrU_F!o2vR?I?P|A8j5o8GERi1@%79td6%Ric;8qD(gA+J
z(n0jS1p7U|HeBb*cXx5$Kek|B@*Rvmyu3gvQvxXCQPkiH-l|ax)gNg`vFn*ySa7=p
zt5Apj>eIB;S{?iL7cXMpB^ls5bml#X-eUvALbyu&dxP;wxxsy9(o40IJGV4>Eqp44
z&d5nfjUD=eo;Dc*4EJRIFU?!PaXy03@T?!M%M)r*TAE%(f7md#b)B{Fz%W3=eA2Fr
ziok+q2*;DE7xNw?O-EYGl|x%nQX(Wt9s*J~4B@yWIUd-v<pYM!0EQ2lD&WuK#TV#?
zMfv^x+wdBRTr}`Iu0vzdFg)N)w>&H_?#L>Vn7O#~Q}^v|meUIP=c&XLEN#BczBcFm
z-yj5dOWEpEd(*={0eg~J+pmB8#f5G@yz5138m90d2nUX*(6yJm;roSz<A=s0vhruC
z!r;M}n38fh2>m1D;7*HbomF`jIgC25^}P#5?`(tOIaPDuqz~<A(8Q0e!HQ!?RE#}6
zn7(KP6dLmiFlg@w>aU+O9K`tK<hL9+Ub%oVvG!H(A4!>1ZPBd$D=-OXN@jJV^sT+>
zSaBdO@s$4h-Ca%7a{Nzh+0>|ifIQ)fm?;y}1f=P^vJ8}#_Cz!6YN49yt^1OIx32`Q
z1;Dq%IiEmH^KR?`C{ktrX#WN0Itd^%@Vvx0UR=X&Qc&WyK0Z4=ScAW92G5h<U%`}m
zzQ~oVZkqTlstZDr$+cF)k&{eM;awN+<cHxsuARz+Vh&Q6LQ(@%R)}_U<HHe*+Pf*W
zcQ0=s{N2GQg4BDEO=qFWL+%{#?{qY}(JC-gr|G(C!d{An5iwTK%QpqZ<v3PK5Awef
zR}0B~>aKBNkpW-B1f4HNxge<YfQcH|NfuwBO{0Yk$P1u~P2t9=J6s@^*2Aj|v3WZ9
zplP3Hh(2OCg;&SI)<kB_3}Yrql*C6sx%HZOoE<NF&dbE_@M^<B!z7NpNG)*CAPzsX
zp*2}qUWSy+s?3vWvQ8GHqDoM*0`uR3UPZJmYF0ARwm!&HiK_!EM4X1`;s>iE8knpa
z%i6jG`qC2x+;x@F6Si}|*pF*}#V8ti1oc#=SyqcFJg&rjBq{VUNuEHh(SMiuzMP-I
zXp*J=W8OJRoT-jXnpAlU8Hq7H@rG7v1!nfN$>b2AG{wUMsiJFc@qU1C@g9RFw~7r`
z-{H%r1D!4yZ)U^jQ^Hdi>(TIx#|2C-9<~5QZI`R#->@(OegVFq@*AG8{>Jy54v>J0
z%<i}uSAPk<)3hI*P(D_iG2bUBKl#m?5N<F3V0}jsH`ek-Dl2^f6Xn*)j(r?X&rXL(
z=~L4O&~ujnlPZCcOQKjR^4In26J7T@f5|ghwN@xEcMN>~tOLUmK&0~S{&EYbQ`nNA
zN4m1OxL#kB^}Yi5mgi}%g73wKKPXCN6OxmOpv&K1QsQcA=QQ<Y3k8o;t7!Pp`NG-X
z+ET>TEcTVF*NPSLcHjHyfUS+~So;xYYD*Y3QQG!OMx)*EWo}7H$tPfze|8xqaKHrJ
z%CGCeYs4g_XANp(`(PYvi`AdrW~csHoN$cQHgBdRC$B)RA~AWO`e;EahL4)~9fVtl
z^_+DUn?Q1|rgKch%tg=6)~CeNQ{$KI?s&r>I*xsY$vSZI{dGrOe6ZXIAQPr@*I4FI
zR+SM{Y|dEwNH2Z;(RsmSzOCv$L5E+vM|W}8<sx*{ztz0~NCG<V0mu!j6(aK&EYe&1
z5uC&JqqRo5ToadrlQ@Flw+-51)q5QnlK*#4Os6<hxhUgu*nEUd<d~G4JPAa~>tofW
z525Au0YTYiUivyg1^34wOk^?yEid1%(US3WESDiNH8ss{JX$SVoSszv4mdeU9t3C?
zZ{`*hwLYVxV{SgDTE7*w)@o(RsN&(AV)GaWfN2sdn`!X!fS#7wKhWN`^kBrmz@}h-
z6d=DRn!ye@sOMfwERxQz?->}_oPq2W%a-{I<IQB>0E-2B6C2km;tso^*ZK{(8(lUw
z8TfOk5eiG^F<HVC26hXpy$db1i?kh;U$`=d;&6i#iNBGKTiYRo4_5Ud)*o~YMtj=Z
z7e9tcse&*{Vx$@Tbc(^Bx}UE%61F`cwYc&POpZPo>!9UShnlGs^8R#}re6gskO}NC
ziuHctDc9E2)J&V)h$&e=ND{H+%ENgu=GpFi--Sb&^m}F8y7~<F{5uqZG9euUMMe<{
zPlGV>#|k4%2jA+%d@*Y7euhaKOAZFu{f2u4cMfWy0;o;7z_rSTwo{XB*(9FlZnUJ=
z(GO;BE-tAZy1RIu3n?rc9rKq@a^J92r*9Rh4L)Ug^`}(&E(yy-u=a+*&+h^<rz5Rq
z&*cm6XO31;D~NF`;di6&`o4#IA^x376yenvaE%k)QXb(@daau`H&Lsd7ia66Q!zWi
zO~lts9(t>>W8z3FB8%F?e%|Q`S4yLxd~%NgY)2@-ZUj5fod0#94J>O;p}6f{*g3&q
z(vgmp-J9cOr`TRuw9ncF)>t|QR|Wl_adFT8#x_x^vWyU=i4%8($qvpeoK6@i;-GI9
z_?%Z@mg<`Bx(Q~O@L*FP$PiC+FLhop5Yb3M-vD1I-o9#9tgRaEZ-T?ObKoVpaqh09
zDc!$J$|TN`4H}=n7**k>K{Wkm;@H}MPsa!JNS_nSIh*74RIQyO+k9IMD4;IQ<^|Tc
z|5)c-0^_Lfvf|+PbM|lRY#p3LQj@GTUtfFtn-A<BU{m#8ob&I(;CD2F^9B{X<8)^R
zus(v8yZ*brO51aEytX}ruZ>LH4ymUk4{hGvvS-O~kKP{r-gx)jW0HjGeI7feka?ZU
zWBQ46MIW}1@LR0ru;NBO2Is6Gcpro6n#l)tS`6W~&f#^%@GSUdF#b4^lugV(FnR8U
zhM5HLmgI^H3mbryl#D%P*E1`sq8RGok6LgsLA!rcz_7yX>1WVtN3O3szMO0Nh5jVZ
zb2muO5Vd*z*k)>C>pqYEc;aN8qR*Ez6ziT`Y_-LuERFR$3CyV*Q4DC>Kw0w7AWFH)
ziEU|p1$yUJUhTl;oQr_3<@I5GO4MARB2oCG>b%$>J^(kb(`7C$%rrm(`QXLsuj%Yu
zjzTpqoYC^+PXGnok{%m8?nKD5>kt!s9;(+jy!QBH<I|=)-D}sFc5&<Wxv>hikLi7K
zIHeb~GYr~g<jd1%V{&&f@N!znyvc}YzWu-8voWmD$Z)!V3fhB_Dsy0^Gz_LUQSZi9
zTEXFLGCzGR6N085sE$h4!EuJ2B{Uu1IHIGI^dx`f*Wu3=66`-J=0Kl^eza6CwE;y?
z|5E0S$3|hs)#Ah_&HkVcR$#UO`U{pGe1*B^-poW8P*I<jeXBKz=qaqWr00^%e=_LC
zOdlQuao}?*j5e@LTQ(}&s{{wS$5xO7aV(UcG5^18Gxg{;vW5FaT_jzc5%-2@ZkQeW
zL1Bs8_>g3$*y{Bw452+_X73Lh&lDT2y0`N>ha~1gk+F`gU!Mob<BFMF1O|2CI0;@G
z>9rd#e{%%Zbbt9!zJaOdX?jn?;XQ~o&oRoEjio`&PlyU$`1DXj`yjvet(6C7Q0?s2
zIE*;abFO~^#8PHy>(2@K*t8Og7LU>6N6JF4qidZR#T=%-1UQ<0t#*~%)=a$Au#~R4
z{rTmuz(iu}OPy{C>>F9CtDUwB>Or&_FCDa~Y3d00D)anUvPw_AMF3pJ4`aFo4ast`
z^f_sfL3exm)t8{){0)2H`c)a3^k$D=C;`9uIernXy-g+DHL!0B!a9t+w7z$v%yR&+
zRZ^@-0IFh=Ql@zPu@|wO=tP<U!t!jj`L(^U!=BQ=!u1b?6SxJY-WcO~2{><hleiO|
zo)@%M2stRFNka$}zEtfDR<M0IyU>oeq#i@~8@j1mk&&06W__Oy2?^dDKpt2tM?MxX
z3f%yH`5AVj43!uPd4SM2QHN-XNQ@>ZH9jT97DmiutANJUJKY*axp$+nlZ~;%U#`-T
zLKn>JA6(G>f<d*^GP>G6UjLX5|9WfXi0I*QW{WdBg~(gja@~C<wHDW@=5{HlGfURF
zzI;Jqnto<MPvh{{)1R&-^&Zq0?~kLXDkG8pK-96gFgx`r-u;s%jfnP(oB?m5T?gW~
zr+$0(b#sb$QMGyas9sriY5M1n<!l~9()j`uND-;eBL7K(iG>A7T;E`47fxcW6N{?)
z#!|?;(bM1yO~n=iqw`8S%Rj^~S{sA+wXT-z63{+U1(Vm7u?cZ4EQn%Lu%vWxQIRmn
zaa{JVQ~xzwBz&Ul$?N{`?BbxHFO%b?4%bWLFDhcniSLG!R1${FSAGotd`>Ua-Xh%P
z`x+;;qgUMW?HdvACD?Hl9B;)ER1L1*q$*f`-l?W{fnTTcUbhb6m34M8v8m7a5XF`8
ze%L!H)~Hm^D+D@8&0iC^OfwZ8X3vfPiuh&$Q{5OkQ9*vPa7f}@_wd4KI9maZeDyB{
zd6^*wy!SJfHnwHFU^@_aP0Mk=>mZKNT_6nkf(drWDrcfW(jYKDg1{^U-g8B77o?`&
zjS)?;iHp9{`Aqmll$v-7>yPB^40f(S{*nJMW1$?p0sd6jsZiOV6EK2Bk%J*@U9=(}
zn|iUANA*X+(8E!y-OE-#f(^6J$sk``{|p?lNPRamJ!tQ1Zy?I7_;-QT&^<(Qj*y{{
z!m($<tQ);UXa0a&VO=zS@M+oFOh7v~o2u?di-yE!KR#<7I`*kge3AO}COF%PQqh4A
zC)3&V*@l;Z(LItwo4?ZUs?MQHH|AYacAR_t$eku>olKu0fqOyfE#^&hR?_>*pN4##
z6@@>qBgCOK-#t`q+@G{m?-0GKJ?Car;#@d#gPy&m((?K-SG}T*`V;*7!OlB>L*M=&
zg|z3Y?Z=w2Na^{tNWdp*eRl4vYiT`9by8velxFJ6@^L<T>;@ti8bJAg4LeVDHaRJ2
zAmi$z%M|ozc3;u+B&E;+fr<1CPr&@hKtZAF3_DA&xl4=b5~s-m3OUB+l1GqjVIhx)
zxuEKA-k1^EuTZNUmzLl+BnyPle(`HcErL8Bp_H7EunQCqmVak#$IpF|W^%7e4)}c*
zU{;HrBj|103N`;dqHpBks;PI4TF-k|eCpvXqx>+JFpzT6hg(|sEu5QDhC*)K@k0VM
z`Rq#+hq#LbuJfESqzCJNlKms)XIgi`E{Q1F>n8=__KjYh6TMb~o1eps4gF&TvKe1b
z7H}^cIxB2`uGrBS6xCh|-TqL==H~akb2~1`T6}WHpjS((!20dS@)(;Jsrujug(de)
z3pFmjv_kxdK1HT1Uy+m?H>q>HCqdJ{bL6KVKaLGsfQ0XWs@1dMjz%P&$|H($POZ;8
za3^07GMl=#MZX^eet@*d$wB+s=_UXtuK_Q*4(=oBKp!en>mxukUP}#S$OW{eLh-!`
zX;Ody^3wU*3nBOwk!t4Pc=rZ7Y>Np_weS9V5m$q=pF{*TX~O6p?QGHcG-Rw$`?7*G
z-R_mJv-ZvQz0uZkMw7Y<VNqu8sWAObryoX(yZ6D>4hD%3eQA681Z(aEFayXNh_H@j
z)5}ubgm~zz?cTBTQvBKHKYIS|%BMS*KrmZeQPpC@XT-?Lb%iWImWS+Duaj%#TY`Ts
z8zv*ROb=@}DFZ&JMB64)rnB%Devf|brD~zvF99zp2K$nJ-E^Y<;Sqf}Z|Ya&bY9Rt
zGsez1Y5r|-8U0kX==Ir3(wPKGDUm9QD{m}n>}q5DD8&fo4~nkv^11>1a4fQ0i{&e}
zfV~z5?0YqH<9>MGYx8To#hdt${^LIQ_IX^OX@x&}!vr=#oK;`m(B?Bm#z*gia=sCc
zTQc{e{MpH36}gAS0!oXE8SldMF<}2;UDtvj_H|~6K8%6YmJ;RV{UsE?{`$9A)h}=l
zt}fjG^}7IcKXU}{Soj)wzn<QE;8Ti^-a2`k(}`Bg_B?#Kan!$`x&5$*Jh_jc8*R}s
zan?htsQ|bgf&h898+2pBKnTKm)B}Qpo#FJQ^@%sYu!yahC@nQHhnF^Eai>tH`c$Le
z1!h|*j4L0W{=C~)*;hu{wTXdywTZ5;NTSH~q;OuRjGf;~I0=OqA%V|VIbHst*Dm5m
zu7Dips7G!Y9}QDTA_Up5w38P48(!}oUE&aJ#A}<XBgHfFc%M^z?)C6;rK?Ey^3dN<
ztLsE*FTr|>otL+_sI1KN6dF9?NT~lK&LO=pm~NpDlA3JwBE@I6(N2?m;7<Q_D^aHc
zlmdhOeSLg(>k6bh5A8QQYY)#ygsj_MaO+0LL3!#2HpT^$8-m5<<!y^Ff`a&+{iu4c
zPfEduIwu>OqbH8%R*i5f`kUy-ZNOB?xajh^(n=e8Rw}GJ-px#YyygTklb%MkKF|N0
z51s2}7_VVRSArMYdwBI&SB!a>*`^3O9~xr()#D!$+jE7#=9|FR@16Ih`Qs2Gi)Pa(
zd~4K=)So|YejwlI2o9#XeVLvlP|+wiiu?RDt&yeIH)%cT8-LX8qa+M)`E|aSBu9VY
zBDlrt_{jcCr+PT9t6yKpj#sZ%if$e2jg7gKk%2<5V3`NhF2yMfz(?xy|Hts^vZnp|
z59Dy~snMM~*)ZEkUA^c|uF4B(;=muvJ1TU0+S5dueZc$NASp_a9;q%>Og%!y_UMYh
z<y;ZcIS0BX$KG^dD-}e9T>kyl#?)BF_#ICe|Mm=e$y>mBdQvuaoCBVyR=Pf=O&<Mr
zD6p>*t&s+Unxt4J$;~#nw)d_hX_09Lx*@h+@5Tx#LOas98m`L&A@q$|6#h3O2Y}$A
z3<A=CM)0b1bQAe(>&wX>{hCojU9Q>QI>s0Q^VpLO2iK(=rxuE;j~JDtETk}M?6i2s
z9`D~88)g|y(oYNHjeb|Dcwblem2BJToAm41I_@NWmmb(h54=}{?VYUTqe8aLe(79m
zv7sEWpT;XHU^?$btwQ@au8y0zjHa;6Nj*M#-{+b=XcQd4N+220;i_~V^P<N)|3siW
zQ&teUskHcSH|ny|0v1TG1&ebq1{sBUG|%U~n)?!TR={rRaS<2V;U#@wJYX?{fWS-r
zHhQ#L%}`;GP}cKtRlt=OPiFQwY^CE;*k;k2p|8WZnoBpX@doP}M{&kT;jX-S>TY#W
z_2d~0f51+E1lLvV!t%FH;DqCbodE;J#4rU~HZCcN5CH}R)vA&Av$W5~-pRzFj7|&D
z2Gf;=#rRgqe$k58ig-v2tX%s-IxXN@-if;NOf8w8Kp|Mf@?5q~gsc1aY@hlEyx)zU
zebV?9C?XSBPEtfaw5fIt`WIVC{5SGh-VX^-e%ujg&iPD&8bZ7I^$8wsHQ_S9`A#C?
zAeJ1vtcDski(rdsf6-h}6-9e1S8yjZGg3v;{oecQXfWj4OR{F6OZ^SSXBkzPf`9%<
zpOV-^m@2cj=JfTwoLlIj6<0$Hr;&pQdG`_4*&7BjCK1Vt2WCSo%*aencR2RDp6Xsg
z@`$-7H^JV(ieuqh?(XG<0J4G(*ZRP2nd`4m)G6XG6T`d*eaYW4`)YVlPG1fp?zBLs
zeZjD&Zd}e#ZkkL=N>Xrm0rf-<DC0n$fc3Bh2eO>C?{yUUdNuZqm$S+VzN6j7IYO!`
z-9_srYky|Mg_mdOIZ_e0s+TCbYCv9BOA+W=$xTr2b(Ilz%nc{bZ?5xg&fFuOXOx4l
zSiVpSIwr^9@Df?Vy@5T{pYkNW%-`HMGJaO*9{lso)CJjdU$x5=`*Uvj;D3M{LL9Ts
zD&tiO8hW8x@aAMF7}L-<G;B_}3c@bnCHsBAZ1Lr{`7b3J=HS$VB|H%$N%=wt^ib#!
zV0b5vjEylubbFbd0A3}@ZP0?OflbOv-fer`yO{`y{S|E4*cndXdTMs;`K_zBQeIe>
zm4=r`B>R)?_D~CeF_(X85qot%>c!PKXTrv=qpRx%V^o25$&zHPY##e&*NC^aTg<ed
z0H?CiS*%tvpHl-hVoxM4jgQOm%{4o0KD^&kQEqy^YC=L)I!d(3SEthg|DLMiqCHC&
zM}{7A#sn$HSm78)N}e`jY3HqW{`Y?b`e1>3P$F6HjzY&gb29NXspLTI%K@ffT%Dex
ziRtNm;F#Eamv?UitT?M>fBSM}Q4T&9xKS&WrRK^))U`|8Rkv|wps&9N-V50ABAnpe
zdUQ=j#u#_arpt}lK1cEfQC_jOIP*pa3J=3rRX^ICX3s}m8dyF}-d~Gs`N?JXBDj;(
z<cS+SFQf4E!75ioL<B57ZB&ikS%v&s9=UI7z9>}wxroX5_8*5N{|E+3k3R=Z?B8cN
zq5=Xpw*CE|Y6ekTFp1Zh*2@v{=U4LH4fCvBIy7GSw_V^N|AN+D<R;ldq@Jzl#kTg>
zga~Bu_TbsXg;Oi_1sdr@C|!GS+jrnYUei97g`Vk6i)lalaE|d}l1O|mRknm@<H=8h
ze_LE4H$*YFF0|r?csGgqd3<@nvmtYi@Ser`6uqLhs|U5IE)}JV&_UAu*{?>NA}w5I
z5h-GHi#nLIv*YiZ0kKb~vwjK@+Y&v6(D`%ZHgT0oB5m|!lcQ39t!Q8&_v=B`K7KKU
zk@z|3Hl??c#6)AiZ;W3<BSwwx*7iWiopWzwY`#V$hQbYTyH~O6s`mLt1K^5x8$7Qj
zygi??redWcWg@9e9g=;|O8YHF_IgYiOUmcKzDoZm)*SoVkJf)r(|yBCFcuSJ|I(<r
zD3rng{?wYxA`jG1f!{w0#vWQd;D>_qrOW)`xyPg$fNW90Iz5kk4PJbe4$jV-?cm;|
zh@eqcT*?dV)XZLS)7D7A8#$Vb%wEzS7BckGj2e9TKoER?B5+Hd{qE|4Y>AluG<Beh
zq+sa6#QZ5KM;b1!1@%pfR;sWFt`snhIfh}q*95O#J<3$d<6L+Iq%KyttWV<q?%EUr
z9EP29wgKT`Y(kmFQpKluCq!5JN53fRM=OFs&ic7~Bd)~ZiNs|r9j*(ryBR%QFQSIN
z51+fOk&`!FlwNOW`Ly3)u`HD$CBsJcf&pOHVE(WO-ulUQX&a2q`~Wvs0QFpnHmmls
zO<mrHrX3pMx;o)U9}Itv)^Stb-XQ1c0{)z`?<A+|t|67B-8Xw4?<?|zb>C`zEPsh*
z1qqL}KSkrAX@gvWkEy^+{BF#`hJltdG*afPfXRO@;wh<iK*GxhMa)qPggB(*<+Zmv
zX!-(?oqx{<-3Fc*-ro;DLaTLJzNl$tiPai-Lb$^0&g_vzjv-gPr@eUrJ!RMaSG7@x
z>&{E+AAy~i*AN`BgNz^+2?aI%N@Hv`!G4PW7}QZXDcJI88Ac%d;YA+ee);oIBb48Z
zuQT!ak+H%2x}D^Y?A(9POODNm5h<<>i<ZaxRz9vXWIi2d%(&X<Ql)KHFOpdO<RElf
zgf_5(4GwSQyh=;6H-iq`tT{NqSA71@5|$IoU<zH3%J@VlowH*%rfq<Nz}z5x=1=Ej
zhC3@fp6zs>aVnf_A-0Y1sj+vD=Ir(7;?_)v_5F(AMb~;)tPGThw8u@uCP_#JdYJKZ
zMv*{=C4W|)M&D0KZrvsPY8#VNj}Dj=x%PCb?9=)erZn;Jy=yG8Uz;qyo=DztAhP7O
ziv4(76j3HEDUq-mQ;{pK#mkYMgjbv<(+y5!cX1uD40Nmn$tzbdN>Z^=SNO?-!t33k
z7Y$n}Oz118%!vGKUBrBm?&kNk)4y#`85d4pA%>*v3?PpOSUF9AVVqZK7-sTl_j+h(
zCfg8wR_{8NC-~?m%vz7}r9L0@d0XVP+4#+dtIgqpv~?#M)5=%_Du({}1*wGebiRWu
z=m>EN0I!+?>>faINPYi6%z>vn)CMmWlNp@(dF*~yuXnDly9`>i?KGc0y|}(Z$0npx
zB8d8n1m(?N#4gR8ofZ@8$T<Tt4odcL%L!~7kWJ1E`^ikOOZHJ&=>as8@@8OQc5)28
zFfPc0^)dX<`qOy&$(2dh)jz&nBi&Z)9sHRvMVZEMmL`K^UVeN5+vt;#adL<Y(zcK(
zU-!hh{KiXbI_m4a8$jjL2FU6JTxs_j!L~Y_dPwzuF!arjKpilN;|~8HOB^>4q{LqT
zz>DIM&0q!v!ZqEUE@49`%Gv4Otuy~H0l!j*UFXZ^i6tst+5!>A1AMTR)Vct~14vVc
zX8m^iv!MX$Ml2uz|K_@fWq&Wh4(JfmEK49wD_}4Tcon)mRgfpI>3aQPPLqX?OS84Z
zGD}l{?%^5l@!4Js5pGD@T>)T}XGTO?&=aOy9htDk!lnY{&WmBT&i_NHsbE@)KJ*4l
zz;85@GLZN7ap+`eXSTgO!`x+h6Pdg~i%ZOJy)xG;1S_Oe&zg7LRdh@6fay<L)w7Td
zb-}13Sb?1X&(<L#=RXh{n6spVyLRV>(!g%{(5TMw=rW?|*<aM3M0!!KW@FxG>os@o
zf>zph7P_FUZz?N!`)G2`<6=P6p7NbwChUd_Uck^iZ+}nlK9%djJdb32)Z#h(WVLz4
zU+de!%43NY>1abzTOF-klJ+(&sb%jM1%_jC8d!Q+Bs|bY`tq;}-O+>S(6<}3M)NJs
z+!6+E{`H@@{ipo80J^44NJ*gwTMG`c+na1yO%`Z6#F01Y=_Oc#1$@CGHq#TZ=uq=-
z$NN|v`va4pqy#S_N+j{kn`!NDOvhJr3(0I4rM*rowvPYW7dqzrDhznBzlT?1+UmWp
z=eVu0=RZ4nD)H?gA1fH30aK{<x(o?b#>+I&*e>nP^dg@oe_2CAtb|V(B9B%R?~Das
zm`JAhq>_(Pf-5U4lkpe3Qa^jH|5o7{FOO-|jbqaF!p-WYB0;r3!kbj~pB>$`B3upL
zhk;$~*Zx12zC0eP_Wl1%h_X}2Zc->hqsTU5l2k;pugR8#Bs-JBC`$^N>>{bgmZj{a
zC<e)z-6QK*8~ggZ=JWmaPp_vu)0uP5ec#u0y*C)cF)=O&m_JyW{4>fAE{%JOAZwa|
zsji*OYD>UoEPY){YN{LPFzdlo>H+8zFN3;?vAlm!PpUMEP(d@9Yypg*DP*!Hd3H;W
zb|0DQ<zCG)es>o`7j{ebEpwmlUwQI?nGtz?WVJY-#VE_SnM-4*CiaKUGd&!ughGGI
zX|cyjb-2)KEHlcspr?O-9X9gq`)*|esT)7Zy8!)50QMm?eO?>Z35Z#hBqSs@!;ED=
zW&bFK0ct}GiqHgFqog^783wvIsUM)B-$B?|_dgorIc51tO+w-#7+;+OsB+;=Y0XvF
zAQMkd&r7$qAOJU(!Q(^sCI^xn=?rYrw$^lPNRT)J#t?gqwwc2VA?lzoe__X`&t*^q
zN=`<3t9yWkCLo(&NFV@0HGR+-f^PA1@uyFp#0BrD&;*_!M!yJc@un!=y~zILaWM9&
zZY6&N4$bk$u_6Z=?Ax$qLs{P3`7e7DuN?k!_KjZN(3#%Md_Z9yI42NDltG#I5*2$%
z#ovXUB2LfFr|>Ja&L_^z4+K+^+U>!yrsSG#4$tAkq?VSJ?_fQ%T-G>71jlshwF?)*
zh~SI07c-{Kfq+d8Jz9Ak;yA2$re!$ua)&=@rz9s|hJw)(6o*w)OTMRWPAq{s+VA_=
z61m-60u*H+x=#m?#gb*D{>PRRZ;xo1WqexN&}YzTCjfW;PmE2$ntN(Ty5|3$aigb>
zRM(Zsaz|QKz#uF7GXbylo9+Cd<zTc`{%~w*^h=%~e8E{+dKSf`we63892sYO3rkrQ
z<l0KFvM4=x<Yfy`=)<p`DcH(!bJQ=mch!U`41yx99CEbIDizL%-wXis>>|x!3k2vk
z2k}AbB6O83&P+%Tdm#s#0x|^-F8j+Px4DR+QAB;+D^~=WY-R8kV26~6DB(KIrOrqn
zI;h5!L646E|Ar@qGfJctBhm^>PUn(t-sLMDf{>%*XX)?1`D9VO?N}B)(uVQk=VbjT
z?V1F#)FF^#ze-J=Yi(;QIF<!uxIf6<U*>HFx@xcE{h2jZAxM@LDYN4Pza#_LXv3T{
z0>I5l(=i_<CswA;ue9eZ)MddVFgvrqjAYYR<X!!q@@UxHSbsTXMo5K!U9qs>N3oUF
z!c>h<(TB`6jz!AnGbMKz<07Qs+TsnTk^G+^7&|5|-YG{7UtDEfJ=<%Q8oow?iJG9}
z>S^jz*ir_MPSS0!o}q0rLF(zLMB<<GQr-pt4BY@FxGq?5w3xfzxPHBZR)e31b(IM$
zk%yqp{qbgn;u>);OvK+Mwvh_e+O`N@A6<Pan3A#!0uSbP9JpsV&z_!@aoist*41@v
zy_p>H<uv!JyCJEAXuR8F&GU8l>DGgGVt%vmnpdcKnB7%kr5}I7(p$0rXG_sJ$kABk
zte3m99Vyc@+O7JOD8bzh{*y%@p^eL{vxZf(cRVYBynP5?3$A<_FWvetf~wU82KTZ^
zg)7Mh2+L{QrxZckDG4K@G`bNc(#kAI_lTp^QJT6F<e52TZX)^doBQi1G$Cm3=clJQ
zAwZ`k0%?F(e+{M<<)G0n>#k6hmp7o(07)|r%|D~0=R@1Se5pOv*6t@bt1sgo1*s1g
zFH#(kcPI$1NCw-mVz&S_3>E|C+(U@wsQsP&*VqsMONVLZ8~Y$5)W14pZEGhMywV1*
z;(`!CWpI$=SCG@TcC|uf@F37nZA#_DfM<bCUs=!rd`y{}ekwL(cVO`|1up$zxE%|I
z<+V5mQ`Jqr2HSeML@?jneg>bN>DK@BYKLkR;ZtGZq7@j2GL6WRQ%LdVS8?uS5Uv_z
zpQ2g980oU!ocQa(ycto{4AvRP2ej-Q!RLB8JpVj=$?r%acO1&L#PIf2ut>23b1Vwy
z{CAq)OX^qh<cXZJ{<585niFsmWw3etUh3=8yL7f@@S|Q}<I`X7F!erOnOVaXz1gnN
z(lbdWUT4N{fnI;&L8WZBxkyg@W_#IO6+DP^&btS!LHWypT$Bg?oefxGy2y{`!e%@O
zTG%@|ol59?;0|XE^B^1Mu$iGgpcE<~yhzdk+gD&ZjH(0N&Lj8D8|xoriIX|qN--}?
zzz9Ipari{l0t>n#mB`)%)~<l{sE#iA-Xl26<Ij=@iVF)pnqUaaCD?eb-ZSMRYyCQ0
zPArv54Vmr8)#vBjc|kmbaRRe3p({9EWCUost}&|re)vRA{mr@j61>iC08R>yaDLe?
zuOv=;f!tmqEWi!d_Ggkh4Zbh}gegAsZ;=1ygMk@4?G3??A~8p^qBE~er6#Qnru$#+
z`+(tM=9F0OEwU$pWB%VlutIA%)hwdfwC^N)XiW6AkJ|^tvQfpV0S{{8{#4det+4l(
zqm$&9{jLc76L(CZF6&`M*!{RVBCa+J7oRFfKAL=_rPz<QUf9mXJc6q%Q=ZO#(Kpt1
zppX?z2O_6DaypUzvITIC%Y=-JdR7hZxxTKkwXMtG^r{#*rf*Jx?aT|jXu=I|i*n|C
zw#;`2S-hTxk}uo-M>d>sv4rOdhS%ZL;zmYR{9_BHUDYw^taa=o3&;e`zFjI#nII#G
z$#o%7lQxbaFMyhP;}gph!j=9qI(SIVnei2&#03cSsl_$1X~1(X4h;=`0j?i5EVbbt
z&)y=Ud@P{^RWJ^ruRF{{KOcF-!tHSg{8J>F$DD4SJR%Inr6$Pw%WnT$N=b^pG){_g
zf_P~k-j0uswcZzS*dUZBw}v7ZF9p>G@5G!}>h*@j!)*}a*eZ9`E8K8~0ii=Qq`Y4{
zn1MIoaSnq5533;52nt~)ewM|w{RDRaHk#SXf<M}y8=n{7mlf}Sa-by*R*So#?o|fc
z*YoG=8v!LLryKF`S?Z-MvZFVj5z{3=!r^}ADz*7_jPg4*WEW<NX@<H%`)nU|Z`yV!
zOoEYi3dbp}aF<sflQujMSHjdnqC-$jg%}f9sFU~oVy)9gS77*9g7@J&Iyzp+G;f9y
z-H&G7L>kQ!&y?HL1|LCuH~x*6pQgSaE!L7+F@W_Mz0%Z%J4FAC37m6p@Ei<d(qQEr
zY#^6&863dWg5zSw-R+MOz$s*}`-m%H(O~~St1H&XKZ;199Uls<yN`qZS~ujRBopTC
zCKORssFAl|6J`P)F8QUw;e_B@6CdLZshg{F0dEbT)Q>wM;FVamSW6_HeDVCbDw1ZR
z>+nC<Ixr5V63+?LjV3zCFui0Rt$j++IsNTkj?o1etD4JE!3^L4xhjEJ4PHt8WHQ-n
z=Kr7j{03l*b&LP`JOl^~guKy9JqT>N=yRB#L+>v$HHbRk-+tbGTamF=&LNhe^~;un
z^N^I_P=!E@vLxM(%JQG@`tE{VMIsfYv;0CKB#nRvs=)4R_?qt300APY;P)Ts0lJDt
zZq6PNlM0#zU{4EbLJ15C%bLf{L6u5Q;@p?P2w?)6RvD+$iP7M%^x(HSJjNGDl@Zu#
z{9ahI0dMF#$QZmb3CtO4_!{uWF?MXVo5%;>qrKOq)|T*N5Ti2X38prDm|TW^4?W*9
z-<=tr!f@umRB=cTXQjS5_1Xd{G;Bif*ChXnA3NsFRC`wC%`6ncq~9GKRzSH(o1LBA
zpMEd`^4y$BmrJ`}f);-bDoUq)*T{l0Plp$LfIid$YsDmK;{d$df}B^u8^B)z?Avhl
zgHL@j;!h~D)EnxmjjnCUE^Y1911;qaUqcccr5)y5VBRCez`*dD;QZW<FOO`=`7yZ!
z!UzSyxO!p5AEH5i+^ZZMgjFa4=3bLPoM%|nS@*3+w!tB5L0VGsQ(M`bG{XF~`4no=
z<^1`F1#qU=WL}eeK?vTTHI`=Ih2Xn4Kf%?#2Z4bNdPbOKf5c-O8*r4ChckK&ytb^t
zDF*ydD!(=!VG+#)Gx-lt4&MXlu{zTEo^Pc+@egc5jhj2W7n_@#x1@5w1v9o0^Mt?#
zI~C&={4s=_w%!+XDl?oJ9<5Neky?Rzy0#py<7|IfEUHlX&9*YM9uTau$yUcj@`n04
z<RpY2FlC&<KLIa|>yUvvuQ|B&;0n-=-hKEWm>sX2`|jP$HF#?JaNyYpHu`ba)uQ-{
zw%`_E<*E14@1)=cD`T;>iNr^^PM*3<_$ocnDg-2Ld;~|k;8Cg)gbA|L^C^bxZqMNq
z4roMo`)k5!h`}ic)bT)NU@3X1?;9C~ezz}!Fm<lcbGHCYFuuZVY6f4@$0EfZxA+*4
zLp(gYu|!2M6q5qeOk-W$CfE;BGD_!ZE=nJV7qDGrb4PH?d|zd@*SRAyb;>>dr&~Ii
zqp5plZ_<hd@f4Q6r<B3=_}$WU--3tH){qBre)zCBH|M)YXMA11OFPeL5D#wpL@j`h
zZ9-S-JFfGZ<IGMtagavl3uTp&$P(rJV@?sz>2xG{J4haS6=P%ZC}f|UWYwk}Zu#@@
z0{hBTd%cyB(egQbn?X-Sz+=PP7Elbj>E;<B<G5QcBt}F7A|1O_^7lV0gq&Ghz~u^1
zi<S_KYGb5(qpyraV`Lle*x6Tr0T~foF>U-+g-skBavUe-ApUPg1!^7=`AX4-1>py%
zOufNP!3j3lg@{MB!MJSunsQ0YvlnowLg47))B5wLJfzfDHG1Fae-Q1~-?2#9{(b@3
z3~Tn3#MH)m7@p`a!y=0|NdDp}!^o*Ihyc$~u4+AiD>(yHk0c^-`aq8ZFOpi{yr2lj
z0Tkv0q7zs9dsx;hi#5BXcz>|Rr3B@4IzeW@li>wf?RqQf3)Hp|#1()$t_=7Bod&io
zGpEo#1mf4(p>T_a2Ja{$&Sijg+&xw`myFQ5I(C}FR*(W*X)f(d3x>QWkAfbG75&JW
zM$aJ`Ny&BhLC4Ny!fiNSchBQUh!LlOfaCn({ALN3dfzi($+%Arf)Z!Ok6lg-?9tdb
zjPPPA?eh=IQyDb|Kg}ip7RvB!6}YaSP|J1`eNddVL#gpoH;><O{uZD11Qa%gliSz;
zA7POTetW2GYET++&~l($lnL#O7q5IFdh<-$O1`N8shs3SGJoIwy0p7t`*w9~+3ojT
z#%^knz9P<)xIXkV@?9=D>y(4SO!vga{|x%2EiA;QMqVBem3+pLzD5~uF5H5kF!@TA
zHr1Yi&*`Jo@VB-Tf#@vT;PQ|ba?JOe?{_}83P8KM`z$?uPpi>$^`@iP<0)p_3=w@S
z^30G8VwcJxfaD%xx;xB+x$L+KA&IIuruJcKmBiA<+o<NyE1T530|>OoTjeDs;OMtP
z`tacpO<YoBc>9JlPe6YGHkM$0Yoh+q3PT~CK#$5^YL(scK3%Dk3A!t;uCA2%Y(5JD
z5p|NWTqcmEQO$=_j~H}B?^TeL-cab?|9*%6c2o@zoA;kQQrCKh6%5O2Kt-T){KYqN
zkk7Xb;G%|x|3IU;NF-7KqG4y3$$+Qj)kH4Kbsa#yf$Hbw0Wm0&Z@{o!J3B(tl~j5G
zcL3qgWZCx&NSMzuuf4T*t{j8h1jmU?h!aWjJA_x;vHKj0;3*Y0zHjTu!U!<Zw^T5-
z!fX+HzlVl~Xu`lm2<O;JBKF4{zK9dPdj~`1BCV_uH~1WDQVH63^98rXDsGu|w;_jA
zVlZ@dw?mlD2{v-(Q{KP?fu*i}Zf-7uv;7O`A}Wf(LB9WaW@)gcz;<R+pRCEl<zIIY
zNzts*Bh_mHJKNW_1&JpKU~G&y3hU!u6W;y``Qh0NT>E=Bi+Z2_ymjvcXAsK>FEZpK
zI4M}0lK$IV|7cblc&V^N)So;W_am>4H=M5?YvStX_qi1Kyx{yK7D<Q`4!+Xvd|&Lh
zT4lNmX%b%C;F=%agI$rhn+Nd$C?h#4r0NYYBEU|Y_zx@trI0jw4{+26U#1Xk{}Rn4
zq8DoRJNflCMYe%#g3^FTEtjBsl~=Qbv%LUpzo>SXF8#bz$7_6kp;tG*qQaaOhx%2v
z=kTtpuB!~H5PM6NzV3KdBu?Q8Q9_O?p_@0HYnb=ojxKlHzp<q)y>&ITKO+MEB5!rX
zi=k&+a3zJ%+aAGxCJ)TMWIvfx5|Z*S_o&?V+~T$?7_i9X%tkDi#K{VY#p&i8`kjs$
zmsNG%=n>o)KZ<-fina!{$Jxu%js4AJpIik5dL71mRE7AvM3||xn}|TpugU3;Y{9c-
zj1%_@T+<HkGfj5Otl`mA!C3G9Vpu;JrHn?ITAZy7cweYpgLNP1%(vrHLjmis3tq49
z?7@qVDk>oX+_5&oI{<6eiM)l1kQo+E;$<mW#%mp&o$>Vekv+qvbm(`JLEi*}5INA|
zD1U6vO*;3<-MW=r$?#rYKl!YTVw_H3qxYa$yK`rUdF|oY#<p3sT55!n!`b7Pn3lLn
z-jCp3(3v)q{eZH+`wM(AA9L{1tyfYiq_TNsl39^Bo$T89)23lU;FL#I1(W1`b<ok;
zjJ6H#aAVqdG)qwMTIV?{C|_mrBpJ?p3l9%}iH`dL@c?@tv$Owx2KHy4?N*`mblZSU
zrPt?a+x2spkS1~^qgPE%eC1`SORjScg2PK8q!kNIro&IaxBf7G7Bd#*VO7qfL9$_6
z<1(O`3u0xOo4l-igz<jCy+lod0HQjg_(RzrzY{*ffwdZfi1iUAJvK}TPbBUQcpzSq
zD!p9z%u<1WhXLQEgPr0Vtqm5!Q{cMRWSae9;I^(U_N~uXbyppK60zir)^016ro`xo
z-#ddTp#Q}MSJCwR3|Iz#qExsezH|u0#ip<19#u_oNb>p-vRDtJ#MzetjdYJk{3RtN
ze}TBrRP6Dyd`cRTbVa3$4(Zj=KkzHq@?g4q>VD)RQfSp9)B5%$w$A2nYmaBkddDH9
zv0-yp88Ats2bJb8K4by;1;f5$WL31iSOwWS;3@I&Z*~vk&Fa0`in~qTR*=(i051%3
zRZ7-{FUlb*;VzZ}+G{tF<w@+`=P;s8o3C4CJDGz%YPyoS&R@c+t8!A5<45aWQ=>ao
z*wxYWcSG+k7>ZYg+ws|Ob9&yrd+I7Ul75E(xqe^J04)$m_xSK{^YUC^(dTLscwe_q
zF_QzYqvL#KB_wj0>JpIfOHxkAbea+Rpu_6heTBqxEZ~C|kP{yZwq~9d7X8(EMl&d}
zZ}W(-!$hrFqPK;M%XAoQp=&@q46<+yvOkgVstCNh7^X_pI57P>ZE@e%m&UXpjClcv
zjvEfw%%r^d`Bwr=;^>g(;#1dkTf7Bx(})EIx-Gn#QGnbXeY~F6z4;k1e|MJO2ls@B
z+q5K|7dPuY_gF@H!9;EB*69rq1Z1HC-^gvwq=o43H!)y&rnTg|jcW9ad1<H)K4sPr
zC)^bd9QLc>$1q-OoPRVbCSMV?h|#Xu0hb<${4@bmL<4ayzY9!7p~M2mp}#-xGo_bb
z)zLL;A@^v%ZjVUX_y-)Hf2s>&i2hc<11w*(Hui<#u5_G^0<+k?(r%G`u$RL<p$4Bw
zs34ck@zh>1-tRd^{k{y21%^$pVY@yar?Y)bkj-X<-7UY}ykLp?KnL#CUP<@MP1euq
zaXPnn9d|ty_(_Z9$>zGabLJFB(n^FT;c`~{lz}FJ8}8CU^v#^kih+TF2_R=kzzdWR
zr}MV}wmhgS;}GFh)rD7^o12VD8&Zv)GmruU@Xw2%9C-cH9ksW+-r1^@UqIMoU`+O_
zySq#pid;sG^Vd+pV>bd}PxV7~flN@@06W3;yw2F{ctfToCJdJQ>GyZVsu~-3Vnkwm
z{2^M)+>)5cbJDbq4SCG5z-=JX=$W-kh#lrIcusr@KzLsdRh3m#V(jCsQK}1qaByiJ
z`jlTe<e4G?zC6*|uZK-^OHbz9jth2P(u9))jOGoHA7yi8tE&%^2{jnEzLLGN@^Y+1
z&bE~Te-MFiiboR+UTYUs7udhNeM;(0oO8w0e`S5`lyU3yAE%4bcaClQnMTZ&VLx26
zDbzckwA)e;6?a!Oq-(G2*i&((KT&yFxwe*j@<Lwqz~uJl$}y5`{xvXn$;8<BV2`(r
zq3)a(?kwldF-67lI6`n6S>!lZWHEplKB&5~Ib%ob#P-(*k#vrBLxj*c7Q63LC?PoR
z#S08C=q*F&@&7HY&zVz(_bCBa(}xq!OqiO77%uw$i{88c*|6ENB9KaNh~kLE{m1_E
z);}A>*nQwr5i0`jUu$WTejU$-PQUwI{9yxkKbGU>yY7nL-h;1S%G#v;Ab6cYn8diq
zRZ)acQsYR)U0o*6nr{C{Y&JivH$z0Eth97T5D!U)&owJj7wysJ>?6FmZ%}ooh8XdH
z<t8M8^wp6s!(;~2JZFzwMu98gj;8C56MB=C(@F#9Bb9U3F^V2ejP!jPfC5;Vn3UtB
zycIa-F5swYZ2{ohs|TxlaChSrI%^+kB?R`*r-c0n#e#=`u&aryMQ6bnV28KPLX)5>
z_AU0|vh~m1jnK4RR&z=&!g3%?lNvb{kT$vV)q9WumZDZ0H6K~Da14I+`{bvWDBq`q
zeDN%-s9MSvs=v&HNvw7MVh7y04-OMpCNX}Z-x~+B=Ex~=1Pl3~dS3SS_5;+a7di3Q
zWt#61H>@FS0v=HslA+dCnM7!S6MrMm=-op?A8{l1$aoVBL;4EFbj5Inx_%dfgM&q~
z1x9xs;c+Dft~)gxU+><&y?I4yB?x_@P@2LjhAYK(ZWU<w<Bt6*a^^?*^3~D4YzB$s
zri78bt{cRI8|>~rD^NFwq}fkYqR3R$1=y)n+o-`m$Rvd4vQ+=Wn0Dr7R7Q2R6`g5z
zd>_;OC}BV5x{rwtYD^<(tE;QSDEx5YL{pRQzliufkjK><=5^+*tgI|Z<>(#OJS6WG
zMTF$5LGW?SZ~D>9W<OuS@;X`m;{}{BrVUx7|LygnjPmyR{e?55DKGcfea@=VpA3<V
zH@5AFt?u9wuQS*3m+{@6>h~ajx+mHF>{ePPe|m?x7SlsWE<MPuzAoA-)5{$&r7E7$
z!g^k|4w2?K%M@l|@k(yPB48{l-R9Te&!$7$HEI`e7cpLi_6;$=+bQP8#%IC!HyiH4
z1&A9iWPgKXK+{eF0z-*ApaaV5(W8;v5~~nK701fTN(ue(<_ht2UGaySCEq~5$#tQ|
zpB?70oSM@AB0QbWfaC-PlZ4TVyRH)y&;qhUAj>kTpulD<H}iF4<=eNCHoE74EYS*;
zV=C3e(sBTspz8-pIhpg;5LjHI{(3Fu*$~_947dJ@%uG8gGqXR75E7qnRpM-r<rN4m
z+D7IzXIt<`V@&O^flGG=v0>z!H*XRlNc}J55-Ze#S-P9!=P*q%S2&AYp`J}LI+0N6
zG5WRqQ6OxeJdUUCS^0bcN6B+KOmRQn#>NOwK*gwnDOg)m8v;fJv`(46sx@yrJRucQ
z;dgx^uai_TO5-A&4XD6FPrnCqM&cU4l0Enz&^mAB+p;x!?zc!hHVG^JQiJP*YvsXh
zdxVOLit@OcR+ZmiTYvg7G2*O(LRDCsNdEm<DX;|XEh{T4g)g0+`2xn}gLnFQ;FP>v
zoLx(cOxik;19kNZU~xw>;&mCuO-)VtK%_rMshH=-`d&L*NoP7d&EM2%us7<VlndXs
zh4w$eR{FjH#$;wqe$}<<;NlGo8%WSSTv}GP+F|bQVWkMDkEv)*3C(kuXL@wu5v;4T
z^c@&Plq)idQ}fQil?sH`0&7`VSoFx6mq<?MYH6e6ip<n`RpK{f&P3hq7K)~1a8}p2
zsnu-FhWUDb4;0PC(i0EA_c{A``K+yODV?=I{?L}HrTm<rb2rBuJGc8c`FpC9T`b+>
zY!6dna)0g?8Z;QQ7%V6Ro?S2QI<n+_zcDz>F3-laU0F#V0#?1Boa}eCnG{U5SvWCZ
z>?JrU4oW{biWSW%pLc7%os68i7Lr*mo09vqm}SDxC%@U&I)C^1+P?E+oAL++x*Ppx
zIcy)dQ_r=fz&H)ZyHfpmt?aCOvZa0M9XFv%x9*S<kLg=*uO0W>e*UTE$|B~QhW|mW
zU-ml=)0@wW2Qta-d3N_dW_Zr|4S5<iH5SqF_w4$e$C-8&^Vg<P8C9#Mj+MMS^rMN6
zlc>F_r|}HmeNe~kTT*D|CvpGdtupFIME7x$Z+bWICN+33l)X5UAN%J#^DFOTUJtWn
z+-{+pUH^ppyI<N)e(K{@;C^W!HFnTaOPOiSVY2`E+F29rsO5dOPE2Ak*L3G}aqh=o
z{M@rBwEc4MPT%pL#yrW*?!Ojiw}U+d3yIn;;#_%Lns+>`)+SmMriv3>CPRD@8Va_o
zO{N!41X*=yy<GWsW^8{kmOM4%et&7G`_23JjFJ}jW*^w|C}5(5HFf`t7Z%MuB-Gim
z$nZr4)C8TWQQW;Yz_BM`Z8aSl_PFp~-3Y0#@=vck{Q)`5{bB}&2kLsn`>LlT&oKnB
z3h#y4$kxk62}@2H%(ND~ldVK8Y+IKVCO@^m?7pbzvpo^BQQ@+%z1jV({EX+F=f*wW
z3ydBixpFq$Dw_@)bMHn!Ul>0W+gNbWn#uU|!im|J+gtA~nfw3apGir}pRo)0&Kg+6
zR-rsWi62W$`PlDn-jZ~_eoA{c^wdm>SL+cUNHiZ(b?ugx``GE<sQN>KBk2fB!{}Jk
z5?MavtJ~HdSHQ|3gYq91V`2JB9dvzK961qqijja$>DZ!G?r71`yWdhHjBXZu8OtOp
z`jOqhUH7^iCdn)qa<XT7YIj%8!-jhM80WOiAFQ8>Sfl5iS$qNc-@kjzR>NM5)9c!c
z6bnRXO{4!#??z8yy?_IF>in)fRk6L*3<`3K!SxOK3S0i3@b(r0;l<BezOYAC=7UHe
zqG0|CPBc5>;bg?W#gESy#=al%`OhS-LtZJKF?9ghpS)2yD4Ar^()38LEW>xibh~={
zpla|kN$F1cG@@>k-73fOIv0)B%`sdDV*fv)-%FvOU2?e4vmtI?l?;RNweSajDl0xS
zwD}8!Sbx~Bv753of7jIK>CDXS!^_WoR(yEk|19R`<t;t<%X7V-FDR9fE>*o*O*i&R
zyj@@i=y(lJ#OrzwFT58;?bj-5$Pe=QQo3aoH5t3h9V6l+s;SJ7dOJ+ij{lE}=`~s9
zKT({SftI5wk(04InAW6!R)70G3we!Qt?!eIN=0F`q!`c#7pA<N6lTH7VG4K}7SLri
zqJ*m7TK#z?YdW(W0#$TKyYq4(nM%LsBj|J=+PUkH5qRFDF@&N2KSn!OYE|jvc184z
ztje&7%%iy-`xA&Le{>o}sWlpbT1yYg%-R(jY^!I=$qF6zEmn6F0*oUp>>MA+zLkZ?
zR;b<u<)r+*7FE9W-zAR0iRJ%#=UNAj31}-;fT>6l@sjSwG{ALE7hfA7BlCU9NgB^~
zpNzgb)1-an3;C$~m!lEZ(LoVcL-o#T1zcj{a(uh~;J8jUZ{lS)T+-pz6yHN>d#!Vy
z{D+x~E`Pb^-0g^axKw)QZW!8rlIM!!yo;-&9A<5<pVluwf$jxO8xP-I!=1*6scmoe
zgKxPEgJ?<j(a0&Zqp%f>S(0D93Qa2^i<D>hM8#Pr1bC^rec58sfS1ZCyd}Y~58+6W
zSg$p_9q(W^X_1)l@>tp(7cO}DinFpb9a-M*YVsE^&l+e4TCo|l`KGI+s`M|#$91=k
z#*J^I#}--@IW3m$6ORSiC|z_^3;cQRW1>)v>Ab}Y>zQSr?r;fA1o1P15T+!N$;}Xv
zJ{K${#`g{QfRvP!EN>n0Oxc%#9;+aeWf#X+w0?YQ_*k_Urf~m+R}pc&@&w#@;G_#r
zD7D5BM=>#N#^pp$518l_LDviBse2o{#ceH6@WimbPIkES-J1{pr}zB(F!xCETuOIo
zL8BG3NMkxL`P){D$UbA?$IooLCnf>~X87I|^r7bLYDbTKlJr-O>EF>nrY}s@^^SHh
zMh%IX%548}O8YXrx52*s!B&4ZkJ^5a!S3#X2mbs~a`ful!uf92_#HOsM!(6lo+1?-
zI|md$7jT#doyL}5&Z@<XDacc?_C>v=@X}l-ZX6T)hAJ&BT`^;$Br&IaPWPOkSoLO|
z`}W1y8k#m)^pi_c7rVN<^M5kk6tl9n;95K0)&x8^k=EV<|9}>kA<L@s^}0T6CbR>4
zpkw|08_$!}Pu~}|-iJ9Q1~l&e*Z*`($w!X5TV#4i7aGD9bBdOIk*R`?MPb(s+VD%0
zP}^{`NPX9{jm{KKdnv1NCzVa}NdgW%ERppQuJfS{mq~Zmx7Y2?FF3M_Ay=WDtlVrE
zqGB2Q=^@z4#9uj1m1z#;P|KA#?QD9odn&zyy;gb$6(it-?DFj~3Y#v=-q9&R9;E#d
z2@nuPaQn=2>P|dV+l>C&mYYK8kPwQf8C`b%5)&b$_Mh;dULt@>ESJVJAHFJ*_!q|>
znd<#t+S0iLq4d8rTAYn9Me&^#)Y!~?60c@Ic+@exyKncoU2i`Z@buq1D{QKu`%($5
zkSpOz+GEvlA+7lc<{C1|v(;S(G}w14GvY4DwSL3uR}%Y{U{1lgxVW6c*eq1c*Qc(2
zI*!odgkf<qiqX?e<;K4fifsh{bkCGp?)J-2E5*V@LEf+ltGc&Mh4A5xYpy#icq0po
zWCjFM04x8L1)an!>_;>Sub_C`{Ra^Omu}p+;j*`*LU^0ry{RSk?cDj-s$7wQFA1lP
zqlKciiNyEN;Wh6DlphpRr;}sS==2`kiEEdXm69T!%Be!?sN_KKtzoR&Gq<piy#pg;
zPr=FKq*9s3ri>#$Jd^@|Rd`dBuvm!twET;$GlQY;E;WpqH<%+@JA~18%~bjU7a|YU
zu@yA)W8^?L1%9<y!d*|RHHJn{=^pRva3dZdk?>>k#R_Gir(?BWW5u%4<vuP`eJ`jA
zhh$b&4cvBd@iTH&1O14uRBcY_u6Tm3RbOv!?_Z@>W^)P=das2q^<02UvDc-+r0N>n
z!JlPw*wT^`7I+NIViR`;J}rU4@PJjM^P5S(;evvK5Lun%F{L)d7wU19N9($}x_S~>
zN8pnxgRK(5m1Kx`<#>qD)9=<x1z}qy-CjE`oLh}Ii^foo2|xBBdk?Q)-1<;eWeEbZ
z0NRt38oz4pdQWh&)ab+toul5qDeg#Iev#YOwKl5xV-AzfuCA7)wys#hyzPWqBq8au
zSb}cqFnog<*fq%8_UKm!Mgq}IjEkLcGxJwP%sG%&$+cwSXNEcs^ob|mZw{Z3kr_N(
z=SEf?3V~!CFE6SC%w+Yv#JSGhVDj7sMV`KSO`u<8dKwln?S)71F8-gRBU=LKTp2tX
zV4vrev8pIJSjS2JfGY7%TN{H}rVpk7qF4_W0n#Nwa8^WDKw4lX^p)j@d3i-3Zy1<#
zEtbZ{Jlzmo4jIYGLlAeGon9u?&3=n^!ecxn56u*jt{=IxL*MZDp}lA0mxT2p;fS&D
z&5-|c)+RMD=X*apQt}HVeU-labYy9oj<|kYB$oN9K5bx!WQ*KQ+L&)B6UA+QRP}2*
zbVVj6<BfVuVzAT|O%WCiCdX&%tx<)-m#QM7lWIrpXV2a|)YQz5;DuLyB@#q){=R#6
zBB<+z$sFOaJfw(Xui_@T+MCTOywC3b`g@wXK@Q~RBuQii^usTJpYq|QMZ~_@>*m2+
zkKL8T&Z((-C=v&nksH;sYvHa4<ZtsmH&kaHfw&LsL9v68Q{6h^|E%E!#1os7He|4S
zYa9ke-J6=oqcDzIL{z%@H<ImO1~yx_CTtFhZDOb^K!8qw&%?sXk%~90L2T2yH&JNi
z8?HNLV@d%Vetra^yLgsU(uOM9AAojeU3>en6Jp=^#J=e#80vGiV;BACj1gNYhZ+Yn
z3Ewmm94@5OoL5K6o&59XC6p3loiGq?RPu~&pT%#19onD1p&@l<4Wi-9OHIN9bOktW
zsTrG^eiGqSLq=p8J*^*Dt%0rY!hTU2#&G5G<>m{>DaOSrN`*B{oi&hL)Tcu_ijtTB
zk&`D*+`4fi;feNZiQclHmy>=yDBoy846mlD3G{G9kj(_F@(Y@Th1;Y8`-x%h_BP0R
z;LwoApTXT{z}HshzXyS3LNj^tG&Km0<a@xXlSS6)>)cVZ`$l46pbXV|V5282URin%
z;ot1&Cn&+3(whAUG-5vr`fnIEjjh7VWd~uk77k|Jqqq`9j0np}0x)GVkr?r;Mj#*|
zIU4?bnkGjt!v=I85LaI)SjP~4!rMc2tN_H6I+#g`eTy@vIKZfoyL}oaG|<XN^mKMg
zl2$$%HVvXuUYGJ1Hd#nF`?J(>np0r1BlJGLFPd<-$2`EWDF6`sO8UC$^X`5y3V2p-
zCDW|j3dkL5VBzKP<=vI*-^q}>6b_I#ToDXy85T*fB)nC->?aHnZs3AZZBG+F(8+Pt
zm6o~H*53O0d{|ei0491)<n0=c{{*ERTEI`Qfn-{g)lzGn2Otk%T~CR%q|$t2-D=vF
z|E2f?(3-rFkZ$vf+3_YYg)ATvb`M2aZWPNtar>^2&syJ$#?em~oY2E5c`Oh0x@SL%
z820BcKdVYue{~FBB6jPoeSoYzHT1%d`|nuGo+&w&?|9~U@w|zazEs;<VJ}=|cjq!Z
z3?<N3c@77y*#&C}vR3UkOm3TP)ng82Y_JZPeJHZK7{RCDdrhC8Ylt*Mp}4}d92kn*
zzN$l0N_s}R#P_AU_ArC6LSTDm7tOkkSk{w=ohB6FjE>!wv<7W^6rpwB;ypO38X3V?
zwddx<Lqt8gam*W;LALFi;-%;iJmD45Z;%GdskNzGa}BDYRIqPMilaBRf`WEt0IJ}_
zOTjZ;{u;)NMercVbCeptf=n`t#oU_M*W;~^;DPMv1ej59Rw>&7v9nBKPat@Hm;n#`
zh)vk#A3K;aB1u2V2T0zo00rnZn;tqz)k-(il|pzw<!?PtFO$dJSH*iJ`K5N7UzQ5F
zW?`{aH0ftwKe|{1Bg`b&8=X)YfTX<kP}&}b4<t}3sBl8Ga%fuGz>1)+yN`Zl36b>)
z@$r@tIe`FCwdYfUAxDfVg#HiSky<*N0axXum-;wf-?X*2l!}*I?$uLDtwWjwDr#F0
zl8<eo8pmF4P1{I4_I(YQO)bZN+Brs6Am6qN3JU6gOqw;Ztn)AiU3<zat8T6PnFjwp
zqydaK5h#j+2vaAr1v-I3)%FJ5^nVU~_UaGgaFX{5g8iy~;m-=9!L%eo^5({f(2v+T
zs+Uz)@3;eAi@@;eC-M)T6_s{qq0MU<UY=4sb0!kLu>%x(>iC~Urn7#ChhQ$Ah>iSy
z6U&H)MYzAeZ1}E=3(?rpvdV~QNhZgL7;<%g&u=fNa37U)yK{2_bYLpI8k#<N5Ung!
zS8bz1@1-eKY6rM)?kO0k7yyYeo#SR34lSQkROFdy17Y)bm&y|@+Q>3xZa$XwxDrl$
z5@fMjh;v1P;~S+ypO!o^Q0_kbF~QITN<$UImYgKN$FJ(U*e9kHE=WsPX~g84$m9f?
zNp<PrWV?HM6wk$Y9m81UQ-sIUXFfYCm}}#(`xbMBs<SF+kP>^`mE&P<{c5|%C8yN7
zKG<Di&b_*OicO#rJAeB_gPXg0xW0u6ow533Ij!%Nni<PC9Znp0dnilm_<ud^A|s#F
z*e<o%Gd?<E(Rn@foMA?;jf!^L$nZ5g2uxicmko&=zx>kf&%g2YJ9AFY3}3ZNsEDCM
z4G%JGZ17?HSsLcm*~;A3dc#W%pF9{TT*Ql_f08$LhZDQ~k79ZlnKj{bUUqX-=SGtJ
z#PJ8<;b0IRPAT*Zv*<))<9cB4o%dr(lT2c}hoZIh85hMddq;(1_av0cIW*k{K6wIc
zqs!GE@Fh`KMn>kU&RTH4Cc(~7SLk5afU^Ssegs_{Dfw5C@PxQQf(dPVXXh;_Rm+i2
z3_5LRXkl&Tu*$EXZz4|!3Y-k@pRGAe>;atY3wwDcV4PPc)VAv5j^V$9TA&+VO+N?%
zX-1YWRM=e~@w0|kZm$>H<4ihZk+@=fE%<VxwAp`tX_GIxyLx)|fRE||K9)W3To-z}
zx`L28-QzFzT3cGITFANkKJBj~lDGA-Zm9uB^1v+OC5#ZD=n&6QJ^q#(xzu0Am}8j7
zzOA|}mgS$#Tb>0LiKVV2A|V|3XlIpUs1M`+86ma%Jx=4pX@hldL8s@2x5x7VUk)W|
zfvVjQNCW0LoZa4+x?#dph0%#p5&TO;kaa{^v|2+58E;#0i^ic(BJt;9sE081#UJ`h
zyY;W6Dwh@*zN5!8Yj7J7h~*O)4dma5Z1?!fINJ%+XT!i_QNU1@9ofK!P#DjpS@l;*
z&qG)$hvgVo<RHiujQ!Hqr0{PtYItR>w-4YYkq_pj@2I>NZ4fWGn)pS^%_rRuZP+iu
z*eGjNp}>ZuP0l%*8HW;8$}x{hdCucLBbu~R6z=ltq;ojjOF$tbhhG!`OnmA13!rWI
z`JIEOBZp)g=BeXwnuL+Q0q#03<o^0-L<Ai5V=`vNe;JSva?)6B{pxkaXxI8FF`%<u
z_Q|z#%`PYGOF9!i!QPOtmGWp|Hkf0VqgDj-vMRLONC3urZzoBn{i*Z^oJn<g#!;vE
zV!R}TVnq(863&0#K?2na{4Xy=s0=Hubtb#Kb~?b{i+e0@?^B;tRO#*WJj(5ZL<rO?
zFH}5CeKofBJOTT1c5xBQ_L=;3-afyiBpwk*;R#>KRY`<Xw<ZchW|ea~wXxtGZ988I
zM*uv86Bv;zI0?wl<8Sn2qXs-Y1_)7ay1pyBka9d&iJs$%)M+jTC`}B>DAhwLB@;sZ
z3Iq}iWg?*~0u={BD`RL`&5C&g6B83Bq4Jiey5KsI3=vGvdXL8B;jGG;pZ2wOF)$a3
z(SE&8qwrb3ve-9s(ZP>U=_b-^q)kR<h$UV*4)n2^x7TaWA6Zd#e`I)@AAb?>RvJq1
z8#*ym60M)9MI_@5t!L5|Dc3h%z2ZL{t-a+;vJuPbPdfLFoYw6x#7R2%MC>gE{;Bn7
z-RIK`j0*URNq!+%vOIEPY2!cF?yZH|Vb70X{!0EpJomR^z6qK~1x&hv_e|%SY8#~o
z%6L;pfAC7@R}gf<P!$~2HJRc}U`j0#t<4LtXPzd(o-ma+a>%Olyh&(<U2WAP?RN+N
zSr{5>Y7%&wi@Tjkj2v-`xx62KnO{ao=9EM@&mN%Tk|ZBHx0?ri(Rt{saC>XXjg7Y0
z+np807aqLud*p<{T$bY2&Ewz%>^qr>=ZO8pLtIINe);|kkbzw=ca0_7OWIh_BsigZ
z%_;OiOgI>(j{IH``D><|M>KOKdBZ$g#=1)BJZ>LSURv4?+3VioT+=5X>p<kr{G!0M
zj!$Q!<}V=2wCVj2WX)h=)K*QwASTZL-&KP*ww(F4e7;M+B0sJ5_l$hYIrAxR_k2}V
z77qu{<HNfR?1y>3RIS`P`A_S!Qqb=;kMlpJl9ZeU@wV1y+*Yb)pzF=b$zd?mWf4^3
z0N!N((G6|cLxGKQ$)#NWFEXqH`rHX2(UE0kXK8M3VX)A~k=?O1!@0N2auLM-orcVA
z^Y?m_-HQTh!E~j)-h&|w?#eMAE938#?zP2SNCa*vBfMJkV-@pWh%mB<A5-!|Z6BOY
z)5|F>17rDe#~;tcLWxg-24#aFVz_e%unZbkRo&y_Pm{?a75OUch;|fToZ_9{!olqe
z-zSa^O2z{}MGt5YNsw7X=H+fz$m!&UP85YD<${?LSL8S4byf_iRFk*bCs<ZdD(8vo
z?c0g#1y_+mw&}EP2Vhn(E%*)H6QjQ@)eL_%L~Wa1kNzDCMBN!j<N-jOHHi-2VG#Eo
zKGX&KWGiy&B6Je62oI2zx^Ea8Kk2a!xC)RbJ-a3nV(|uE*b6w3)6_aR(hZ-*K>ei#
z+s8EtNNf_~t>Mr-nWLH$zuK{lkN;N!JrV|SOPf?1dl_*uN6@kVft{9?R?zk9+~_zR
zV80DOu&4g^)I5*oKz^z4!4Vo@)pk1I&!desB#l$k62GjwP_Qw+9uxoXrej%Yw-*9_
zZ`%=qxa^&fM}!g^eVdUGV@dnosyDLvWd+FJyMQeh!C)@C)cOd^)_x6`d4vHrCjf*o
zbIR2i2S;|R4^i{Eu{(QpWU6%YOtOx6Lr-^iE8Xvo6WgkR;*ZzygmAj)2zeUblM@ed
ze8k{*9=sq{wppmr?0xC+9&abc$tWE90^F+((F2QEue3=QDF;BZr9yb|{zz^N6edvn
zb+EyV<uxKrHXR?9c6Q_&rUzgehui${v6cTE@MuNY_~a0<q&uW?c}!X3%c{X{;B0+k
zg8iPsb<dEF7oSK=c2%W!&)JS^Fl`C+{Fs*%C=f!%2v)iOaZNHRIWG?(+uAF}<o9g(
z(YH=VHZ*9<VZgEV3)!^z)&ZLD+0s~}d!yiyYF5rUqhZB{)~AGTkWASHYmL^!o#5<R
z*LqS;N%>*xc^vUBbF-OHiW&E_eiUCUf{6(AAP+<kdr-i2UNCIJz--#eu_m2(@ig@u
zZdnbHg;&B5cwcm)&BfA=yVn7UWQTJRL)Af_Fw)(ri>;95WHp6p!xnHeg&`Na0w_|?
z2;nFtJV83A^IDJh-lS6NQ{1wl0)KTF!JIG^7=kMELaE|#wbC*&RvGaX>~)^V1Gl?(
zcQfEw769T7b8QE5l?2`jU}FKpre@e}C*{19><PYS%epr)NbLhbiLd1P?077IVurPM
zHn|P3*bhKg5CNnPYo55m+vwRK{}G+VT-uGX>al`i`v?+DpYfJfZjLF{ie*Uv9{L#2
zO+XkSz_scSTSS|)tE&ntg5CK0Vh89-HZX`}0K|GPyq48i4yZFHBj3J(`R|RKPHFTB
zv8=Ip!w9sRWr*BXz(qQQ(+t!Gc}7o=44?upC@3m6Lgd-q%i>&n&d$!J(`)b4VYar%
zdoU~wXh*TgDmn`iyiC@kv7ezT4q2J&_epRtyU5jUG{PKEf<b2b%NL4aUr7M<ngkFi
zmN>A3`VsY`m!JRqn+!EMD>hIa|L}|VMckKRhA+crRVN;Q>hw&hgzI)Yk<io}DEF@P
zxYRh3V>Dbo92{^J@Pu3kvo1&-4kH5f0HU`R5G78$%wxWI-5lk+>V&uO41YYhSv$}0
ztEgu^844wTc|o>XxNqLj9Pes{2|(p%2=bxy7dqlbdU~yoV#Yf6B^?y~LO#E}cQorV
zNE|j_0`M;YUkmPkxsLenSi;a^4{vWNhzOnmA{(>6Y!8`u1mDUBI2r|TM$>&AT|5eW
zPF|4HVqsv8P4cUN=xfr-f%E=8f2&+S>c-eDBZ&^}JS^X*m*^v7v>#YY@=nI5Jmz&8
z2)leVH?uZ@F7*!TQ7z|tYwq9GzdjtgpLOKLW^6+>qxD0H*w3tt(L(|(;f}1AZoU^d
zt1AU{B3h8mzQ@Yv`!g{uIWYf@kB=XzXUBen#6nck=z6%_vMQNH3@0ajKZ1$>yg3CV
zM?6UHQ=-XM^hAaempKK*EX)W@NG+fv#fCVqvp5dX)fw!{x&MoJgh3R}p3MhPD&jQN
z9FgE`FGo@YVjG=M2&bAJE*kkYG!z`uy~!i?O`$e-(I}_$HMwd(a;INChUm_#8NbDB
zZw2I|*1QiN#CyC=0@8d$@nOMZ_78whR_xrKg#!t(JL=jc+{N{!loTCtJ^I4ava;^<
z7%aocck;if$BP?HZO3p522$R4rFklUhJ*;?CwFR(AkaMRLPqqsCSe*^B7y;i<<4fu
zj+_B9S&?6f;O|?l9Y@wU+aK-*dO1$?;m}2Tt~=7d*`=N%kK^yLAVx+;9M6RP+sJ_V
zPn^hMyEXAZ>{}7?HEmJ|D0^htNi&>+;!%B9)wcJ*VmD*Y4!B0#xa$~vg~{_M@-M>6
zOY+br8>Vfa2R$dixmd#Yn>|Kw%D`<O0FQNpPy#=!atpv4N{{qtM8F7gG<{4KUW+dB
z022Zn<5O`usw^WhqSBb!gSKzd=lPM?&5$;RYpF-vy}e68^l%6^X9mZbM8Yaio6jL>
zVp$=Kqp<#f8)GN-O&3vutmD>O6DQF30Mc;`W~!4yOqq&wA*Z`rIcWlM4DOPBWSgXN
zTKG<t4(=nSWBHF$dW-EuC1Hw5$|0_Ma~4PpHnfBBoYzF)yV4<cjprTjbB15(<^*4w
zK3qLoG2fw^=SpzSaxkMCTUsA3?UvAyx~L-+Yd?_#Jg8sr^4tChxmZA>cT{rxCru+)
zeS**WP%KU1$e#QtashV^Zsv5w-80*y^+G!0#jf!7=+GUykmc7R(QdA;@6Um0qYtE|
z+mg<#WRtGfJh8RN&k$4Fd#yb%GW0Yzv6?OR%#YTq5tK02x|pEa>jLr$KBB>vzJjf?
z=NRh$F`{(Vj6)I**FCbPtPKUQ16fg0TKe0^Hua}!tG#sZO$xMwgVnRzC9MPI&H$jQ
z{-e3MzuOEl=+|{a7Ye}oWLm(zs@($G?5nXL6+Em`Vd8S~eko#D)>D3bc2%dNM+||`
z4K~rNmq6MhMD1@Wdv>NJX6&!nAm6LWih1IZr&(&vWW~)bP3AkwSNtv}P<eqo<6s2g
zv5a-&`IPy^xzrj|jo#pV;rFJpZ>>RVcllJ#?YVrYg8a=y>)?&?+EjV_{m-lii;}Oe
zu6QpG+^dLqFhfAA`v1M^yZ&t0uJ6~Sk-yr7y57qV*7k=o;r1za9ejFNZ*YvM>ONTr
zkjZp=(_K+XW81}^A#>N2nJzvxe}(5i#R*IR*EKvoz`ZycA)=`p3F*-{yWTBV8@LDh
zLNa!1qYX}<RY=*$^4`y5dv15`R3#F9?iX-@Z~vBB?xAh$SP-YezmWyhT*UM`ws`oP
zJ69QCkef?#&#Zq6qz`*thqmViAet)Quci*S5h9e+C7J^cRV8xTTolH9b;>DiEt0+r
zMrNQ29k?ghIDg3c*15FP9YkVUs{=wy(-lKtpk$*XHHq<pI9;2s3s#n;w-c`7x`2zj
zZlfLiF%bqY<GeH3*U!-f2fe;7v{m4}D>jsEeY&~DGbI_;!7km%4P<S7dhXueun_X`
zN!I^bS-3y&rEe&z*9sROoY`;H=`!h>_kQ!sWKYBK>G_!fD@*L5&I`N?Psx-juOxC+
zUAjg3IHtYpYSfQU+LaZjDlRO1dVMA;l@DWq`zueCN7A(YIisx0g*E-v%Mg@le+|k<
zHju?fK|OTM!gzyPBqK*jqfU9Aynlx@ehgV%B-y?2G@Fj4@wb3#JF{FL?nX@jy^J8d
z6;Q21J_Lpj<H(}EyKWCi@y%GZ)w)my=4Z*tv={dE#R5JMfhp=OZmqI#21RuAV~J`4
zmAt5tyz99!H*`~{{f0<1idNx9cuSA637q6>+3{jX+vohsV3kw~1&z!q#lXY?yr%$)
zsm3qQOsmOPYqPgg?vAk9JLSX||E|2StoLQn<2ygyz0LoMe~bKAImY%?gt8YIQniLY
zTT+hyx-l(pt8&Txq*$tKj+#gDVeZY?FANtX{v-b!zL1vMBd@SaSv6t|4KI%85>UL0
zgH2a7=Ns7m%H5y3R<$)>35M+ZUL_~XgM`}co*s}$<}_?4=SQZmMxWe|htO5o3;wR}
zu38TZPrd_uN_wpHYSX=w;T9ogLV<(IH<3k?<QgA=hJJ2`n5Zc|qC<bzu-Z^7cC}N^
zKT<D%Vb%OOuJNYz7~_0+KU)QtzK|z|O+<}#wp1%1GWF(L-@>+X-Mcuf%UI}tFP0X@
zcAt11%|*AhHcyd;R&72)p3Ssr$sLF)_|ewZ2<e>izCSoVn0?$2I|tv{J4w@}pl6ck
zCx%cTOn{47KgY~mRtLv8?F!!<2s9JA^HI6a(mx<F=KI$Qv&pWWk2`~7#L83kQ;uH>
zJ=&--FAUXVtd*rzlQSaBIlf#M7WSL;8{n%HiFO@g_@K(<vi2$SKOqa(oIb=^u(p5q
z(}!j0D?$eJBh;OD<vsNeGrm;We%S{t6AGp}ny_`n8=J2DJVCpw5Ubk&XZw{g;9jIP
z(Am0>(q9@1&n@&<Vpy0LoQ=TM;Rgf{NaPk36&+Ujb2UU(6V})RXyv<uh&$)XjSDA>
ziu`DVy<9^nz|b~KWC{v)e$imZO~|03_53uBK`_|sWq$UWEK7hHRV40f8cZwudm=+F
zo>l`aOiM?qdS0(S=D4I9yV=L^V=^h`>q1q&16J!-|LDt!1INW#ufVXKu54a+P4jZ0
z?s<t<oI<Bjv4LCWMk3xP-^56U-ejF)M-8V{&+lewB%O9R2u<Qch$iEPK|0~Hd>{;W
zfd7r5NqYPh#2$Zb?T|Z$2uc^00D7k--TY1pLSioVJk@tNb#}!8Yx{-6Z>D6V^SE6F
z;XQTHzv*A!M613TPsL1N%2XAHF|TLvXqDOTs?YY7&yTR9pox7%+cs{%O#R^f*-B|P
zaN3eX`d~D;25)ToPbH^r-{S1d=C!lewM&SB4mD{qY?`ZMmG55OnP#@8%xtID`)v1%
z<l$j69g_DLsiQ1ypq<RdX0o<J8OAG=dmIb?j0D2|rG%A`n6yD?>N+jMJR?>F7#2n_
z$THdP8dtm&qTjXS^C8?$4gsp3t;dOknfa3Y%%kjwO+Lu0hR6jg?gUmTkDc1KZF|l6
z-=X{Wj?zcEm5KJ6=!&>bt$OnjJ9rhZU_}Z9eH8Ule3f(vF+1;kj5b5HsqjVQf;R6T
zI(%4+Kl&!5Z%p+Rq`R03gts4+$DryY(gUB{SX*1;Q(r%9f#K^6aL=s}IZjrItYGNj
zt{}ev78O40CdYx~=jR*mayV6gzEKf3?>9cex3@sv@<M4adfIhpUum@NKX3l12YO!v
z=zZkIl3H=O_aCUcd!)4bVy7}^2Q01}ammzcbV$SY7ft<Fn$eyjlV<E#15{8FJsyr-
zPDCwWb(S9KHfLv)J9hM4>yn4IrO@P0-vWDwwN{5;d8brn@}H{G7dV}~cuO$ZZ+l`U
z$Ey$1T>YNvWGzCEhk9LIfj@d^qD_L4^D39-GF{#7%D~2}Ii2ebe#%Y9`J=6YJ8B#y
zYYiTr3zm+^?|@jkUu4x-!tQ9UlPI3Bw{{I_2a;y$o0iRJKL6W%YBvCF6GgAQ7TIy0
zg$N)U@7bb800lH}liCH!#`^f_Lze>_jznG3IzF-xu_G)Yt;W*RIry{(dk@7KUU+Xi
z^S}PRG->B$$}MKi(@`A~CL=FfkMLn_SrCn)Q1L%*YLxRwY3kImVdM&pKqcI`SM!`^
z9$K^1AW(be-rpb1k#8?9cv)FnpRzDF7j)bW>sGb~L_wQr)P>Zuw^9&t^#VE$?a0;x
zzxFrQxhpBfaCe!r>xgr?13n*;vSFQ3SSSY_-^FiZOXJ|_rj;H4qPxImuK~n0Tt`Mr
zf%+Q85dhLESZvIwjQ`{6qJ?8+zfP)E@Nh;$TlXGGIcRGR@`<y8Yz4~^UHd(`5H*PA
z@Bqy%tVgymP46$i`pNg<O5`CO)~Y9n4*v@LXzOt3b_w{TwjT!p@%vgVtp-X;eFV@Y
z-{%}RKXKe7QYxOJfQdT$m7E9427OG2A)tZbL@bmZ14(A;V2RZP_!3S5Ro8fa$g0Op
zR$4mcoXhX*vheWzFtqUnMNyfw>wiETnBZzZft-WgjRERT0n}Sy*v1()MVeF2KwHat
zWV{YO3uJuGZ{7Oqk*YaGWtG)l$XG}Ntp60ijj;d<xHH9^1f~Iv3&h=DMn#t0p_@%K
zYopPR$*MGs%gHBCpI(-3KC%Ayh5o?dlg1?*3+$zCmEXMwjX@My;uf$$L!*xCrS#I?
zMFU6UGPla})$s`lSK)b_+_{I&7Ric=GrW!PsXUmC*ma6T7U7KC&m{JbpP%1&vjCvx
z&rn1AA{dxh?JW5YI7~c1n=kaV@0wHAU<Uls!6<CC;J`(uIAHejST2Bwi$Kt$s=9}b
zDV>Y~g?bxEV3?4X2?_s?yYGx@YTephfKmi07J88=Qlv>#KsrW5P|#SAE&>6iOYc!y
zkfvJ{q7(%pHkwkTqadgR5KxLplMMlp8hXo}%X7Xv?)`oL-7_5HY`0so@~*edXFg@;
zyrz<9Qj-q#-PkFhqAhpsGff;>VEM|Ut3Xs`LURR5)?xw>i=y4Dg#K!15J^#}XAkU(
zfSEDae|o|XH*vDAc<_^U$e*nMuSVNh+NM&I`1TV|cTd)ZW&2f9-b*m&S096mKum&M
z{U3Yx`u>;={t>qLTk|5zeb}9r$*m>{&KQ-yTXyk9xsPxu;Noi^nl@=B@FH7qwy<I8
z3OEQlt?DYBdSUe9GG@mq%stB}-tYRP6i~!K;?l`g<athx18GE!!9071_g4`(a0DFK
zwJL<<LlvZZ%2XCA>I~dM7Dx^6;<a0-rl@a>qHu!vo&(Twu{w#%@2Yr2wmo#{P;d@R
zYn^+B?3f_Huw90h&#BNiEha?(+KWw|m&Wap%&G-$H#g7xXznesre4&kfisd9cnKrW
zhdc{+{cS{OZDKG%3c?9nt)|`Hi6c~CBb|i0IF&aGKGTG=1K<O8#20#~eE_V!0q{hx
zuXF@=<UUDQv}yGavP(bhU}V5Yr9+4=uz-w=R(J3%F5CVV+>UaEq$2~O$PA7l3ZUS#
zpr5Kw9N_}yLtrR0Le^J?!}M`8KwJs1u^G64$RP&+Qt;lWva#!1Vn)8>zodZf{V5os
zTs2rz;*6>HCa+2&9%_kiRS|2T+7EiAnS)fJnaU6aJ8R$~w9Yn*P_4k7EI7{59DqV-
z_driMu{sU<{>poHR0BAX2_%PyBpV6skd-RHK=m1$E=(I*!U@_<)VKH-d!X6q0L|rr
z4vSi3DC(lzcc7Cju_1Yj<)v=jE9+5jN7M#)>sP&}W|LRHe~c3dA1ttE2FnuLWPHXb
ztzCc3PA`)5lJvaR(R|s2tU}Qt5-`Gmo9RUHCIMNW0UeD)Dqm<sXg{yw77(Hn^ytFj
zy>u3I_90xL>AQwVLn6!s0D&>cz6VBA3XuVUkd2s)JSi?d@=r>Nfa$^ewC!G4dLA`|
z3CjR*nFYZ$7$zM<kZWV<FRLpqNOdU(9crVelBH%2Se~0=f1h>r(b1bzqG=ay?y}LI
zcDE8%XIa(Pm+Ih2DswD2%yjp_`#*YR1s}yjPYp}3nf)TqYzVO>X6$IGuxAf2wQczc
zBwc9?ngCnxkt#%V1`P_1eGZGrN2Y=-Vkh=K@3l9)nBt(t-@h)(9R-HTTlrVaM1Y3R
z;DUFx@9FksbIuFjPpN_`Miz)P$DOaTk(`<NrV5gezk<EwL~$2$-A6;7Q#xmi%wLq$
zeD&?Wg)FgplHB@e)!;PUf`E|9YFe!|1Gad;KJMovKgge~*)en-@%9740}C6M;H;iO
zjWP(ZtOzy6F4af)<92#l`?F&iapak~WnXugIh9O3rm~A-ly8Cr@zXdOoET-P>Uy{)
zHuI}v5hUjn9A<7Dz#}D07U*n~phq4-8jrz$kyzjPJ{XRbDBjM9V%~Phd_;H7i8d^E
zkV9Nfa_wmfUdPwkKNA1@Dn<^3l|2`X$Op3YbSqNQN$zaQZ$X4|*U`N8Ko&dp73cuV
zaM|tGaXuxqK(mHxMS5;-ZXc0GXrI``_^>QqL(E{H_~Sm_NiFBA!$Q@~A-TkK?qFn(
z4u9O#%j61)I*BG=XR;!MRssDqwjov6P|c9%fW6!AVdX1wG_S<cm1QaSjVKuW7qBiI
zT$zc1iGPn|CE0KoK1&^$W|<`b<se_5)StSlCE1{ZvOP@>-oHfElmmU=sLqp>L)gL5
zifIN?wSCA6vAT4LVholK2rhN?G~#J(hPHC^C&6B%R+%0HJb=DnI6EehoSbB!McVpU
z`wK80RUdcW!}5+u5(fRkG-~U?6z?>a$@CTHBZ(~w%J6?USy2Z5N1woFO^Qj^XjK?%
zdeKN7WM6B?_{@=|<&nLJ+y)y*AaYzh;14xuUf{9aLJ&+GD)kzAPyz5UQw!I1mI<X-
z(<T;4_tYhVyTdAnqBoV^yEF|%%}j;u`{WX3Qu0is()KO2gC_aB;W*brJ1g}?=~R04
zy62A^p+bc|+wE2hq>tYra>UPo`WoiYz9h9@B!A7eb!luTm5dFZzcKte8IKsc<lWs0
zErsO`FHPRIrYaO3Vn*3p40Tw*`9yZDaY$~14Za${uS3)-@j7#47N8eDu0Uv7OKv+%
zmzbQKe7v!m>(8VnLjnX6403>-3yLs~yv1fDj2QtO_+;K<2_l}1--;qD<wI@8)^WlG
zMDV|#o`~`LBY?hz-LVbg`Xpe~>Oe!{tc<K|?+L)Y-1<fUNqz@<po>O_v5aGIBSGgU
z+mJ8j(VyJOV+3uEFdiMg%}BBY5UhYq;1BNjF!KaZK@`xm$QiV1AYR&lxw0_jTP+Bw
znd{JFTN$8${GDHNDk>f^0lDOo#iXf1a|O^<oq>tc?Avb-I95^=F1eX1PV9oM>@&^*
z2sc2>N`4Jbf5`}3=rU{9e79r6jc{!#puU92S~KPq0piHU1@VtmrSkmsD%)o|2eYoj
z{P+y2W@ci)R-1@$EH3ftSPAZ10if?uVe0?NQN+Eh%YwkIEAvUGs1xBJWe>oqpQ{4t
z+Si?(pTkyY%G4vx4l`aG(9bfs=NUu6^Cc(wgl1di_*B^-xPw|&Mx%<o!;q*ZQVCa`
z5^9JjU%Dtj_^iB1AFo|9)ERoWS2w4)*ay?0^(B{u1P*})4qRT#lg2DWTHyP%Y3&T!
zM}Uf1wtQE2ba;3BvmxESwZMym#k>in756q?>8#KV6~i@JCz*!m=1-O~uP9*!*6oa8
zHfbR)P?)g5Dtd-E?*wt-rh)&iYGS$Zk@)G4NW;b|UDYaRf?|3$Rhh{!e9qVVP0+)I
z5Lc$Lg{>aS{)5?T&vmYL*>%?oX)?(balgjjJy2G0N?j}2LO1sqvyFyHhUWpB^=Yk@
z+6kSep(>^=-r0q%pCFoUG#fFsY=^!>DhSCeu}-ZUrfZJB+fS6<KG~CuX9fwZBr;?E
za4(hTAm$$gZ>V}~FQ3@!<ccVg`y01)Q+<*YwTc-5TN*WIUBFka=jm*l<=Ytkipz;;
z<iYYl35D}{+_lC^`IZ^$ybY@qRU1SHzA7V$w1a8E-+K9B{P*V1rop8WAGZvZFut+)
z-v+Xy3ivO!E_ovl9U<`yaOdmbFRE?(PL8W~4xA!J5LN>WpVO~~*w9q<9Yc~jEtR|4
zH?F!!fm{W1W0yYHJl$WF=mC-T3aX;q60AenprMvPp6BOxAt-n7d0yV;6_?QCL~BHI
zLalWk7-#1JSnjac&BuYrVuUFr13+xS$m~X5Ma1vAClxt<0vG-eZ<BfE;LN@(3}Gv2
za9u;N&I$N1m%&40r!L&973OGOGgHfQ44~s4=G&|b|8#9Va3|mS6Cgb0x;)T|!#(Ue
zUJf{XiQbP$-ezoK+1(7MGhv}SXEh5H$Y)r+7e3Rg_-pf{ktZ<AS&7iPR%hdoR9rHZ
zg5B{DqJ7yYlxHHixt{4K3-aEXXwrQIn$0FF6I@t&2tye3EAjEeJ&7Y}rqFi?V;j1O
zxwFz8+(fIF@M?dWm4#VZ=EV8Pchpxczm=c#plT}LGd%MUFV1y!6rEVg-g>4C#UA{a
zd%JQF$w9^ZYIKyx0F7RBG?h4VFhoR2!e7<>=km4qFB3f9Yxt=_abx<qB7b)Mk*bT`
z+2e7AFGJ(^WzB$w#ndAX`i)gL>{y8+(RQvUj9#3h4YzAO7z`MKDB*IsfSbTpB3Jvo
zSN3P+?XWPb%n#OwOH?9EgH+gMoS}=sF@8l%UG3RUUE{BZGQwgb3=Wf=Bk;fP13_Gq
zPt5Y%x!Ha|=Qn}F_7ukd4KOKpifg{>@OYOC^@7sIN`x9-x9P?YF_LrkpxUOJJimq?
zEa*XR>*Yf96Ewwbakz3^P82Wsl{t1@RTd?k;&2`ul8JCCtFh}&f`27rs;PR1?$b=}
zmAHs0)+hZ*w9|+U=AIhfC3G9n2~xBA##HYJAy8->LEwVW3)=}dpBTrGWM8QVw7H-Y
z(2ae&N8b?WEwYY19=yPYEP-0Q?Nk0mqrA9}*P6t^OQQ*di<v_y!*dA<2_ocjA>B-1
zk)U}vw-!FQpfE6@W_R5q2bDme!^QBn13FmJJEXS*=|QVF@L%Fo^)!+_h<W8PShHO>
zXb%&XXMdJo?d#hy#_<c^B92Moz>v&cuhFF(iNwDYns~w7iToJ^%CM=d?@m;W!>X#~
z&nanw7Jx>$P~gRW)A69SOET-eM9qy31+pDVV)M>;TH>CF!;D1n0vCBuDDERSY@hoG
ziHE(pk$H*Z*TXe>6DMC+R2*NS*P@irT9&I`=oul|po#fm=~69C?4Dg+{Bh{d9$VMw
zxwE`GqNtv;3VXO(F28P9%H>g%-DKMG-WZ&HD?4~fQBbZ({5Gy@U@Xz#sLS)ElAh|T
zg46P~qKxCy?xO1MjKl#iY{3u6T3x@3zxkE;dx9i$8i!KBc*8~_$QrrU>-82)`xGP9
zykM4X!a4RM?#`WPFmR250zX1VgS%smQ>&R=?Qb#J4F(+=iMxHRRY#Yf*$4rv4jdxp
zHln)<G}|6OE!lbjgv{_O%IjJ~*|V!lMq<?|4;`y>OKi^Ka+&K;)Bp@&9*wA}LX&7m
zZP8$PQP1Ht!HMDdWo7y@vXMrfSvFH+!!kJQ?0{C80v9g_z@)`-|2pS6v4|y1>3|33
ze&S|HR~b_#4;zno1+*oTH4^DfptO6HpYQ$@D5Hlc+Wh)^TGKUD^>9YA4>}>(igTYl
zMU&aEpst15wEMg_2*wOuHlYbsZ)|M5oCl&3sQXVtaRUr=^(LhmVPx<Q4paFq|1tcZ
z&R+ehKdN2p*Yg-<=-~#q)*qH3vn}PVa|WwEfnvMQca*waH}CQa3pkBqQ=wOenRB>W
zw0h;l7-aHS0Ym^e!V)m(*eCq@P9Paj%%4KkK0%`bpfRa??&I22DtnZE5)$A8?wTSS
z_qezap-z@#yV^-024SVOz3wA+Sp-{5-b%BXU~nLR+D5ezT~MtvM40vf0C+2XJ`4F8
zy;Ee2WhI%E&vq_m!FOdBQG&OfX$x~xK618jqHtb`%YM*2wXwubP=m7Y%RaNMNxU!I
z?5E$X$83lHblq_Fa+HZH(WpfKE>X($%7@!h^2$dpUK3l}HS%kmyfU*q-P9{3E$JHb
z<cj}7B5Y8CgU(#KhO&e9V`gw05QnA9c8CIxoC6KKs`x_nun1107xY*ee@J}s(13a5
z*5^%D|Hp{Z_2j|{3)z#%O$~)<!tV3j9rP;_?G`$iNKdHJ>fzSb#<U{ErvMIIA~>9>
zOP<FKXXk*<ObJb6m(7j;D4n;EtMl+rnXtNoS681x7Zjz9fVBXflAH@vxM(QprLt6q
zl%hv@{JB>X7`i<(dE1cUva+^q%84ZIYh#t0RUDEHV#vcCk^_FCwDZkx2EJP`G(d`@
zm(wTq!S;K|0pdwOer6=IyNh4G++pbdThV@O1UB*&13)K%khh?NSfGA#a7z@5gj-}4
z+_c?*w5}~XDgjf9;bPtues`coHaRnM5I`)Qk+%0?Q2n=p7$u!!C<uwW>wb5@2q!{G
zKASiKj)g0`iR*)4G7hdDwoDrUTd{%L-N1RH?{X9yKK%_K&B?NC_{3CH5aCkMMt=nE
z2cT1sQBcSe(C7MYVLRodA}w<vyr^jT0ls#Z{syQU&7iK2AhkM<NdQl|1TIpQOjp2i
z;Rf8TU6|5LaNTP=ZH^o{BELUNU7u8xLF?yq?RYXBKm@Wcz@dEm4K!&5kMfZ}!jW`=
zsonT5x1dc_V)P;qw~#iXW_nsyf-pvpbvA4Aa`(6P=it+l;EtK`6s0+YA1b_hDWnLx
z@Ni|>8B-7FplA;5X49sNv?zDXAXk2Hj=<3f#uGW6k;TOCqyDU8+#Sk6tjyYjxjj8M
z(`okMF3AxBgrB!!cq;iXu$dA~j?}xDb9jt2%|6o6&*)OSzVS3*sxrLk?7Hpk;q4JE
zRX3m`B<3K!mTr$gmt777LJoaPra8&LVpQ7QUIruiBZ8<;>WtX?1T7Q*J?G#{XBz_6
z@P7Wdvu!=~<@VtIwz-z~-9n;?`d+*DoRO9hZjia7x(W)118sC}$t>04u4NfYBe2j4
zP$vg9yN#8(+S@uhst=4dbzMSB9nGz5Z3lI66zYZ<<=dm7pYOFlL9hKD0K)9V;0?M!
zd48}gf~u*`<}GdkX6V7)0ZNWka=7ruI(m!FPJZ;PL~&8%6BiMPkJ`Yn>9b__+CgOO
zY9EFU|EWy~h_e>KQIak4O5E+n!s`Z2HM4(4NDenEG|L^x0*jT~WJXT%BO72?Wt=(K
zeTYJkp<D~I345M=oU5)LF@ZXojaltD&>*U96LX*8U$DeJZ?x44UIy$me06d0I_O+3
zN;U`?E<fjohZRGhmsTrYSC(2HO(J~j?zWwvO@f{0mrUagRpgVElx8+nKF?PLx)RES
zniSGjPgfT|xHe>tu$6zKS7oj?1&7(VpFMd0eBNR<ZlN0n0<CQ7B#tqj;BQDUEOvpU
z5hP{nMzT7b`Lcv9`3FV{u26BX>83B;?M6VwetWOQ<O`h7Tf7_;P~@%(`^h}O(H?-A
z$4@2OrI=apP<hDv%Mym!gIdMIr!|qed=Yc}giE#ZyH?_YasUE1M3sAne+0N=z^HEN
z1m+R<P~p{Dm%K%5qZcC^vr6^0=dEOqUXb<Gg<h2<;inc^i0&-dA5WIzlO<^LZ&@8c
zy2g@JDzY{&RWm)&dQi7v%Kt>Y<f;A4A8Ss7Eay+#kO{j{W`c(^Is+U2r-k;Bdd*2>
zzI?li8DYBBJH$NIb;je(?Dv#$IoFf|DDRs=BN-2ssDVo;x^M5;bbDMXmyu^UGM30O
zUwd@U?R@`bDBe*8b}X*O7`F`aIc-Zm)6(VRwM$V)1o-*6sm;xCYxVP{AO?K8Pt3e^
z?$VdSdcv=xSA+6*W?Q0XD+ceB=G8ds-KtJYfgr6N2zy>|Uv*>R{c>NkM6t%LY$LC4
zJrSM_?rcNPi`dZbqO3A@>2Wk15siMd<txp;lU)-c?(ghocAKaTTVd8d)U;{sS)Is<
zuf=kNgqh|I^VBW{i$si6bgYJcc(zOv^Kxv+EgQPBQ+K7wK_k3rU1-kFwKqzsln<BN
zt=8=FezLcN3Z?7rDBcpB&sAXR47YVozjPH0Gk0pZ-z!6<2A9rn>91AFoM^onLYxg0
z@;lOq{mp3p&Hu@!mAu%ko^H7-?0%3O*af03H@V0FraIsJN$rc~=Ca2+k+Jv?$Frvz
z7rA}pGUJ~PV(6PK$>0v5)TfS}eEq7{f5%vU2iUTqRScZ>PMM*8!%$4w$A||xqsn+f
z-cgD`&XJnLCw%GZJI<%7e}_{}Bdu0um-fmKi|^uhvu5CY*6PgGu{e=!3O&HWV;)(6
z%khPrQ-?$H#J`EhBc4F`+n2YPfx766^aV2Mz;-Y8kt$-<ZJjh=nXj=Oy8u0BB)pQd
zGp-_G`=N-(O(ggftrN2vO&ab0PTDB0ME#sz1jz3Y@iHS*kLOS64fg3mC{<aBa0Ne#
zYym;UPsbLuGT9n@X4l_xW;wymCmR%f1i~7mY<9;BAAL#a$T_VW)OTyz<dK~q)Djn{
zRDb}k6;v--P?Ceh5Fp~7J@F*iSH7?`Vxk~$y0tIW*G&7E(<!d&&rBGL#VRX}hy7>4
zh#<8WgGnMMZJQOP-X_3v8qA<ZFlTX1OC8%={N&JkkbR#Y1C^}Kjy|oek-hMY3vM#%
zpy&a8=~bk3vO>ZwBH$GCMBJ_vJGV!>-91yk^5slhiQNLP(ThSMDJOWo1<2{<d=`;w
zxjoK&ltv5J5#?@+s;#>OWRR#9dDgDL;g|8@{x$*fx`2$&&(`zsu<$-~v<7gJQT-Uv
zERv#4M1s5IeDjwt(QK>m`HTsm1oCXE>048><D#06bMp6nv08Aszu>4|L(g)4Y^^MB
zyml;Q*>&bTl$dB}ci}{5?(*tC8}KwC-pX%B8R4wCkVp-{RZ!;8@{~ElzwHQn#p$oJ
zU=kqO<kdys*mY#O^tu?dtbjio*v(i6KDfo;M2IzorH(cM{P^7DhYxKessK`Lg0AR4
zd1qR?{#CGCYak5t2|w1*o(z6}XA};8u!UJ-(pD154kka%g%L)7&FyTUHc;JAW&FeY
z_q|oH0??0G-?00&O&3;vVrz4=hK-9>>zmi$ndL!E*C-Q1;L@`R=;|9s^I#(|WP1+s
z*^`V=s86On`j&W#yLJOeatJG(YR*j5k$Pfp{Mu`zadC36mcfC$Xn;#V31plCiW}Q9
z+oVtqGq}wRAc|itEE7jw7rU)bJE)Ky2*A?M<!gs#3k_&XwO~4c*Ruf?wK$O_idO=}
zCgyNoI@{xup~5ued?bh$d%tVVUUu{;{OoXdz{S8HOjIA&1e&v5?e<Xh(If0dn}ps|
zb0O$wPID#<BfRr!L4ao1i37WOGf6k0NR8VH#6hnkmSi&*(*SZ^*$4Q`%HFrS)_S4L
z*XLdS_w)UjsQO|1)N&H(5ioou;2LiMY*=+_Rc7+dP;+y#wYBx;acb41yHkdsutA&d
zX9s+t5WhP*=WZIka1A~w(oZD)ga2|H$o-mFQzm6CQSPSw_YC<u5*kCn1U`jDW`7po
z&b?4daw6h7VO1?ue~1;xr6kv~@Ukjn;p}hMIc5so7@`ZR5DNza@o~Pq7PZ>H;yXze
zHtyGZ^{uE>(80d;RMRYg-euW7XHPC{49S^?(W4D6MJ32<K$>~rPMDEA9}7U=V7=|Q
zyl}#0mH<$awOge8D76-e#c{LN33X#uuOByMpL>@)?}ebI-cs-abei96Nkz_*oO!W~
z0`OL(Az=6KsYdJuu`SbG>B#3mGj_+UJ(U>Tj=Q)wXV6RZG>%94?FeK2-*Yk-UzH4O
z*L}?UYZcy^2%;z_CoH@pY5?)n<jdQmp9XslWcdAR&_-ByooClIbV;W#7O>h|Dnm*7
zSH*ne@T*9)8mLZBRw+qe-aJ}*x2vMRbV?h{&nu>Rth=?Cb@A+8nh0+@*v{{T_bv^<
zMQqoaE9Q78v|K_3K-Y5s!+YMg+m{EluFzayu9Hn1=|Q;f;th~903Ol|WqH0@EYBPf
zBO<y+f&5sW*RNjnVfo{%M=IPS$!4cz!#Rnd!^O=qfOUTy8;%Us=1*>IrTY(DXT8gI
z^#tG;b-w+;ZWch)*brE<5wYU|d5bw$<SzpXUu5(`BX*oeH;DGo<l}r%vI@A)cEao%
zfaWl(Ck6leNVl)j^H;AlIO|sNUtE~>iE?LhU+o4xUO9Lv<Ql#3fQA6(#!@r5>wD<&
zJ4<CH0Jy@BwWS3PB*5+QNNs#v?6?!yc8GyMSFNwK3E=s}$%<~^)`xM{EyB*c9UeD>
ztaEKlry_qHf6l;`@lv^l`+uY!JmD+#+GPVllYGr7N^FRVRu8%pd(>02^70ZOPg!gF
z-ALl06BUwIr%zV$@r{C(Dgl(vmmAaiO_6w3B0xT%E}_Bh7zRt&gHNA&b?h!JFnFJJ
z_%R|I(>Rn*r*VtOO+deOk@XvSI@Go{+jGFe1L0)1GM&><HB#dr1fhlq^5w;Y!vIuW
zDJQerC3w$+<`Fq(ZJk#*q3J22+ha@IiA&Bd$v3EAQlun%@SV2-6W9#itVoo{-j_IH
z^+&DMG}c*-sMQoNbbo{v0e-$wnGgNi==`e3j<vENly4U?MttpRO<rN*V7|#xn9GY%
z0;4I(tYPZLG;rE3qeeMUg@AYVA~L_Zf_u2Q{Q&Xj;$%0^UHtSHsyb}7Rp1#DM;h0a
zl`8HU6h7|b4AyXE;MkT8HCs184;BEF)%*4*{gqAQKm)d=oS7|Ne=!n{QBe3{FbWjW
z&9%t_#>OfwlMTUYLTj#m{8FkA?!e^&n>?qMM@OZUlxCc84R9I}K3!JDVDxZqC=i9U
znRey^`pedj(y3JZ4NX1;`>~`*UL1}qXIYW0kac49tC36k)iD6`t$1{`u^ytwePqnc
z%<5+-ZYLg|tRQ{5Hf9|=ZYT-MEm11V09kh2#_67T1lf+jQh&L>9b8o>qTh8{sCd5w
zZhm%ViWM?Q7~4cd$9QsUq(Cb(oyM=T5fq|*MpJ-z61UEx##{H4s%hjB%7ZP#^ndl(
zDQ>dDBlL*rz;OzwkfB?ZY?3dik2{8S$%*Ng$SP4}^Lzrr254C5pi~-S1oD%8XdSnJ
zk~dfppfg<n@mOnGrMnOI?GrNa&GAOy3cnMS(VLYT3h3EYRLw34NYy*I=9O1=UPEyI
zmL;i9dG6K^fWKL@tIh)u*`p}h6@CV~w1(RfybfYw+eB)P5lzwQ2Hrk=d^^qGIK(1%
zA$MNyh;TaBJ|WS^UO%O&nwtD^Vr5bjgfT0`O{fW5amCz{y}gkt8uu|VW>BV$AIt$s
zhK^OGX(Sn_0Q<gvoptAZ_T~*9Qtc<4k9@%$`7~qAhCm&>Yo#xKm9y-0$N(bFt}92W
zf=!puMvtTghQBB%V4R}iz{X*DSwO3Ddz}L0hW3?C34jD57F-I_zyJK{3L3BUBy2^}
zUui5P5ayMnhpjlHXLof<*Q2}cu7dq%TohtIH9kwYz&T-{LUNAks(?+o5ZybNhvW&*
zJk>;*X2lT=?@w4Pr{p$NN+o^&vouH`^Dh|nL)w5u>gt~6H%1Tehjm_$s#4!m!(kV9
zZ1Tznwf6c2@R&A4u;g+T{<s!g#aw3K{XHz67r}OZ5f+C8bK!AH1Y!t?e)F3QfFz<}
zMdXrK)1cAr-nUe5F&PL2Q@5dQ967-~wyn>wtI)1~EYGHTO$<(w%Xs`emS6++C8K1g
zj0w)6V4z6w{@MU$0m##i@})bOUzTX2-wy0zTpJ4p{Y!JKa|!<U@<T_CHu}vmD!CI@
zxi_e0;2>UyDmOeE$PfZ5^tsBJnsseZxT*t%;#KVU3T#V37>nHGYqF!@q%YhCPC=A!
z@c_3A=&pBH3dg&>=i*e2cZZip*_4R*sIxVf6dw93R+^c(>qE#9FzbvTsJAV=uv0?Y
z%EqVtBx4i8HuA3#Aa44Y>4QqML)h?+i4t&!XhHTxstvw*%>i8j4?|f~@MjFkTXds_
zfX6h1A(ZQU6G3!w90Z%a+%ew#@>ga-b-;+^%|!zC>K5UDyRRhZN;VuPZ0$kNW&-dz
zLJ%F`R*+BN{IPTfY1~}r#!lq@A|P8~vXNIj%)7K;tDhQC`tyLCc!0>$_v6P0h%&Z*
zk-VmeO|lzPFLl#ldji?Lo8Ng_5#YCeeUe)tH1TvANalM`F<U@}KL!hW<qY5{IAVlN
zab?W=x_!a1kpTvz`zawDbyxEi?{9hD1p1$*2`)*Q&H`dOWoW!7c0FR!l?4x#{Oz+>
zLH|J8-F}Z6VhI2`bj?#ah5{j5L^wf_$uqZWZ48D#oCU!$e!O|jl9MbzSV(*Pg1`UM
zo*FwJEaP)t6ZI5x05_2h`?3Mu{z7jLmVw2>6$1a(UGwb6AUH&oWT9)QE}6Fq?3MkB
z<PV*PHXtj4cDog!N#8#xAdH;5crh9EYO%4fs4$k<W1$Kz{{#g5-rLN}-20z^c0TEz
zJ1-r*$@P|MDT^o79z_`jd5ceg)LQ^nipofz#1a<*gCmdf>=Q`ZJ6danZo<t0{)0A;
z3>C*OpJ4UwMB|irbFwKEN3aagtLbU8<RdPkUXy0`_|a;)t&Imvn8N<lek=0#LGfg8
zcCDEH)jETc&N67DK$;v%hdC~d5gw|TzOI)FG(CXCN?_v+MJ*=YR9A;a)OG}(duAUi
zQ}FcZa7*iTIe;j0O2m~Sul$>0+!P3a`Mg^nq1#uZz!0vOb1n5$egxiTTGu18`bTtg
zY+uhwC4+k^_eA<(s&ZaN0ln1R($Xm_uC{iceaSpE-2Xe@yArX;^frZ3mBiL2f5o`O
zTHqf6J!=^x+w2H>{E-7E)7s>{?7W9HHv4>%mz1CBgB|D`O{*Jw*Jk6xg4N&a*m<CP
zi}H!JJfl@e?_<<bgV>jh$4u;Qci&!O@i^#8TN$c-xEfYknBKPNczy7Z&$-6Kk1MC&
zh*e58aWZt2fTr}2bknMP^Qd;FQieHqdS_hx^4rmLFi4Elk>BE+aRlQvtT&5?pjIUQ
zP9*R9sw4I2JZYgOS-0KIlk6@Z?osFRIN8%`r!v^a?`JIh-S()MrLe!*aLu2UM1`Us
zeSHPZ{~SvnErG8|en$QN>1|H)xFkwN4gw*`%gWBH=zgl9`*ocl++$DxY`x@-`Ev#y
z4r3L920Z7?&95r}&(+Z7m3bTlkk*e^C*!Y_+_*Gg8a97FtUsN<z9&&7=B~)#zGq%;
zg8k3o7~s9P453vCjQ*Lh<rpZ?_aHgFGtd&LA3vKaguG7D*}4KQ(3jYN$z^i_cf9$R
zNp!o2Ys;)(w!mRj2+kDAdj>aVj8=u?izHI7hZ~Ia!a?-sYZ38ZK*|&f->OnW_U}2^
z@0<rXDu-_7v`HKQDy0O}_a_0`Ua90L{O`@s<^JU*G?pAGHb4CLhH;j}4it%<!UqyH
zrr$-ORTJUwW`<t(7KF#R2b3$!8@0O!S!Xd+?QZyt{}kh3O!oJ;3&&8?`5;#C2-r@L
z#KPOiF1ujV3q*!7@o&oUHcc=w3{;!P%QKjUI8rl!3(b}7zawlgV}DlmS*XVas}llm
z{5`|a#|J;~`+rZjr^%SN*jRM#_N~_X6BcsdKTQ1lCz2Fb)&G6>@7Rx_AL&Iu2FzBn
zgZU6&@ap2O9?yyk(*~ge!uyP^@4q8WmG928YzklN%v{o*YuIhNALGV<4D!oV58FD!
z2*IL?B?SPs8Ud(F1dD*86+1!*c!xg0BrhM>QjG(%+dI|Kd=&W#W(?7;LecFmXkTLi
zv2bDTFkOO^0lxZ<Fj}N?*%KH#?Xkx#%0Wc9mz6}Y@#IVBglQtF{1CDSZ`TX<FlR8w
z$dtPOISAckj?@OCqfL-Wgl&-U5SR1cp;n?X6&8238OtWAtiu9p??Xp$JnUbFQ*_kd
z^(Krx!EP7!2d2h@zjK(C6?wZi1^tl6<Uw_S5wLKb2RPwBzv2r%qvI3<5-dXa-&fIn
z!N~Va3?#OXpQUD<239=q*h;5OBH$<3xkBa?&&0&JXSdu04GONI03VDnaC+Uf=0EMf
zchsc|LCE5+==T=D<Q=u@77P1!{!{`>9o1F%@8tQPCGZc)5Dww#N}a8hk=h_|^=7K$
z;(^E@<)FO`|FdBbZu;9Je7)}*AmP?$a3LQ!q*H^>!=LV?M-c?Ibk#)pXEVpquWR73
zccb;RY>U=&bULhF19Q-;U{`sEl<Y`$<b@v?KVZzRhucO;?(V;Sn5(|0i>fIAf(EKQ
za9ViQf4CG>&k|X<-?`5Yz28CnGwmY;KeX`}K+?%p0Q+tXGPahb;iB#GqIRZ)%;^YU
z`#;W@{{f_U*k+j#9)eUj`jwYCU=m}pgsAeQPgEGe>~7_HFaSr#Ht_#pA;7-&Me`55
z5ak+Ksz=8EG3}2W$`yvk9o!~N;DdD*B>A^cYeHt1`aF0RG&^h1_Z%cmIEY-S4)R57
zAnh|OeXuqf(RVKLUuYKcp51F1n=`L6Lgr5+cP$>vI->(S^Paj7Q-0&ST<GRvceo1x
zd9@f!{`2R`mZrl0d!p-;eu8@R{bW}jnrng%o!|X42g@lGDS3)$$A3rs?=(c<R*RSG
zhMN@nOjtrRE%54C+W)mB<yZU$>=2XH))+5D$J^OSBFgv7ao^F^YMn}k*2#0gETpit
zjns=*t~ifb!|ZoS)d+yMDYR|{R#St@=!$^xxd2DbHonmAKi)7+J?znG>huIa|E>SN
z1yy_KM|}AEo1p!j8Ze_+Xk%k9r%fXNPI6P+Hd!gCh7P5gh{LlA(J2J<tNrKKe|Dq4
z08XmiF#J0Mk1-z3T&UN)d2Yb$_-jz>{;=ptuN^|DM@8kZj7{Fp^j*Lm`TJXVpbTMQ
z1J!E;<|nN>j19>Yo1lq6xHYgL?_K>4!W>l&;(;LKW~e16!35<{5L`7c^WHo5cl$j!
z#@V7=(SFIy`XsIaYU>_gF(&z03sBFXOA9_qzu3M1IFQQvzrT5H&-CQQi_h^{N6@Kw
z!gOag+gFP+0F8j#dlTW)d$I6g7`H9!&$3v$$dGl^q^O^9y_=$|f3*ErBCxA6{Kwu*
zh%P<8OPdPR+BUaTtm)6ae)c)7)$VLYumM<BrO^Tl-9!#ueyxkS_Z4yxT7n?<uF-`0
zpUDM&g^1wcYYp?T-*x#9hL#P&N!PI7AfA1R;eeQzjbkvk&YsE)uuh96$$0CWA8lH{
zRDX-4QmawSur2l6m02)VSYG9NU2T}AQMjL;Ms8GSp^trV>;k_X@08&}?{D;DEp)$k
z;>YLzsO~wV<sqDJ`CF(@t&Lh$t+QM`5ghz@w71l)xU}>aCB^0%;UT!dt6B!Yj*w0k
zx??Zc|N6fL86*#ms7N*}vaoX1ft}R?s3|`}4%9#JsGowYRLBh-6ypbuls;yt8-ly8
zi&NvF!77Wn&3hYC-MUA8?n1EP4ay!Y7Je&DNj9&CWaoITwoVI|crlI3KT6Y&{sd{t
zZD_Q}5E>yqWwh=V%iCy6Ft-M$iChvp#MIuakKt((&abW(YksJ3q0}vc)Bs|aiVg1I
z<$nJM$^RtdHSIn`{t;pV$<4Kvu<kFwtghr*-ddjlh)@O*RKJ-6U6^KJ_t7s8pj&qV
zK3edw{?bIJw97l_oeX!H>Rdw3ojdo{QA<@-bp$lL7x6|tr3!$4bY9vu2S(sB&2LEL
zK<_~Fs(>P9Fi@ETX{CdimWgqSq9Y}lK=@PI=Wg9ahYY*;u`$AS1P#i1lL1|55@bKg
zA%be2Pee5XJi9!hl)qAREeey>GN%5($PQfOzL=V&WHKQEGu6w<yuXYKVqm=9bXkB<
zD_&fyqB*FwiV(viQPUe_0|H6-dtGm7fmbSgUN93OaZ??XBd>>3)t}cYZECW0M|3?}
z1}>r^y~^S9t`_Q_KylbB_CvAyCfc(6rWBZ4KIjrY5zRI6CZoH+HVM5+aYzDLoY>Mu
zXOjqd63Gjo{7n$ZSxfPOT7HMH`w@_Tz>lM3Ix#fvX||036Wf2)`tQ(^&&W~sKvV1>
zWGiPL{Rz$tMX()8Me2ry)%<i!v3?T`l9DT>uDvN?9xi#{z<6zRhU2V#Q(}MC%v8Vs
zp!JS>TH_DHJlHaw@{WSJo)qA?Z=?G<W~RWnMBcLWOeo0F769NuA8j9#=8hq1zh9q%
z`K3!A$A8^I*HUZa-@6i6A9jSXtVd(pG&{i*{k!8^Ld)-z`}ZS&Fk0FV-YZFR6jxa(
z7G1dqyGq^4bl_-fHCC#==-PKIlK0)(?^jMcg;X5&V~sJ_D0@!J-dC!c{g44a<3|kX
zsyV-6#dsDCq#o~n*izCqZA3lbow0aS%{AI<wy|JGV7Sv6=`$ftc3@FZ<Yvh>jC%9b
zs15{-cmawnNAc{ji}`4(IoA*bkrjs7NizTf+F#DM>dhn{hFO~ww)o1ndQY0_ekC{m
zpI%M=I&hm}LX<;RX2)Fe%g5&Ahb=%6l3Tqo-+bS#FWS)@dSZ``LOGhKxjwwBpl0p&
zO86E%bKU&m_BOib`|Sc%SFEfy?Cv)1Q-Zc_1AwcmQ&%~QVUAZ5AS%Wd>faASfn8AX
z^PoBLO_0-NNN9xH#`==EQ~J@|3%%nGD%bmiCi9wre5ZIyHVROQj}WRpFiCY~3!Iyj
z@`d<E(VySG6(2&lM2@{4{r##SOm4rMo{hx}>;Vzh-C{20`~dT>Hi~$J9DoFF-yPjc
zGvSQjUo1SDvw7!aw&fjFd^dEv7fkS1bG)@`H<$V%P~W#~68mR|UD6o=zkb4v`&SDv
zc^}^sC;=O^zvCJ2pdw2aiV^d>vJtu4gyjDPg0!F?A4ZLl2<zcNmVSD-@hDaPd6V*H
zboCaSc&aw2kT?)!zdt>u&{q8-aJ!<psub$la(@U5J|MXb9<lt*o10y*>GW+ph|-wf
zfLksuGkj~+P-YJ^->_=!YRi2z$0>TBiB7@`Kz3cm&#LzO<RtIPpbh8TH(48e8Y8~u
zP7AUrbGL3yP#w4eX;Thz4?cvgPc5UPxi|=4!Kts5^>~n0b)QG=W)Fyo7TAy`FaAu>
zYce=~HFMFr=`xbrqPfL>gtQ#()_kzK%A=hN@eB*e(D*D(CZWr7=@q=^*t9g!f(sda
zwjpyLtHp!=6oqcYIKG3Mdq$sko0f)ln;t5^kFSP%BTuoLh>`5ZLaxrHKQub;3{@U@
zPJ;uJW);4<C=CUV5ykVX9-D&Z=0YcpZ8449W$9i{xz=CdYnONQ;F;9fxzQBcEmuPC
zHd+lTt#@~J7Th0M=UzFrH1WX9W;JAtrv8b(KS}e=@?=4+&3O0QEhyGhUjeDkExo25
z4}sxAbYMYj>O!vCP!m8x2Lm}i0F~H!x{BWF!Pa?WqmABS61enG!SdKp#bo|^A}=$%
zdMttZ92D`5x2c+Jqu!loRnwuZA@=|e`6wNCj1|lOrBFTJ(-x*HXSC<@$_9R%WWS{s
z!CLZnjXQ)%vpQm3x?Xp{jp4<oa9z?Qn4}d!NNB0w)<6bG4sBpfKN{1y`XNfdCUr4*
zy?S{-#E0IZDj^o)5x!hGnC=g^@#@~y;Pvbz?cc#8398~Lh6i%Ggincj;a&sIAlbLP
z1QTv69X8H)nY6$jctZnPU^U5jEY<dR_0CCz%<6?>J^)a6%*wmvsHwyHKnA=OZFHRi
zJ>^M>0hj|g_r7s-0zaza{r#Wqg}cx~=5I}yDzQ0!DjP`-%qTMjN23n3Ijz+DLCoi?
zUVD4?smx!2HX?j;I*iq}LvN$vfUyWjM%e4*4&;YKz|bubreXreBkwP=xmI!%syzX0
zDB45OjjGT5L%VEl+Ptx>qmE>x707=h;Bju8DD{>I-<WgS1OH>@1>I^Y9p=C0J%yhf
z(rKPIfLM7L>kW_52VBhXHvVbIlkX4y_WV59wx+;ENelL=+Gg-Ohpl|ka&WDyt)y!T
z|78{}n1hkYx7)-5eq7JBZUAfrBCKbYU><omma3swX<H!uC`)e3vncsJAz%|Q9B%#Z
z=uc?6S+Gl*71(V4g6X_G<2nq1uU<X?k1b1M+}+$l%PK0?JYY0{RyrsS9*K4qlR5Ys
zixE890p6vas4+A^MDz#vJe<Skhy>#ue_gb^9^FJ^s(27N_t0^)da=tgoUGwLoh3i~
zFJv)>kR8oKV-2eqTkAZ&m)Zc@bs8HTo!XATbv=0G1!M%MSiZAQRDTvSRCnvtZa$Bm
z!uO$2dP%hKPv1SkO+E%^??`di>yoYFSDNSx_*gkr+9w2@m%YTWp<8TQJiRf!W0_u!
zLbcy5;O0{fJ*Gq;-BEgfX)b=d5PlZ7{h?zNTH-ZTzNF2B&IISuXf#u%C*7~j=^fx#
zv3|4Evk4aZ;m!5sK?&mgr21ru7F>ru!`g4UjvBAjynfXddSI83PT>5%6019l8qmSm
zPfSR!M^Chs^QXjsYX0&pJ0DbNU1z~JF_RESFYYv{yhC!8#I=5TaL8$E(w6ZkMd9aZ
z>2x1=nLWZMaBl#cYqbY+f&ln<h>7Nd%gpgq@+Husy?zy>{im>gNeJ{}{^VX`3O*A(
z?aCZDRRd;+_+TGiY1<5c$tE5!#DiRR;y6A8-rTF(`ONj%K}14JgqvaBr(Lbuu<bCC
z$Xc?F)99vH29ood2UF-ZaQ-Cz3z#~(z)n=41)fE11Wr|u?c2i@104Kb0j+}qv(cZx
z=??>Z9R5VTmtN(kqg30%?+zEJ0ehG^8~1c>=Cl;hO6B#uP1Hw|n{$%Osb@Uk^;bhz
zbH;%~`tQF5t8hp2`OW3Q@FCdJu2cQo8Q_J>Xa4GPUeFqJlo+N0!zOTRJTzZhKkx|F
za5c=mpz)`{NuuiW4wxV;kRQrHktML^K}M-KQ0w$T%E?E8#)GidU-4r>h-VYJ_+2Uf
zxE-NLYPjN#w{g8!(0ZW)$8wa~+o%bQlBMwUAzGlzmuPaWa_dcFdez>=vVMA1_V4n_
zdFsT2rP`aluGh7k;@)aZ2A=x2T>86rsket?M%j8v|KpmnGGDFrGqgk~=>9=l<ywY-
zAEUl8WXt=aFdNMUswPAeNpBQ2>#06~5cvGmg`#az@mCH|FcLjM1Mv;_?b5qMk-`rj
z^rz)u&hVY@+V1h@Uq|Emspp#El1i43XnD_T3oaegdXZ6fpv^K+%OQ`Z_`xyG`*F87
zttzBHXxb{=@<Lnh2ltPQh1LaAZgb^>1KmrdHR8m)wSnoqnY5Ns3VjhACDFR`|Fd5P
zrY9_CB>-nVfD~nSj%B9!%?7IGN<Wi*tn_WTG`>$MLP4rjCB&nsy5Pao`TRai>(r&e
z$A_Aff=yjV=PZT&yrG1f>jgWSzgQF4QtR=smX^*{pY(bN=y9J~Yu<MeiCwO76~FI|
zc3gVocdmZ$$V(J71Ek|R2$a`BYyIx^Ygd3+d!NAR^z?nLSd$Q7;6Ei0P}Wi)Q_dB6
z{`&RLe61e64G55wRZ!Rjc1G{V@K+ihS2z&(8UAqw**qw+uC?#1^&>T}Yne|JLDD=R
zZJZtSs#ENnF$5VnG<i*@YKI18wtU<h2{|4Hpv`URR$n#&83*WufL1F0v#Z;~Kr2KC
z)VQSzBhY(3g^GO9^u8@i%e1j4?H~+Vs|Vu3=|)RijX_wqpCPYV__xm0-UBtz)}FAP
z^lMx_UIX!Z6RN<V^+My3?s{EmTJL;zwpjs~ySo}J!MywtFo2XDCZ_yEn-tN18Il2g
zEq^gA;fzV{zpR6MH&Hp9o$a9!m}`xGCD}0!fW-uJKy+=5Oyr88Yzf|F^Bx3ds?gUh
zCLidNl0XrV4U*wZQtN@N85Um9NxVhHVDehJ7oo3?{$u=d?Vm=AZNr-)PT(nvgXU<)
zo*hxG_wd}WAS@Pj*(iNH>FTv@VnQw?x7gozLjV9lUcQ7KQTk#DNqJQI!C{Tu0yMxw
zwwt=($8~i2+VdKO2pZ>CAZx}D!a%P4+M>c|g0;!(vU=hLu<|&v2XRVUZk|_ywtHS6
zeXJLbCcNxXFwgb|$9+9o6%#K|9)Q401O^Z%a+v-e=W}dh%~Mp`Qr-8G;x^(&j4l>D
zlOI-=&$q;9zY6i0+d4S<Lzau_E~u^Tfr)Y%7+VkKh_aSxdTXvo<r?D@NTVPNT<uh8
z#nu~_!y|OBZG7nu0;wqvTpHKOzP?w_nc;j2d4K&2zQp5C@+(%jBxT@kq@pdHFfEYO
zq@ZKnw7Z=rB82d5`Cya#XWBtE_peX%203EtX8;NQ$wJ(m7eESKd*Ae*c>1-{=*2E{
zVje(_L)r_7lSB}02%3w7@n{0qI%sU(Jb;MBM?y!`M|Siv%!LUau*`C10HxF)0vN>*
z|FttF5Aa=JE$gF%ye_Hn2R};s<|LlE5b*>Uuc34bsHeYkfC&K;LCe@9{D+5NBR6!v
zmWt$GW#Z*NQ!5Q+86dB{PnH1v0n!7lq%>$M9VeOsp(I{03zH+_YPo;%Fsgn!dp1D;
zv=fjq_x_^XCCD`z{PBhEc0H(K$MU6ly07aiI!BHOKM&u%daATbUcEj^6s*t?GYDqC
zU^E5I?ZN?_f`KzZHFxttgSCxMD;;77Z?>kXzq+jqFBTQ|zyg%mA(;paMM1Eordc4T
z%JVH3_RjBTl3}DRgERDSdPj;vi>+Es+;YWn!fs&QKyomw@$bk%_|rQ|>VB}S9ybUi
zza3mT1Pa_AT?VOhLK^o;CcxA&M1Q7m&g9FL=3k#=QYP;yrU)VDU_mNl0UGlk%sXr5
zBowH1g567kPZHv0%b;l%JG6mjqBOsG1VYXl;EQ>q$vj(^jRN-)2Z2K7<krWEP3p3+
z1xH$u>(J@81F{AWaw@wWq7xqimMDqlp8@$K8wBPCE(sUqe4WAfycXRO{-fXEzB(pA
zat1PyJ-lDCAkfV(8*QqKCuRQ4S7~W+l#F~;av6D6kw3ZG+k0<N8eP)-<I}4^Z(LA;
zzIejW45-;}1AKOXi1x{K$ipOHrn)7L;FvB#Sb+>>i!biu)_HUDSRh@Z_a<#n2=78-
z5N9^e+Q|w=9gT+->!HXoA!2!o-RmGxg|KzeB@~{nMPy4|3W+1fKwu~+Q`uxFzo;SB
zU;$nDUq}qzBdmp8$R^48yb8Ihq^Rhy4IYn|p=j!{ds(8=AcleUDGVR{SRC}-B?eHr
z0GJCnjB&;~vlCT;z|#UOz7Ube$8NAAu#Gd<nKJ#HsF*&5x*?RhWuC${Ip=91D4Te_
z{bYTcm*``%sbrP}Qb=+Z=i97-Sh$@iKjK1h*PEJ}EeX9X*avH~OT@v<ZhEmT9MEG_
zU*DM;XbuEaonh6N8tL936Z6JyZ5kceWe&uT48m9h6P39xtbWl+pQJ~v(tKdl-_g^f
zrlb~rMA(-!jzLCJSGAGMUH1$rcyjg2ESRVoi5HlLQV<7lUW{|=Go#>Tx7R&}&hGPb
zGCt~jXYIxW0ETvl2&(HmUz)tq?jvA@FwQdc0Eh7kg&>GVFzW!8_+GwVP>(DlD<|OL
zKE!LXEj9pmgQt!O!NF)=2i1eI3Y}@_nq-4o-l7qvqTjdQ3{8h=r-s}C<_Bo|d=M;X
z28z3CLC*lrmo!AJpTYI>Y4Trl{a`2sc0+0^2iBDBD`+^2V1xz{u*O+<3g{cn0<vx4
z6+J@PN1%f`g*z?TP!Pqt`2f!Y!(AC+04k=_<-EVl^huDHsZXeZNvWj&kW~YVC89Al
zkz|M%Hgnmu!rXh8{o;k}UMmmW0+zrn&c0Dep^P>HM}knBugHAY7M7R*=4FRPE;0*!
zbN`mlpUdM(MycfoLA`RLHeW>|2YgM^PT+EH<UJN^DmP}IgDmnU>Pt9OMIqNXzS}|v
zX0SVbG7de65=2zDk|FuqP=$V`Z;P?is%es#^=G6u_hm4_|81}60ZDejMBS@~ets2%
z`$wO!u;00JyD5k{>-G@S?^gj?hiwY7e#Oc>xfxhTWPko7EnD=oUl756_rq;BZ?Yd?
zy6NiY|E%(NAfsox#o^84Z8qn=u7zo@Iy|dP%*}Y2F_ruKMea{y-~b*`GqBtZZYzj5
zh~%=Mw?Bxsqde%L68h`}!b5yx{?rU8-|b2)wDPPJZ7*Fo(+yXDkNbEVUEIO^{cED%
zzCGZ&eN~IEUz$?&Iy-x07Ovp6Kf1fwFxLp&#a+V4Lq+R~5A-U3pvSp@aJl-TT>ntu
zKom7irBT#MF@+_5%N3|$aida1U(T{C@=8baWk>z|{JsFLTzqxqW9f^xZ!ctce&9Hb
ztJR=Z9kp1kB9Sf&*~@`XXhmM$Sp}<iU#V&8So6HgDZK5FR3c8WITZO$Uv}}tpYhwG
zGcyj9Z|$+TtWVT+6}mOT?ITKCay_OYfW#l}5M=50E!Z{-VG$=Ff(Hb%M!B84q4VjS
zjF*7$6+eg|BhNUDRRixf3pPO?!Dv%sS%FBql`yo$RD#suPy>ALk9YQN8ogKsex)?=
zAmY#R>DaMj1HdwT_`z@aLc_d>{gSUJ?GUoWw9l%$I+oN5{2kKs7*ZI2o=n&Dy6ANc
zEJGhA3+A^YYUh}M@HYkbF@>BlT0M`v1N3KPV}{jJ5pm92W|^(Ue;Gv7;>iA^?RzQ(
zRM9Uk^qKMeaAU)&3Yi*{lN>IY<%IlfrSAOf@CJst=$@U9F}s&E5uEdrNZRs|?-1SZ
zf^RSIN@HF^plhmnGCn^k-z<uEy&^xDlW1U1JppUi9!lm+mS{6+t+sVBzD?mey!{zf
zY<QP%zle9aRYWp=_jxR~61TAD2G`RoW#@%J>mHKq4$TAkLzDps@6>N4yamGX^!_XY
zQpTdJPtt(U3@tg@Rmp}jIPgJktVs+euL2i{Big!;jVTg$<UnMP4CQrkNeKlg`|qi;
zz`ffIqor{Fa}^Wv^84?a#1VP+dQXdQ%b9Qn-jHl?)F)l~8(##bp;gWw87=rP8st@3
zdulaqVTUBn3r=J<yA`2bNMYD!(4FM!vgG-5ge@%JPNpGXzi`4URpk@vLLge0c515p
zK50M$pmF`;@7eme-H0>h&bk~ji>AOy+n<R$OpxUZy$*vyW7(fS1^Z{wTx9}@m1!Fg
z$@eD2>cLrHH|9cyup9|^(`-gBuuQY@LRjHa_x>O(mVwl<SWGHnD)zD87P(n&#nPDg
zW(uNpB{BZa&g0=Q->$e6c0JR9R$<BL&DEDZ6pfpv{$}}B<&;;iCS3=Y3!Zy_7yqmj
zxes%@Ypou)aL0&pGfX?PJDYNrf{(?&@PSrX3iCV2&b5&p&HbRPS!tzM5cj(<y5!@v
zqAFa`p>9}SQH?7#JcG+;gM%v%Hxfx_;P01Pxi>hbl3pT962ijArvYQVvK^fLwe)aK
z%;S(>waQL3*W(ra*4g=%A4$fmGQE2Wp&T7xC&tE`HzaTM?k-cEAodVfy~j!oW7P1W
zk_<(k5QZg6;TrHpk#+%YFD@QedP#?yu=~NRRRpwCobiXvz|6OEgjJRzeiy&>uCh`i
zH+k(X@2^lqaUoRa3<ZBbR>moQRV{kwL(YhO?;!smUD%P4g}-qxd7c@OZd|vt&jDH0
ziL<!AjtQT*<oTX`?5&C^&A|IUbI^OSkp0VCs7{^ViT6336Z><LC6pV}rq{RjB469v
zy`W|_1x2JdQR$-r-dbWOa}O($KgrE|kK^{$$x^pIZU~Qg)i~NcDv8)VJ;%-ziQF}!
zJc9c*E0&W`6AHbTo%$pXmKDm(x>JMD+uqlvI2y~l`{cHLSzwo|4WxI|YXMQ^`yx|?
zw&`8DkQr;0-~rap@|c%CzP<`1A52bi=LhADEB^k=zUL)Ml<9pM8XC1l;4MRtY&e#;
zcpBb*mrR=q@SX?YapLhW{teD36Ri6eMqKH8aa+To8bC9SfA{V8hL>Cl_DrwZYneUw
z5C>K0WwGPhgUf?>tO<;D6oe)fnj3v?Om+NtZSDvHO|oD(aGM|CW7cZI%V~k>xP>!6
z^PMT1Duc^yuVuY=^M!7!Q_$lrOvW3_?nIR7SZW%p=T$Sa?)^rxW-irCb?Z#>{Q4nx
zNf~k}&ACmZkQY(pprX!%V0iBR(9TedOm&YB3@y5{A%dzsZNanriek#Tet0-TQ+Biu
zZKY^wX+d^(n!0z`_nw}2Uwr%h;c|0GvrPj65#F86pmB8j=CbO|zQDg&cs%~&03z-0
z=ch=DKV$LE)9&^9Az*Kb5O1NLL{c40qD^F*7Z(TGJ3GBSeB9))nXE%JP;F>8`u6WG
z?m7i7GwWGfHHJp3vj9jZvU<AwEZ84G{-jKQ2OSH~erO1W<WE-AE^5yF#=j`O!Y)Zx
zx4FeiG*hN)Au^e5*is#l64skj+um~v+Ft=f`2POt_w*`LP-UM#c)$Fam7>zo#y^Gr
z#|IwQfHOAZx~r=u)wh2T4u-ht>FMU1<!SfZX!Y&C3$MuYHyg85-gGOvvSnQ?Xuks*
zCUq~JPd-+5<!xBk0$QT9Xw&sJ2NembgG#On{Z``0-NOgBBkAesCDX$f6;r~`zqqLA
z>fsTdOAB-YE2;CyzN`RSg;XIsK^yVW6gUI5xaxOcB_KXc+nl`}z{{i2W<!rL<y)Vq
zZpbG=@4duQSQlz&;=Bn$0F8Ngs;b8Tg!+7@R>{KV+DEVAfxrV_6*@1%gIu%EG7!J>
z^Geg=!h&n!lJ}OC?4l#(+xgL(<?uekVZ*E|<aDd*=(!PpI3glKm3C8I`hk%YWP~il
zA0C?#^m8<DSec%MjGX<qnm;HfQ{^GfVqtOdQudQG*+LwTDak@@^a@A^x0GGH0yju|
z>g&|iYM2_2p(7Wdj9xh{nMg8gszUbDNtf;4Q%?!oU-tL))e_2+Q^5|ZcI}(^^Cubi
zt&Y00{fjK$z1`7v3~1eM?O`iWX>{F}#R3#3)z;<B7MS)YkYjR`R?-raQ^H}<ZSS`s
zx5-URya4Bxm+D|VwjpZ3J$MiQ3m$o3G`OrYzP@!T`|1U@!*nr3=0@(-vB#uws5);z
z?^eW~L@q$0mk(6tSF$79^^_?!*6m?~gFCsnLgXK})U?1DI=$_EOL}gE`~19C{l^bp
z>}NsxsljClkbZIuE}tNT@z%XZiP+$O9txKr1^8Q`a6+v=FrvgkRGtv>`|^$V)GUiU
z_oYyVhv0yviJjm8Fug=YMbo&i`UysV-^V_kaQl8aw99(nzH%J#h`oI2F>=6V%_!PV
zZBO*DguT|T^L%v+sH!ex^NL7bEz^<9au1q#v=+XeJgV0#-stJ6%G++GMYS_}(Fw97
z1Y34$IZ@cfmGArtXuC{d=5D3KOVlSBD~nz{!=fvg*i+O%l|*DH2Y^nwe9QINdMXqm
z4sUypLL?p9iKzayu;_adGT!B^sZ>X}cPsx{d~-tL%;RGToKd$YK=SKE5X%dgnLgtN
z4iaz_6*j_=v|3h2y-g}bo&ZOn;Z?6Baci7@uGncg7t-2z+j)?X_kwSag{>yU_J4TW
z`-e?LSh!2bo*#Fpoo)BMx<vO{UVTHZ0(~-M+Hm1~O<r7n)fxK<+!L>^P{I$`7I&Bc
zF0RTfcp$6Wer0q;41s`7t!3A*7N*}VVvqrdx8iG8r6dcSmgU)ASUjedl@2RvaZ@yJ
zv0J%{XFU-JJ~x5E<b77drLUb!muKhB2>^hW78j!gw?Mez*Lg5Y%qL3tgye6wJC`Sp
zAy4$5D!*)&{a<vwc{J30{|EdXJ1K)=>}!@5jIkvVCS0;aMakMoqR5tHn@SoPTtW;*
zk&uv>>`SSUOi5XyEG0{cDTA?l-gDi*=bY!C=RW7Yuj|}LnfZP{%lrL$zZPL#3?WyC
z=4yrSmm)L=ke5BtT<RmNSYD8ge@amEoPe$YFq~ZuGNq(qb?v*Z$ZkdRJ$J&nanN*}
zQ{`05CVL_z6%2;hNiQ8+?_G{^7fm(CKcQ~RaJ029ITeRyS*~_}A^D0Rw-&pzKNrLI
z4x%g=(APeLBHtEn^X^+<I0dbp1wJk7BqwpY9u+_Il2@kv1+XVh<u}J+efA*$b$!6#
zUbW#Q9yPl)GoVrl*U{BI@SZNtVUSG`LLGVW^uc~Jw-MuQMDWU&WGwdvZCa}b!YlYi
z4vjgkm^uZDF>Ug*Ci#~;%#2Qi$dykAXw&|D`0(#x{Hn0S=l*`@z1syIFjl>c^Yjr}
zl$ORXUQVLl$}W_rZD1hdpmE+L1oBWKwg@LZ-|G2f!%mwyn4NJJ_ciL)!qdETM*)Rq
z(Vw#oU`@ua(Dz_=pyCr@Ew#GuEV}zHoMMowa8B`7tSa$a7IKqg^!heKwT-e}97~s~
zE7t4~W}DX6q5V5JN1-~3Pj>|AV^bT3Dd@Mtg2Lus#6~4;86`}0-j%_0?LUBn4OnqR
zEl$t6mc1~mD+9hkjWl9WeND3En|A!xmZkA-EbY8{hBYB~+GX1Dak}5>i7iRk*xeb{
z4ALiH7e7az{*iT$v~(i}>X4A?z)MYI1}WI84=($W+Pb=v7UzaO-&fx*0CqCd$Xz|K
zN$`N(SdcI^gA~IqKdh2whl%&tli6t^bLfYR(_nZl_PlGz4~`b3^%^X}OFkP(=<hE9
zXX%GTxtiVyrTnuf16bMof^vDv07haYZhJi(^ESdBIm)_Pxec;JQd9rZeS=?Xg^09@
z4h;=C_l+bL?BP6dmYkYe1fay&>C3V63Up};hir+~7qGl6)3z!Q)$wsxuU>UKWKw>C
z^C@#glSe*kMDC5ZwkjweMSr>0rzqz`#;OI!9c&d8NjKMPA?ivHQbcwj$&t_}S}xW?
zU!<q2qx0s$g9k}wq<3a~9IXj>GY&K@i>4*G+Z28Nw&N@}LgjggjgP<ieOnv?8j(6g
z49;~Z1XFvRx|r^w)G%cN5Vvu2dx*-Hw*BVyd}YwItu^dt=#~8RIZ+U`>ZWykb<@bK
znEm~Gdsz8L1zgw5OPNt|UIwp&q=VhU-(adVT=r#>jMVbiRyn60r#^7(cV2k$YVn6v
z)8+54Jui#+7qNCE^JoZ{VQCoTW~OyvQo#<Vn)V2;elV7SlP|^~t>dm{;hH;|t27B~
zYP)t70yUc{c15grlgt#(i%}yU0-ox~!%yeHmXWnDxk@$i!8kCb4uh`)xV(iRa$Xar
z{bBqFNctcD3|#?rbc{CNwWFQmbG_CjV7K=%)G*rKIL||zx97|Cdgymw&uP-iT~F<~
zBcAbw8l+S3Pk+T@k<^3=$T)`d9LQb3{$00G`2>NP8&p^j_r7ZK^72A;g`AM~04ar0
ze^?F~s}b+Kd*8}ts9?(<DfMy4*j2_=EJnvxVSNq=-`gT6^)YqNJ%_r#TV?_g8wqLY
zH9ee(p_bM~RU{WC@S?OV)%-b2?@n*+ytm%k3>wBl7dH(r&AP;SS7FR{UL~+Y`1R4n
zLoF_=`}1c^!w1@`u_^v=0tuA2;>c08?Jr?~2O`vp1lKClwyW=5P$W1ipHrzaAf%~8
z^m_Xk2Jic@^;&n1iVDBJ`tv*P2DZ^!;`HU?v3rTSh#jYVWMpK`p_NEL4@7r_-9&%?
z0CPEMa6E8^Jb@f*e35*%ASUSzDO-YSvQcBc;wyB)D0drQ+rO);tBHsf@Ijg=%QwyV
zB&DUF;FsML@NM8Id+BqUF=!b+UmxXBAFt&XRk=(27NZY_gKb)k<ux_oQaF}Y$XUaC
zxtG6OsJW2%@$PwYM0HWoSy7y7ekG%idgez2$*GdX+X~V$Iz0`Q{=M3|<h{4{fF1r6
z*2u}$Ee1!!c@w{l73A{`PyPHk0Gtr9c&{aU#cba5Lf%eoaP&s17bYh!_Thw^;4WLZ
ze|_7PY>N06h1&pFF*rT*eSe%&A4j=BQl++yn+K{*bl;cEgq!11y`Rhe!3lrK(=T6m
zUaYQ^d$1m&J;>NV5(7#!+vC>JxU>#Bsj6puGW+kf_wVfnK7O2&@o@*F@dn*BN#!(}
z>&0uZxlu`rb+m30(Isf+yqkrLW_^_M!*nIl8`LwF7b@Js#J@lcOe;M{sp9S}tOe5Q
zbyMcKvtsI!EhgSMqjS9UXvwkD7cc&)qOVm$3JrH_w{gU@N<bw*Gp0|1pptdhA!C&b
z&y$=EOjBCv@2KKgb^8XlBm$Mp!>Qz0K&Im`<(*H(G3)5VeBEvIGFsLPN%3=#=(@6!
z>ow5{S1+iV1AVFnjFAeVwm;hH<GeTu{S>+k5$XN{rC}GdakpFl`t`mQJH-{=csJWF
z$S9t%E@_6m?7H)Mk(uei(zsZZ!>ieMIr^J2tu&BSM}z$iR2$Rw&=0@Cm^fPxJWdD6
z{feVr&U)IIfw+hRxW+v7G+jU3JZ6xrLsLeb_n8oN>z_Gl9X-r!1bLEXpUdVe*1D>n
zB6kkt@{vwg)?TBus1~jzOh$x5w{xgJjM48B4*p9OcRltLem$&CRnB?00TSD?z7?#b
zvC8>}F+RgD_@1c#%DDq~9BkGwxRfhV@!yWy2-g|MTJr@#7YpW?9>=VQ?D3IaOME-Q
zv}p$}5D;AGgI4dQKcmxcQ|?_c*U<}2m;$wD5MD2*sg6q36<uh1Xt+${S8(xpf0tsT
zETWHKfY7l~>iEmjWqKSxKPk`W1YR?4a9SA4wC1_>-(%+~XR1l+D;aKVX^SL?-}G9N
zg0ShSh~cn-^NWFIB&Y>9IUo)ThYu|tGbn`*V6B()Zi|AuQrwcOvi-|2H<;waRFYl%
zzZoRA(G%3(X}1R@LzdDD3@(ilt5RrWslHGE??W!W;8^S-_;!;Kc|9)v?Lpq}cFo2u
zMU*_?ZjG}F+@bIaylYAUoodf;<Q9zNkJ^I3{nd1J|4Dy0)Ws6VU%R@PvtZ3sBt_WJ
z&+BsT91pI*PJ9HA2A)a-ILuY>Da>wd`_tz~y>j#zZ7*bH=DzdU{1K6R%PHOCWJ9LO
z+@q{w>hQOdq@-v9J-9zCrOT(PAN-jN++W(Q+v4|jyDv4o)M|tlZFh!a4Ybs7V#^ct
z4U<2mbh8esCipu3KKT^7@XKp4c)p;xF@v%18Ph=9G%lsaH1u83R0QSTut*oP99&K4
z^is+`&e02S59Z{52Xh{pWW^2q4_glW?hW7ue|}4sOLLU9!b7fJ82I6krSxZg2sT#u
zNdyh@G+jta1q0)7kQ+aS<?JTNJ6y#GWM2j%uQm+WmjNdau_H}2u-he8xb*;Xq$ZCQ
zi4WyRmYU@lghnz+gZyzZaNyZEo<P4z#%?1fAcl#rzjrh<gz&;I!!N3<=67){X$j8=
zjoySzGgUYtm&eRVM=242JvpMe^2E%f58+#QKNM3p&Qo2YZ!%UnG440k2~am$;`Id-
z46~Lm5p15jYOrY6DqQQHag4$h9z`L=Y$N8czyGni5!UM$ra>G*Wq}M&n|T+ybyd%s
z@{X0iQ{V^$on-D@bZiJFzJlY=P9Hn4c=ehHR}o2I3eO0qoFTnc0Jx#_*e+Gk?(4_|
za>77IXZ{z|@#hm}HQ@~_Bb_(UIh5sfjQh!r;}4mZ)V@i})rbD$gAX(lrh*k$X4TgD
zJR1^Y>Rg)#FrQGPl8A(2eThril~k#{^$iVjeJ*n9aZBase1XxUF4Lm$$G0dvPjXaQ
zSzXl>xHc+^IPod$a+%KY6U1{u5i=r1c+W`$Ou>ZPQ<fM>B9XBSXunEnSv8<-e@zE;
z?dL5m!7i@}W1nHy5qG2!jvCxG`6Wd7cvf92eV1{2J#aYz0Mk=kF%~XFJxR_#zKMc7
z)H6`qiJ3h~+5&mj5@id^F4M=6QG@sT0Axl0ZfV9h3>Ou*%k)vi2J(49vAG{)fz9vP
zVIR;$oF}jRN+^COj_%eCiw;&0UKd27Mm9knNu_03lBUA&^Q!9Ot|P3x;tT$^!+8<}
zh?a{{B7!T$^v(GA;iJ1Unv>ofT!`L$VqG{FfJi0yiV;I#KiS>Nr-K4JkK6R3265bF
zT0!BJEfRyS>u=X!u^@jO?ggph8OG<&;$~4ezH7`lbjnT<ep@`?A}s$ix-{3r_${Y3
zx4}CUZ2RMeIEi+nkoPju(otbi!;!AxYk~mz^8VrO534z}+~&JBEEoSxot6b(v$yrn
z<4f?;JgoP@;7c{%Ovfu!2$wf7GGfxnS~uw<zixr1Nz1^XcJIpYJNjgAl0U#qH9V#l
zAN8$t(i;OnmXxLy#q}j8YGg#3s?Q}4Z<_%NiJ_8z7Oty&W37BB;{k0+eEn?qhMQ(G
z!PaoL#E39H0vG1wr-{nB#-4e7Cv=(k_3mGnAE=~_J=-){UyJ$`sleROmpIc!Eh7|;
zoM|!cItb|!7m9Erd6vuYm$CoOJDbY+neQvf_g2LFR{Xb*i*FIzgKkjsFPhgqXIb7G
zCA)WMn|A+@+|27M&U2)}wT6hlkLrW{roX1?6~O4iB4Cd2yr}tWwqCcaBu~LYf7aY@
zi`abk&B*+MLF1uAl>Jc^pEkFxl<W?nU%_57>8l}BSMGQ5IC3Goo91^Rf*RIe6QpyX
z$Gw!1I5ZXEeZHpy``Auv<+4<%?f!J^t*`rg9liuM_)p5dp&pfK_}A;n8Z~(4mwrj}
zJ3=yJ#dzQ~<DCZMB>U0)-xK=(`A6f@@4mu_@N;`Kw^)QIYy{r42wGmRNm_^vU)L19
zRI~17U*quK6K4N;P0TT-{g2>%lOxq<KS+vprPMO^XnJs+mt&7|ptNn<=%$|7v$>70
z`!9GPuzbrJ*!#1*E+ArA9>El*x6^+DZoQMZ!c5!zB9A;tHzbn=Z@vCb1<CG(ZEb&M
zXjvv<;o*U;Etj8k<(b5;efaQUKN*|Y(9p1oUii}Tcq0?VMTELRDh>^&lE+hmoG@Zn
z^obV&t?ZOV`u6}^61}M3$^NXmpNrGj0C*g7zo4K13%9mL&b!6Sxiy2##_@sk&z;r7
zZ1r;PCC+FTfKEOR-OdTB!WXjz2ajrGhNL?N!2fEkC@Y{^AzOw94!wauqTElsmv6qM
zFugQA*izlRC&OcUSG{@M^p%<sSB**h@}-sN833wu!}>->(k{&$b5F87ctG*ane;h}
zP|42ig{EK2p{D-{{FE;Z#`R&*6l-;Ugq9^O9F5Je{s$@Ub^BUgIcOA5-hb%Q$c<gU
zzSMtOKf!1S{wY(Idw|5zoR$m7@u7!l`WS+SvvmiwaL&-Mc>t!7)G2X@>(*+hVDy6k
z^6y`t4Y1*}UpX@zk0K=ash<w(feG{7TC~q2$MeXq%jcy`_AiWcU_Kpha&K3Pm|oDn
zQ@T2v-<mS_L>OXh?G*Bleh&>AOioVbVFx^c4~K`)wrzIh|KPNFE;%rmF;3XE{r@!l
z4EYb<;d=VNNkbfR(bCeAfaXd;P6&;PBa&HlS4r-B3ymPMjQ~&^rE}aHkYQ2${J`nT
zrRf8EV};5^5j(*C!Q3WSj~4ap*sk@dx@s?>PqWE`y)U}o%A9;5SMc7=P4#!}oLYXh
zt1}}vy(W#GJLzVMPmCIAsfCR;!Hi%^pZO}&MSa&ry*qhoIK=DN0RSkApv|`~siG`L
zDH;O!Vb1qgURVb9Lnirlc=*a?JAxcy)U}&)DY)d=%2C66#sJarW-T|u&DMq;#5u_{
zxQxd%6E4`VjxWENk9zy1m$~nn<1ZO{l&-K0fQF)oH1bX3t<=oPq>-lFuBt%xk&&rY
z@b1qk0Dm_VVa}U<=Z=^yp0(V(IW`z+U6Lo#U1wdwfSg6kbVm(b;?%GalFV3TDPD;P
z@b^EAx_k%*1T)BG(DZiz9ReraK42o)rpn91Q_jx%`GgribBvAcD<CK&G&IykR#Ngx
z7}cd|C&lIxyfg2Kt+cF8C1*EOD@<z7Iw_`JhR$l>!k6c6cdV4RiJR%%u`WC`aQ+em
zdA9`DMLFx`M3-V8wZJpiy}fx^(eNsz2JZ6q+}zw*b|nlZQ<BK<h~ZN=&`dHGB|J2`
z8l!$E5*#zfc4xe`B>8INDoUM7TRedDR8>ITz4G3=qySRs$`(Xnp7Cf(wzvA*0VEr>
zCl+STF-#CxY~?rz&-ohZQD}JhCJ-c9*6Jx*v^}io&9}uesyHT={u|nZ1tfsy{v@4J
zl{Z}v<|)!#o-?hjt>f$p3i-Fg+ebiQ+Z<q}GBPqr8P?;q@J$XwQwI)84RL5reCWdM
zorn8+rXp@n*E1CI&5<X7Quc!k<#&lyJU=a~A5{Ebsqjz;l!#KsYIyHd2woia<9>O;
zw(!I1FvE|G9%&J1quKoa6?wT@Q9TI@Jekl7N#z!yrRjz=Ocm8tLmcJF9tuUyQ2T?-
zNH?JpGsj%ok~?K!XUA7r3&XpPH?~VncpZt>kFX5fp<|8*-c7&VJcabeYobzxy6@u`
zDI}CnfhP&eZoM)-cY7KS1>J3XsTGw?D*qe3nVPL_VPpwqgF3Pexp>;}p1Wq;Woy1~
z0DVA(9}|b2;6(I}@5(r=bZ-lyl3}f@ucOoG%okLQo#+Nc#-H7ENfV?65S4p&atd)%
z+s$-PC%!`&7vxgdlj?;DnEv_mCp4BPtRoI$;@RJ@%<(aQ>oge)kbk3whUUk%zh<NW
zK(Ysb*(=HB<FQ1$ZG2?4Xs#zUGM#5ZuaN|W?SX9v1M6Iq7h0{=GfBf}F4I7J`>sL5
zfqi~s5@w{IVO^3S(f)$E&n}mC`E%e}z;=QH4KNwIL-BERxByJ1P?sV7hvO-@18tz%
zTJ{As!KHAEaui^MlolHm*tbCtJ`+oz??PH&Qb_u-Pm%8$KiF=JYYC2Q8@&oAz3lkD
z|4m$wX?JhvQ*CII!FBP#X-MfB4}OPul3~m%h_mOm5Jcaay%$IZIt&cZKXD@puV8Xs
z*<I5Gvjj2G?jmX*GhwO?gtgO0t>3*^-0?+5UQs;`jX-~`U`Cpjl9H-W$WP2#wt`8W
ze12)ckFR}wi$DdZX%iuGb`{{#jc*3;k0Zu%9ZMRDE7vC@^dZmG9De};tCN<U`QRm>
zfy?_*9{_A;=67+=!X8~Sl7}`k6$wUW0b#`<208EEmphf7LC%7sK4~geBmo}|d**(*
zTQ!7=b;Ey((^pc_-!*)U9r*sT+b~;*KF|?tdD5~!)oKs-A3dM<BHcBM5E2=SXTgWz
zg}FP8+1SFb0Qm;c`8Fx0b*yz=%=`lv=&ES9Ffv>VbMk_8LqquEs`*DLb@xab=l%TZ
z_Xh8eM}Hqe%27o21p;3mKzU8zw`^-orLR%71S<kBT#&ix%kVQdZ#%8H!h;C4p1s}S
z9j=nrVX>|U<b!n({%I=ZPa|}0A_$630m8|>g$n@`Al$!9j^hu_*Tyxs!#e<mzX?_h
z#=njlJbzSta_#XW(8q;`g@)?T43ic*>2jiGYeusB*@M2pu%VnJ>`1~23O_G~=pWm)
zV=TfQII5SC)&XP?vZC3pPu;lZ6-Q<TZvD6m?=2c=4QZqaj-}f4XNT3pwre%MHdQ~4
zHjCQrH>pl<bX5<tIrg5^5QOF$BTa$sA;Ix2dCXuJ9|wV4Vy$iu#jhP+1`&f>_LP#d
zKipNH;I0xA?q=l&F->5lFbj+azAfLH4}?Y<1fnM_@C=j|IEL--Vs2oj<yy^vX#yZp
z4Z2$bIum&Q@OYxo2V3a?3yE=nlr30sc|SbW?x4Frz}>tZTt3!i6<4$o?on?=mq+P_
z%cIwYw#A`MXivih;a1}(lCi4j?xgZ*y?z$hrHn${avsT;MrWd;j3A2?WBc9Izv&1#
za?Xk(vEWs%Shf&_w7?8kw$%p-(AgL^!-F@PIsGp8pH7(U)IhpP9o(YOHnUNOe@U|{
z`OpQm3=I$G+82FVJ^gvgm_l;WV(w4E%HZdZ`ZVvpVuz0Zwt55Y>|EMwg6_7@TJ}Vy
zrl+fNZ?a23kynyz+QFf#l$|&h+;tCt$r9)f8Qy@=@T-rXbeX;Y0d@?OJjvI4;RZ=Z
zcm^%FyS@u{>Anoo#~l5@0A}>2ZZo5ZH09!B9A)pVP4iXYLVdnTN(NNk(y6q!3*v0f
ztE5p-#KLqF&JR#u+&{7BJz>HGVkptw&#iJdpyv@&%=e=jwzJk5YK6m)kP``y4K8As
z`=&#WZO0d63j3xSim@ir)IIuI@6-mINpdRr*A?BG(nyPN1fxe-A)K6?mRigUW+a(G
zD(pX)Nk4%3iwDQWS*T0-n;9*2E@jPPt$%_4)iW@legmC}WhON<YT%|VpzM1`zW`K4
zri0XTc<D_y(1}njS%R3a?AWeYF|)h;2=tkId}KNP+=FuH0YIqQOm$>-K6>+bGh>pB
zZMRn6U)@(xDvTu$ilS4wwB%Z+qeo)5;_~34i6;#z9f-}LsB#$eu-5M~R(S;!oY37n
z9VEPTj2*o&k8*NyT7-}rW(r)y%O9_ih6&{5<2thLujxg=S2_)Q_U^aSOChu@_+2&d
zV6y$F*@TJq>+)H`NxR>U2UiBIi~AUdvS*ct&d7<ze{)gv%L1{1GNN4g+jAm!czAdL
z&Mwpm*IgOzKUZTk1l!CJIxti_9X5tGlH8tpq7H?%<Wj(I*^>P<qDS%sJkhO|$i<Kl
zW~JlXen3wN`OhCwmWy1bFO#(pHpJh|2-Kn7)r<qf9aX6AJ_p_XOQ$0$H@!YX-Ik(F
zyE|%NmxEQ=N`#ZPd5b3lrnu(OBPN5abqRXoEt1CLf!#L9D;S)-gD{OnF|)OFN(GqQ
zRz;0;9WU*LVBmiM+m*XD*bDfyFg`TA@&tXQ*<?T8wVn9TE7gXphY`jxYh9qpay#T6
zg^QmJ5f~X5ED?N+s~t<|8e)m<OU)zJ_!?yCoQ_7z?!u^O=m~nv9^6N12}d9EcY`LV
zQ!xVe6E3$kQb}0m_v*%jRN1qfwXz3y{i;eGk@7KivmS6Ma~hdijk%dV7lvdb2DGdr
z>f-_m;1d)A#F-E9Hv3li5E=NWdGtwUJ<xbR(bvEocbK&<3j7ZmCWM?mCzEPCvSl;{
zR*>2V%VX>4JAlV1HYzDevw@)UGx(R(cdWE`fEP4pTakaeCO5xa=YbZj^RURY7(lx2
z7eO5;Pgy>xKF$x53=w3D!Xqidgy-j{2lNNiew}8m3M5d#Hmq9)9|xtV$GhAEt7}b*
zgZ^h895E<TnaQpFM*taNMaL4(o-J|(Jzf%iUPdvyAbq6>ecA#OZvw-fQ^*k@&9cCD
zXyuTiA8E^|SM!cT2E0T<b)OV$&?^~^A=Q26_+wnH$z#&dttejC7Qf!d#tN^N0jTs+
zbotoZ8>UMv#jee@02kv&#4s?w0(T_7?nT}g`->mq*(vOxN^Ag@;gxo%chf+^?Z(a{
zY=ebg10CDMMMcSW`bhiJZ&`b`3&1f#@z0Oi<ZR`?CJ#oy%6*mS@3Kfm03h?(I_De<
zTUtC2UpC1A1hqwG4=(Z`VDzcKgUeKu7){1nSpV#M(}Da81~bGDE*=h00gVUmI}54?
z7Dq9k!UUp*7})to7olG+7}*2iQT4jK8jupf_u7olAwk8r*;yk~4xBcws%;n8pOggU
zmI#vi&gU#Hgrk+q2UtK4)!w~>aIy!Ezdj)`)2kbPNKsF^m%t4UPPkN-LeN~9fTo!v
zMizJ&cN%$EFY~LP5o^7G4CC=YxVD8dS(fWXA;rcgK0R0)XL62QC)D~E&Qz~_H%%>C
z8dqxRA9jm91e1aHIy7IOVadqL7(#u)KdFfsj(Ol|`~oyx(a!_OWHdETF+2<<k2X_=
z;*>Q%|K#0x@cY)*gEd$m5@{H9AG6Tmk=F6>h;;;_CrQ}QC|vspn(-oz%OY(r{s4<c
zNwCdH{S26qLW;@@T2_$b+agNDK3vPz*4K!LDf$?sJ#D(-OXs_*{x-ubqb_*-?cp0}
zkB=^LyrYi*92Gz+c>Z)0%d}$%<tN#_1-sG*6}#l=iM+$=_UvX~aO+mLfu5ewtLX2c
z2%DY{8N#qdkSRDrsPSqzmVm;;$%ssmZdTMt>>Jj4O7B-8LQSAzwp9E#b7)S)AW^})
z<92(xV?XE8W2_I-Y6E$IdbBlc@C+EK{IxF&3+&-RcdKUAo!FHz>u6oq%&71W49q)(
zM*$?eX@`J4)jCN_P^wMqE*`JKcdbb&6-<SweJi{`YDs~o_W2NSeosg66Jj6k73)mo
z5Ki!2sI<oagLEOaU`hyZ<0SHi6@4`GY&Fr$Gz!?U%U+n=-Ejtr6r05hpqo1hBMh_Z
zaGYI>>a#MggD|+oF~!PsaaG%{d5Ykq6kQU(@ijj?qUNhONTdH99*CFcv*P<}@O(3V
zRw*v)Bj^<*57wZ+n<BA0%+SIz*<F)V>;(Ny@ls;n6@WdO_FOsyNMRSCyiR;Ug2W8#
zl7PaVy6zus+h#x|=W~t1;{AgM2xM_6++*v({~9P*B3reYyAe#;!jbfy<R7kbWh&Px
zQqZ(SftX(E$e5iV5j+bIRdetW1SgphZfe`jx|qY+?|kI?T_9|x5@{{@yc}rNC~z2&
zFN{JHVK)HnyVt5lJF|0Vg0Hr4(~edGatBT>Dt>;4Paha~$PsMzw2dM7-`m`s#m{O}
zs-OxLrALY4VsB9FKf2_c;33dodto+|gLlX1<h&d1hKhXHut^))<KDQWuITcZnyU{;
zh!`@HJofb<-rS6I?1xHYAhgYJ%YSr{QmjA7SD8&oq_2_E=ady6a}d#|Yf2MSBX!Sc
zQ~IF3zKQjbz{Ns|br}CC!559Z9iOWQY?wpqDrrrgPnPae<&omt<DkDd#$PhEIXHR#
z)K^tn)(6Z{e;cQV=?pP5BaZutlzw!#coLTHn&+C@cl#u#wu&<oH%Z0k$tR(DA(K`L
zbTo*T0ynNDe|=843z2I2nVsWdbXTrFSFPgvIsaW>UvEjE#TKAX??r^UOfd^T3uu@z
zgZItsrkIx1!g1N7C&dyQqA1wre|2Veqr*XCXtBks`|{-T2?<lCg~uvjNb@9!kiyBy
zac~RK7I<dC(DZT;Jtx}pN1h|CDEfJ1Et}+on$o5jsl;V%@f3(x<vE4S!!b7rb4+an
z52V0PU?(`hA;@?D1^RT>GUO>$fWe=6lBJNau5Vc$q*q;jVyE{%OsJAg`H6Tj&=^tW
zGa*Kx--D}4shN=nw~#%MDJJ0?@?y__n3=zgnQ56|0}fzj{Yvw;tlxWE;B|r&wnO!R
zq96Cgn(6wH(-T5STj{YbQyU(lmLNAkRBD24D8Wq)JA}w)6KU7#mQJpxDri&=`3^jx
zx_8leZ+czU!pYg-E6$%kFAZr(v0MnSBUm6EZF2CBCZfML`f4s~q9qQ&=W2jD@24O2
zF=F(um2wOu>{R%Rm%$W7z;hpt0jv0>6-~IhZylq@@e)of;hL)?$;**iWd>KU{cB(T
zF-eB(To}rBcVj7}4P<m%88sYK`S+j(nE+)6D*nKIi+ep<H1d=h-?h((H=-bXoU$y5
zK*a|1VG3U7kpDWkna#lfiY;*q;PwQ<kkjsh);}@5ZP31DQ7X`8)xce-5$RUFfj0c5
z`D=D|_{biyt|ZszBdzo_Xdkq*KVt?grR5&HqU#@4AHi^$?#Hp9wn0WM5LsMH5~Y6+
zh^z|xT&&c&g`?kNLjFw;R>5^WaVkxN9qWP1Hnvb2+}~+NlEa1U-pZ(nX=1E0v}xP1
z(*N2a2LYF2WYsAR^87v3AJ!EvJ-LNCQ_N_SjNa;jiJ=K1wdK1}g4)bmQ<u`P6E$Ep
z-;;YCu>r2jUYHuWeJu+*nToQduR+rauZ`mHw1FS7OZiA9R}~9cawHyF;A~~wK-ay=
zGEO1|fUU}FrxBJe&ROgCtqbts&OnI)-yhF2i$>U_ghCrQ24FNn!G~S|Zjs(^gCHI4
z7#NiN9Ub-bM{`LauYtaO9ZHN7!>Jf_H^v$eLYX8F(amjfURI88fvVy~-j_rXy5k5}
zp){Q?3MDFGscxG4;$>j}vK8Pm$>03owAYAR(#37wAU%U+%Qd>ajGC-s^eb<-R4W}o
z2lwwM#s+~xq=ui(NSONF7hjL_v$d@s>}^WISF_1G?;v`Ir=YiOEGq&*!2clmaM7m<
zw&a@!@S<l>0$c*!4Tr&21f*HMJPou(&tr6YJ?%{#`Wh;Zz6TJT=h%>54AT#JR8dhe
z2+=_veApYL#l(*lUK8&?IoPNsMYy8GI`Zr1&y!MzjEC7CI7)2mjtf9U0dL=Pt$zdn
z4p}>d=8{v)FMwZz2ht4#8fFg<kJ!M#zya1e3+mzwI<TnTOfr>L&)v*<wTU*9E>90$
z1wIRA+n%r-s7Pp8vOe2n+V^SXbxlthi+1xPZ*?D+cpTT&?Z*)P$>%yInOA&$ePh`)
z^>)}~Qgh3VxmsQ?e|C6(OcIn%{_!}hrT17>p0T2QzIV0rbI8~nTisB4eL5(t&edJt
zz`y`HKRC*c6W}QHD<UNOEn4kXJWZhQWK*jxgB!nu4dK&M;N<6p|8B5<19S&_`K}d^
z)IbvY;Q5mi=M`Q>BO>@vW8n<cLH{9hyrniX5}8Ln&>OLmnU8@Nf9jccM|SZ@3I>>!
z5*?P*E6JhH+A2?W-+GK(1k|hsewEO2vk9p2hhfGo*7l;x27niBpvt~xt+%q)$D0|k
zLBQK*nUQKNL^&nHXc%FIIYg`Bm*{zYm41<K2jHG|*B)@0{s+jNx{{Xr58^uuCePZz
zSM2}trQy+uJ;slzPF@(h$Lg`w1_FkB*OpcSQOa4%1iVfTC05)`AE{56@<!lNG*7MR
z@Q=9cv1y0^(WK79e`v={tTECG7JLH(CpEQUsLl_CYh5!)q5!T1n9jb!skG@Y-f4)@
zy-U&XBD8I3fWGK+!L(DK^Yes(9h9m$cW!vS!Rr)V67((ma!o!<5GD`%<IueD!#D|(
zQtOg0>5h}}UbT5>4ggk*{x0d#?)HB8AW!YfLBHlIPV4w@0Oa*M*B{#a{DXK=l+K~Z
z(hk<Ti&BE$M_X;04uarDChBK-fz5G(uhI|@RlMehG`5L23H|*nVBeC20Qvla!t{YD
zQuaN?DZjE304rZ$(#XGprQ1_8tj|;!Bw^!S`@^ow`_le&{(jAFf=KzEn`t)-VohxD
z(@GMecpV3S8L2a7d_fs~E5Cs)5ep1Ib>Xrz6Pr8p_d>BaV~V!&*{E~;)#NfQw?!cv
z74-=dVhdR@IEu~0@$zYnBi4Iikg2CW9)#EVgkc6DBv!43h2FU`%^hY@Nb4<tMPz)8
zuac4p6HGQ!31}c`VD``1#q{BPW4Y=8?&vMJ+jXfouO}q6(v$EyK`=qBoL(Bkhq?o(
z?&IkxuUY7-8n<*DKADPebUH<!+w{ZkxFsK8k@L2dKS?8c1ri|=8(jE)`z2}#s;63!
zd9~1PkQKTPb1J~Wjv}8DrmkrTwxoPJFaXB6j{Z%bMoK<kIFM@fRfNm*21#Slh@p?4
zcR>7KYPpUZyx)BE=_d=cs$i~sM14U5DMg~bVhAv^Ha~U;^}J!L3AiwX+vn)b6hY$g
zeV|l0=p;uea6zv!R@(bZ3c26V5NWQGb`nhF!=DYD=V(1n%PIf~#IYaEZV$gjuZR|C
z<FzSI0);HklKctuyg0PnQR@W}2WZDt<7yK~c23q!>VoF|L3gE|4g7xXGCguw{Zzu#
z1usmD0vsE)cYVpAM9_8dhn!>iv<@A91=(O}Hk#u-!xTPH^q0xn0ZEG1C5LEPc>)TH
zkG{S6CXTAr+*X{~H5nGVy~iBhoj`w>I1C6NiVOmzAqb8EeTy&RPg%wyWuLqM1S;n9
zx5<tZ8LRf-_<mHIvSwQ7coNiIx89yrAMd9`Bsls>5N{xl4y(6F#(%3hT=<a&C<H)P
zr6S!GKs`DMRpAJ0Jr=)gN&a}k#EhgAhlcJV+7>#y^tr4zTP9*rL=vq%Es!2{5B(iP
z-1!gFSN7o`!bk?6E}#DhOv1`pMhr-ChywnKGrAi__F{@F_puY+$nL^)XOZp!Q5BoZ
zZ<vihc;?54LZiQBJb1v_`U1q&il3<(I1CsR_Xm$MC%IrZ7PC7<_aHv<(C$h03^yWy
z;9L%^#1?+eRxte78t+^%%R^jg>J6%&+AKwk_>f3&&e#gi8^VftF79E=k0!OE-fP2A
zdBT6)OEKFNZ*uEBdBeBPb%XQi(7{`s;nGDf=`H%S`9uBs@m`mk(&su(pb2zh--?UE
ztL)-rdw4xnT1Lz4*7gy0;-B;S0&-_2N`Y@H5?!Qb$egb31L}yKO1==5xqu{lfKknT
z#%d`jF+{sv)W^k1Qy`&cu(=ONv8zU`u3(!zDhmcRDL2sP2z1`>%qsuEGsu15=23v-
zfd3&yFt);Xfq>{CV>J;g{bTx5uit`^!mAhf`MrV_yINqB+^_{9`2zm!(o-8J>L7&k
z*un7MnGY&b7B-~3q9Tw;8vX|l?W7#)sS)3`PtYsB3mZC>waiDbsewa2b$FH9*Dpcn
zdvyg+c1W5QYrSpNrLWDLMi~W=_ldVg5$JW$AmWfCCCBvOnH(S{rEc?cj*>w3x>Qd|
zATUzei=S6ebm{r}b*))T&_u1!6;4;ka{y7BI<93$YdFcb6gx50)YRnvbm)Mw#!>v)
zt89K;IRJ;@NGoth^LFMRPQvyBBRMjEJ|D!D_o*=^L@1FnA&|LEE6Ta#*e#`8lU8~Q
zGkOGo=e?l$07^ytAXbtEq%*L?_MQ;p$Pyfd)cXt5<ouwT#rgR)2mkf*H#=8W>1!5c
z3z+~IOPnEpV9&z1O#cKayb@Eu*E^ONK?4l19q;L#0bib%!OQ>T!a^Mch6dH8Ox7Hq
zBA{TrZPbcDKN~%=X@I!bUi@YyhtDf<)yVTAFUuiSq^ZOB>erZ%^Dykhj}^<u)s{aO
zqAbVwGy^h!S@&)dwgtJ!iHqH7JSKrL4um_7K$<c|JQVZwB?-nbuWA+~LSbVAB^{i=
zkL39Th28iM_S;v#UID~)6*^#B{7nemHN&4n&H~m086Oy?vtqsO$M$u4l!)*FuF-q=
z9&>yk=fw+Xu2aZ;kcm}LH;U1xC2_F{Bv%6c6in}g5%{A!yfDq~d_kH-=-Nbaa#DGP
z<y7MY63}e!qV6{UsCEGs7eq~DB3TM?wV9Mys6#OJc7q21z5XBn<A7>rXVUobqf(!D
z@3Y9>6o=7i3|t41GrEPxfKO+6b!KvR%Fcca%VM@YGP3<`Ugx-^MMHDq$`4FG3emlq
zeMxn){4&<*o!^(=<V)*y>6NO#A86z{uZNv!85QlPj?KQ7T>Ttz*I4z}T;mZ#%;EO^
zpxlhGE`fw}+Y#G!rSaaoVa;FaD|yEXRS>TW>kU_&X8fxEkIr!><@2Y^cA1Yo&G-B7
zm2L5Sg_ep48oHri?6*vKgAandEii}btpJ<-X6T780VA>r7?x+@aNclmuWZov`|-q9
z)$dGM%cjxb&Zh*eav5?${aXIU#)%8XokzdiR65i1#x5+4y8&lmF+J@@ji?zbdcGl9
zhkv&q^Oj9=i1ai_*1Kd0bN2<!6HgD49T#&kzQq|h?T6gYr^6rSSxOKH&!kRTG(G2y
zekK}ue`KgHab`v4aQo?M1|XF=z!mik3>1R7iTAtpp^p7dQkFS_r4`{i_Z-$D(pSPS
zJGHBYJo&rj_lpqE|7Pnvi@aZ;;NCv)jr7p%VT6L4GJ$h%9TdG)2~&6<;}d*;k6_~S
zW`Nag>ZbMFEu(77z~YaMkaPXz9~lX<dAl{Mhdqk5!<}h~4-zLGH@BR8A9AjfnK8Xg
zhG6CT#p?H|hTjkL<W5EdRlvc=eROrh{^{ASsocJrqfMJ#bC+08Trvayw>HE&W4SMB
ze>@#=j*#c@fBzRKnP2&qzt^l8P0<vmu<-9Izy4vxZQ8qcZs|-spyKi5*$n0xTNoxw
z*z{x*YQ}HG=i}<ym2VB7AM)J$f2$7uF?ahq0#{@sOzL{__O9I~EdCyd1R`)@C1Lxx
zFbH=c6$NP0D^YI)fi_V1>1Xt&hnb5zI^A&<Pna7Ybr3cOH|q;*#gO}Efa!n4oVn5Q
zdCT{wE7w?9k;;0Nw*k@fXB^U=FY4R&{17JmC~47i()n{B%tLnXE`7goIi=fkR#F!K
zC>ieGe<qaPwQZ(Y^Qihb0$no{+GTaF8XA^;lM-b~VdK3c6}?@>^`w+UpdJIi#=SIs
zrOEM^OBXZdCqTB=CH@(X{U9A$`&t)r6cX-_^L?wSsj+{x==)1)94r$kY<~1G|M`@+
zMiwo7zeH1I%Rx$;)}_Gkop~KFN7jAsH(rvmvF19*nA-?gA^)07S^iDl!N0%R#A%@5
z;g@eNp;2NIg!f`*Um-9%`zgVrzpB*uafZ23f6Uj{)D=VZ+e5uBBcC9gLdCOPZ7lNR
zS?aT7#q0ksDQfPvXL!4Rl3(0!l`iI^=HCYl7~xOEHyl0zU@Qlp`{-3+&Pz`UlK7Ab
z;3G9pG>#0e5-PvoqF8aYLr{~vgGbFS5cOf+2fl9i(@z)ncz}HRRAl7p3?QzyKpcAH
z=;xcB@l&`!6W(e*i0-7dCM3oPlFks?@o54QdY>hRMryw>0)M5kH$`9&h-IYQi6s|I
zS#+B8#o1qYLOgJQWBO1#vyt1nq=+4e(mZ<yGsX<5TiiUU_E|mfoq<wekFj;hqk83r
zE0;X12L5~J+HLP2x&S9-54#=o8Aiu@fjvrh@)(yXde6_9nIRqoK6|7Dfd=Crt5c^=
z-6B06502P@fQY*)Yx$z$W37-(#;O$R1Bf>lFPuLgnz`rXGnL2j2nn<wFvr{5;jN7g
z_*x6Vl^JGe%vGcRDex*J=xfEmF8#aUauTv~ngG37l_KcD4fUi<J*Oa(SwJdQ;Japd
z<;s=%u_$O_j#B$N*qqx(>Dio~u}I2FbIW!jplY}ztUi<#kYW=+J~_4;^Ka+)T`;or
zfjbg0V$*nDoq@dBnw@;tCW7nM?17R+HHIQ~)vK_F3$Z*`wi_q{EDbgtOxIFey>NnG
z!Tkk2rT-4whb;b|G?kf=p`rDQFh(q)_OUN(i%)I7YJ~wDAAnXCMC}KPSrJr!z5xNl
zr7bO+h@znm-?ifa?g9`+8=o8RWOcg)f^K-4mk8Pg8{l$Ra3JdA*LBxxMd7i2O2S@;
zX;$(NUu{~W1)oB7pHO&sxQUUq-pfBr11&%@0@IuMlfcD*V0A%3!95j$>^c8IzHV#0
z3e@;D5axN-uQOqA-%;y*5uTo&XW0D<l?8j8PvIF2a{xG#YV{tw+f5zcwq29|fd64R
zcA2Y-Y3SO2&lO4+fd9gK`^(a^&GEcErcVotiY6JPm3mlvcc<$=MUQx7fW!qHW?)t$
z1qGUDYWbKp9%flDz&FKy7<`ORjZL#x2bLKJjChsu-JmFt<GT7pV$%xncO5;w0RC&E
z1;_>rSW93P--Iv~PC#5_-2t$_rB;G?=5Jg$I|0h;OP0V4fKf_#iyzhHC*W51)8|OO
zCO$C$%a0c<#Iol{O;;9B0QE*I??*nsF(EX?V2nslUtv>h*h7D?6C`7W*fg1-!BE3>
z0iWR>=%@GIvt#5~DTe|qnFcpA^hlBZWzHbDK5(p*3Ainqc+v|argT!MJoSZa-5Iz+
zHeY;}I1b0FBjHtsqjkiM>3S1b)s0|F;{Pz6%~oE8zS;%><#-!CcHW3F4OR;5Ku`qc
z_u|M2!BG(cy%)K&tI!bjbj+ZNQg^q*dsw=+4cKUkaZ6i;ZM`QPf!-F0Is#LD)CcIl
zyL={qfNs+xAX#w{&WLaDgkZh}B#PxoK=<)K%-+H$H^ymlUOa&FfFX4>Oun8$_@e?p
z;`o*cav(WahOhCVpz4c5H|0*=D^3@ouSF}odVmkTg`J3OW=z9YGzXfqxM(*6wRW2%
z7MaUpzTp;!HsCI4mIEnUK$($Z)e4Q<=`2*O5yfWMsmv+%#v3=Idv^9f>gR4XA!9SO
zm{2Z!VQ*J`#D=21QzqlDZhO!j$Rrg&dTQ@6dTyqEIj{K9oa3P4rNX2^Syl+#x@9Kv
z`9Rv<)gDxz;mAM{ss8<Tw#p)f@FiIsM8{vYumKMtE!-EmaU&4Tb#1V@SY6y@+5|%|
zmZJW(LdLDyGa*J=sIVvH*HEGOo)ZVVKd-P~%AAp=&?w7gx}~=Klugm6o3wNA6x!YT
z-K_DMoJ&ym3HfMKYF-6HjzEE_`a-0_s{{0?LqL0XP!Ef8^?;t+KzQL?Sq0C<;{*Z$
z{5=`u_A@GJ`w~fF01EFU?oKGy2h|scp#595!gAI87Wi54Bsi(QkOGM9%vJ>EnUWRh
z^|Gybl;zCw>ER5J9f(Bo1I6^r1W*8(Fw{r+Y}BK_!&i;(;%w9C#<<r-SEUCB0i9lK
z;VLI&cj*9?xWn6BV){B|bIRa-6C}=h5YnG_1l|1t{q`5sd9R5J)+KVPA_*qi%)qn`
zZ+o~frVD-pS4R{)DmamigZNA+{@tN|!(_^Fy|`gUl1g_J=U14cN0p)T@7fim@LW3a
z6YRJ^!SD|<TXAexkPKL;K>KtU6xNhfvZWnGyAX7#NUfRmNig9uLrw#=5I7j8`@=>=
ze*Rtsx?qMQ$YR61FcYZs3`h4p1&+Tu5hrb?Za0o;f(XDf4Mbg9rvF#1m>~Xa*;=MH
z5M_=50-%5X^V5{R6+FTVb2fxXv4u=~<T79~GN2HLwpj)gND=fkkU<v#AXb8Gphn+@
z8Xl;0)fjn9-8dlZwiOvTuQv%4rG%+9K;6#J*W`)z$S8nX=(bXuNv)6vpw2ov&(Xyu
zUW3n)4qUg;P->E~9;|4SGODp9-`_U45}N(NYUm{<WGfM30#^a_w)I~ZYY#H6hFAq5
z6cNh<{>>;~h5P~@US8HG7fsGT5hJYYz#Rz3g&f3Bt~PIqAr^dpFCa(Z2hNHozAkZ@
zPJtIw1y1MTdl0k(PS}=g46ip(am4@^3uE{a*j_Hy%K?SQ1c<4QG3M40Mnpo?NFEHE
z?D01NQ%TI%euzFDh%i9i5UTL13%P$pZ3?@R#9VIVxvwOIAfSlthmjtTYW)x!{1@2j
zc*Shg=z<h@jptCdAk93886VG6aYTRDcL*Y<HZ$z!qhlXqCz$w9U;_?^e|vd@Cv5lx
zUdNOVyA6?U-<L-@1gdrTA?Soi6pscNt8x|?mv2VC0gD>}&j>Wv%^O}>93Q}<fe(SP
z_q*EiRZ*YjC&zZ#0+BSEV^kA_5m59vBU<3()ghV+7uP4&`gS5v$2R%~2Mr;zgAOJ-
zFx)bM_t^wrS76jh;Z+8h1XDoLnSBE-E=kZ>h>o=`IW`D@=H9r=&OOijVH)8>rX1ZP
z1}+a;DI^GiS3$sZI+REF9@l6Xd@sm)cd}l-0y)Sq6jbgHV{!kHEn8@Rm>#$@e>Guh
z5Aw|CcU}iwXtlXT09kIXC^*Y7M$#UpSMY%IM;iB2ePVp{;(#hI;)U@cO^s>^2A=h~
zXQRU6)Pi}NE7fI)_h1TkA__71Ra~GV+}%rW1V0;Ri<PBD^!FTCQgOaUMz?`E;XU!=
z!-pectygJT7aU9!GOTBwDn6mAAd%RRX92D@Jm`iiv6+-1#}b_vumZrU4>t)$>}Q|A
zoX8rlw49&@`m74xQET-tq$z}8^M)?h_Vni4RL8d!5(EtpVcz9{3lr+p--q!joNNpJ
z-;dcoEo;1lBsQSx_!{xmq3wau*9b&4x%GlR0<zdqfBeAt;THN@64pagEKwi0DGNAe
zLv^1&z&eU9y1Mvza9B%sl;tFX!-x*CD8tcNilBj|tpO{@gj3#ULxZSS*yDxRZ2z`|
zDApHS=-ndk<5Ms`O<s-!;<EzMJv0;zGN668NVA~qml8^IoVCQ~xdK{#2Po}OM~t|a
zIWdqwm1-u{eaJ<3_I;aL`YQ<^>bw2blecuG)h8i!Z1*eJcm;sK+-KJqef7Hq%?V_R
z^v~A_A4*=(+#G+NTnAXk2pe<;{f!RMrYAQXj^i6ZfQCCPc^cX_EX|c`^s`#@4HBl6
z1qxb5Lw$X2^4xlhAh(Yg4Wq@(gvrS-xO%oq5X!l<s^B*b0x?0?kJs|2987b78gK!D
zwrvMcn)WAG#Rx{|;Mzrz6p$l1Tg!-!uLHj(dvDwc@gaSxM1mDS-Oa~#Mb`oTbgIrZ
z=3mODO5EkWh?V+C0d-hlv<kt)oJ5!JT9>dx8d?zt+>&*0d`obd&VyQ{#qvxpr@a2T
zj}OlxjbAVYHRlI{c@UZ2O$o$Kn-Vny;(T)?Ct+&p%?S`&c^FRJziyZOb`Xz;fyGwh
z)Xa<<Y>5;}45n5Rx!v)j3!2CR#%d>sT9`1#+Q)ZIHDT(AXD!sVHuy{+P>n$C?VX7J
zuBe#(ad7a8G$I<IA<aFi?djdyi=dksCMcLy!Up+AJ;iHc90}-l0T_f|VM3cpgR@l^
z-*cYqg?IqzH=^-BEv&~o`bh)>4039E@U`^0uQ1y`@M&Oxq9&Foj%Dsbl-yN%{ivHi
zi}E&>*q9Y?1^9h7a<CK12q~|_@TKqX*^5aO+lMzT;mifiJ(Uw|Y5RdHa<Z;`H4EH-
zC;V(<YFx^U_XB_G?|*-LZ|{OKQ3`1kMzWT-(&@lFcmRVf7a&;Z(AMyLFYw1?4(YL*
z>9w0)|JxE49G}^=y0i4GRG@aG<L41XwVvTrdR#I8rvKMSA)XIH2j^KVQAFU{eGmV=
zap;?zqwsAnfRGEyITnf!lqLHd+yl;?tK)A~A<#>@sYerhlVHhl-k*x{LE2WGP;}+|
zUKoc11A!mOhcek6^i}^l%A%WInIy?5@xsvI9mLfonWCS7Y1~OUTOKs-CUSRTV&a~w
z)fQ-c;=jc})s_r1gMX*%V}Ss-idR;=E<raEp}!51_981N{<<{;UCS2)L$Cp5i9e54
zDrvYZ{R%DUZtRuZ8lds+MfS2gLFsmW3I(kGl*hJwAC#Oim4i{dNXKFP{2t*TZOYv&
zD`i1kqHiz?P82OBm`B2m4bAl=#AnF@n+ze#nk(y(0r3~ZWum}D?+S2RO`)yZ^|nEj
z{*~{(R9kts24af;8{^BT;A5?xMqh)ZU5Ub;DhM5hvx}p39-Mu!g65F&icQ`%vl{aO
z-WUsLi6RbAf`j$zMoIb=C-sFrxQbvmXYG*sBWi-EB|+gCrMSx{)O&$LygxYX5y*i@
zfZ(Rd{YSU3$D*(&?EeN;yAVl9Nk8Z<#lbR#3bkPkh#^6|u8i;6CcMwZU!d*cx&P^I
zz}{FBrwJ&4AOiBxK+lO+;ABz3@jP-@=%q`J4-2NXj8JW~EF15sjjN<>FP@%#2>>sx
zI57LA*4M8iBQ3_W{(|<huLz3>+f($A`oiyDy`}w77*|i%^KMaCO!%lwiC`<ncRA$!
zi$0AL)}8gs>Ww)U5HL}^zI|bggFxprBdw-8`opv_9Bwxph}ArSF0t@}QwsIuKeMO>
z&d&$&in~Jc`&RyfZc|9{7RC-Q^p84!>u!|i`pSY{U()~QY`+~(GRW&<rmG+2(ptOb
zR&^UsZ<ABf_vX>sK7>mRvM!$%Kp@!8Z2sAvxXW&6E_1xjUKi?j7*4PmGT4cJGZKsN
z`QT-7Vkc_KcRav*$9V`U+JS6(Pk`pQ3q0S^mETZ;rz$XdZ$T1+(_4hs`~%54iS9lE
zBW<P3?rx{+WB#Z6o}3&jOm{<W)1%_Y49>#r7gycK^JS>0{bK<S(T}<-i$bzuu~<?H
zah?<Vk-OZZ^f$VTwurlU{5OyZRGL2D8_e_}%OtJTy)2*3F1FF5Ss};DoJzsd6DZ5D
zUV4E7i9_6Pemn5S!(Le=mSPecBYpLXPJ|#bzqrU&Hn8VPlx0Qa>_6(_??B<@k{(dh
za<f~R+meTp@b!9LQb4EGq#XA}p7@1JE@-ZHAp2SZa~R<x(3O!R)-y+pg^!c5hQV#d
z*Gcb@i}lzEa01id1~y`>KY8Cv3=@0+f7H*urbkI=8Fe^nWSY?FGl+2~z2dyDZ|(j;
zCK$#|qZ%m`6B_-jNOxp)Un%zYHW{gQv{@Fcb&L3is6Pa-1&>eq^9i-q3~T&Q<luDs
zgd5#R32<4SKZXjgnt)5hJ9->ujcF)pl{hs)=huq2cgv2^>D1Ms>u-kF^@u{82G=Pj
zPpHQ4gYE|QC101^_g&j!;XYW|-F)-A&ehI{Nym+$bU67GWi)|Dsex+|YlR9J%(Wt5
zFp%9CJZ>!`^)2j(jtb_B>WU{>0eL@`V)DKl|K&|pIaM}H1WYcWr9ElTVE^C0=;?q>
zrYD$q{E3!J&ADWvb$+d<@ggToOC%J-Cw&)$VDKF7=8PfS@wy!N1BNQxrs&3htOwNN
zYGqqZVfZfD#<L0}I)G1>={B@18K>E&(OqGHbFU*loLcY$z0J+WYK6`I<iEf-$)Ny;
zLOHLiqV?&jCJ_9eZX=*=WwWvw+S+z>*semnAM&Z}QPV6pRB6oTctwS4@}z~AVOIuB
zEmLzI^L&7Nnh2)pB&((7yb9Y)yCPNa+F7uit+e2CD5+a_b$w~uBp4*Ius&(9jf^#i
zL9qR~vYh<h%bY}*PexXra0NNb1q75+{tf#;y8soIk!0&TILe>(RmnTvKoP<1F&xI;
z2T~IkN1(TjJ`SX3pgFJDAtrE7<sVV|eZR_qcBfqZbEaeScxAin>L<uez@j|>R?Qg%
z@2_vg1<Bbu1_qx4$r0eR)51@jotnx5Pbn4|yM<B*6t<C-h3P;KptwFVh=u;m9e^bJ
z-GwTA3fpGDLWAR?C^0A9@r?TTYk=T((6YQ0Q~3(420Br$kJ5iB<%a~<eI0@3eG<!z
z=)T0uMoCP3j6Y*SG@rAEtXA2~yCzr%$Q#aDc>(1`0mYSF2)OTEeD#JLCLQkuy<{N_
zbGIOU$cZ6Hp{Q(Wi9H9ETnb4K9Lvt8?|mZ2N&O;@>`7WAvo1j)CsyQOZL39lwK8<B
z5uKW_TFb+ODBw+qz<|7BRQWL78cO^L>%wQcE5?BrFFut{NrYDy34YdKBE~{3@%!aR
zT86cYn*KG=`s*zxd|=k#{rsaxkDS3>NVoN(4(m<y$Sn0aTRF?|Kf{Q}e2RmD@*tuQ
zOqdcuWPl|P*Jb}zubS^uOLtRYm6bkBp9J5y&Ex(}MACENZs_fV8p>BwKzP^z<Czp%
zmOsq=HgDS%G143%sn_k->IN^^tbwBH3YY}6hYeN0Zs~+t(NM6#ECu5X>-6uhksYu<
z^V3%j5ap1|*T)R<KmryB@8ilxX5%SHk_Z1cQTW>zVXtMUKZCKPXnwxPXIWQ%2MWKU
z-{WJuLSG46P8~0G+A7?A6Y^y5z-?6qAxP%<dCD7-iLT+>b4tV%FeVnOyPA^tHsANm
zl~)=2>+{H8yI{te<`@Inux;{u<^MX`iJQ5;ruTCiobunRG<HCvO|1}QIMFb9o~+Cn
zyP+sP-R&CghK%L!Xu(+Wbw3Rnv-tG&>mKR$e<TSIKod+^_ABfWP<WM@;9JnQlCC9K
z1DJ@#z0MfCsPN7LJr5m-ivIu(b#RjF!iNmxl?Q2FG;-wZiFWP8djG8su?m81?1#+O
zYlYi@w#46z)Q;@gZsxt;(9oTo0Aw^9F<c0)HHJCwjCaI;Yl5;Ylk$a!hsQY8O1WIr
zEGlHM`rPJcNDyp>IprHT%`gP_d)9@?h*kn+b0T7x0ms38$C6rPST_FKoH_W8b-)}v
zCYNFYFa9UJ@dRHGS3H4p?a>jnV;PRSk*KFo?8q0=&z0HVb~JuPuSi<FSe5R0tn@gF
z%r$r$P*b2b%z10qJ#{Sk3RLJJhs{2oim|DE1Mtgk0S|)$k2Yn|tBu)s2EKD103S7)
zFr58c>*1jPzQBJg@)fGHL#Jv2_JY#k3;=C=a3hxZBGK;2g0th>6#cv>?&a=4#(up$
zgFJ&;IA=1#4F>kd)T!yDM>wV>8T*PJl$$6iB~=3y(5@{CeUbz_ER9cn+>H%Hu+uOL
z(2B|b4ioRS2Pyh-W-ashZ1{kSa5or=Xoc(-Zc^vtC>MI{!yZ~~+B`W0PE!#jFX>;s
z$#v3grU^0IMvuZo_j~>9rUkz&Oy98~h+sp^ozC%LdA{NI^i|KLH;+oQmerBK6EIQt
zEOd;}B&xzBdkgV5xX$45jGg%fa0J5h%z_S0i>XPG(24rG17<bhXf{QQ&7}lYBut@g
z6!80rrKm=AzH36z$!&5Y5(GQWi>H3PjM^<624c@|Ktq#)!n9AD$=SN-+m4^NM}~k5
zspt~4dM!QpcKY0Ih-y0}G+N;JR*+a4hpqtairm&~qrcVW7K8BB$&^g+5_y(SjroA7
zQoqyWQWj7DT0ouUB>q3OUHd<jY1n^IbT+7rQkYsrtwVB5v^7x_8CzM0grbmB4k58^
zm};=qI823&RaD~`MM6u6DLd;dqGTk6NDj%o-^cFfegA^DU+VK|s;7DG`@Zh$`kwF#
z6i#x>chEQNHcbgjX3k1Sy%8QgQ<&@M@m*0%vL&;}hgN5jY8oJ!bFu+u>yw7PSKv)J
zvs^2&QbYdYMhp6lq~Z-%_T;u091|QNZlpb_QdpmMvO38e><{q~RU*{}EvgG&%61!d
zk~b5fDY*E4EHtTjQO{ej|8!{~@DeEnu8=^R8azxtOq_W%)N%d2K}cw5tH#*s7){24
z&!?AouW7qu%S~A+$42;Iik_oK*usd@5b?OQjZcvgPoCgR4io@LzR1xPn=EFJ>hem}
zBPL*MxE%yGRqnVxos9_(xDML%ttp&_mym0K=&-uN8-#Z0ot+kR#Km_zpE(aMyV0^8
zrl!0wN(JfXWa%gG_Js0w`%dPp#*#!Ce$k^GHiNb(DJZ6875Zahhnri!#qc6+tDJDL
zqxw=^hfjZ73yTxlbij+k4a67B-&;ORopc>KWOfTGXH@b?j;z+$Lyo>By~cxU41EHo
z{XRcRDtPGT2d%1DN7RjvBEC05b7m%NVWkM~oJ0>u)O*2q`HeX(vSY#L+1kclH^M8P
zQMRz6pX4W=HA2tN(O=f{a8czE(RCVQF1*gA5p{i|zx_nHxsQI3X1jwPO?4^5k@1IS
zwF&9qJcnS;)XQl$88(DgU^5UqP!s(#n%Er|Z~{wxdYHi<CA$@>scr1VSbejmKQl7#
z3y>O9R5ie6VD3At;yE$W-ZkqC11?GGpa8&=GWKBQU`_+cQJZh_>XyTtk>kr%Q*S-|
zhB}MC#W3PCH(B!#jB|E5b90nmvHj^T2v^W_L_;I}G1uTBbX%H;llq*=`JJ@QoxDHP
z^{<Zdu45rGN4ef^Xgkt8*7=z{O*c7l>Qr(9gc;36ZVy7xJk>OR39#>HLnpQ_F!3R5
z1oDnZ7Tagv5_Ie#eTgoW_!jNrm}M=5Wm$L0w{<7cEfjQT58Y`T5CfRN;=h~MLwXwz
zRv+McruU`eMxV4T$jkgi``?A5DZRn34?u;M^o{Sq0p&hSpPbJYx&$<7Iy4H$$1R_`
z7DzNF$Tk-=7HlC=D}G((HT8CY`Fm!<?)w7OPq<sWb@VYMuAE=}nbg4e!jAg(b+@Z&
zC9eg+N2sal%N}Ps;TR&{%#<v{!(RObpp2$fziL}O4cZ;XcKkKj(cM(L7E&BGV{t({
zY2z%pWOd@>yZ2w_{?T<d$Fh9G#{=P~X7!}C1HHyhJ8h8bt?g?lD3x8Dx2<dFylk36
z;8h82gS!Kltp?@$X4S@E-dfj@cQ`2Z!v@n2)Ax%!?@k$Y*eK)T{)C|t;H7h84Gd2m
zxmjb5^P9JOG-QO=IP=`x?i-|dCnFm)^)?BgcA-8<fWhSnE?p-oc0`vj_P^By1B$JM
zQA59BZ1<S&CY!#x)<rHNPbqIh@Pf)}Gw5wCahpJ}V(P`APXmiT+eDdv|86ySZf$Ge
z!R`|$P0b7LY>7>nEv7G4*z_qoJMN(O*;AI&$2V^udQPuO`MOwRT5mP?WnP=ZtV36~
zL+Yoy+<7c&-vP5O1Mk;{$Tj%m_Ur8fy?OqHkGH00TpnEGA>A{@stnm~nCNR|yt3wQ
z>Ktyb4;exZJEU!_R0*K49+K+5=Z;nV`oD;CjtjYPcbiVn)YrNee7nQQ8sN7kcGPj7
zjXLkB7-_lOUf?z?99}6n&Z`~X4NwlIaGQk5fBoNgu;QcYwZ87BLx-G&D`bow+i?q7
zPdBRd2~$6<n%ji<Wc}jm^4@3uL24!HKUArG{Uff>F`h*8XVm=`zRr5``TO?!<{w?X
zeV^=eDNz}IlM+&&GG^~za%bpkf`g3Z9vg=_Lyx)E;udQvUr3vuoo_OF`cG^DU#wE!
z<zJ^4O3Ur83D=A%TEqGah6Bp52(P?slREeR6lyjpRFZ!>A<<}FMB~7hPCAY6&YCI!
zIj^O&AEtO0*!id>&)inj!!;|t!ly>;#BqTu%@$I_HB)ELojL`q`<h7Z@HbtP?zrVU
z<&Cy(_5Y4Zlx}ma6G$xfL;;372meK|Uwg2MpV+GzGo5zDi2Q-%_$^Waa9s@l^5u&m
zrAzCx5EB|j_(LgBsgoY0K>d0tYt7Q}>4Niv!+bTPF}2a=G2s)(8?FyRiifs=rt}X4
z;nPH^gG%4Ku_?s_JC%T12tFNfs^kE}JaX~V^lEb*4AGMT+U*5OqC0_-aPgA?b^q7N
zwRoZA<S^iE)x|_K)0Xpn<f~IQ=eg;^7~=9X(ZPI>vNx-5!`qlo=*5n`28d+Nnc6^*
zW)`qkk?RVTiEuRe1yZU(e}gXZ9ueX&0qdbBG8L8%tzqQBx-p|uFHKV`JepH(ZT(3O
zy-^~DDGp0kThkKjpPh_z6PS~<0%w-o`m_mi74Mja^|9}cbH{U7n#Q8JOSPkH?cpj^
zi@VfmrK-~RD@{LLZSy*&6=?MGQq7*rC5G!vdNv*(%6)i7cVc0{xbw&IJB9hIfFEbQ
zSemIC)o0a9hOj-aG2C<Z7$bGTzsC2fRmhXeB?}2SY_7ku#~%3;XKZ51Os+W`ZHq8g
zz4qMxZ+QE~`~ynjVHf@0vZ|K`bM>OHeC?b^@@92wmgdu*o*wkpuK@Nv9-W%ezGCjX
zhc3n|m7?lbo=Ks+1wqb{IQ!4U_Za@T3Rt4h)T-nD7r#=?eo}%sDsa1)*+R%usZ<+W
z_Ciw<)#J^=lXXtn(n=<lMBGu0zXU3^ToNRLH!yFl%pRPbS0OPrWr$jp+N<Xcc3#fC
zU*dHNKPjb|QKN2A(nJZ+H`b_M@WI1qp?>i@I}N!2?ji2-yi`zi9OwG}Pe7`#HuP^I
zmm#<h+<#hITT_9B*xA}jL$Ve^Ix|=%8)!p;7>{L+JNK#>O@Qj8!**j~e$@o0IFfmu
zoQ_&sZxHLjAUq2I{4rL03Gn}?{OOIh&n3fPedK6uwjcAUA$4%WKNpf8gRsH}3oOX1
zE%zrZ8n+WCYPG6M+o@x9;9-=XdZqJ%=gDec6+c#orlIM*%LXRICyMhZ^hE#7iGwA6
zXpF_sEPXGwe+h$6z$DuvnFgS^2%nI_e**}aOhjjDs=NYResRTk#y4pxAY&Uwr_M5y
zpNRfjQF1CtBg>Wb^~;s2=&rMiwS+ciQ;op*e7nOYnu!XYXr)Z1;Y_@`PPHc{Kg+u(
zbP@1imchoYz8Z7FR0j8uV*^jftXHNj{3CF;AEs%x#NkCs=a3!Aio!G8xc&gs^sRG|
zLwDfPg=ifyz~F5VLm*55SmR@e0UqxDsVPw7{yL7z)%N+22N@sa9)dsTlbo!qEIW@U
zFb5C7pP{<#1w4Qkbvc7=x$mZ49?*LWzO4|cFP}G&(e__3?+!_2eE5i#HUQm2m>9`~
zQIM?kiEjys*K|$p4{jx?OEq7|E*Ybb-34<mOoc%XXyv7B5A`O%jQ9rsO!W(sZn(3r
zUvORmR{;II5AH&!-{dQP^j+QmGC5Q+!j!Zni^&0Tt9U2V6pOKRcJ^F39^)>I4HcYN
z#jmJZ>oe?|y1RvH@P}Vwd9&0)CBQf$8oU2zl>l4A^(KufQu_Qe6{KMRrm3kO+*Bxe
z;t)TPeZVXX$*dP}CgB2#0p0=bxC>axhPfcINE1P=@4vnG)Uk6G^zlm5Fs*=rMWB3O
zp!R>;aTy8m;)TkJ|4sBP=G_F|cY~CWo3K<x=Xfr(H28gQA!_^lEP!CbNtieQkze<O
zum$rHC*Gx~dJh1i(iNMa70ywA7SMbRv>h}frweVrFN`ops|W)(Ej_(6=Ro|xt_YEQ
z^$^pWQt1j=&eW#rq(iRf*vztp1ooR!MyW`J5fSSq7=sapee0>?f>Ty<h^dhOi}Xt?
zv!I6`G)u;)4+aFbL^NFWBPliXC=J{&UF}=H|Dfdv4(~FVo${9SPeAN@2^+KG-#O4r
zagl9cL6^l}VF+d5@}kGQ8X1`hQ9UFgE_=0@44v?Zq{I-*E{Y}U$7;nfqcHl0kqSXo
z&-myfkd(2y%86TYzNf^!uwxJXDzgm87O4(DCV0%5LME2-5=$GFdyhN!2Ld|P<oP}O
zh#Y7(6Ep?#gaRB~ZD`Yu+yIe^E!^>^F!uFW7Yt8~g7)9!Yo-=!<<Qb#0%KT39s8X<
zT2#4go2P<}7+8-O_4Uo^jcktG9?{qj-#>H|su?qx4EMFfmTDH&fd0Vy-P`XP?ks5C
z8X>vt$HJJxa?gR1$=F%<;9b&hPqX?gvY*Nr?#s~h1-6~G+qj&pI>47sU(BRs+(ZI{
z4N4cHGp4r(!VSSKl2XM>g;=!&94kdF;ev{rq^(MjgKl5RkVtis5ZhV}Z+{;>HGxq=
z+`SU(zqMv$0RPksbnGBWyhYh`hV|0`^ga;U<)C>mqkA*V_AAkpX&MFg=&xL$ym3G@
z^oSB%?P=04;u(jCCFHPJW#wh#W?KbK07&#s?Z}-^2{6;u31v7}A18YjckVdmMK^HP
z3QV??@u_1EPvoCZlH*s^$XGdMlMJ_&eX_inYk2f~$LkZe*YRW*DBX7F#t}usH90lD
zQ9-|Ij%_7YxUNNI_{B~wQFwrR$jwaU8?ANx9Bq~A%FA&r`%-+G8a5DnL?<CDh$HV4
zKtqxHP>0}h3-O5Sd*{!wKW7K$9M1DfSxRXXf;3YtYzY#b)F$v1x*R@A3~~^-q9am)
zm~A?H!kJc5Pd&X!s_RZ+S=sGQ{s$W2kBn?#71es4&q@EV=oR($YNl4lMlFbIXoj%~
zJqbft+ipM7bxhz3mCVK~d)OW?U%uW)Uw^>|*uOln+NH&00#@HpGs@A@sxy<ot=0id
z@BAXT0n{ihuxuaq2b*JN28D*gqwGNn|0j^yx_+X}zzf4k=f-$E!<clLV&UBxf_%XA
z7FiHU2{X$oSIu}W{8-T7HP;L0y=NY}5*iW$(+aB8npFcImeRlMqWLjTc(G^CC{+cd
zKQI;{aF8l75Mw1S)wODHms#<OO7W>byWTUzc2MSZy9vOnD`VUR)mioer4ta-v7cj^
z)h{fDCFpEX4XWH5QQ{=`q2`!1uM;flZv}JA*r}XK(pKcz=;&>o>*LXplxT<mtuIg-
z=&gT)43@%qDCZI@Qh}h<<zh(HD+R^yJEAm-yy0!zI$vXTK{m=SW+)D3`d~pn6m6^J
zt=p7<qwQxjCJR2>x$q>3QVX--yZylm=;EjK?|Vr{L~tb1ci1YYXk;F`XV783ggef>
zQQWI19ufQ1TT*uCF(N5*iMV1?a0IiC?r$u$LZlOZ{O8>ZOGF5>jDJEoQ`)>zCMV9r
z-5s8^Arb_FFILzUd2;6W*t@<4nQ6GN^@yZuhH_KwQcvOPP_YOZToAq<cO}Vv*O@~i
zJ|kemHPXM_XXih%?oFS~JY`O&3|3NQEZH9)M29`d$7tqj6Id#e5<aV>xMCxHbXuMc
zXc`q8tr}}o)n>7tRX)fB=?4E>uj6X|`wk;r()X(LO_r6bE~x~sNI|R?GpBo#L9-;#
zq>{0$?A=v!QNs24)gSDjxzN22O{T{KQKMT$o=uOuO~*Az`y{RQ#>O##Lb9TdlHk@P
z4(?2Eyb~=AHY#CQJ(FeOmN@foQQpcHxHTAU_S1dc%s;s8kHT!@YaF;$t|IO$(!iQ*
z)GTFq67tvgDc4Bxi#om#6a_64dIuGB8X^5fc>}()oN*im93<aP;%WofU^|p}o^Xa7
z&{!gT$?G;lQ~yhWYmDQ+!qM<wRO4Su&3kGHMZbuTcy5<=NkPGB8$uweHEfsl^UHY$
zVq=R-WGk$26p8kvLecySS))!w7Pn;T(3>37Wp%2XEaX{%O|3}=`;iMpMoWMbI*fMX
zq!V@RQyv&J3^v_aFaJ?igE#A!Wr|W6n#7qpw#s?t*DckP;4pT2u8Sfs`+emrLzgF_
zAu8SH<SLg#RX_rC^+Xu5J<1@g8&QUs7S{{Non<0-{(AAf9bvJa=BP3*rE**{;;G_-
z+cH*nC~uc@$K$o1)$|+2HT`hmcLKV~c?Fnh_*O2}J^L)6OV>=r7^;pA$jL-VV?@b|
znZI!)L69O5b24_MACt`ProaF88OMkq&c4|1ctmoXH;tBdCPOFI-=Xzm+Zk_X!Eq<5
zkywviN<UZP?_;c~+nUNd9$c;CZBcUp)5!OSa)d9*f*K#i2_Mvp<=Z;K>2|6t)x*>C
ztQ|Oyt(Zq{&`Ja)OrtC>k3WB;iVP<R4-YrOR9Wf5<S2wFYp*eMqMee6Tv3A78uV@~
zSR8y=sMjx1-kv48NnN+X?~K@MjFhaxSv8H1jQ#X9SIJPt3lv73E}p!9rP93C4;xyp
zP@H+qg2}QLTYCP?9u@5s75Xq|pwV>wj2&eMTvtb=Lu=cS!S1pu-l95~!`p}6&x}ZQ
z5!^wn5csul16xL<?8=3IF3Rd`@0@qxv(YV)%qZrG1ys#<nII*gQ=O;f;kuR;vj&$|
zlngh4sML4tmhcnY#05&TY8UhX8x&xdM^of5loTPvv;*LcKxmX26e9-<<;%-OfK;H2
z0(Vw>8r#6kEI6TMy0>gteHgE0>TF7SbBDEvJRe5hCt1?%*Ezdf*E$RIem_JUy~oaP
zAtaN6cPw}_NeZ}kSydDn%kZ0tS-|S8T4Rs)3@y@{Fb#e|x@l<%OKiDE6f<TVm8!bH
z%#z~Y0}n`)fVv4E6(hWk3d*&SO17Kc$b4^&^RCG@T%iKC6{WjX0w8KrRjO)6UAAmH
zw{j~nr((x}3^RGDoj-$rP3%Ck+)J!9S6LlNX{`yt4UB)q4yPfMm3`=-Is>{UqMaVC
zsEFv*TPJ?M#a3%9g6-E-`-x%pf`{xYy^4<c{MQ5Jh)oE>fIN~p)D2PmMB3(7=_`Tq
z{o;g#*cpSh61c-l%J4%)ZsOe}a)!l6j9hq+F={kuD}dq+hrVO%QbY0%qz+LZZ_{5I
z%VG8sw&c~))uI(<S(O(kw_&+=YvUC2jTUM3;KD<s_!CZWFl6hhp1Of9x?{gxWRldO
zjSc5)2O%!I_hAr;Z_y>$=FlLM6BecHL1j4cuB{lEmz~8eFDxA2p+q+ahuShMG;Mpm
zgt^LLHSllDO-*awL9sf3C$8`HqqRHgYiNudz>SIW{LO=+q9J1p8cj#Zrt+04qL3iI
z4ggsXCHFJlJk}LP6D69}iz`P`$>KXc@gGCpbgzm6{-fp}#?jd%;G6NGm26wKASyY=
zTr>h+`&sm@<L|Cnp7X(8RCXUWs!qzn%`wdP&k+n#n7w+t!2gkM)-1er%V|+WAxaD%
zU1YRZ$Af`4fMT$wNGdg~(US4FxkY%6@@%h-8P}Qb6<v?4*>6G+7^rM^{rV^SGET$%
z+d7tWRP;CO`o3lmlpU2W$YdxHr7!`EdlfGHUckGFc$!l6yAO+U{wvONo?p*KQ)_HC
zF+~GHvs}_v2>N^f*>=dmMee%#yE<i+j73DX$e93yj~Aj7aU(2F%ez&-eRer@)h5R;
zIj^a#rB##Oy*8u5O&wpIH3jpCYA?GV)8+Urxd0SbUY_6bV<%R?k(aE()&!|F`ws?n
z9ephFgL~}5zcxk{W^TG+qT>Ca<gI_Y+zFTG2OTAv!@5=WgHJv~t?+kMgP+PccsP*F
z{Rmf(tc?-vCyuk^;}6~w^VFr7(sEn7`b&hnUwl6DSnGa`r+HUl*Ff0TuI7HZPv>|x
z`K?9VqL<T}uI@uM<F=L1{NsVz;=$R&xqeoOxQTurj9oBO|5RLX2|d-I(_!nm?}hvz
zKGp70ZTlRqxa6;=5}ipEC)TuIGzLH}6JOi<=C1eTZ~piB|CgUWrU=FEc}beqPPDBh
P@MG_83wrj>qv!tz(2r6%

literal 0
HcmV?d00001

diff --git a/static/nic/nginx_plain.png b/static/nic/nginx_plain.png
new file mode 100644
index 0000000000000000000000000000000000000000..51c9c9a52d5e90467dc09486a7992ff083509aa2
GIT binary patch
literal 119752
zcmeGE`9IYA`v;CcEoDkERF<-<gzPH2NTo^C5E?s$8hhEdNkoUpiIA;rl4UG0WEYt!
zM8e2ULfMxPWBFXudB46tegA^b?K3}|<IG{^F^|XNx~}_mzu&KUaM|$u-rWaxBM7qh
zg1#OWL0GyGggFAW6P}@*J7|Y6b;MoJ(=qW&n;!5_6F9r3J#Tc?yRGOvx4u3~ubvBa
z{BTc-p|0MY`O{~)&I-m}_r3Q<dhnn1rPG2mdOdrUn8@{0OoFvik^h7>iFh4WuRO$U
z8jIXd4Hr+<9RHc0GbG$sZ1CigK1y}1%BG;o)+whlx6<jc|9W=7ZV|En7e0DVJs22Z
z`uo9NB&B@3t{CIJV#jOk_xyk^LKqkb7XACbdb6%8^7r)iPR`DTe96D!UAr2^CK;$F
z5%u@sqj&UiysNA0(Tyvz)>VG}U%sG=pVHr~uLs;-8%tV^)HeOzI}lLIZ@G^P9_`jL
z>4v#3Cv#JuK6TWW)D{g_VXb4u^IOd2=8^AWZv~@SrPbBcLiX1jFFeHJva?%{@hCa9
z51H<9$_zGDKDZf+y%m6Ft*kUEd3+83JRuCttb^XTgz_9rG_zjQo~9tF?@ut^ife|%
zid1@x)Sv72o|C8OC1S@|I5jQ{-EL9PMZND_)_Tot;@(@b3s1`{N<HcNZ@aU}T1{xj
zpM_DQ;Kff8_h6B}=ZE<Iw{B@z_tU3OL#2t<GT~n?UAi>+>ak((z`zSDTW4ofl663~
zRk;`Ofu2~?>SkMMS(!~I?3nDew;zVOHa&fonI8PzEo)ia)J;rwd7I{{fT8y09q+Ff
zBy{k5MOo{KPo0IYlg?hcv{!5XE@u>du6Ae-2Zxm87#^`y_MYq<__zE?<><4&`=O^U
z_V|-N@+Lc5RSd<f6tdwb;M?!{X1~H?Y%J@yjpDh@cx*l2y{AtP3It9UDWaIo@tg)(
z9rQ9XIi+dB!OY&{(%;t!lo1WblM)yF1lpYw_@~U!qO5sjXJ=<LVoTC|@%r_+Jo0m9
zW?)R1`F{t|owHv?i9)#OUcHDCMaNO4IZa+EIF@N%v-`i7)GN97e_I9zAo72Irl+SK
z^?!%L)z0z1cmMx>_5c446kMjky^09FUtFnv`oHt8G(GZ$M|XNWV_H4A{OI4P4A@ab
z(?v0fvQ|`7%-<8<K&q>&5yYXzZFXQVItBk<P!D{>RrbtJV}{k&gC)n<dohwWC05H@
zQg^*=Y=mVirxh&&ei8j9v$H(D=&(J1{+x-D{CVX<U#!`~zqi%-6u0hajOwD(@5?hy
zbO-Xl6Q9J*t8c%?X)L0&R*K?Ap5pW0zc?Fx+1U7=vvNhT(d|rX%YVVwE^GQpWOa3Q
zRCxOjn_Kx9Po6~?2UR#!!%%bCL;zw?o^o0;BGtWyzico-T5G*M?)&RhxBASj-x3MU
zH_`$ov-Pt&;DR$D8)I^z??>abV>=Ah_nsQ`6VI=lRWrxO8)kXJ!o?0g)J5H;3I*;l
zer@nRE_A~|W4Y7#&j@GeyVL?o&E5aIcI~nz{P|YLc^0|~LJlxq#87MPdP}kbOSvUS
zl1+$eZ(pB+`=AC=*OVw-bo~=|-nHVLj87S>KC6;vQ!8Y%)@1gjqvPIO=r-L$fQ_+c
z(>(LLjP-MB%p<X?<9r$`-yHr-J84JLXDc}~>HQPK6|x#_4GUCZPEl5&fS;l~CjwLC
z-~D%by^Y~$zl{Z|=UnybcWIlo-K`o+21uQ;k!Hk`Cp;Ul{L_jl;n>}=qo+|!L#qqL
znVWkaK78o6{wr$%_Je<WYqi#Mid6O;l8`Rs3>wKI^1(id?_V#<H5O5YqG6{6Ad!oP
zY);vXwkWlI;5skB)a}irk*S%L#5VC?QsbJ@O(d*bEeJRevRXOxkd;Qn?%H?Mpzg|f
z!3gc`wYFpXcZ>J&Ie1X`ot_mHan;N@e0_D{PaT^Uf${RI1HQt95!-U}<KGjE4c{}~
zb!#g`;LaBvzbT8Mf8gi-(Ctlex`XZJqQm&pzZYsnD#hTO*20H<Qt5_s<o4%ep8Tor
z@7aVuH1gWSFkTcRX^t-n*$jA>uZ|_;VVO3f#AEqVB3(&mHH0D)xX+w9gCL|694f<z
zLAu%j3ZI@B7oWpr3ybK@)gj?FE&BAV##pe>z5lL%@8bssN5$Q0)*My+7q6GY%XZLc
zJcvB<rN7@Lj~saQk=3Vz+w`GrO8G=aw4X+7T+k2kWCe$v|1^rJsi}SG>!XLYEN;=~
zwBNQoK{I=Md!uzv<M-OCR9cytMM@gKjyYa?gs69%=g_W_n-l-bfPn|$YTh_==H9#c
zdUi6pUS!W}Cfkwv2zq&bpKT1k95IH^fqD9D(L*#dh0pT#=MzzSVt>9S)r1$fs<9)5
zb`3i>#!uDyzgM)N;TYF2QYhe9i~?HMw&V4s`Cws4*2uGj`o~6E51>W}-yUzdJIA<^
zQ{4sB_2nrA&+mFjgO1+~&8f+0zcFtP{?MB%PdP>YR>W%iZ&1~ko{>m<p@2p5JH&bm
zOmxwDZ|X)h#3-D{;cI2W&7-SJo^&d;Y1|W!Rbh7bZ?-sR-8|;?b9R=JAZdIOk0+gV
za*{AqpDBs2qccMG!-IVbIcC+nkzo}M43S$+T^&CE6$=Y?#BaKY`ix9rTs<U}6c3xm
zhL^D~;(L_<A6b2~YW3=#{J&+<Ij+dL{e>rP%E7WbSdeh)7?DGnV(<tngnpoROIl~-
z%a<>l3{()%sydMtQ+@nhe#>*itd2kPk=ikt+Zz+f+M!xcWGr@4Jw2Kvvxc8oxV;B3
z@PIR9{vPa1?C5Z-`rHRN=a4k7Cdqf3D}9~=-raWZ!*=*Br4H>GUQ_LsHp~A|AHlwm
z?_15j{fDaU(dSw=qB-Z!$)WYf7ODH^fb@J@=+?eb%EN|xoLW)6y||6Fwor<AoJJTn
zJN#75!o%bfc$&UXYU$qpT|QDPT*tL`=ie?4E!nzJEX0KT1jU?$gDL7RF>qvOkyzS#
zmY|?uCX+}wnwv22IcxsksuglUBYkjHtKX;3_1#QqpFA9A(C?SRjcKa4=ZoTk_jFqa
z${4DQgvYxq?%=f~*laB(z5D(3;+13j9~m57SS|<^Y<J#|4AZqZ)P9NtO&Vv`A274L
z+bmnTCqkF0!2dJeV<dt%_WE04zhS10Uq+$zuP!`BvoblhWjx&8oD22)`8*Oq&I@?5
zI(~k7;;qmr*F*m+{T2)qNTWHvN?=ooU6LGHWwL$coHR$@$(Qlcg><6bS=sd1ep!oB
zmma5jD|6DaH7}FtxKej__h>!4oL;%*xoi{N;NVUDRK|&kZ*LcbZn9JO1Ux@*nb!oV
zuCK3)gx9_E97SvoH&|X{r@tGGZTL#Ocs?hpyR*~9XXB3AL*MEtD~mL<8I=aR7ud-$
z^<QSl|8H?6WHJ+S3y<GEp{)G7%vpJzCsd{0he@Ob(}2qrkB>5zO5EB#46i~$o+-)&
zx|?28%*B2VG<hu)uYdi=3DSue1wQSNjgO^?t5V_UV@b{O6cM4gxar&gKi?b4s?}90
zgpB|2ZnVMCdo-G<@27u{oWVBbws`!SY;UM)E;2XRq4P+ZC)(-Gojbpsim!Ei`BK<@
zBae#x^wn(K&Ww2s(_VzRY$cU=uGd5=z^shz{)A;x^H}^$Zr?*w)p7ICpTv>T-Txu(
zE<HRx7n0RDi#$88tcF0H2Fd%#?vgrviW*ib(G>nHqQ}KYB=xfta<ERT*tGM>eJ8W9
z?-a_p<JMJtkf>6twR$(!mK6LKf5ew}y}UQ)s(Q5g&i}$K=|WbARO;uaM=n13^ZE1V
zNJRglWbI5vzJ*kx8|(ZnqDeZf_g#K&)7av@nz`D|$=rev0fNS8jMB>b^WnZ6#fh~a
zkBumwBr>ZSeG*TvrOyRTBo}n#zqcFt3s*{{qag1V_v9H8u{qh<zxL@y)y4{IZ?Wk{
zorusK5s)0?M}&6T3R2@K$r5CmlV$L7SDdYiv8&IV<g`$qnq_K3g|FQIj<(~vVoLn;
zL1-}?+h3fW)0{4Bm<3?4wu|uclxy!DYa5%Pz9bn7pD_se@^&0uhUyuvFrF=f!ab3*
z$>3y9uC{+kX+PWSQzAGcAi!hzcZqV9utImJ3~-})kU9u`CrP5Lm(}WZhdsL^>bbkU
z`($f37O70n$mFhcHSe6+nVHWRNo`)%_XSCEHX#mb>9N;~dlqLk553@}4*yr(tWC2`
zns(j0)$#SK7b_u7Pb_{Zc&H3FRcnFQ9vmDD5k}1MjS;-o$Lha3LbLTg-FI-U;*i@r
zyM4&}x~D5V|93n;$HWv<Vw~}K_OHKwZ!P$3XduEQfckGtqz3p{-ydmyB2!uVl?Mq&
z^ISbs)7RU(hj3|xUhwVtaLMXO+W(b4QHPe?Eq#c$&nHft7}~G<?e5*X#cVrw4pzJL
zyu}-5C)}H0nULAhwkPjqLBn6n);{QzS9k9{YQ`(^Sp|vo8Nz+7j)n6$T6d$xd*B?2
zEF>VX@f7`?k+a&6hK9!5<(7qeE61HuR@7PmP_(y-<!rfJtaKg7>~GzSbt|jh<d$3P
zT@eU8-^a}~QfT3_l@dRK*Q@-;+11q>mTi!n?Z(JAPr5ogH_l6*=vdv%y?_7yYjRnc
z(-T>%bpy3@QyQ-5;oTGM)(;qnw)a|2F^5I-n`(2P7u<U0E?VJ*+|KSd%||Y34$^vE
zn^j%iS0457_ga^dNUpypD3B9op0s|E{ud!IZn{&3|M>IR(V$Mxv?Z(VL?ZUrc8mgV
zSy|acP9MbU=OZtiZT`a7>S@^j-x>vu>%V^${p!e~7AC5CD>=4A1!S0w`e&%GYibC;
zIfy``q~bB#U;ZFP$%$rG?WS;Uyv%F*X2<Ks+`)Z&_wJ2n{MgWaqpQgJO9A8OLkACv
zA(z+6Z)N(#%pi5L=7l0!!Rx=jP4^Vz%L=!5U+Z!5OOGmjqquQ0#UNvS(yVq}?)F5h
zX6~Z3Sp1)FVLRBjzJB@Qq5p^bC0{`KgGv7`MDOCo=Cva8X^Q74CD;_zeoZ!M$P*%=
zrmVVJvl}|l?`v(M!eU>gnU$cG{{8m9z@NkyRIhw+Rt^}0?Eeq8=^OmZ^vBYgQto)~
z1;lY{V~xtHGk>VtTY_FwD^Ry1W1@U5NULr>NpaMFaEe6UHp2KPD;%|t$<EHrom$ms
z<8yHH5}1&HDq1Bs9fsIWw4^A#_e_&T&SA1SH0JA0`S|!~{q!HyLz1YY3)gf}1}Ta+
zb`Vy_me!baYFJO6JZXr<43und(c{>|hTW0YKKI(q*DUYe^Sz8fw{~V5^X6NYFRtXw
zJi-uf!7Y~U#<is@-~1O(s@{LvLM{DCkBh09l@ynd)7`0x<`UXYLbBow%qWy?b5UQp
zZr~*NPr0R4jK-?(mYWC(3=G@>p%@3@p5Rs9zjyc+g4S*E6_`kHR#s!GYml4pd>|EC
z2HkRxiPV@t(ENLM_@7y^qXI9;gDUd!^C6OB!f-<?xCr`0>@6q+TeGvL+Vd%lJm7O5
zCpq>!QIwz?bx*S`&`CC_^5~wzy@)f(K{raAm_TPr-i;V(Z<aJ&S7d~l^2w7SNZnaX
zwkJjsC2AXU7j2LEGxRc#ENpo6v9S90DDjZQ&yF(4luGQ&1hp1E7UKS(p*Vz)@U<N$
zJYF&T9EX3GALv|UUbU-^Xot8UrzOV_6^!J84xCY{R&apJSX1I^V8&`7)l<tUMhDHR
zovPqK$?eX!vRGrjxpU{vR&T3QB=SyzQ}9sj9z=>Rc;+E?@=FtEgsx7+wlp?7ftm2>
zu|%J|d{V|lc40aY0(;SpzjKKlH@%?+kVc}Yqbu_boTuOjvN~=q58vZ#s;E#)Z5~su
zAJ)w4RrgB6R5n51=%~o=zq#C<tNUE!`@*{&gdnW~>Ld#SU~z1~cZdYf$?V_#oxs8&
z-$fn31tO?8_tGyR(O-X+;A%sv5yIWOOk7%T_?MD1CR8JI?S72tf1|c9=@2LUbG-5s
zrz}(pa_I72ZSaXgM(JC5CQ>It7k_*T@e>kD#C)1Bc88qTTWEK0dS+%hcU?lW%~*~m
zA$da-6^7J(`S=N?fM(UPB?Z3^qQRNFd@Izc`B;t4Ho;sC<(RFZyOD`){MCw(zxkcg
zMoeib)+NqYu#(=M$9dG>uWnuf3aZ63P0reXEOE0=AFV~3<7$^?W<bG!o?W6b3KSf^
znT9(?d{HwO>PE}ER+e_>>xE$Cx@?jX7UK{j$>(qsCEA2QCxh?p?KKgLfA_^Rt-xG;
zW3$#$cKa-9;TYi(t(PSNO}!`?*NHns>}(SP1jjV&goqGJD17*sb_(Bt{O36TYV%*I
zG@NSeQnvrn_@-#;XD#DTt>H7fDapqO-yxD3E4-)jXzO%Z?_)vg%>?XGN}TYvDl&wK
z?0fLx4t~ZrXsApV#l`xbZdPEud93u`2#&U)gAOh8ac{r2nh2dXk(ERqw@sX9Q+>H=
z_32R@YvWo_NK3c$xzJttCG2G^@&e|OQ?0T5`f=VN7HWe$y?rvj1Ec9fVeR6qr6rt9
zb>mBGMT+>BeWo_PMG;Hfh@NZ``$5Qz3w~8hb(dw6q)n@9do%^5qp06j{SM>J*LrZ$
z3LAoku_2#v>H#Y6`Z3RpgY!#s2A;G&w$_16y<e9P8EcH@4a7FBs>d$b4XpwiezIN@
z+TLYm6KwX)5)rRm)hjS(lvigbE~uMg+^ly!tyWLyM){J-<jtdrm<xMqRTXV2xcC2F
zS$P5*p)NpO!|>g~k(RS44-c(2Pm0(<rdJ}<1oNj_cMwESgS&<&kUWKRQ6nX5Jh>4T
z_?HwumDmn6>w708DEs+yyF18HB+6O&7E@G4M#kPx*B6y2$wL<<C7emxN&1J~pr4ve
zz;3}#Ct<}<VMF;i@?=0bQ%9+#1R^FBcM;J)%-z9MWs14RY3r($S?dXxMoEx*L7Es_
zMAO<koV6CT#pEI+l0u<S{4v?S?4qx4k%U=1f_;5gXEG+zok{5qq~O<=kM;Wj*Qil!
z`#$X596gJL&z)3VmYXZx{q37yRl?#W-KZd~%<bDp3Rg7bB*Xp6XzRA3;X4b@NqR2>
z6_P2?#RfRQ6XLd(f(y*SPNGTPnF`}OiJhO<f@<7<??AD9O(3sa!Zw|WQHW#t6NqLl
z8}#nBy7zLmHgU>%yfs~2_%v{olEfIE=*EkXdD(JSM3HZ6OB0akpIt>MNCXj<(#R{X
zVL$M9Cz9BA7ts42Ds&gXe$?oRc>>^oHEuHfzDWx0@94O#jkG*Hfp<L2eeF6aoyoR(
z!auW+ruD6>%Nu?yMg-)DRX035<`<v?kVS4kRN#e;y(NA>>$Jg+M?AVMUAT*qH!^AK
zb3HCAPkB{WNeU12UR*#a*kJq#<Wkh|9J2Lq+XP+eE**-pgfwxG+4c<V=w4{E{U0VQ
zrc;u~a!pB-J(R%Hfwl3!6abaJCK7MFAg?IVdY2|ACs(GXrYf!Ro1-_HpKP*xbGarH
zax$v!Z($I_lS*h?XHi9UICY`Aq=SbJ6|{|c8L<!)#&<-V;5}}RmP=|LQlRij5>a8p
z-(f>85=KPwEM?h|pVQM-zHkGC|HWopkxkk@5ZyR?jt|k7bUiYvX<Al4GHJA1G((=E
zjKgcE>mLs3qR~p-@LBs>*|wb&Q>t_^Yd5K$lpQ+r@vx=2=<oYQ!%t8&M2Q<a2~GWr
zuH*C?Rz&hfJ&vvfzqVF0H0y7zC)s63N*5u9lX)n~t9}`)uY<Hg-H#xKhq*svvW0hx
z9#xHnS`;So=hcKiKYk`vfa;G&vl`K8v>L%WrJ6Y-WPTs9^OXqd$x-eH4#WhT=tlc}
z|1^F#LN;zd$y8`ts*wp-xrkBi@f0w}b8!T3n<%Din46h(FOQI^0Cw!Vt$YUrb)(K$
zbqlgRQ&irz6#Z}p@Q~}T>1oR=zm@=FOgR*N(+)>d)nbi}yS5r)M>phB3{LubdynP5
zop9hnTmUzr3DJ3EGPdbOf+Ac&p4JqlEbp$ItD1?xuo=`GL4{==BRZPCmJQELTKf0X
zkL|UZ?RZPsGA`sryK|HGKy=fX7qr&e;zW(}D6V)caIW~7Dm}5H!ph1(*TdZY)d`Ey
z6uuiIO+Cz7utQ5IV#ztY9~t5Z8?FRkcDdWTjUx<!`he6?t}FWQB+Ts+eSJ~#N_iW$
ziSr2egJvq^mw3RvGyEB@PHh>QJ>CP&;pi;P+Q#{IzT2_nm7!wC&uS8o$XOA9ARNOI
zd>o6l%){sNr_KQ}BS8?7e>XUBwLm-FFzf1Z9=ZrYj%r_YFS_x&W^iz@3?(^K2AXpD
zM2xCL`kjAo;_;*N?k}YB7>$s61er${bsn|wMqxZq7j=Y~_B>%7T`%{Gl3b3gaIzd?
zLI5S(iheLa9$|Nje(3sj2M2Y(tFO<(y3)t>=1ed72x49x;BDsQG{HMtF_m9SGB5gm
z#igPDGM==T<>3ihZ-Krfi{uRh)WTBXC!XBnkxOokuP>$6ILDNq(xCE4j@_W)Y*3;l
zG+u8XpZs09nYFLVbL@Du71Q2PKOrG*q?uEcenD29Yj~?CSRogZRk(b^oqkX1B`)0{
zBaG@NzI$HfRa&U9F<Ng{I9eO6TXm%0rX=8JA^9Zt*4!@LD0hTFTen6ynG4wj?|kvc
zHW}$lO0en7JC|G5)U9r^GigYNCvyz@7Q^1hcwA5(TGbv=X>}3RQ$~f|pd@z$4Q*GT
zUjPy1h{G3T0?9Lyc)A><5v5q*RVh&-s1T@?*-+Mb2@j~FRDH=%b*I*}GYu;i6{l!R
zRqkrBOBeAoO1e=?VIs-bNt$O+3gSG`-V%>L8AFGxwf^&E)^5>|>55qc(((=#7M6BD
zjoBv{V#7m)?HKB)6BP3IchqE<>i9;(jc(N-!;pebihlSbg0i-NL?HM;Z~TI!5i<c)
zfQt_m*n#Ol9_40dr!4;NFshZQYNg@uuM%W*qaNQAdB<E=X$m#{Pk;Gs&LnKeXV0`>
zxT%6mnOXy|ayK;V`CFvQ?+bs}0AOofD|d9*vndn}u%4Pfm2rzyon?N!#uP8O5WIca
zq2)yEXcf&fEz=<Nq|8nP+e8gV$4L>7GXLQqB;uwxrHETs$|-#w2EFVz{?iV}y~;(>
z4XGge8OAo+=h_#2lY5mAZ(sDM$G%9#>DO0cx9^=hdrZUTNgC5)0gd(y!r13&A(FBf
zyuBL{z9TS!a%geVXseXUY|}m#e$37Uks{tf{^&-Tqghj5wEv`FbmV}UeG83{nnQ~|
zfh)T4$MEp89r8fqT7<;A^%T1ATU^`7eEjK0r~p;<6OOLdwltX0HnDv?{M*;sI39!s
zkQj5AdrpbcFA~njyK@@0<dichbjRuY5hXs5FwG^$?jrdiv*i=5*Wmg~rWkBNFBunk
zfWix#xS2XdBS};2i&j}wPUBsfH1f#S-=JcpPWYdoBsar*N(Z?YPsxNA;_%YMG&_<N
zkgY*fLEpTc1P{p~qx+m(8Bee$Aq>V5+txJIT+8m6M_3x%AATg0aq&WEy_`()v|b6|
zWy~1hOoT9{(MC5zvkI5ec0!xq!KA^UT!lo5F1zTz^??}Sh0j#Et1k1<p+oMHNzD_x
zMVp{4K{niD@Fx7<HK{oI5r>vw;CNO*RKdlKv|WTN%fgg~kMTc%d>CE0El5>WLxpKW
zMh(urWy9&8u?obBn=vMM<9Vb|#qK)s5d~XPx(g}Tm4Q3#=oXr7mF6f<F~YS(f_S`s
zLj6<@(;kq1WZ!HY5BJC;8^<Wj?TXAad%d@+!+Rj5(SD%`>YRbEuP@OEui1v*752;w
z)vgw}GOgVYFoM%gnv?J<VK<`DhA*Vmd|D08O;D50Y%ADZW|4#;4yr>lmZg8#YZ6Fk
zCryYY={)idgvGA<ZYaRaj`N{HWp@mE1BqBki59KY2zK6@R__5LT4!ffptJKE^W!{n
zl04BvEsn)T_doBDcdSOlb}QTlZB+eIa(uoO<XvN0?;L_kz>YEn9cr+l2_s)@_@5ri
zc|ULIYL4GFlTD%{aIMXxPPh38OmG6(+Y76Ks!(o<555G+*h)hvlM~6GlB!bSMPd}R
zJ8%#ilX>LKRgHpkcv1uN6$>#4xq~r>54#eh+HU&-F>R}o6%-l9B^sWH-R;owQU@J$
zqJ_pzT0TNaerW%V33RTM{TY!GL=%i8)3A-Ere@ja49&`unQfdmN$NSiR>5f)o=#5z
zlxR&?Pft%ehKPtf!nPupd0WLpJ8>3i>b|ors<+1lhzU~W_*43l4*_D;&7a{w?EUm=
zHI%s@9M4p8YE9+T-k4tilxYJ>m&(iBT>J=wuaaZ*dpGc;6BK>X4_AN>r(YC{S0RCR
zn4gt3AqNaV&>R3q-j(0K`%Qnjc@IhVi~(Af42O$LW_-H)chs!Px8Ghqws8w^8VQzP
zyQg3(L7uR2;C?OJgQif(K0-hOXy;EELJONKpp;fyn_pX7EA3*@Gb`i}1NXqk!^7j&
zx54a+e8aJTNKT9`$*OB;DD*bSLx<B1qk-fFHG^F=4{iVJr`Cbp5z9L0{(}$nV!f<<
z73DQvI9$w3&B^9jO2o36<K3-_?9U!4EQQiG=2c$D*Kvf{iOHtqw1w@{DycYDb-!;h
zP%khu9=E^TQr6kcP3v`e`5G@Eja(=K1NZLTGsEGBz77s<Ex4SdU+<cGyhHdc+VudV
z_3O>9zf~;86D`w$D?qXQ@;&_cQ@0dRi2BC1jc@7tA1Hf{7|B&OLenA!db<Q{0k8~u
zR8K<_O!}LI063P1x>1tIGxFdQyJ99p!2d^ls4``vnUAI0JC5y<?Ec+tDACgW<|w4}
z^0A=v7*!#{BdqCtj@ss>s_qG|@@H>9ba52wqEMn+a8bJ>Y&;ln<s5!s-%fL#Y?GXz
z9uliJGS8sdAbCI%vRd^dEsu`K)7w+<;>7(mbJ}*K877faF5g6$>O9k~A(Lbp5GAFw
zL8#uBB)tz2^3dNei-zylHJI0E1N+065)xwOZ~h`dZO}7q=u)!$h-ur>tp3r*nNNXp
zP(c&{grujZ$Du^?IotN-Pt}~mlphz0+m=W%7zgO3x-`)y962K5j$c(4i=?ivGM#?6
zKZVIQATY2QTpIqn`L6j)6XfTuA}5Of@DQq32Lsvi$cO6j!kh(0V_JDQNXq2_ha3!a
zP)w3zmv8LK!`xVJmnvWv&0sHH`si3(QCZo?r916JIuJXmv2V6kv9{-R$FGOjCTqk|
zI`b1({*-BchYm)PefZ6F#Wli&KM*HnD|gw1-T|x}ln(#%ifqc1Y~FRAD<q`CTqY><
zaQ)ETCa2tdB5|xwH!8Hdt1F#txV5IHW*>V*Jv~X*D&Qgz`Kh0-mzvzojH1*r2=Wr+
zYxuoLASC|%P|oBbyQ;(*=aRRo=IFc_$%}UKrq^WgFUdaoC@xO{iAnm_R$?7D<POeT
zq)^}}T5uK#*qZYwPyKhF%`Zy3UOk!G1<L8h8f0;6)D@Ot;|0H<69gTE+~o?C2cTEz
zk%QO?w;QI{F~}5C)qrQ3ADWdP4yI+yYln*kd7ku^HVORnB9x9?<k{=jjvltQwhl)K
zq~k+ZcU9$)3u$gmj>QZ%l!tH?v-eNUknl>GHYzL-d1fM&;;g(Ik*DmJ->7?DQM+$G
zXyvU)xF1g&Tlqa&?=pqY94{=J)a;F{hofyyQZ%H(RfhQX?b8+Dd!R?blb(~cLi*o%
zGU}V@8FP692-dc<FWc#f*vysST2qW_qxV3M4!VwS30m><jxEUxujNGsuvbW4etRjq
znN6e;y&zxQ$u{xIBYWHFyldZezsdRDU60v~pQ9!P=QYKuUQeNSuJoN|Mkm$>L9_3P
zpJBzz1Pz70Pq;rgXwAj5GXXc{InpfmR8yIv(lD^^1Yb>7V%skHAi>PNVYb!i7aV-o
zUUMLq&CFKqjisICj6Z2P755DH-)<wFqEvP9-M#`rbv4^0;JU5tv*nRU;hIv#AL?+?
zFFrZmGh1u)!1@=%5YwLj0?@}p-~j^gGbza6PFv?Y*X97VE!Nf5Wxh(7V^?}D47<Dy
znu($L%vuPNd4|vV$m37qP=Z~gyWW>crAY^dLNlj_TJV>=;eck%<P*Pm?5I(OOT%}o
zq+>*TO7dIu_wyjIYy-N|#7&(Mpk4q+lMq1|Fnj!GM;mNyPMpPN!;epoFNKDN9*HWc
znKKKUWR|zQX@TFALRP+<;q)GF%PbHA#<L*-8+kP>3$)U?9XfB&x~BPd8bW0V@Eg^b
z>=0t7-_U9$F~R-Q#L^jyDVKMKOO1$Z22>VL9dy-u934L7p;rl`pcO)P<aowH0R5y3
zk!A9D09|^FLKYz09lB8+2&5JNQEHqvSDno{Vd>P*ra~Vz_RIE}veyZD)G>8&qVC8h
z<)#&68XOfSbu!m2F`Yn?`IQ{?BG8W?Do{Mr+V3{<C{55z&&9eM2S$%@p?Hv^2FdbY
zhK9EF-fc1=v)PmTXazQNIQ+|o3peO3(aS_#Ob_qMOh$fw{+b-ErWdxqG-l&j^*vA}
z1a~E*rlt<PAaB`2V}Hxp`R6C#Km7slg?Io3!pS6#@3m;nJsNQHzazDm*Kkr14_A>+
zGfvw%9H}$(QJ@a^nA~vm9Q#DJEP%-}z`ZuHy_uH|b5l{Gv5FLPL~2iR>BS?Dpv8~G
zWGm&7BX^5_)kT$6{NsQ0F&DgTMN!d0G$xzh?*1PN+z)L4GK+xNwWWz0+L~3T7m~(5
zr}_q;Os(dW>)<|@Xt&@y6zt2u8799hln;_vbyMrLbWrWX{??adlMW#S$YeOl8;4QM
zDADWLCcU@j@BA5wObybC6G6>h!Mx{lNW?;GqQX<x1jOh5-4O@zGr9jX+M}Zzr=gI~
zr81BwCi?=A*D(sY>gwv<h&jt})~D-=;>0TX7E~ttGY3ix|LDq4==Ot}xi+apOc^Y>
z3o&Im4c&M7sERO0pWFuz56yKo9P$O{d%vNc6A|$$w**xm{cC1M2FPhgVrSny5x-ZU
zCa@tvl1CD-?re|FcWrclEc}3yOz~*_bGz=O*?36JnYOZ3X->(~!$Icz4|6|&p6@b7
zkZJhIq}KBCa@R%4q5Z6PFJr2I&RY(xN_YRr@OTq&4*)ojRp!@hwDzP4gd2-HXDYw7
zUjFyU#SI1`JSW+8FuD;3`Y#{fJH9&N%*>2$#LQu&VfV0}`u*EL8veY&>)5lW-oK!0
zjs&!n7LcUGgnFDsy~mB4#wqOmAhQ76*)YZj-#E<8Me99{Su<{1+Ip&gSk~a^<1F}m
z5zzT3VkZL-DuSl<DiX4oo?Slntx2mP#ANle$?{%MY)?M^^s#cb0)KCgKEye3#Oz7C
zBGOV<M{vR8mB9Jq4q}C+g8`c3<(3O@q|9ijqoJ^y$A}4N`xmtJK)GeLh^5=7rkubj
zGt`C))KAVPQ<4#+gqDOSvCViK^v)-*2m>>iWN>u*Fi}Gr#cW(n^GxIwkZ3_g!y#)h
z4`+^8_D5kSlYs3~g?3>FK+l79%kla@GI3LmNFhx~hPd%^RK*Nf)|bF83!+YgawD{B
z_$m!2I6EbU@SSq&&n44BeFdDZX$WoKR1xk}1y@uYm#!X(thSL>VkZ0fO^pQt<mZ+<
zFonBB$DyN8MPB6G+V~EP-GinyC;W^J^f%8E7K?%ExfDT{=gV*kwm;63`is7G0(_bQ
zDpkA=gOTwZCc!=pD`OrX8ry-9JDAcc-~W59biuFRR4Dlv(M=|)xfe$-?<sbY$f5sG
zF*H^_sQGbqbErI@KICz}LUF);Dc{^Ug$@n0+m1rWBsgS(Ngg2H$1$(F6aJ3@j*tP4
z%w?Q%AH0It#&9`o)_k!(Z*u8n(XTt}gz@q5W<hHCb13yh6RFLb+S(zDiaWm~Kotrw
zgOVRTG9*3d`yz>nA-k0*fgW>{bQaB8G=Cy`{&{}Fq7!cFZ0x9k62;`cA{7}P44k`)
zY>1$=NC^k!!u=xA^;a;}SMi&s4lz%#Qj$l)(Wr^>LARK-`S|lf<*##d+4H9k5)+gu
z`V2Lwz{G_I1bZyz7HKrGwUkWW>-(iQH%1{ED7i~$R#fhFYMjdVsDDRQjKf6UnP609
zHD)KE8fm@>xJ)8%oh10`OHzUBOaYn;nABywi`^_4tt&~C>dHF5{$M0D6Q77xM1}b+
zpQI#*C3qbRDga{H95E-~>I#L8I-naBhmjQ5joN|mnB$+5x3b7SPZJj3c<d@@s?i%$
zp(H<5cw3^2TDXdz!4nf6ze>1(pShGVaUcQfjm0>V)HD6ZQ=;Y5&d!z429Far-Xti_
z(6@eNOe{xIqx2<#@N}R4^{ZTf@TQ=kZSS5v{cjT13lqHBA$138v`I6+$-cEs2e;Dq
z*O1g@Zak6}XQ??#tm3Hief;TqH2V7~WN=QURROw#Zpcj0NEEc3hcwzOW>s3*NaRxx
zpB4@+bFUH#_UQ(}#{_=w2tZ5sP(LQA%&~7jSuF4oSj>~=G4mVAzUKREt4CELFQuz3
zFJ>EOZOx@PWt3mWNP?MR%*+2r$heoPpkqP7s>WPd?C9|XtPhlMyu79Stha8I>Coya
zjHFy8LxxOjJO8Krfr+=o!4>1b{-Tq>1x7=#s>I%opYRuEns>#|gdnXC8ttj@*1~Rp
zk_6=~SwR+RnxpW@o|yS0)%^ZO@ik!msGzAjB15ryV&1R@sO{TSp^!f#+u`E8dZ3M_
znO*w5_?J+zJ_)jPqCxLb(sD2*d3!fB23;Rsb=>4Peb9=$qvHCA<QmR~u2cni`DaW~
zUAbo3-90`26}0u2v|bSO7I%}DA0s6S<3%E<3Lt({6~>LBK@10h<7#3~DQJthsqKRf
zG-uM>RZL?2C}>Q94K)KS$YTkkQp7+i5et#p`-Z#~PYXCf=)z3}A{xn`9Usoo=eTqe
zfS@{$-z)$^?coHA`eX3W85tQB(AID3Ms44p*c#ly&hw$+q#TNaMBaoyeW>7j$YCp&
zoPYiKDdwN;xFPBAcbtf!+ONYb4ASx@vRz0UWPiqHryz&Cg}U+>lGza7lHAa$*+B<4
zV3m}xO>!vFqv2;hoqwAS$WV)rF^|j3t}smWc~M+^8&<VcLNmKbTGEYrh^&{;%Du`r
zq(whS0?X5fLe_!?=O!oD&C4yf9)O&n8%1a8G{*yE93FyqU&Uk_iRbC2H;?@T8zesF
zwZ=_ae#mFttj0WC4g?Ay;@ail?IqAmfuEPzTTq7R0r5QqXuX$jNqCQ0-PTcp=+J6k
z@X)r&@=mB;Cs1MRd1RnBB-lkm*oVQOV}T)lRSygZaKjL>Mf27!s4!a+dF6RKn<*x-
zgtlsd7w#>&`FJN`UTI#_p+!pc!-8(q8k=xX;UU)d#v>COA+~-WSdrAvj(Zt;9&aLs
zD9rD$s2kOd{2`N9eu$v9UX!&{GuyTYma3W-Jr9-8@Jt$4mahev<AXCtRT2?PAE0dz
zze?Krc;T^Lxd^my64vcF@F{&@<4USOGH6R$CXrX+HteFG3*3b#F?=6j8hK=xB@Xt(
zIj{zmlk)Rt?U6X%=*A`Jmeg{=wE*U(Ffixb9kGwCET7V&3-IKLh`mSx<J3QztNpi)
zfmV`NR#yH7?o5}iK4yZevoj=#tj^BPZ`kY~d=Bdjj#HqpM_?>IW{#l|0Kx8CLJRl@
zI|&}O^>3uI!HVZOR?7$Tyg<@pyC_MTqu+w)ii_wus0zf>1?1L4g)@mqo}Nq93|#pE
zIvkm{TXJleA%~>{F#@I~QL1M`!s0@ZmbT-2u&nGf!>AtNiPpi~6r}#D1lQg=RjoCK
zU+D!v61Ix`TqfJbe-6a4$b*41+9*xMGZe{3+ZSeKIi2ZptY4~npo8wbAlW=HFkoaK
zllKSykaG1&&{GDOhEsl(u&;zRmErgOfkP(z<2jHUK<cTV#r#6%rzR&)#$5U6{3C=R
ziq+~L{tEb<ay8d<K$E6=wT!c1bXo*;^7rrGdA+)HE(XI5JaZAP_mY*B)fz9pHe&Q2
zJu!ugC<TU%gC|C_z#J(AuLmVrmDal}cC^2*r)TZs&)Z;hd9zQ~pdII4HIWgRkv(_;
z+OCY?m7X&}Lvxjkr_NrT9|A#<fPO()-TV$~p`B7z?ySgH&z=m44KWu%zA^kSs{j#S
zCSrk&(RdfIJb9ivX$-LS1<3ODjsILiJib4Wm@R`}+?7A2g<I|s=y3!Z6yUKVIH}mc
zZoTm3=P2_dXq@|*ip-CHg~c7Cggnv-eA3h(#Dd7k$YfoR9O8X=Zs_W<{p%#MwjyQ2
ztLN<vqi44`R%R!sThTnWO7L6mr8H|BW8=|~jZtAL^t|j2drIXG++Pv3OXte7EdOfh
z_36l099@}U46bnXhIpNzDDaG##AAqQnAbP*R;}+ZzdGMXV`~fiz%toHzHsz0I}|}1
z%{Ge>|G~Wg8npNDapW)n1Rxlhw$xK?Ab?dOA7!jMWY8}QZo|Bc-O=S8-S3w)d}HWh
z4DFlGp)+m5-|a^BGbu%v+Rxpp{Zz-9vQDZ(Y-FLk`i5(edcjOokyf*vw(lz=xp&<b
zmA)kt&DRxE2Rd$pC-&o$Cr|JeI9yAl)^E|i{{D@nV(>zLYod=-O$KAf)JjT9s><Q9
z@tiaGWB#>ba3hdty<cm<w?iWPz~!tU5*tsRI^_=hRtCGv!rWT=KcU&&VCj;_&hVu=
zC6skK;%B5>8D0(W7&k%(>1uulk3Z{|!?L@0Z-M*GK1?ko!1ZGAK*myz8{YcIa#3mS
zbtU}hf}hc0ZdI5?5kb)`@C9rhZxa@;jw~9Vq4ll;=-uSF%HK>9a8gb&%-Vs3H>B7c
zXFm$8#h$tDR%dOVD{E=t7d>2Eg}Yp(sfPw?yhvqtgwMx4eG^h$Z@Uy&N}k%l(o3%K
z+|FA8r-s{&%&uTZ&s@z8$L3oyFpCsMUbzUmi&ghkNWdo@TF!&1d$!&~L8<G@7u(gb
z-NP-Gj|UnQyN^4c1Io97#@sY>(|Euqa02D_i+!v#s9hlUb7_dqz~EBvSB>wanb93{
zt1BxUkbIPpKX1`5`0GS<qi&1EM;%YZ?5rDls9-Y(FlBEl=Y_!xxj{$u?wONz@@2)n
zagA=&iR%`<HQ%bg(b{@SLu9RQWtNtPve&sakO!RZ6;@jvInxJj&rFCZKu1~E@S)ss
z)G06`=IB13e+g2u)wP>#BZYdEYz$uUMevy$YuN>Wy{%^e*HDtN*(Nw-xE7+ix!%XY
zR951JrtuMVb_B94*c!D=fxCFRwY5dx$;MW2ED^(dqqs*g=UlOT;n7~rztcK1hmOm?
z6)=(`49+i4HEer*lxw#Z+w(>SfmJy&e9Zd<scZjCRk)v|JS!-elg4Dn!eg7M#bn=%
z<bSVlrhd$?6E4RNgkhecjC!WFO|VQmB!)d$(Sd2DH>IVe2*M+SQ@$#>EF(Flijf41
zS*3lE--vrCy>FYjp|R=7@oU_SH7Wg_lIW#QAF(MZD{)&Mbk4LKkMbdTbYA!ZcFp6K
z?>s87lXs||A%}@zEVh15u6b5nz4^MZ99)$z7~a2s33?@m6d1D>FOs5Rkc1mKclEY#
zZquKd{ZX?QCv+>Vk6h-!Sy&9f_Ued!a01T2!w>Y586EU-S9kaABlBS+-#7ZXBEr8Z
z@w~SW4uBU*Kb$vTDX|ePXFb{5-1o_`_?n<&Ywm<kYEHKda>BK@<d32GJrmoBkTQP!
zb`B8YvX+liol~!F8upf!o-77~dk3iBmjG#Kv&a)+7dvRZz9nU4+i%~NdYgZX(K*q6
ztY)qO$Btl8MSb>`jtp<S&%c_^!9D3u$8v&xF<AM^1gwp>m9IUTHMC`7Df1~*sO#O{
zawW7HAj<U7tbm|}_CGuqx&+S6pnY|549lS%aY>L|tn^)+Ua)5*9r~F*0c!ax=vu@R
zF=XH;Y$b#;SD0WhV`XLKA6V*MgfZpf^rvQ9oY<L7;oGx!Z*cA9W0wDZb`;)uf8uK7
z?LvMN_jEGt#bTs2ztoha_U|ue5>vOLXzQK~Q{=ZXVb;IqUG+%6<y;$0UwEz|=W6a&
z<bV<tDhxZ%@o(DP4+IocRQ!CkGKB+FIRO$}wXjHab8!iJjLi`|olf?tCY!RLG1<)t
z*sNP5dLFrLhmLImR*L{`5N?JvC0H#Bwco`><21%U3jIAlNNf9T+gZ)6KciW!I`V7a
zNSkY1TJ=f;%L)?d{;lw?IP=Zi`qMpZgx9ZM^V>at%N{0j8n&?;7aFp*IHp-Qj<=Yj
z$j-G(aqhiH{3;IT^sUg21!`?H;B}6gxigYGL_Y{AT~D^wqT%=){yHNd;?7|tN#wZW
z7Nye)h`p~tx-DZ6j;_d<0a0n=9oaT(+aYw*xVoLsl`s*>5|=1Q+QXZ_rzZiB_z7&&
z0q{p6(OE{BLf6XNtcn6c6a7D4r4D?3WW;y@BJ&?ewKF{H?|`mN1H)YKkhT&}^rj_V
zQ~0#jbOB|&`SvGJhtDnRgi{CYwHvf95IYyzolEjfq^uOc2;ar%>lH({Hg4kZM$mkb
zv@ajqpAQVjUgR6lXv%q3m8E--m&|rtTkrWc`N1TQWngs}X{uujM-PEsa*!aA(|Y^I
zLDSM};KGCExKC}{0zm_q=B-Pet=-<zGcsx`23}BSxFUZ?A*0*xf=RU0fo|T)tS&j1
zW=&%C6No@BuzZB5rE7tyK9hYo42Z3Da3rV3C?t8`xnpT{lYRP%xXsFS9t0R4p_oQ{
zqt33b>PeX7;DXt%Je9?d;=aB^&Jr+>)-+P9%NWu4{wph!Cw4T-t2~GkIb`~EXpHmq
zAHK+_DCcHtOzAbG@PXd<Wbn9}Wt&vIs;s1UsK0AVvj3ryF%b-4E%+)vxCM|zkxyXR
zP%oW^6Ado}a@H6u8w?6n6VO;FLXdyg8hI^3QjWS%x>7OWuU$&3IfV*KVdz-HKGT7z
zei>yPb)$&2nZL**{ll$!fM_c~*{X#;bZ+jaf-W6<WZA4F$NwwBxOJw)&PcEb{kyrj
z8OQHX!;t9ZYDexL!i<>Q!&ou*`oM+0bt}LKhFmx6>JZTR?8jSD?!omlWcXzdqh1Ez
zLo+wpbK$%58^JT_3L>y8(=q%E4v`S_`DSNi={FK#iYjUjP5R4E*61_K!zSz({ScT(
zwjtAm@)Fjg$SYg0#dBB3DS%3RQKGGE@>YA|1TEQYFKA`j2+dw(K)`fYl4}CidJwul
zxtzB(fBj^dR`|^_z?PeuDFz{|b-FN_8l!*@M{fh1>HyZD48sP-xpJg+zpem3$F-^+
zTwgmpZKNS=c>(cRneK^{BG$Z2c*>5@dc7&hnclv>HY~Q$w}Zg>R9FkF7enCnOcRHe
z=Oy}k2x-}fPN%bhJ2A8-;VpxHABCK1>d;b|N9F}RdXo!*5fyJgVBd?$D_|4aiQK@?
zSkZdhpe-q2A?!0$vGXc2-^f9K@4_~{qOBhl{jiMy7XkL%N`#fxoBJxkFx%u7%jH84
z^jgbkrHt1sR(s>@;$pB%bnr-I?Or2hkFyNx9edU><QqdVol<GdLaLf^7VN`DwBGX%
z6|`-D0#VzeJ)NANu%1I+VMRQV9eCHka!WTGP>;p^LVmoD0>u6nW+4u97l6Fa@~4oz
zq6#F}tAtdbV9sl_1-c*SY32dl14_uR?+c^U&=y?a{RA&<{0s{s`*C8)>METVnTAm?
z>xqh4dr`gJ4K};y;;~!V#l=hAFX=jgz>bUO*7lz|bt)6Zum!d54Xbk|)jmtW)!g~@
zl}ebHn4hB=&JDmgG*qFvb7Jw^ysS(x<OZ7?=d9dhH$vwVWi6or0eZT~T+hl%5WIYc
z9G)^v_;N7|t84l7e}${IU6K3FpyGiXo|EH=Ue%YZElAKsv(`S<@PB(Lt78%-<+h8a
zDug?5+HAu;9!p^QY6ciA32l%tXiYcvuvN_M*G<bN*YMX>17Kr54fa=BZ#gD=iD?hh
zpGvftC{csPuza)a5;c5F^I<s+oDERhwYrkaLL_e(?g%H-q=<t~G1t=c4{Lpc5q19~
zg{e>%UpOoGJ|_#krD<LH1q@}a(b30daG)~v?6rD-_0bQ4RR3zUeT4!ABe{>(dk>6b
z#MseeNM;G`3B<##(S<+IczX5l-QI!tWt=)tC;TemHi&MvetyeLpj1NG`$GezwFyRv
zNtlGl^Awm^MmSLH%>p}Y4<aa0F&a)X+yiMz!d76i10=^<%#ZsR7MTa3>$HUfrxl>R
zW{46uiJhx43O5i=B>6Z|Lp@$UNC&g_5*o>hH;)lptM2scq+lq1Vd#34=s3*hp>>Zp
zc+7A55Ie8xMg=&u+|!M!!&&4etUH47*lDoJ-w8UFw`>-FbYCZ^eZ<jU&r_2VytFce
z-8k?vpuWT$IyK9KP{ABnNQ*VbR0EChlA#|oF{u5EAT_B3ZI0?j&FvNyqa>dXN8dms
ziJcY@$A@ARguyx4_1a@~PsysRSh`^)XcJ=q4;b+4$*4*ujJih$56RJMLL)%A{5!+L
zBCbPrw5@J%0ZAFAROms*#vLR~b}3|g;ITYwA%N8o3a%LyC@e-S!DKs4PEFB+hvt9|
z$*fwR%oP^a#9cRY_*+4bi-vdMED#&E`79Asemr)N+fjT-FuGA|oW3RH&=Oc#S=r58
z2T}3*tXRCZ6!Gav7zUCcT&y4XRjA+1em`ZGsDXJpjSYO}+wVaGF;PBP{mfEUZf1IV
zL%H6-7x?MRkUNaZEkn%l17ABj9<vZYyWxD7Pd_0!1~Uzn>ZzXxdtivGcB&$iM^_`8
z>^2MVeixr?-WYvr3^8;Ev~uQ8fVZtPQxxPyP1=_)@)A7J1CtfARbXry2U?8IBoeRR
zg4Wdl+sgja#y}RGBpiyof8P{*ew8#_;00ILnKY<_nUJ$W75g14=IGin=U&d0(n5CE
z*$=G>GxAFjR4i~2Y+eWcz=`3C@ikpuazi!&d=yJ{OULW``6TZoz*wR=%v;-lQ%!bH
z*f0lT(>Adbx}Y)V?9lQSzPMlxQp`&v2qDxj-6b)Jz?kN3P~DTK@+;jA5PD$@!knKc
zq<)t~C-`cFrHPY}hMj?uYHM)43Np^k!`y38kfRqh=F(qAKa02+`JlD6b$dx;4$|s5
zB$orsBKsOv5fS^Cy9(o@*rqPf0dv6-@*13tn-FY9V)6R$`L*`eaf0+S>_51GZE{C0
zQ<B-?a?~8KeryJwJS#9ue!*??)<yiCILUawZ2jWxPVbYcG7N_Jyxz<9qX2djurI(9
z--Dx917NktImxvr$3`o0=o54#Q;21fVHPKB;X_a@u2PauV?GTB2-|~QCHVxy&=Tri
zwLoc77AdO4A7FGDFM@F@ot1K#ZJE~oGN8b~cFew{;UIhVbaWJ-OvE&vbopk>V3dBs
z1g30^o>({7?HZTfFQ2>!84s)hZ<r9gYu>*_LEyZa1mM`$U^`tUU&w>F05D>FAB0eJ
zV+an$a&`>2`e|58gwKQcd>D?C6Jd1zzJvY~#u8~B^>pa=+WBPrcevPPI07x=O!8)!
zE;j39{^+A+iTi22Loh@WlKu9QRASB{KE6M-aK|!%(28y%PS4I-GYsAF3gdS~KYU;?
zrE@Sp=>;^+I-QOukv#;Qbm2c3di{)WMy3G-zJ`$5seX?$ssd8d^?~;;rJfX&B5u5x
zqaPyECYFIQVz7#qvc5(R4x?1K3(tUBoFD9gE{?Z<JQSFdeGPlc??5M_mM#mekkzsM
zt>CDaA6j(>Qfl2F-V8QQ1pMC3K!-{rgTpGV7C}SW+^6Lz8FRpk(+@cyb-}P_M*}ie
zExqMs!=o(l4A+nbdS_!BJO@;(7=EV6Z)=45AYT7fDIi*tU3p9&fxGXUXv?fc*NM}5
zPkl~3HTOMH+Dxl5V(UxBOYTBg;mOCq)STf^{Q=BvBh;Sr92^{jAR>f*8yw8oK`=Nv
z3Z%l!^o>#LqCE0<7*5>}nazm#ot^J$q)$ywXtxi2ZvS8ZjuXE_9-5ifyUij3Ixvv4
z<LgreW<Zhd)G5?KEuay`T)B3hkPPsCyIHdDX|$y#v`u7|(%g!~49z?7KPF(@TC+{5
z&SRzOR>-Pyx3>|<zMe>&f5xfo%g0m@2v%hRl|-%~uY4)1SthkZDWXElLErS#*eZtu
zo&ea9R(7i^CzPqqwQQhNsBV4IEvD<#&?<RU<z$sm#lHjbSR4X`{QVdOvw(~VT31((
zN7N)jXiB>cqeVitB$Bt48J-l!(dN4`JZ!t?v}jWEbFUgoa=d8%()i~?{A$2bhuu-r
zbUbYr(*u2(9wcNiFMpbk#_|&wy35|WbX0Md#YfCH5!AVJ2UvA32WKb=P_NX?*_fUv
zQwMN=Yjb@$6$Wp%##LI|!OBFb2ua+;lf3=nfLm1)c)@{~qL`p~!Bxm^@(4ld`Ie%{
zrr^W<oUG6ws2x(pG_R(v(egYO3IrJR7I0Gt@=xOnfLq0XXQm>V{a)V+Es5k0cE{mx
zt*rCQfa^ibmReq2&4gi}%z}!^oGdO=cFykH*XhTC{G3SS?=ecPkD$qFF`uh6P{Cb~
zTT}m+@nsM*&Bu{rL^Y;oSmkE#fn7T2ca&srY|}QAJdpACXJFPMw0=oL__PKpObszI
zn_1dn(;1HLQ{MBL&zMu>7AbvNrBw=fLn002Jxt)%jrs&>rLYe?rl9r<f}b%RX6eC>
zstw0Z>(vI&4w%jZ=Bk!j_xe3p@@in)*$56*&4lK$Ad?#xCZH6H5P*hjrF!VR1>p%8
zR2q&QPvT(tEeI9e6lF&ubDn?M?j-$QGDB|CbaQFtpF<81OsDyN$Mx5GB>Nnp2dNPH
zS7!V99O?s~Kx-!m6HesB8nDFYxY0X}ja0!fsCo>=EK0OIxjx83!0xV@J4Eun6G+#s
zJoj$v&XLPJPU+sX4gJH5FgoCcMYA%_DKbJ=^zmm$w)z!AXv_y6GZW0h<Ufv|$g=w9
z?=E)KyNup@lT)K9FF#DNS752*3>)5&a=2}&-{WC+RDz;)&jA>*J7302>-|=0^75gc
znA9}&k;3>8t(W;E=RxmeW*e?J>P0@Ge}Z`l4%`nuq>{)o2uD1&MuPi6RhEeq3BHJd
zG6k_<ad3&y=M3hWe-o3C-|gpxH5E`{wcxX*V6%S<1CnOi=*Cr=qJYP4zpEgmSY-nI
zGRV3j#N*-oBa^{>P4Y{EDVY@!_UFX$w;b5oB+}xliNiKA!rFt3**-VW%Tz>JLC@kO
zNHoqHN5o&@urm#OOkR=v%Vx|p2>kK~cVI+A#b?HM5aj{F1vDcJ&e7LUhu-rotwH5!
z^70iszDRXB(JsyUH+M|%J4n6H+ChMC<<L@6RzA#Rz@-b{+#r`HFN+Mr_f6!c$lK|%
zp3Y40I&%Y5!JDLX=F`BOJ?DP36X9m4qGbt3xcGz&`zI>$FJn^vAC|5IoXWP3KSroz
zq$D(GNXZBxGbyF%RL03jRytV;*($3t>WhjpA{35&>{W_VNH~hDBqF1PBz(W8-tT(9
z>w2&Ea@O-a_kI8Wzx4;v>@r$9R*_oxc79RnTU5Sm{vz0vn%mmkclpOFhs*nc!?0y5
zI&&(BH<;y%pnMf7?9UfeT9`~}C)2_lTv4Phq;@*ju8Gnc0;}P3a^Pn!I5OK%NETE`
zkHMwMq1K3#Bi#;;$LvF&Xf$dopH~g9ziJmSrV16JSz&Bv*SB3%+J;khG;H!GAVYwn
z5r~v7EEApBmxs;1tuHNA=4H7w|5P}D51{g2V~pOD=@)(9*`SDXC8UkPl6POO54v$m
znq}|Lx@Rj}VakeE+C__g-49!u436z%psI-T_rxNJZy=I{qbN-3?0Hku&V6ucX1IvL
zMPAL%aS|XyKWV&ODu$1WvIt3vP@!1C&0!lV=dKbi|FEE7%C*YrjyJR^`oz15vhQ&N
zYv7*cWAVq9dI-Ni4>ElZKH^ZkhB^lU8LF}68zmMY$$n1aG`2HK-y2y=6f8nlmq&u6
zQ5hg)PfA(`^0js2`ZXHtsC_6CJn`ODLAdi_mCT!W+O$qM!{yP0Cbyj6woTvkOfiEL
znyWPqb1B`vbgN3^LG}4+OEpwSe4jGL71^|KW~xKeI7eKvP}+IkIasJTT+kmb@1|bg
zgvjN+Q+c|ksr3O#YzqEf1Q0Gg>r2icz#!y`I+EIoOc}q&P_@Xoh36kce`&hf{!AcW
z0co|@dxAKpKR1}|7w}lyMW|1`|8VfG^qdzCWLV`s!}?(;O@edzjY|f!Ia_zjJbTz!
zb8p=%i+B=zJHGS2D=|o3)`OBVHz|5zI$oP-=jd}c7zXgml3Iw%xbCDr0yxGFX1gVW
zX)UHRS()A#@bp^?O1+ox?R+A&nsw9;=>Y%89|Ca$o3KMV<++Wt|8KxUjxgMkJPM|I
zjD@ImHWRp}Gk^TlsagBRiJGiag_%MP0+~6?olC?X@qJoVWpnwvO=8pIn(^fp6_lZD
z$devXBva36eA;hNl<TJC9~>qpT=kK>oxr7@;>IYwm?&G2NLD*VvnNDNwnp)MY-jKc
zSaBu=zcXYg5@evu3jeWvNlg&BbdcQ~8jr7#h_sQ;{)k#QmSknif>dfQX(ccO2@WXl
zWQD`l-pJPWfW7wP^c+L)Ng<q2GqMTH-br;u;jp;D+4;)k$l>fLe*;PDpi*g`k>Oz)
z*E;`@G?!~oDugn8_%uR}S!g<P*@`QedyOz`-#k#s+j;l(%C;<X84^F6Hl~r~K5uVH
z`Ke)n5jEhjDb04#^){}E7(lNzJ_*XI9I%uGb@%{y3?#Emype+kzpe99U)WWPoHG9n
z%R<aP{6%~;UQ<OtM)od0yg`PIFUKe&9cWaO^8+g>!BV-k5$3n|Z*0e%n->Y&ca-PK
zdO-9tx<Vhh#74K?eI4=qOimty35|bSW@I}8z(lIX0{Qr9_NM*oYwn5A89e^(5E|S^
zja$gVRqH&Th4-#^?Tj2QA!+4tcR)>?1o_t8E7_l}^Yrx06`EK2JqAgFo!VMQxE9f~
z`+oN5T3{P*M0vwPpG-sLCY>&NA@tyS2+QJgnDe@NUs-?c#iJWWN_|rK&g|!s)91>G
zADd+rTKsk|dbn~Usd*S^Vo_?i;u8mOWe!O8yNAhP!}S%6sExR2T38MV-RE&{S|o*s
zaR1yx0r~AqOo_OfC+bN`h^B=BGG#E^a0V-)vzHURL7!3^+tKD~h=cY8j_@OGu9ZB*
z$=4w#1t5&}VYVMhK5;_N!(&JE8<dg_Ln9-w+JE0epVT7b=!Q$+j&pxF;Nj<F>Tbu!
zK1_Ja#Wzk{?}*M}oz~;{bHMV=9_(sFa*GV;u+ad4Baic#b>n5UeeQKa8=f_q1MBl=
z@lOihHN*o85Ty>bgwnLkOb7I}zv`fI*^UL>hBJ*G`Fjz;AD+_lVAvFllM1TV&G+kv
zK=pa~9zI;33+QO!IG1zw*z8^OdK)r}K3!jD<~KLFr+1Jo)9|nk@$V7Y0+l7}|Kgx#
zP*O7=>0r&q69+@pnnq|c^YWPkvlR=f#4-?DEFTf*Qh|cDF{3>hIFyfe$Q`ue9OKyx
zH`vl@QGSD{vIs5iqIMj&%ZeQO?o+v4ieo2Ng3Rq#AuG2TsO4K!2Q{O4(1zDaxXMJb
zUp0`=4=(Qkq{8^Es6M#&nzzOn`o4bDeKOEBNF;lwGp3fp$_3XI6hz!*PHUY5kwn3#
zZDjdI2LCaPQ6M3esZa!#csFfijOEX0!d0F$b`B200mM6WsjG0zD6zC~i3xIv`6e=a
zb)iwvg%M*PAA2|N^eQ%jHWGuM?oP9}?z9K9G0FCl_1B(BA3UD$9xrT8Hen-x{WgHF
z7;UCjCYwn69i{oG`xmkq>2HnFfY-}w6s?tZtGcL9oH#Uc+9C0HkhVeSuvpBBkDZOU
z**M@w{u$&Mje&f;#<WIG*(RZhYE&yzz#>SnuJDd4*qaKu6qK-Yc$6OTCHlci0q8ap
z6-7PO%S9u;JHru<XzVYjZ_+P>!7Db3#>#+?-S&6I!ZrfYGZ8G8^6~ZRg(kYNj=ExB
zS+VCOl(xJaL$9+`P}=0uB^Q^8#tpY#!n0iA4zmU1JCcU5sB`9h_!gwsF~0UY3)kPE
z#16Ga7o3L15jpEN-xzZ1H5p*jEtjb|n}t{)pL^Ktw>px?WC2XXms%fm4EeMnI&H(y
z-zW^Cfy7`=j?rjnXQ$$!T1ej)+qjcgWJ)b-vuHyG5ke+tfT27enzCW`Jm{fr9L7=c
z)eq}rkmm3JG(_l9d5@Lw29);*q0Xwu2I<=Z^~Q)=WBLKOpbJ}4SM@>7da2wx*)eJw
z@RgD?DGV_9k`<vbweuJ*qQPoGGnKn_YBNnf4iGD(=hMp!e3rrW#EXNTGps%QRfMT-
z=<h?SNW1Cw>_)=UOOh%tz4ZOl!rwhMO6k<8Q>IRjHOTAHv@|5=`mw;Qu*pT9c?qeM
zfO7{`yX(AUlpTO;C0)tBRnU6*%nPF|`xiF^SwzS{%OQ>M-^MtcY$e_-zLS*o;h=J(
zT%b>P=B!ftV@^(0tBgim#nGvs!ET2p84l;prP(_;__`yz<M(vs!kpXpPcM#wqgP07
z{#r-zeouY6OI+OlXcwrA?wz?0ns?@>JCrh}TI~<F(pDxF`s7US8yoH)?7LI2t~0{E
zSR=~+!l~a%%!-2P$vUqMt;Ob_i%t#I-U%<>(B^b-)-T89L%Wx1`?_|l2S%%LuGKYO
zk{Qm5qWD&#O8TY!Fx!k)o^K@Ot9ZX&(7!i$D|VJLO`V^Kf0<nb8NArvR094&03J4(
z<<}JM>TMFTl*VqImXu_<tYGe`D1Q@I!&fpbG|?yevG6-b<XilFg=@X)pyUE*)(#UX
z!3CqOQG%d5{mSs7!^&AP(dWe59mwDqTyPD^+pm=IsVoGU{HHiOQrJBk$Y<_i>V9Qx
z)_t*9gCC;)9Lh<qBueEy8nv-5Gl8bAzpV&by5lHqyrCXxAvL`yhj5m6BLfRZ!(*)V
zW5~Q19US~+m+XW4$DMZVtnOcGxZT(5o%fqtDv!L1${)siz4J-F``EMo$KD%)vB=fn
zq@6o=WR0k(C;%z0s!cd>hjS)Bx$Ee3g#F7D92wc^CHt<W<>CXrPpru;#yLjZK&vZP
zXq$K<faME|4L)e#FB_O2i+sR)UvKT-Sb|QTaq0V}G`E!fuuUbN*s9)!qU5u~w_1aG
zlwI0Tscu<*O^uB9(+F0Vzp<U<IGohhuEUNw{SuCsjtKR<_<WUHudGg3n@u9OXc}g`
zy<E;_3c_Ikuz|5Ge1=BU!w_AY9rRYIM`F{qMcac1zx^*xGXL)5j05N4IU6H3s{h3+
zX0wN{%Cb~JPH+U7MdjKd$%J6=2j#pQv$=|_{;sCehrqNOOTp4Ho&>QI0&@z>N>vT*
zQCai1x%xqZa0=}}199_kG6i+SqS8`Fg#ta6Twq1;#*MAJrqcymv4eteEV8Rcw@2wM
zIFf!(gTkx~`@;~&{$u-nqqMw^=15Fh)21R5{0=eO%lmg#ytBVUcfe99qzwH*E=JqW
z>FI^66I*?3I!jzNVV-}X=jDI03fK8BW}H7KML^tkXUXZXs8?MSH!m-<ZpwI}daZE!
z9JAm9)!gix;wjfdLYAKhM3)wBdg)u7IWp)I`hhv^BNp&Jj#l%@w)7sO;6lWC>;?!4
ze8B4Di#t*;MB-yUhLWxy5T@p=nQd$#-?c%!ebeXBQG(30)kBkIu*2d4NG=AM6BMNB
zD0t$`ukMapGQUVqQz5x=q5_wlTIHuwGaQxR^s~bJZPpMBI@lIR`pKdhPzAr*g6Zj>
zzKe*Hop(vS6z&}rc|)a9^Vd#nU5SE-T6V57n+fGPClS2P_ZRa^>Gd>ADtBXGm!n7)
z{eh<6e35?b+Rm<^winTeevwksh4nHsL?6)1zD#3$0fecfaqrD+R~qpKqMu$@9f7C)
zu)UpKv7VlXC5i|;ls|=N{|5oB%9uF6SUH{A{FRG%>d~r`pZ?bxnLo$w4|~vh4foNH
z5eT;0p8Vi*$!K%jz+4I-x_msZspH<qY(ZR32m|lRV@faA7Cj&O6orf*He^jT-#@<=
z(3ghEjxXyt>LfbQhdP2wOq4htCKrz;vV!N-mc%Kf$mkKf0KY=AQVDzMadY$TWI}oo
zN$WkVIJQMfP}}<@)yo826&R+40KU6$4aJkGd2>QMI~fBWW2?0Dw<Nzq!R#dV+z?Kc
zmD*L*QU^pE)x*#DODT=D7mdRkLp@Vjcu2z`<-LxSn{M_VnnjKCsmv#bH{b4Nak`je
zWU?Znwvm0@6^&h+YdrAu>(Go`&AxPM)3_q^U9ond#e^1>i(hpx;i@d+){f9dWRjW&
ze;~oAd`rMhB4EISLi0I-l2%vZXq=iYA~eBM_Sf9I5y*GHKC5A1f;4;(ZLZy<nf12z
z!yY|J=*ZNW?FUKGU$+|4G6S<!*hXU4qvj(8>Na`5Gx8c@mfv{Mki+!tbQUc%k<Qv8
zcw+z#>OT_arE!ztX!UCG_7(T+KTR5`&#EpK1I-^<qPF~+cQe)NF7tPmcE|x#r7rmY
z^|a8OSUfulsOedI7Fb>`+U*3by3%5?a6r1|WFam=h}Z-i7Qb~53)vDyZw%j=UH-u=
z+z>0<BebFBnnYaDy6hJ!&k8Cl{cvU%S5ar*S5;}L63|K&flprrYwQ`Z=N1)Xg*18=
zdk-q@tW`?_yOjV@q6*kLdkDM>wR^fUBeDcp&LNC~J+w}GWXxLjr!wR*UgebFc>C2O
z5TLGjCk5Jw0Cm_+vOgV4mPJ*7_a8-`x}KdrkR1<a!*;<Nre8}&lZnwb>Vm$WiX49Q
z=Cu(rs=WaML)%0^dmFM9y>NbDBlaA*JtnK!cbD>=IfvE))zm`e?IXJmc*La=XK5oU
znZwcm@Llqm+d}1x#h!zx?4UCclW7rpi;#s>w1_XU)3r06t;m$-lRP$S$U5j^I{iOV
z7QTWz&0P?i^aB&=Rgap#?mu|&;Bj1*WSqCE%=RuIyG>YOeOYBc>K2IVJyk4l6(x4w
zAWxPiw_K(mM6M=!Gck}yeSrd`8>sH&PTB}3oDoz!DJ6gq7jXp(fO~V^xO{agWBvlT
zdsOP(hEjsvnT+||K4m`b2mgbrMk8Jc&`vvVm5lhUmj|%2hxMK)K?T2;I*dqwOK|&r
zxq|BZD4}()iQ`$1LVV*a+$P;Xj1cT<W@>Kk_XYW^87%9C!*;5KyWC;^UQ8R21ogBX
z!e&w0NCz}cifB;ki6fb5;UglJ8IeCMYwjI_A#RUGyyG28g*?}l4%0Suik^p>tVy6T
zSJR4XI-5Z<fqzeRb9H5$rFZwt&bJX#T=H!l6xs8)`;<`<-vJ}lf-~<6N@fST>p_S(
zwh4z-JUq6gY^}d(_UYZCRe^d>ULkiuJ-)GW0|*>w5L(6IonZc6+vchXTvApQKL!xD
zDqodua^$$r!Z6Nf$KlaYhaEK!*n8Gd>Y|y{{gRsq$V*kQ4#HlXksFwu?*J{Yf*<z)
z>pTT2=#2rF>fyh#{WQbRnSb>e=RQ`bDj~R>#!Z=15xl`*yO)dInlyuV=OSD$KA43;
z5DoOriRvs1V#tkeKcdaGvO&y&Bt}dT$w5}V$Wn=x`x2qewLRe8Qli+T!H6c)Lal^B
zb@qOg4;exfMX6M(A^fLd%3H&(1;@>A0JK36yFfD4n1Pgyhh$xiE_>&eWGcW*Z}eFF
zaQj3_#lCQw`Xz$m=OAp)xxRD1T_C#VYY++I`!qt)LvLOS%5C0MB?`MOgE~AWV#zAm
zA00Q)s^%A?Eo8a&E52ttG`w*zz=d2yaNC*CnY=z_Y5$Fc+Mn_2+Zl{3xf(6nTsauP
zQSwXRTdx}%9c>`qXUDbyD7t$Q%=^KO%YhR)p#3W4`y^}`$}zr{0QqrN()!u-oGqjs
zmC>)PKL7mMY)PJ&ptjsZEHf{P+Lke<w)alP^p%iS!jHT?!_a&;$^$`xP)p_GG#8!0
zVD2JPuz~DJAMMmqTdRrfFaA88o*~mPQ?9xmBpy1fZHr!$vc)8bV&}yIULr&x1-J9K
z<)K6f1!oZpHF=y)r%SV;25oj~AXnYgaSIc#V0`19_Z4v#@4)d$q8fH$0TeyOAP_`H
z8@H07O!5JIw*&ZQ?^_&@Oy<*WVRd3bLiS!#1g74cdNd*v2d=1K$Nyl@Dr70Le<Yx{
zT8uq_uV$jmeTkSf*Om3%c&NK{*ZJi0H5g7-pZ~SOGL*rrK^V}{V|oW@^taTz094`l
z7=Q;(u_lyLmYuLDnAys$8M+G48w+7aH?^cM^1n(X7)c$0Kr3!+c2k?{(q7MwekWBU
z8anLM(;cj0)+7%b1IWxO&lr1f2>$In`~c;V6c!;~f;yap?SQ3XY{42CF21N07aapB
z*wD_PZSwc}HXbl`t#{^m6lE*d74VYUEBwu%PLsqXL1p>*)rDfwfLbL&7M_$*kk|bH
zNtS}tb^rrHr_^=fKTRSad)S4D>u6|PR(_Mz{iAyGCXDjWHsO@ffR*vl-`M^<^so82
zBWq7ziqt`5GCf~Hy#4ln1>rj?4TvJM)1^^e<5^uhs(yr~u)u~EexjFzBGqUkGrig8
z&(h;pYO8Gz2nlc&eH1AOr}RE9mgE+nq^(9GYML3;0L@Yuh^ez~V$aVcuK<ZRjbEu0
zaG9~lfB(iEXtucsFcEhHlj3v(CPKvmP^f6RDxNo@85*uRMaU-I%~-Cj9Nq`&v=gkt
z&Y%f1-LyMP#dfhgps2LjLpIjS=ju_#!nq!$FA4&mA`|JmEM=R|3mEDlTu#rXti-%V
zD2d>rjeHyrtTP$$c61!m>OY2`;}vJfo=xSFE4<)aY?2uXyC67)z5u?Z@b5Begiut@
z%OhjNfXf+Mso#nW(fR+K_;LWTgfk>zgTMbD$9OrY{a-yjJ<xMQEL$j(<<QM!)~KLd
ztNoj^|8qIAl_F|4^hRuOxfaL=a!D+J)gN){zIuG@2eB`g;LuxAH3<d`5|vs!75aKl
zRK2^`UE7r$$wH<UUJ_FsLe<$W>*a-fC-@m=HU4?W?=}DgC~+I1ZVwP*mpx103wgs<
z|FEQ~ZO_iN!>TpLMpz!&B<p7Wjarns?HRXcnUR!1Bb#nfR;}*z?2Gdj^>*&cPaNZy
zG@1r|n3T)AXVI&&Ui6Mx^g(-iXXUwNR)m(hdHh;<3N2foy5i~R0PCUZ@BRjyZ!79l
z9kJ(f1Qnf(2+p8*mIv4E?;kwUD9}3=!s1Wv&x^%0D29eg?x#=pj6(fv4t#6Vhw}xZ
z;aA`(yjuToS|?xkzrG<fk|J!G!g}fbgj#D`o8jW@nqcEWF#<8b62+Nb&=`+)=G!$(
zkfDib-=0sDrOG{63@@CX%_RXyf5OrDG?1G3o%b04FtFkPSE$7|t|E-+3}D^pAd`-5
zd4Ssx!S2NA9}m_<5htiSD<71AA_y&3LIM?*JZ)QbOYM%DTw@twJ`v0708Zid+7Q4u
zDYTYHy7_B<y-glf?<>oDDr0=8Z-d%`P|)253LyS_><L%bD;I(J7G{4cOdQiw2UL~8
zm=YpVmWKpRyxFV#xoe3SGidG`@3c=#uJ!AW7k90}w<NM}Z$A7#d`y9y&7&n=j*gDj
z2PASX^w)K;eB{yEeEXFqkS%kzOD+fyu!k0;vf5HUy<}xC+p?uqOT@_jXt}ocYv%_7
z`ONpYJY<06(BG_JA+sQOxjAHVPl+e0b1aQPi*GN&QuQWY(@)rc?iu$`Da(5xe};?d
zk5~7cUxZ6&mK=G3<zk@y)`h99+%ol>=nT2!$fr(K-tH(Qo;yD{juwVz3ENHq9u;#C
zuwWH@))7$N^J#O@Crc1sU^_AMCl=+6Wq2RJKj~elnk5K6*!ad0_&z;#Dw@&VCZPbM
z@)lCv<%;NUM@U(2$~P!mdR2%R5s%Z;z1~qfB$F=&@-@q<g{q;-_8e+?qDXYD<fxaa
zc+cRwOhJZXU{WUiq~76W!S$N#*hS4O-#|`ShHZ+inr1yQQ?}0Rbz9Ix-8v3TV#uo)
zyUQZFE~1u~tAj?MJE~`sU31CzTAtO8ucU6_Cv+O$I0+m!w*W}vOwI&{TBs+<SshLL
z=ri59B!5$43Go3vKCdI1;D~)mN=wC#a9v68fuNe|<u$vPJjeRTbBxeGSsWK~HmizE
z@@;Y(_c1>pd007PvYNE8Zi~`0mb6}6HB03Gu5g54lN}&v{fjd>M<pkb&tU_JL?;$m
zQ2-?kaRzRD?7Wi6JlKhXfiI?}rYd0zGS>5mWB&dDeH5JZh7b^LpfkFEBA|im7X4=}
zHN9GF5dGw96ch)OBcB*a-B}BP$}aziz{7rP*q@^C|5WTUFyBV?BI$J}G-1J@3{TcN
zHy}+)9#MS3RWHZg$^&~pY#8&18-OOA3`#H%)2X9+IYWTbX4*EFIyRdJ@q0dVbd|v;
zB%+jyKUkOx$3`~4jXK=DSPTxmF}CsDbVdu+d>IMh4kLVU_9#x96UUFc7^6!;PqPrC
z;$rh1s-3ft?;S^9A}RLV{MlUQJF0t0rWdQfIs9S+!w3g?!tl-G`-Dui6Y+U+Umk(3
zxT^io$ry-y131a~yY)7cWgZjZxy*`fTvvR%r)6rKa+Cz$3-8&KREhBsl?Vjc0+AZF
z)51rQuv{#(Q2i_+Ghax{=gsRVyQ7nD_}7tncJ?q&-u;7-lx`={)Z<*=8*%OQ^<LyN
zyTRu6Esz9nXJ_mx?LX!lmq%OC=Nd7dW&!Bbh!D^7ZX5dC5e4Cs;eGkw%qLj1Bqx(D
z6hFXo;s~7*OxOdkB|>11yr=c?joph0$QyTsClM{Dm2YH_#JYi=53)-a5EkgG5Piso
zz+WvO5=xQ`>3`45@~2~>jF!)gMZ@*r>C>mls1{)ESHWzUFx7Ab)ZSVZr}1%IJ*siw
za8ZM+E;dQ9{JOg0x2&ndeo*LFvME0onrPm?F)@Q-S-+t>l(7>ziST6sv0A2OM)M&%
zNhk>g;4F=Zq)Z3D$Oi2fjFvqMfc5s}*GvYK8@kCbib_x+uc5NvFWHDk%nZ##%TQ~2
z{B4Tw9-3*$zNFM$;Vw5AQ%tNObGBc>jH$6(`*i|0EJF|A^a?Qpt!Pl@v_n+Myl@{x
zXl&+wo67d<E8b%r$b}6rI?e`Y8A(aU9%)llQu5=eIxHY@<PV^BCA6qt(5ER$n^*iX
z$JTB!F`0HPWJ*t}YBwlUdv=1%dV^EW8(}RS7~SALjkdoH)g~gyXe^)MQHA;L4~u`M
z)d<jW9_Ygl7||N@nMV++{m@7%vjnq34531IJ`St))yUi~p^0NCG{Xp}$$60V$laqu
z=&}^m3FYbO6(jj<70W&FMCaZGEEcF(!Txj&PLawzC-;t7?I>Ok*+jXCG$#(mMC^xR
z#23&MUam0C+tYnY8Ey~czU(5%+%-Rvzo^?m-Gz+lv`Eh+W(mTbwwe1Zg9t+|a~NvK
zxmq+`GTfROO4oGGl<<8*Dr|Zn-|S+s`O~4rOlMI``dp&i7a4rGUwZyJSNm;q6)UUA
zE>aSY%Gu-=5tcGzE@xH$Q`nPncGa2A@K{2!rP(k&cRYY^B9Ko4p)kv}KPECNlCi-Q
zz8g#P`USA48|oT~03(@zB430SFAR8eu|g2YedY84#0v@&<7$pbEN!hAlXw*Ah|(MV
z!fi^XH%6j3lIDrU+!?x|ab8_5EkD-+^1-n>0Dgy#Wsrw!^1J`_UCq0%tgIXzvwBQi
z|HkYK17{gbYnS;=l>Tqi+C7smcjQF5o!a4P6~i9H7GJlt^~19vOZx%m8nqPk1+cVP
zR3_#kW^`dntuct^67kJ(+uX-*Cc5V7`g20Y^NWSz_LN7>IefKkps(EnmtSk!`~#PU
z=vEl=3VFSI*b0)9lRv(D_als?>?r+nb!9`H?~MN?{`ZBl2cFzm!&SF$kw@;(K%K@u
zM?(+$pBe><>pxIRn`%FF%{kOBoeHzRe`V@Q50cIz;)JHsJ!f+=NA85@F)STltBZVS
z6lxpjFSGF~mp#TofKYe?6Wn+AM%6JjFdb()@X^75@%y%p+3r|vEGeX`lb_XV?f`S6
z3~xiJ&)0oHfnIU$Oa0rB0>XySrTD$A<6|T5SB+I?%3UCpS3Df!7DRkTR#w*V*w_LT
zGS{&<X#Vwgd)rN8H;K1@FxvhgBxJDvX+p0xpY*}a)vlGgW?gZnWgmSK>!DNFzU_4!
zixxz|5&?YcvXD{;3(zkoKzp<CzQ4cH9Ey5_D4TCP6GDPpHzXSV8#<L=8fK+{^5&%8
z>T=R*n(i4fMPMmn&cl0DJY?u4a7$X4++DQsmOkC<0NMXJf!Y=^{qv#((rZ)c^f1~<
zfu?O7!GV9-1_MSxK?&k{zOy7iGI2?=UjobG8M)`3_5e<2NV-chIrnW15*dHW#b5sH
zZ$FZ#{%WcrCnffvxTx{lckgzHRGq=Yd6xnVe><nsD~zge<n8#;1-7KU;KcYw+|~Az
zMnBI@3!FT7C;H;9k)2?YPjP)Ogu-tEg%Sg4iavnBZ;*)*Uah&*GIyPy*K7VwPht^T
z{f>UQ_hAnn+(WbxUg*hIAUoh3UGqGB?llUyoyLEIsP!cs_Tg2vS8T|k1{=Y&#F9bx
zAaoJ?H|2^~-^Yp!Ktg5(Ky#(|Mn7ch7jkoR_G)vn`CnG#*AMwSDJs!0+iBT3HsXfh
zc0EWT42~b4s5q1JI83fGpJ~?8)b#z>`v())_zL|0QXfs*8f|v}fEG#}evQz`9~nkc
zJD-?Hll5OwQc_<xK_VO`(zVu%kdT5a|Ggv_QR!*Rx1@q3Ly%PbF+CrBNyS&wbDW`a
z1L}Yk$fTSzfT&3a|M6Gnk(hMnFH0ltxd^Vl+`>XbRIEOrftcS4yL}xOIq5?IpAP~B
z=)`Va-P%nAceaPKJOa0!|IJaDa&Eo+1I3g1SjlKAc7vlLqN3gnRIg&W&CN|sazZ-?
z%Fcln`R^xH*!?UU+JHLadSvba$xX<~crN5(4gIP_wuc4YwcYo>cin!!KHb6Io-Vm!
zi9Lcbw<Uk<o}N1e0Ok+w%P3d3`(3yg{XuReu6g!%F2vb&{5%UgiEsb7npo+8U%>31
zAnKP_*iss$!G}6NXP|%Lo-==+Gx7FWOf5=6zsyR&j_Z4$FOgnR;X8`96oS`nPzfvL
zemK8cXf><D)ANe_O|OIgUEnTSo<}PvH%UCsz@NWjmJ_fYF0nh9MYpiZKO4isp8Cgx
zoR#=XN$KR@&0$_g`Mbv;=pwoJjw83Y64Urpg~Mu~@St>0`(=C2{AeWxP73gkENS@5
zbfAnc1=C^3)ywu4suTehDUNZB+d!y!7G_1o+rc@>OPn(9@cbKzKZ0*p5%KQ<D@QwV
z>!{lI04nH5KLjc<Av1tRJ)Mq0bLgxQL-GMj$WOmB?jQ|}-md?y_IdJZ+u5l!J3rus
zK1B(d8g7WQcPc1c?8juW+DWMs`*iYW|GRQ*2pjdle4BQ#PuS>GhzdlxKDo7@9hF{b
z&AnuJ5{4J~0}468EP(dgG~(Z-i`$!DP_Qe?<K2x_G8%7%TrLB`4DVadb;XagJ}STl
zu#|{CRKs#wnf*b?+3A1t>+*x~SS}}UpWYbT#wzZGL#5WaLNIKf1jHB8mTwF(lVoaO
zXbOB|$Q1X#pW~(pNLXjnF)+ZMl?X;kqtj!RWM#8=a$Q*mRgb*kN2ls#n~3GrE@>)R
zxL3UYJwZyVV?D^%u=y9jRg%aQ-pyzADDvQ6^q55pq-GR@4jEnJe}CTAasDqgm<rU;
z5^g8aTEzVgfgxChktM;Gdl~e<&*%p{qw0dBSP_@v@vhmAA3u7B^eGPrS+)o8y`^?z
zuhGWBijA5=f{0GO`+pA(joiq|;V!Aow@??$i9HX-vttWtt{c%W`gq0IR{QFO9mnyS
zyZ^mLAgn<R_9RI6eGzWHP7~I|47o3)G<+I!Z1%V^#yi_Av2_1=iTOv^v4!Dixn9RN
zP99i~BJXZZ4qv5>TLQGw_ia;C&e|Sw^_H*s_x0}@3vHPtvf*xuMg{W>p{&0uvgiyy
z#TxGt(9PSkXWE&id5x&qEdO!Z<=*?g=*4@D7IV&2bc+WRWmi;almNvQAxu6Z%kgfL
zy}OSRlAroFySsCebAP7XqQ1!ov00PudVTt2H^AJAWj$SCB1&<2P`S8cV_n#U>R5;;
zW4n+MmW=$rL4BUrK*#*<9P_me;3FfR7__zuGs($4wazx2yZMAHHMS?0ox?fMNN8d6
zgEb<%bQT6u8O?v=Z#s_tdo)`ua&pI@c`XD;BSySNn)dH{N8daap~Y#6_nvGPZ@2xo
zS+?`E9;5+}Tf^Ct0gd$K$mKW$V%Bq2c(tB1>@;H>u;x<6@~ZytDkxjf1Nok@RzZ(?
zYHW7imc{$@!rZjxS%^{mlxqHz0h$vg@SH;fEE4P|z+Zmlzm;|!rnarLlWgQ+ZcM2w
zz-OI+*@@(rK2p8<`tO=|X?oh@(E<bYcQT|x5KvhJSS&snZCDQ3MH>Kb7|Ci;Vf%_b
z2OF`DOsPKpzKaZ~CU33bmVZ|u>4f1VS;nvuwwM#+eZk4;E$iT0s-G>A9m*|SNMV!C
zztyFEf6*(PU@=gJ4PbnRsFH(88Bi#QzgChGNY(LYy`L}xrS9*Tju5l2WHwIg<qHtW
z;NA>i%9N;rvT~7d)d1k6O6;*J&?FFtlF#6R@&8S54>5a+o5|`AQGfSuX5l`G!!bWS
z#hz~h)E;ssr|2nlmO*)vzwv(koy+yXH&AMv{0lGXWbMbt;6fo0ZvemH5hO}^HTSlW
z82C)8=G@oSr>*R1OUW}Jar?ikm4!D+N6&wR`1N?WWXxTZ6B92M`<vtRc4ytNTammM
zO*j5+L|N?kTP()!Sd81zX#)_P18ceflhPtXQ`goJ;_bglq#FtOR;+-qzxTdLgYNmu
zeOGKIQrX8=YX5oe+UZONeumEc@|_)VpTj^tlV?IN>hb6oEc(01+6}K^@3$p=yx7ZO
zK~)EbmQ~aDeFnR$7~NGDE8lQiSamXk`yL%X<-e14<i<vVjldKu?{dme8NQr6l>Iwv
z{(wNZftoyPX~z=T1pN7$jsLAQGae=t+vL`6`@b72YUci2P#*)>`7lC^YVe<o!~)&)
zFlphhODRn!SN52b+rOpib`wvm9v456ji*5va!}wLipeLC=UvLl$*K7R7UfQ$ZSXwM
z(UgJezh7CZiZt|D9-gHV*bB=I@cV$Zi$h%JUNI3XfOLRyH=-N-5GR6afcZ2c7{t%a
zZe2sVP0kKH;~)M-4U|(Rg<J5Mo~77Dkp)`*u(EQ&jyBQ=b0Jw4?69J*)aLT9uEbs~
z@$cq&g~=uqaIy7+hOb|t?cL%0pgB1bPxnz;XBT!kj?*b*4)&VAOCeuL$k<>hK@Nq&
z6PF&|_dp^b<Q#pW7Yi4~ZWkK?C}<QC7*^R+SQMpP|885-$(8Hn{{xJFIEX!uFlh?|
z6be6~qm*gM&*|2YX!3TM{*$$gJRz3_BF<46OC`4~q-SLv#hI&?z^HhH-JrH=e1{2n
z9O#q^-2FtJ9O`-}AMQYkkSqCs1E4{oj3d;EZZNB@60-Dd!>=gF&BPqUZ(khn&~6hY
z6VZUY;vW6@a^LX|7;VCz6t%v^O<o2a&0mVj8b?D%<=lwlIs#H5Y`;=}*ZA2&gq~nC
zIz^DRYRu+jHKpa(@>e4a^JzV^T?UiaJ}&0wWvRsE#l6<6rOB_y^6x6dVob3<6h`E@
z(wYO3tComqm>U|p4+0&4EG`Q-R3=M-XTU%n$Ci$l=)ViD%5`Gd05%_Igou@4c?|&u
zK`^J+)Cb#zF<628c4f@lSM_$|_i+AO>ZOO031jR1)1O}4P^XPdgTuK=0pFFyx!dW(
zkN($fEDQ1Fsu2;1WeddojD~z(Ua>Mef0@?ar|Wgyo{Co%(CklA>Fw<&*RN_9wogBq
z&MYV}Wl~3aPtwv;3=Z<FV5SR3Fy)zSw+=tEVBf3r`4}H-@zgzFX4ASheOLVbPcQ#f
zF{`(!G%v65je}eKm|Ek+oEtsett77=LulS-_VmPHz=WlF$Tuwy&_R0+H~%TNi@CdB
z66u7R2)5IOD%x!EdDD)PQzG?3mZ2l!JejL4L*)vNT1OZJSNB%`@m)|5doE+&F$$xd
zIVPA?z{#)qp~K}E{yd|w_uu=^F0rHEI-q4>VBl8F_vu+#S(zNJJ+MKgM-;$=f(Iu`
z&f#m6ui<RN*AnVTFIeLty?r|*$K3IaN|;E5ATsdZh<+K_mEf}El9b@>PUdO6;=Ig%
zzrbth$rC5;MZ324I$a9r9;<vYFcJGO@`6bl-JV7(oq|ool=ot5!JVEa@`Gks{{4)p
zV(SQvqsVSE>L`%em>5r^V+Mwj|8RPG`l?I!!O)AD8RB=G_j~qK5x=@dBO=qal}tq7
zTqgX}g=k*7WJwU3M<$r?*BB-}?&zQDCy(!6>Fm_$!hb2|<LD<B^77uaXX}6W?j1$!
zd82)YG?=yF<jA%y$@8S-|BI9Id4k|%;_atw%eNOb<h%RvCg>=OrmTIt_(SJ(ZN(*1
z9Se(xiwQEUD=j_U<#NN3PE4A$BXHUtx3P~8d2vRVI4W-yn&X2A%#c;)-ug&ODDHK7
zKR)AaxvaXVF*hTJQU_r+q&!c$f%NWl^!oe5zWKjBb(Q8{`KXfXj8Z}C``N5l;rkL7
zDf`=m=E#_AS+PTYl?tQ^H@K^RJ!~8(MR$@MNkO(>7MTLN#BqXN=R`g}v!z{vCS#3U
z{yZF4p$K3l@0mjVu$k{nzm2GWbF93z2|1&3&-soxhZvhU<i@}N!bz;><MM`7EyhBK
zsyE|Kux)>xhHU6Y(35Jp_N(tTe)U(yM7Dyk%*LmmK7FdbHdw12vTgR~S4+nax&8c-
z{iaYdcrrWg$oTK55mH?r-P!4Hszv-9@2wsI%WWzX@C)feHCU(YQ`HHzxl(8v&OnI`
zoOzx|n7QFS|3<jvw5$-}B=7G{=+U;n^~f}JJT5@+-&(HCmE58VDKFfiA|l^sR1FZK
zG6|H8<DleNp%g9G+87o}4S!D7%T*V}OJ3w=T$OsQ4gID|irrd^j;T!;{Kq=JA6sBo
znNz-bc`cryRksR1ZkA8JUsqR`$?jz5;4rEW5#c0SG^O(&i@v`~jrZMkQeWSK<Ts`H
zoloPr`{v&wa)m}zRb6Ha>{H&|tRMj-zOm$BfVP;vp<ycV7>^F9f9=l$1H;Qic7~*+
zY+lvD`xCv_>JLg*DJAy7TpU+{&L=#0Ai9kBe#wO8{kg*zl|^?V0{1B5mX;G&o+d<l
z98z0*H`>jreQ-p=rIf=TNuJ63BG&p~@|YG_g_1WFdmi3YIs10~i0cI%Ss{fTwaVvO
zwiI8T{9rmV#oTs~@VxKluu?hGyfTi^;<}X;DSTMRhrzra!sXv6%YDiE<VJq5;q0dq
z<P!?CAKt`-#eH2f{7+B6eW~Gg(TwlmY1yLI;s{KfNZJ1I*h?XWvp0P)NUV`z?*)sB
z$pfUrAvqD_N^NMg;gvxaqLF&Zqww?lDREm`Y>lF__Z$rG%UGllrJ#%J!a|sJ<aXql
z;_d4i8{2RKb~n6wHACAPwX5%OQaClgz5<>4YLT7i`BYR?JOOFv&B@mo9TnsW4ub$}
zi}?Tg`}=(%_}?7xE6>^(lVqBiO-;_%C}}CsFRmG+8jhU6F6Q2hT`<R?StKP;fKYe-
z^jx&fbsZ!&Pa;dsf=rt3Yu?bNDlFI8#WkH;P;YkdPEKB~nAb5%Kv{gFcUR;4+RThS
zU9m3TCGm?7K?p?A(@SkmEG|}2v3hxPF{Q3prv-h7#&@XM&(Rzml@2wxT+`78X2h^w
zTY1|hFK<ACpwbTOJi7X{=cs*0g-Vp(oCcE9cjW2I3YjD_G-5*bp%gnA@4ThMr^58o
z2-YS$tKsMV{!R?!F?j#>?KpGiwBHcpO$l#@msyR_aPJmTo>PcXTSnjl2r!uPKYsi;
zGB!B)J|i*>;Sx5OHdL?GW^32B=nPi;H!WuR6&jkB`zbT_u*V~_!)YC{RZ2?jS;2_@
z9qa9J5ReTeCMIG~LaS_OHG_G7P3;p5No(@-UT)>O=+xf5d(D-&uSQZ95xd~}U&yO>
zSxTIPj9fQ5#Uq#RObC<8*F=RS$gIezx8uX?Qg+teVmb?O*4=&gRbl0d6%Q<9zUV{r
zeyG{|5(uR2gskV!!KM_uxHQHch_o<vHkV;MD~AVJovBc7QDCpB=-5?;jkI?+ZhT*I
z<T}NjJEf(zZWTrZ`AM4k3N3A#dLagN=`%HUjI6a1s*%*WxPl+yo(;!QTb$!%XBD`%
zg|liHDtxw5At%nOPj69&XLRzNaldsP??2is#QlZ!*K+<Rpz&H3U43d9Ns(9`)Kmnm
z=cecZNqi7b&qlH5#|YR$NTF_eZ#}y*W|L3A813{wzQmS+3Cy5;QYp|>ttVM6%S|Bu
zQvDdshu?oY=ntvnd>@VOyUVJLkOX#@HDUio?WVIQ5UFqBA9+EIKRKVNYe!$eWW#Jx
z)nWp3Uah)=mWfoPMV8=(IHpjZyk?O)p|_oitNA6va{dlwh+X^#jecCG#mL-zq1(P2
z;VsOiR$1vheENYnKktPAv`a&z?F87ddt>(Zjki9Jcg7iYFSU@fjf<Ui)#@PUQp%8A
za!Vz?m_5NE62y|c0>!AfWPc&t21U${cn&SxW<Ne{6OJlz@v9*wlGcwZD(3e&s<LRI
zQO^9RP;b6eEL^U>!T2Xd4}!lq$`Gj2pxN<PTL!9$Bdt_(v4CF%b}<9@Qm$RxwM?=f
z!lWlb7KfC$`|e^R$Y2Cf(q6fCmZEGQWhb4LU!bj<J=FXsu1~odQCD3uTetp3;ETE5
zlZE9?>OmHNu7(6frz}oh@hEcLe#slaDa_Yuco#XMcX)DI_Lm}kazr~sP9vTdbJq2W
zk4d`T;``J{1pV@^I1X!WVe@+VSrhm~eIqGDC&k;@dyE{ny0>wSf`p5p=&9@Kgj0r;
zQtak0hlHaN+KBbIh`4_J`n;7fvltQ^sn@JTQRY(Y6cUNAp;JhMY;VoBfJ+CtEY6m@
zR)&S#biHpGlhUu;a6so`h+PbCY36Jyj;|Z1WzW9obCwX|Udz_wOWY>*H!JwSMQPGj
zUiR=|Z?~#vWf;ckg85d}v9b+%7e%=rNx2P~WcRqV$wwQZnicVlZBdwTrB_VMw{~^;
zlF*vw=R?JzIcqbAwKozcPMr9OMDj}U#IKk?y81ncfk%DHg-Cs3YxJ5v6%`eAWO`>b
zPWs_!x6~HO(f(%Y0PDT20l)4?UdUwr9>fr_%s%C;jso=>h5E&VCN!xfOPBgQJ?(^h
z*G3pUiTqtaIafwWt0@@i#>yy$%s@Dxp~~}r7DCgk$~73Og@h3cxVL26Twk+rZ%FKb
zmVClG!9`e+sN_qmk`1jqOJCaj^&$!op97MNmkRaYgDlh*_3V?hhVOk39@Bj^(=7qN
zzP`_~<Yj}CFeKzpki|VcNmfF92a6HROCeiQ7``G^ML?0VV5`tQ)U3u@^_BREB7BXE
zY*}k=hMeA$O<<XaQS~0wX=#%UUEpiFMjUE$UH0uk!~83r<r5PVlLgaW?yHHQrDCIR
zskAm%M`E0NSDW!d)!4N8_T+q%wly8Nyq9*x&fkgrVck*C$m+D6py;8^6HSf$orDBD
z{<-jwaIr+o06twBy_+q2b(Ii(vI*enGM$SzErf!Y?Hs$>$jwED<<j+#%`BIUXzF;x
zkLNRktc@d3Z)g&+&BBE$Hg&IGpW;0IKc?p`yBHmvZidvhd;2%uVdV?5_&6{<n<|<7
z1wik*DDZ~EgM&hQb$AgP>w^FJv1wfz$WStQekOFy>9VoyYr^)O^zbOI%*e>t7=1|k
z`|KRj0WgiXy#eC3?g>`flHh8Nzt!pc@X43}8&z!`ZFdThdA+s|*P?tC7dr>5vOaAt
z7VAexO3(!rk?S4nz~-+%t05%le*MjM@a;oGlC`zGcGhG^G%h=bn9dXX4x6n}F&NgY
zDL-tNe&uP;!vcHsP2HU1KN5CdCC6QF2zX1W^U(P@0)~W#Kq2FIlQQ2d8+t9g&!h|C
z7Quz__itRkzWIHD53~r-Ff6|o@bc9wea{ZDQ&s%hpASfmh1K@8**K7j=?*aHi)5Xj
z1uSOkf=v=5J`NPvN4SU%xZ<d<08Z%UIFW><8aFlLO~Ry1%p}wJcu?jlhZf@LjQF`Z
z+KleF;>J2)2v@4Lz2#YYFfOrVvcu1m9JZ>M)3WckCTFnmNl8h4tHj$KCJflGKAr5^
zKdB2G=D5<z%UbJ~RZXV&u@MMaI@+buOgOz13;v8efZ^%ch>^j;d(8Lme`zrb?%L7E
z-clnL`5Q@1J(2u~Ds2?b_dB?I8~HIpcO}%g+b%csvulSOKmMep9T&&t`vHzg2ALVM
zk~*v(WMQ%cC!r<+FN@MUv8fB_i1X(-be3dl6+e3P`2>CPFp@u?;vi)J1ip&|<`RVN
zN-y@#&Gb}q36;g+&iTMh^8!7xy~jG&tbckop78Ij4(=fK)5`0dA1L@w{Fs;sd-hCw
z9sl8<DKi=aBhLt}F*sLk#CNq~<|&*hN}+313uO3xWTNyo5mI{xUZw{&xa>oU>!%WF
zLR7{3my@dCjpS?lMS^xy>TKbH)J<7KsZ(Mw5e{S{?zv^yLoDFzcuF=e2hpq`f4R#b
zDV9n*sP`4%#^Q@%$~Pk~z`4_PTBxQC4kS^G)ePWcCCq-X(tflrqfb_rnes?&+48d6
zD@#X0{Ko;w#Z{I54H+F>rnxwM46`cde;?>LQVWO-G3Ge*-w#YIYxt%|8=06NdA*C{
z$7s^SJ;A?oCOw9BIbP-DU27Bb<;mBJC40EOuN{A-aw_}u(?0AGR<+J`-w#l7j~?z6
z)c)+b>E(JneV&;I?pV*{Gmj?7Bk@HC>HnY=XSk|fr`X{bPE_A@4gCyEHT?Wob=KC&
z^2qoi2d<UpCM5J!60GE`0fDB4lP6DheqO|6_s`XHCi|=N5}tD}8GN7YlOx3w4`)^U
z9`ekxiYoP<xj<)hJ&rslk$9D3neb;ce`;;6v*+jsXq`PHiQBS&oKtXQ$8Pw?x6&_R
zxI~8S(yA(h{(KyeTu=u40P37&HR8RPxp*hH<sJh8hJ}#*;2~x|8nBGXT}sj6b-Tut
z-D0+XEcL&cnU!VEK}26TT3`>=<!8NS1zrQa)m;VAgzEt}RSX$EIYwt&tE1z?lJQ|O
zZ|(!48HvS}-Rsy&^v<)yZ<L?KF<eU>_9i^c)LX8Wxec(qe4VdE6ZV|SpUC8ivo=;e
zl(I*sIJREj5kj*lq9=;hOq}g~7Pw7w*oeD&u)VNNa2bJNWg%QTC+>DuKtDts^!D@q
z7FIO9kTGx?{VHMoLsKV7|0I>_xzT?M|Ka-Auk)by9fevZDJ^YiWkPy}fuV;Eu4m{-
zjM+L9fm;nRJcocoD3HBPr|t4vL;_scM^PSvh^b!$hi;Aibbr|S7%W1&YS{}cTg1;b
zQQa@yw{lky&B}Xc&egQi#4%#HB*-r2^I=n6bmMI+tR#~;2>N7Z=IhR_-|s2ueS3Z6
zLDXvdO^Nl<%>hTR3?Dk9)TU7HBljXAWQ)DA!NDnef{&ZS?}$$2`a}&%oqNb29^oC;
zvWFb67cAHQmOuY9Ggs>M!y_UrR(b)h<-UP|ff~fwbLaHNMk^RhUq|M=0gYGS8as<W
zWov(@f)j5{gOH`y(!JvR8-&A3bOQ1kcBLoyEzD~+QO)f;+$v9OJ=u+U^fNHDet|-s
zL<zP?Nwt`f{bp!RXUp)_Vf*v0QR=EJq-9KIZA2kXY~E}81@wuokc&1VS<L*UP`bI%
z85p#&IY5Y5e>r1)tE*{z<G@wQISjw-8&O}FYR`!{U+QN_!*8+p^~hui!6h@Zy5}&x
zOCqc(Cg%SAWdv7nHA1XjEf&}u`i^S8DPRy@bZroBzLI%!|8?+l!d}kN+Typ~-@AYR
zAa&Ss3D6e8DEz3IW_jsu*QsLh#EtxR$&s4rHQV-u32(wI!Sw-y!=~dimx5JEFa#Zq
z$Z%U$>RE*$gA*q{yIs8aV4sfruetdRkhc6l(P9VNqy5xWSqce)&3b#z#SEKT3+?-&
z{cM+`&IH%RaMt^SYP>a2UTLFb`Tdow^8~f?4@erK_>JsSW_ufL|B-$Dv)*j60HM)E
z_4Xbf9?=ZD&Ru~=^rE8$E81xt{KN@mQ9*QhM8cuw2S4}bzqp?pHaXlTfJ#vHUBSp@
z?26*a4>-MZ*On$EtoLtd6Zcv&GoY;lGP%N0sODC9-_Og_zdfR#?$y_CO1`YsbA_yP
zy=z=-Qm$<C&i&%$I-tiMgHV}A?hcCwza=0X_1Hk<bzY4zXW5$fqcQTf;rusVSecr}
zo-#4<23j7|ig;1oK)wnb0U{=C>T=t%8~%bpp*f8Y3m3I@-0^9jnp&g2Z`17qi!sWv
zICHpw?bmL6y3oZVBPSt+`ia9RI61QNE@dqmx<ohnWM_f>wA|smGoPMcQz3guEm$WG
z=xFk5^YL$gpyX(ln4SIhSp(a*#&dnP_Or$jZ9x`RW{vKqZJUVZn(#GVXHssv!mk;Q
zivM9`d#v4Hhfii~XJz><Px_=_tuxV+@aD0z+FEzAn|mf3s@D{KnI6IS>}C5xs-FMI
zXO#j^$52s~+`y1goZmbBf4mt6FmHvg?BQFvAVXxDVkT+Iini4DZ-<Ku-xj-d1Qlv@
zE7S|uIx~fWoX@T2Q+{#(dxB-oJ(HX>FLIE7hcRG^cdQjhKdS*H?P`g7`yGirx6v6t
z&CSidXWy}qYd`x9wIu3_)RTsW3!Y?qY`lp}b67r>+_6g^7am?(SjPV}v*dZ~waQmI
zw)?))FHL{Yu>vMtM7+gW?~SkbS|fh!Vw<Zua5KL}*$}Uo_fF4pVju4Yqb;R1kpHz7
zk7@)4nPT82*)zlY8i$2!VQgTxE7tcE%}0b#P*g0wtd-D8i+^9R#%xxD5obi(UNCX*
zjkC>=35{SD%q}9b1PdZUUb>ntBT!`f71&ogbWGh18Jy8tKc3Ae{xC8|TPKT9K7TYN
z&1)p5&^<HnS3c9tcAk;B@r*2Y-?BE>1>26PS5HrmWAF=S$l&s7*$Rjb_fUszfjwZJ
z`ds$o$6LNe4ecn`ap<Tx>SG-JT;5*3Z1rLe;`tdl6^Kb|acCr`*qMQh`-=BDO4P9Y
zve*@SWV!wfWOo8NM(0acMRQlb=T5j5Qp4Yrg)%ZvC%<R1&D>9nk4sHk=kDsD??15s
z<0C0uOL~mxldiaSJtwxhl5R<6(gZ8h%vcv&U&n4NwsGkn7EtT50nXm;f1$EF{`R5G
z@hGy2hG1SYVJB9uT*<`nfWGDY5hsAxT6!60tu8LGKPAvqtM?>=<)T$*e}a79lx~Mc
zP{=z111vQ0%txQ57~gS4YdOuYzs*0L_!EZ!om)kwT+W<tiw%m<iESsk|3|4{PpIVk
z<W3!46*8!RdwY`-*M+tmhI9#W&%?CxTOsYa9e}1;GA7%L={z#URL-}Gv7SkkA%w59
z;fO0F%ECu7dR;|zS%2-9oRs5FCP-b<o@&`=s5@2@_pc4!Cn_E?d{1yWKd}&cORWU-
zuIbvKarJ7$w@)3a;h_;BXAj#@l?nJ0bkx>%YwJ`VO>MqWR`St>ICPUz69M<}4VI6{
zSij4H-11M9v7GICPr|6fO#8ULJ>t~+lQFFE4{En-4Ma{r;){&E%HhL%)^Yb7Azo02
z@sBywoNeW`4kCYS+P`ffVFC|x+M11tG(wckA81b2Mbl|Rf@w#W5NLAIxhTLNjW3>t
zQnh2lEiQZ8ZWKX=mkubqlADr&!OqhV0IectS`^ruCq`1C#`zwbmX_AM<FYHT%B|bB
z#mcPb<pTchrqwR7m_D_Lt_b+R;jx7fo3}={7c5;J?4$wqQiE8q=nfOfDCnVI9-#)F
zmc6$v0Hby`H9$<E1QCqE<pvA}<;4u!biF4h_Ux%X-r>=n>4T?Xjib=MV>B|V@d{=@
zWqxqGe_B@gW=QzX!!9!r_U^PEy2i6k<6}c(qh^gP_ewx8HkuB=o92LhIKvirio{j+
zZxmna_vibDkh7-&Tz+h6iR1~?{&Hvgsqh`#)zE#fa-1mpg2N<yx%SWRGv0^s#SdDo
zs~T)dn!TT*^1k#K31RSXj=N!L%SInM;&|>{omE+vvF#0FkSs|-I$R8;=-I5PH6R1Z
zMTy}srLME>O&S0Jv6^p^;m)O~^uI0LL~gk3H@jO}^6elT=0x7xj>9gP1T|KYEepdf
zzc!a8Kr=_{I7@8VoR~>t$z5%<CZbmUsb3pS-r`w+KD10k&vwTX-s!XMZXd~!UO+K=
zbs`;Tv{QwMk<C0bQ60=X29Hzxcb$uo7D7ukfAw5Vu@Aon9-|<$36WCbT~Mu$Vcq6|
z@Hq|b)a^)8hVv!mO^tE?I+e#ZfRo;9<cvI4x2Esz7;-y5AWoLd9i`>>`H2;{DZ*Ur
z^L$+Fqwn3WBFw~G+3wv&Q$Q8EJ+~j7F+VX|pkCYYr$VM-Al0n$5GAkk(x32eXV;b6
z?BlY`F#Iqyk&&PO^CxJRVlW~((lRpc2le!P6|L(cGq3Y?O~Yt~k9WJahMmFM!F%?s
z#57B+;e!0?N1EHR1&ljJo%~ckwDEKl#ny(5T)gh)CK^4mh*%*g_ytXPkc{8V>s><J
z8k7?!6fTli82>T7Hey}(PF&qdY}67S5uKf`)2g)E%#RU(>A&@;@fVD$jShM{jH$S}
zjk1hQ&Sn&hXid!y9=GQSuHFZ-#cOcUsv0AiRo8S1ejnK)DXEf{k?}3($BzpGoSMHb
zOK;m&I{jy&QB&H*Pg!*8vgQr4V3QH`n;Es;!O+7qU`IHx9pg&48gd~JQ_$?uE>~bv
zGRUOW30bP+^awm@Z2Xnb^6;3!B$hznR6K-9o2i!0T|{iStbMDPw4_7&@)`1~th#!2
zc<#8(_8fjL_J&p}?{e)>j<>)P6}K%G$*RQ1#$6M?#kDs{e<e>aFOEVl?GO>*#XJZ#
zo`|F@JWfk1QOa}PT&wH8^B#^v)wj-0<qPe`<8S&Of)%u_^Om6zTcoAu<1B;>1y`&%
zbk5%16fwYg7^Rwt%HGW>5sVK0u(!u^VPCJ4Q3kjLGC%Udg$ox^20UGZHyze5SQaT$
z)N=*N)AS&V2bqzq{=-0m9B~wnvBg>!?O@PJs*)-1<W%mW=KA|aVe8{%sQm{XCni37
zlaU^`!@BO_9qT!CW(U{QUS|GAZjd5k-Vc*8jBk)bvOn`ASrkvIl`9r?MG@y6+3iFJ
zN7O%zG1kO3ntlkvgTB;^a$uPj(g5tS8+8k4fBZHv1K`xmK(CVm)ufTlKb|dg@;u(d
zCY~uE!~RXmXjF2f|HES3ymo_lzfGGqfz>e4KX%N?n?|FR50|(@f#0?C;-a1<e^g$O
zU*M7#WumY&8l^vHEIi;o1uo`>va7f`W{&{>9mkgDQcyl7e{=emWyQ~AnQ}oc_Dl{9
zN#}Q0Cm%i9`C*OjGOY+S<lQ7Vc3;7c@^t6)Eki$H9K&810soGMfB7wwO;_)KfM4Wd
z+`U2AUs_sPgO26nTG{Ov!SuWYYHKAxDqD~TUFnRJj0@NP`)aH<?n<YXxQMMn+~G~s
zg*MmD7eqx6{i@9pj;ovfHJ6HAPmY|-96rK1uHohq@J=?=8!Q$)V}fMeGTEZ<du3Hw
zOo|=2iU=<)FE0PJ>Yf+h=4OoX>C5?VV1Z3B3U9P6p9w$4>|1d4OhosKHTSB$Q>ed&
zwC=f8O>d8FvD%u<<0fi5ft`A}`E!>k4k`@;X7?TSsmv=6$UEfc3}=v0p+hXX?lr`{
zU9Lm>U*~2jac{_oL<(w&DrUK2x*?N@g=+5QqV=VWUOY87oc+F3y>0$2UoKhHkR8B>
zdAw|S4oQGwpZ7WIO1j>#@6bGy+Wgw2ZSE_+S68Ez#bj>!*7K>{m^QNmTlJ&zukNsL
zwz+Qd=OJKuRJ{5$;Uy?3G@SXjGdiHD4kbA|GN%_0T@x5;dRbHOdGQrX7H6sN0!P*5
z8~a9MhyAkP>YD2-x3Lo&moGkd?%W0W+G9pWXTyXQ^)li5T}K`6g$a6aP4LHp!+2}c
zb+X|39LChF8ul7g-Ox|k_sTT(ju21qUU25P(Vnk!eW8(FL*TfN(s@L1vpa=04$P**
zXn|*e@{7@Cc8Y`0iTu&v;l-Q}MW=EcQF~MS9Cr*jb<A!N;*PndbA?zhA)#wq$${RH
z@JFx{`^1kQUy3tNLFu>_LlUl%?WwJ%`<F5{EnnY?t}YjZM{aOwkdMHKo{=YI`ii}-
zLtbx!S9B<q9SL3?w$H=r;yTz$Z4`uESssJx)fSJrbN{|qY@ae_5HBX=L3)FZw>@`C
zwe!6dR(@-drpxKCc5~5P7Zr7hW8}b4eVRJ2)*iLBy!*uYn_60Q%(SKj#GWI~+mS`t
z4-C!g>{;5m#Uw$UwEZ<T@<{3!5RHZ2hJwylV_wzaQ_-u%49G@2o^w5r`B$aCey!=8
z_6WaB41&aZj4KotnY)`dHw-vl$L1=Dhb>yP$b55R2MU12sBR7;+rk*#(C^c-m!j=E
z$l1;xfPWs>I4a_1U5(T0D3H}W6!Y$Q`%1UIoY}rzBbk-}S7*>P&aJ8a&>en@<t7D?
zIMl==B^mdpYo{-|C%t)5gB*(K)yht%11*F!8yg$fLGGw8kzAGvOoPSo)a5uvez07P
zXL{yX-v9phKQ#a|pXT4pKS`ak_3V48NZe$`_-8&L(jGq^q*Ti~G*J<_AOjHdb<d*D
ze>t=2?XOFY(bN&f-MjkYk-`mxCji@d7B&tO*3<SrK6C#k?7hRW?%(*~4>BsVMcGP{
zib7UK66H3E%E(Meb~YI;QAUMiYf$1MGRiJR5t6#3D=S%<5wd@;Pv75j9M5q)e?0d;
z_c*$_uFp8%=lMEcBRN-0n4T+xE*(E%AM(!B$vw`)*hxW>!=;q1OCK`-DZWzXgL^W#
zIS3jx5--wrTsnsCDuy__oi>b~UH^o3Akqu3#$JfCHL*1v-iz+7yg)xq1uOq~0WMjv
z0ai9`+!z=WrhSc*p^)lqP=6W<XiG*lz@|quYzcZ|KTrsW*i<2ABxg=`Po}a%bY^NA
zbRzY1&(>Av;J&E$AN&2D_c%^s!PUZ*lp?Ceql{P%*gJ?JO01Mi$+y)mN`jLm*@36l
z^--)NR#mgyyG=ibG<i+Z6Xmyi27v$WgzhFPY;sqF;;QO-XYGbtZFi;VB2Zgqz~C_w
za#Z%g)W##S#*t!APH4<l#I1)~(POSA)V#1K9|Q87KAN^+*){+y;uBWT^b>&;ul!zl
z4GlvKG+0-PJ-0A?_~glx<giLjjVp9cbQ9mvAD$=aT6av=Dgd}$#tKtQqfz6}6YBg1
z5k(`%B{$rJU~kV#|2rS@b--2GhF4hpDo;*qy)^5?vZUG>x^XWr$?}QUjZwWHuo$n3
zdV6N|*+7c|<@mUk({*R|nw&Z{!%!o&=ecu$4$zcB<Okh>SMG^jn`rP}&>?O}he+3c
z9f%)lj*X4Ic$CFG#hT|zM(o`8w02e7S^G~zo*?VamV&sz?&%SnSrTPdm0RQj*@q;3
zh?<bwOKYAIi44<>SVP>iG*+f7r|fRXDr!B@$1E<1g`5eI8GyI=>9c1OAR;8A@EBq7
z24;9Iy7>KKVvk{l-@#EWqx<}X_7G2~H5V6O-Q2CPCIrh*CoG{4OtIyuRSi3rZm@>f
z#<f{vRmSHfa6{*Mu)8rQ_HnW-zLsg^<*!TFdiC7w+(m9sii*$fQ>ZQ;&Esro)sW$?
zRuoChjTI5T+9kz`En~jHuN-U{+i*wv(6_`HC=j32!`L%Ei{P;9%+9MUB_pWqvE$jK
z&Po*!S*P)+kh&rdjZN^qggyMMOwpfBS5C9+)kJK!wj-PH)$F1mb8*=W?2a*aXHI8+
zZ@^srz#-Ann{S{PzbP9=FHUg4YIV4{&dM(HLKzNntu3J~iShCABsy|t@$c{W`HPiR
z_~h+K>rV916U2Pb1x+FiHN=B1?8vsu=VYGZ`P>5+t%_`jD!$|AY7uxRpS+QZz(mNI
zaiU+rTzJ({aY4oYdp6pg7pEHes^FSu&9gPmfIh`=C5EU6?=S|BtIGF*siiAndLRfE
z(WhVI#1{29%kjxtUf1%~1d6HP{aAm-Y6IeV*kImWTj3PFl@|ccU1>^2%B=UL^FP5v
zMDjt=9vD4?Uo_Fl;H26cC~#1mF|C<d+;%Hh+|pFqidlq(+ukRS>r)RihGgocD7F;j
zoMx?&hob?umYoGTRUN@AOT2jZz9f7jsZS~;I>G&GplJJII@^Q#<*c-naM+-pbgI8L
zSi7v_%Kwt7d_7=1Pf@Op2eI>5j30**G{z#m<e^?elb&Z=pgK#dJ0IYjO9tnQVkhTO
z5ojpJNUNO1E7e^(Mj`Z=()CFm(p66BYn)5?AUOIhK=dsXM_EwUh(jCpvBb4&BjG~e
z(%dpQUn7O?HxI+J57+Szye6{5w(vnd%CsVEu37-$4B&X>@10#(aiYy^#_mvq$b(#b
z#SiyWlIu8sNE=p1ZvOo|no)cTSYn!lTK|-fn&PDuyTY%)LWGAkHM6LaCKYkB6C7Jc
zVkab<UJ14)Hs~p|AW%JS7i;7gh>|IXjiunVnw}$|fkkOPY#-1i`CVf01M0~g77!&x
z%Fl_9t@^5?P99BhC3ll?)lSi+T$+orxaF+*+~-ds7s1M}_*q}0D}UGUErbuhhely~
z7SELW{bR6updC^V6CbZ!7z@V#xol!=%=6*>d%t&J4m>u<x`8WM4M^6Rc(!X;F|FAr
zQO<Vh2N{*T@64O9%b4w|Oz)md)XrGuTXU@m(SeR0=511}kOZsT4Rc|Xs&h{k3m**6
znVCM4(q?i*KWYCcFR+{b6FaXhE?z8o_Uu-a>ay?T9?txwFzS|2>-3_cjR1nFaND56
zd@o<;K1O-+MBe$`En!M$mv?kv*Ng@U;Ou{2pF6X#)TN(cfX-bNfMhO(V$OE)&fes<
zlPG8whloFrp;yA)#s$$9?;09Bpbqv`L?l!=#vA=i)mADs6inM8B%9V?0SuXHY<zsM
z4O*Dp9beLh;vffst0b0L-lcNdtHt{|$hQ$~Tv1H5zfbDcsWUso`>tUj*X(<6VLe7<
zzeA2o`?(?&U@TO-3&wiK_4Jxvs)q$d^_FAoua)S+GykY$X$tdU7t=%{b^gxl*RN?f
zE4~pg2Km^$;9gXKDzd*g^{7xGbx+7-&OneH>Kk2k2~x1ZFF~8kF0!wPnvgYV?wF5l
z?$%6)emHw0z;5Dny5rTkDx12f6#8z3R+(T!W8=Tg7`F>Kf2<NlnoA_WZU@)XK7S{A
zN~VWe?HRdbtLFNXG{L^KQ8K#9SND6Zunq+QymMRy^j)KarIJc5-%`s@B#6>8Ftd+v
zbRQAV0CFPh`ZU7?;{Q{|#`29ISvn;48>CCWH|d`%qS6z0B`s68s0J-UYxJD2&H;WD
zcuw|AXZjV>?^w%p<%$zc1x)Hdkr4ac4I&w_;P7yY_a*xt2wL`zdaflR!q0v^Fw>zk
zD^|TKXz9;kZu7HIAd29St0V@}f>jUznPutQ!{}f_4afUd0GR<p^pml>xvS2SuI4xg
zKvjJ4eSCHnDU5guD=J{H^zuV7QEgbg*~Tfam86CJv7etA%?_TpB6ttDX&LQpC6TcF
z0fV(<po*mwFj$NU_MS$;nUC9CmN$^}Yah;*9j!7eOzAbemlj;4cn-imN-4qVW0^!i
z><Mjgwi<A7E)AF7#3F#?<$>h(5<Lo=M&VJGmagK__2r|@6PaeJO9;df(~96Z{>-j%
zOD_`1n%nVw2AB?iA=oG9F4p-rPjBa1-R4C`U>(@J=Gq6enF|GpHuOgreBTDRu!Wel
zInS(<-mpe^o=DkxtG$kk{rdZWsH2@<N{t9BaHsqvjB;hJa|pW7iYqo%Gn)?6-L>uW
zr>(TYmDeFLcn8=pLBQPBs!3W_9yp2JyO=<<YD}DNK-s~E+)os-eH0vbD$7|=@tGL1
z6|O^+@!V~LU$(+mQRg`r=`R_6^y6Z{W0Zu0J{z@7N^tPQV#Spi=G_g7C$!snV6(`t
z==lULlGH8uyI@MNq-0_y*0$H_LVD%Dl|8#(L@mKA(8?P=KJ?$7eWObCGL1b+a;~-F
zkCW9QGP%+#Z{F(k*M4R3w!!7FV+IE5u--P*7T4A2CAw1s#@t(`x~e+D3x-c>{af_S
zPobf(2MafdQe@Eqo?a8qFn6+n_Ap6fPJV`iWk!WQ<YBam{}YGAI+ykWMzOSu`xxoz
z<f9nGZA*d&CYviqp|x>$-^=g$@u0SL)-}$<YO~Y!{vGd%xQ{&6X&pgSv@|y53n*F9
zaIn%=OsNb2kH8T6P|cBLQzI?MKsPBKKG3q-Z0S#l%s(qC^7_w?zXLP|88}%`*R@Dx
zoKPMAUFRD;XDh_{A~cMZ7^Ia*66b295Yz4}h_dSV++dBypB^X%O~Epu)UYe*Kw{1}
zq3Kmbb%pJf4`xo^x`%8vU*WB{MPzcVaB<S%1J6T|+gV5zdT^TIQgx)pSyn!IPNFd0
zIxj7D9eAj0=|LELJjkv=T6bz&jno($(-paM6fg`{&X`c8vFGGh+7X^XSMAjisgjnr
zv6{0+iit2@*gTMoC)szZQEqlHvTF43HJlS9A+&_^hfIysnvB?$&3MI`DAU1o--qS(
zYB2tO^LbX*#KgsawP`b><(gIWg6ofGKHAL2Bc+DG<T!)vAzYm^-xee{hvt7O6Kd&g
zqxe5`R#a6DzSk>%zPtKTZ5Y?q(#&?27UZqucRY%{Y-_>;A6Va^jChvno*uWqRwCbS
ziCcc{a2|0eKdZ2FOXO2vYCrq?Q(<EFz97dYBNkj*es1_4T*rOcp6-}=i`Fp;7W2}{
zOjVrF*A=23GO_Z6+}^5nA-JEoGt`W#ehNMF+Ev{j#SJt0)HMXXw1P9+DtcLKZV~gP
zxwJx5?B|G}oTTFlR87&7eCE8sn>*YYG0NALo6{jGvOXlPJvEF-pMJAm|HC%bL%TM$
zVyQmA)pNOKrnuSc$+_(hWQkLBzFi9@q8VoCML`PdJ<D>F+ASE;b#(i4YtJFMu;^?5
zjhme6>sxa5+}|CjD+L{3P4$97JtMIkzwwa){K<}Z+3ig`q%lfdzH6)eDApeW$=xh!
zuC8`!KpD6tExxm+Ukk$`-y?dqsXeOGhTdX-$H=!&N(IhB<hne!TF#>tqf30>zyNbb
z?0_R>zyYMc6HuL|IV7$qgBr6ysCn~`JArc;kh@!>@RO2JHc_sxkxjSD+uWy;>fh%r
zKpWOv2s?6)a?RF6N_Tx{Kq@~`-X|*$<A8mV^DTF6`B#$$vWuEuw_K~SPV?z8Kw}%-
z(AXG=1?P3lQZQ^$+VAq+cLH`A5(xj<J}!Mn{u#+JXX08-d{0v#oFA)t07LGerVV**
zZ4;mqN+`;GxfKo4aOv0-*bDv`yGqgWTK<Unc0ZvT6s5y(-&SdfO-oZX)^>OxT~?ww
z5Sp-xg`q9SBxY^;#uWZtkdv(v8gzc%LJLBG91mFEpFkUGu;&k<n%b?DUU7cIK1Lhk
z6>Xi-5$6%Ux|Ou2*T)GTm-c15@75)FL~Qib6Mc;NKkr3uK$$b`FjyeFcvz|2n>N)u
z3p{>K)y><dE1e!YuM#p)o-^7`^P#L3gnO9}TaElFZNC)~t{U&=J8Q=YEDvnW>owNB
zuxwTO6cD+Oo0o+kv;T;G;+{14!^xhCfht@l6EhXwJGME4g}0Y)ptWsB*tzG{JfNB%
z#tazm)06Dg{z~Vv#X-l$b{P&eja9T_=@n|38`oq=%-jL!k%ma{1e4xg*4}*?8{mYw
zOT2G4(530l{#8Um`ytfBN@HAaDcgBzi*!oabN$X?&0Ohy2aRwnumXiXAYh3=fnapY
zb-;&3I9bdHwQK74KkOLR6c=@%M2`XQS0Q{&UV?Tvuq9OZqshV+!YVOyqJJtH48rS#
z8n)dDx7SKObD7nY!;UI03^bi>1Skf7Hg4K9zc1n0+O=z^D$K`YJjMd={cSOk-bmmI
zeoSJY+D))rQ(p$a=I6W)ZOrI^axxKyBT$eJNT)w7k$@vu4FY`k)w!SIYVjnr{8#%G
zD@OSq7^BCXLr*Ts6(|i!!CMKx;**ASPg*eQpg)}bTD-LI;Y-E`$EQU=+1IJr9~=F`
ztI9rTs-H_XWCt=n`;-@Ls;LNUAlrG5zdhFn2sJ65LKsWOW5`{3Z17Zv1t-^I(92tk
zM|Bd4b7g6r3Xa}<%o=}!$<4^B5R&g`;p~(MboHRMwe`$5-&%j!v8ztpwzku!u#mL0
zuvlhpC|Hh3OAAgIE^US-NF-KVKftq_&$+=|o=Y+ihMANzR9lBHJBobjeBx>(#CP-U
z349KaY5zWmos8EOH)8o6kH=9w!2tmz{u#riQ_eI2EdR9V;CtsoMk5w-K449GSZsbN
z-9URs#v_NsE6Avb6i_Y=w(BS|GFp(LOfO(<6U<0Fie0${_7ndWCGU~VczcJ?Dth86
z;AL4=8IzP$CXcOapR#_N`&nl1_PVg9<A3-mo4bDftw@*A)p!Nk2J5>6*A0GgbPhU6
z@vsJEfkTG1SW0QBq7U|B0~luygRHRE)6V2TImk_2ro(bLLpr*YToa0DXA}Fuk$Fx~
zZBxCI_B#*=S#&bc?f~~fRmA_|$k+S<zf0mFO*dK56C|BCq1tH3kd4_lESogPU&K*O
z&r{;!tJ#R<(b8Ndx2TfN<M1$(H@wDq%|QF8#&uujxjv|u<4KiHG?;2>++XeO_V8$n
z6UIL%ymA#b9&rW?Ax&I6X~k(+RWi29SSR*#kPjxtpHIJizi(E!@RQU?-^NdoLtebx
zCSq5E2yr1Pfh8i}qJC|xmz}wngTs($O(<JH9j0j=M_ot_2An&~=gRQDHG_WBBbxkk
z2&+!q*TB}-N-@5?p$0ou7rZ5JtwWIs1~qw$9c@Oki0T9Ai-Od8UkA{gNJ?Y>8ezQ+
z>g6OWS6^5|Q232cMr^crMyMl&L!BDynAU6$pg@zjkKRWYkZv<UGBU&zq8KRC<`&Py
z5UO0bjfb^U^eQRZNx}`aV4TnwS+iRBMiKRxwr=zJ0tcQ@;fxO*Gd$t%HmH9kE)-Yj
ziyziFK?rqpb|xgjAc}&Yn7ylE3mz^(kiD~s?`RiSK$LjVB^9w2rY)CWSydQ3)nxg7
zQuvL6>2NHk$gh;DFXZj&o0?nJ(HO^<I_W^+4I5-3jL-uRi?RaIK4+O<()RNcl+z_+
z--Hi^f|$Fes!R2>b~pf&9I7c-OV(Z6+te+Hnm>hK*Ot>wvro)~U*kc0D}8`xL=HaI
zV<=wE9G2oqW=uD8OnDsZUpqdVhUs%3x3ERLfy&72LNKe9ju7V)#tC6AMlb+?zh&cZ
z5(I|k47?<kS{n8U1Hfu)dt-{yYzC$e64e9YW)q&;%^IFwQap=S3~s<g82^sPVCNYg
z%^07t_fiq`;N{o3`(EO(sfd*`*o`m}UREXw*H+EsbBX<3&NP)yuMS-dCZOK$|32}j
zRsV5FlhA=Jk=i2`KXm>P&+7cm-JE$evk}S|VoQ5@nhuecHC`A9As|{qze8Z}8I2mU
z4FrF77a_)ZoQo@EtyQ?eFFkl}yCn8M)cEW|^ZrC@v&%Ta5E4xI{-^CH8Ujb!xvUdU
z^~7aM;2o^zdYTmbENWr8Y4Pe9=WNM09abu&vY8G;n%$0h)oWtk(X!k!6PDkhRDaZP
zABC83Gx0AuMM1ib9fhNGYlJ^(XSIdBlV#n?NRSLh;Qq__QG)b5>Kbzf+H?e-U~VS*
zOV><?r3<NboGp>W7GMy7RFz?0#%7Up0@w^cz}sf22uV75g!~mzhan<M>y>W?KU9@r
z#8de`Q;63v)eDZ)V|Q@-4}^?E+(aj3z;c_z3iODI*b92NG^&J9%m=V0KoybOnNb==
zE88*2Tj#!$i1=)(4+RjiU=fpG>Zr_8ePMi23FpSr$$be<Vh{Ebdzjp=QvI`HFF=wu
zG&ePn*K~H`i)pi7hQZ@=6b>%+<n&m7{*<E~%YgKn!3J&PY;gy-VO@)2jg$o}{PL*4
za#p8(em5rcz$nfDs8L$Ny~w@PsjD^CTi5T1zk4^R9Rnu>eMdd#A@P-KN>vWXDDks9
zx-R+@$trP@!0zZ2aSPQnhe8=;ZS#`mPa5662p`oK=g6foZ|H3hQ}_w8)$U?+3&K<A
z)+)0gk+B7Onp+8S%E%IE@I6q;NQ80-E_b4jYaYY_ys$Vob(%OJ2qbcYI;$~Ma0TR*
z?2fr$nXsQl(%sk=BWh^aJjR{AMrf)Z?;EXma!l+`f<(AyYR*8--fA%JJBW4Xz?W9Y
zuBcF+dXd|!3d0FGWdtj8(^um+o!;jIw1HVOf@iOss%n?Fd7G@RwBdytq*#Zwy9vk8
z!>}ikAthv@NR%_}XVJ=bf(N#7uQX&%h)=ttU#ZV=R=vqos!jbsCuI-t<|Rm~ir;yA
z%%^}fI)%vXV^gy)xHd2_u(D9Yp?Z-q<$Z7I43Lat(twqM(Xb+R(g}LwVBSHqLzPga
zN$a#aH656Pc1Dij#U_$S9emZ`mz0QUB{ViV9izFdl|WB7hPXy<mhQL0DiQ_q(QGmt
zCaT!G10Y9W2_Xfp=fHf(E>X7Msu^KC4L*<#R8CS=Qz_#zRZ#nxV``W_m(VPYY|)>w
z;)YR}eeq<xEp}c|R8+J(PZ>ulli%jSc^#UCxH|bx?<FcEUNC)>HJ$iv@03Xw2FeT@
z?fV`g9Z-&6Ka*rq5ii{3zdddXH)ZzpdRoXGL813Ht~%jYf_uB{GUGwY_eMr597brx
z97H!`5=~iCGQoJNxFo>Y>8;o$htQd*miCz!(JJ%jiW+wm)|Unz$_&Kr4R!F^SG@}b
z{OEM|#r%AXlxZ6n;k(**RaHz4*v>7VaCUN~og$_aX2=D4`DmNda|OmL2c-p~8z54;
zNOWKM@Y`i!OZBjstC-=-`dD6w|A)IPIR39nuYKT^QgBlF(#Y!s>j*DtZ0O8~A3+P~
z_l8UBgOu)+NJ9Y=kjXi$9jn0o;IJUYsS-PP=Ag76aXp)aqtC|aItt$C``9Pn+F35w
zimj%dpa!oFnb1C;m80fBb1q92i+Q(e!CfhF-C#%M!-20~df&xne{0zr^puiN)MY~R
z>=;m1?TIlsvoqk)fh3;*?*&+x8NSm_FU~G#;sPd0`E_-?d(nCJMTPUVcyT_9fIsZT
zZ6<XzFIFXAwtWknCRL8(3dMnqMe!`o@fIAl#?9*?^+Qtt;X}t-$?|7H@I5<|*w0_=
zESR93p`s0=cPvq)rMda>RZUDxUN&%VBzXkhR>PE6)48kmDy`9xRb=QlZ?~UuR`UPO
zo)*Ae+|lBGk$UY4zp{({fURX=u+dOTPV4gLsj+UAqLi5trv-E6(29Hx_NSYN+d)5g
zAaRV8H=B!l>8>m<Rds&*Rw@h@orSiaAui_Hk0)vVTHJKxZ>=rPE@5hOS}7VWb+PDr
z$3rtTAATwUN)&jAQ0b}WJD2egusv}7V%l~B?xuwK!J^5#T_lY^V)U+s(LmzptmjO$
zkpOmt-pqb}>tzUYP_ELk+t(wSH{dTIyup~8*JnR{noGtEftag8ygB$ky)%cvOFLzC
zyEjiBJvv)p&GRtq+!B-#0yi}uQW6$Q%Ob%9k&M}e$fWn6e+0o`i1-`hOk?1yGeKwT
zKL(PqMGhW{t+&Il6MkU4tJd}p`Nqt=ba!hkHP5VdI(qbdR;Gi>IUY?*;Z^L4gX!^2
zsw<0==VVIPrNt_PX)-!wYQzsLY-{v^$z2q$N9pNSIsmN8uyd`QMgJc4LGjmz((@Ao
zYsjlLvo7^QLn*Icd(}Z`Vw}rd;X+aH@?|^LDVE@a2Nb+`;mbn2HGH$#hSqXYHoc(W
zlQ?cfARu24$QlHhq%Ob|s0zZ6VUX}k>`r>Ti<SME%ucp(G)H-3YvoI%#+mbh>%N4~
zX#Mv#E6<uaqV35AytGzWV5hkF`zghm#Z=pfgO0kLjB;#hX~D~LHQ1f?vj{JzBqc4R
zfHoQcrI01~A=xI+?J6uG`n47K7TNfZ4;2*g_}X)U9vHf9C)6EvF$umx6%xvj5%eDv
z_M3RctPiE=3K&B%Hu=VhZC29WR@qOUJPUhAmrf>uU0Pb0t%?l`axuA!HU9v5QS(zU
z=HpPa{ZicT|K;EJcr5?IPI(QNaLU++-Jb9+=mkEu53(3GlViswWW{a2*v6Zmf^Xi>
z%jA!*hMMvR>_0Y;GB9^{cfnSf<`&bgSS;wz!Qw-t&fO&^H#aq<T?KUOd}AGN`=o!b
zOLw<;aZVkVx|(AoV16^tmcu*>7ap~I`t$%Ga21$7dW5Dt-*(D$v26Zkn+37@560LX
zcz~moc`tL$t*bK7o?Z=iS`ykYBRrgTy)m+1yQ}}_SFnve*Cbj)<D==r^mIaXz9rfX
zHR+g^)^+SH<}TTq7?HG7n_5=L{AtmCj!##IU~lpiH(woHd+@FX|7zq{*?@qDs73v(
ztgM&tH+6oW>)cVX8-anfUoVA`cj0<i>2h}LYn%}g5_#o!Tq@`6prlcZ!(A-HuKg@B
z0zf6d*K+RjX#aNU+L=8tyU^@+EyM2#v*wZGY+=lFFaViP+cD7Z<jF5eB(X?`0D3if
z<lpO6%EsK5BPLATnv7Y_=cG5#=JOxCkCk4!>hkYsH}f`hyK=fIie7#)TLSO2o!nQv
z@@`QX$Y%-p3pjsV6e;~u?2KUEJW())KP1Wyw||)F^mMPRCg1*im%7&1Cea@;GhNL1
z%$czP^!eh%F=rm8SOeUNZMmhtc78II5VzHXvCNl$ixNiaqJ>?K&%>Oxwhvys_^aM3
zlZJu6*;(T=v}L(qbtTHcu)x0J;@bA<r~j%`DL?bJG|k1Sw@a8-?h!&62R;;!{vPuD
zri>*dEAeqY#x_QsWk-e-6yx|4VQ2Scfk%U_PO_W)0eXw~DJkW-P$BLJFh^OBdHeRQ
zeQaD@#jW`GSq{qdZ*t3<HC$@{`Sa&R1w&e5n6LT2>*mjwx@qkFD!T&}e{cTdw1o_p
zW)wRQz*hP?>*j(EXKBMXRf~O+HD2bu2yiw4!-4@2S(@U?;*@@ha==X4fy2r9ox(6n
z$jsbcpA!Raosyp85_gT1-c}JZ#1hLSAZ_4F<Cq=5n{%6Vjfj{&!e{nSdb1uiQ5n#C
z<MPtN)RT8ApTB?CAtslCR*n$^wBkTr50B@mQr4H<@kBbwo=<6%f<u}6<a;q2VA((J
zUl%X{b407XcnQLQRGyn}_uFdET)fZxhKFX`p7s(pDN5g@BGzFO8fWm@t7FB15)8xI
z=WlS1BVJC|=YMZkt;$;FHUjg95~(0Ez3X*@>c4}F%tL(Z6+4>(y+6IwSE&eOj~&9t
z5s<PXHga=sm6PMv7H7%tJ-OD@@#1V**I~t!P5R2yv0(5SV^=(ZLUV)e;yb$iHp=TT
z!QRk(IQBWqkU25a1oD&}J9hAVq*7;c48ZOyE!_gJQ$yo_(g~Z2S~@{9z*{xNqiH60
zr==ST<}r?ni-tYP-UgP>qgePloJV2x2XJ1CN6if&3q!RY!>|sUQ;n3{^4tJfgVsTs
zRXWmDwens&OSSUvkDIM<)!N4VHDa38B>1M{mdIat>CV(h<wDsnNm2$;OeSyk_xFDz
zIfK6cDaDrj!%=K<+T^XS41Xxpz(W6;GfghjKpYeEpW|BmqU_3lj>$*WyqZ=~*KjlE
z#;uTn9Br@fgq8c}<65tZozGExhRW^fof-<<-iyW~V<r6UO>QMTL59)tKf-j0JzcX}
zuX$(*IpQ5_h&`YmO2QGm%+_SRd0QMHfHv`rF*JxK93;p5)OHRA@>DW*^-yDK!=nUm
zS{D<O_HYePbGWo&t@aszs<Jmq$>s6GOsB57oUCqI{i?6{ZGV492kU_RUQq-?^%S5+
zCP$ARbwt65TA#d^x|^ghBGsIo0Aqs{a_Gm!&MP0i%==2mwrXcNBC6^xLrU6v1lk<8
zcui6%fm#fOM2G<5kcIGMAsE>I67o}~t_Utxlf{6U+Mz~@bp%oZL@pbw30#<Y`^CsI
z@(_pe2H@)T#iN#b3H$nRfNz(6Xb)*k^Flx?c^=@)?1d_#YOn4TKdqQd)Ly=dL{mUp
z9u?Jz#4)_o2iQO>gttq_B_7XXb~hf_nrPuMW#!%fL4M||jnBRNiKC~}d;$Y9nPzSY
zA99=Pi#OEMW54tMQ4+qjkAs7QJkWjw5vw(QvKm=?C(Aq<>j>;8@}Oqa7V$5IYUXJX
zGR(I>M*ovWhWLn;S81u+Q_e4U+v4JvZmv5RP<M&P%!f<;Z=8WVI#s%mHsjed3B<y?
zt<i5z8kvha(O}1&q1#$sg&+DEdZ7y;jbA&t*{`#mWqc3Esjm9>?@fNrF1Vi5=Kluu
zR5*41H2MR?W5$}?Wk6R)mfMV?(AWZrf!hXa3?|RlH}{6H?=SQTuXXoL=vo$9ZzTw7
z_=`WE{);^A^78Oe@hObMZFu1-w?t}kPi%3jonfcQrXc?P6c(}!SV*~pG0+9kX>qUo
zYOKJ89t`6U+)tl!bX)il`tB-KT+<w8ArYR?mgxYy@c!KGJa%c`YRqk$7yH|TS%lMz
zG>;$WLf@eQb4rm1e6(W6n>TMZL)m6tD_RP*6E0y7WBm|J?ikr>?m?3ka8fZPv{(Ll
z_~5LxeUsCl{mnYuK4p|wWX~{sXLTw>!OzaMh`_a75N=;@^XmjidZ9G}j5<2rSlqng
zSZrya-BZ}AR|Dh}bi-EEJ0(5w>8}X&Xhtm=pJ3T<Qx+MLD|yz$%<OxeR77_8;HSmK
z#bqoW_3_^1K7H!XH^^FDQMEU9nPlFMX7Wc0xQ@@5SL{wQSmV>-#SJll`=_H~J<n>`
zYs`H*uASW%ZoDfLA7eCyL7|%OqhoISvUrS;u68&)b$Q{`1J{oIZN;Ov4eHBqEts%?
z&~o48UhAzpQ+i(HldY{SsqA2bN~q1$u>?)YcW`-AEKi=C_Qie$ZEN>UBYc1F^?qG)
z%%5XF@r$mb9k(j4ph@>R`1JiY(B|Y?2HU0k?rE1-AmfJxj8|~Wb$G5vECv^!-_P4G
zhBA`~Po{3C*@<_uG)XS5tDMiAdATioh2b#OxUw`J>_QFzsUT1Ib@~mYU;^X2cqjiJ
zTyMai2O0^N#`l24Bl#32SFqZK(@coLQ`y@`7I%t?4HT1<EY|>O2>l>Y?C9_$-?Qi@
zvwPr6Ji{G5iBaim^nyb|OCJEK?w;#{wdi9mpUgfb%)|O)<au-LqoXlGS3|6M?kV}~
zSzhQ``2oNFT9~Lu)d>W!M)h{nx|a9jmq<Y&NmP%tKhHn^WhZ%ZytRo|4n@^fcZ|g1
zT+r~b-eD~43D220$*RQ*$$>NN7@JXFfsfW8el8p&QO{nJp$>GO3zQEh4~VEAKFo*_
z;X`e$=9jAA6=@u}3~p?S_O2r(g5M%Wvq0*#qaNkv=GNb!zPLjYW?Z+A6e>hbm1v0k
zra>Al{BiSDbV7~8<hwUYN1skI!LKMODrz>SDlfdPuh(WCTnzI2{gyitht-lx!g0Gt
zFF`Cp-lZs(dY2K(bOwhJwBT~bEG(j)KHYh7I@^+wD4(XD_C;de#0<@~#+?t4KjJKz
z5MLsJ1e4w0af^VNyaELA8&~Q_M!W?qF_|kT<MO&Ye7fF_2hA##!^0cK#k^Lu{oD0Z
zBf#Et{c;yv7d%+Pa&jdBdi6me<h#<a>T6JyV7z6J!ZQ4YZ^(6BH00oupZJBrt`D_k
z*6p%%t)c^EH9^7bj#bfjys2!mti9U8Z!&_ax?rCxtDO~qk=v4~^z!+)!K!#pXGpOj
zdhqj<I#lJQlAIi;{UM?ne~=>>$f!2sqcdYRU?B)IU6tj(Hk@2871O7ZFVu?@Au}`H
z8@Rb`5ThwS^eD#4WRp(oRcjvkpSKRVEls!CfDwAm)wK>jM0<V4%z&d>PyT!lLQM?@
zJhyuB$K5bLt3zvZ1E!7Lp}a2DFvAMDxu=u`7)yx3`Rt6?Oot!Pa@7IaoTyV>&QEIA
z8GrjqmNsttYX+aRM@w~{%cXQ^dxd+iCfI&OcriU7*fFKRlQ?hXmYtKn1LeJpE^|uC
z#^(se#QJ&`tB+5eo&Q|ukZUu25oHsGWXWjC$|NiQK7jNlxhw>&ynrLP*Xs8<kBYad
zr0FxrTe7$ZDW+HizhdOhLEPL)?8TFCY9zf|^91iZNfW<hvE{5iRfB_HaRU^xgrZhd
zQc{vN4->o6h!nXp#-)F@3oX=+47VnQ0V`Y_{1@_Sz&7*d!g!S+)bJ{V=a;AW4Dx?I
z9zvUPxiWC!3@YV41&{3@dpQGDdyqYHYWp*b3V+!kyih$Kq?_N!Rn6%VX|erh%A&3~
zdaH4&S9_WBU3e!fKalM423nfOS2=4Q#TwFmzli7hH1VQaLFtybNd0a}NmUTVq`CNa
zW|)1!Mkxh_qpm<M;_aDmm-Ab3HZ4W3C2)-GCc5SIn7QVza$aGr;dxY)`Xu)0j@`RE
zh;GEcJ;s+bLTcVA--q9jLuEVO@GuJ}+B(S1ce+$9dCSPjkqxA&Bl!<vV$AJzqF1ZI
zT4&2RVN{(G6T=|93IG|3T?25w*Qhn@85^8vq0}wp2pdAj0N2THMXKVWtTk#jHe2_g
zOkf4SscQa9UTJ2y$IBlbb+2TVtaw7{D6-pi6R#rD+{~r3yj|o0S4YR5+EPP1?R!*3
z_$z@gm;aBID0$bw;y(>%6w{tIv$mpGgG75@;2yLja#g*NEAo^!7uOtd5B3|1ttZ!t
z)N`x<WOxC@HfdpIbm2UZok#;P!fmy)EVx_GPSRJP;oKo1Q3Kn4x6z`uA8?BTL|Tm_
zIUF3Op!0v^@$IouuN&y=bB^0>CeB#Z6^+}f&eAfioVGevdUJIVRf?5?Eb0hKG)gZo
z=WDYF7(L}|Q<m3O!L^xYn7|<bjwCD%GFT=FD?p;_k`<EqLkg)s1BGYl+@y#U?TlDk
zlZOkl<11(T8@#kKkiQj?U-8Pz9PaHQVLC*5lcW#>I&V|)4CG8@?QTdUH{e+m3LAu-
z>LTAB1hjLXv}^wXwB#~aB&@fOJd$|z6#+;2whf!^WxhOl3-c_hm-|S5ow_)q@G7zp
zfD2RA#X(@TPoC@WhQVs2yL8V*6+tZR!*Fs~O?1C9UkE_c?hf17p2-Hux;P_?_Km(C
zRuuy%>C6!y?2&~VI$VnHubt&hOi)KA3f;V`g&#CsWiTxvzOq{7IMX!o+ASih-V%2W
zp=CdBJL0@rP@j2M<V-6;$T@dNmeTqkXEk$=vK&;ipSTAdO-H$(2X0fiHBUp>jxY;T
z!K5(qEP@A5<#6%J;()4g!P(WJteffEI!Za~9P=td#{<U$@F|E1&@#Gj9bzYQ;F;4s
zGBaZf9Lqk)OrgVKR%ap4W+H_A=PKMU_m;!lJ@pcKtEwGyW|`P?+v&E(JnKON{1#84
z)4j~BB5FfvnR$el7{#mqbqp#98o+1R*h_Oo0taP>ZU~NLT{a!x$tBOiOK8p_5kym@
zx1Ni&MoPC;#;om{!BbuFBD!kJBC0;@>ukT^knJq;^@a4&#r3oYr6`n>zQ>IR=zblW
z-1iVGsj$SvEohQi$^Qa*mRrN_lI}#uTwoihJ>%t5><~5T=%gOl4A<v1aN4sa4_)(w
zTJyHI-LJ0X!yDq_@aeACB~?q#2N0R&iv(FWSYiJF?d&>r3)%(amls5#sS2@No{Tqd
zuaQPRnv+hle7@t=<k2nUH2|ZxRpvL|@E){!hMj*N%+ehoLg3XcP=Yh6Ea|<m&pOj#
z9Gy?EAG-f>JsAZC=a)cLaK&5j2Sl~A^ljH#7CUW@K7(z@f*HhH5gH=GEiVtO1}$xk
z@GZT^ZU2cIVH|l1A0Qlg6$wi(bc!c%b{mO*k<g;hSwWom_pM~mC7jxfa0_2We~H*r
zIw-;y_@{*k$@nk+2j~=691=g8_Tm82($!_N@E;Q0k-^D+{dczI(o+cnJNoN<7g&Op
zhAn&lZ~H?}D?V;ua2buzIvAl~Fg@q!SkqRu>;)G-F4zT(pVzmm@bdm4T|7*7D-|E&
zUg30H9CZz@fl}E4Y$Xx2U-zFrJrBYIS7+hYT6SZNN9Jus9~CG~uu@r`#(+EK#Wz46
z)R^S-P41pFG&P;iQf%v>T_8I&6L~%=5|Im&RRT+!z05C|mt;3hFU@wX)bCI7VQc|Y
z1jBcFe1F6Hh;;)$e|F#bZ_g{yc(Z~pOQw##b<Bh>FuVJ)uW=f?V{vpy{EMt_ET~9A
zS78}V7T%~Nmr{o^I8E*+GvCckPd7fKmR<kXb6otmE#~OrTyt>kY1fJjFrtJ|m0iG_
ztzagYnIrtlr$76DOg{+uQ37eMC|JD_m<$J;6aMvJC&axl@tK@N?2R+BS~v&S6v+BJ
zFaugPo(+F{W(^VcBp;@*jxY@k+UtRc8ZPoAMwU{{;9^v}WR-pSwlbjyxs%2ktJ=KE
z?!?*JFEssR->3V0xT}3%w3m5_M0Zo?c<wfdzDITeq4>aE^{c3+jxgMNaR2_R(XOhh
z1fA^z(B=<Ux4+s<yAQGf{9Z{62V+eN1aZAvwW7+gb3DDPVg9x?501QyVDxJ*cW;UG
zCe*gA+xxKP$%4rO3A7fRBVMd5FUS$TT*OZ7Ec*NH`q)B7X1gR3F60xXnh&H`n*P|w
z8IU9iwpN+4eF65-W(<ShqQXj__Bxeyjf}Q;k{yhs1Enl?1UAmykWP6lOb^?`zhofn
z+&o@dGR&Ma+ElvOCZUQHfdZ5S<FblH$QX(Y=(%%YP54q69CQ_+IRD{Jq=o}n2VLaA
z+|QVeE6yb7th?c#cFPdcHnSOHJb&Z{d(DiM@s(u`Fr_W4f(Y*e<_ocgdavHy-U<!j
z$D)pznZ~WH3rx&yPE|4QgPeGn1cLrrAAtOz6n`A9OQz>}YB^T$47k8~5cJ<+a|hAQ
z!`nN%*3g+ttB>v6vnMysz(Q9eerCLD#Ttg0CotuA;Qfq-hp{dFg=Jn~8pYW%!LAog
zw}+{qUv$GrHtJTU^DO!Omder5k(;l`3$t2yqHATDn{@dHV8aa(G$mH?G3;UaT?2On
z`$`uF$b6g=1>-jo-+U8Mm9XFWTNP48GJ)t=fQ3{A-OB!?upm{8^qS-Du}i*qc_KzD
zKjeIHZZmR~kTy?Vf7^>gWw=|Gc_Bt8vJzp`Cr+Le_q@xk4Y-Ho*4P4b=^lC-5vcO7
zDHi8rUqB%7#=P9z%2E*Nc4REZ+nRtBXNeYS#RFfH@LhclV!`m7U3ui#OY^cA9dG`w
z$MWiumz*L1cE71@yBdCtWj?DAGW@wrDd~KT{y_X1Cm=h-&$e@@{O!JcWZRiZ&#jo}
zMLt<HIx-N*njlB_rlXHr?FnOB6RLh8H5)_K9-xlAoROO56xn?=a$g)V>dHRYZ7LqO
zLEQ?26XCn6Os-)S6&6jecb9yBfbgec=Om~W$dJ~}O=muQt-M_%kVK^8lD^jv*}EOV
zTqjuai=nH6iBJq$=z##bmp_j?{rl0;>~FeFwM4k+2*eX%HaV4RCf?;Yz;7|prMqwS
zyO|T{MN3@xmvN>JYlzTQb-5N}cVK`(<teJMhgIX(%GQ$sGI-mNNR<n~T-Q+<^OUT*
zhS>blGBZqK2kyqlr}Zo;pFhjkM_#*sh>zLBtgLXNTBgxxUAV^cuJMwwidl=7q<nlE
zF>*6T+^$M&zycbYRq$)P3{Tt5=s*s;xa6XtmczBY5<DPFt%&)&ChEd{nJUkU$k|y<
z5?2G5UIvV!9CQmCxL}#1%-ZkB5RjCR2zY@_m3(>n0W2d-9oY*=l$x5&f2;kqbn7}y
z6pJ{UyV{Ebr*N`I@VdMZ4#co`160rBX)1v)9+rS-gMIyf@O{ceveKGjXZ!lakx#wS
zG`Okt<^?ZhTa<ZIlH%j-ff6eLXA633@+v@(jV)_~j&*f<lVfo19Vtf1)=^te*gM4}
zh{88Ep5bo`Be$8<`s&e42Uv@CJa4G44+3$uBs0@and?5FJVj2&Bod}`T5$tVNZd-;
zo~*MS38xFFV-SQasVq($S{$}qA!jH~@eFTsBPf4g-P`ZHCF;QBJ9B@t{%LnUW}mJ=
zIWV(N0#Tq~$@C4fh80iC;)GFNZ3&ijQr9lcPrLR|`e%O!AJVijPOB-^e8$LsE5_NM
z@*#(7Ts^)N_0W>p%>YPaK7`rWz^~+jJGg)<T7|^9Tngmq6TfUE+=lj$kJR)&W+%6l
z9?{;H4zP~S+mWG1=Z5aJm-tElZrd;GfX!UDsfvd+#J(0g!%=Dws6z{6^Z)S${p~Ry
zeo`W~-uOT9y#X^$;5TPuLxhOqa=ei3@5Rz`^i<}~{ut`EOm6nrs~xZ+c_h8&X!lGl
zvs>K{=HJJsc19@vT(wyEWEFRm;^SezeQUjDHw>Km`@?o=x52h`_s_|gDtZ0-yn>!N
zc72N^S}a5HtMYmH*Z&8&PPoj@cb0tRa*X7=uQ(DDnPF9{x-(FsVfA=Wou#4JxvzB3
z?3-CGO3@ty_E-bGQS3pAAY1&5jhbh>ZM?9UnEhkJH{mQ;OR~WA!Tsd1V?t(afnwMu
z1H{>HtNFgNyGEgV)a7I1=B%-c8+z{hq`rz|J9+N!pst$nv$agUjr|+{9_$$ZT|H^f
znc~K^onMiCm73qH@@}=4C1ev2koHoL;e{=(ZFDid3EW-c41ykFaVtWZhQr6|j|#uo
zoHnNas~rC}6CO8wGiRR4-Koe;O7avkVX(43dNh0xc)F}>`R~w0Z0I9ERdVu?IibC}
zMrz{6P01hV7EaC0&8ch8S?r9Pw}T?^r>In~7ghNlWNX`Ywaoo~?pCvJ(QaAU_s5cv
zP{vy8K6=7nA6rfRwa;ssa}%$}tC(F~8?D6O#w7XXnaXu~g0Ihe^!l^_c4CnlA`kHP
zqu>_NS5KoHalpUr3{S0tM&S!QNiO1j;|MZ3PdY(W8t>{4(fZ%ZddNNRb1&nU5IN`k
z)4U!8qP$X$!?)mGrU{}kKFffiRO-dE_spBe#V562NwJnMPBy#%<YH@Kk&3(#GH@sf
zcKGJ5l<my;8lTrNtu}uBX0kDRBDzGNj<Qxz?b}fzQ}A^`aXsgrBKk{ecLg0p-DiLB
z2$;<63*y>w=)HT_o9g7{Tc!s?d`o>KpEvqDnF9~pAJR(Vr?A7Z2U>XN?7q1rY$F_t
zs2tG5=eC-*Mr@Y$wfnb(_Q!ToRTt=#z~;Fh=LjiQ8(o~b-BWXwlVfG$^)dP??eEy{
z?sI(Bb#Y1;&CSlLF3GE$yx4R4!3SqEfy1UbqvDn3l~sI0-MOM1y-kOo|8A=FA%ZPg
zB$%~_NAGri`uI-gjF2TARcwE6J-4gINQ%At(7h?C=@;(_#m6_+)4g$6=N~sR{T1d3
z$c<H@>&^l-cnAhOoe;R429&FfMXTMqmNdF^7SaE#zf!{t#|s4R<7L-n$=74Kgs(+W
z{9vHXBK*vA$l&{hhTVx_z=XnK8&yEAt-E!H25#pF9C7Fq6&habS}(D3Jx|4d^`77%
zeP8>A^TrCybf!L(`^&pbB{(-fTV(F};>ETj(3`1Jc~<+4s{i`SifM;NYnP3qAHa9%
z!=iE<tObzg{u5EH5=GQrObae#J@>-%-z6l%Ci$!>=RMiD@eI3s7q?bEYPX?mIP}Ab
z2_&dIC@3%xTesRdF*6C|<=-Uwv>BULf&4K)#kP}W=Bpd-I{R}BC{KG_oXtwJ?kv^3
z)py<cn_Fy|)`EBJ+M0NdqgP*!e-ZxkHQH@@#pP}3Otf&AP+0fat4fpEspV90EP3(X
z4+Cs-h3OU262`VZ2*(bkIri>d6$JnsHkX=ikK^FKaO>Z-9IH*?qV}F$m*7A_fH2sA
zZZzkTAr95WV{k6U64cKe8D;#Prn*t-{`Z=)I#wCpGyXC!{2;IE%7d?-Z|<sIDWr0q
zVo#U->75xe&Yrc6h5mK@;WC}xyP;bmqT}vgc)#^)vePAT9oL`9TKNIODM$U8LeOWl
zp-T(w^6HQTEoUV$b56IRpc7rjg1Ni<?=Y-2G#?(1JF4>@#d|N6pJV|TWU?ALI!Y|h
zlvMS=iQpq9BKU>BXmd}d)$}~uiw$~IqCZdHmu#x`{mDix_x`Hj%bW8$!mnNs+NG-Y
z!13wd&h#Ei>-NhNeP^8Owwo=EuwI;fpZ)vm4epBD9zPs@RK%7DoPOxB?KGak%H!td
zfu-Q-g53BV%YlUqYo6x#*w{r8KK9wh2>;%xICXOS&O_VEXZBn`OPo<e9YHh8%d=HB
zh{PcU<M5hl979FRAkJdJ&{_H)mEo-Bbw-wk{gmpT!Iq&n(^mL51uwGi3Rb-}cG3L)
zw93M9?aN21|IEH!EBK)<_Hl63P;+B-t%iravQy;fb{(6F%QKn5Hvu<OKYu<jSUUC+
zOJ{NB5UeG5JuY0Zz`{XEFy++?CPLuf)AyA-{E8#>;W-M3bOf<7-&QpN1VJArCOlxI
zT!XvbOnlX%=t*PaC$Cn2@Mj&3JmvF3{Cm6nT1&qXE#H0=Q61h;Nsg$yA6I#1PIi{4
zZVAa2)d{9E(6~3(UnMnk`=;XKM-t4J|8C8b1I-4EoF)>@$IU$r^_xi%P~d#*OO6v;
z!D4uZ)1U|)&F_hwEMO&GX|o|ugOQun{Or`Nq%%CjF^xy?K%7AB|A9%~3ykQq=v<64
zV!NOccOcAqi<w(K3UQutF}czzP_`<*;*Xfq5tq=3zC#RY0p`<9_g;sHexL;Dv?v@K
z@_+dCXTw`sl2K2&Sl+8Y_V!l)J!LbU+Bwph3m#32De@Ayka)fHqO{asb7$O^A$dI=
z7OoG?&A|^*?_IIl<^`z^tcjCk59d?zk07=nm+R5!PY*j;J$Q59{r=s|wD8<*Fy^L#
z8SX*|q=9x|9<0|p{<EsR<i(*b^g{c`x3=ZWMyHyu_XrYM9g=6~i;}+5?-+>TEo9OW
z>~5G18fCqI)L6*+$0b{R>mS|6|Gxj~;1)Ns=8egC?8&H`gw@PQy98ab5sV`J!C-ld
z?vWcwI+oCzO^RiF?gG84tNFkNGr|9TKqA`g`B)}i2Z(~Fx59MfKlDP_SuCFdwId7j
z?rE|%AdOA=?n6EqCu63bVTKH!V;glP)Eb&+W5TZ&h6=sTxMZ-{`$x5V{BcKEfL<Aw
zbd}%QJ^V)WX;Or%2LA;0N({j@;nMI;-^FI(X0A{fnnK+A<>vZ0iDtOMC~;SR0@i3@
zZ$kATmsV`o)VCMsMmL5xlkakIn;S`|!m<@Pryxrl=q(-F(B_rr&G*;|SKa;}F|}=V
ze|0Id^!u+v=e(kZt~-C7SluPC`1PHvhpLGrW#a`_!9B`7W~@!4H%~p@NEzBa=sM6X
zX46zdSkk3$3oDLFDx^yN-Rc^gNwUw#_XQGUz~j-J$Dg1{RHt~ULK@rv^mG%+jNJ+Z
z!Q!&ak4OJ|p-=mo$`5nxd-w@iRQe3QiXKY(jN|;pa_e-2&c)TnUypd(Rq4N*eRB5F
z(ae(3TsEF{iVXopnKZZAJJ;P$2g+LYRSR9Z>&d+QZ17<DpU#GmQ#?NBi0AqX&h{6c
zcbpTWRgsEl0*;S26Qu23nB0Of%=Lo0t*w!P9e*>4_pQLxW*N9eAOnHjr{t!a3f)6L
z$a1s5N0!3IQ@6R8sTJH@>2VrXACE)``0naNua@It$&n`IlQkwocWjlh&_$20MsB~j
zEMGgjF7i+GT`FIhW8)2tYgI^eo`03kH8q%%*ao7^H<s>Cz`&m35QQzDIcql!cdg_+
z#SupcFHw09fe^4;1SUgmb@MDtbC1)wo}~6CGT`@{$pN8}a&sMD&5%=rj(t{*jQTZS
z)=XUf6{}Noa?iI<lw0AEA$QN|x`qm+_B0gVnLBX*#*H=43ktv|zk^Bu$$GB%jvapy
zo8{<$YoPilRt}*4rgVvS)b8f3WZymtgcF3T6Lzr)??O1YuS)n>_Uvk^+Q(y3?=CZ0
z-3mDv;;A(8<$eq&kLQ8&RliRcX429N-w?s7PTIvGe{%Je?3r23(UGCxJbd=-nAXFV
z6*J$SYkB+S<kJ2}q+B@=r)_==m>1G{6tJDtCf?<Ajg8g*>$rW$#Fk>8a~*Rru-;wD
zm0lSwbv0sMrBotKJjz&`;Pi@deP(x5o<*eAsRPmT(TTTg`qXx=K5cCL%zZOebpNGy
zAqE$QK}tR0SsdJ;vylTHYuJsnt?9PBe{3*(Yn1#M__1<>hQcBI<}KWn{=eMR)IBf?
z#PugrU7W^+z9}Xcw~c>}dl^9ETzGzNd?kbWuH?c*Yo1wTSHy}+(9ADOx3<Ny3jSaE
zscnB46qd>_4UZOG+dHW9NjhDE?pt1_PQry~gI`-jO665mS6;%at!dZp-4%dICvD00
zHk3R0UzhI8jeMK@)SHBedUoq2!ziBULl@?)C%;QbxjHih`Dm}QVPd^5M90QRx%4-*
zWa4qH$vGcGA>nc^570n|8^Jk>L<Y<R1EC7iVoHp5#-66e#@+hc)(ynP#(tKM^615i
z*2q7pwK)3UYsc`SN!BJutTkj(lfr%R^VNI~y;tRND_0!)tm`LS(-k^G2dHm;kNjf%
zE0xcsD!;tz&vYN1>1E#zS=wO$Ca}`sf)f^YkMS@{@wA2sRD2Ot0>|Q>`o_jcyynZ^
z*aPk_pIZmaYL(;|`AdyAfieoqDpMajenHj2Rjl>=EVO4I@91@pW!6pns&7(kvteiJ
zZn#o6;U+@c+L?I1Pjs&bOmQTT+yniji0~UPG}uOfZQn7X88sqV>_eE=%Vqxu^}T9+
zOAhr+D0w`??^!rCj=bMcD{z25uIn!wE2qx7LD$)9qB_;}bg@^v3avTyYpv7t?UcQd
z<s<3%w*!wz8nBg{>sksgU%srM@y7|R(Kvts55j)qzt1l=7QV06e~+uFZ))6?0hN2v
z4}w!Kg-4rRH56FbOD&>k1xqmdg>oolMpkAvOU%FZW_Ev2GTM?b(oGiMFJD9v0qsZW
zm494PRJ8O~rqR{-?z9t7Q)f^*ge0DApE%)8p3!UD4Ckc}TxjHB;F`Y2kwM`UQX6!O
z`TMP>*M0f7z0FL4n6L*^_5R(9)7h$rvRm1+HqOsaKC85mess#h&Mj4F*`$yPlq4ZI
zhFZ#8xw<r-`>dfnUorZGBx3PVdHJFW5j?T5)Cz}JY)t>8H8wU@VaxBr{4vhN>{8cN
zkZ`a4%3s=yBqwMAMNS)Nd(o1xn672FGIczxQSZ)I<JFNGZ+_Y*==ga;JfT+CvXZ`+
zLxHX;)iOL!dB%p%M2g4Ux{ygl+vRoWPdm<pW6Gn({yY@ftDL?Iqb1T}=aE^HO{Bx$
zLBEsgiS?}g<$e_B{h>8IFlB;;R*bEQ>SigcY7ThW=Zy>w`hx7>Oz&GNZxa!CypXyk
z<N_bFa)D~iOv30N`_32x@6*8mg=^W>FdQ?G)X@6Nm+60Fp=5)F3Vc1*cbBH*SLa&H
zb+lPpX-jM{e))GcK(a?pvg`6dQ+DmwE73Kgl8XYmjpKAe=P1^jx8JG1WU!92&}(Vf
z`CHPQ!ZGm-kRf{IjnRPYV?A_^VpMk~pUu=!<N?F%&ylO~FCqX9PEc)BS-X2sYSWT3
z{VpLY0|IbAuu3K2u3|_!MN3xS?IuAt+VH-m1SE08+gpv?Eg*F8Ev($V%T#Op(?*s*
zU=1g|lu$%shFY+jKvY&fgJIhjWf%a=4!60!0kI+vR-HUspsH{geP=&cuKcShZG`9b
zLWT4#QP+dNaw#`6bApeG9=GbV9@6^HZE`F3!}-sfpDehDni^8x$u7AS(bM_bO%MNV
zcMLw19YYihn;F`lzRD>i@|V@IB+5P5h9rYN$;xVh27eQzSHq=|gd29tNksCPvvqW)
zbc({oJAX%JVXlycjfM!MrOhw~aRPI~141>IJPIWcwnF{CJ3iXs3tKu6&?LNFc&Hia
z|Jb#w@)`;MBVa=w-T`ASytF#jnh@$1bW8r|N?s349fzMjQJSY(6Mun6NzFEQ5FCk7
zUPQH^wB1Te8yCQyX9Fvf1J;k*-ZXg#tYbME_qwna{?&KC2<^LH@%13*L50<ez9SnJ
z9X{#1H5sbb1jnnc{X0oV@xFg;)wyeC65PX8E0zbU=Gl^`@&wfrUh*XSNLeh6bsc}c
zsCuu&WpykXi3zvGClh7&{tUh~?wH}a+H++x^}5=}o!8c0PYLhhGt4Y`=Y8+&#ZJSo
z!<<~}!dD@o`6<%-9;p89X83zirN%vZ4x`{>w$1w<eOb$=KzwH-+greY3<P*F{P3#y
zf`YbyW+ba9=$Q80Fo5YVYWA09(j9lpk;hOpF^H}{u(5b_;Q4~|CAAPNG$#|5HdD*a
z&P#(e*-E;hWE<rn0Rk&lcaiy8bXlgQ*{U^L+ambW%d__VqvZmg$SZbMx}*1aEhK<f
zu^xLZrK0qA+u@J<=~ha5hdozSAK$|?zwqPM;z6mL14owHZ7;1}McFuS`qC}7H9^7b
zC{L!~ZWm@1rxhOkij^%Er+=?Y->7nK?U{M^uFGX9)#eh6_3vLPjh9ENHq9}JI<Hn#
zJH$(o<*O5>$YNRiC^ixaE1=Y0SW7gmDq+Ux#GltMtBe$p|LDwQfXD@d&UVw9r}Y}A
zEzae((|4y!K=h~kswjlYJM$9XRuU`}O9z^_Op4xYd&)BFaA0w3n#rTs`5+9;cAhr>
zD*#T4KzH#Nm5_E=Ct-&*G&RS5+d!bd)Fqfu;yAcb<_HV%lGYV+>n{8J-^t?vzg$&~
z4w?7SYuqw@wQj$T_3Ql?L;9EtFFSt~TBnp8b%-z<s@Dj3pv=beh`pTWQxYXT>|9av
z0IgfTX%R@zFfea5dxu(vKX+;d;>}AXz(`~k@a>i*Vu0fZLE&r*5KS8HZu;7=7`>yN
zkqYb1@BcH`(gM4E#G~Ply^Ex{xSuZEwVDT%G{n8`4VN-ss_L4NNLY^GJQHbaGK_$e
z|F_Xr=;LeBwIMkY7aynkpYH^_MsZ!Wm3YSYmW`Ga+0CXBU%Jv(=EIW&OiTN&P%^Li
zxIB`Q36{DMtyCe+)D`1<S5Yh9(sX^@e~v#wq+06Yug5pd^Da~WNLg4Ia!@v2z8;}|
zc5&8yvTD!U#F^>Sx@)f+d}<SG+o8jD(eG1hpq<R@e|__2y&=4^f9jpZh2IpQcISR5
zy{VNms{-3P(!Blu$C<8asyUAiwOqx#%iccK&&~y$ek~~6&)VbJUclXk-93p8iVWwv
zj5m|#Im5@IO(!%Swsh>|-_T-uz&IfHVwvr3BHzo6jrc@ousf~l(kb@t28P(Rv}eCZ
z5=wes1Rcs(__BsE@}R=fGvD4a`GKJ{8;?@9Z4vtG5*<eS|1`*5H|S!%s~6z=ZNOD$
z{Bcnxc5*xxR7dt-Gq*=Bm|?wnO+#ikcGik{W*^oQb|8^TPV8^qcBGeU6H3~lfNyEm
z6^8o5|2`jW6ATXW5iXY!q*7Q^bR6!6seguB7gSzax74kbt6baq$49TLNhHkb(}3kA
zk)m(sDc-6Q+;ew>v%mN59%6TLU!UfmbM$8-qeB0Yy%Rl^vlrzvMt{;<F5jdKHFrF*
z`1LbJ|5Wme5d`9Byeah>j&Qz{Y7TE=V{yie&mE+))Oc4h)1Ybe=w(YmOfCn!vv8W^
zrG8E8k>j;-()Zf*;#28(g{w;G+>e3awT#u1eKp4|tKXjK^Eat`uA={b)f=(aN|q2|
zofo6L-*4C4{O~TU;Cg1%qMdKk9ns1u#Po%*<(kaC%c*Nxw18oJBIl2iV&}Abq-A6q
zvWJ`e{<LVdIZ%e+hrZsz*_j+Drs?_2pnf=#85>V6l?-VtYDj(EIK86LJD(w>B>3^~
zpAEk&&S`xqP!(s~o*w&u=z8y<rnWC^_|T-O1W-YGQ7IOhg3`etiUo)$2m&IVP(*r<
z3L2Cm8ihzx5RnoPAv9@%f<geX1nEtRQi6nD-xcrgoB7^9-pt%Pcjgij&e>=0wVw49
z))dwn|G+P?;S0+2gY5AkcznGjR-Bh12x_@}tPo&Hc_2DwfM$Fdx~JeyKN<{os|6T6
z8yMM_R^0!<sNK`>Pzn4L`@FN@*t`?7-T9v2-fojSRsvLJ30;d+y_q9F$o(3uoU$%;
zXQZ0i8e(N^V#HH!6eN3%CdK)R%@MU30+K<tHX+<I7(1GPp}9<CdDl1{WLVYtgvu-!
zu@zAkd*VX>^(<gS3q6Zrsb~ejg=c*WNZ~g}&n|zgdROGqpp0WZ_l+m#hqmbFJvMuf
z{N5)K8C590r!Mw!c+B5Br<iaD$wzl62mX4taMTQxK2B77W1v!-z^(;BfmskVh23~b
zn0p3?!T|&f#m4|gercYa27Rf$76+qW(0c0u%O6HK95~#|<i_b(a(VV|(|mUu&gHpl
z9Q>H+jr}j5Dh`#O(N#Y_G{{@-bXBQ2Zp+_Ug9$artjGk<Rq#G9v&w^VEii>Lk<F@t
zK(=pBFvtzaHd|^1)kxU2$wR;XA**|#5ssNom}cv=UeXI7McdQ_?e?@?MrLeRS=ITH
z?UvW{r?X7m{~Wr#Bh~G_UD(bhgUp&c2OBRK*uHy?-7=B~c0p&U$3>36kYxlIUYdK}
z!cTa_22{3>K(TiF3^3#Y+zo(Mao||MOmCbA3xg36<EPNkx8qvObcFIPa^C*COB#Fu
zcMCp7)P!lYiEZvUoh@p4LITA)-L+6n87Vn;@+`YRthTsusvo<Q%;o2W)=19o(*dQK
zK<@+(vm>fr{V@QwqL5k0lbuOradfA(u(rTv3{2?hlfaYe0f?_cP}e3re6tle_@M=W
zPO<l|Vt4rd@MAE>E!2jAn)FkwtLu|rX`87VKo610^|b>boCzyWEV|dlklU_7lSK>8
zJT;tuV#Eo_%pA+L@9n)uK8O#s+}opvdVh&;8>h+TFa5o}F))<t6x9rT^ZR()Nkj24
z-#`dVuHi4=B{0cW^{f*J{E3M?R7+dXkJAt^;$cJkb^%FwoGG34XUhD)n<Dn_>H1W#
zty6dW%d@Y1+x)1{Jp=fbPj2XV+kP9d_*S{|%}qNF`|Qagjm}Hi2(fXN$#A6G`{VNF
zYnpHDqqC%IUu5nCSYlDUj7tOYe@hT6s0>_LF`=U_C}VEt>gG~CA5h|%>f?Lx6Wd$f
zQhe1n;(=7z)K%<U`%eS|c?u%4zW;SDKzp!vkDt15BXvO#nGm{SQ~6tKz37F|F)y7R
zGJQ-9ZTEU#xeMIVMVsX8*-jCTqzR<O<~8mf8SK5I-6b<!K64BK1pus*3oebp??_a8
z=p@s24!#Am1r^}^6EJNMkv9f#^fHrr_7nbp^dWm&5e8}z;s6mUB(Zp7ZJdn-ecPsm
zZB+I^#BN0oRD!@!{^$FUDDG2f(c<wtrH{`pYq=dkAeIeAP8F~gZQ?-I3ie#%(ANHi
zIZQb4MACtK%GT4<ll+nZz|=7{N7b<pj3$s_fc<X;94Oy(F<yL8W$LEKO#1DwIXA<-
z{BbhC&U&p$@f`QpGZ_<u3FWTC@qZVj57g}%^Y6SwyM0csz!2{u1pJGLht_d<z`@0#
zhTnk%|8UD31pJL!PQu*SZIeymHN*ECMs925S$GDNwlTV|pEl3QrAzZgv_aAJ(VXlX
zO==O$$nw}lo%i2pnrzpO<3^Y1YP34zxQzqIU|hfq<G((SyXHzsjnk)aMPje8yMz&j
z;o_I0tpi+=%^p2%V1?EWoS8gE2A2WUoh1-+-?U#!>?32EvZ&0stT9FXUht&C)zBj?
zw1Y-E&Gi{Hmu27-b>-3}GRMDu#@^lbzp&k&cvzuL$AN^l4}p3u-SOF26k`Gp7-|HR
zYVQbhR2UE)3rY6cO<-)F?(Na-{gI3ft@<MnsAT|3<po72?08KcJ!w=B@rY)bslyR$
z{>rrtiX^#3)lS40tp6+jODW#O8UFi@8~p!EwLxxBuQ>0X2YQN(<zyZsd)O%J51E=+
zXi0XnVR)GQr|@kZeaAQ|v>IT&0!SJm4MdAG6r;0e<5^MrGjaeI^an^|LmwYONjX8^
z&DedN4lqhl2u2?H7hJ5N8+fd6H*yZz5-fOsxq+Xb0f6t8*syriFb^;guKxCDn}h-n
zl5^_*eTqLMY)D;)5#_0W4FHt6*<6yI0GI3l5>-Cijd9=yM_7R(lW(H=P(huZD&w17
zWIW-JyY-yGdjDe&?n!H8>Hy0Pkka0Rv?cJRTrUTlISR^9L>DG{H&z$}c=x8`R>$G(
z{s<&rf%5SB7=`#5*my#qdeT=WRuS=_Xr-qE|0&1?!Z5OtFM#QQgQi7apC`OMKbx`3
z!3APU4P)Mcz%I=sl?#Z006#A##|->^0<@uWr-Q7z?6C1aXhieBuX*SW9L2jIeEf<4
zb6y*am!%aHX!9@@Y&FUek{k7clJ3X$*<c3k<dE?H0-cTEZo=2g#GhvTan_w1P*=2r
zqnbsNcQ<mCM92jVrYn1Sr~u<RU{r!|MW=gIqxS;s$(nQUD{Kv!z%Kp+iP6wX|KDM`
zp0CmvSJD6Z|H7uz_lIaL4x#7mB|kiY(OglPd)FMEFjoL;Qft!VAoAK1D+fPMJ<mAo
z;9ej3d}IJZqbwovlP64jzyKPxEJCoEQBWUH|1Sq7Kc)(4K7wyFrTads9KM)R=~)IH
zAM_cpp<DrX>@T2tY5>B;b8wpg!<AwB$}?yKJQ?23$Wh+kFc!S6Fa|eR1DQ<}h4(l5
zCnw5j7K;f3yp;tZ!#$<ez;&gbl`Awg+6ZAJ$pCE$!A(sw*3|}RMByz^>Q%mqFiz9#
z5`(y^cBXR*AjhM2cUz7hZ#xXh({;7CjM*87_|MHq*hb)MhIw|~qJw-dp6s!vFSS}h
z6~Z(}u#`hSckr#U6aUHkQkEI-2xn||@Q&%ji~<Ehy44Y2P#Qu|k`*X5_ZrDH`So?f
z2nH(-{rG~ed6+w=0{;odB}|5@jd820<pG<UGW`vxNHG%yq#q+!J1<#Iwt)XKjCBiG
z{$V;r8!Z1@4d$itO_%<kS>Pc|rOf~K{K>5U-68GW(P&l#vb`8_19SkjB2l#^9`9^n
z{$gshvIci!%fYMt-*dR2`rjg*;x=W-s-f6oc=NkH(@{H5=ab9A7;VUapREgH0(7e_
zXBeD#pWR`s)M~c>UFLd+`0Ff?kq~5p-7o|_D6f8<cgg^`&&M-{-aPK24;hcD*53bq
zd~#=G{=yH~HyzQwXJB_Y1G@tWDPZ_IHZVqEN&hBtlRN(VLo5O^U@^eo0RrCgc+_<v
zUTYA!>Evf-f{)1@L*%ihEQ}?AfGHO4_~aSJyNafzL+AG9yqAW;>>}{V1d#g=9`Fe0
zU!9<@WEjZ-dp3i*Iu3_dAxkRLA{3AK|2~rO=KLkTD_i|nW@Y^Cgb~yWlh@dE0I0Uw
z`-x3WrqqaadRUsXlbZRrr==+vSp&tAGyXDiyE_K0cYB$~+2AZba`T`xPwv`{V)G)g
zf8B%5e6FL*WE#!>w6r++<^HQ#CZ1e`(h7g)wDFbA&7Z_K=O3$nd|=;SXl{GnKP_mc
zi?Xz0Q^Yxz_D9sZOz@ItRidrZDPnX?4rZdydc&T4ku!dEYo!j|sVO-WbS5O^UHRx!
zE3~<J;x-&V^dYEDzxG5-nr!4l%gJ;YxfgECCDv962>xxNo=%I3{Qq7N((Q|H&i%T1
zV&zbQ)_^3kE7nVZX&nlj+&Rrc$iJ|2J9+ZX+5pW)zy3ku@rf%GaAmV81_oL(kQ0~a
zkM^IPf`7E%fnjHtcUQ+KKOf_@DX{O^WMt&H97x19K3Q7X$MAw3)L&p!d5LBwB|*4x
zJ|^c^q+PimfXVUkmD+qJ6Cl~|H^=rdKexeFr{ZVeRpXrh7Lk4Yc}gKN$stDR<8|*z
zpbM_-LL8KdL`?HhB+~Bqmv7(bvlbh3nluSXv^od#{QP{c7BC*?K{e;h$BQL-<d_9N
z2d{0xzHrDBcR*AiY|k+*bnf##HLw1wB0qHg39~N3<e!~O^1F+8D|~QBQSoBg+}cAG
zA_c5>JupU}DTxfDoj+TCGkxa{sC=_bmXg|^75Z~&V_ML@my=ULLN>7_x~&a7p&{&8
z9iFP+Ae*Ap)zwuuCeaG6R?K0peGm{nop$fvb>HIse8x+^p3bd5-|I$F;MHGGz=w;o
zz8?VLNgT63bvZCCac9FU#OU@yT6bIS7yYJJKYGD2*{Geq`HH;B4e?1=C9|rGj8@p&
z=~SRMh3>(jSE4Q<b&%$CRT2#~!~wa{R`{dN4y#6?boOWHSYjh+m7c&>!1@@}aw70a
z2bAbMNh|Rn7KUK#^V%R*Dj_e9pnZMJ#?6uEB+_}w;P=}QxzUetBkSN^l*|-541$1;
zj`CABuSdMW-KX}ucZw~feKwUBVw#hqP!V&QULLB+){k4Ayda=GTqTXSL{6ybYL;2@
z$nhp+x+L<Yvr~Y3@SR4Ih)3zBdrJ%|-jL(3G*}D52JTrxt=WxewqJag<C8Hx)mk0m
zBYXDeyP}yNRhkdxINNo~i;KU(Lhb7BKXRF5>30ck?6){k4ebvUcBl)_?g2N)YKPB{
zmeA}j+ri3V-@n(o+L_3ID-k`<C;8zlegd8g;Yd_Af&yW#H1qK6>>EVUio+X)+ZYak
zQkD}5NeigN{5c@`p~xsFk=OJvPEyVh<`MTeB`xt22h+wkra|`F%bpNHpPf}?IxgY1
z1@4;J8Q6R1^maad5hqeLlDU58Y}O;z8#jDu?<rHKw4bJ0PP*#jiHP=KP=DUL%F21T
zO}(&O;7SQ_N%k9}*{!fLOcs0BoZ_O$s%(RbQtB2Q-r!L%I5D0moAnmlsSM<Pydtc^
z<=qIex3@namPz)vNK`_b<-WfB>t@AY%BWoBfj5&&d9#}B(L1>X5eRkeU7o#GrG(Uh
zMgH(4Sa!3YmE(DYp*D5;RHWp)1iT~#_GhX#uGR=7eAZwYoN!ih6Oj&sxby+nDX>w=
z1<tsrmO#bT3#X=8knx)p<*7<h3*~9$;%Vb2IyUSVf&xbQ_14&ooSn0OPfQGgE&d5}
zYrh{O2QTL@zyI>(3sV;6x0O*2_@}1=c3%ygY-7*376q%)LtXrwjMvts?`aR<E@>Ld
zUBMn!xo0QHB{zBn47L)N78m>DQqM=-lfF3o^TRVRAy6l_I_Yo?CS#23NKxd)U?k#L
z<1VC%Pxk?NF&1IY`reY4muDW77LY+((=f{7W8%nIWRei+Q$SR=pXAf8QhNNkD$hjr
zYV6x>y&RHBcq58Cac_=UGoq`Vz6It6^c8A1J&WLHIl0Iff%bulMDYe-H8d<~gB5Xd
zx<1BDUs?As-Lz7nvKl<gmvky{9J9kt$45_yNk)FL6lWfkb<#e?p>#%WfeRU!*Q6b;
zq4Dr0?2|G;UmHukUFhfUA6Irj)5aFD7+5-t1g4o!uWf#jEnbQ?dFzPivgks0ZQ;@A
z!HdNBAd<+>avr$MHMID7=X~!N<>>74{+gPa1fGM`2BePHP{g#etE)?VE6%$0=ZOLt
zbyi(-bMw(~p|Vieu0dP<v4&>;)Hracz9mtCM|x@d%+ypb*Wd`4Nw0$+>v_3_HeYpX
zi%Q?$28~Hi;AaMqsS=t0?cJIC>iuAI5@43V%kGavREjZwCXxQ5xhaT55|JzFHnYj~
zu};~n8qXL>tOsWuTMaGU+`C<zNg}zmR3pwOO=%nY<sFHi>~)Jk-SfH1L<kc#T;fLf
z6C|Ye=!a%O7F#<lut@_7df%8MWfyJVy?a;tC#XL;pWGy$)eRGVW2RYA(n1$li(p$R
zS0yqYFnwXQdB(=eiS>Y_<OT>;8MqV#H}op&pgZ<3e}^PI+Xz_9I}UIlFiV!wY}dHN
zq0}yT5uO2cg}GxgNG~)=>P~G;IPzkp{)-zPp{?{PS4wCVN(xKTI+Wb%xj*AxK6&fV
zF0NX`D;E8aw|qxaxDmz1?~cku9!|-fPENZXd^A2I#{(Jgy!w=Fy43EFDAd4W*j7jL
zu2WE{Xnpcd;X!o_QKl#`3j%AI^%qK~7=rqX+8RT7uySHMu2w4m`-<oGwR@P{20@?v
z$;zfZ4-EPNrA%a;L{n2!M`6f#9@A_<se)|aB~6;1Q$IvHFNH;f91=0GzXbo+>mjBl
z_}aBWMI@!wi6)Z)VGvuBzkdgnzlHmL(nJ19Fbi%4J^$6klg9StU}SmtbT?Ugvglq|
z!mMW2+(Vge;Q*$<PMDkxKn8#Vthns8wKZd_s=&WXK(Rk^wI+1MWH>(cA-rY>BzOz>
z`O>l#Rk$Uu#r!U!Y9Gi7l~z&s<Wx+fjMF<~ytzdK2X8rndyhm$Cx608v^%N#V0wFc
zV$0|+a5;*ktvNxR7&lp&(mr1ME2w`1QDxWrQVj5KIP#hVVSOwtBMU93<?Ldv#GZaA
zpf7SHOEVMrr&xYLAy<-4F2T~7v|sXrKyjBlXB~TkVu?P7UCheqfPese^?bXZi1YpN
zpti;79x!*U77-JpB2TTb#t$)K6v|^J3iA!~k1fj_P}<|Jjg^7&`7)Ap)b*<xljbE;
z2e8F$K_obCPa_3v&9{Cet;k@SA%o)@$>3@k*<UfaHCzkGIA$@<^~`mHgV&y*hBpc(
z+m1E@z@)<^$;fVWciN@``es%=6ZXN(CeeVDsXu?dcDeg&<I>@?-j*N9+6CD;0V3mW
zS>M+(y*0T8Pa!D%Dr>og%cNrvaLn5Q#y>U?Cpr%j@*~?!C{D%BT#{{<jYK&R%63WC
zd@@JFtjGED=g$JpG;`(6wOb(#JJblu#B=vXj*Ii_e{UR(=Ac?C(*LH7ABJScz-GGU
z=vp`&qitX^4;6s?+h;fwvn5v0zQEJP<#-NMK>fne5(~`PnVAhh#(z*#qg^?C|6oDH
z8i>?+5HHCLZdd}qB;GSn9Qb#b#@n$p62f=hUmsre5%)igt4j{8Jcwm2F-%%H*q9V9
z8Oij8VH~&1Kdc6fht8Ijmd-R#3Y8jfy!5t-d%NwpY9WL0eaK*}erj!Vw1zhD7VdmD
zFHy>vRq8FZ+t?CI6L7rX<?4EZ8FJJ_6@H>vP+D4AeUx=M$w)+TN8J*!0>TGlloI^|
z0tW6oOKQ53&eqWGF@EVsr!HzY1O+NLkMHIIY;A}4mf=7x$PjiRdE}k3N*XarnYLfp
z$<!BAb%(KA<?%4>qCLjc^jTtWODy~6n5oNi+%}K0`^owIlu?k4YO<CXjx?K`hJuRe
z8Bv_8LGimK&sn)zL-gZ266NQx)%}9}k#?`6T}%%=CJGbHxTP$ID`#3tsCTH{dL+Mb
zIPEIXM_KB!At=EVE6Ue#t#^-#7f*wt!<e4bDi@A;=gyq~<P!}d#LB@X;RfOin+kjc
z053a93sVvt>hM)Zj>7>Y&WdBmDqLJ$A&<pEA5GRn<saGeptUi{UGT20Vk30?{qCfV
zeaLc6A(W>r(G!m;DO|S))u`PRSgP0@v&wzy=s<Ijcyu9e%IHb6>sfHe{r&wRmDYdZ
z-N1%t&nT$oqo|d3E-n)yQtA}HKH6dHO5X-h4y@;b-@~Q764McVOaCfWfj!Y<aN~n^
zs?Z*{k8eF~bt+_fbDE=r5rPxXv<z(2cbX$`ZcCy?Chiee+RAe$B8Gzc^^n|XJdv1B
zc8E!!cFQ!L9zP~@KeSvpTK3wQxS;(JGox1dCq~YJX#uMK3cGsXoBh3~vp%FuT40tN
z6(*5SaSRFCQ={wxnGiQGuk24|ff*c4-hUXjjzVH${{CQb%hSwM-?m%-I}^gY!~N%*
zAw7c30qrV5rH}#V^srZV?T#lBMUh5J4NIRR$Z=C^X<kb7gkQoNZ8Umo3QBwy9AL9c
zpq=1(;r_L1w_s0akcc2+l=bx+`uoAiKsFT(%6cG*m9FOgb9NcDXp4T<O9!N$<q>i_
zEz6iE7Bp!lP7JIO$;~IH)5Ery8KKe;;#2tmpUd<`Ho|9bY`pY~wRv!swBBu-0z;A<
zO!J)>rKiM*%d)%L9vrDwOK!DsC28HlKZQd^T!1SI7OfYAaj@UDbHPs(z;{f09V+?w
zv&8n3uB2%oq&@C<QP(5Vl=H(<1-Ae~pXs>fLSTp)*i#-7lx-6#<vMI?0|(>cc3KZD
zzG0~|U<90u7EFd;;_$}6PSOb@(BO}dp%C#KJX^>+5hx4C4ndN^-!9|R@LDc=$kEBk
z+3th?^xWMjObo|nl=B<W{t1N0971psG2km7mJ~HvxzprnK8YOvLW=E&Qj^HVi--2q
zo=1zR+>^zgfCDI3xp5t(Yk29>?s(@tV$zWu_}37r=_lY=+!YVDp^)#Ij<4AQYgezd
zqpptxJ^XhNq=`!l3mtWJI4})8=g2vL+&EFnvh8(!K!`D&KUt_#k!}DYxDO4GUL-0X
znZ%zgVR&FJai*YPXlO_>>-&goavUw;Q%On`sv+S-2$}3(F&?yo+D$gf0d9MNmZLt)
z-dbabEHn6MQ5d&V_ZRTV#o%-ml5&eV_aXkiXOA(5w`}vI_SHjsG<Zo7#>VXpUG9t9
z<VN2$?d5+-C{P+ZFtAiOr`b+ChJ89cHRV8%u4BR3IYIG0z)@%CbU0Gb$%#+@yCVHP
z0zNY`87y4PZ%VSVK9Z@M3HZ%FYnv;(Tbo@%c`^>oVkJKW!7&jb`N0-UXZ2sqc9qXU
z1#qfzt&rkTPmgc*y^1g_brz1}mQtZf&5KbI2YWc1PZXIWHdV{l?I}Ev5mIxaX7}gt
zGym?Iz?pLye0*u+Xl5Bk)!alGD5X9E(^kS<m}$b#Dk76fM8uZAROKDKE*cKU`}afN
z!)C-+=brUl57T@y3Z){g=c^<6K^u7k`zPl@tK~tHJ$JPaM@mTLmQrmjAeBAp?V=B5
zO<hCdJRnBkLF=X5_y&~$shAK^0{6`Md4Aui-f=BdqN!2N<*e@-1PmDcwC2dt%az7j
zqx6Szi~hve{PeD4Vh3Z{wTy~leSC+)h=u_<u1SFPeL#$oF{k89!rM0Q6a`dAVLn;S
zxwvZp9tyVI2Xfoh{ZNU&>s4+uU%_tN_x|wy3kK8t^RR@&7<-XV8m*u6s2T@@y6*^G
zh^xDMKC|Ls?JbE69^MWz5`GrlsZ4h@+oq2{iRc=w2$L2_7$ZHjiBaml$mPAbNzL{(
zEHqSs21ZIQqzDpu=8}<|6L3VtuZ`tJqB^0QC>{?wE0u`fx8=udvN@Caug9?o8np$G
z*6%B{_kWRf=%jrhajOM@k(ymkNR;^0snmaar?Y|7RhfNNH&9TT4LFU(T4E1IF7Ltx
zp^xt34oVx(X-!rWAd$5k1DsH}#1|soSD1B;jg4!`i`5Mc4RkW~aAVS06DrzrDyrR&
zP1E)3%K<l1guudx2hz_x_*<zN1AcuTa88^=3!rmqN|osM@EnavIDDI{o7*!r`NLp!
z9KXpEtE3iXxBN|UySWQVp_qE);GPGujY$=7Tkd+_G>?Bk_TLxab0qOGwR_c>Fe&Zv
zZFON1@&U%Ju!$;kem#`?{)`gB93=Jh5HPhBi``gT-XC;@Fa;|tjU=dYFzfEAMCdn9
zvErdU`57q$?IQXq^E+MiIdB)mN>%Pac(!kkx%8A6v_oZ!udWb3VUC15##BJY9oC-W
zgjl@upS}#gyo8!=Kekq{82X6FA~%|#k2jakI-=B=68%=8a%y@y?5iMM9qXZidv`}7
z@IEmX^9PXMPOyRh2Gqv&5n0;!2jzoI_^$zQ(C5Gw7y=FwS9Ojao$r4C{{2N_P&!QG
zqV}JCs`(axs(^_3O!4y{J@<yJSu;xAhYyi|Ef4qIt49pMCds^(y6U6P;WQ@iw8^Cs
zkG>=(CUyXk$hddn?Ue%=#v(oxB|j)cK&E{mC{3pF-Mh8mkPxqyak@4y>B0KFrEYg+
z>axF|-|kqYf&0vMdPXY-Qo(L9-;dYRHJdEgPD&XWKBE?{)oigKEm5c=xDw1CcGC;L
zwA_-0C%#cMpOdv^po~syA5VnrrEha9>+zk1wzW0zIh@FK<IT2?^_<r>U}ldYd^>p}
zH8u4vzF+;a00QF=_xZ3b7TD$|HYuTpaPfQX#Y(An_3>^<_92Tm5<j}SPIR2SqZB=^
z*(g~2fKx+da^g)S(`#_MxVg=w%}+FTBsOy=XQNvt#wEMIzhBQOTx#wc+^_WZae;CA
zN>mL^0X`ryR67C#1{AxwqJ)PF@~z)3=7ef*T^d+&b|obfgNl^KUL8*_!?^wJt?=Qw
zPi=(qO$U4*D-~91A|jPuMG=jUHTF8ibWknX22<0<&p)_L-ybo;hs68}&X&b2*8yig
zLR(X_%2x1hBA;nxLBULCPnp+N!x@>>`J3pKKZ%E}_B6d>Y<{OtC!sz+Fx0Q-#zP75
zp3-TB^?Hf{N0DuHu}6HMmOFIOHk&*XJ7-U`l7ABZ1FXl;y9`41mB)_<0Uos`b^ZX;
z>mbz)*gr0U+0|w;bv3}0b+#dCMa%TfbaSG4D+O}wY<RQw9<;zl@DUXvu3$xz9h^Y}
z7JeXO(3yYw9!hG@C$=;t(YUSi=+{4xH2l%>M?_=BFANI{(<5}t^N+TO?d@b#5Umc%
zGGP9a{^YYm|M#vgSFWgf(HdIBJ$%0b`ob=YsUP4aXm(hBeIR`YlnU|@;)mT?aF{>Z
z_LM$Too}EO5Z6DU96A9A5>tr<HX!67X72<TV;^3O?&re2B<OSeZ7!EZfMim048V@U
ztgKNu_0K<cZcj^f12oS1z~hzI<3ZxA&71uzp_}G4wAut>*%d4#b9Q*A+|g|J0Uz9f
z?%v+eQvioNdcD38rEix-TT_t9@aX7OQ=z**4;`GJa#9*%<1%Nh%xr6G8v<Xd(0a?Y
z?pwERrORj8Seu&%OoI7!L<w{dPi4RCl`;MJ4^%i{bX_&^;jCs9-hEd`H?yv@vrI^u
z3`AP97k5n=P`iUDSMPkHJ;X16Imts#P+jf-6`PkLeKccgdv%><2%uim(NRiH{!Aj7
zglBCO#m4RY9p@26kM5(qcVEQ*=|6*eu&Q!%2jWCYl7w@LrJY{m9uriJx-PFG?6gOp
z<9M7j6NJFKis5{6QW~-BxOQJylnl$l3b;-2PRc}or%gGPvyvaKK$jgc0k58u{gw}I
zb}I|J+S?EL8CwPx2&S_&cNc=X{+K?V$54;FXUF#K9PRY9UHU28bp`F23AI*xk$kcw
z&KT?rN_O(_c(pneiwg@0t@=QxZA$G{L6Xem_n*!BT1G9fUNZy8{%7pxcWl?BJ=QO5
z_IcZq$SRG(>_}?Mr~_EHOEcVWS|OnBiu{u#ymo4<(|CqR>w0TZyheuZb^GtTvDKzl
zRxL0K-HtRST|zEA!dzfiRCxS(9ptDNk#G6r#CHXgpc%b@rsWnEiaU&{0ZeKvWdHE9
z!(uUY^QT|mZ%S1p5r#V3^k#d^<bMEdG_Wa7lm<rFHbSgSZ@Z?<vcA(|l;oVW`E|*d
z`}K<JegF&xq}+7n!KTa(JN)W`vh*UPW*tI~hjnBan7fg5pkOF=4-8z^0@h_sRc-Co
zK>%8fnMNC0WKZhxEgzDEm)*HX-+sb)K;f8?953e=q`3kIl1ei`;sDJniyJA|$Ct?V
zL}zDS--gT2$ytG0UqmiVC%z!4gEXQV=4mODl@+k1gK2;-*25*H!T=jafjX+7z@=8b
z+4gYKiQN&ODC7kH$|I}d$T>LPp#S6?l+ovqi!@2NdvShg>7Jp8H#!yb=Q{Ki8K1h<
ze$iKiwc34FS655MgW^!b^4RHgktW`P$r%WXeFKk~s6lSO!P&iRW_b@*Ed(~SC6i8A
zE7e%6L9#-G3yF6BTZ&xP1&FM)Z%k@RTFLB4;YROafz@S2BBw(K$73Xy4G|=;H0G~h
zy&#y^+DLBi-67k0#j8w6$Z3Vk(vhf+%BHaHoI=dZu>7CP1s9>Df!6+w9x4T918!M_
zN0`cj$(laDzQ_4w<GuDzTa@JQ_ef^!N-M%684J@hGd3-hL?L?!^d^|e`$?$`unr2K
zf4Py;6&rogulg+Ie(<usPfsF>Hn}EZ`t4#WF3Bx$N}{W&t8!ASW8ltm51?t#5YY8d
z>(Vz5mwyl}7OU%q%d98o=qGrWC(>>?7S_fvOv(5pW$og9{rrAkJt6~W@>R0ik8~Im
zzYPR%>O8eO8zhP{Fprx7E_jFG&59IZ(O~aij~@LyY~OHy7RNJ&LzJrbf){sO3mYAW
zMO+$6tQBH?e@N;XAJNv!-NgkTwL{odxR4PX>P5ATcrW;PM}rCTYj(v$ksL`Yyx3_k
z*g$ieRc+=TB_@G_nRdaRa*Jw-?szp4?k8-&N({;)`y&h-{CKcZ7W4{*z~WGq%8jKF
z)&1PI05}?u$V$l|&)AKL8s)?zqbw|h^G})T+EO)^MqvDnJjPFa@qj2euDbJ2x+m{@
z?_{>X#t^x#Y4A>KM_91w<3mW~>PA84Sy_{v9OG-7)oJ6YAfe{MeYTuL)diClWSA&7
ztkvR5MBAe$e*dmuAfNjrKlEe~JSbH<xa<bS&?KT4=k04N(2=B_TB-99Ao=Z+y-f^}
z;$~)^6-2;|qlmm{V}H(zfSJl^hL4M9nTRdvTay0T3pw6He_^QHxwNzt@etpiLl%?D
z&;hqw0H?m*mzU=`Jfql{?>vShiswyP9bJ-2Z;v1Y^dOGZxWwc*kI7Ni_o-}swp`0g
zOH1=49G2s#i-V3h9Wb(&-=Zf-=%cB`i+U){ZG$u<{7L(``3SLUj0cMHD1AIXafO5~
z5l4349h#=3s5R#QnVvp;jd_#K$*EM76F4u5VZH(VHEaNzyLiLi0vAvNUE=<C_@gsG
zHMPF}{@Y;8%Z2NEP<Q{|96*7YFQSC89Td@K@zFD$%^#h<WVTFS7h{-9%oLLQE1@&_
zD%KolPMhf#wjSVsO-NZ=@MlBVlcji<Mwy>&{cg$u8ci^4OfG@S+zzobSkWpy21=5!
zCm2<(m!)MJdf&4<?Dq&p%=lk<3`QrNmR10fJdxkU6>qku&8fJSU%x6ApRY7_5st>M
z_gnZv`hBFqcH!Lg<YZ4}^52;6DvY7xug{N{egobbC^f3po_FMlk)NpzEiy8K{jW+R
z^5(`+{T%|vS%tnPbN-nb8C+m(Q625(`4-;%CUNp<BESAkq(1xyuP178-n7>mfTwu$
z=5=7HgY?Bwz8Mer3omDty{mI0HbRQ|m7w3@%^=_OrK1JWTtguj!=;v@p+^0C*3Zf+
zIX6i|XgsYsi264SQnLnS^_OdvpH_Eqv(~|RW(-LDBeFlA$^i7A!w~%i&#_+`VQ#xq
z!Bfojz`$}3P!LCaT*j*I`P;9A9KV1)+ICzHhM1rsh(4awUo5B7xOx8caw0wra(ZEY
zlgcyr0iI|Tc6Ro?b@KKUHuJ0A2DWCQRpZ)>Eq%xU&FFSCBZ&Af$9e7id{>O72hqpc
zLk?br>NT3HK15n^EAQE4U!NLvA-c+;NocA1m|S0<g@5PFr?7-5oF@Q*w}?>ni(n7u
zlZ6@BpWihHeNQmy2Y7L9R`!LTS0uhV`ordcZ2H4D<|Tk(0wK`sR6;`$jHAsJ>1vRl
z(gCg026}#nJ!L<9zmIXRtNu((oZcD47)sl`WL$YbGav9U*AdT+AyTV5d0Xwr&Y&Hl
zUGPNl-TI-PfS0SC%IV?LgFmR%g-(Nb(^T2W2_SPR9NzOF9_Rw5PMag`;fuwaP;qv2
zb{a-k1pfP-@#yjkP>=>Dj0E-DH74x>pWp|_u+-jLX!_HKibA>P?gVtZX8!<8YY*;Q
z_J!2ox>AoG&$ra@h|%UJwJfJfey&DzkNh_tmXE%{z~E<xqi$C8S|pJ9w>lyt`%H-O
z;c&?MASnRzYRg3G!jvJEx>|3$J}j`6U+$PVnDF1@q{%m={_mLe-K6a^^wqCVdjXAW
z&QI|W#@i!N0<aOP0rV(|m~%;LhkzZ27Sj~pvf{t{$o6SMAQ!&IIFI+U*UJNG+Au}Z
z^+r!e@cVzS9j|YR&}<awk-Q=D(&K2xFkN7>SF>{vLQ?KQ<EN}b0tQ(F;7qGjXuCR<
z=%?gHe>Wx>f}UbN0lKd#egm;_Sm6t`GmMMIc-6b0=WkzG`AVE!&zO^tU|jasEd064
z5%WV=>U|ypEhx372}Zl?Lm<fTJU$Ym!eD@E!655uB?Emnp<b81(!#iG0wSLULh9+U
zS}UZD!Z3p^>~wp&PHnE4yyz!Nfs#`b^tIwl*T&n^ZI5YcYPR_GnP5G*qv{*M<Atwr
zRA<=v1Y^I5LVde;_wGzrxwrlA0qZRvrgr)tCXwxfOan`0BN4RXRa@6uC?szdSsZ0_
zijcDc^GX$%I=v+`KyWho#|(hHPk|a-2!xlWh)QG5kk(HFx4vD_n8qn?PegSD0f!_9
zGI4v6K@BLK);A{JZf$rTVC)U+@6MDMaJCEh2Q&Qz_63|5yWvbpZgnzF1?idU*VPX-
z8C!XGGPmv)<{}7o+7vx+)#>L28C<vR<4(NV2F`{);O7%d?bhMz@Y`~t4@C$t%Npju
z2G;~*?L#(6_rkW?s&#d*ydz%7ZimpZ%^uj&c;XAHQMD}tAbYkYu2>^5q~7W#Eb1&?
zZ4zpSdRGDJ7Kj~MVr(lcbyY$1oy|_g5hg~Yy&@u2_A|W|#Q?~9yQ`;eVg>Jd<yGkn
zonT@4HxJfX>uMLfQgL&Xtug5pED0K<Wx&C?W%btKGZ~l?&qNbFyu1WHt26$5&8-#N
z+WdX{&P68R8)2-$HhT$i%`!_x)fZ8PI{of}_fh}!;lqaol<D!I13Up2ZP%HLHT23c
zU-Ay|4`7?*(?2^vns2eh_6986*wl`3f3=0!>>YXY??j5zEhps>nBjkIOky$0dW6?0
z%*|E*V#)2)Z!MHm9ve+*sI@v>0^v&q<VDD-tg*&c?@w;6fku2wbo4~p>F}S?ZhSK8
zcca^yCKeua1|9`(mfz<wMr!Z_{wX&{rXTdxQ!F`@j>~V&Pk3K&(6nE0G<K9(U7srO
zdXgT0BEqz7T2D$jvpK%Nxyt!wzIJR)fc{fOAat(@+4lpd1Fi#&|7TE~Vdn`OE$^<>
zRU)(jfbam)ynwVF$gq?O-i~9z#V8G!7#)TN=nA&%6(&cKgBeoRIV2A#kD;Ykb*`_>
zjoPKqS7EMG&Rus8WT*2ik{^s;5}FQX#o59|?<A200(^blnQ#m!3kJWPr>Tb-+jr2J
zn?}!OQ?je8Q=x%k&<vDu>HHl`aU<v0P%x_5F9mi4qP(I&P~C}3S37#NTri8%1FHXo
zbSsgPXy_i_tc^<)oJ51(M5Ea@E~Aow8s=;AKC(-{gj`k@zdH$!Vw1lArzflWe&t~#
zxn=Z&#b!{#tdcv4jND%Kk&GlmtfVUXsOBkQ@35+SK|ftX|B9^VJ)4CJ6Ol;0Af87E
zJ}Y=Pp0{H=LNh$^v%OqsDiD%ix}lF+^Sl$x0DfNA78!3QO{TyA@;F_|M(5O+RE<n!
zM2T(wC8Mx(VtaIVPA|{VV4hghCKo{j{?1t1T6zsw7V}sF3^m<BPL0fm?P+&x&vhOq
zg8aB#rE_o4{jrc=D|?%~O6HcDgY+GB<d;?~-d9jbRsmgLU>5w4wssJ?Hh=5N$I94+
zb2DZI89Yz0Rx4iTfXM=7jzdgP9_EjsK7OOA;+}k3taYPp(VkMN3#`Z>SR^MxCBs*z
zakZ1=IEM9lH(j~`3)ehD%Ij#O3wAmhYLWc_VTZjgD_d#=m`j`;Ae8;c2e}vWO~UO9
zKHqPS8k~eR0-*HKqRYWQaxV#A&bLsq#a4e2^s(~uTj<iqYry8~d+JDHvKZ$tf=dyj
z9ZyTILbWRL+gPB0hOnfS^?k1;wuQ2-&Oje;1rv}vaU&%hlA2E1kBMF0BG98W!Th>x
zmLewJ!AyaT=sqf=COdn4({y^u^di{OR>l(^nHSnr`^}Rf1Tpg^VN$edNO8N)QyBX$
z9conndhgr;9~{~Lb#}IM&ueAYy5O`WE(E+QCjpye3M{0p^#BTRP_$_!kNS*hJ4h<>
zYNX=-o)!jz@Hqzm@GfnQXUb7$YxnhUPDLQ~qr)Co0pyZu$~p^jlA>8_BCClZo-Ccy
zj;TIn?|NqGRHhJj_-}~GyI=*j+9&z*x#7Vk!@hg0tk1t^B(nun;O{R2SWxuCGUTjw
zdc*?yPtOBo-7C61q_MXEob2y`!&y1bcCnxGjRO#YZ)ECkFmlx_zc(kHeoR%BI={HM
zGwzZtwCUdg_q0yS=7=sL37+}`*~xth9JhyGk2@sZOdG$nR-<$Dg2u=T#HF1cK2<rh
zwr$%s!2ZBV@b=QooF*K?*FRctB8=yWffvDJ2hJa>4lwEi<EFlGUQ*$BkTDAfQx$b-
zV<FJ#LgTY!XYwmx&YU__1Z@>CJr;PS)H5M>$RA*SHz<3+?r!zcRn=9UD`kvRahwxs
ziP@`nksAQ&C>iBMSYW~G*Oepy1E))w+#zX8m$JSCXZzZiaM(b^Mc-%!Tm*2z7To2J
zmKwWtMOAc|uO$&{VQRHWfGr7{QZ`)}VLZXOl~Pyr<VKZAetD?jtH?#-6;#It+P4w<
za50L5GCQiHEDCj=qWJ(HNnX^;g1n!kp0EKO0H>}FA8$KYLcK*^<VX8DfVmUj-JuaM
z%(U$8>iR5Od%E3mOo3Z+(QYh^7-YdwluD$*d|$h)u+R%jICx2id*~VRW;}?-s~`G7
z@FLGOaU`CvLzT235F8v#1zlMdw6XW$;FQeL{9)N*IVsL9sd`$j)`8?Gr5*soD7L8$
zZVjeEMy$21J;j=`{*W*y2!s=um1%R_HU=c%EFb~$N1sT0Fz~tpg5`D66HGG{y-(nY
z9KL^3dQuD8q(UyqIH$2)yqxxwacD(%cy~cb2<7G*m>zwXb!^)wl`EZ*oljmmBd7D$
zf4aK~#d!jbFAt-fLM$nQ>)H;LhzG<aHelFE+X;q~0p5*A9=1BQ!vKH7a`Ge-0Y71b
zodzCZC8N{cJx(F|z_nTx!kx?~UnaEfm?@)fmcWBp+1F~#pnn23-wq~;v_nsf&V~-u
z7K5!w7PVVknZ8X*J&{-|8R_CUmZOgkx2OEMUbNf+>-PE0G|l!rr!g;X$vB6xqc|K9
zOi0GJG=pat%*Q7f+OfuS`=##T)11a&0BsD+i-C(p3Q)tqs5cMlx|f6jX2mNUAT}>}
zj7cLy>m>^OI6>Wmygw|lTYy{D1cQ`)z_iHN2k4(u(1UZs{^rHt9v;l9X`=WwChf;G
zFP)Ve@F1n?q4gX--mIjp#T!gM00=+%v%>`wqp&(b6>AP&t9L0o2Ysc23(1Qua1Sac
zRtA2f-1@76*p=v8SFp}}9lM-r5{YGk_S${G2<2&~UuKyQ6%koK2g28~=n1$Gqwu~a
z<O|?03{D1q;<QuR{W-f&($wxkcowis&$F@|_wZV~#+*QN6e+0aFb(QCT?XE?58{Fd
zN1?J_ym*m9n8U$|;{~M5!sVK+cg+p5?R4$aXc?8_ljvjAZd+J7h0`k?=a#)N6$4PU
zhQ7i4*@g9B=Y22e!>yA3&h1BT&+weR$nk&Wo+kSlN*rHW@rSVnwC@2VlYpUix9Pul
zBd_YnCc)tEeTtk3#ZEJm7S3i7XdhJ+ezQXvwq?!nS5D3`nQ-%nO6>=5a1?0@B0+#}
zJH2i1!u5@ta*hX8YN?hXuTaBAAP*p5e6k3Ja#{V?NgHyA1=bpg)yH=sbrj?V3U}Gb
z6W@3va^yG({T<BDPoZtijjDIn{f*MsV|oKE5)0ya$*8)|JH?&}*g5WIM%5UOzni}5
zecvFS%#3i*&r6cQM5<*O1Z!_qNwf;@54o%{V8CpX8!b!*GAne9@&+SGB!b%$OdIsr
zJatW&obQuQFkW~{`AG26Gsu-O>hzl=uDpU~X`a8MFhf<~C~UAmZ#Xy!%#|Bj?Q2gb
zD|MX4%#|T8<ib--I0-gr0XQ2{Vm`44LKxvi8RN82U}&ZTfs{aGand&9@b&;l%@Cl%
zL7jnygaHV1(19rIc0}YPIzWl;hMlefKh++~5Fb#m@S0XDHclC$NenbJ;!tGZew-fg
zFO7oWc3Za7FR&w0-F$cLaBs(a@I;z)h9NwW_u)_|%!8nslW5wtF_|coni9;y`d<)M
z{oprNx%{*b*MX^a0&3V1(|lR#*{-mw?UX{~q5arFxRop>tY5rH9_O+!EpRoukcTa!
zB8VpZMTv^^^H6-o6Cv<(r;5*Ad;!+eQ#<c%tGntNf0K8O9m#|B3-_P^)e;8jCyiD>
z`StV!fM=?f4JV^r#8e_8@!{_&3XWrX_UAGuD``9pv-ZSuPP=(i8!0C#BJx>#00JHW
zw!7$U=bcy^zSzIdT`r`$q-x5I8b_gQi>OqVKs=Gh$9k!ivVM|4exI9}$pYJ%S(A4G
zMCv}n18}UJO9(bMn{h|zNkP3XJs+<ty`gHqAHDYs(L}CE^X>rDq#W&gRHf{axw-92
zf;y2HFO?C7d;0^dAreo-6+a~A5m$tqo}%Yrd4{KccG$y&BYYLI7u%PS9nC=r)xpIk
zNNg!47E#urXm~tX*$_7}l}B)6yMZ7K8@=mr%P*ykhn?a0%i<KCMShypm4FHVL9ZHU
zhvKApX7N&eMB;Lt513lC!6-?*eClmW&91vclGN@2Bf0pq+28UY_`OOwu|;${p|u63
zNu?SAPZ(!q<T&zKyeo2C9gQ|*dWdGlPU|pzsjEW_o}KRj;xh0Rfx3AQu=^1EfPf_}
z$nxq+Xc_%P*StqmAYe)@uq0}5vC`Nfr*KCUtGTd!Dbs2G4mRiy_oBmz=%cU6s_2(U
zXc|!s==kw>?UoJg&vgjeBNX635kWFzf!!!j-0rna;w9nQm>0O}Ldv`Z!Xa6D&(0;O
zf@9DOaRSCpCuO|_4EnynLn0<0If2suE@ZzANKM?h5i&J>d&8S1%N7_P<&$+{)<4To
zfQZM6v^gll6vsfHBa7Vc789g~+uN9=5M@_>Qf>iA(TT9|i1!cF0L9);a3{B<Cc+JP
zQNhmJgXWf#hM9kss8<u1PD_3mZ%{m>OxMY17vs1+Xl#_DCZF{dDX%ww#^8-fXRRkG
zjh#Xi4({SAoDYkD(AfL%@bfQqIj3WhYp_#4zAaG>gQm`VcFU<C$^SD5L&N(r>7jFo
zQ}`S3;H?7fReONH|1(Agk*QIt7by&y_v+TAjV0Jt`5$~7&R5)CdoWA$K2ZVRBpa!i
zh55`O8ONk(CjaE^N~kuLlq!68$WI@?OC^F8HyakgrlP>F|BzhTv$PSgTC?>L8i^<r
z%m=Agu*RRp>4i&STPpCrJaTv$>iT1{Kd<6&rk2=AODsQozDlD7V$3DED4lTtDTGjq
zzM>kM+Ftwq_Y{c?Dk%A1X=rHNfwEQ?n%+B@KS_$)6$GI~DKU|)!Wad~s_=Av{~lTm
z8<jiZup!WbXey1Gxn$4QaXRg9*j6!oEdSjhHIb$h4~eyr&gZ`0lREfVRcf_1R9ok8
zdV3jg!rfx_KEi|(@qp<U!rPkQym_m*y^w$rn>pU5G0engDi^$s1;IytJPgf6^u%$}
z!e<!iQI<9!FFHB1Ax0X^Pm(Gbr#zfo&+u*bPNH{*;=yb6?;WV;txBkL{A)d<3OG^q
z5MxBwK?_r1oKsd7&;pJyTL+wMWU|mGR$BWw{VWi4Lx6YWG-eouy2sz4#3;S(1TVn#
zyZyR$oI`RaR2+$`H3JZrrUOth&kxIVxh&r(6wMQhJv-pv<G}+rPy{#mlJF1{{&{JG
zAF8Ey02%zffJpLcokKr>%G3CTNgylW7u!tpqY4U+2(!K)2U5jtV0znAOkogN1B1w7
zDtIqkq#polw)oJZk#YH<2%aXrc4QE;2YRcnf4m>yMzXa!v}X(QfcE^LQax>e*eZ~C
z#5(xX+-S>5Lai{r&g#GCT=rj490l^z`}lnbiWmPnQp<2D3wl48k-OqucH+zppJhX(
z#2z-Vb?Sx5vNJRZYAOL-l64fQN!Spl_O!!H98OO$%|eKpsQ*tp1%+K)1N$?|P^JRB
zXQXo9Qjg4q=>Tz|PZym$9L_uew=fTMt5g<5g`f9~Bzgx9=p9Qi-@gh|FCcFxUN%ZS
znAIzQSYbP1u?hj>2!3Ot3kecK#2*~B0LrRD{GXIBbSo>XgG{;{e|fXM|C%GMPXnEq
zOj~<FTbrhYo<I&{lrc<T9tIxCtjPYfeOUvFo<87uMC!lzBK)Mw>hTTG&ctAHKMQ_?
ziMS_>S#E?440w{PA-h!<&5htcq0<2(i;%!wETLLOPn;WAqPfFeH1xS~rpTfSPxRV`
z*i$rs_#^kkXbCt0@sQbG!J+F8|9(xj;bVQzhHUNxkL*J?MDD@7&>K(<vbW6I>gsKH
z+)eE%s!pEw=MJ+VF9}}-eFC6oc?aAHZU&VC=mfDa>Uu#AzmInUNs9<GE)qrV*k?p&
zC46LTW4z~;8sCr?KQ&j#?cy?L3EaUO#wFO{9t(aD62uD3=|>4?emi#-Sie)<IqMh$
z&1A3%$KPD=HVe35wg|_nSQfeF{nAGJ{K5ho^xg8xcXaL$Yx!JFpieM2;zSacKs%%z
zvN&ZXQr;ryV~S$sVF_#ixa&ZyFWShFG!6GK{r>9dg2~m!B#kTrg^~`Bz#hWJT|Km#
zVS0P~xP6L}zR?-v2#n%3{YtXYKqZ?-#2#bB;JR34EO-F_%01>cz}Xs;0Fnx&o$zr|
zPj6qNtb-cx)QQPD&-6@SLGqAy59s~)c}0;NH-f@p;px-JK1amVt9bK<?`3@-vbwg`
zPRciy^OIJ&Lv-G`W5@YMl`ht+$Q$ab5p{qPqN&M<S?T$X-qVN+R1dHp$*Y{iZX^Js
zuqJQ=#?Jz<y&qwkEuQWvd*JN4@@Q84WqoflBx-$xJfh7iC{oS$JoxyH7&Hy!WOZcS
zd#FB2+~UnOJ^5A7(>u>Fu=KP$`*O<p((-QnvVW!3F8o)e=dteIm5$+PnKZnQ9_(MQ
zUaY?jkC1=z=e~{l4;UEMzoXT>Yxfo*uy~G`ARtiRXIx6)YfKUb6sDEIBMg9qjm40(
zGChvJr;uh#E7y9fy&FAj63{STC2Z_}PeJLQCM}3dN3^;@g#5yv9}UQX7l(Qup{`3e
zo8J8f@Xz~i#yVj-ybBzXi)B=KIY)k6!Rc!QBWUfvANcpc%4Vxec<SQ`<(W*3(vc?@
zMMc{v`yx?|Ne7SsWfcRV_7bI6@%Wl9D)rS&?N&G$60@~LZ%%=QYBGb|jh+uep5nuQ
zbatwtY@Npnt``NCp@#3Ijav_|Z9YbxlhZhLQ5_?cbwT9*`A)``iOidQ_kNDL9X%nQ
zFi?7GUlo7`o1zKVL|dEAW*+NuhBNW7<>VPz!{-8+=Ig!#;mBKLlNr(H5VW5I+k>Tx
z3Gv>zw+|~?{rW_aMK%+0(&&X}UnUFQU0A6R2MY*WaOM8!oe~Gf5DM24iJAmZRC;K!
zi?6VggfN7FOmzj5mRJujkOhD<a>|}q`#maFNOcj-d7rN-Y&*Mg$Di{ht-My;z5}Pj
zf&xpP=g~X0zx4FH`$(^nAqEX7Znx#SX8p0IcP9=UA!c{s7?ii?m_K?_%|iBbvN|f;
z5o&jjRIBg0nk%K+V3cD;v2nR*@yMSC$ZSB?_s^i%JA%t2U<^-9&d%1=>2f0Apdf<4
zHQ!;B<AHuzLVdSjf61tbs_q%FZzBnFpID*JaoeLYX%c42y&wX`#|Ojr6gJs;JL$6n
zWGWb<OuH>Lq*rUsxRL_SU@v#wCERonlh-M<5Wc^v40+JHDAss%;wh>Qm*&!E(*`4E
z2Q9TBXeQ&1bpZ`QM+=rhA$P-UpHYqiOybu~IEvh1aobignDFslM(h9KV;T(g;`pJm
z-kT3}ue1o&D&EHXuQBshU;Fv{TXxgv;^TzwSmGLBUe+Rlf)a@OS9cweyLR~=V~hi&
zv(wo$T+Yy;GE|{iNaD_0i3KS9YGgc{u8#{`K6NFJ{Ozp!%P?_77nZC)V;w_Q+!Wzc
zA)$oYEqD<>!{bazdS6{#eFr@+!K-KVThZqr6oCik)-f-iq_~r`K3SgasHQ>FZX~CG
z(hs%fD3TE3KO-k&7#7xT*<z|<6*@4`55vUt*lV#9jyjJ&Q&?~K?pmlWh5pw2z~d7j
zeaXT!16Ar?B<dnl)rp!8!D1d>Ij0$h&}8a?c&G4+y}4mnDH=`b6|LCuVdEDRP7LPt
z{foPJJCdbd{N86z+2ZX`h@NnRE{|zlT*dswA@`=5Tn&SnR3-aUB92!V7Z!FX(xD-I
zLN4X}xgg;Js%+K7me0VhsC6OLUL%EJj8?*>R)u-Beh2kCCSdDpU&iw3yPq`J^%qcr
z<NJF)J-dR9#<Qvnm=h0hbf`db>eD!TA+%+Wo#Y2;#Qm35YudORfo;`JGE#rVgbDpJ
z<N0khmglRh!Q6=Dq@wEIrx;JtR3;`j!mCj>t5?aW*o#E&QTzijTT1kAz}`zxY(vTc
zkyL4}kI>>3-G(Go%tv;CWlCl!zVsxvTFxk85Bts!;QAYe9}g<Cz>4q7IEa5OS_h_w
zHOp6ek{A8&DcxnVaGC+mzeej}#0}2UC2H!vp$J0;B>VqY#4$#ZOH7o#Vq%*GC@C=6
zF0=yaRcpo78GLytKsQET1NJk<KeRJPJ2~60Tpx<UZ`zT<$mGk)K0XE)hAqzS1K8mM
zv?6=$<D@fg0kgY4envEiDZbUmx%HW&w2lMw;0Ibc#a;Tn1}h5vKI$&sMOZ%asN86c
zKHj27Ym9qN?C8`J-cmUZW_~iK{Np%o)uTsmyyVRbRoeL`fP-+yYKMXSe(W^dR~@NV
zvcbwb9FX@(u^TzGx73~TS#GgP2FS0VG?7%VKq<4{fM<l8cgdF(>EpyJT$01&60^8J
zJDfIIahDL7p}R_=r?!p&@kyR7MA)D%ZXBJdS$0ft_h-$oH!i<=8LZ3UjRVm&;3dc7
zE@n%+S{a>jEDMgLc55JYmKv{!{vWk3jm{6RoB6tCv*6*dvN&h}PwzO(vYTph7*Dg_
zCn0H%#jocM&=+MN&5K?1I8XQ#8t71Xie2+{FIFj`vG}X+&y1-9Mc-_|VK4Srj+C-b
zoKJ4kh`)UJDHJPE!CPc79g@c91n(+8F*+ZpN$s{yQ;;&+YoCM{iw=+PG(bjI3T2O&
zXzTLJ8d4%kZ#ewr9Vfg3!RBO;O&IicFvdEEVvT?{O_44N^xh4?mVIEKcQk$y!9&T<
zbaoq%;P5AYn%H|LFkERkJ`BPsm3Xzb4Q9g7Yc*PF3?ilff-7K!53nMj!ZU~7a-L~)
z{crT|2*yx!D-Nc~fo*)rX_i<oGb6IFJ-`w5u=(<Y4YX%Y6@JE-xTcL)clq^AlBw#T
z$Y-wOLm(f(Z+_0I^XE?s2Gdj1XY5?`TU`xnIX2QUe%?zQanj7cTwYvPiy`pq?_x3$
zygSmr260vZDppG;w`#|{9X!HBVXKSR*(?VXlQEilOd=a9tK^fJaJ2>-%KRqbe?hmJ
z0{WB}z(Ra%DqJt<lT2F^IDg}+?n|OLuw?t5<1u0%9UE`McqAK)vvY|nyAyt|WRu7N
zhT#*c%KM$L9wgK-n3S5PjgwbvB7|}8h$j%mE_#(5gC_RkdVyAZk0Cbo50ESb>oOAt
z7lnY!Cq#^jrx<{ITN0@2R^aDYeuqeViV-7``}_O)!Y0!WJg=u{v>8)mo3_1S7xgvS
zt<uS73M%X`ujh2TZsU-jV6TyI=h;uz9(q+Uh&EpmWEAPyP{fCQ12J5Ki_Mnk2feOg
z-O~XmUj7bKs15=6ut$&FpVJh5O%Q@+QUf>i>DaYBxSEOQkpM5B^PRoO^8DBFwndlT
z16+SPxe%bJ4rHnxR=-A6%p6l~gi=*$EF5aGo4!AlKGHQoc6HLQJ(&n|To&BtCqBh$
zt?@N7GwlG69$^xcaszSFA&%RzP_DN=afB$r^wZhj+(~_tCv&aU=O|3|-|Pgn4`*rC
z3-YfyHEsN2OjMLk0pVXes)&A9M$<65<fra@Xn`d;m%Yvk>=kd`rmoHdP~`*llXev_
zQxsqXVjbRktkXT3@*%)m`X7CEx&3hxYQJWp9U{AnD=${5mRBEzQ<tjLOl}p6pF5l3
z;o_1cl%>0xMpnh&mizeX7dB}{$;nCb!wabJnXWN(i=n^I+Nz)DNcd*i^9fzNX8YUS
zAs8!N+v$XW?CVS5sCDP)>5Ds^!U@FBPk#&@1~h66Vv&z-uLA%?Nb*C<grywE?H{Hg
z{K4M2D7<*=POd{ZHA<RR2)bc3s6QJ>i0$yt6#ye0LzLWwlZWHY8QSzyw|gf6_^hA?
z{~wmFJRHjXeZRJ%MT4?rmqe*d3fb#SltQ#9g)|XONQLZkN|v(JL1>|9LRqqBS41(9
z(vV$3B_!Fm-#vYQf1K-FS64LizMtiJ?&n^ps1Uq>$BZOCJXekqy&0Wyo1*{pMkNMU
zcM_puR~rSk((Pb={m+YW>x8T)v|XeGI`&fZI0#t^IL4-eW@_6S!)(}#FcQ4AmDtN8
zT!g)~$aJ)N)srtNq*kEe#efjSNxr5Ag(<rz=t4jKyGA$sq>YU~QR_E$%~rJ2f;@Lj
zs}^kRCs|op)wpAU5IUKalcoa^MB{&u*0JhT{$SA#v-!nT`W{n*rFvoPk}9}xd+pU0
z5u_5m6&-uz5bu1@h)>Q-l{n!_yhiL?gGAKF`jwFOcCCqy80afM7kE<Eq1ql5QGEHj
zt1>Mjgom3OxpwIRL!n09d}ZH}i4nM{oLPCYna6$IbM9RvTK_6@BSuJy$7M04zL3To
z>zv7?_Ulvc&!`G?{L~1C(rMqHLLNGs0q(EVw=%r<<Tf-wRui7D#+DeYzIlcXqTN`t
z$&atwYJPrxdEE3U*3?Y|v(62G&v9SC*F)vtM9o6N1e<Wuv&SH@(Bw+SI-&&whS$Jz
z)P>B}2)vU`1YW1}l6fci15^7S-rK^vVcK>N?Z~AheI&APi|gW*g}Snd)ObC9K(dB8
z82oJ=VJ#ORlRjR#i{vBN5c}m^R9>^!3R(B6(0g%)xsczM17wz^9^k8Rj63keh<9{(
z*W{w$o=shS@fry^c@vmUK=gSjfHec)$_C>_kGSbRhzbPEj8`8RY!+8L|6;k~tjG!4
z4*GNRo08+|6YBg)S)dvV&^`7lofR}2MC-Ev%{jD9O9dOJ!+RkYJpr(`A#wQiWRNIh
z=mz(z_hTjdt(vV!+%GM=CPgA_|J!>zjvPB3W?p+PeOw)k)+RQ1_~bP~pL)nq(GW^L
z%NYxf0{^!kKfJ2ON?i6S`6uR;m4KBO$zBVeutOtbr<r(eKfAlT4LMGMjZ}(>QMrf2
z*^mKG|8<EG=iBnrU0@m=q%wxzca%2^1`Q0&N)>GjNV>tocELc`j%Wj_wr?jw(ITK>
ze3EC)amsPK|F++8dMAyhH(_F-33mNU*ZcO2CWcX}FTg`9bgF6uU_Ek;EAZb2`<$_m
z6!jZweno>thTicpT)(`#CWqjTeaO7_P?R}T@?9wLoNjW3g^eGicq^v0--GFLbi{-{
za5;8txeFlV7|eVE_C+dmK>KT$56b)`>~sd!Qp+lsk61HniT9TNk-_!yiIdQVZ2;+J
z3l7KOe2f7!b_YXIlM3+q=4g?j^O7D7U$U8=yVsM%uFBf8>oU$BzR#oM)gIluA@MfZ
z<nDIIkLWE5%%37b6u9te{Z32oc+!{LDbmC2cVrS^TCrc+BaU*}%o03xexe6&#c;lH
z^vdbQi-35cIpM6hT3uZ&h70-g3|tE84<vsSQ5|!|t_CHB3Ha<9hqmQ#^_#olx+%*x
zwWZv@cO?z#e&~Zr^VDjX4{$hr#P%r1+%$&Ox?i#;jx9GR2W!#%wA$R9f-du9{`t5Z
zpXuLzgvFNQ*<Y*iI~hdT)2NvR(B+|bPmSJWv9RuUjWDLbxy38E{}Q<trT!Co2RK@o
z{%vq@kn2J&xqmCma!|vhbg(GLs@XTSS7T{$#y$J~|5!7omV-I}3P|rShT!m07}<jJ
zy-}(rw4#F=^?Lw)NbqPE)mVDh{!jb1RqbAfp;8|a`;xhZI2?PWS&1RRi28>TnbbfL
z4fH2hYk$=+F;Y5m0%)6`efW;2vsIH1(|ST}iPd~(q(4}8$ucg(7`w&w{!MHNEvx2^
zptwBN%woLX%y-kn?Sob0f{jtfDyx~!O?Ng0#7fL^8&13GW#n}}j(TdsFc$+Y<dVdI
zkA1(&3ST)*Uo=4{lDy1!2P-92^PSposH+ewhnJ9|-&P!2L#nl}eh0$6BNXEk(wKG3
zO!Y>n<NulqA`Bi>@?CG4*O4VEO1C3aw6*8zR95&iqFT2;FtIsqV^f}*pFg1_=T(CZ
zH4Z^YOwH_T(M!9alHCz)B*`UXV_{LShu1YZ>f#&AStpz!J)ZGwE(n!5$6@bR<$6D2
zpHjl9{*{OkmB#4looMf&otuwpXId)p5anFIf(MKIptPOGZ!RdznEkD?LOPe_w`I$S
zM!gj=3~k&}{At7CjXOm5#4c#4>M^2bHq$p_Mw(w%wm@!n+e)r(uVLB{r>F(Nt|<`{
z|8YgFIvniqpLuO+Q!Xc+j57Y*<#!x(ptuK>#+}l~OYvlm5MEdg((4oRD7o)M$HqZS
zXlIj!0JRAd_~QjIwhPfOY*5DuV4vVSA$D0};4!dcaVe=X?uI#?)Q}mqHCOrz`6_P(
zJ6vpvc<}p=5xkvh1$G}E&iRoNe~t*2qm3j*UHo$PV(89&<V(v4oce)jc_RfZXLqZD
z<4WV|1Xspj{Ic#tOrNC!*O@*Weua+s@JRSdAEOOvMqO(0#}9asDq@C<1~V2E^E&=q
z(RO`bgd<<dzRc3-_)yVsFXaD|xY=B|-&Zp?oS<z5yB!fQ379r5kEX3<d|7*3OUX`>
z?r19-&Wy`blYD2qhJgLc@e?P!_mH^t+^syy4{yw4r$U<&qWFeZfTaW3_l|?LAjcrv
zy0z{f`zPpKLBJht!X;MrxvR@Rg*9__cW@zIm_NG*YcSQF{#uCAGau$M$|v%fyH4k^
zN$S6(*EgQrpe_BJfQ`W*M@a?_>Fsjoa#<`=;|hBznZ$HlK|m~@C3-8WwRIq7*A?vJ
z<tTZb-&>Y*R><3%2sM6W&Rs}7Jk!bEbW3G09k=uCT1vNpYtixwcpBP1lo%2vg1?Q}
zin0tjGM82Ct;ncBsUe=r!YX1<$a2Mq*lC0UOGo6^`E$^31osQ~t={WDp*_+E#z3p6
z>dK0LZ<Ew0l!BSEazW93#jh~1c^p+&sgjn@%CIovAxMEel}4$X<StE`?~&Q?+jp@5
zAM*rMm!BzzE18EvzPS<wN{kF^kT1fQy<?TKS`z|nV-3!1lb)PL4%Bvt?YUKL5RD=&
zo2W%}Bh-0Y-=$j*So}t*;CI!ktZ1H?ob2NH8P(<{5<8t!9Sd)<2s9|#L^o>G97`k5
zs62NY`-PSCdjS2V53+&<iPexggQ-3F1Q41Oef~NLGytviymFwri`+!lWTk^tCdQtA
zrR08?3yM*;udJ{MBbQ>m=#>Ngni1eB7u?<QX4{ux*lhM;fJ~xayC!pslDl(7<p`)X
z3mGZWs~so0Fby)_q7{7;9R9}YFmd08F>9yLojZ&&)gptPZ}6)x98+AaR`XGX)sB(n
zFE&nmNi^^%ZC-;w6ofyCJ0`&P%3drKyZ35P_t-BOiw1fSEfPZ(c@VRmz>A_`CS@4>
z?Vy}dknJ&<#6f&RC&k&wdk)HakfN3dRqzo{$YY@V-;m+;0`Y+noS20H7bjghuxF$F
zFb^GErZ}iTsjaz=)t27SVZ2pz`us+;z^RR8gR`qvG$;S`s>?yPR~UKuO9_a|f^u2q
zD=OhTv_d+3An|kxq@5Z-H&%z4VF5T}Fq-+^GJ&I8#@<hx_v)r)*LQ<HWJ4U>UaieT
zpfoLJdi>0>QCwa2-7{V$k?WNT@Rh3<`{{MDo`%}-wOqIHMlft&#Hcqg_(v|wLzL>*
z(bjh24cI&|K*`*zG#K(N-l4?Ga`1B0ja9_MsEuM&za^(|+pP^raSkoqfPb}8r9>w_
z$RYg>u612G&1HSpUK(N&Kn2$S4$EnUN?`ewS7R}6u2R1ik06rSb9Kcms1hZKhc`aJ
z6ygqXjIGgJ9_;WMJ9tEY=PNzqrgTL%HyIV?_5Bi$&ju)3z308{|9Q)XF;|mzGq)qZ
zN1lI~ve?0?HE#Q-rCPMIyuDgfJ0@>!@t}Cv*qDPsgnx3^CZ9}?RJ4B{%mlpz6ojkd
z?b@h!QvdjN-PBx=3@sL^{`Il_(4W}>W$cB!<e3~rlS-lZ0Vg&GA%S7@BS&)5|HJ8@
zJ4=Q67F|<HOMSm;u_X;I)?ih(uJWI%ECCCB=^f?czZoaDsGlAucXs`yC1c(svI@w_
z$M^5MkMiz5-84e|0EqcZd+F$i*>JO!wL4s=_CTR@Tfg|GjJ2zih^&0Ql6aquyTXMA
zlip_~TVv|>HH_UK4Jdn2Z}#ftn}J^5uhC<B;0|Qwom8_==vz)~MJy@8ZYw`;_0yP*
z{il-?YF;F;=_4<6@N*rxn+;+lcSvVln4g#)8#sY>TKtoZ_@qmTFPqNQ=a-UlDOpE6
zb1Ww|;kNFut)F2G{GXzGMKi;%D5qTUb1!hI7C82L_(x63xKvU@Zx}U(W|lE*BMCFZ
z2vk5OCq3}tacVQ+jLTM1q&j$eg!+seu5Xm;zn^%&XIavO=*Ekt7Jd<7JMvvyMQP5&
z&l3Mlt)|>5A_CFgy(qZiv#*SP`G{wi-3w;`c4yJfHk1?EG}%=Cy<3g_<~iO<w+9U9
zt^0m$fot+-M!SD@N2!vYbzJRPZ_`P=doz<y!b>-+-~R3WQDNbAHa8t_SPL}4PmnTI
zOwO;`@jrrHkH+NBl@0b=!~W1X6O8|~Qf7Z;4u_0p7+=;FN<HyVVtVdD#^6F=Fpf<S
zAUy2-K(ITKe@q#!5o11G{^vP+#UlJCJG<_Untc6ie8AtP<Y1JS30Fn7UER~5pdie}
zb{g}NcdV!^KbPK62vGT`Ve<p9<7x8V3hd=;BggjC5fpS^^+=-q$7b_d===4?eHVLO
ztNtvy4G31Bp*#n5Zo@KJ;ca8P6l=tkjFdpa@_`-A?B0O)0U~Nzl7SB{f7llU+ch59
zDmkU~j_KvJ^im&)2nOl5W2K6hKZ#{uV9&+>CjzkLWUE-*tUR`;>a~9ScxiI6NRLnG
zH06Ts?>FlvVH?^Q-up&FPFL`yCL|noUgd~aoc@H2+Y-ojoB+3&s*W|J<qd&WxHj~L
z-ie!c*#lIO9sg4(-1>EO{S7~tgR=5fx=;3Xb_IxtNAJu8f;9C*>Ch8p;#U|dv%N5C
zdvEDIis4e(O~sG@F!ba9e!{c={|Qf5>4pk7-aPwiEU+<diD-zymY&yjCJQY<Va~zy
zR65e!&%kKs<`tC?KuP;_|GRVn@b(c*B@eNUcZ`{TC8iSx*z%K~2j&D9cKb~WU$KoC
znKsClTJ-!fpeewQft78p-o$ps;bPL4s>_->n|ZI+gH4cwSyws7x}!2P{;amYlVJ|_
z7yH$2YpUxUvg+htg+lp*T77#64ww*2Akf$M9Jv2~d3EY+8#<fA+S4bZ@P$<P**|*F
zfOrno?b3}5%RJU3CW?Q$3&(!TJkMbb9p^cXBYgiVe*QAe6_tkGUS35BPC9&xQXo&G
zYb2y}em<`(TGv&5#(2TEs=*DuTXb;d+lJv4pL~nyy8G3!_gH96I2K`->Yj!6!eXCN
zIpPw+AtHlva$DDAc?*at#JYtR;kP+|Kh)JJ8xN=|3h4u$g0R`~Me9(GLY9B=LFEQc
zIyFMa-3XYfKOAt@6zj$a(m^-x2C2vn8@d;zf|g2=M`D8tM+F<u<C9%5<sIEayy?5h
zxwYh<{DI0VyhH#gQlh4CNkxoH`TWGwMb`xD3s`ZA#4YpqO^i7!fGLMAf1iGC2vf+m
zU+j;LiVU7cKcUZe-LLsTH{<Ze&H1d08>2OoL0BAR3vONjuG+`ewZ|E9a{pz@LAdkk
zk`NyqNDysX9CHsiH9HyysHLPD&i>9a<;Vd~7qobg**blPr|S}emM$;1kMiSqewI3?
z%SkDe4zogypaF_!=@azC7~#mbXY7~B`XMhff{@6^c^@SAvSs*@jTX<v)ApPXtHrt~
zv&G4UqP}4h7o1!M+)I4vEEa3hKIgOQa~ko?pYg8aQ=WRLMbM1}<HtWK8AI+r(RpqL
zY9>9e%PKOx?6>e~r)R#mqufw<h6Tq#R%^)5v5<Un<AUiGAJAJqH;<LD19h2CQx-qx
zY8B0YRgtxQRVBO~jBz%HzX#>&QFsJjLxsUZ+!!ApFTZ6DcbCyG>Oul+jtrZ<zjxv|
zdwpWvYY&L>DO59E6cQs2+}-{*EMqj~;^^6Edq<)9-g-j!4fCc|vt-C!Bg#ov-!!#q
zp`W-BIvP6U7`eofBp_IpeSo$<wzOPH0gtf8^)8z6vU?zNETeDyko2=&-X&T8xFyYM
z)U&-Hgi_vlZ(7PXZ1RGWhy8WxyP<EI1_yk?$Y)87ZNHc=9Jl@u>u^4KXY!!CcJ+;e
zI`)!lW;3$ijfxJo2F$d*f3Lz*ksSQ3Pk&lgJUP5^ET`DbFJHT@bo*^LajUId#muqc
znY`kQ-m0cTR{J>!qts?jjeBv)5w0WU)I|mP1FJKF`L|$XT!}bj-@v%8maeWv;~Lj+
z<K&OcThUnGz}-=TKD$pge!AW`;3xa6+MJZP9%h3yQ9Ar7ZHOSQ7Bvlx7hOOzjD3CQ
zpO4Ji?%CPc)U^FxFn>M^f};uNm+>|?3SoZ;k1<Vw()hR$uitMsta3(8n$0$0pgHx;
zFCo~`(esiuJ1aylp;+r;!Q{l>8P4PvtO~p?T=*4^o{d9$ESr2g=ET2e`AaAuPLFDj
zoU$*gck2kmkZS}IbpO+beV=A!x&8ovfnv~D%OLNc+bY-bqsbf(pFaJePsqqErzffL
zbE!B%Q$3N=Kz+$R7H21hg1}A^myq~b#x9A;M)Ww43A|89=7GZnT$rEpuS=juvz5on
z`gol-S1XTNSfUnSKd#|;h<`G$S7R%D7(R7$%vTNft3|$*a18w%6z2kJ`uxY}OL$e?
zV9UuQ+S@PCFg4Vt>6E~~%PDD~93iLsc*%~S$d`hg->O^RszSi?sYzwUb<)+O1>?&)
zhO=*OVr=uaaltk!UA3Aisf9Iv89h4``7-g9%g#`#y}B5iybcpr9~SNCLS14iB`SIW
z$73ZtVr!htw!{b_Wxy5SwKb1SE~|*W;emuLtC+Z<+3jhqL*Gf+o{KV^(;%Hpu+d_3
zU*A$tV~RKH#$phc5;oCrWi02T7sR~k&!Q3mw-g%;t*>%IjOr79U~TE6yUZ0L9dlVX
zR94KME^jacpFBJ-ADqJ6k=aR3A>pUJe#ZQj2PtKrVW{c(?NLxWj7EH(UtCcmap{0n
z>fzsTtpOi;k|VhM-j{7nSlGzC2;|@S^_El8B_3(lDgn3f-otE_ZV1nEVGYO<x2vf9
z^0H?UPt@VI+L>*){}&u@`Cn7HY8yhMegmeQFB{QQsXrO<$Mw{yhqadbXMg52OiUH-
z-`lcZnPB&($IE;?x6(~FTjqYV*c}{!klIL`4}Z~qJ5<*qnT7p#H|ziP@B8&-{Z6DH
zZrMd>zzZTeI724!?zfy>L<G;SUm0uz#ZF9#7*U%4;5>(|!fFl;Vz>PQUQtH_WDzfu
z7N6HRQnVYqrRn=aQtrfUrrX+Y0a*z{r_De$^f2ogmQR!xY}^{_`5#H{9mu6~?<)DV
zewM%$;)S)A|H9l;T(2v-=gs_&@ji+zgeF1=vIl>WY7q?>P&65GzF1QM+nbp(z12Jx
zv$&PQUY{O40j5&#6@yI`FiT{*-aipW_UEg-;3^-=N91EWraygJ^dN5O@9C1I6*!7}
zC2I=Rc(2;<$sQ$+@tqPRWCL2B=9L-nj>>jT8h%J;D*?cj(c8eLCK?d8DDp)6+0f}z
zcx@J-2D2%hXL3Ft3jQWY!0l!v#@xD|c?2(N954j?zwFalEudg-V*A$YCmvrX{Zk#Q
z=a3#_K)ppU=cdP=<+27irs(i%C2sGVwIc3Jl_e~tpI7tN74VhNU#Uuyr8HU=yTVan
z3?r*!@KcVD!^Hl66;p{g%G+Z}TTZ#$3bBN9ME@GlnJ<IJJZA|aZg7f}zMiV7Tw*%Y
zhfUKsYImk%bYgVZQpv-42<Y%L;~gc_(m4*UJjFvdohmDrBw*YzDX?2RHLq-+QQQf3
zFOS(M>#}C)Hr}h!@R@Nu%=?Eec&%}DR<EAxoSeT7wI+fAujBD_?V*SeEz%Vqi60y*
zwv90`fqKTiN1;$WnGxj`L^j~$eH^tuecTl7?M~taF6j%jp^I{wt(LUlH?nfn^im_G
z@ln9Gp}b@91L^Pv1-}x+1Q|FrXz^Yh1i8<mL}cRz`S`63W8pj(q*NQYDjHR#wvD+l
zee6N|lP}u<E3`e7%oSI=A&w|8QqrqrQYieYE<6|Rj?9)<s`}T!1={DNk>?ircV@dO
z#gWR~NBP5F<0>3&#As&A5<;z3>G2ZM-aoSr;oxzWk#kI+e@ObWG-FT=*XVvU-^m>B
zVZvgKAMhjKpZO0n?QzsAOK%40OFL}Bba@Ci2hI5I_EZt@l<URWVl3~|T}|H(4xTki
z^}vr+avXqdxG^P&;}%m}hH)l+JRAO9&p`Po1j5i8Z7#y4LF&6E78HD=I(968)HUv_
zm#^Og{bVKLg5?sMw~e_I{Hn?DNj}|w2;GFBke0mB-WCYDH(*wd<n_vaz*|;U^G38G
z536P!<oN6&5<XgHzW80cDPaj6HQ%Sk#@mlaj36^^ycK(WgSJQ^7;Ib*rR{e0Xfb^p
zG0ft8jv3Amjr!&=G8a*{yn6+0s36W0#+A}=EBT6>(-?9&lORKO>C8i<=dJ2aRy^@q
z_Z2gS^94z9_N1z6@HYpd+^&C?V~!rD72>d0X*?B)7Xx9$c`%_IaJH_z+8u)iVOa%1
zUmiQHZC|!a>C;zOOXEBZEqb2(aO(<vkS~|O74?A}qXZ)P9pF2UP_FJc=qD>Buq=RN
z#7h>d!1Fs6WH(D{Y`VQ9_BuK6Iw{k>-^P%$H-ckMph6euqI3HE+IY|J{R;~VeSkg3
zSgjm#GYYEy@o||;ewj0xj4@$L&r-2VPv=yLi|bMjnA%7;jGIo-a{sA<5lqzeGS%2=
z1AD16{nEtL8dVr@bfrgmZH4A-117%@U_jUfgH9MOQ79suQ*x>{TLUyONlM1v*$D5~
z_7&a9uts_Q($bquA1ThL!=ACE0qmZCnCC7|Uk+OjY$hwC&$UeT0?-xLynFUwn_aCp
zx=uIBVY~GC_`C^axfub0<4S!DsF5W2Sk&}n2N#zO4P*RmAb25Pc;F-;U0`mUQ(>ep
ztL2Ic!5HQxcq=c&pinU3ll>8r;{GR3WyN{{V}ogZZq&r~r%qLXa8fRxxYmAwkDf!!
z>GP6r88OQKdwWK=1$~ixB6`XK12WHoedx3%U612A?#&?32#{v{&T`hneu0zjB1%=;
z$T0b2X`_RadZYHbHzrFCZVs4|pd*z)JUC?)@dRPvGw*kSme2xC-&<k}L`iv+%Q>Vk
zLd-c|Ij@sS<5F@n{|<Pr^Sejc9v4T$W5LWNlIgRK?m}v`l)GEY)Z>wnt8)ifX@%8t
zE%=G*n5O-Lplas&#1X;9QA^r7M*C1#iFvAgu!FRHJhUfg`?=EcItTz`_%~S?gPjQe
zreePkM(+QIaydTF9SzZCDpQ)RP`fdBGrrW(axiP67BVaK>c@|xP9%;zsv$_KnV}QE
zB#A31Ph23dXa+qQyx~2R0T`fj>O*$K*L_KGdHYY#_;mp<ZU+mCQk^;9*E0tM8q;9{
zOC0O*wBEsPhL67o6BwBp8XpeatJ_*WcLx)idXQcrHA;ejB4#6_h%K+}#O?kVf9*18
zJg}-X?Nmp9Z@pUHzK5@2y(qyZwc<3jL3MLwmB42l6mAIM$l@l@Bfg{jk)jRB&|#oF
zX)w9)YOF*&J<npfY%4a7H)NePA5-4fQ#b|2|NObEuBPU<<AF(nV|qs{WR;{Cf!zn?
zPnK6%&R)kM6#e27j`!`&ZvNnybN!kHff~As&K`~W6F}n*@n)UDB$1Z%h3&%V-t5+}
z{AxFqFlp$!_zkwu9aHP+l3*_+z|quhcW^(uGzCPfnw7KlJ1?b5px1H9Zf$DD+K32f
z<MUYMyp_Lx!ZRd@Etu+qdWv6e2F;}irtW7HB0UR9r*E@nZ0-HLbrU9gi?ka~Yz}w<
zy7FeChB8hg9!33zPHGeCy85!QdM#-lI&fDDOIloT_^JMpp_Z)PL!(7r@da>}uL~uM
z5ixA4qncV-wd;K$e3gV?;SBijvr@iis;jG)mp^@at}t)n=gBPvML9WRcQC|zhm!(A
zLx0fG1twJ=n3Q8Mx-5O1Yj?1R!IOI80_LbTrpX`AV%GYAyL$}p<{~U>c9<JI%hP>y
zP_bP!+G;0~wGxh6Sopsay+jc3nYe^^Ve+KD@MQQw)*I`GQI-$$%JAeFcnVI$dl+U-
zVpy!Jr=fA>I0T`tyGXHz&ryVLHa8j2if(?s^4bdt=&blROo*~faG!hr8I5L#Ta*nJ
ziI5r}5sC>7HZYCwqg=jE?ytt{e0Sx<F`6k_nyp}rmEiy__4vzoh0E-PEYcSbu=fIO
zuPmcWvpq0S{yXpGHRI~mz@>;;=XCj%gxB_8$mk^DVudlo5n>xWWNQb;ZuSo1#MFy6
zUw9DAMht9-RgaXnuTo?v9H*_a>yLzHP`7B0XM90?Fh9J?E(NEkgR%!Yxo@>-5{Him
z8j$<nDh9p)9%$fnC}3?<9hsolS?<Se7!X^>9B0lwX>-Q4c_oYyCBpfhIrrH|cQI^A
zw_z*;n6<QdEnACskK?53U)wI*W7hfPcOQ)ZXltPE<?arGrc^*c(jk5R=%a%##EG@y
z;<U$6HfQXU@^m5ay>CJG(6cadBag*lspIB-9v3$Nj}r$HclqYk%SO^1Mos{;*iBqY
z%iE!N;;nq^V8B@}ix)ddM4DyZkGB1Hl&9Ze2q;F>r$OC{YrlZ)PvePKJ3<#&en)<Z
zK6qEl?|zjh_Z0Hty7!GePR@ZDdE16<$?}XQB?#d$Qvpq;^!A;-ux~^sv7iH>ZzCg|
zv|Hl&y%|`e9!gA*Y#5tx1Y~R&t+eM!!ge;B{A-Qpi9g%guQ16qO&oY3DT<<>V>WTq
z*w*uUHZ-T$={4-Ta*gB18lV2OJZ>36#n@=tAE%LuY5?g-%6qv8b(><bO?w1h)vZwx
zmy@FnVL4v{ek2vX{XceCQdb^Jm;2$}II7d^Hd$^l>d_<1SVZ^iLO~v@0RDBlSkOxA
zRtoNf74IvRlJ0t~5ufcJ{yQ?UgS7kP3-*-yb^Ai4=s!ejKTaMJp~wh#li1*tUixD9
z^Cbk@)I|;6tCCFZNti6@O3)7)8He>}BUNy-Ro0W5{YuX&RnBLU(t14?ox#3E_14nf
zuATnuSzV&?WnMW=4m%Gnq5|$4&FH%-3t=8eR=IfW(06wkXlTGkI{C4dnb~ZKxa0};
zhQh|oKra^c`^(;2i&bb@hrk+0_;fdXX5P$Rm=KmkYqf3`t?2l@z@Q+JzOm^`n01~3
z2F;Y9RXzjjVl~l-=4KD&Y@qFnBT8=0%E!3$(V!oNOgH3>%Gh9{tE#Fv0~#x6Eq`I5
z^-8d+`^NzEf&hj1tB%y@zw~W*OvybJ*_})1Z;4qam%W=;t$MC{a()of;Kb6$ansH<
zuI7~7)da}m3*VXAODlvd2XC^44p(ec$1d8JSs0}Te@l6>;JP7Zuc3Ws7nC&5{>?s!
zO?+@arN%K`onvYrDk}KO!bEL9s&qvGD<fF6mPr%P#>gg}bt#~U@pZb|6H5t+nmCDc
zc$&(F_cB$h=St0=hxa>gR$ctydf!X7%8`ISyLz?0QXl-8nvX(vKbG)zV9X^w*yR@Q
zPQJyBE9g+U^`{-n`tsMYPpX1_0B?Dkk>MAFeSob|=*4!1`7**pjcGRRq4amuLSd76
zw!8wJF~&r#`rC~|zt?VQ`?qs-9D|3r0z&V$-&7x7JO9?5gtK(AA1#!;o0o*Z6*oNV
zy}1|UIO%Sv#6$@?n*2b;d-eQ=Te*W)u3BZf=kp35lc>(*JO*REQ@XLx?Xc~kN;D_E
zzwW+EP94I}$8KG1R{AgLw5Do9v*jXhg=={4eWU^U*r4OKSeM{>jjxQfbeH~-BU;HO
z3P=^W#hQu7=vS1;@*4k<IN*5>AMf%==_Ht|AT$_qOsNV;8X<>aolb*y0!hv;JuGj4
zpFSVVn=zQr`9kR&7ppah?cwQyoeLb_ZO`nfe(zT*?Et{~^H*CXC<mm3`{}+Btz@Eb
z=={$7S$*kQp2=}q5F<)8J#Q)T!pg`oarP%XjK2>KE;q|x5_>+~j?vTuQ1JQb`pp8y
zJF1U0yCnzO9^>lflbdmcunLw!$zJgukIDT(l*_Q~_ByZ5(WRoIqE8?-*EYPjDacks
zH1N@KeTuJb)U_b1HC@o$!v1(lY~a||$Gd~0EeA~zt7IuRa|o^h{HlwP0t9WEf1ET>
zS$%0WEjEwkmNCc@qsA*F3Zapgi63+b=a-XH3W!~M?`ooi1v~?_YyU02@5&h(b^+Q8
zXO8D!{a50z@(`;k_6Mgpq<191D$e!E;r3Uz8LzE^`LBX&eB`%pLa@VT)$*|5@ZjoS
z9~A3fQemCxw~R=)E-k`D$pKzgZESHDtSjwUt^0&xso@j9M$Gunv0>j=NY4@J8@W@n
zF2VEP-*?wW<t-K%T+*VNI)#2ZpQ{T!fu&F;!r^$MHXoIMqB*!O<{mN{jQ1<;qm@b%
zfYbk=^G7>yE-r6k29>%bVWB!!O}@HBL4NMUF#sejh=*}5>=Q<i_6=*IH2MC;T3GqL
zMp^J+7fGTV0Wmjm2IeAX;4Mg@8v1t)F20Gxz@L*nnu)hixwKL>GVf?rp@!ia0Y%y~
zb85S;tX$8`=-zIreFO3V-6^XC*&#K|5|^lsAM*BoTDAXPlbe>7N!&na7%7Pm`R6}x
zdvZZiQhu-f7I^dtFS~97zYDm*xf!L70lV%645o(^p2*wuQo|pEgEe7IMwEHB`GdSN
zSw+q#&LPdU@bKeZdQ0>p$p%N7pbv>J6I%0RU`=li)CX<HzU8v2Up1G4tfX|L-f4yE
z;AKsOSO>nV7Ddd-@`^zs<%)CCwcF@3G5Ih0)@jv0fxw#k2PlUUX~_@M#zU{mQMM3!
z(0F7WWxF9<2ba`@#GOpObZBFAk@h(kV>m@jVje#{G$dKA@g2$%dA1bLKbtiydL$g*
zoj52k?e~guRB#<->6QpoYx2BTa|mX%xgP{Rm=hO+22qw8Wl5%1hr04~K?dr0TmSfL
z=Eyp^u<X}di95HkT8)_{Loh(eT&f~S*1O2n^6@75(a+^RqN@JQuJ?I>VP4o7zv~TC
zHu_rB=aivFD*wUw%9h9X1cubNEF}eyb|2jN#+tOJN|>0!Z?Q0YSi117ldqxB+$iE)
zv%qd%YUr-7oFpD&c|xs~DokHa>>>qxzwG64X`5`YgXLv<^BZPD>Wi49`4eC>E$vSI
zcBzgj32n3qZ=-U6#-?ba2S+wWUxn&g$9}=@(ZQDBDtYamt^<$b@<(Oc8~hi>#)-}s
zY%5`*MiF4Xx-jtgv%vOvO2Y`f17nT^XZRZ7t)9NTeg5xYX%ky==(A4kxMW?;i)}5<
z*2}jfiCR3^OW~rdUcTucBPEA)J!)v78Lt^5PmMrFclyx>c+LwDqNXb0+>^O^6Ct>+
z_7h)c7o@>GNIuy-&oAKX1ox#5tSH_1#@L~dbHq6bf77LG&qH^kjy20uMtitpl2R)z
zXMI6>jyC^ZJ1RyEi28se>G`(~&hCz=7mu?heR*Z2R$P@K4(?#Tuy>D=g1@fl-o-df
z%Q~iQL+fx%H&$X8wC1xuAS?+%S>uWXWp{%KeBoE9ULt>>_!;rKK4V!{&xa1$+T)-0
zQY<n?0})Leg<;g4H#L5^%vU$N4e;zb$kjcIxpg$>MbzEO&s|nlKIfJZdUvVM`fJFt
zPrYd;jQh4WY8!P;x^P}NgiszX)$(e~d+QU0AO*F}I@Vr}BEO_#d!7~VE>>$zT3+&A
zr4gas&@VY@8}1@0+Dl<SwH^JezR}RROQ;=CFYv9cDNmnTf|0mLbSJWtz{f#7xyiP;
zS^^S!b*xpjHtP|e!0UgPj)c^L%W+`OU?LlOKleD{_NS^GwLN`jzpM?No;wcPl>bQS
zpxchWX+NA{_lG&uxLADE>2`EQ!gW#t?^PM8k8h+<s{^*WIV-ZqN)H1B+jAg?iQ__1
z-5p#2(=}5VM>IbwQ5UjR=+S#6y3kVow(p`kr^dBlT}u$rcGG<8Ku7m)ZEVb1w%44k
z2`Ra-7x7gC+Yi^*X#Wnf;1w{ith$ycCrB8swYBfx4q?#ny;DN2&NgC<Y_S+Th>g*l
zs$B&b4>_&U`Ev`+x3ipAG)uDsF#nt3;mq?cB{YgWTks9_8D5@|pE{6#j1YDEiiV?6
zS+9iF_R@CeLq|0PiP)!4H^M;SjK6<*QBR<_5vx^A$xcVrWfyYXnN`eF{k||k9QpRG
zW!N)bh_B*6AMa<iZLfJ$^&}bGnrUz*=@~UYxF=!6y?b{s3<(7KBszQR|4}}vI;J3Z
zl_ZykA}*+Ule7@cZC&|A;vg86s9(}=D=eIX`nA<cQb1U=aaktUbAAHnroG&Zw!njn
zh-6yq&u??~=3LWS{>DZe60>WAMdH!shGNvGW)nR}6=|0pFi9B;`Suo6$d2_4iL8sk
zA=kIqyRX~NBR<ps9-V>QTF)(Cl%9Qak*4bszqDNri3Sev$(rEyfAQkO;|Ia#OYE5?
z*W#cHrN@C`s7D%l)-iM>H7}6d&(|#`>%M}QShaHHr{%K30k%`9J$jK_;(=f*=5%9(
zAH^(V=rH^zTi>eYJZD`^<n5#U;Z<Eq{0JjQa%h_=o#9G}==aRLJ~(wDI8NPAO5g~g
zC@AxI!1L9l@1}qjJ<TdIp|XAZV|Yk%+uvdSWQVoD&TBUUr0(E3a1i04@vm!jU;n$t
z>H70g{q5EN<g(_W7xUgW6h0Xk{QK!5XT??wN<n={Ll*G3w#%;7GFuw0H_UCYJ@s{D
zlAvd@CuJURn{FxwZ1WUBM4OQ<aG1)RwqSePf4Mht>j&EmuxF>S;Ctnso%<xZZ^o^X
zliM&ccBUW9hFuitP)=b-;t3q@;JGjvy!ZXe>!ej98Gf=9<))_Vwu%$gl$hYF*Z4Jg
z6=$zya_FOD{W}tg?n8&6h1kx%n{4pzih|yFeD~eEYnO-e(h||+t>J!|$tJdvPVYg;
z*~(hZH5^yA0|u2lchE?(1%Qn6i=II9?bUn2dvU$Kc3RH14HGmIt`MhZdtN*v=qFDX
zW1fT@U8nJwzW~o#tq)@*KWatd3oi|ryoDJvj1XMV7Plk`Z>h~Jf%@LO_S>RX;top{
z;9#lIb~wGxVTz=MD#&;B6rUwcEG|@9!tpj$Z>HEx_r<Z3aSD6{vQDi(!2bm5cG{*|
zg|?4)E3eUe&aW}c<RcKe5wd*UW)B@zizMZ$pYo!87k3ugRt5%foF`7D=NUKdSXt3|
zsX+$}=V={P|J2e_tDi08FM?qX@sFZf)9T8Wh!KvswGz0yFUwX1?|F&yiiX!Y&8FDg
zSTG`5%6w;=<EEtugphyi)ioF;_(O~}aLB-vr@=@mChi`2W04ya3MFXNb08%VH(0WE
zdcA3rZM)^5pczDm2YJmnYjy87%D(wd+1_SJ3m`4&jctp#PFApP@Qy2#uGj@{j#E`X
z<3XYkUnjyvdD7c(gAMuMUzO8D*6jCpt|DJX_+_h7Z}-n=f-TzPv59dmcKREXmg0sr
z8xjj%WOzrB6)s35Uo<tBe<&^LKd@)1Ai_%=(chfDTn;fs3@(R{i6cD7fXN1YgrV4w
zjoASh1$?TGJ&`znX>WUH&Vz`6fDpmr3ww4o3|qruxcSEGFSZPGN8HU`VZ9puZ0^;K
zlUqDw4ytXnLE*L6vh43&D}>M*EL#%y9!67Sc&~(Wx(>va<JEw+mICG2cJJL5V5m;u
z20`;N#*wyEB`j_$z``K-(>7qtwUnHHRAFI$AI(XIah_eMBiv}g4j7tl%pr;EqLn|j
zw{`HxeGatUt60vvNano?;*aN9H@Ccx=uxs*UXi^Thk#uGGaafHU4F`Gk4lPFFn9ce
z5B85<ZP@w1#Qz0cDZgpdKTFFizpvvxQOuqXS;A%F5I~SUAVnmB3-`IbeU56+LgzzG
z_od2Ti8w6U_kurUFZej<VjMv%4Fe54Zu)ey+bRSA1!8Et^q@)C<?92U11~b#1i5#e
zMPmSuE@#;)d8NLkU}}ruwA@MWGVFccC=s^9pJl1lnb#7b7RpmB!<#|vFV_nH2(<td
znaxm%mjdyC!`4Y9w{xINKYsRXFk)2VTsq`iJJ8o11K!Lk9ddGM`^8S~!S#Fpr$+sK
z(EZ);Vl$7^q+xLli%OAb^BO$W93o9pN@@%4z|W|}4?(kGV&ti#s<&n+^Sasdg0A%A
zIsIjg_B~gsuf9TLRkV4$Ou$qr)&((@mzRH(chri2>9smC<62<b)fzIeU+Fc`T{JBD
z`g9hoJey&<*;@%-b$lI1by+=g>ACdYZii!-gxwnO40>#y+5o27LvsHBC3o|UZHpX?
zrrWznCqK2dc}v3*setnPmn#6-8Wez=UA#Wt8!lmcX??UThucx~c{Q!;aa$uetA`9J
z<?9l~Aj_@wjN#LlVXVkwMG~j3T)9#bb7~3O7-|FRjm$LE8;6yJMWAcJ`<*Sy@D9(L
z=mVQfwu;Q03&gD3!|8K&pKDaY%L`F=%1%0d*0eo?Yy@dEHa43Wy5OGu#t>0OwJRmc
zD*|>haz=Z`v;|)3ID2e}32{&!*sGMe<bs<*WZ^-h=`ocRcp==3ChuHU#0q|XYr!r=
zn?y%l{5Q`X#`V2R>^ory?M?U`rIqUZzT_`P*Gh67*9vFrYSOSJTxF}c*q(U*;Oaju
zr<oAv4`ts1<#H0s65$$N_6t&~nIgN}SDYf*Swx$1TtT#sG{B}OdBTW!u4B6JS6(pG
zd|+)>s0)S#j|RUNtFiGV`xa3k0Iylk3CYboH9zNystGy=kpwtKZ$*C10<X&H+p5-2
z-~QdL5`TBAApmr^WPb*WRE!Sne+HBwOE}V-K&Dl-0k(udcF*~tL*ds)1Wj45#$P%+
zX8qp=0CgsUkXa()_uID|UqLzG0>U8K8=5xJ;nB5G76w=0T&EHm)p>S3Or#ycxxJaq
zLVjmCxC$9yR!5Gw`JhnSoH5vGjsJ6Xuf#0+1B^9v<H_qJi~q4pcrQjwh`YUIU&SX}
zO5K(V_yQ4220GZa4MuQ%X6Ix84uRBVjvo&?lzP}>V|1%N#f7-AOtqNlqZscQ;{M_L
z<yy-&7_?(Gj^X2tV1KlN9S3}(fIPNgG_;ydC^uOyt_Nma2<pd@8dnx9s@;~$)+<IE
zl`9M1l!irU#9(H4zk{axYk}Pd)+ah9Z4IzhOq!hlvtO8C3-{OaURAv&GZi#g<l=5M
zxiw>O0xSV3rM^^<<Ff(BIucFjkMT4W(#OH_)4(JHfbhggc-el(2v@s`DGfjG)Td9q
zXn52|j64xHM+^Qo1(x+V*!wPf{&icDmiO1k8y@d2C_lMLF^fJVZgnV)RubSy%xxJI
zE9aj0^XDYO`T|I=0At%6HX1*A<VeTHfR^%O%6@i81&raU0E^kMS1K+N4>V6t(Af;k
zx__gx(fz@~=R2!)5<N$MOx(L)zkbyK=yL(X|0gW0wFEkLQ^YYHJwby}S>dRqky3Fe
zIRX!Lor3Y*KO$6Sx_al8-mmzs1v0#dpVnr--f;7$rbeEoFzeYsfEEt;_`;Dh`%Z;8
zJnhv$wAoiKU4Hm)GvGCiso*4j8SDp#@f2pX1a@$~(V74Au|_qA-AKTpJ^=&fA900S
z?%uO%l}XfOL<#k^!e29z()1{A0{TH+9B?o`oq-#5Oz<~vrjOOe=!?NA?w75SCLW#Y
z|K8YQkUWqC7!=;kn<$U5h@gk>kYThVIpNa3<mv*}mcqX@cOAWqL2EewcYuo!jrfme
z@L3v;GLK)?y`0tR4|Dj!l)aM%lo-m@UxQfE&D^_galxD=0%!N+<EU9Yao;XW@8rQE
zT+U@@(}!TogXWP-(Z66`ZAB&Ae;|RGrhF~VDBh(st|fO7?8-uTq4w%3fNkd=ePeZC
z6*Ko@Uu_1sXeH=P*3#V~6^x5CqK!J>>Yo?^F-8F@z?xKz#R466gjlTT+n6J-E(vf}
z;4qDhHqVTh3&1r!jfK^|H0s?|_}_For$0EC-eJQ#sz^7!E#0$MvY2)T>md@ITbH2Y
z%e0Z%W;oQuz}gm@^@4|PLb+6fLxd;WKPq<mGHvJq1V6kLRjuDJBILSGs#zw>Z`c2p
z(p1OvVB7F?c=LYPO<X}&d<X(14muJ#xBXmuKKOt3moPRxM&p9(SRP=)bmGj|Vu8ni
ztNH4I#R|P6pK6#=5^^%ZU$U&%)eRrmdP9CXyj)%?#BlrDs%stVrDQ`w3PTIu74_5R
z`nLxazIl{=<L<sDN|*ul%#O9(_FGRKp_Ck?n1$<{EqWH;CEZraKe**0-;IXZ@h?0F
znvn%M$^7%t?TAHrS9Th-o3SZTmbids-++TT0bj?v%PZgmR>)6Cg2b>?jH-Js^mu$-
z->|VlWHNGlRjaF%>%3&)Hq4I5?0Ynuo{}QE1325EJQk*Ql_3s10y>{sTW3zinsB^_
zTq&Vnqkd_~w?53qh)mN33j2>v9cR^qI9SnWgXyo`w9x$j#zuHVwohWs<b(GXX4WC)
z`So_Mk&%(EOn?Sa;Xphi((;|OL^9rLYj~qfi;Oa_p`~+C4<JW+u(WXjAH5}{Iu^?F
zNgkEJ;Q05JnHVg&z6d?+syoZ6AzZ;x9lMdyR4c=K2hpEdAm+K9D9#AHpSfxiLjiON
zF6!CE$htnM2tnfqnmg3|=B66fQsV`7w;yksKf#VqwLi{!Ssm+2$vsJ%*T<}eh6784
zmTr-kpWi7kwBh#NC<v@{mHKv7$0A^P2c=1YaUO>Hw42MZ{M|yG+JZ=Cr$Rr&nM(S`
zon>R%Th|Bd6{Sva9h3|BhA5*^K!ANch1-c+2NX=*t<;f^!PV2+b1s%Pu@VIi551R=
zSavF!+^>f_rh&km6V&YLwN$SF(xO7*BowBXG0<a&Y8#H`LFSl+8D3QO&h~QdQ~$mF
zdZsO3556#=|HhLVCdbD+pn8%uN}Z&oO9TFx-)b=B7rV{Q$Ol$0I+giD`v_qW;J-2w
zbFYnnD7d&!2^Oh_oL54E<73R#g4{~?bV41g6tI_;zF`wX4Zz}h=$01oS262GR6~0i
z1PGt@eAiPB5M9q$k;}SS`B01vB$=2SNjik?+{>E<w$vv|lNhT<xbJ{MWDPPXIS%fl
z2-6ooR9rkc<l-JL+Gd3oNM40>8M3j@LXtIai78u0N5>L0^Lms&_ps@BUVr!0Rs&BU
zpXTJ`Gm;<f)M@uB`G-sK{P}-oZvSv}h`5tJe!=tEptpCpZPi6eZ*~DWL4B|>$5_WN
z-+WO}%ld3(>Bzg^t=~0U_cTvE9~bUCIdX&MQ1GX!)zWH3j#EpoS0s(9@x{3Q<@-se
zblvGkn%>0%J)*R~LG8)RIMso(0}ni;9{4XzABF&X5wxE0(EPL8#Mbcig_5g9+uY?I
zn4D;oKJUq;bi-OG?tsDd#jbeqnn%-Iwj$K?IwVo&d&*mI8RWY^+;q<;M?CO=LQ-H|
z!PNM3iE{zJg{2cjE&Bz+oqkOv`krT$CCQw6;gcBmu&cHxy7K<Vp5M3I{xe<uezoL?
zd&m2g={Y?U>aSdHCW^n=T>ozG_nUQEUyl`#B<n7?ZU3s#cT4-`TgeqSk}j6^c!@tb
zaH1_pw5R=T;$Zev*E)uDeyEH4`8Lbu#tGYue+4GT?7KWGeU=2xr>&e09scGaNG&$j
zxKI1#r8{u{Quqok+Ducj?jA5W^<ZnEqtR+DaZ9zjrHyCt&9>?mR_Vv;CuJXN>qM#7
zZrq8LCsHuxd}03MW4@FB^YU_kApxuJvkP<gT*^GHw(nXyr4>P*P<z>NPLz6nu+vf9
zX(abIe#^rPPyAl#n{J{(OXUB3cvzQFUS7^$QDl~6F#q25zCWm>vx$j(AKd#$LU_`)
zbL*=_u@<U3@7###)dXX4L-pw_Q^Ceb<+^N;u1+iUS!9$i%mh__m5Y4)COy6Wr6|>9
zJ%5H6`-fWEJ`3*}0}pqD62os}z!b7)b1>C(mQ4&4cPSa=BcMAnQM)((QpZ!2S}eA-
znf-RDKb^KpMCgdBG~>eN@Okal@iC12%Xe`pa_p^9#+Y)JT*h0T?CrjrRlskmJU&r9
z5Hz&UXP%tjO9Acg-1+k>h=&LjOM(w?)SWwJ$>?mvh;pBa&u9HR+S}Wu8LJli8ziVd
zH@|+l!(08zGylWWhO-?vxgK}i9K1(XQ?zW|a_`*_sM{iXHInhk(S}r^+~B5XzDv+s
z9Qoh=_?ceyatF2e4xtY)>fX1a;SEFyrX$&+v2h8-Plh}N>Cj&6l&tu7+NaDDD*L*M
zU2S{0ktUjUA3ThmyGUR!=FN-KGhkES>UuvC<hykC8FXrr^@z}ad*<R(^B)J&#}6eL
zgcWJs{qt?;{Ew#8ENt3=6>@@utn}G7Fh0CrHcL~rs5g)P1mNJ2X8vQFY}MJ5&0+An
zWgFXlu?>=BVOHt@P=;oDcl*9e9<J3bC;pB3a@xC;BG<!&6SqY1g6)67zfI)@?Otap
zF`gJH`O5}ODS$+k>^@rdnSZampfCZMn7O(6@BKBd^#su{mL|!}TrqNW#0<pji&m3C
zyMvc++PG1fK<=XMxu%o^MMkHPf_I%XD{y@Chwr(Za6l&a_4QfoSMq;hTe-x;BbvID
zkBC*VeI+Vem1kc2B=t~o_~uTmH`&!oSe$fNk-ZGWQIsi44gWqeQhuCwR1eSLobSx{
zWPhZ-NVuR}@S{?bLM%(gsOK$O2VItZF1DDeR63n?Od+A6>+td8JD2oCxR`Atze;d=
zYr{zzy)vhob?j$z{J>}46A6!_u+E4-ob0i2{xCJDF6Y|x>hdzJk0ZCUrJ#E<^Qdsa
zfo>%i@Ir`y4YyRk@4CLN1j4{JQnOm}a7Qh@p1E>fx8uQpKnu@!PV^ttb-c1Ok~OkW
zy?1pqH+%32=&XIB<m}lI-Ryn1OFI1Z>GFN@f>cOnu5jt|%3cHwQ;_Ha3G=+)-ktdc
z!|r=N7X%XeN_l*2n|4z$yq%R>^GgRJ$oUKh-}8`Myn!!^ttW6Fq{jO{E-zoK&(6+n
zAdVel3uX~O7Vz9#!yn%(G|NdqCmP6bJ~AT$LG-fLlz)3q=VWVZ#87uWN^A=>UREXK
zxC5*!@rLNBJvL3R@b#scHhO$owHU5_(7VoA6N-)JT<ObP#@{sxPs0u8rgp<1dqJPp
zs>@36Yj5;1@bdL;C=LB>#4sPx8-CG?9_HODX}QwRv-y4FLz-pKD97NxIq$C7&McSg
z1odKf_lZZpolEQ8d;P@Pp0U3WP`g$FX=Sx24ox#NGyPAauKV-W)bAo<$c992e7v+@
z4X?LbnwH;;jUyo*QIpKGi=DA*hW55SJ8b}dQ%4bf?9Qc+(;i&)%P-8&EfbLB?j}>2
z`*8`ImhGGPg6UX$a!JV?95hYIzmCu3MqR9Yxm3D+wCRxPk>#>?mdQ$4Ln`bY0mA>j
z_3PIg^2t6?WN5N|`M{@K{(73@Asj)geY@CWV%fxPN_JZk8p>N58%KYuN#zszA(Ybz
zSG294<e6CB*<r$)1&hwJ01K>N4kma5Op9A`YPCQ*@gCVy2PmJ6QbCq#`M}tp6tqN;
zj>~;7mDz%Znt}M4xZl5ja|NfYtuR1Ib#lw(N!OhlH*JbIXcUG5<ivfG<jq}^lOuzJ
zLa^?6CJ?@BRh`!@me*a<tG!BXI9IKG=0<C5UJp_~F#w9R<?A>@;4?%lyJI&5y*hap
z>9P{zPSC6{?};t!U;Et2JB^gcMMu2tz--y4&d##m80DrSGKmUe^iv3RN)OJJQRK30
zw56n1b(az>ly0!Luq=hBN}C;C6_%wuh>)E)(&<3bm;J;Y5Owv|+!3=an%`Wf*&=#q
zGvg%u3~Mi(|E&gB-YoQ&S(bxPysfJEA;TN*=;C5?+{YSpbh3$(+Zi}i%wVjc1Em4{
z$954<;22z>Jct0Y0wp6GGc)qJ_7|=nkq){grcOs4gRJ>n7N2YtUg|O`GY6HDj@b+r
zoL{pW+tbt-XA(AU!U2U1ZTY@mfw8tF^@b}f2k@{~D57RRcpTLl;Z$~pOCS3n4Kh)P
zdV8h`8EG3pC{(F#5~aq=Cf0u;x5p0*!K@T@UHNj^->}u)#9%2SP5V20VK<hISm3O+
z0Hhpa2#+9Dw;xU9-kOMn-IR|UEk>zp0NXbp&ez9kbca`!fZ+it1UboKoaY3lX9pN5
zv-_1cg*ZqPrp_(TZ9nHU=(gGTgc17N;?iUi`Fis5&<~WifBrlz*m=f}r(x_o^*}V)
z0FD@`^YPxpZyRFCRCrh`%2s`Z?Ua`-#B{SrzLQpBXkQJMiZR!PYXHloA+J(Y9ITX6
zdwR3jGlBoIs5RCy0WV(V50T48Ja}cxvLUosgc*&_^cTJl6X#RKs3V8lH{Ty}OO!UO
zaXt4qY89u3ApN=1tQwX10B|e5s6DeK6E$N5w#z1B?hx;2`5ikQ+=51spN@E1^93%3
z@)CzFExi=zS^=aWRH8?WI!q~_(Q1aOS97yH5HABu3Bh~xG&Axnw>#d9omka7`ov*Q
zafxNx+p!Xi2^Y_|O>C4a602}I-{zd>H2W5#<^!?L&v&>!z6keei|D8*<!t4_<BX=w
zls|@T`68Pb!XWlFESt1LY<Nf7U(aPFxw|&FywEEYU@0V%zNDVn=IM#^A~CC$@<+VJ
zRVofQ(OX<l>NTgcHaNA_1JaYGpJg}hw@i}L9S)>9wOJHr%wE_QcYsZnI;50mWaJ5L
z+Z}=epxS2NzPIZ#2Ky18E3kX6Hh(A_=Q0BzfiLg1s2ewyiC4Hpn=iUr6{tx?s7FUf
zr{6K}l(_kNSa7%YJtIbcqT*DR(`*cZcsB&nEqwU!AvwytfD;C4lUc{k!}s+phyLMC
ztlPT%Mn){lJD)hZXY-x9`ZY`jQp}Q^fkv+7f{w~a&P!iu+>fxUj_um7Bpp`Mn?nTG
z*4AddJ@ebBEx%cjA@!g6!kg?g|LWe+<jA*Q8=#8Y(PLb{j(`K(l0vv)b}2EebDcnj
zmWKC^X<L56UWLdmljM(fjmO}WyYG(Od`<q)Go6Ow_t|M8PHlcw`9t?`;clYO0=VG6
zF|pI@&$p;vja3{|M!*A;14uNdwlXxsdRpN*ud>t1*GIm6%bq~m!TB+g8%05lRdZ>1
zTH4R4=ltpC)t+r)A4<xD90X0G=D2g4`yir=7UNNX^sIcwjk3cCrqZdNMyVp#NfDe=
zj@nY?b@@a1DrcxsCcL8vpzyy=65^0hWXx@%8*&`Pfs%#Ke1dnB)-ZP3R=^lN_)c`7
zv*+8a4JiKH7sAZXg$x#%9yxk6o?qW!pd>f<4~7ZaXWAzC;QA?W^EK<(9XAhU;bOR2
zzwWILqj4_@`nS7<8u0)~&e(oDpj_oaTSk);NJcfiqapzP%0;bn*11&%jm%ORQT}<#
zgZZGvnerAqz(W3~Y{cd`npUKpWCDAA?$qXg<MrtXQX^N-G}n~Jy{sX@uo|e*Z+Ucj
zo^`=JzZE`Y;UFY76B;RaN;X0Y2VQ)KW=K~J<td(5lCTR(ChNI%?<O=qpJ$ztiLD1)
zu7Ow9T0u^T`{j8#&E&_A&+H&@29JYp1T)`a;(pKU!oKQQuXHy6e_h+FeU{R}W)z*-
zDNDQ(9gC3R)!k3I$C38I(myJ=p6l0Lr#60p@r{h9%5^h41t47TW&3rWBXQS(o)Cb+
zBIm;c3fI<!Yb4$eb_U(O39wfJYi33IxDvP#7JRbUb?P7zNZd^CdT~heLHKo!Ia`cn
zcJsOl3ixhMXxK{Jx@F$!1?psIZQn%>f@Eex;x>R4ifq+q_HPiU+Rv8xiwL~TP78#S
zf`3X%bg2c+DS)JR+dSS3ktL=yUsy*k{%5|7(bS-JzU9Kn#<X{(J;yq_I5pT^ZA5jf
z4XDIRabl(5x=JvwT?Y`~pXdhXlU*Y}C7sSDeMyKPU=R-<Kd$0@I5u5!+uWM3`!S#s
zPZIaQblIYdEcfH6^8E^t8@RYSI6@Rxol>Q53Lu%lkVRXzs^L}d@XDI1SvFHx0+>cJ
z_UT$e8650L!lZs+%x2WL{F7S;jApj-5RAhc1bh$E<~aq{1dtM%EfdZiX9*H#+T4AW
zg=d8YoR(cZwS~S4$Qax38F?jHsPmQ)3d>l5M#&$Ai6U^Sx4KCrcZ%lhrTGfeBhiC-
zaA@~w)Gs2B+E+WKZW>&{#$6;)S;}suaqskTJ>RZ!SX<S>1sdK`$x$;|1D@9+{ie%Y
zg1>Rsxb{1ykAPk)5;&04l|QtKa9E+Yf8A&pjA<?(4uS(=vs;Jv<ET&2ZF!W9Gz<?8
z&f==~wX?HhgQ$_g!6@(dP!ev|^bXL{7a4iF`*~e0@mP@g{tTmM=WTIw8sIPpuciKY
z<(omSZgNc5JN#$o_T9k?!^6%z1p1tf0v(RWj~YYY77_9dUK;!G+HF?v{@Ob_1q;xX
z)=8Ad%dcO}Qhs(jxD1OIw76C@V>)s_cz&hgI(Yi+B|Kphu#@mKyZE~+30;7oXRni<
zp;B)Eb*Fxbex;8K0YhpE#g~|Q9JM-LPl)?p*~C>F8GcK<XLdhQIYFCW1A{NEa8+ZY
zo#Iz~&2_6=+#e-=e)-y|pkv}9w&H7GV4&%5$23Y6j$mxCuMQ=iBMPjsm((mVsutb<
z@#oH9;tjiOy0cf_Sy@SGdK-NdHR$nxm#CFKk@KArK<!^_gP~!)kg0a#nz90f8suY{
zWs*)i%iW&BNW52b#dpDF`s|En4ZwHh*s}(5mR-oTK9Sovrp+fKlX#KnLWg4LFW`iD
z3Nqm*&zL)<5P3ZIoxK|n{fg|gN(73pqiomuS+<gx1lzkcJFN@s)9a|@a$$la{Y0Cf
z<KeH;Zx<b_!w7k+L8j>g&GBLIge5bgp7LFl;W#CLmzHaH{KMpY49ETdYwyj&sa)GP
z;KvXW855gK4alrSWo}7H)T)$Otqg@wDKZv?h(uJ15{>3L;|j4$B`MT0OOy;{&h(v6
z@80|O@Av=r?c><T@xJXA&w8Hwx$o;buXE^l|Na**VUnyf?~eTxW%n3npUfUcHxAfa
z#48AL@)~$Qv(8*Xpr~|bAN8;E)Y(l*hO?lzW?76>THFWAgUBB~5B%{3oz69gZ2HW>
zS~%2CVa{G*by|2A&NdS*@x^1nf;s3HQBl-R`Adbs@5RDJyEG$XD8{2RFwd>Dv2dtC
zl=gOsM*}!CX>spY8vLL|h6^<A1i#hCd54!<<GJ*>-ypI@AJ3@l{QUW^jELXPIEY*<
z2X#56lvqdaklJC+F8zkF5+ah><KTx?72p8{5}o7zmDolOTUjyes{Dk^&CM53(A?nd
zp`k*neC?Pg56tY#)js>9r%vTPMjx_^a=>zM5iahJ@ugODPljUW*I*RR?<3SP_>@b0
zb6hTsE86Kv^Y2{Lyvar_r|}*{kIbG0cUq8DUp>f(I7C@<ow_t*;vl+=e#3A00Z2QV
z6QvtLUE~gW-O0lXR+7?8dVkT@5GasgJpOfkeeQCw{3Ya`Y)hre0c(s#-~yshI>Di~
zsn3m47UX<`&M*V`vAW5*<bEG^R9%7wubDjRudUr>3mdifLtt{U1#w#rGOCmYWw)Fl
zPwWBfBy<Nl=to=7RwM|mn29;6_Gw7-E#`p9$ZBw`Pce-69m1<Nx9@R5fZ1uAi+wt;
zz1s6;AuZ&&s~xi=l4&%?PiF*m@W`e5VkY{1)Hpo5<Qm>vPBH6YNjJwg^B<mPA|h4S
zYu%o|qRI_h+{?~ZYB&8}=cbpY#=-TeS!WSls{v7iMEMNTmz%jO2Co+inZW(#=94oR
zeVbu^^JZjZWbp*D!dckFTQ4OaTWC|QExc@%`KiOCICE=Mm>^*S!E&-Qn<w`6IO@?z
zi{CW@W~VRO&=26~={xz%fiezbTZtAgr^9y*y^F(5v07*<9`{|yOfs$S*ObyWQuZH-
z^eNmUyU{^SMBV@Q_<N5s2ZRH#2bG|7l_hu$Uc;M+`bt7@Ni%_Aj4pJ3CdNKrb!LC;
zyWAbvwv<3i`kBeZ<=C+qW)<EV48(Kazo)Wv8A^rl8T{BcuCuCk_bMp1c>Vz5kWG8T
zO*oqRUD?uQ8|5QpqHQt?PUCkxos<$>02oB|`>Z7ixA5){=YUIEr%(T#;EA;%LA)u?
zFcS4d8C$hwJ*L+BysShn357ZoXf?n*uKZ5e4&!Hm_}-X2^X|PH2fxq~<Ov&L$3C!k
zZ?_WU*TK9!QRgo?i`_DPScf1icFIwOdgdVA5FYLiKw*2UZDhZl{)~`{vq<EuGt@uq
zU15x(?t-K&A<Hvpfg7~K_8>ETAiKa~ha3;|y#mnlDs!eY5x8Qj`vny*J#VYVJKW(U
zz<L;9fsKl0R1?%f9^c-l<yFxw-`?K5A<6V1%^*yM*dayvG}fRy!d1Q;N39Qh=1cg)
zLr~l8#~^}*lHXc5#E&)3l_j@21f{VLa?9_J6Gzc_A&}+bA%()|xZL$7x;+%#y<Hgv
zI&X8+d;L0<BmYwW-btrV^!p^u|EgDBe6mN@WXxZeB?yA9-}%jXq>rkf@SzBFf!7;w
zHKvqZ7bLS&<Jc()??RRer0jg1en?@{ru30}eWTh9d1-M?)k$2HHS|ONj4`dP0HKW^
zUj)7<K}RDM9o`|jyxSS1A>Y(#OI8o}Lk|TA`?=|#iQxl#5edzhOsHzO$k8y8i$Qtd
z!-0EMi5(%>-<`eA%lLQN@eq`8b|NJurD{T}VbVX)aGL1#NA1pArjw^hbFFJcPQl!O
z#_T206W)IdkDbTH5)H0rucn=%oScOX914)9)zetr(_P^!OiLFI+?ic2B0{_HXb@R7
z`WttK^Y(;Ea<B%;sCwN0&LV6bzl|fuoFgXe#FL_Hl}f*->=*QTug1M+9{mNZauZr(
zlFv2&$<^F9sbx1sn^^av*ApcOx~qe7WZKm|j7s?S3f3IwGSS>*DAxz#b|g#o;Z$bO
z*v=d@H;;mh9NH0W>2oBfKje_Y148U>L456v=MDZJ&aDga770>NR8(gd^9ZudcaDJp
zqHk^C(7_Piw2F~>m2xhYft6K>{Nz(JviX?2?1H^O(0gZVB{s`VOkE9!{|XVXy>g9e
z4m2pWxkNs_=+S{7AYC0ukzoyb2^T7{mX3~vBN)tv@FK^QNm9n-h8`Gc7gaj@t1B})
zIywf<UyPxm<P|1jcC3jTncaJKLgNtVMo+Ql1Eis$X=T!6LYe156cgvF{P%21R0k!(
z@|y8Vui)e-1?z}VWb4UGUo!}k{ac#2-tDC-PW1eo_F%ffQR+L3ac-VMy)pmZ&r|bo
zn4=nRwsheZ^ba(el}tGpsmeq&e){wcMj!lyAqDv^Qx`{qc`t<U5~F@+&lasn<H^ed
z;cltaTe%Z9{u`*T)a25nQv%U^CZ=dD4XQ-zw!-iwsAc{%oGcPVQk)ucSzM}=zV;Hx
zQ`7vJ)Vzg5B951DiQ&YRQNtXcF-PvZT0#+5WTg36^;Z&{p?Vwy0M=TWl!vYi9eDEl
zGo>p&iC{4Ooh@JXoE{P=PbuaT9{8PPvJM5X9eh+~a6tG2EHvcE+2PXu38|2rTi-oV
z2$2=0vGSDzB4;BG6&%0LLthj7a$sxi@~l<0txEigb=O}W{lcx$_Ku~?oCwT%`m_|C
zAZbB@>Q@^ExRrSb`DF)PESLlXQBEzRXS7D<9QLSJ_boE!=OfBEg3!fs5bN*&g^SNu
zO5hy1&vX~@3r1F#3pY7lCsCe;eqeU%Li7jkQT8i_ge`a*gmFsM^q{n|8^3G6=JEbl
zd2X|B4=J2^s`_;U(ahg?M5?Az<=si{`dqfLtJIQ;k>D_KCi~iG3HRJj3Wx1~cqGTY
zuhWb8(e?TH;qr;?Jp3tJHq@3GQ$$r%e%^{u%wX3$Y`H@&BgOt3x7T1vCfC%44(xTr
z4vwFvTR9gvi7~8O9yU9U76Eo5?Sqh)U}5@uj`IpZ&+mRa!YGsgaqKK%x+Y~gvB>le
zlS(0jvTtgN#*f1(YpTX96hn3}hb^QM<6x=<3N#)kG$%gn3w^soKIr_-VRY^X0JSKj
z!NIMT`Oxvm8J?gQhs!j)wJcpYMXyS54W>*VDu~NnX_#@xkSVaT`LnXInXvb}@gp}n
zM6NAxN2>0%9|<}C-6d4)<PLE|m$#RE3~h?RNsA(r!!}1Xp;I*rcfPFZ$QQK8A+@FY
zRHaSwGuX#emX-O51qD~nFn_puPS1PQGA?VgM(=*v;<tzYzRk8R>rJ+dUMQ%t=<bX;
zq(FXrfCe{~+R^J{`{9nSQH8QA0q?Et{WRx0P0epvXs)4+SJktEu?pSMwVp=P;7*7g
z1W+@A6BKx-i_^v4oM-GyX|9Ln1aFsHd2vWRKxQP1<o&MAT&*FzJ>Fb%_m>eVUA`;t
zXD=If?3}XWva-lhP*$!))S^}V_3I)8QlLP(ZS3q+h7|3-<Vk0rHN@(W>5^W}JT!ss
zNWiiJaA;<<6x=!Hv=37Hyj*OjDfx}L3cQVt#25LjGU*LBxg7E=@YcL8bX(S%vO<-A
z$*y3p2XUX->B3yBvNJt3+e%l+r~QJ)m*pxlvrOJYp0!&+h$UzOfNQ977H8?maBz0t
zmi4=MSyk&q2BctW{#7(d*4uau|Ljt!OtyD}vkR`o*@FChSLUFjYMU|bPzjn>ea(Hq
zlXy@N@G@5cwvKj|gAG8tgpsV00DlZ32)F_xs&|})e)VTF98AzWSGX}o_8R+F3y)de
z+oOqE&W*2%T^)^WYMc{qjHgXP)$j2us=NmK6Rux>MqIW!b6xep(c)YdJqwFZ?{3yB
z60;W<Cqu=1cX-LB`E7Rf&p4EG#88Yyab9n4bjW}<ER`RvS5&++I2+)Cz$60<>+d&K
z03_2rV$nPsVHFv{eM)h8v(3SSEl)9Nv5>0yGP)(<#VmKdQwVR$qqYlSdX%LEPxqDN
z4E=D*1p+4DLpsD1QaZ$_vV!Xgze92phEg>S0M5eEm57Flm{lHNF-*DFJ|{veZRm2+
z#d*6-NZ}B7SIVikoBOvAWH??xE~0bqql}t4g%wl;9<4kPUFR6-7LKyeHe-5woABxs
z&on|PRPnYEvr3_xRrjIw%UCk9*)J)cG-C?R$aCi{T*F5+G8pnW;d54*<<-A>wZHX+
zx&&L)$gvYAhM}Uq2#<#<)B|&9?j}%1c6hiA$DC;9CU#QlAOL?u1ax2+aC*xfrDa9C
zq(3Vk=ZmbpB0>{dDy2tZXHmiEirTGdi<e$cs)m*DM~(WOGaAz{eaZ@9XYE3?0IRt2
z^~?&~e7X4C#I?_j3-v`>wpE#XPFHj~M1BLxq(?ImVXMvEoYZdt{iK>u#Pv(hYnNFL
zI{Vutgh{4}ansXn%Pr0K@7EL-7Vy<8j@F@>bQU)2R-FRv|7W-GTs&a(yXooaGGd`T
zMBPrgDfV}wQA?x61$l|X7V*oo<fYR5&WDA><<@$&w~_@vQiZ<&H(6N~I7NoOk6l%N
z%WlZynHtx0oq8)QKq87ID$|Bl-$Ss<{587C%~!2;4$2DJt}xgiVv{Quv!nHJi$A}?
z{!5DA8-4b77kC^xtq@MBs--)vmQ0!AHeoegedfMII=#gz2!55E%8;ZkmGIaj9g~fx
zfHWljDXpxIu`&TBdf|{j*xxOd%7`qO#!O#aj3+B@%lbK2w#Gw~1E)+V+l_bb^<SCr
zywFWvJo@ZXDGUXGa-QT$e{*6j|5Ewbm$DfM#3d7&1hD<MTr=|0c`&_Ly|kbIDo5Q(
zWkC5}N(rSa>1iO0no@Lv8d&J)FVB9Ny6*l~#8(svOUu#zLHfQ|qy2PK4@!qmc!1}0
zkru<4yokBtW3zx?v38rWNAL0maUxxqy~Q=_LBVojnzE+8zJ6EL-CE+%qXHr7D-l!$
z2Y}Rnhx_SroO!d=o<+0#jaz^{u<)){+__&?@JIIA^c3JwAvA}gZ)_GEs;#$nQg}iI
z&fI}6@w~9J&&KYO=Z{4;IL^soes^M5ArU#k!<FoYg{spNw)zz+=3oblMKc#}=`HL3
z%3Gf{Uai{Lgbq6@ikS`}8H+~>^%ZlrGoqwtvTv_*-J{hwR>o4z&QxwB=1F-LcQQVX
z-yqE8{@Rr7>uGQjStr+59`CT3`YI3IecdIW85lLK<G9cek`Ym#a`RsJ4(E)+kuTAq
z_9Dl-Kg+UUy)JNzlX88bsd3EoeZU1YEZ-itdb{nBj9CAPixWa$@cQ6#V40F2o8~Hg
z4cm%GMD%VBKADvJRfCs-T|ANGXts#=LQVEC<Rx<mk0JJ$Kqy!$R%UvN-^tS8u)23(
z<D?ESP<Rnt==YIJ`=DIVjHrqa&>(XY_o1$u8)e#UgVu-~-=Ty>#`Mr3shV*Q>8yt-
zC2OQ*(=g$=%|<jj(SDDAtHVHQ+&@sAZ(c^BAxtsbfP;kqz!kkzN<4=88UM@a!2bQk
z7}#9IH#EDU(yhfP%#um@)V(mf_rntq3fd~cma703B|?0qOz_)2JR12kT=pt8YQn!#
z>&ZxukXPr_9eh?`uRPl&Wot_t8*Lo`b$e}y>8pb!Yb^)i$rC`^-(uK*>`-IC1xZaX
z@aDH(H}=0jy#-c$0f5HZ4{IMIG#93OjVw2T*RlK^hWfdm(qA4`Tc7ww2%F+49fm~$
z@F)itGXt(CGQg{Sk##<qFJP*9FaO!I%{v}8HSee&1(jpfw45lz>Sp%SW(>?eI$6Yj
zu(b31kyBR)a(?NlXKlZZsy&kwinz0jG6eza6@);8U=Az!!yfY=N#Rke<&-I-P(zf4
z(B)`&`h=n`UdgI&&a*M*o9w8pP~o_U^!r9uD|ES);OIJSiHcPc<UC8(7Z9SYPC*WC
zGS&EiOU6n=3;U20-NcD}w^<j1Fo|`sFD3XIDL^Gz^;K3|n?6}i_W>!`0ylt#a&(D4
zFWOADtH5CwWkQ@szJK3xP;SCA!)uSMV1VWRGg~>BIi!rkosXd;)+LmQM<AJhpVf&}
z4OG<Op`=F0OuRa(25A6hkC{t6?hTeC?38ozNorXW;;rv8ufr%LBd~4PrF4cWX6k8n
zSdl`#1rU9Iiv;z9ogtR?A=JNfglW{*UNV~`aGuuGZx+4aDn;3^#7$6N&4v%COVyC$
zmXicT^3ehYe(l0zd*FXWG2XmO&g*)=PbJQhdLn(V@hW{v=S`?5nW(QyC4lD10QFf!
zEnsf^=4obTl2l0XE)G>#)iBlPer415sKcP=c1mW5dztr@XIXn>{i<`*mBFAqKz)@!
z_+g&Bg!bCaa`3USocoW~oRuSpVk>ga0I@=?HoeGgwg~Da3Cwbk+P0h+^{UUU#i7-S
z-gy13{R$i`Kk;K`AY|5a@mCJ2j-w`6#;*mcA$j}mG7!s}Te>F1CKZJJ6s_gwriiyV
zjHWOutCNX+x%DD%Z))5@5Y+-QCax2Dlp;}DKx*7?4}fkL3DSV(D)sG0%Z4d`U8S_!
zaMqkRB$ffzX$GGlAvF#PibZmc`xVL)UB11%NwlGo%%$~SG~j^myxPYAZS!FcgZNH#
z^CAXe^1+e=vDAfi3H1{~cFU^ogx;%jwrJi$sN!|RGD9sT9!IT!E5hM;2mf7iecS7V
zZAMmq5#4>O@WnBS;aTZ)Wo?sl;J;*Ho384-Yxkk0rBj&o`C909U)9$yp0H?M1tZ25
z_y;d`eEsSe!ZefJDIb|rE~;xo^UbKO-5!2kvZsi$#+8w@4|VFPv=58+cd!5Kfq#)M
zOg12ixk&x4)8ggMd=)sI-Igy`w*|22Me-g>1ph2v$)@B|*a<-cjutOn<&ffL&)fb4
zJy!vqtlK(eL$br1<EZP+H^wI-&l%r*cjln!DY5>8!~%f6tVq>Z46JpU-oICKmp7~7
zCJ@IsQwLCfxm@2YMl-&EPqq23tWFUCbg0Do?t94zW;&{EGC($#3VW0T24N4pwK~8L
z&A?EhO}Gi@j0ap4-|S5|8qz63eWgq|gQBAADc1iLZPF7}?D1U@C|oS5AG9+!-ahmy
ziu14bNAM%b!pvxg3px9dz(5#LGRor7fd^gYW%=&F_IUDW;}@F>2Md*2YtF9chZH7P
zGYZ`?-mJD9oT$BFf^5E&(Kb=(%aik$Jku%r&C3+=G%pFzGw{n185by<ro`eg`!uWK
z-1;D8LN@ODbsMg(t&MBH&Q|0o$gha53lwM7e?$Mag3QodLg1wQGKO~ubH=q=l^P|P
zTYcekkj1UBUD?{e1Pm+1M$5p^uuYg}Zk6ln1Z<73H4FUlKIQZk2aEMW5%X8WzH&;P
z3;TO*%9#wTTD7R&Hl+UWxG}_0&Mc(=iSPKtPS7IFjhX13VFPH!A<Hkt{-|yle*m@q
z;?gePMm2Q<jup)ZKO7LJd=X4$V4#Ya!7~zkZ<;OL@zwI+WcRXg$VEkEsTHE!XN|ei
z`4;1ve<xD*i{m?uXquXHsNyCDqoReg7-m~hit_TaH>uxg!ULZd{G~78c0(-OpE($n
zryzf;I9=h#@@Ozb;^KZqN^)32QWuSGYmad|La?t>#v?~&W%^G(3%yTUEv+$^zWh!I
z50UO+rSRG}*1<wTwHD!>{YUC^b1esb0a;8?^4(F<2LNenZ&cSb31}=HIVrt9x};P-
zZ4KX*zlLY4gjZM56k06D+&9sD*`&mxP-c9<fn&!lqdjYnL2DL#GP&vPczpuVcx1?O
zrWYM*N>VMH>gCb$J&3($1=ToLVHY@6<@{diQ0aYtDU+<lO81uDVr~4)TCU&(Fu?}*
zZH3G%z3E4Q-)Oxn9MUtkxUt3S`)2^JAO?7I2O&@`b4gZ_LiJc#BV}W|@M@TWh}R4X
z?A|LK<AE<CWe^r_IXEAwT7QvOIn>2&WkZy<H0H*Us{5GM5L%x;ew=s>lj2P*yky*i
zM0A~zONPU-W8d<?$moP=E<1f@SAtSGD0$yi7==9QwWkFdPvPq{9I=06<AjpQr(tY3
zo|@zudDFt&JbrL^I1}q>N7@HRxxNkfq>YWW21&yPshKrx|162RucGdUa25sQ5iRk~
zmZ|y2*p#IxM)&p{Dsugl%l%>k)@c>sHHrHA`symA%_XQlVAi`BcM_SyH-Qso$(>Mq
zl$mMTTByBKZekjRxh;K=N8k+tH=h(V&mM{|I0=t(my~%-q@vlca<F99p?$ICDqR<W
zBI_|W>fDD9A67yLWJqX!y+K=!gBS+z6}(5<@w3?Ke6fu`CTe%dJtPi+<#NkgYr*oy
z*EjJl{D;M3Q{#+i_H93Zc~pXLTS`8Z?EL)w0HNGL9Xir_v6R$#F8U;C>@@bds_H0_
zG0`-OxT}4Db<A|otaZO0SOnK55tD+z&lq9tRJ(cGHFC4HoH}^QGE7>l0=9z?3H}1q
zJ4h^uz@0X;w-0~xGIMa9t?y7lAso3f>jpOrAtG$~nv|cE{7N^*Q(M2EFCMm}TQnW?
z(*a}?DKg8~s7lHIB%G)Aqy?l#Y{T})jy(oVy_dXQERrZ6<>RR9IGFvXyF+ys=f)bM
zn=NIS%1U4r5vAfTlGN*2d*dhNv>;*u#=HSmy3{8q+l8hyP^Duu@r}n-q%Aj(pZY^V
z!tuHR$U(9##E9P?=~O*iv5s%=McyN~;(k?9U-gsRLD`Xv-Iu?{#l`IxrF}sP?B{E5
z9G8VtQWV6=mai0$^LyL51(S8XTId)?mb{Y>83?m%6QTK<PT#eH6&4#&gGg=v$X?CG
ze$BT(^?Ap^zHGriSKm06R*#!wqLQusSeWL!a(U*b(oaGfzqh&WlPryJ%g|yRPZgbY
z_8SypfSf*col4I4Gx3aCR`(_BSaaLs^+-GQRcx^24#*vKidW4_G&h&L<!(0@v<@u8
z63ME@sAJGQHFxCi!6WhxpN74zcK#rvPd>&wD6UDF#5pIh{f5eJM>UZcOdAEQ@jB0w
zA~X5baZW~qr&6c5{r!Chy%OCTyb4&(l=$K7tbR8V3p^)}@N4jD$7Iq^oc<6K>A?qy
zCoH2qwB3f4DrQHgr_P2JF<j@hzTPUg5)6F4U82gl>R$JW_@e%8fA#IXt&u%J_!qmC
zrf99sC>L3x&KxwVWd_-;u2}C*sxi0T8vdoFd3kx>YPsF7^r^2NrE_+pzfA4?zU{J<
zON3C1D0ewixT7Oay_U5_DBI~56Drhamy5VFN*|fL=vyCfCA;rg^rT&xn<m58joaUS
zJU}F=?yht5xeZ{8+!Huv=&(sx(=OP@us=}#Tc~_}qD|-O-Cxu<R(5}PE<V@Zb0hTS
z2zOs=(jcc*rRk;m%3{B*zc;VS94?%iy`Wkcic^bCZ>+ze63VZ|350IUmGB-h_3@eU
zLR}Vtwjtp2hYxXY9P@5j<#e8-tWm0*`xSF(BBy-M^j-OqhoA0i7CVjzt@eLDeEFfx
z>b{%;KcmluPhaH~xSjr6Dm2VmiJd5nqYBd$2thVSD_<n23+nSy6uaHy1FWJP22`WR
z#jT9xQsYjF)|cF$(52q$e*32RZA<3#g-%QHbz0GaZx>dvbS)pN(D-sVGN${-_sPOk
ziSCIz+9U3TS>1))Q=2=Qwa$!dT^aw>adWKnX@xQtUq@H}hTD&*EXBXl^WK(-=w-Mu
z5-<VnN49&LAw}2K)m345;)V9%4(3Ld{!e*MW+%m*nE5=fmakN+<w)C~4FuaM?~|+9
z^e^#66Hkvft)+YNJ2vtuHd%JUruh50j>D46q-ugIM*6R)TBY-qZ55_%!9F6<Xj#b-
zY2AD_Hf5}MDSgNw>>&iuM(GK%<q!;_e=!Ps<gc;fx@zs@xx>32gJ1quv8e5rU{EdC
zZByp;xk{d5PEj}=F-=qishpwF={FWZr~hunaG>p4`7%oTIG{(fea7m>a&=4eyDo%2
zA1=sm{*A}>BO@!z9b5^!vYD@mc5R>6>z1<Exkly;`M)ZXN#-2B?D@@=Xjw~(EH@<Q
z#eE5Orj67%u=z)pcoeuX)IrKXYFHd~+1G~TMP`B`U^?7rP?@)sE8l#P?s+?FiGGlu
zPIPXrhC&s6l9|FPhbr7CFi;opw|%5fqwv11(6F;-vyXUULHv&?uc(s0BBQYIOeSOi
zXjC6(W@fI8R87c$$FqLp<>hUc%jdDfW@OCY7%U;#{<Q$HOdw;{gb}@7&Btd&;THxw
zI&2l}DsE$9x19h_mDyts+}N_h>F(xXlHu;^o>y1LPyw%a8`oQ*q?bo)L3J8q@+$?H
zR0gwbJ9y@HcvN$17#*vwoGEe@z2o=m<#0{7K(b1$ST^izFE<2C=JjM(FK0BpI8yo&
zjEYN@^F!|E9W3AjH|+^>MH<}E3i{t9_E*l7o>e5Z1EtmPZWf;1$PE#}WYht_YCFvN
zq|)Y&f+KTACplF0t8K<a3nFXZv6WTC2{xQ7Kfp}f@oKg(x*i{2=+>J3{Bc%Roru%z
z^9J_-zb87<J8p*Xs?_QkFO_0dDj%l?!d*;=uU#ECv?=1+aI>#5`CHxDOOLz4<o2^w
z3tyk-d;IR@E$`luE@p=L8@raQwB7^$31&n4uBb|;NTAlSiGAak%)-X<i<s-0;Z8Y$
z{cu8tzj4)1@3v>tJrSOuY4Ds`<>*@^OSjFoKVQ+G<SQ6-hW7d~sbIXNt@=!)LFlcp
zZ$0Tsn_5;@R+F3lhQt}95|<Ew&7p6P!d+5I@Lj<ua#X=V`&sx@j)O%gIG%xLp($|5
zp7P@Br{6+P-<^^;KTx|E9XQv!o_P2MDvr}>A3&v83)@#`3|c#-QXXKiUjA3%k+IKj
ztYkuX!xlyl4W4C}V*7lVM`yb0QR6gj)ltF)n8{h+ZECu24@Z{wL2`NeTWbz&5hCN4
zbb9)u?sZJ$pe;$zpbb^dDx8{Z%soTD4K~)stxtQ4jzz1^bDdycWzil`dyb<ln>?)#
zO8QV)ik`(E4m)%oBY=m4vG*mjWS<xxXoMr?@S~?sXH7upN371qy;sZGBi^(!uDLPx
z-gTS&^7*Tn^@iGxlLj0Op0_QiuYw6of2@c-#G~BYlb6Bj1WQkvPaPz~jj=B&!Kp_#
zeswK&jc`{>jXN6oDYamEq^ds9J8+4<?h|}hDV6MzDAv6gTs6Ow%f#e<)yeG|n{x-W
za|eWLuAa7H6p59LoZjMw;Wj)1P1!x72TNj8)CBtlhH1_^)x&v@e&jw%pYx?-4`fr{
zwCNW9E_i7T?#GY+_JZqIXZGRhgtWLibR3C@$TAxI{#{3y?Mp~YAd3i%nA&e2S?&ww
zRAThj;bQt&Spz|jliSxr?15kb{^E|`JnL2&0Ydn$GP7L!`jnRYwSJ!=kOI~;j8Rvw
z5k0q>e|O5J^c2D;(XGz6u*AL0)_e&8#C#=O%ehtsOn1*lT^)Y&i)r*X>t-uC0cZiV
zjd0t!bhu!lKAB2RR&-}xn!U$j)&pq%tPi{Qmi3=uAZRT*(latVppk*#vKm}@)kEF+
zW0n<uoB8;TWrPo*sHRZzy?-9Tq}dF6S{63YkHpq95=D95uhpTYkqNnK5ca&80WIh_
zN(Pc~j)Wi|^r#xB>+F`t3K0JrAGfe8)NeWDqOD8z@%@_t03c;L9koSZ!JqCj%(;g@
z!z-cRXJl<kbqKE!i?^xEJTwjre{X-W$u4hXwSNb7Yx(MwZ)kMleuaY#*6F&bRLM92
zWL;nhNET`b5;!6P7lWM4!C{n^%h2-azC4;6A9i$8;vG9Ek#9g6t<SrL80TyJ1<s-w
z%=_*9B1zjIIm*TZ95K8GTBZ~iVooNZK7;*FjD{WU^|#s^i>kE)VCgG^)2OwZG6giV
zKv+2I#4;(Jqmi2rad?K|f+RU?&-GnDIE>J(-F81!VeN_nHfn{z8cZ(3cI=XCfo&LB
zftgz?V;euSl~gQM{cJtmdqo4lRLAE2+hayJsW7q>0K6;!olt^Y+KC$oW8Fa4<K^3Z
z6|B!w<QXuuiL!?DGWsrwF1tWM{$@jeKgLMbA?JmfpWn?aEoCr`?r!mFLg`*6pr?G9
zS(o<OXxFY?%1xGbgnb&-m@h_BnnOwlTdQ4t?%jgz<0Ra55?y+O+RaGJr%u-^7X5&`
zLqM0N=_-O%e-!WJ?6b^eL<Cs-KR<y_mCr;+`dJ%p2^kovt%m5{$AxZ->8Yu#XnIQ6
z>A-;l*GL<$i_K~+Y+sWm_Au^(8{?g2weTtNpuwu%8r3?neVGLd;k}wGk7q!hxr_R0
zUaU?ZuvswzYA&ShO3(q#b2)gyXNe2h3l+yAEgr_56Qh5=b?X*O*g!w{B_hL4$Q|gs
zc8%ZUw&u@FNZD*)B{OsKG$+d714IR~4i%CcbmgIQC^>O+WVQhuhU9jD6&#(Z5UC{{
z(DJkpc3xzs@5HTkf<uEYXi+0r<R4*kZJW^0A4rz)T@yJXj9%|_HkxZu40RG4L|R<Q
z2F`Rq{JJa8Fg_jecVQGRr9TB5HL90u<$%|0#fZROyK!bdxeRqcT~7-ZaGD2#4<G`V
zRs*|1*JUi_C$5`ZV1@b^NJiPUYuC19Oyof{P`6AfO1(A}mWBNm@#_0r{MD-xujl5f
z;R*W_u}pp&I4+1{Y~<vUQOT*t+ZanVw&U=G%GVCtYLaSgegD`&=Zq_Hzn*?Oz2(w*
zk;<1-^X>>e1F7^W$=i}i(|WK+b`3~)AO@G!36C{Vr1v&|{8)g9;_C267G&wM7zn~A
zSd7QGqi0sat=mFYFkY0_fwzf^X7U8I)J=7srk*xa8jU(6{hMm+&qDtUqLu~tn;WjE
zHk~_n?k&4VP~5K)QbGdug!js`8;(Zi6vaAA=K&z`LCw%+Ei3r86%M6Kh;^9e1?Y-L
zE0Y_QnBaWWaQJX`r0R)hSmxVnZ~TI_*Y~qHI0o>#>tTh$eIpXoJo>2FXGNk=)v;I)
z*68<}N1azvjh!?4C#I(C#1v<dFf2whdDg2bfmyF0F@&87thkDphJKCT6?Uc2D=&ul
zXt8%~Na{bZQ!Y9S3a3**B8ot!wTSA)>?zo<v(gJDddZxn)+|B%2CRi{2^d$CF!^Th
za>mrD+8fcWg*G2MJ1Zd>&}!IvH4KDha-=2kZD8P#_}8&H*qiF+p%AKFRX4*LbPNZ4
z1d)yx!iE5FE$&Ndc9vl7>mwMn0n?B5G!r*eJH9s>a7`bP`nJQ^=bYM2ttaTSRO@qf
z)`W}}G~dCNx~TZ1$OXJXF#Br(2l_N|^k2Yg7UwTK8sYI~aDrIa2pcdf;D!}zL#B<v
zmd~uH2*_0ZnnLD#BM|)iqXZ%4&KIr2)ru{6EMk0{FB&ir0SY0-lF1EI98!)rr#6FE
zp4#-y=DqRy5S8xV@t-hqF~DF2B(m%EeSQSoXH%QcX%UCw)j^U!Nqb#|HQWYl=ZEP{
zwY54pVl>$-Qx+W=XHdfO5H&|sMZ_bdQgorad5{IJlc8p}Fdw34h~kwjw0v53MGMQo
zRcZ=WmoOaK#jsB4!eg!&HUGlw>gl6L9!=j)|B=bKM}FfqU^NIk&Xq5@ODbdu0C;Lh
zYy||2@@a&<4|xYMjwMw`Bsm?t=n06I_8TK4Ig|h$x{_T#`(<wWK41fj?g&+3r+Bph
zu(N}<NJv}79;M%;0m<#XZ~kL2t1_S$SXbq`5KZvM+L*eEq0uPB5ovb^b7&){Jd1Wr
zW2$yGK*P#Z^iQe68QgI&e4y0QrPK4aE;OW23^c*uwC(cwAkW0)Oo7I1rf0m&I33p#
zDHzUJ=C1k6j2mMXeCr<)XQToF$Q6%VKWN)1AY&?6F|zu)@iD0yCaN*!0?P^L_fMOd
zMGws`IMQA>5!s6ivxCUXImX3W38TmJygii!6fLZkk4*dtdkb?haGyi1NKpSQ<_uMs
z)~cQxcLt8Lt6}UMlNb|SI%WRnISpNAA}ucb`%B?i&X&`+QT+@L4G%}LsGzZc%T@qk
zbWwjsmVm!~pwx9^8}6=GfOjWAvANvu!^7VgtIw+dKkBer#|^c@zKQE?B}9XYkq(-~
z>TwP!Jl{YcBKNljoDv_g)7ZF0&J2Ol)_kFkwxQ4pbRX0ZMig`fgvV~Y-eq9cx&%uW
z8_TJ82%kCy<cPd;z7?@^F`Gh|`re6#9jvNUBn*r<ODR|-@E*C&dt^lrP;Qxvyk;!L
z8n98g6gJEf1YzA;f{=62H{RT~4f!Fm_Vzsm8m{sSJbatsW{ddlo}GjlllSE?b7t?o
z9G)QQw(vFzZ0p=gk$RnF#gU`-N@i{fG3M|VowMZlsi~6fSjgLBga?<3F_NHx32aNG
zF@S&>3w*HOie#4INbiW}2$GUkMN#ET%B)AeecSvLQUnvJnlT`9od=8+)6tWuT^4_T
zss7;4DJ_~i6S>co_oc+UNL!L+j8l?N?QwVr6oSPIRJ(MKto4XbM`(3lAvUqug|02{
z^mzr@+pEU3meFU!oLhxlrC2X+u;nrRkqbkQ;1FI`du@VhoFQl+ENxkU!e1FC*~iD4
zqn_s~{B<mlPny5>MuxWJ-E2Qmk`nR=Q1au9)PvnO#-A^3&u<Q%5omOw8q*?=VPchB
z$5HQ$<F4TJH!8^z?cO!TT&xkZV=jM>Y$V1@?=djY*GXRNNVmuv4*U{hWXmRr{edij
zjygFx1q}@xK(*{TwKR}1hids^-la~ok%(B`LL3C2KDoK2CE1LU9Ec1G@e`zYo5NP*
zLXJ(e71;>JLa{9tvf+Fz^?Qn+P9-Gj2uW_nX$6k`eyF|0bOXwS48}vht-}?PyjJ2a
z49#CK0cboQDO98cZpt*IG6LZteLhLo-#8Xfzw4>mZy?=)l%x^E`wDB)lh}g~o=b9K
zf&atW#_7SK&GgZAPKPL|OmyKUAy$3mp!q1xp0JYyv`D6n6+@6K*Aivj4;~`n>neaX
zoMv)q)<+^^D5w91Q@k+&9)kzyt1P5WPWYhT*hW;jo{gG=fG1C%Ia2}fFjppy+6fP5
zo==7T&N|6i;gcW9FB)6rY5xWa`cvI3A7q_7HljgwLD9Y(e-lAjk3hld#&P2QyGBMQ
zhFK4z?ND%}RwU-wgao_Pww@4Jl62oFdK2*lW=t9ajfQyX92kXW&}f&EedX4XvVH9U
zLVSqmi%dVm@o{osKjM=F%E<t{es15J5s3L<8LRq06>8oeKYl2{0;Y4U3{!?C;E=|0
zjOu(daQW}{YR<}~>1-wG(b#wTPJx04ajJ9)l4pJZnqJPr7T@!ENu4{Bo|d?s2?f#@
zRGqsjH#oeC^WNX=@htNJ#0Kr;=a=ra7c*_%PCOw;_23r3fEzyEr;Hz8ei<uc$Itfq
zB6;Hc0gj)MInsekWo(00zdl8Z<I|Fo-yzQHypSh)^yRMF8{8CDn#tMmb1<R*RwwTJ
zV=ZLbp+A1)U_W9g%Fea(5)>rirNP~94#q*l-@o4)DH*Oq`F09zdnMcyl6BlWv?N%x
zlQh@ayRPiw;s3KGsr?YLojct|@Z!t`<M!=p=|k}oFUSaHk2CIsck9%=c-jXI>f`;J
zFtrz?2NM;}ku!;LCnMr}RJ>OZQD6e2s1C;Tm)WDp!D0pWNuQa%gvDFnHe(dDUHbR-
zdwT|;bfq#1N6etO+ll-o7-jij0un8-_bjF>=LpnDw2g9!f8BE_{_B|4={d_m8K$ln
zBk^y{9-DFaP87^fGDgnhqS}wD&CCM^azqLQ^JpY*3U7e{&Hkn;yqZ4d;I1HDPwN>J
z0_=1RP;D_(h19nSpBcix+tNM&U=PS@J~y#2J0ejK<izyD2@^x~m!z`xBmTwrE>HnA
zz!tMHHAwx9QoQQI2cAat&I#+OJ?R<RJc8|S@`iI{!HunFGt0s43{AXs>ni|@WHDC#
zQ(&6CpuP&k{_j5p@wK9U>$Y%m|Nqm?l=p@3`cpncXqXyo2k#tNVY5b1_DD%9qCIIC
z>sUszG8W;(#TkS@DUSP9PuX}e3`RD^MjVX~3zUc;cuViKb(#0mNe;xu9w65@LnvJ%
zX&8Zf!H63KtUkn3cclLE<;yQ9<BMU=&*FZ87UDpCwJUre8|J(7+jz83pK)^PcOiJA
z>$v$Q`1cl3j~A;RZ>M~4uxJ)7Tq^aux;J{=fml!*&a&yN>~bj=q~{ofjX+<r#KRt&
zpefES83ev+fCYVPbXrMXkP~hhN9Fo%8iZ{l0M?$30Ix-qmK0AFmq~NIN)31+Oalv?
zoQo@kmvDYP`AkT9%SYiRrL=VRQEjOjo)F#*m<Nx5FGFs=2r4;wnl|C8liaz3VzV`1
z5=I+C`Wvxubz@&X!kigx(Zb`nEg7K2!N8-_tGyO-UmaTrmKw>;cS8(Rcwc>P3Nx7I
zj$T%sjDHF}%V5a~3p8Acu5PQg{QSq!f`cw6FF$AjBPf@~TJ$MD4Z{4ds3zj8*%3i7
z7I2JfJ_m7MmV#yeqpW-P^cN<w0#_-gr8@6?49)9V;5zJ9@de$DMiMp$%d+k{+*Wrn
ze>O79j`QEmw!&{_Y+F5>9=O7gmEJ_t-g3G001F*T7Ma$<3?g0mxDQP6PyQ`+AF0iq
zzsN~g^&pQhTfHh2)~yg*Y}oBG-*&Yx`;y||4w9J!Y6Fg<pJ2HiyRjy?{tl>Lbzbdg
z*zcm7ax0$W53kWNetd0ys&nyrcA^e|k+VuMrVkHneCDt&Ru1~LPPWm<sOvn@KrJEw
zi3&~@^wRKXO^t|OILClU@+!8c2S7(C(j|FdXjS}!@U6a`;9#~gru;=1hXDr+erl{w
zy-~jw*32@!2Q}Y&ZPjBEFgD3Ko1(F7i_vGDwn3|Um(mN2RoU9J9Wf^>+M^Q49<=Di
ztrm2gaI(JuF&O4oKfZl?CQeT#v0_P;?4BBim$@efJ`Ba;uSyb;IqeQs%teX;qoF?9
zpSK%k@o?*fR#Z+GbWc_mOhxaHiedf~Q^<X=d8mD=`Fm!uPGNlA<nRXLY9<XV7j3r6
zrlxQCU|x<32Q@%Q{!C+Haxx$%KmRl-X|%v~1P;J<16-L3!F7RoottYrCZ;`?(_GJf
zikIlkSVFIM6CGY;{Q5jO9B5VOUhjL>v6FGccdRvj+)n`O+4nIBlXtNwF2yEkw=x)3
zjE^6^QdGY_M#VUTn;eDWc^CS(;8BfWy#AZi7CcCR8CAE^im1n%@bbTM%=0IP>yN4(
zAau~Zm;(4!4O%uhIEY9?EfQ@WPi;CjINckq;okqVHF9Wa+esXo*n3(_t@CqP*_!K`
zVNq7OWDgp%K-7jk1C94bAT-rNUI!2P9^qMDvO+`8|BvZRr0QMg;yoxRZtDgvJjG`_
z`3-KrgQ>D;ix-HQvv#;CEu?2s)BT%ud~AKb=^rA?cYApJ@3#sw3;<qANyofAdK>+M
z&e@@Y7TXUD#-IpIJiM-V0x-@!5_@}#@#D!5eILM)U6P6A5g2^@xoTlw7AaO__ZSFo
z?5!1bclCi+O%p7got!f?EaN9OXH1;J@9%Gb4TVYm55BW2okq+_Q1s7-w+phpK>(uu
zCVVaMW2YHtR(R0v@)LuY1uw{kOgo_fe@r|=pF!@*+$UZ*j;Q_j@eZyPZ<Z?&@9?R>
z&$wGv@Ja|Yp{Rohp^65w5<p)X3C{OU^oec$+i`^RzfTsjGtnW~8nS{N|4q`+=e;Dy
zdhAtiKru0q^E!*DjSFzmv5V6I2~)a9GI8kRzmtndH|1Lz?n#}1*Ab2O<%&i}tIz0j
z_6Ate`$sqbUdkwJkb|scAIQXq?Cf;m$8%hY^{2OMp+;{+B54u?d#Y_InLQ*Kc5Z4l
zaSh>a6@PoRH-IQGf-S~okCoNzM*w@UNF9QN-5koj+QIhP(A6DBx6<6V{<~a+8FDXr
zbE@Ni*unUFRVRZn>n6>QV}{h}w{O8>X{w&cS!!h`kyw~}C8y|LV<U8Wod1Bocxo-=
zOX^Q7HsRy@(mpJWcWBqaoeM-^D-q@4?<&oY%MAA1iPfbw^Ci~kJj;)Eu%T=2u%1~m
zi~#_-ZiN|XqzD3)<TH<MgUzV>9un3kQ4-rivK#KkkU{$jkUY_eappd6k0G&<Y%boX
z?nEq7(=9Z6!I&)!k6<J+`V^yO#2!{9={zXEqRLh)e5hG($D;x^KJJBNH(j#N_;de;
zPLfPc&Riy((M#%aYM8$69}^*-d28uta9rretETJ!^`?{QpT~s$*1F}5X4F0h#-sy4
zG8y~=11w_SX^+YEm{j%IORi#Nilb&LL|EmVW!8;H2TeYta)(Qibwc<>fjb{I6-ju|
znO5$U)73`d&<QCdfSw=8R`C-WwAV!!BqingC{i_Z<ecsUGPk~rD&6=J875hiI297j
z+@-N=t96O91pcEK*(Yd$3JEI`14F|la9_H#&vdhcOjK9<6|!ge^Q%i)$mc_zhlz<3
z0GdXZN&kL_zgl5TX#!Kk3sWoD(*<!{pzn~I+GjjJL+a`Ymh%&~D=P(y1da4Zcl6$k
z2=432XWUXc=MMy^_(yL2XoTGyGu2oOWBy_=07uC)k4I~i9yXJk!5CCB{of1O$~d?w
z@gt#vM^uVx^BE)#$<q~qM=|cY4lh?J%1zZvA-wOW{2{VL;7gkq-gYxK`-QoF-4S)0
znh2{W0By35HLVk-u?6?Y(z!1XAc(5CnVIom<78_RdWfpRDi!n-HWglHqi-W6gGz0_
zBjwJ=k5^#;MDzQ$%g$g^;tNa`M)Q*AT|MU189MOu_~*ST{UaqKSK65&OLbT&eMJ4c
zD~`I|MZ48NF$6a4E3I45IVxa!`Vd~f;y;$;g&Ccn*wCOAj4!<$M3)!Kl*@wP)BD%M
zJ7@kvD8k0#%w=hUC(0+x+X7~Xrhm6oMpe%BDNonwE--aYc_Li5cVF^vLF9+35Ol8=
zo6v{J0e?x%w$^zx?bhh-@Euvg*L`1NUKT!85vcoDb1(zR<*S@+AK7DL!=0h-*I9>&
zqAD;A(A@t@)NrrGOseQv;ucXlMwEXZxNEett1BxJ2nV6HIP&{j3l-sG8`RT$>|tf4
z-PWjB(69nCVXL+^_T@O5u;H5qBg}iBj=E%(Uy4vF;Q$Yr?xZ_w0mrbO?of%^wF%Z2
zP&xHLK*~yJ!T8J@`_oU5M`*C2nZ~1vCci`AbhX4NoKw2bR?e>49xZ-_{6j>E*90!k
z+MyF-TWRN~iq_^QJd~M0jDC)2iBtF$CsZ>n<(8xgnrB*vgWlBjZX3@Fe5J#Y=i}NM
zeSH7#Tv?4#GRVGRD3KOdM%S7B@|Q5+5ET|%?MlE!iu0lYlvklRS^{ppaa3;0TifYl
zzyV~Z_tE_*1Al*QuxkhcV8XiQOq&S2Rb4nTVf>KoCTc7P%24lR`Aj-~FCQxtdGWXx
zLgd98>HOjYfu-x>N?ZC(r=)PW(=!9OfSRTi%#_imcJrKe3%?S``Q|nkZYkDZGg=Gd
z4|NZtKSSUg#mh^b9I~Fs>Cm5(1t$4tw>F||2p6T<F1^s@M9JsWD^gvj91`Tlc<(9p
zIPMzNxPEFr0AyD(bZgCP0~m;T?zI;z7WeKtKMg;q3-_b8aJsZ)zCdht_Q^iuxP$~6
zG^w~C!qzU96#3TRTL9HPY$4RKxG>d=<F^{NK1}v1&Y6!N>-+d@-sIlF)#627a<y<U
zh(*i*#jaA10OTwF_8`#%ahY9!+n#@Wm>dPf@JK}XyVk<qc$a_PXmKwrR7JLIVR{16
z3AN#a0YT>?Ez+lwdK^O)VFFpTa@?is1Jeo%g*4hcs@EPKoZPC!zeaj|a<T`pTD8c*
z3YO$xE2X)&74!Y{7K0FS96QOmfqN>o^g=gYKI2`x?!_749S=I+b*`r-9Mre<WPZ_w
zFcr9Q{{W{K8c7yDZc|s-XnME#jlDTk8K8}^{iS-PQZ8r{1Wr`UI1UR{u>5z(mb<li
z_g+b4()w#*hL6C#6$kz5FS;jXqalZ9HiA*nbT~1kGuv-}`*TR<`x*bm`6(J+phu4%
zKR<BL=Azub2X~8#RvxtRS^@g%?@L|g987Y3U9+?t;V=&4$Itz)Q$1|XX7^ce;4Q~&
z+`j%yoH+5o<mLtPlO-j8$(yIsA*N_-Y&?%>n^QsMcmD6%+QUrNtp+YrJol@<fVbxu
z0o+c2cneWrPNAC&MrGlDKi{fQEM%bPas{z-+(r`q8!;&HZ1b#RB9eT*ij<)Mw_^R9
zuGcb(j8-wP4|{{3PedqJaAc@kw=6+djOFXi1l$Ai`C9w>Da@&|1Ln_>x4bp~m_TN6
z52qL$Ws66vmSNfCH}5gN_v8sDwsQiZDZ#kjv6I$}aNsI`4(L_}x8dMn%<?Y(dq!h7
znt{wO5wDdiF{(nKQ1ZVT*5T=SC60e~xKx?^DL{&t3A`RKNLvmBjuZSiiQlucd(F)^
zO((HS`0<h(=pTZ|^NgYn67%3Oz4RdNLL5K%D4Kn7`$z^w%G0OIU=0}d;)v!bodv!$
ze|DU&iSFAS9M*P>B~9tcEy++PcVBYznjZ;V6jJPQWt8<Q8T@nYf2tM!%a#xCPvmI0
zw%UjA^3%6I30FVvv(Q?nbLr1s{kf&$67oRWPSz`WH~4l0?@}%oB>%(D40r!!q~mv2
zWH$zhHA`h~2l4oIv3LXN%Rcgg)7rcH;th2dA;9X)CP`W%<nFvv=1vGKF8Kc3%nYm0
zEWbW^*!?k!)%{sl?t!xm6f@fn99Xejvy0Fgf45CmS-I}TN;|FA_S<d}|JX+g(?(>;
zp6lK{CcLH_a7y`>Xl{Kyre*Cv@zEQR-J|18X1!%&Z>wc=elCra&=sc|YyGSdAm5AB
zIF(wYpz|%_3?g?7P{eMZd?i;rkP^W*Hs&t@c|`T%!pLF|kPag!Cz+_tUxi^ckdm3X
zJgOHf4n6E#&&o>rM2lVYK|B8y7}?=CoE|XJy}UYFi=Xf=99{L_*@Fqy-mc?}O>Z@O
zxo&&bidea7)OIx`FN}9BF8+)T3<~4LGfPwU|HeIIsMu{R_hrl{Qe6A5<k`0VOYKEe
zPD)6)fJ~2z-Rx)4!m%}uTciG6bi#~n7bJzP4}ONG_rw+sW<ky+7@=@LRwgMuU7=fS
z3d%utdds#F*}t1DacUC6t`p|QZmPkWeB8rZjRpGZ&v5<M;1q^Zo~!b?@yS}nFOj|w
zcT$BAGT_Se<mSrvGa6Z<BAmKR3jFY{bImViwx^U`VrVc_t%Ltp$AQJhtx>!AR>o|w
z#GK?h)7xR_gq&*f36Iam9+I|W!T>t$OWZ`ZzUh5>mixcw_rp#0dy0*PML3o?Uz6c;
znDD>J&dO^K-umI6=B1T!L)FoPYa%hN$#Ucpe@-_!3HYaYyy7-Up=pVHN_tU%*~<U^
zaA?hcKRhz$4oOh@_X=bG+gdPF|G&1bw$-$!3k;e6{Q$<!|GF1p+SdPGZotzr|Mg<%
zkpKT*^8fyJ`PNBGGhx=iAvJm0v-QMw%AaG3DJX{eK56~3e^+15Sq14|7kM9KW$}Om
zN)cRQ>8fl*;WfCMmluml=I4F@4^0HX^fR-D_Cv#~)c)DI-hv#lk#xSF{eW%!3%Q5;
z&752lyORh~y=0X;b%f-}VN8xRI8K^HyjpD;n3Q%dKx-N&a<=~WOnvJx3~97fhTrB7
zPi(EfgIJdDA<gWQl!SaEmP+9lL?GpYC*QMo`!`K6hIlZ{E^t{9)Gls4c3<qDi`fd1
z3;HZL(J>+-RWqqi$SIq}zJ06LnI$R2QGH7yU03oO+{JgqsgsW@%7gI!TS+FV-vutO
zGm(~H%L&<5$7%<Lz*dL<t=t?N3UQYdw7Rx<Et<)xt8*};?yvijTMn*1uK|XYft*r0
zr{*VGbc09FwF>lg%U}85a-NKe2ZoGR10C54NI0O5QmNffv_^+*WN-Cdp-<V)k%Q>=
z+at5P+!3qu^uAl`w)0;3r~Y{te2qla!mn!%rsq9?r!P3r?K+e3<prcqQbPkYFds+L
zWHbAY_59OOxjL!;W7+9jBIY_JyQR}TVta3qq0~RGCcZk_+!Q>|-aF;{rDN_wFvDDA
v{?B{<@B91ji}>$r`_Hxff8qa5#?LOw9Dd>alzx_vz&|?;O(~fM_80yikV~0E

literal 0
HcmV?d00001


From 098d094abbe3358813172b1fbc492f0100a39601 Mon Sep 17 00:00:00 2001
From: Jack Hickey <133868041+nginx-jack@users.noreply.github.com>
Date: Wed, 18 Jun 2025 11:17:08 +0100
Subject: [PATCH 030/117] feat: Remove external NGINX Ingress Controller
 sitemap ref (#699)

---
 static/sitemap_index.xml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/static/sitemap_index.xml b/static/sitemap_index.xml
index dbc662e09..280c60c8a 100644
--- a/static/sitemap_index.xml
+++ b/static/sitemap_index.xml
@@ -3,9 +3,6 @@
     <sitemap>
       <loc>https://docs.nginx.com/sitemap.xml</loc>
     </sitemap>
-    <sitemap>
-      <loc>https://docs.nginx.com/nginx-ingress-controller/sitemap.xml</loc>
-    </sitemap>
     <sitemap>
       <loc>https://unit.nginx.org/sitemap.xml</loc>
     </sitemap>

From b9222e58922dbf7ef8143a141adc48aa0ddbb391 Mon Sep 17 00:00:00 2001
From: Chetan Jain <46200286+Chetan-99@users.noreply.github.com>
Date: Wed, 18 Jun 2025 20:22:23 +0530
Subject: [PATCH 031/117] fix: Updated nim k8s docs deploy-using-helm.md (#698)

* fix: Updated nim k8s docs deploy-using-helm.md

* fix: nim k8s docs helm chart update

* fix: minor change

---------

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>
---
 .../nms-chart-supported-module-versions.md    | 65 ++++++++++---------
 .../deploy/kubernetes/deploy-using-helm.md    | 10 +--
 2 files changed, 38 insertions(+), 37 deletions(-)

diff --git a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
index 21811f7d4..9305de473 100644
--- a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
+++ b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
@@ -4,37 +4,38 @@ docs: DOCS-1324
 
 {{<bootstrap-table "table table-striped table-bordered">}}
 
-| NGINX Instance Manager chart | Instance Manager |
-|------------------------------|------------------|
-| 2.0.0                        | 2.20.0           |
-| 1.15.0                       | 2.18.0           |
-| 1.14.4                       | 2.17.4           |
-| 1.14.0                       | 2.17.0           |
-| 1.13.0                       | 2.16.0           |
-| 1.12.1                       | 2.15.1           |
-| 1.12.0                       | 2.15.0           |
-| 1.11.0                       | 2.14.0           |
-| 1.10.1                       | 2.13.1           |
-| 1.10.0                       | 2.13.1           |
-| 1.9.0                        | 2.13.0           |
-| 1.8.2                        | 2.12.0           |
-| 1.8.1                        | 2.12.0           |
-| 1.8.0                        | 2.12.0           |
-| 1.7.2                        | 2.11.0           |
-| 1.7.1                        | 2.11.0           |
-| 1.7.0                        | 2.11.0           |
-| 1.6.0                        | 2.10.1           |
-| 1.5.2                        | 2.10.0           |
-| 1.5.1                        | 2.10.0           |
-| 1.5.0                        | 2.10.0           |
-| 1.4.0                        | 2.9.1            |
-| 1.3.1                        | 2.9.0            |
-| 1.3.0                        | 2.9.0            |
-| 1.2.1                        | 2.8.0            |
-| 1.2.0                        | 2.8.0            |
-| 1.1.2                        | 2.7.0            |
-| 1.1.1                        | 2.7.0            |
-| 1.1.0                        | 2.7.0            |
-| 1.0.0                        | 2.6.0            |
+| NGINX Instance Manager chart | Chart                      | Instance Manager |
+|------------------------------|----------------------------|------------------|
+| 2.0.0                        | nginx-stable/nim           | 2.20.0           |
+| 2.19.0                       | nginx-stable/nms-hybrid    | 2.20.0           |
+| 1.15.0                       | ngnx-stable/nms            | 2.18.0           |
+| 1.14.4                       | ngnx-stable/nms            | 2.17.4           |
+| 1.14.0                       | ngnx-stable/nms            | 2.17.0           |
+| 1.13.0                       | ngnx-stable/nms            | 2.16.0           |
+| 1.12.1                       | ngnx-stable/nms            | 2.15.1           |
+| 1.12.0                       | ngnx-stable/nms            | 2.15.0           |
+| 1.11.0                       | ngnx-stable/nms            | 2.14.0           |
+| 1.10.1                       | ngnx-stable/nms            | 2.13.1           |
+| 1.10.0                       | ngnx-stable/nms            | 2.13.1           |
+| 1.9.0                        | ngnx-stable/nms            | 2.13.0           |
+| 1.8.2                        | ngnx-stable/nms            | 2.12.0           |
+| 1.8.1                        | ngnx-stable/nms            | 2.12.0           |
+| 1.8.0                        | ngnx-stable/nms            | 2.12.0           |
+| 1.7.2                        | ngnx-stable/nms            | 2.11.0           |
+| 1.7.1                        | ngnx-stable/nms            | 2.11.0           |
+| 1.7.0                        | ngnx-stable/nms            | 2.11.0           |
+| 1.6.0                        | ngnx-stable/nms            | 2.10.1           |
+| 1.5.2                        | ngnx-stable/nms            | 2.10.0           |
+| 1.5.1                        | ngnx-stable/nms            | 2.10.0           |
+| 1.5.0                        | ngnx-stable/nms            | 2.10.0           |
+| 1.4.0                        | ngnx-stable/nms            | 2.9.1            |
+| 1.3.1                        | ngnx-stable/nms            | 2.9.0            |
+| 1.3.0                        | ngnx-stable/nms            | 2.9.0            |
+| 1.2.1                        | ngnx-stable/nms            | 2.8.0            |
+| 1.2.0                        | ngnx-stable/nms            | 2.8.0            |
+| 1.1.2                        | ngnx-stable/nms            | 2.7.0            |
+| 1.1.1                        | ngnx-stable/nms            | 2.7.0            |
+| 1.1.0                        | ngnx-stable/nms            | 2.7.0            |
+| 1.0.0                        | ngnx-stable/nms            | 2.6.0            |
 
 {{</bootstrap-table>}}
diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md
index cfb7e23e3..897d35e9a 100644
--- a/content/nim/deploy/kubernetes/deploy-using-helm.md
+++ b/content/nim/deploy/kubernetes/deploy-using-helm.md
@@ -213,7 +213,7 @@ helm install nim nginx-stable/nim \
 
 - Replace `<your-password>` with your preferred admin password.
 - Replace `<your-values.yaml>` with the path to your customized values.yaml file.
-- Replace `<chart-version>` with the version you want to install (for example, `2.20.0`).
+- Replace `<chart-version>` with the version you want to install (for example, `2.0.0`).
 
 **Note:** You can set the ClickHouse mode at install time instead of editing `values.yaml`:
 
@@ -269,13 +269,13 @@ helm upgrade nim nginx-stable/nim \
   -n nim \
   --set adminPasswordHash=$(openssl passwd -6 '<your-password>') \
   -f <path-to-your-values.yaml> \
-  --version <nim-version> \
+  --version <chart-version> \
   --wait
 ```
 
-- Replace `<your-password>` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
-- Replace `<path-to-your-values.yaml>` with the full path to your configuration file.
-- Replace `<nim-version>` with the version of NGINX Instance Manager you want to upgrade to.
+- Replace `<your-password>` with your preferred admin password.
+- Replace `<your-values.yaml>` with the path to your customized values.yaml file.
+- Replace `<chart-version>` with the version you want to install (for example, `2.0.0`).
 
 
 {{< call-out "important" "Save the password!" >}}

From 0777bbe5efd6a1537b8f6af5824cb77c4d6c4121 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Wed, 18 Jun 2025 15:55:48 +0100
Subject: [PATCH 032/117] fix: broken link fixed in Nplus install docker guide
 (#701)

Fixes a broken link caused by a recent change in the NGINX One console docs
---
 .../admin-guide/installing-nginx/installing-nginx-docker.md     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
index 503f4eb27..2c9f4ce58 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
@@ -221,7 +221,7 @@ sudo docker run \
 ```
 
 To start the Docker container with NGINX Plus and NGINX Agent,
-you will need to additionally pass the NGINX One data plane key as the `NGINX_AGENT_SERVER_TOKEN` environment variable. For more information, see [Create and manage data plane keys](https://docs.nginx.com/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys/):
+you will need to additionally pass the NGINX One data plane key as the `NGINX_AGENT_SERVER_TOKEN` environment variable. For more information, see [Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}}):
 
 ```sh
 sudo docker run \

From 88f7d75c7e8728cc0d2b549e8bf4a28ed0286455 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 18 Jun 2025 08:20:04 -0700
Subject: [PATCH 033/117] Bump docs-action to 1.0.9 from 1.0.8 in Build
 workflow (#702)

chore: Bump docs-action to 1.0.9 from 1.0.8
---
 .github/workflows/build-push.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index da2534a36..f87e5180f 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -58,7 +58,7 @@ jobs:
 
   call-docs-build-push:
     needs: prod-check-branch
-    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@bc2ae667727ba02b3d70dacee231ce04f7d94344 # v1.0.8
+    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@cc69def33942d819719164723b35b5163d838276 # v1.0.9
     with:
       production_url_path: ""
       preview_url_path: "${{ vars.PREVIEW_URL_PATH }}"

From b39c3792260b9b6ffd4633017f5f38023bfd395d Mon Sep 17 00:00:00 2001
From: Chetan Jain <46200286+Chetan-99@users.noreply.github.com>
Date: Wed, 18 Jun 2025 21:39:27 +0530
Subject: [PATCH 034/117] fix: Update nim versions
 nms-chart-supported-module-versions.md (#703)

Update nms-chart-supported-module-versions.md
---
 .../nim/kubernetes/nms-chart-supported-module-versions.md     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
index 9305de473..a23ff1c6e 100644
--- a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
+++ b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
@@ -7,7 +7,9 @@ docs: DOCS-1324
 | NGINX Instance Manager chart | Chart                      | Instance Manager |
 |------------------------------|----------------------------|------------------|
 | 2.0.0                        | nginx-stable/nim           | 2.20.0           |
-| 2.19.0                       | nginx-stable/nms-hybrid    | 2.20.0           |
+| 2.19.2                       | nginx-stable/nms-hybrid    | 2.19.2           |
+| 2.19.1                       | nginx-stable/nms-hybrid    | 2.19.1           |
+| 2.19.0                       | nginx-stable/nms-hybrid    | 2.19.0           |
 | 1.15.0                       | ngnx-stable/nms            | 2.18.0           |
 | 1.14.4                       | ngnx-stable/nms            | 2.17.4           |
 | 1.14.0                       | ngnx-stable/nms            | 2.17.0           |

From a6b8379c7057193f15a7b0334af86ddeed5327eb Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Thu, 19 Jun 2025 14:38:41 +0100
Subject: [PATCH 035/117] feat: Remove redundant link checker in GitHub
 configuration (#705)

This commit removes the defunct check-broken-links workflow
configuration, whose utility (Checking for broken links) was replaced by
linkchecker some time ago.

It also removes an outdated .txt file whose only content referenced the
redundant action. In the future, detail about how the repository is
configured will be available in the /documentation folder.
---
 .github/about.txt                        | 16 ---------------
 .github/workflows/check-broken-links.yml | 25 ------------------------
 2 files changed, 41 deletions(-)
 delete mode 100644 .github/about.txt
 delete mode 100644 .github/workflows/check-broken-links.yml

diff --git a/.github/about.txt b/.github/about.txt
deleted file mode 100644
index d556164ce..000000000
--- a/.github/about.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-# GitHub Configurations
-
-This directory contains settings used by GitHub for Actions, identifying code reviewers, issue and pull request templates, and more.
-
-## Workflows
-
-### check-broken-links
-
-The check-broken-links workflow relies on the following projects:
-
-- https://github.com/BoundfoxStudios/action-hugo-link-check
-- https://github.com/fenneclab/hugo-bin/releases
-
-The hugo-bin project lets you add Hugo as a dependency in your npm package.json file. The action-hugo-link-check Action requires this, as that is how it identifies which version of Hugo to run to build your docs. 
-
-> Note: The release version numbers in the hugo-bin project do not align with the actual Hugo releases. Check the README and versions in the hugo-bin repo to find out which releases correspond to Hugo releases.
diff --git a/.github/workflows/check-broken-links.yml b/.github/workflows/check-broken-links.yml
deleted file mode 100644
index 3a9bbdfbb..000000000
--- a/.github/workflows/check-broken-links.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Check for Broken Links
-# Generates the Hugo production site and checks for broken links
-on:
-  workflow_dispatch:
-  # Run on pull requests with changed md files
-  # pull_request:
-  #   paths:
-  #   - 'content/**.md'
-
-jobs:
-  check-broken-links:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: BoundfoxStudios/action-hugo-link-check@v2.0.3
-        with:
-          hugo-root: ./
-          hugo-content-dir: ./content
-          hugo-config: ./config/production/config.yaml
-          skip: github\.com\/nginxinc\/docs\/(tree|edit|new|issues\/new),twitter\.com\/nginx,linkedin\.com,facebook\.com,.*\/nginx-ingress-controller\/,.*\/nginxaas\/azure\/,.*\/nginx-amplify\/,.*\/nginx-agent\/,www\.nginx\.com,nginx\.com,www\.mywebsite\.com,example\.com
-          hugo-startup-wait-time: 60
-
-

From ccd9f67696db2917796a38f3dbc3ceb7525fea4d Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Thu, 19 Jun 2025 17:17:33 +0100
Subject: [PATCH 036/117] docs: AMP catalog audit (#710)

---
 content/amplify/changelog.md    | 5 +++--
 content/amplify/known-issues.md | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/content/amplify/changelog.md b/content/amplify/changelog.md
index 6024dcfad..d965086f0 100644
--- a/content/amplify/changelog.md
+++ b/content/amplify/changelog.md
@@ -1,8 +1,9 @@
 ---
-title: "Changelog"
-description: "These release notes list and describe the new features, enhancements, and resolved issues in F5 NGINX Amplify"
+title: Changelog
+description: These release notes list and describe the new features, enhancements, and resolved issues in F5 NGINX Amplify
 weight: 900
 toc: true
+docs: DOCS-1691
 ---
 
 ## Sept 21, 2023
diff --git a/content/amplify/known-issues.md b/content/amplify/known-issues.md
index 667f24065..bf5ea989c 100644
--- a/content/amplify/known-issues.md
+++ b/content/amplify/known-issues.md
@@ -3,6 +3,7 @@ title: Known Issues
 weight: 1000
 description: List of known issues in the latest release of F5 NGINX Amplify
 toc: true
+docs: DOCS-1692
 ---
 
 {{<rn-styles>}}

From f034e2e39c7b32b388aceb62b89d8d3ec9b48655 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Thu, 19 Jun 2025 18:58:33 +0100
Subject: [PATCH 037/117] docs: update catalog for NGINX+ (#709)

---
 content/nginx/admin-guide/security-controls/configuring-oidc.md  | 1 +
 .../single-sign-on/active-directory-federation-services.md       | 1 +
 content/nginx/deployment-guides/single-sign-on/auth0.md          | 1 +
 content/nginx/deployment-guides/single-sign-on/cognito.md        | 1 +
 content/nginx/deployment-guides/single-sign-on/entra-id.md       | 1 +
 content/nginx/deployment-guides/single-sign-on/keycloak.md       | 1 +
 content/nginx/deployment-guides/single-sign-on/okta.md           | 1 +
 content/nginx/deployment-guides/single-sign-on/onelogin.md       | 1 +
 content/nginx/deployment-guides/single-sign-on/ping-identity.md  | 1 +
 content/nginx/variables.md                                       | 1 +
 10 files changed, 10 insertions(+)

diff --git a/content/nginx/admin-guide/security-controls/configuring-oidc.md b/content/nginx/admin-guide/security-controls/configuring-oidc.md
index c9b4e2628..1d35bbbdc 100644
--- a/content/nginx/admin-guide/security-controls/configuring-oidc.md
+++ b/content/nginx/admin-guide/security-controls/configuring-oidc.md
@@ -6,6 +6,7 @@ title: Single Sign-On with OpenID Connect and Identity Providers
 toc: true
 weight: 550
 product: NGINX-PLUS
+docs: DOCS-1690
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus using: 
diff --git a/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md b/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md
index ca12c8637..3c1ed62f2 100644
--- a/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md
+++ b/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md
@@ -6,6 +6,7 @@ title: Single Sign-On with Microsoft Active Directory FS
 toc: true
 weight: 300
 product: NGINX-PLUS
+docs: DOCS-1683
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Microsoft Active Directory Federation Services](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) (AD FS) as the Identity Provider (IdP) and NGINX Plus as the Relying Party (RP), or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/auth0.md b/content/nginx/deployment-guides/single-sign-on/auth0.md
index 987092ce1..26eb60921 100644
--- a/content/nginx/deployment-guides/single-sign-on/auth0.md
+++ b/content/nginx/deployment-guides/single-sign-on/auth0.md
@@ -6,6 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On With Auth0
 toc: true
 weight: 100
+docs: DOCS-1686
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Auth0](https://auth0.com/features/single-sign-on) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/cognito.md b/content/nginx/deployment-guides/single-sign-on/cognito.md
index c7d70a5c2..f3dbfaf51 100644
--- a/content/nginx/deployment-guides/single-sign-on/cognito.md
+++ b/content/nginx/deployment-guides/single-sign-on/cognito.md
@@ -6,6 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Amazon Cognito
 toc: true
 weight: 200
+docs: DOCS-1685
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Amazon Cognito](https://aws.amazon.com/cognito/) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/entra-id.md b/content/nginx/deployment-guides/single-sign-on/entra-id.md
index b9f445066..10637062f 100644
--- a/content/nginx/deployment-guides/single-sign-on/entra-id.md
+++ b/content/nginx/deployment-guides/single-sign-on/entra-id.md
@@ -6,6 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Microsoft Entra ID
 toc: true
 weight: 400
+docs: DOCS-1688
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/keycloak.md b/content/nginx/deployment-guides/single-sign-on/keycloak.md
index c62b563ba..3d9e7153c 100644
--- a/content/nginx/deployment-guides/single-sign-on/keycloak.md
+++ b/content/nginx/deployment-guides/single-sign-on/keycloak.md
@@ -6,6 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Keycloak
 toc: true
 weight: 500
+docs: DOCS-1682
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Keycloak](https://www.keycloak.org/) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/okta.md b/content/nginx/deployment-guides/single-sign-on/okta.md
index 9c976326a..2dc975726 100644
--- a/content/nginx/deployment-guides/single-sign-on/okta.md
+++ b/content/nginx/deployment-guides/single-sign-on/okta.md
@@ -6,6 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Okta
 toc: true
 weight: 700
+docs: DOCS-1689
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Okta](https://www.okta.com/) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/onelogin.md b/content/nginx/deployment-guides/single-sign-on/onelogin.md
index 99f323b49..1171890dc 100644
--- a/content/nginx/deployment-guides/single-sign-on/onelogin.md
+++ b/content/nginx/deployment-guides/single-sign-on/onelogin.md
@@ -6,6 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with OneLogin
 toc: true
 weight: 600
+docs: DOCS-1687
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [OneLogin](https://www.onelogin.com/) as the Identity Provider (IdP) and NGINX Plus as the Relying Party (RP), or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/ping-identity.md b/content/nginx/deployment-guides/single-sign-on/ping-identity.md
index 92ed75600..c1bec1101 100644
--- a/content/nginx/deployment-guides/single-sign-on/ping-identity.md
+++ b/content/nginx/deployment-guides/single-sign-on/ping-identity.md
@@ -6,6 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Ping Identity
 toc: true
 weight: 800
+docs: DOCS-1684
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Ping Identity](https://www.pingidentity.com/en.html) (PingFederate or PingOne) as the Identity Provider (IdP), and NGINX Plus as the Relying Party.
diff --git a/content/nginx/variables.md b/content/nginx/variables.md
index ca19e1300..3c68dd448 100644
--- a/content/nginx/variables.md
+++ b/content/nginx/variables.md
@@ -2,6 +2,7 @@
 title: NGINX Variables Index
 url: /nginx/variables
 weight: 800
+docs: DOCS-1681
 ---
 
 <!-- this is dummy doc is used to create a list page entry that redirects users to the variables index in the .org docs. The redirect is configured in azure-redirects-base -->
\ No newline at end of file

From 377f265a661ecdb8e0b1716dc91a66e4771ac55e Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Fri, 20 Jun 2025 14:37:32 +0100
Subject: [PATCH 038/117] feat: Update NGINX Ingress Controller links for
 consistency (#713)

This commit updates all non-uniform NGINX Ingress Controller links to
follow the standardised Hugo ref convention. This involves updating the
paths of every existing ref to add the /nic/ subfolder, excising any
remaining relref uses and removing Markdown-style inline links.

Outside of style uniformity, it means that broken links will now be
detected by Hugo's built-in error mechanisms, making it easier to
maintain link integrity. Many affected files also had small metadata or
formatting changes applied to them.

Co-authored-by: Gabor Javorszky <g.javorszky@f5.com>
---
 .../configmap-resource.md                     |  18 +--
 .../globalconfiguration-resource.md           |   4 +-
 .../reporting-resources-status.md             |  10 +-
 ...advanced-configuration-with-annotations.md |  10 +-
 .../cross-namespace-configuration.md          |   8 +-
 .../ingress-resources/custom-annotations.md   |  12 +-
 content/nic/configuration/policy-resource.md  |  30 ++--
 content/nic/configuration/security.md         |   8 +-
 ...server-and-virtualserverroute-resources.md |  36 ++---
 content/nic/installation/ingress-nginx.md     |  98 ++++++-------
 .../deploy-with-nap-using-helm.md             |   6 +-
 .../installing-nic/installation-with-helm.md  |  12 +-
 .../troubleshoot-app-protect-dos.md           |  11 +-
 .../compile-waf-policies.md                   |  14 +-
 .../app-protect-waf-v5/configuration.md       |   8 +-
 .../troubleshoot-app-protect-waf.md           |   8 +-
 .../integrations/nic-n1-console.md            |   2 +-
 .../nic-images/get-image-using-jwt.md         |  10 +-
 content/nic/logging-and-monitoring/logging.md |  14 +-
 .../nic/logging-and-monitoring/prometheus.md  |   4 +-
 .../logging-and-monitoring/service-insight.md |  12 +-
 .../nic/logging-and-monitoring/status-page.md |  14 +-
 content/nic/overview/controller-comparison.md |  22 +--
 content/nic/overview/design.md                |  36 +----
 content/nic/releases.md                       | 132 ++++++------------
 .../ingress-path-regex-annotation.md          |   8 +-
 content/nic/tutorials/nginx-dynamic-module.md |   8 +-
 content/nic/tutorials/nginx-ingress-istio.md  |  14 +-
 .../nic/tutorials/nginx-ingress-linkerd.md    |   8 +-
 content/nic/tutorials/nginx-ingress-osm.md    |  17 +--
 content/nic/tutorials/security-monitoring.md  |  10 +-
 content/nic/usage-reporting.md                |  16 ++-
 32 files changed, 268 insertions(+), 352 deletions(-)

diff --git a/content/nic/configuration/global-configuration/configmap-resource.md b/content/nic/configuration/global-configuration/configmap-resource.md
index 711ac7065..662c9a4a2 100644
--- a/content/nic/configuration/global-configuration/configmap-resource.md
+++ b/content/nic/configuration/global-configuration/configmap-resource.md
@@ -2,9 +2,9 @@
 title: ConfigMap resources
 weight: 300
 toc: true
-type: how-to
-product: NIC
-docs: DOCS-586
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-586
 ---
 
 When using F5 NGINX Ingress Controller, you can customize or fine tune NGINX behavior using ConfigMap resources. Examples include setting the number of worker processes or customizing the access log format.
@@ -171,7 +171,7 @@ For more information, view the [VirtualServer and VirtualServerRoute resources](
 {{<bootstrap-table "table table-striped table-bordered table-responsive">}}
 |ConfigMap Key | Description | Default | Example |
 | ---| ---| ---| --- |
-|*lb-method* | Sets the [load balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify *"round_robin"*. | *"random two least_conn"* |  |
+|*lb-method* | Sets the [load balancing method]({{< ref "/nginx/admin-guide/load-balancer/http-load-balancer.md#choosing-a-load-balancing-method" >}}). To use the round-robin method, specify *"round_robin"*. | *"random two least_conn"* |  |
 |*max-fails* | Sets the value of the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the *server* directive. | *1* |  |
 |*upstream-zone-size* | Sets the size of the shared memory [zone](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone) for upstreams. For NGINX, the special value 0 disables the shared memory zones. For NGINX Plus, shared memory zones are required and cannot be disabled. The special value 0 will be ignored. | *256k* for NGINX, *512k* for NGINX Plus  |  |
 |*fail-timeout* | Sets the value of the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the *server* directive. | *10s* |  |
@@ -182,7 +182,7 @@ For more information, view the [VirtualServer and VirtualServerRoute resources](
 
 ### Zone Sync
 
-Zone Sync enables the [ngx_stream_zone_sync_module](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html) in NGINX Ingress Controller when NGINX Plus is used.  Multiple replicas are required to effectively utililise this functionality. More information is available in the [How NGINX Plus Performs Zone Synchronization](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync_details/) topic.
+Zone Sync enables the [ngx_stream_zone_sync_module](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html) in NGINX Ingress Controller when NGINX Plus is used.  Multiple replicas are required to effectively utililise this functionality. More information is available in the [How NGINX Plus Performs Zone Synchronization]({{< ref "/nginx/admin-guide/high-availability/zone_sync_details.md" >}}) topic.
 
 Zone synchronization with TLS for NGINX Ingress Controller is not yet available with ConfigMap. If you would like to enable Zone Sync with TLS, please remove `zone-sync` from ConfigMap and add Zone Sync parameters via [`stream-snippets`]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) similar to [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-config.yaml) and adding the [zone_sync_ssl directive](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_ssl) along with any other TLS parameters to the `stream-snippets`. 
 
@@ -217,10 +217,10 @@ If you encounter the error `error [emerg] 13#13: "zone_sync" directive is duplic
 |*location-snippets* | Sets a custom snippet in location context. | N/A |  |
 |*server-snippets* | Sets a custom snippet in server context. | N/A |  |
 |*stream-snippets* | Sets a custom snippet in stream context. | N/A | [Support for TCP/UDP Load Balancing](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/tcp-udp). |
-|*main-template* | Sets the main NGINX configuration template. | By default the template is read from the file in the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
-|*ingress-template* | Sets the NGINX configuration template for an Ingress resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
-|*virtualserver-template* | Sets the NGINX configuration template for an VirtualServer resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
-|*transportserver-template* | Sets the NGINX configuration template for a TransportServer resource. | By default the template is read from the file on the container. | [Custom Templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates). |
+|*main-template* | Sets the main NGINX configuration template. | By default the template is read from the file in the container. | [Custom Templates]({{< ref "/nic/configuration/global-configuration/custom-templates.md" >}}). |
+|*ingress-template* | Sets the NGINX configuration template for an Ingress resource. | By default the template is read from the file on the container. | [Custom Templates]({{< ref "/nic/configuration/global-configuration/custom-templates.md" >}}). |
+|*virtualserver-template* | Sets the NGINX configuration template for an VirtualServer resource. | By default the template is read from the file on the container. | [Custom Templates]({{< ref "/nic/configuration/global-configuration/custom-templates.md" >}}). |
+|*transportserver-template* | Sets the NGINX configuration template for a TransportServer resource. | By default the template is read from the file on the container. | [Custom Templates]({{< ref "/nic/configuration/global-configuration/custom-templates.md" >}}) |
 {{</bootstrap-table>}}
 
 ---
diff --git a/content/nic/configuration/global-configuration/globalconfiguration-resource.md b/content/nic/configuration/global-configuration/globalconfiguration-resource.md
index 84b4e4002..80d05bd55 100644
--- a/content/nic/configuration/global-configuration/globalconfiguration-resource.md
+++ b/content/nic/configuration/global-configuration/globalconfiguration-resource.md
@@ -17,7 +17,7 @@ Listeners are required by [TransportServer resources]({{< ref "/nic/configuratio
 
 ## Prerequisites
 
-When [installing NGINX Ingress Controller using Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), you need to reference a GlobalConfiguration resource in the [`-global-configuration`](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments#cmdoption-global-configuration) command-line argument. NGINX Ingress Controller only needs one GlobalConfiguration resource.
+When [installing NGINX Ingress Controller using Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), you need to reference a GlobalConfiguration resource in the [`-global-configuration`]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-global-configuration" >}}) command-line argument. NGINX Ingress Controller only needs one GlobalConfiguration resource.
 
 ---
 
@@ -71,7 +71,7 @@ The `listeners:` key defines a listener (a combination of a protocol and a port)
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 | *name* | The name of the listener. Must be a valid DNS label as defined in RFC 1035. For example, ``hello`` and ``listener-123`` are valid. The name must be unique among all listeners. The name ``tls-passthrough`` is reserved for the built-in TLS Passthrough listener and cannot be used. | *string* | Yes |
-| *port* | The port of the listener. The port must fall into the range ``1..65535`` with the following exceptions: ``80``, ``443``, the [status port](/nginx-ingress-controller/logging-and-monitoring/status-page), the [Prometheus metrics port](/nginx-ingress-controller/logging-and-monitoring/prometheus). Among all listeners, only a single combination of a port-protocol is allowed. | *int* | Yes |
+| *port* | The port of the listener. The port must fall into the range ``1..65535`` with the following exceptions: ``80``, ``443``, the [status port]({{< ref "/nic/logging-and-monitoring/status-page.md" >}}), the [Prometheus metrics port]({{< ref "/nic/logging-and-monitoring/prometheus.md" >}}). Among all listeners, only a single combination of a port-protocol is allowed. | *int* | Yes |
 | *protocol* | The protocol of the listener. Supported values: ``TCP``, ``UDP`` and ``HTTP``. | *string* | Yes |
 | *ssl* | Configures the listener with SSL. This is currently only supported for ``HTTP`` listeners. Default value is ``false`` | *bool* | No |
 | *ipv4* | Specifies the IPv4 address to listen on. | *string* | No |
diff --git a/content/nic/configuration/global-configuration/reporting-resources-status.md b/content/nic/configuration/global-configuration/reporting-resources-status.md
index 8e36733eb..dc79ea3b2 100644
--- a/content/nic/configuration/global-configuration/reporting-resources-status.md
+++ b/content/nic/configuration/global-configuration/reporting-resources-status.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-589
-doctypes:
-- ''
 title: Reporting resource status
 toc: true
 weight: 600
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-589
 ---
 
 This page describes how to view the status of resources managed by F5 NGINX Ingress Controller.
@@ -30,7 +30,7 @@ NGINX Ingress Controller must be configured to report an Ingress status:
     1. A user defined address, specified in the `external-status-address` ConfigMap key.
     1. A Service of the type LoadBalancer configured with an external IP or address and specified by the `-external-service` command-line flag.
 
-View the [ConfigMap keys](/nginx-ingress-controller/configuration/global-configuration/configmap-resource) and [Command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) topics for more information.
+View the [ConfigMap keys]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) and [Command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) topics for more information.
 
 {{< note >}} NGINX Ingress Controller does not clear the status of Ingress resources when it is being shut down. {{< /note >}}
 
@@ -113,7 +113,7 @@ NGINX Ingress Controller must be configured to report a VirtualServer or Virtual
     1. A user defined address, specified in the `external-status-address` ConfigMap key.
     1. A Service of the type LoadBalancer configured with an external IP or address and specified by the `-external-service` command-line flag.
 
-View the [ConfigMap keys](/nginx-ingress-controller/configuration/global-configuration/configmap-resource) and [Command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) topics for more information.
+View the [ConfigMap keys]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) and [Command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) topics for more information.
 
 {{< note >}} NGINX Ingress Controller does not clear the status of VirtualServer and VirtualServerRoute resources when it is being shut down. {{< /note >}}
 
diff --git a/content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md b/content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
index ee3dbc860..b037f3f82 100644
--- a/content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
+++ b/content/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-591
-doctypes:
-- ''
 title: Advanced configuration with Annotations
 toc: true
 weight: 200
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-591
 ---
 
 This topic explains how to enable advanced features in F5 NGINX Ingress Controller with Annotations.
@@ -157,7 +157,7 @@ The table below summarizes the available annotations.
 {{<bootstrap-table "table table-striped table-bordered table-responsive">}}
 |Annotation | ConfigMap Key | Description | Default | Example |
 | ---| ---| ---| ---| --- |
-| *nginx.org/lb-method* | *lb-method* | Sets the [load balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify ``"round_robin"``. | *"random two least_conn"* |  |
+| *nginx.org/lb-method* | *lb-method* | Sets the [load balancing method]({{< ref "/nginx/admin-guide/load-balancer/http-load-balancer.md#choosing-a-load-balancing-method" >}}). To use the round-robin method, specify ``"round_robin"``. | *"random two least_conn"* |  |
 | *nginx.org/ssl-services* | N/A | Enables HTTPS or gRPC over SSL when connecting to the endpoints of services. | N/A | [ssl-services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/ssl-services) |
 | *nginx.org/grpc-services* | N/A | Enables gRPC for services. Note: requires HTTP/2 (see ``http2* ConfigMap key); only works for Ingresses with TLS termination enabled. | N/A | [grpc-services](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/grpc-services) |
 | *nginx.org/websocket-services* | N/A | Enables WebSocket for services. | N/A | [websocket](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/websocket) |
@@ -170,7 +170,7 @@ The table below summarizes the available annotations.
 | *nginx.com/health-checks* | N/A | Enables active health checks. | *False* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
 | *nginx.com/health-checks-mandatory* | N/A | Configures active health checks as mandatory. | *False* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
 | *nginx.com/health-checks-mandatory-queue* | N/A | When active health checks are mandatory, creates a queue where incoming requests are temporarily stored while NGINX Plus is checking the health of the endpoints after a configuration reload. | *0* | [health-checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks) |
-| *nginx.com/slow-start* | N/A | Sets the upstream server [slow-start period](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#server-slow-start). By default, slow-start is activated after a server becomes [available](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks) or [healthy](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#active-health-checks). To enable slow-start for newly-added servers, configure [mandatory active health checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks). | *"0s"* |  |
+| *nginx.com/slow-start* | N/A | Sets the upstream server [slow-start period]({{< ref "/nginx/admin-guide/load-balancer/http-load-balancer.md#server-slow-start" >}}). By default, slow-start is activated after a server becomes [available]({{< ref "/nginx/admin-guide/load-balancer/http-health-check.md#passive-health-checks" >}}) or [healthy]({{< ref "/nginx/admin-guide/load-balancer/http-health-check.md#active-health-checks" >}}). To enable slow-start for newly-added servers, configure [mandatory active health checks](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/health-checks). | *"0s"* |  |
 | *nginx.org/use-cluster-ip* | N/A | Enables using the Cluster IP and port of the service instead of the default behavior of using the IP and port of the pods. When this field is enabled, the fields that configure NGINX behavior related to multiple upstream servers (like ``lb-method* and ``next-upstream``) will have no effect, as NGINX Ingress Controller will configure NGINX with only one upstream server that will match the service Cluster IP.   | *False* |  |
 {{</bootstrap-table>}}
 
diff --git a/content/nic/configuration/ingress-resources/cross-namespace-configuration.md b/content/nic/configuration/ingress-resources/cross-namespace-configuration.md
index 3e92b6403..8a443b4fd 100644
--- a/content/nic/configuration/ingress-resources/cross-namespace-configuration.md
+++ b/content/nic/configuration/ingress-resources/cross-namespace-configuration.md
@@ -1,14 +1,14 @@
 ---
-docs: DOCS-594
-doctypes:
-- ''
 title: Cross-namespace configuration
 toc: true
 weight: 500
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-594
 ---
 
 This topic explains how to spread Ingress configuration across different namespaces in F5 NGINX Ingress Controller.
 
 You can spread the Ingress configuration for a common host across multiple Ingress resources using Mergeable Ingress resources. Such resources can belong to the *same* or *different* namespaces. This enables easier management when using a large number of paths. See the [Mergeable Ingress Resources](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/mergeable-ingress-types) example in our GitHub repo.
 
-As an alternative to Mergeable Ingress resources, you can use [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) for cross-namespace configuration. See the [Cross-Namespace Configuration](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/cross-namespace-configuration) example in our GitHub repo.
+As an alternative to Mergeable Ingress resources, you can use [VirtualServer and VirtualServerRoute resources]({{< ref "/nic//configuration/virtualserver-and-virtualserverroute-resources.md" >}}) for cross-namespace configuration. See the [Cross-Namespace Configuration](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/cross-namespace-configuration) example in our GitHub repo.
diff --git a/content/nic/configuration/ingress-resources/custom-annotations.md b/content/nic/configuration/ingress-resources/custom-annotations.md
index 8bbd136b0..a7dd3db81 100644
--- a/content/nic/configuration/ingress-resources/custom-annotations.md
+++ b/content/nic/configuration/ingress-resources/custom-annotations.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-595
-doctypes:
-- ''
 title: Custom annotations
 toc: true
 weight: 300
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-595
 ---
 
 This topic explains how you can use custom annotations with F5 NGINX Ingress Controller.
@@ -13,7 +13,7 @@ Custom annotations enable you to quickly extend the Ingress resource to support
 
 ## Overview
 
-NGINX Ingress Controller supports a number of annotations for the Ingress resource that fine tune NGINX configuration (for example, connection timeouts) or enable additional features (for example, JWT validation). The complete list of annotations is available [here](/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations).
+NGINX Ingress Controller supports a number of annotations for the Ingress resource that fine tune NGINX configuration (for example, connection timeouts) or enable additional features (for example, JWT validation). The complete list of annotations is available [here]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md" >}}).
 
 The annotations are provided only for the most common features and use cases, meaning that not every NGINX feature or a customization option is available through the annotations. Additionally, even if an annotation is available, it might not give you the satisfactory level of control of a particular NGINX feature.
 
@@ -72,14 +72,14 @@ Assuming that the Ingress Controller is using that customized template, it will
 
 **Notes**:
 
-- You can customize the template to insert you custom annotations via [custom templates](/nginx-ingress-controller/configuration/global-configuration/custom-templates).
+- You can customize the template to insert you custom annotations via [custom templates]({{< ref "/nic//configuration/global-configuration/custom-templates.md" >}}).
 - The Ingress Controller uses go templates to generate NGINX config. You can read more information about go templates [here](https://golang.org/pkg/text/template/).
 
 See the examples in the next section that use custom annotations to configure NGINX features.
 
 ### Custom Annotations with Mergeable Ingress Resources
 
-A Mergeable Ingress resource consists of multiple Ingress resources - one master and one or several minions. Read more about Mergeable Ingress resources [here](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration).
+A Mergeable Ingress resource consists of multiple Ingress resources - one master and one or several minions. Read more about Mergeable Ingress resources [here]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration.md" >}}).
 
 If you'd like to use custom annotations with Mergeable Ingress resources, please keep the following in mind:
 
diff --git a/content/nic/configuration/policy-resource.md b/content/nic/configuration/policy-resource.md
index 4188188ef..a6c33e3e4 100644
--- a/content/nic/configuration/policy-resource.md
+++ b/content/nic/configuration/policy-resource.md
@@ -2,12 +2,12 @@
 title: Policy resources
 weight: 500
 toc: true
-type: how-to
-product: NIC
-docs: DOCS-596
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-596
 ---
 
-The Policy resource allows you to configure features like access control and rate-limiting, which you can add to your [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/).
+The Policy resource allows you to configure features like access control and rate-limiting, which you can add to your [VirtualServer and VirtualServerRoute resources]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}).
 
 The resource is implemented as a [Custom Resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
 
@@ -15,7 +15,7 @@ This document is the reference documentation for the Policy resource. An example
 
 ## Prerequisites
 
-Policies work together with [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/), which you need to create separately.
+Policies work together with [VirtualServer and VirtualServerRoute resources]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}), which you need to create separately.
 
 ## Policy Specification
 
@@ -227,7 +227,7 @@ The policies' API keys are securely stored using SHA-256 hashing. When a client
 
 If the hashed keys match, the NGINX JavaScript (NJS) subrequest issues a 204 No Content response to the `auth_request` directive, indicating successful authorization. Conversely, if no API Key is provided in the specified header or query parameter, a 401 Unauthorized response is returned. Similarly, if an invalid key is presented in the expected header or query parameter, a 403 Forbidden response is issued, denying access.
 
-It is possible to use the [errorPages](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#errorpage) property on a route, to change the default behaviour of 401 or 403 errors.
+It is possible to use the [errorPages]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#errorpage" >}}) property on a route, to change the default behaviour of 401 or 403 errors.
 
 At least one header or query param is required.
 
@@ -362,7 +362,7 @@ action:
         value: ${jwt_header_alg}
 ```
 
-We use the `requestHeaders` of the [Action.Proxy](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#actionproxy) to set the values of two headers that NGINX will pass to the upstream servers.
+We use the `requestHeaders` of the [Action.Proxy]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#actionproxy" >}}) to set the values of two headers that NGINX will pass to the upstream servers.
 
 The value of the `${jwt_claim_user}` variable is the `user` claim of a JWT. For other claims, use `${jwt_claim_name}`, where `name` is the name of the claim. Note that nested claims and claims that include a period (`.`) are not supported. Similarly, use `${jwt_header_name}` where `name` is the name of a header. In our example, we use the `alg` header.
 
@@ -474,8 +474,8 @@ data:
 
 A VirtualServer that references an IngressMTLS policy must:
 
-- Enable [TLS termination](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualservertls).
-- Reference the policy in the VirtualServer [`spec`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserver-specification). It is not allowed to reference an IngressMTLS policy in a [`route`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroute) or in a VirtualServerRoute [`subroute`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroutesubroute).
+- Enable [TLS termination]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#virtualservertls" >}}).
+- Reference the policy in the VirtualServer [`spec`]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#virtualserver-specification" >}}). It is not allowed to reference an IngressMTLS policy in a [`route`](({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#virtualserverroute" >}}) or in a VirtualServerRoute [`subroute`]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#virtualserverroutesubroute" >}}).
 
 If the conditions above are not met, NGINX will send the `500` status code to clients.
 
@@ -493,7 +493,7 @@ action:
         value: ${ssl_client_escaped_cert} # client certificate in the PEM format (urlencoded)
 ```
 
-We use the `requestHeaders` of the [Action.Proxy](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#actionproxy) to set the values of the two headers that NGINX will pass to the upstream servers. See the [list of embedded variables](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables) that are supported by the `ngx_http_ssl_module`, which you can use to pass the client certificate details.
+We use the `requestHeaders` of the [Action.Proxy]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#actionproxy" >}}) to set the values of the two headers that NGINX will pass to the upstream servers. See the [list of embedded variables](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables) that are supported by the `ngx_http_ssl_module`, which you can use to pass the client certificate details.
 
 {{< note >}}
 
@@ -611,7 +611,7 @@ The feature is implemented using the NGINX [ngx_http_proxy_module](https://nginx
 |``serverName`` | Enables passing of the server name through ``Server Name Indication`` extension. | ``bool`` | No |
 |``sslName`` | Allows overriding the server name used to verify the certificate of the upstream HTTPS server. | ``string`` | No |
 |``ciphers`` | Specifies the enabled ciphers for requests to an upstream HTTPS server. The default is ``DEFAULT``. | ``string`` | No |
-|``protocols`` | Specifies the protocols for requests to an upstream HTTPS server. The default is ``TLSv1 TLSv1.1 TLSv1.2``. | ``string`` | No | > Note: the value of ``ciphers`` and ``protocols`` is not validated by NGINX Ingress Controller. As a result, NGINX can fail to reload the configuration. To ensure that the configuration for a VirtualServer/VirtualServerRoute that references the policy was successfully applied, check its [status](/nginx-ingress-controller/configuration/global-configuration/reporting-resources-status/#virtualserver-and-virtualserverroute-resources). The validation will be added in the future releases. |
+|``protocols`` | Specifies the protocols for requests to an upstream HTTPS server. The default is ``TLSv1 TLSv1.1 TLSv1.2``. | ``string`` | No | > Note: the value of ``ciphers`` and ``protocols`` is not validated by NGINX Ingress Controller. As a result, NGINX can fail to reload the configuration. To ensure that the configuration for a VirtualServer/VirtualServerRoute that references the policy was successfully applied, check its [status]({{< ref "/nic/configuration/global-configuration/reporting-resources-status.md#virtualserver-and-virtualserverroute-resources" >}}). The validation will be added in the future releases. |
 {{% /table %}}
 
 #### EgressMTLS Merging Behavior
@@ -662,7 +662,7 @@ The feature is implemented using the [reference implementation](https://github.c
 
 #### Prerequisites
 
-In order to use OIDC, you need to enable [zone synchronization](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync/). If you don't set up zone synchronization, NGINX Plus will fail to reload.
+In order to use OIDC, you need to enable [zone synchronization]({{< ref "/nginx/admin-guide/high-availability/zone_sync.md" >}}). If you don't set up zone synchronization, NGINX Plus will fail to reload.
 You also need to configure a resolver, which NGINX Plus will use to resolve the IDP authorization endpoint. You can find an example configuration [in our GitHub repository](https://github.com/nginx/kubernetes-ingress/blob/v{{< nic-version >}}/examples/custom-resources/oidc#step-7---configure-nginx-plus-zone-synchronization-and-resolver).
 
 {{< warning >}}
@@ -734,9 +734,9 @@ webapp-policy   27m
 
 For `kubectl get` and similar commands, you can also use the short name `pol` instead of `policy`.
 
-### WAF {#waf}
+### WAF
 
-{{< note >}} The feature is implemented using the NGINX Plus [NGINX App Protect WAF Module](https://docs.nginx.com/nginx-app-protect/configuration/). {{< /note >}}
+{{< note >}} The feature is implemented using the NGINX Plus [NGINX App Protect WAF Module]({{< ref "/nap-waf/" >}}). {{< /note >}}
 
 The WAF policy configures NGINX Plus to secure client requests using App Protect WAF policies.
 
@@ -867,7 +867,7 @@ For an invalid policy, NGINX returns the 500 status code for client requests wit
 - If a policy is referenced in a VirtualServer `route` or a VirtualServerRoute `subroute`, then NGINX will return the 500 status code for requests for the URIs of that route/subroute.
 - If a policy is referenced in the VirtualServer `spec`, then NGINX will return the 500 status code for requests for all URIs of that VirtualServer.
 
-If a policy is invalid, the VirtualServer or VirtualServerRoute will have the [status](/nginx-ingress-controller/configuration/global-configuration/reporting-resources-status#virtualserver-and-virtualserverroute-resources) with the state `Warning` and the message explaining why the policy wasn't considered invalid.
+If a policy is invalid, the VirtualServer or VirtualServerRoute will have the [status]({{< ref "/nic/configuration/global-configuration/reporting-resources-status.md#virtualserver-and-virtualserverroute-resources" >}}) with the state `Warning` and the message explaining why the policy wasn't considered invalid.
 
 ### Validation
 
diff --git a/content/nic/configuration/security.md b/content/nic/configuration/security.md
index f0b74f6a3..c2637af8a 100644
--- a/content/nic/configuration/security.md
+++ b/content/nic/configuration/security.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-597
-doctypes:
-- ''
 title: Security recommendations
 toc: true
 weight: 300
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-597
 ---
 
 F5 NGINX Ingress Controller follows Kubernetes best practices: this page outlines configuration specific to NGINX Ingress Controller you may require, including links to examples in the [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples).
@@ -34,7 +34,7 @@ By default, the ServiceAccount has access to all Secret resources in the cluster
 ### Configure root filesystem as read-only
 
 {{< caution >}}
- This feature is compatible with [NGINX App Protect WAFv5](https://docs.nginx.com/nginx-app-protect-waf/v5/). It is not compatible with [NGINX App Protect WAFv4](https://docs.nginx.com/nginx-app-protect-waf/v4/) or [NGINX App Protect DoS](https://docs.nginx.com/nginx-app-protect-dos/).
+ This feature is compatible with [NGINX App Protect WAF v5]({{< ref "/nap-waf/v5/" >}}). It is not compatible with [NGINX App Protect WAF v4]({{< ref "/nap-waf/v4/" >}}) or [NGINX App Protect DoS]({{< ref "/nap-dos/" >}}).
 {{< /caution >}}
 
 NGINX Ingress Controller is designed to be resilient against attacks in various ways, such as running the service as non-root to avoid changes to files. We recommend setting filesystems on all containers to read-only, this includes `nginx-ingress-controller`, though also includes `waf-enforcer` and `waf-config-mgr` when NGINX App Protect WAFv5 is in use.  This is so that the attack surface is further reduced by limiting changes to binaries and libraries.
diff --git a/content/nic/configuration/virtualserver-and-virtualserverroute-resources.md b/content/nic/configuration/virtualserver-and-virtualserverroute-resources.md
index 1acd05b02..31f4d2c3f 100644
--- a/content/nic/configuration/virtualserver-and-virtualserverroute-resources.md
+++ b/content/nic/configuration/virtualserver-and-virtualserverroute-resources.md
@@ -2,7 +2,9 @@
 title: VirtualServer and VirtualServerRoute resources
 toc: true
 weight: 700
-docs: DOCS-599
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-599
 ---
 
 This document is reference material for the VirtualServer and VirtualServerRoute resources used by F5 NGINX Ingress Controller.
@@ -54,13 +56,12 @@ spec:
       pass: tea
 ```
 
-{{<bootstrap-table "table table-striped table-bordered table-responsive">}}
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
-|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. When using a wildcard domain like ``*.example.com`` the domain must be contained in double quotes.  The ``host`` value needs to be unique among all Ingress and VirtualServer resources. See also [Handling Host and Listener Collisions](/nginx-ingress-controller/configuration/host-and-listener-collisions). | ``string`` | Yes |
+|``host`` | The host (domain name) of the server. Must be a valid subdomain as defined in RFC 1123, such as ``my-app`` or ``hello.example.com``. When using a wildcard domain like ``*.example.com`` the domain must be contained in double quotes. The ``host`` value needs to be unique among all Ingress and VirtualServer resources. See also [Handling Host and Listener Collisions]({{< ref "/nic/configuration/host-and-listener-collisions.md" >}}). | ``string`` | Yes |
 |``listener`` | Sets a custom HTTP and/or HTTPS listener. Valid fields are `listener.http` and `listener.https`. Each field must reference the name of a valid listener defined in a GlobalConfiguration resource | [listener](#virtualserverlistener) | No |
 |``tls`` | The TLS termination configuration. | [tls](#virtualservertls) | No |
-|``gunzip`` | Enables or disables [decompression](https://docs.nginx.com/nginx/admin-guide/web-server/compression/) of gzipped responses for clients. Allowed values “on”/“off”, “true”/“false” or “yes”/“no”. If the ``gunzip`` value is not set, it defaults to ``off``.   | ``boolean`` | No |
+|``gunzip`` | Enables or disables [decompression]({{< ref "/nginx/admin-guide/web-server/compression.md" >}}) of gzipped responses for clients. Allowed values “on”/“off”, “true”/“false” or “yes”/“no”. If the ``gunzip`` value is not set, it defaults to ``off``.   | ``boolean`` | No |
 |``externalDNS`` | The externalDNS configuration for a VirtualServer. | [externalDNS](#virtualserverexternaldns) | No |
 |``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServer. | ``string`` | No |
 |``policies`` | A list of policies. | [[]policy](#virtualserverpolicy) | No |
@@ -70,7 +71,6 @@ spec:
 |``internalRoute`` | Specifies if the VirtualServer resource is an internal route or not. | ``boolean`` | No |
 |``http-snippets`` | Sets a custom snippet in the http context. | ``string`` | No |
 |``server-snippets`` | Sets a custom snippet in server context. Overrides the ``server-snippets`` ConfigMap key. | ``string`` | No |
-{{</bootstrap-table>}}
 
 ### VirtualServer.TLS
 
@@ -85,7 +85,7 @@ redirect:
 {{<bootstrap-table "table table-striped table-bordered table-responsive">}}
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
-|``secret`` | The name of a secret with a TLS certificate and key. The secret must belong to the same namespace as the VirtualServer. The secret must be of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that contain the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). If the secret doesn't exist or is invalid, NGINX will break any attempt to establish a TLS connection to the host of the VirtualServer. If the secret is not specified but [wildcard TLS secret](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments#cmdoption-wildcard-tls-secret) is configured, NGINX will use the wildcard secret for TLS termination. | ``string`` | No |
+|``secret`` | The name of a secret with a TLS certificate and key. The secret must belong to the same namespace as the VirtualServer. The secret must be of the type ``kubernetes.io/tls`` and contain keys named ``tls.crt`` and ``tls.key`` that contain the certificate and private key as described [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). If the secret doesn't exist or is invalid, NGINX will break any attempt to establish a TLS connection to the host of the VirtualServer. If the secret is not specified but [wildcard TLS secret]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#cmdoption-wildcard-tls-secret" >}}) is configured, NGINX will use the wildcard secret for TLS termination. | ``string`` | No |
 |``redirect`` | The redirect configuration of the TLS for a VirtualServer. | [tls.redirect](#virtualservertlsredirect) | No | ### VirtualServer.TLS.Redirect |
 |``cert-manager`` | The cert-manager configuration of the TLS for a VirtualServer. | [tls.cert-manager](#virtualservertlscertmanager) | No | ### VirtualServer.TLS.CertManager |
 {{</bootstrap-table>}}
@@ -133,7 +133,7 @@ cert-manager:
 
 ### VirtualServer.Listener
 The listener field defines a custom HTTP and/or HTTPS listener.
-The respective listeners used must reference the name of a listener defined using a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource.
+The respective listeners used must reference the name of a listener defined using a [GlobalConfiguration]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}) resource.
 For example:
 ```yaml
 http: http-8083
@@ -143,8 +143,8 @@ https: https-8443
 {{<bootstrap-table "table table-striped table-bordered table-responsive">}}
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
-|``http`` |  The name of am HTTP listener defined in a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource. | ``string`` | No |
-|``https`` |  The name of an HTTPS listener defined in a [GlobalConfiguration](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/) resource. | ``string`` | No |
+|``http`` |  The name of am HTTP listener defined in a [GlobalConfiguration]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}) resource. | ``string`` | No |
+|``https`` |  The name of an HTTPS listener defined in a [GlobalConfiguration]({{< ref "/nic/configuration/global-configuration/globalconfiguration-resource.md" >}}) resource. | ``string`` | No |
 {{</bootstrap-table>}}
 
 ### VirtualServer.ExternalDNS
@@ -185,7 +185,7 @@ The providerSpecific field of the externalDNS block allows the specification of
 
 ### VirtualServer.Policy
 
-The policy field references a [Policy resource](/nginx-ingress-controller/configuration/policy-resource/) by its name and optional namespace. For example:
+The policy field references a [Policy resource]({{< ref "/nic/configuration/policy-resource.md" >}}) by its name and optional namespace. For example:
 
 ```yaml
 name: access-control
@@ -212,7 +212,7 @@ The route defines rules for matching client requests to actions like passing a r
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 |``path`` | The path of the route. NGINX will match it against the URI of a request. Possible values are: a prefix ( ``/`` , ``/path`` ), an exact match ( ``=/exact/match`` ), a case insensitive regular expression ( ``~*^/Bar.*\.jpg`` ) or a case sensitive regular expression ( ``~^/foo.*\.jpg`` ). In the case of a prefix (must start with ``/`` ) or an exact match (must start with ``=`` ), the path must not include any whitespace characters, ``{`` , ``}`` or ``;``. In the case of the regex matches, all double quotes ``"`` must be escaped and the match can't end in an unescaped backslash ``\``. The path must be unique among the paths of all routes of the VirtualServer. Check the [location](https://nginx.org/en/docs/http/ngx_http_core_module.html#location) directive for more information. | ``string`` | Yes |
-|``policies`` | A list of policies. The policies override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies](/nginx-ingress-controller/configuration/policy-resource/#applying-policies) for more details. | [[]policy](#virtualserverpolicy) | No |
+|``policies`` | A list of policies. The policies override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies]({{< ref "/nic/configuration/policy-resource.md#applying-policies" >}}) for more details. | [[]policy](#virtualserverpolicy) | No |
 |``action`` | The default action to perform for a request. | [action](#action) | No |
 |``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServer route. | ``string`` | No |
 |``splits`` | The default splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
@@ -226,7 +226,7 @@ The route defines rules for matching client requests to actions like passing a r
 
 ## VirtualServerRoute specification
 
-The VirtualServerRoute resource defines a route for a VirtualServer. It can consist of one or multiple subroutes. The VirtualServerRoute is an alternative to [Mergeable Ingress types](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration).
+The VirtualServerRoute resource defines a route for a VirtualServer. It can consist of one or multiple subroutes. The VirtualServerRoute is an alternative to [Mergeable Ingress types]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration.md" >}}).
 
 In the example below, the VirtualServer `cafe` from the namespace `cafe-ns` defines a route with the path `/coffee`, which is further defined in the VirtualServerRoute `coffee` from the namespace `coffee-ns`.
 
@@ -303,7 +303,7 @@ action:
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 |``path`` | The path of the subroute. NGINX will match it against the URI of a request. Possible values are: a prefix ( ``/`` , ``/path`` ), an exact match ( ``=/exact/match`` ), a case insensitive regular expression ( ``~*^/Bar.*\.jpg`` ) or a case sensitive regular expression ( ``~^/foo.*\.jpg`` ). In the case of a prefix, the path must start with the same path as the path of the route of the VirtualServer that references this resource. In the case of an exact or regex match, the path must be the same as the path of the route of the VirtualServer that references this resource. A matching path of the route of the VirtualServer but in different type is not accepted, e.g. a regex path (`~/match`) cannot be used with a prefix path in VirtualServer (`/match`) In the case of a prefix or an exact match, the path must not include any whitespace characters, ``{`` , ``}`` or ``;``.  In the case of the regex matches, all double quotes ``"`` must be escaped and the match can't end in an unescaped backslash ``\``. The path must be unique among the paths of all subroutes of the VirtualServerRoute. | ``string`` | Yes |
-|``policies`` | A list of policies. The policies override *all* policies defined in the route of the VirtualServer that references this resource. The policies also override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies](/nginx-ingress-controller/configuration/policy-resource/#applying-policies) for more details. | [[]policy](#virtualserverpolicy) | No |
+|``policies`` | A list of policies. The policies override *all* policies defined in the route of the VirtualServer that references this resource. The policies also override the policies of the same type defined in the ``spec`` of the VirtualServer. See [Applying Policies]({{< ref "/nic/configuration/policy-resource.md#applying-policies" >}}) for more details. | [[]policy](#virtualserverpolicy) | No |
 |``action`` | The default action to perform for a request. | [action](#action) | No |
 |``dos`` | A reference to a DosProtectedResource, setting this enables DOS protection of the VirtualServerRoute subroute. | ``string`` | No |
 |``splits`` | The default splits configuration for traffic splitting. Must include at least 2 splits. | [[]split](#split) | No |
@@ -352,7 +352,7 @@ tls:
 |``subselector`` | Selects the pods within the service using label keys and values. By default, all pods of the service are selected. Note: the specified labels are expected to be present in the pods when they are created. If the pod labels are updated, NGINX Ingress Controller will not see that change until the number of the pods is changed. | ``map[string]string`` | No |
 |``use-cluster-ip`` | Enables using the Cluster IP and port of the service instead of the default behavior of using the IP and port of the pods. When this field is enabled, the fields that configure NGINX behavior related to multiple upstream servers (like ``lb-method`` and ``next-upstream``) will have no effect, as NGINX Ingress Controller will configure NGINX with only one upstream server that will match the service Cluster IP. | ``boolean`` | No |
 |``port`` | The port of the service. If the service doesn't define that port, NGINX will assume the service has zero endpoints and return a ``502`` response for requests for this upstream. The port must fall into the range ``1..65535``. | ``uint16`` | Yes |
-|``lb-method`` | The load [balancing method](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#choosing-a-load-balancing-method). To use the round-robin method, specify ``round_robin``. The default is specified in the ``lb-method`` ConfigMap key. | ``string`` | No |
+|``lb-method`` | The load [balancing method]({{< ref "/nginx/admin-guide/load-balancer/http-load-balancer.md#choosing-a-load-balancing-method" >}}). To use the round-robin method, specify ``round_robin``. The default is specified in the ``lb-method`` ConfigMap key. | ``string`` | No |
 |``fail-timeout`` | The time during which the specified number of unsuccessful attempts to communicate with an upstream server should happen to consider the server unavailable. See the [fail_timeout](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout) parameter of the server directive. The default is set in the ``fail-timeout`` ConfigMap key. | ``string`` | No |
 |``max-fails`` | The number of unsuccessful attempts to communicate with an upstream server that should happen in the duration set by the ``fail-timeout`` to consider the server unavailable. See the [max_fails](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails) parameter of the server directive. The default is set in the ``max-fails`` ConfigMap key. | ``int`` | No |
 |``max-conns`` | The maximum number of simultaneous active connections to an upstream server. See the [max_conns](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_conns) parameter of the server directive. By default there is no limit. Note: if keepalive connections are enabled, the total number of active and idle keepalive connections to an upstream server may exceed the ``max_conns`` value. | ``int`` | No |
@@ -372,7 +372,7 @@ tls:
 |``buffers`` | Configures the buffers used for reading a response from the upstream server for a single connection. | [buffers](#upstreambuffers) | No |
 |``buffer-size`` | Sets the size of the buffer used for reading the first part of a response received from the upstream server. See the [proxy_buffer_size](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) directive. The default is set in the ``proxy-buffer-size`` ConfigMap key. | ``string`` | No |
 |``ntlm`` | Allows proxying requests with NTLM Authentication. See the [ntlm](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#ntlm) directive. In order for NTLM authentication to work, it is necessary to enable keepalive connections to upstream servers using the ``keepalive`` field. Note: this feature is supported only in NGINX Plus.| ``boolean`` | No |
-|``type`` |The type of the upstream. Supported values are ``http`` and ``grpc``. The default is ``http``. For gRPC, it is necessary to enable HTTP/2 in the [ConfigMap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#listeners) and configure TLS termination in the VirtualServer. | ``string`` | No |
+|``type`` |The type of the upstream. Supported values are ``http`` and ``grpc``. The default is ``http``. For gRPC, it is necessary to enable HTTP/2 in the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#listeners" >}}) and configure TLS termination in the VirtualServer. | ``string`` | No |
 |``backup`` | The name of the backup service of type [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname). This will be used when the primary servers are unavailable. Note: The parameter cannot be used along with the ``random`` , ``hash`` or ``ip_hash`` load balancing methods. | ``string`` | No |
 |``backupPort`` | The port of the backup service. The backup port is required if the backup service name is provided. The port must fall into the range ``1..65535``. | ``uint16`` | No |
 {{</bootstrap-table>}}
@@ -400,7 +400,7 @@ See the [proxy_buffers](https://nginx.org/en/docs/http/ngx_http_proxy_module.htm
 {{<bootstrap-table "table table-striped table-bordered table-responsive">}}
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
-|``enable`` | Enables HTTPS for requests to upstream servers. The default is ``False`` , meaning that HTTP will be used. Note: by default, NGINX will not verify the upstream server certificate. To enable the verification, configure an [EgressMTLS Policy](/nginx-ingress-controller/configuration/policy-resource/#egressmtls). | ``boolean`` | No |
+|``enable`` | Enables HTTPS for requests to upstream servers. The default is ``False`` , meaning that HTTP will be used. Note: by default, NGINX will not verify the upstream server certificate. To enable the verification, configure an [EgressMTLS Policy]({{< ref "/nic/configuration/policy-resource/#egressmtls" >}}). | ``boolean`` | No |
 {{</bootstrap-table>}}
 
 ### Upstream.Queue
@@ -425,7 +425,7 @@ Note: This feature is supported only in NGINX Plus.
 
 ### Upstream.Healthcheck
 
-The Healthcheck defines an [active health check](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/). In the example below we enable a health check for an upstream and configure all the available parameters, including the `slow-start` parameter combined with [`mandatory` and `persistent`](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#mandatory-health-checks):
+The Healthcheck defines an [active health check]({{< ref "/nginx/admin-guide/load-balancer.md#http-health-check" >}}). In the example below we enable a health check for an upstream and configure all the available parameters, including the `slow-start` parameter combined with [`mandatory` and `persistent`]({{< ref "/nginx/admin-guide/load-balancer/http-health-check.md#mandatory-health-checks" >}}):
 
 ```yaml
 name: tea
@@ -1089,7 +1089,7 @@ NGINX Ingress Controller validates VirtualServerRoute resources in a similar way
 
 ## Customization using ConfigMap
 
-You can customize the NGINX configuration for VirtualServer and VirtualServerRoutes resources using the [ConfigMap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource). Most of the ConfigMap keys are supported, with the following exceptions:
+You can customize the NGINX configuration for VirtualServer and VirtualServerRoutes resources using the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}). Most of the ConfigMap keys are supported, with the following exceptions:
 
 - `proxy-hide-headers`
 - `proxy-pass-headers`
diff --git a/content/nic/installation/ingress-nginx.md b/content/nic/installation/ingress-nginx.md
index cdace0791..cc8fc2ebb 100644
--- a/content/nic/installation/ingress-nginx.md
+++ b/content/nic/installation/ingress-nginx.md
@@ -459,17 +459,17 @@ This table maps the Ingress-NGINX Controller annotations to NGINX Ingress Contro
 {{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
 | Ingress-NGINX Controller | NGINX Ingress Controller | NGINX Directive |
 | ------------------------ | ------------------------ | --------------- |
-| [_nginx.ingress.kubernetes.io/configuration-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet) | [_nginx.org/location-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#snippets-and-custom-templates) | N/A |
-| [_nginx.ingress.kubernetes.io/load-balance_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-nginx-load-balancing) (1) |  [_nginx.org/lb-method_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#backend-services-upstreams) | [_random two least_conn_](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#random) |
-| [_nginx.ingress.kubernetes.io/proxy-buffering_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffering) | [_nginx.org/proxy-buffering_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_buffering_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) |
-| [_nginx.ingress.kubernetes.io/proxy-buffers-number_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffers-number) | [_nginx.org/proxy-buffers_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_buffers_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) |
-| [_nginx.ingress.kubernetes.io/proxy-buffer-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffer-size) | [_nginx.org/proxy-buffer-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_buffer_size_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) |
-| [_nginx.ingress.kubernetes.io/proxy-connect-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-connect-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_connect_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) |
-| [_nginx.ingress.kubernetes.io/proxy-read-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-read-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_read_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) |
-| [_nginx.ingress.kubernetes.io/proxy-send-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-send-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#general-customization) | [_proxy_send_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) |
-| [_nginx.ingress.kubernetes.io/rewrite-target_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rewrite) | [_nginx.org/rewrites_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#request-uriheader-manipulation) | [_rewrite_](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#rewrite) |
-| [_nginx.ingress.kubernetes.io/server-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-snippet)| [_nginx.org/server-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#snippets-and-custom-templates) | N/A |
-| [_nginx.ingress.kubernetes.io/ssl-redirect_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect) | [_ingress.kubernetes.io/ssl-redirect_](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#auth-and-ssltls) | N/A (2) |
+| [_nginx.ingress.kubernetes.io/configuration-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet) | [_nginx.org/location-snippets_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#snippets-and-custom-templates" >}}) | N/A |
+| [_nginx.ingress.kubernetes.io/load-balance_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-nginx-load-balancing) (1) |  [_nginx.org/lb-method_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#backend-services-upstreams" >}}) | [_random two least_conn_](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#random) |
+| [_nginx.ingress.kubernetes.io/proxy-buffering_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffering) | [_nginx.org/proxy-buffering_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#general-customization" >}}) | [_proxy_buffering_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering) |
+| [_nginx.ingress.kubernetes.io/proxy-buffers-number_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffers-number) | [_nginx.org/proxy-buffers_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#general-customization" >}}) | [_proxy_buffers_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers) |
+| [_nginx.ingress.kubernetes.io/proxy-buffer-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffer-size) | [_nginx.org/proxy-buffer-size_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#general-customization" >}}) | [_proxy_buffer_size_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) |
+| [_nginx.ingress.kubernetes.io/proxy-connect-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-connect-timeout_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#general-customization" >}}) | [_proxy_connect_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) |
+| [_nginx.ingress.kubernetes.io/proxy-read-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-read-timeout_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#general-customization" >}}) | [_proxy_read_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout) |
+| [_nginx.ingress.kubernetes.io/proxy-send-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-timeouts) | [_nginx.org/proxy-send-timeout_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#general-customization" >}}) | [_proxy_send_timeout_](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) |
+| [_nginx.ingress.kubernetes.io/rewrite-target_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rewrite) | [_nginx.org/rewrites_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#request-uriheader-manipulation" >}}) | [_rewrite_](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#rewrite) |
+| [_nginx.ingress.kubernetes.io/server-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-snippet)| [_nginx.org/server-snippets_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#snippets-and-custom-templates" >}}) | N/A |
+| [_nginx.ingress.kubernetes.io/ssl-redirect_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect) | [_ingress.kubernetes.io/ssl-redirect_]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#auth-and-ssltls" >}}) | N/A (2) |
 {{% /bootstrap-table %}}
 
 1. Ingress-NGINX Controller implements some of its load balancing algorithms with Lua, which may not have an equivalent in NGINX Ingress Controller.
@@ -505,42 +505,42 @@ Some of the key names are identical, and each Ingress Controller has ConfigMap k
 {{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
 | Ingress-NGINX Controller | NGINX Ingress Controller |
 | ------------------------ | ------------------------ |
-| [_disable-access-log_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#disable-access-log) | [_access-log-off_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
-| [_error-log-level_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#error-log-level) | [_error-log-level_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
-| [_hsts_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts) | [_hsts_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
-| [_hsts-include-subdomains_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts-include-subdomains) | [_hsts-include-subdomains_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls)       |
-| [_hsts-max-age_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts-max-age) | [_hsts-max-age_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
-| [_http-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#http-snippet) | [_http-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
-| [_keep-alive_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#keep-alive) | [_keepalive-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_keep-alive-requests_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#keep-alive-requests) | [_keepalive-requests_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_load-balance_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#load-balance) | [_lb-method_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#backend-services-upstreams) |
-| [_location-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#location-snippet) | [_location-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
-| [_log-format-escape-json_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-escape-json) | [_log-format-escaping: "json"_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
-| [_log-format-stream_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-stream) | [_stream-log-format_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
-| [_log-format-upstream_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-upstream) | [_log-format_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#logging) |
-| [_main-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#main-snippet) | [_main-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
-| [_max-worker-connections_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#max-worker-connections) | [_worker-connections_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_max-worker-open-files_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#max-worker-open-files) | [_worker-rlimit-nofile_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-body-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-body-size) | [_client-max-body-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-buffering_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffering) | [_proxy-buffering_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-buffers-number_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffers-number) | [_proxy-buffers: number size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-buffer-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffer-size) | [_proxy-buffers: number size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-connect-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-connect-timeout) | [_proxy-connect-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-read-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-read-timeout) | [_proxy-read-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-send-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-send-timeout) | [_proxy-send-timeout_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_server-name-hash-bucket-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-name-hash-bucket-size) | [_server-names-hash-bucket-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_proxy-headers-hash-max-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-headers-hash-max-size) | [_server-names-hash-max-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_server-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-snippet) | [_server-snippets_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#snippets-and-custom-templates) |
-| [_server-tokens _](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-tokens) | [_server-tokens_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_ssl-ciphers_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-ciphers) | [_ssl-ciphers_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
-| [_ssl-dh-param_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-dh-param) | [_ssl-dhparam-file_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
-| [_ssl-protocols_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-protocols) | [_ssl-protocols_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
-| [_ssl-redirect_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-redirect) | [_ssl-redirect_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls) |
-| [_upstream-keepalive-connections_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#upstream-keepalive-connections) | [_keepalive_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#backend-services-upstreams) |
-| [_use-http2_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-http2) | [_http2_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#listeners) |
-| [_use-proxy-protocol_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-proxy-protocol) | [_proxy-protocol_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#listeners) |
-| [_variables-hash-bucket-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#variables-hash-bucket-size)     | [_variables-hash-bucket-size_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_worker-cpu-affinity_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-cpu-affinity) | [_worker-cpu-affinity_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_worker-processes_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-processes) | [_worker-processes_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
-| [_worker-shutdown-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-shutdown-timeout) | [_worker-shutdown-timeole_](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#general-customization) |
+| [_disable-access-log_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#disable-access-log) | [_access-log-off_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#logging" >}}) |
+| [_error-log-level_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#error-log-level) | [_error-log-level_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#logging" >}}) |
+| [_hsts_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts) | [_hsts_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#auth-and-ssltls" >}}) |
+| [_hsts-include-subdomains_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts-include-subdomains) | [_hsts-include-subdomains_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#auth-and-ssltls" >}})       |
+| [_hsts-max-age_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#hsts-max-age) | [_hsts-max-age_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#auth-and-ssltls" >}}) |
+| [_http-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#http-snippet) | [_http-snippets_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}}) |
+| [_keep-alive_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#keep-alive) | [_keepalive-timeout_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_keep-alive-requests_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#keep-alive-requests) | [_keepalive-requests_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_load-balance_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#load-balance) | [_lb-method_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#backend-services-upstreams" >}}) |
+| [_location-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#location-snippet) | [_location-snippets_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}}) |
+| [_log-format-escape-json_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-escape-json) | [_log-format-escaping: "json"_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#logging" >}}) |
+| [_log-format-stream_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-stream) | [_stream-log-format_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#logging" >}}) |
+| [_log-format-upstream_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-upstream) | [_log-format_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#logging" >}}) |
+| [_main-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#main-snippet) | [_main-snippets_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}}) |
+| [_max-worker-connections_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#max-worker-connections) | [_worker-connections_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_max-worker-open-files_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#max-worker-open-files) | [_worker-rlimit-nofile_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-body-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-body-size) | [_client-max-body-size_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-buffering_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffering) | [_proxy-buffering_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-buffers-number_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffers-number) | [_proxy-buffers: number size_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-buffer-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-buffer-size) | [_proxy-buffers: number size_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-connect-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-connect-timeout) | [_proxy-connect-timeout_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-read-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-read-timeout) | [_proxy-read-timeout_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-send-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-send-timeout) | [_proxy-send-timeout_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_server-name-hash-bucket-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-name-hash-bucket-size) | [_server-names-hash-bucket-size_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_proxy-headers-hash-max-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#proxy-headers-hash-max-size) | [_server-names-hash-max-size_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_server-snippet_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-snippet) | [_server-snippets_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#snippets-and-custom-templates" >}}) |
+| [_server-tokens _](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-tokens) | [_server-tokens_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_ssl-ciphers_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-ciphers) | [_ssl-ciphers_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#auth-and-ssltls" >}}) |
+| [_ssl-dh-param_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-dh-param) | [_ssl-dhparam-file_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#auth-and-ssltls" >}}) |
+| [_ssl-protocols_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-protocols) | [_ssl-protocols_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#auth-and-ssltls" >}}) |
+| [_ssl-redirect_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-redirect) | [_ssl-redirect_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#auth-and-ssltls" >}}) |
+| [_upstream-keepalive-connections_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#upstream-keepalive-connections) | [_keepalive_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#backend-services-upstreams" >}}) |
+| [_use-http2_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-http2) | [_http2_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#listeners" >}}) |
+| [_use-proxy-protocol_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-proxy-protocol) | [_proxy-protocol_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#listeners" >}}) |
+| [_variables-hash-bucket-size_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#variables-hash-bucket-size)     | [_variables-hash-bucket-size_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_worker-cpu-affinity_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-cpu-affinity) | [_worker-cpu-affinity_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_worker-processes_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-processes) | [_worker-processes_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
+| [_worker-shutdown-timeout_](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-shutdown-timeout) | [_worker-shutdown-timeole_]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#general-customization" >}}) |
 {{% /bootstrap-table %}}
diff --git a/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md b/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
index 93cf807fd..815ac0166 100644
--- a/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
+++ b/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
@@ -2,8 +2,8 @@
 title: Install NGINX Ingress Controller and NGINX App Protect WAF with Docker and Helm
 toc: true
 weight: 500
-type: how-to
-product: NIC
+nd-content-type: how-to
+nd-product: NIC
 ---
 
 This document describes how to build a local F5 NGINX App Protect WAF v5 Docker image with NGINX Plus Ingress 
@@ -340,4 +340,4 @@ deployment in a single file with the policy bundle already set.
 
 You now have a fully operational NGINX Ingress Controller instance with NGINX App Protect deployed in your Kubernetes environment. 
 
-For further details, troubleshooting, or support, refer to the [official NGINX documentation](https://docs.nginx.com) or reach out directly to your F5/NGINX account team.
+For further details, troubleshooting, or support, refer to the [official NGINX documentation]({{< ref "/" >}}) or reach out directly to your F5/NGINX account team.
diff --git a/content/nic/installation/installing-nic/installation-with-helm.md b/content/nic/installation/installing-nic/installation-with-helm.md
index 460b838ac..3580dce67 100644
--- a/content/nic/installation/installing-nic/installation-with-helm.md
+++ b/content/nic/installation/installing-nic/installation-with-helm.md
@@ -334,7 +334,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 | **controller.customConfigMap** | The name of the custom ConfigMap used by the Ingress Controller. If set, then the default config is ignored. | "" |
 | **controller.config.name** | The name of the ConfigMap used by the Ingress Controller. | Autogenerated |
 | **controller.config.annotations** | The annotations of the Ingress Controller configmap. | {} |
-| **controller.config.entries** | The entries of the ConfigMap for customizing NGINX configuration. See [ConfigMap resource docs](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) for the list of supported ConfigMap keys. | {} |
+| **controller.config.entries** | The entries of the ConfigMap for customizing NGINX configuration. See [ConfigMap resource docs]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) for the list of supported ConfigMap keys. | {} |
 | **controller.customPorts** | A list of custom ports to expose on the NGINX Ingress Controller pod. Follows the conventional Kubernetes yaml syntax for container ports. | [] |
 | **controller.defaultTLS.cert** | The base64-encoded TLS certificate for the default HTTPS server. **Note:** It is recommended that you specify your own certificate. Alternatively, omitting the default server secret completely will configure NGINX to reject TLS connections to the default server. |
 | **controller.defaultTLS.key** | The base64-encoded TLS key for the default HTTPS server. **Note:** It is recommended that you specify your own key. Alternatively, omitting the default server secret completely will configure NGINX to reject TLS connections to the default server. |
@@ -454,7 +454,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 | **controller.readOnlyRootFilesystem** | Configure root filesystem as read-only and add volumes for temporary data. Three major releases after 3.5.x this argument will be moved permanently to the `controller.securityContext` section.  | false |
 | **controller.enableSSLDynamicReload** | Enable lazy loading for SSL Certificates. | true |
 | **controller.telemetryReporting.enable** | Enable telemetry reporting. | true |
-| **controller.enableWeightChangesDynamicReload** | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) if there are many two-way splits. Requires `controller.nginxplus` | false |
+| **controller.enableWeightChangesDynamicReload** | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) if there are many two-way splits. Requires `controller.nginxplus` | false |
 | **rbac.create** | Configures RBAC. | true |
 | **rbac.clusterrole.create** | Configures creation of ClusterRole. Creation can be disabled when more fine-grained control over RBAC is required. For example when controller.watchNamespace is used. | true |
 | **prometheus.create** | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
@@ -472,18 +472,18 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 | **serviceInsight.scheme** | Configures the HTTP scheme to use for connections to the Service Insight endpoint. | http |
 | **serviceInsight.secret** | The namespace / name of a Kubernetes TLS Secret. If specified, this secret is used to secure the Service Insight endpoint with TLS connections. | "" |
 | **serviceNameOverride** | Used to prevent cloud load balancers from being replaced due to service name change during helm upgrades. | "" |
-| **nginxServiceMesh.enable** | Enable integration with NGINX Service Mesh. See the NGINX Service Mesh [docs](https://docs.nginx.com/nginx-service-mesh/tutorials/kic/deploy-with-kic/) for more details. Requires `controller.nginxplus`. | false |
-| **nginxServiceMesh.enableEgress** | Enable NGINX Service Mesh workloads to route egress traffic through the Ingress Controller. See the NGINX Service Mesh [docs](https://docs.nginx.com/nginx-service-mesh/tutorials/kic/deploy-with-kic/#enabling-egress) for more details. Requires `nginxServiceMesh.enable`. | false |
+| **nginxServiceMesh.enable** | Enable integration with NGINX Service Mesh. See the NGINX Service Mesh docs for more details. Requires `controller.nginxplus`. | false |
+| **nginxServiceMesh.enableEgress** | Enable NGINX Service Mesh workloads to route egress traffic through the Ingress Controller. See the NGINX Service Mesh docs for more details. Requires `nginxServiceMesh.enable`. | false |
 |**nginxAgent.enable** | Enable NGINX Agent to integrate the Security Monitoring and App Protect WAF modules. Requires `controller.appprotect.enable`. | false |
 |**nginxAgent.instanceGroup** | Set a custom Instance Group name for the deployment, shown when connected to NGINX Instance Manager. `nginx-ingress.controller.fullname` will be used if not set. | "" |
 |**nginxAgent.logLevel** | Log level for NGINX Agent. | "error |
 |**nginxAgent.instanceManager.host** | FQDN or IP for connecting to NGINX Ingress Controller. Required when `nginxAgent.enable` is set to `true` | "" |
 |**nginxAgent.instanceManager.grpcPort** | Port for connecting to NGINX Ingress Controller. | 443 |
-|**nginxAgent.instanceManager.sni** | Server Name Indication for Instance Manager. See the NGINX Agent [docs](https://docs.nginx.com/nginx-agent/configuration/encrypt-communication/) for more details. | "" |
+|**nginxAgent.instanceManager.sni** | Server Name Indication for Instance Manager. See the NGINX Agent [docs]({{< ref "/agent/configuration/encrypt-communication.md" >}}) for more details. | "" |
 |**nginxAgent.instanceManager.tls.enable** | Enable TLS for Instance Manager connection. | true |
 |**nginxAgent.instanceManager.tls.skipVerify** | Skip certification verification for Instance Manager connection. | false |
 |**nginxAgent.instanceManager.tls.caSecret** | Name of `nginx.org/ca` secret used for verification of Instance Manager TLS. | "" |
-|**nginxAgent.instanceManager.tls.secret** | Name of `kubernetes.io/tls` secret with a TLS certificate and key for using mTLS between NGINX Agent and Instance Manager. See the NGINX Instance Manager [docs](https://docs.nginx.com/nginx-instance-manager/system-configuration/secure-traffic/#mutual-client-certificate-authentication-setup-mtls) and the NGINX Agent [docs](https://docs.nginx.com/nginx-agent/configuration/encrypt-communication/) for more details. | "" |
+|**nginxAgent.instanceManager.tls.secret** | Name of `kubernetes.io/tls` secret with a TLS certificate and key for using mTLS between NGINX Agent and Instance Manager. See the NGINX Instance Manager [docs]({{< ref "/nim/system-configuration/secure-traffic.md#mutual-client-certificate-authentication-setup-mtls" >}}) and the NGINX Agent [docs]({{< ref "/agent/configuration/encrypt-communication.md" >}}) for more details. | "" |
 |**nginxAgent.syslog.host** | Address for NGINX Agent to run syslog listener. | 127.0.0.1 |
 |**nginxAgent.syslog.port** | Port for NGINX Agent to run syslog listener. | 1514 |
 |**nginxAgent.napMonitoring.collectorBufferSize** | Buffer size for collector. Will contain log lines and parsed log lines. | 50000 |
diff --git a/content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md b/content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md
index 3b3fd61c5..323c2d53e 100644
--- a/content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md
+++ b/content/nic/installation/integrations/app-protect-dos/troubleshoot-app-protect-dos.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-1456
-doctypes:
-- ''
 title: Troubleshoot NGINX App Protect DoS
 toc: true
 weight: 400
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1456
 ---
 
 This document describes how to troubleshoot problems when using NGINX Ingress Controller and the App Protect DoS module.
@@ -106,6 +106,7 @@ The events section has a *Normal* event with the *AddedOrUpdated reason*, indica
 
 ## Run App Protect DoS in Debug log Mode
 
-When you set the Ingress Controller to use debug log mode, the setting also applies to the App Protect DoS module.  See  [Running NGINX in the Debug Mode](/nginx-ingress-controller/troubleshooting/#running-nginx-in-the-debug-mode) for instructions.
+When you configure NGINX Ingress Controller to use debug log mode, the setting also applies to the App Protect DoS module. See [Enable debugging for NGINX Ingress Controller
+]({{< ref "/nic/troubleshooting/troubleshoot-common.md#enable-debugging-for-nginx-ingress-controller" >}}) for instructions.
 
-You can enable debug log mode to App Protect DoS module only by setting the `app-protect-dos-debug` [configmap](/nginx-ingress-controller/configuration/global-configuration/configmap-resource#modules).
+You can enable debug log mode to App Protect DoS module only by setting the `app-protect-dos-debug` [configmap]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#modules" >}}).
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
index d6abcb83c..c34785d49 100644
--- a/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
+++ b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
@@ -2,9 +2,9 @@
 title: Compile NGINX App Protect WAF policies using NGINX Instance Manager
 weight: 300
 toc: true
-type: how-to
-product: NIC
-docs: DOCS-000
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-000
 ---
 
 ## Overview
@@ -22,8 +22,8 @@ The following steps describe how to use the NGINX Instance Manager API to create
 ## Before you start
 
 ### Requirements
-- A working [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/deploy/) instance.
-- An [NGINX Instance Manager user](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/overview-rbac/) for API requests.
+- A working [NGINX Instance Manager]({{< ref "/nim/deploy/" >}}) instance.
+- An [NGINX Instance Manager user]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}) for API requests.
 - A NGINX Ingress Controller [deployment with NGINX App Protect WAF]({{< ref "/nic/installation/integrations/app-protect-waf/installation.md" >}}).
 
 ---
@@ -32,7 +32,7 @@ The following steps describe how to use the NGINX Instance Manager API to create
 
 {{< tip >}} You can skip this step if you intend to use an existing security policy. {{< /tip >}}
 
-Create a [new security policy](https://docs.nginx.com/nginx-instance-manager/nginx-app-protect/manage-waf-security-policies/#create-security-policy) using the API: this will require the use of a tool such as [`curl`](https://curl.se/) or [Postman](https://www.postman.com/)
+Create a [new security policy]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies.md#create-security-policy" >}}) using the API: this will require the use of a tool such as [`curl`](https://curl.se/) or [Postman](https://www.postman.com/)
 
 Create the file `simple-policy.json` with the contents below:
 
@@ -91,7 +91,7 @@ It is one of two unique IDs we will use to download the bundle: it will be refer
 
 ## Create a new security bundle
 
-Once you have created (Or selected) a security policy, [create a security bundle](https://docs.nginx.com/nginx-instance-manager/nginx-app-protect/manage-waf-security-policies/#create-security-policy-bundles) using the API. The version in the bundle you create **must** match the WAF compiler version you intend to use.
+Once you have created (Or selected) a security policy, [create a security bundle]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies.md#create-security-policy-bundles" >}}) using the API. The version in the bundle you create **must** match the WAF compiler version you intend to use.
 
 You can check which version is installed in NGINX Instance Manager by checking the operating system packages. If the wrong version is noted in the JSON payload, you will receive an error similar to below:
 
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/configuration.md b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
index b1c0c805e..748e56d79 100644
--- a/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
+++ b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
@@ -2,14 +2,14 @@
 title: Configure NGINX App Protect with NGINX Ingress Controller
 weight: 200
 toc: true
-type: how-to
-product: NIC
-docs: DOCS-000
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-000
 ---
 
 ## Overview
 
-This document explains how to use F5 NGINX Ingress Controller to configure [NGINX App Protect WAF v5](https://docs.nginx.com/nginx-app-protect-waf/v5/).
+This document explains how to use F5 NGINX Ingress Controller to configure [NGINX App Protect WAF v5]({{< ref "/nap-waf/v5/" >}}).
 
 {{< note >}} There are complete NGINX Ingress Controller with NGINX App Protect WAF [example resources on GitHub](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/app-protect-waf-v5). {{< /note >}}
 
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
index 65a76a872..65594dcf6 100644
--- a/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
+++ b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
@@ -2,16 +2,16 @@
 title: Troubleshoot NGINX App Protect WAF
 weight: 400
 toc: true
-type: how-to
-product: NIC
-docs: DOCS-000
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-000
 ---
 
 This document describes how to troubleshoot problems when using NGINX Ingress Controller and the NGINX App Protect WAF module version 5.
 
 For general troubleshooting of NGINX Ingress Controller, check the general [troubleshooting]({{< ref "/nic/troubleshooting/troubleshoot-common" >}}) documentation.
 
-{{< see-also >}} You can find more troubleshooting tips in the NGINX App Protect WAF [troubleshooting guide](https://docs.nginx.com/nginx-app-protect-waf/v5/troubleshooting-guide/troubleshooting/) {{< /see-also >}}.
+{{< see-also >}} You can find more troubleshooting tips in the NGINX App Protect WAF [troubleshooting guide]({{< ref "/nap-waf/v5/troubleshooting-guide/troubleshooting.md" >}}) {{< /see-also >}}.
 
 ## Potential problems
 
diff --git a/content/nic/installation/integrations/nic-n1-console.md b/content/nic/installation/integrations/nic-n1-console.md
index 231c9c329..8602062a0 100644
--- a/content/nic/installation/integrations/nic-n1-console.md
+++ b/content/nic/installation/integrations/nic-n1-console.md
@@ -24,7 +24,7 @@ nginxAgent:
   dataplaneKey: "<Your Dataplane Key>"
 ```
 
- The `dataplaneKey` is used to authenticate the agent with NGINX One Console. See the NGINX One Console Docs [here](https://docs.nginx.com/nginx-one/getting-started/#generate-data-plane-key) to generate your dataplane key from the NGINX One Console.
+ The `dataplaneKey` is used to authenticate the agent with NGINX One Console. See the NGINX One Console Docs [here]({{< ref "/nginx-one/getting-started.md#generate-data-plane-key" >}}) to generate your dataplane key from the NGINX One Console.
 
 
 Follow the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) instructions to deploy NGINX Ingress Controller.
diff --git a/content/nic/installation/nic-images/get-image-using-jwt.md b/content/nic/installation/nic-images/get-image-using-jwt.md
index 7e1a52f61..1dff0c74b 100644
--- a/content/nic/installation/nic-images/get-image-using-jwt.md
+++ b/content/nic/installation/nic-images/get-image-using-jwt.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-1454
-doctypes:
-- ''
 title: Get the NGINX Ingress Controller image with JWT
 toc: true
 weight: 150
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1454
 ---
 
 This document describes how to pull the F5 NGINX Plus Ingress Controller image from the F5 Docker registry into your Kubernetes cluster using your JWT token.
@@ -41,7 +41,7 @@ You will need the following information from [MyF5](https://my.f5.com) for these
 
 ## Prepare NGINX Ingress Controller
 
-1. Choose your desired [NGINX Ingress Controller Image](https://docs.nginx.com/nginx-ingress-controller/technical-specifications/#images-with-nginx-plus).
+1. Choose your desired [NGINX Ingress Controller Image]({{< ref "/nic/technical-specifications.md#images-with-nginx-plus" >}}).
 1. Log into the [MyF5 Portal](https://my.f5.com/), navigate to your subscription details, and download the relevant .cert, .key and .JWT files.
 1. Create a Kubernetes secret using the JWT token. You should use `cat` to view the contents of the JWT token and store the output for use in later steps.
 1. Ensure there are no additional characters or extra whitespace that might have been accidentally added. This will break authorization and prevent the NGINX Ingress Controller image from being downloaded.
@@ -72,7 +72,7 @@ You will need the following information from [MyF5](https://my.f5.com) for these
 
 ## Manifest Deployment
 
-The page ["Installation with Manifests"](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/) explains how to install NGINX Ingress Controller using manifests. The following snippet is an example of a deployment:
+The page ["Installation with Manifests"]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) explains how to install NGINX Ingress Controller using manifests. The following snippet is an example of a deployment:
 
 ```yaml
 spec:
diff --git a/content/nic/logging-and-monitoring/logging.md b/content/nic/logging-and-monitoring/logging.md
index 44e7a8fb2..2407b99a8 100644
--- a/content/nic/logging-and-monitoring/logging.md
+++ b/content/nic/logging-and-monitoring/logging.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-613
-doctypes:
-- ''
 title: Logging
 toc: true
 weight: 1800
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-613
 ---
 
 This document gives an overview of logging provided by NGINX Ingress Controller.
@@ -19,17 +19,17 @@ kubectl logs <nginx-ingress-pod> -n nginx-ingress
 
 The NGINX Ingress Controller process logs are configured through the `-log-level` command-line argument of the NGINX Ingress Controller, which sets the log level. The default value is `info`. Other options include: `trace`, `debug`, `info`, `warning`, `error` and `fatal`. The value `debug` is useful for troubleshooting: you will be able to see how NGINX Ingress Controller gets updates from the Kubernetes API, generates NGINX configuration and reloads NGINX.
 
-See also the doc about NGINX Ingress Controller [command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments).
+See also the doc about NGINX Ingress Controller [command-line arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}).
 
 ## NGINX Logs
 
 The NGINX includes two logs:
 
-- *Access log*, where NGINX writes information about client requests in the access log right after the request is processed. The access log is configured via the [logging-related](/nginx-ingress-controller/configuration/global-configuration/configmap-resource#logging) ConfigMap keys:
+- *Access log*, where NGINX writes information about client requests in the access log right after the request is processed. The access log is configured via the [logging-related]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#logging" >}}) ConfigMap keys:
   - `log-format` for HTTP and HTTPS traffic.
   - `stream-log-format` for TCP, UDP, and TLS Passthrough traffic.
 
     Additionally, you can disable access logging with the `access-log-off` ConfigMap key.
-- *Error log*, where NGINX writes information about encountered issues of different severity levels. It is configured via the `error-log-level` [ConfigMap key](/nginx-ingress-controller/configuration/global-configuration/configmap-resource#logging). To enable debug logging, set the level to `debug` and also set the `-nginx-debug` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments), so that NGINX is started with the debug binary `nginx-debug`.
+- *Error log*, where NGINX writes information about encountered issues of different severity levels. It is configured via the `error-log-level` [ConfigMap key]({{< ref "/nic/configuration/global-configuration.md#configmap-resource#logging" >}}). To enable debug logging, set the level to `debug` and also set the `-nginx-debug` [command-line argument]({{< ref "/nic/configuration/global-configuration.md#command-line-arguments" >}}), so that NGINX is started with the debug binary `nginx-debug`.
 
-See also the doc about [NGINX logs](https://docs.nginx.com/nginx/admin-guide/monitoring/logging/) from NGINX Admin guide.
+See also the doc about [NGINX logs]({{< ref "/nginx/admin-guide/monitoring/logging.md" >}}) from NGINX Admin guide.
diff --git a/content/nic/logging-and-monitoring/prometheus.md b/content/nic/logging-and-monitoring/prometheus.md
index b8f3d6532..3d56d486f 100644
--- a/content/nic/logging-and-monitoring/prometheus.md
+++ b/content/nic/logging-and-monitoring/prometheus.md
@@ -14,7 +14,7 @@ NGINX Ingress Controller exposes metrics in the [Prometheus](https://prometheus.
 ### Using Manifests
 If you're using *Kubernetes manifests* (Deployment or DaemonSet) to install the Ingress Controller, to enable Prometheus metrics:
 
-1. Run the Ingress Controller with the `-enable-prometheus-metrics` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments). As a result, the Ingress Controller will expose NGINX or NGINX Plus metrics in the Prometheus format via the path `/metrics` on port `9113` (customizable via the `-prometheus-metrics-listen-port` command-line argument).
+1. Run the Ingress Controller with the `-enable-prometheus-metrics` [command-line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}). As a result, the Ingress Controller will expose NGINX or NGINX Plus metrics in the Prometheus format via the path `/metrics` on port `9113` (customizable via the `-prometheus-metrics-listen-port` command-line argument).
 1. To enable TLS for the Prometheus endpoint, configure the `-prometheus-tls-secret` cli argument with the namespace and name of a TLS Secret.
 1. Add the Prometheus port to the list of the ports of the Ingress Controller container in the template of the Ingress Controller pod:
 
@@ -64,7 +64,7 @@ The Ingress Controller exports the following metrics:
   - `controller_nginx_last_reload_status`. Status of the last NGINX reload, 0 meaning down and 1 up.
   - `controller_nginx_last_reload_milliseconds`. Duration in milliseconds of the last NGINX reload.
   - `controller_nginx_worker_processes_total`. Number of NGINX worker processes. This metric includes the constant label `generation` with two possible values `old` (the shutting down processes of the old generations) or `current` (the processes of the current generation).
-  - `controller_ingress_resources_total`. Number of handled Ingress resources. This metric includes the label type, that groups the Ingress resources by their type (regular, [minion or master](/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration)). **Note**: The metric doesn't count minions without a master.
+  - `controller_ingress_resources_total`. Number of handled Ingress resources. This metric includes the label type, that groups the Ingress resources by their type (regular, [minion or master]({{< ref "/nic/configuration/ingress-resources/cross-namespace-configuration.md" >}}). **Note**: The metric doesn't count minions without a master.
   - `controller_virtualserver_resources_total`. Number of handled VirtualServer resources.
   - `controller_virtualserverroute_resources_total`. Number of handled VirtualServerRoute resources. **Note**: The metric counts only VirtualServerRoutes that have a reference from a VirtualServer.
   - `location_zone` (upstream services) metrics:
diff --git a/content/nic/logging-and-monitoring/service-insight.md b/content/nic/logging-and-monitoring/service-insight.md
index aefeb4d98..b2908d27c 100644
--- a/content/nic/logging-and-monitoring/service-insight.md
+++ b/content/nic/logging-and-monitoring/service-insight.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-1180
-doctypes:
-- ''
 title: Service Insight
 toc: true
 weight: 2100
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1180
 ---
 
 The Service Insight feature is available only for F5 NGINX Plus. The F5 NGINX Ingress Controller exposes an endpoint which provides host statistics for services exposed using the VirtualServer (VS) and TransportServer (TS) resources.
@@ -16,13 +16,13 @@ The response body holds information about the total, down and the unhealthy numb
 The service is indicated as not healthy (HTTP response code different than 200 OK) if all upstreams (pods) are determined unhealthy by NGINX Plus.
 The service is healthy if at least one upstream pod is healthy as determined by NGINX Plus. In this case, the endpoint returns HTTP code 200 OK.
 
-NGINX Plus determination of healthy can be tuned using advanced health checks, and also dynamically relate to pods responses and responsiveness.  See Upstream Healthcheck <https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#upstream>
+NGINX Plus determination of healthy can be tuned using advanced health checks, and also dynamically relate to pods responses and responsiveness.  See [Upstream Healthcheck]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#upstream" >}})
 
 ## Enabling Service Insight Endpoint
 
 If you're using *Kubernetes manifests* (Deployment or DaemonSet) to install the Ingress Controller, to enable the Service Insight endpoint:
 
-1. Run the Ingress Controller with the `-enable-service-insight` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments). This will expose the Ingress Controller endpoint via paths `/probe/{hostname}` for Virtual Servers, and `/probe/ts/{service_name}` for Transport Servers on port `9114` (customizable with the `-service-insight-listen-port` command-line argument). The `service_name` parameter refers to the name of the deployed service (the service specified under `upstreams` in the transport server).
+1. Run the Ingress Controller with the `-enable-service-insight` [command-line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}). This will expose the Ingress Controller endpoint via paths `/probe/{hostname}` for Virtual Servers, and `/probe/ts/{service_name}` for Transport Servers on port `9114` (customizable with the `-service-insight-listen-port` command-line argument). The `service_name` parameter refers to the name of the deployed service (the service specified under `upstreams` in the transport server).
 1. To enable TLS for the Service Insight endpoint, configure the `-service-insight-tls-secret` cli argument with the namespace and name of a TLS Secret.
 1. Add the Service Insight port to the list of the ports of the Ingress Controller container in the template of the Ingress Controller pod:
 
@@ -31,7 +31,7 @@ If you're using *Kubernetes manifests* (Deployment or DaemonSet) to install the
       containerPort: 9114
     ```
 
-If you're using *Helm* to install the Ingress Controller, to enable Service Insight endpoint, configure the `serviceInsight.*` parameters of the Helm chart. See the [Installation with Helm](/nginx-ingress-controller/installation/installing-nic/installation-with-helm) doc.
+If you're using *Helm* to install the Ingress Controller, to enable Service Insight endpoint, configure the `serviceInsight.*` parameters of the Helm chart. See the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) doc.
 
 ## Available Statistics and HTTP Response Codes
 
diff --git a/content/nic/logging-and-monitoring/status-page.md b/content/nic/logging-and-monitoring/status-page.md
index 246c3a475..0357f0fb1 100644
--- a/content/nic/logging-and-monitoring/status-page.md
+++ b/content/nic/logging-and-monitoring/status-page.md
@@ -1,26 +1,26 @@
 ---
-docs: DOCS-615
-doctypes:
-- ''
 title: Status Page
 toc: true
 weight: 1900
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-615
 ---
 
 This document explains how to get access to the stub status in NGINX and the dashboard in NGINX Plus.
 
 NGINX comes with a status page that reports basic metrics about NGINX called the [stub status](https://nginx.org/en/docs/http/ngx_http_stub_status_module.html).
 
-NGINX Plus comes with a [dashboard](https://docs.nginx.com/nginx/admin-guide/monitoring/live-activity-monitoring/) that reports key load-balancing and performance metrics.
+NGINX Plus comes with a [dashboard]({{< ref "/nginx/admin-guide/monitoring/live-activity-monitoring.md" >}}) that reports key load-balancing and performance metrics.
 
-NGINX App Protect DoS comes with a [dashboard](https://docs.nginx.com/nginx-app-protect-dos/monitoring/live-activity-monitoring/) that shows the status and information of the protected objects.
+NGINX App Protect DoS comes with a [dashboard]({{< ref "/nap-dos/monitoring/live-activity-monitoring.md" >}}) that shows the status and information of the protected objects.
 This doc shows how to get access to the stub status/dashboard.
 
 ## Accessing Stub Status
 
 Prerequisites:
 
-1. The stub status is enabled by default. Ensure that the `nginx-status` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments) is not set to false.
+1. The stub status is enabled by default. Ensure that the `nginx-status` [command-line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) is not set to false.
 1. The stub status is available on port 8080 by default. It is customizable by the `nginx-status-port` command-line argument. If yours is not on 8080, modify the kubectl proxy command below.
 
 To access the status:
@@ -42,7 +42,7 @@ If you want to access the stub status externally (without `kubectl port-forward`
 
 Prerequisites:
 
-1. The dashboard is enabled by default. Ensure that the `nginx-status` [command-line argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments)is not set to false.
+1. The dashboard is enabled by default. Ensure that the `nginx-status` [command-line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) is not set to false.
 1. The dashboard is available on port 8080 by default. It is customizable by the `nginx-status-port` command-line argument. If yours is not on 8080, modify the kubectl proxy command below.
 
 To access the dashboard:
diff --git a/content/nic/overview/controller-comparison.md b/content/nic/overview/controller-comparison.md
index 437e508c4..f4770395c 100644
--- a/content/nic/overview/controller-comparison.md
+++ b/content/nic/overview/controller-comparison.md
@@ -1,11 +1,11 @@
 ---
-docs: DOCS-610
-doctypes:
-- concept
-draft: true
 title: Which Ingress Controller Do I Need?
 toc: true
+draft: true
 weight: 400
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-610
 ---
 
 This document describes the key differences between the community Ingress-NGINX Controller and F5 NGINX Ingress Controller.
@@ -18,7 +18,7 @@ If you are unsure about which implementation you are using, check the container
 
 ## The Key Differences
 
-The table below summarizes the key difference between nginx/kubernetes-ingress and kubernetes/ingress-nginx Ingress Controllers. Note that the table has two columns for the nginx/kubernetes-ingress Ingress Controller, as it can be used both with NGINX and NGINX Plus. For more information about nginx/kubernetes-ingress with NGINX Plus, read the [NGINX Ingress Controller with NGINX Plus](/nginx-ingress-controller/intro/nginx-plus) documentation.
+The table below summarizes the key difference between nginx/kubernetes-ingress and kubernetes/ingress-nginx Ingress Controllers. Note that the table has two columns for the nginx/kubernetes-ingress Ingress Controller, as it can be used both with NGINX and NGINX Plus. For more information about nginx/kubernetes-ingress with NGINX Plus, read the [Extensibility with NGINX Plus]({{< ref "/nic/overview/nginx-plus.md" >}}) documentation.
 
 {{% table %}}
 | Aspect or Feature | kubernetes/ingress-nginx | nginx/kubernetes-ingress with NGINX | nginx/kubernetes-ingress with NGINX Plus |
@@ -29,8 +29,8 @@ The table below summarizes the key difference between nginx/kubernetes-ingress a
 | Commercial support | N/A | N/A | Included |
 | **Load balancing configuration via the Ingress resource** |
 | Merging Ingress rules with the same host | Supported | Supported via [Mergeable Ingresses](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/mergeable-ingress-types) | Supported via [Mergeable Ingresses](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/mergeable-ingress-types) |
-| HTTP load balancing extensions - Annotations | See the [supported annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) | See the [supported annotations](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/) | See the [supported annotations](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/)|
-| HTTP load balancing extensions -- ConfigMap | See the [supported ConfigMap keys](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/) | See the [supported ConfigMap keys](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) | See the [supported ConfigMap keys](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) |
+| HTTP load balancing extensions - Annotations | See the [supported annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) | See the [supported annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md" >}}) | See the [supported annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md#summary-of-annotations" >}})|
+| HTTP load balancing extensions -- ConfigMap | See the [supported ConfigMap keys](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/) | See the [supported ConfigMap keys]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) | See the [supported ConfigMap keys]({{< ref "/nic/configuration/global-configuration/configmap-resource.md" >}}) |
 | TCP/UDP | Supported via a ConfigMap | Supported via custom resources | Supported via custom resources |
 | Websocket  | Supported | Supported via an [annotation](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/websocket) | Supported via an [annotation](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/ingress-resources/websocket) |
 | TCP SSL Passthrough | Supported via a ConfigMap | Supported via custom resources | Supported via custom resources |
@@ -39,11 +39,11 @@ The table below summarizes the key difference between nginx/kubernetes-ingress a
 | Canary testing (by header, cookie, weight) | Supported via annotations | Supported via custom resources | Supported via custom resources |
 | Configuration templates *1 | See the [template](https://github.com/kubernetes/ingress-nginx/blob/main/rootfs/etc/nginx/template/nginx.tmpl) | See the [templates](../internal/configs/version1) | See the [templates](../internal/configs/version1) |
 | **Load balancing configuration via Custom Resources** |
-| HTTP load balancing | Not supported | See [VirtualServer and VirtualServerRoute](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) resources | See [VirtualServer and VirtualServerRoute](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) resources |
-| TCP/UDP load balancing | Not supported | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource |
-| TCP SSL Passthrough load balancing | Not supported | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource | See [TransportServer](https://docs.nginx.com/nginx-ingress-controller/configuration/transportserver-resource/) resource |
+| HTTP load balancing | Not supported | See [VirtualServer and VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}) resources | See [VirtualServer and VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}) resources |
+| TCP/UDP load balancing | Not supported | See [TransportServer]({{< ref "/nic/configuration/transportserver-resource.md" >}}) resource | See [TransportServer](({{< ref "/nic/configuration/transportserver-resource.md" >}}) resource |
+| TCP SSL Passthrough load balancing | Not supported | See [TransportServer]({{< ref "/nic/configuration/transportserver-resource.md" >}}) resource | See [TransportServer]({{< ref "/nic/configuration/transportserver-resource.md" >}}) resource |
 | **Deployment** |
-| Command-line arguments *2 | See the [arguments](https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/) | See the [arguments](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/) | See the [arguments](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/) |
+| Command-line arguments *2 | See the [arguments](https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/) | See the [arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) | See the [arguments]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md" >}}) |
 | TLS certificate and key for the default server | Required as a command-line argument/ auto-generated | Required as a command-line argument | Required as a command-line argument |
 | Helm chart | Supported | Supported | Supported |
 | Operator | Not supported | Supported | Supported |
diff --git a/content/nic/overview/design.md b/content/nic/overview/design.md
index 16dcbd967..14e99a5d0 100644
--- a/content/nic/overview/design.md
+++ b/content/nic/overview/design.md
@@ -38,8 +38,6 @@ The figure shows:
 
 The yellow and purple arrows represent connections related to the client traffic, and the black arrows represent access to the Kubernetes API.
 
----
-
 ## The NGINX Ingress Controller pod
 
 The NGINX Ingress Controller pod consists of a single container, which includes the following:
@@ -75,13 +73,11 @@ This table describes each connection, starting with its type:
 |16|Signal| The _NGINX master_ controls the [lifecycle of _NGINX workers_](https://nginx.org/en/docs/control.html#reconfiguration) it creates workers with the new configuration and shutdowns workers with the old configuration.
 |17|File I/O| An _NGINX worker_ writes logs to its _stdout_ and _stderr_, which are collected by the container runtime.
 |18|UDP| An _NGINX worker_ sends the HTTP upstream server response latency logs via the Syslog protocol over the UNIX socket `/var/lib/nginx/nginx-syslog.sock` to _NGINX Ingress Controller_. In turn, _NGINX Ingress Controller_ analyzes and transforms the logs into Prometheus metrics.
-|19|HTTP,HTTPS,TCP,UDP| A _client_ sends traffic to and receives traffic from any of the _NGINX workers_ on ports 80 and 443 and any additional ports exposed by the [GlobalConfiguration resource](/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource).
+|19|HTTP,HTTPS,TCP,UDP| A _client_ sends traffic to and receives traffic from any of the _NGINX workers_ on ports 80 and 443 and any additional ports exposed by the [GlobalConfiguration resource]({{< ref "/nic//configuration/global-configuration/globalconfiguration-resource.md" >}}).
 |20|HTTP,HTTPS,TCP,UDP| An _NGINX worker_ sends traffic to and receives traffic from the _backends_.
 |21|HTTP| _Admin_ can connect to the [NGINX stub_status](http://nginx.org/en/docs/http/ngx_http_stub_status_module.html#stub_status) using port 8080 via an _NGINX worker_. By default, NGINX only allows connections from `localhost`.
 {{% /bootstrap-table %}}
 
----
-
 ### Differences with NGINX Plus
 
 The previous diagram depicts NGINX Ingress Controller using NGINX. NGINX Ingress Controller with NGINX Plus has the following differences:
@@ -90,8 +86,6 @@ The previous diagram depicts NGINX Ingress Controller using NGINX. NGINX Ingress
 - Instead of the stub status metrics, the extended metrics available from the NGINX Plus API are used.
 - In addition to TLS certs and keys, NGINX Ingress Controller writes JWKs from the secrets of the type `nginx.org/jwk`, and NGINX workers read them.
 
----
-
 ## The NGINX Ingress Controller process
 
 This section covers the architecture of the NGINX Ingress Controller process, including:
@@ -100,8 +94,6 @@ This section covers the architecture of the NGINX Ingress Controller process, in
 - A summary of how NGINX Ingress Controller works in relation to others Kubernetes Controllers.
 - The different components of the IC process.
 
----
-
 ### Processing a new Ingress resource
 
 The following diagram depicts how NGINX Ingress Controller processes a new Ingress resource. The the NGINX master and worker processes are represented as a single rectangle, _NGINX_ for simplicity. VirtualServer and VirtualServerRoute resources are indicated similarly.
@@ -121,8 +113,6 @@ Processing a new Ingress resource involves the following steps: each step corres
     1. _NGINX_ reads the _configuration files_.
 1. The _Control Loop_ emits an event for the Ingress resource and updates its status. If the reload fails, the event includes the error message.
 
----
-
 ### NGINX Ingress Controller is a Kubernetes controller
 
 With the context from the previous sections, we can generalize how NGINX Ingress Controller works:
@@ -156,8 +146,6 @@ NGINX Ingress Controller can watch additional Custom Resources, which are less c
 - [NGINX App Protect resources]({{< ref "/nic/installation/integrations/app-protect-dos/configuration" >}}) (APPolicies, APLogConfs, APUserSigs)
 - IngressLink resource (only one resource)
 
----
-
 ## NGINX Ingress Controller process components
 
 In this section, we describe the components of the NGINX Ingress Controller process and how they interact, including:
@@ -183,8 +171,6 @@ We also mentioned that once the cache is updated, it notifies the control loop a
 - The _Workqueue_ always tries to drain itself: if there is an element at the front, the queue will remove the element and send it to the _Controller_ by calling a callback function (See the arrow _4. Send_).
 - The _Controller_ is the primary component of NGINX Ingress Controller, which represents the _Control Loop_, explained in [The Control Loop](#the-control-loop) section. To process a workqueue element, the _Controller_ component gets the latest version of the resource from the _Store_ (See the arrow _5. Get_), reconfigures _NGINX_ according to the resource (See the arrow _6. Reconfigure*_, updates the resource status, and emits an event via the _Kubernetes API_ (See the arrow  _7. Update status and emit event_).
 
----
-
 ### The control loop
 
 This section discusses the main components of NGINX Ingress Controller, which comprise the control loop:
@@ -205,8 +191,6 @@ The following diagram shows how the three components interact:
 
 {{<img src="/nic/control-loop.png" alt="">}}
 
----
-
 #### The Controller sync method
 
 The Controller [sync](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/controller.go#L663) method is called by the _Workqueue_ to process a change of a resource. The method determines the _kind_ of the resource and calls the appropriate _sync_ method (Such as _syncIngress_ for Ingress resources).
@@ -234,14 +218,10 @@ To explain how the sync methods work, we will examine the most important one: th
 - The _syncVirtualServer_, _syncVirtualServerRoute_, and _syncTransportServer_ methods are similar to _syncIngress_, while other sync methods are different. However, those methods typically find the affected Ingress, VirtualServer, and TransportServer resources and regenerate the configuration for them.
 - The _Workqueue_ has only a single worker thread that calls the sync method synchronously, meaning the _Control Loop_ processes only one change at a time.
 
----
-
 #### Helper components
 
 There are two additional helper components crucial for processing changes: _Configuration_ and _LocalSecretStore_.
 
----
-
 ##### Configuration
 
 [_Configuration_](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/configuration.go#L320) holds the latest valid state of the NGINX Ingress Controller load balancing configuration resources: Ingresses, VirtualServers, VirtualServerRoutes, TransportServers, and GlobalConfiguration.
@@ -257,22 +237,16 @@ Additionally, the _Configuration_ ensures that only one Ingress/VirtualServer/Tr
 
 Ultimately, NGINX Ingress Controller ensures the NGINX config on the filesystem reflects the state of the objects in the _Configuration_ at any point in time.
 
----
-
 ##### LocalSecretStore
 
 [_LocalSecretStore_](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/secrets/store.go#L32) (of the _SecretStore_ interface) holds the valid Secret resources and keeps the corresponding files on the filesystem in sync with them. Secrets are used to hold TLS certificates and keys (type `kubernetes.io/tls`), CAs (`nginx.org/ca`), JWKs (`nginx.org/jwk`), and client secrets for an OIDC provider (`nginx.org/oidc`).
 
 When _Controller_ processes a change to a configuration resource like Ingress, it creates an extended version of a resource that includes the dependencies (Such as Secrets) necessary to generate the NGINX configuration. _LocalSecretStore_ allows _Controller_ to reference the filesystem for a secret using the secret key (namespace/name).
 
----
-
 ## Reloading NGINX
 
 The following sections describe how NGINX reloads and how NGINX Ingress Controller specifically affects this process.
 
----
-
 ### How NGINX reloads work
 
 Reloading NGINX is necessary to apply new configuration changes and occurs with these steps:
@@ -283,8 +257,6 @@ Reloading NGINX is necessary to apply new configuration changes and occurs with
 
 The [NGINX documentation](https://nginx.org/en/docs/control.html#reconfiguration) has more details about reloading.
 
----
-
 #### How to reload NGINX and confirm success
 
 The NGINX binary (`nginx`) supports the reload operation with the `-s reload` option. When you run this option:
@@ -301,8 +273,6 @@ Once the reload operation has been invoked with `nginx -s reload`, there is no w
 
 NGINX reloads take roughly 200ms. The factors affecting reload time are configuration size and details, the number of TLS certificates/keys, enabled modules, and available CPU resources.
 
----
-
 #### Potential problems
 
 Most of the time, if `nginx -s reload` executes, the reload will also succeed. In the rare case a reload fails, the NGINX master process will print the an error message. This is an example:
@@ -315,8 +285,6 @@ The operation is graceful; reloading doesn't lead to any traffic loss by NGINX.
 
 Old NGINX workers will not shut down until all connections are terminated either by clients or backends, unless you configure [worker_shutdown_timeout](https://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout). Since both the old and new NGINX worker processes coexist during a reload, reloading can lead to two spikes in memory utilization. With a lack of available memory, the NGINX master process can fail to create new worker processes.
 
----
-
 ### Reloading in NGINX Ingress Controller
 
 NGINX Ingress Controller reloads NGINX to apply configuration changes.
@@ -333,8 +301,6 @@ Reloads occur with this sequence of steps:
 
 The [NGINX Ingress Controller Control Loop](#the-control-loop) stops during a reload so that it cannot affect configuration files or reload NGINX until the current reload succeeds or fails.
 
----
-
 ### When NGINX Ingress Controller reloads NGINX
 
 NGINX Ingress Controller reloads NGINX every time the Control Loop processes a change that affects the generated NGINX configuration. In general, every time a monitored resource is changed, NGINX Ingress Controller will regenerate the configuration and reload NGINX.
diff --git a/content/nic/releases.md b/content/nic/releases.md
index 8c8a585da..4738b69be 100644
--- a/content/nic/releases.md
+++ b/content/nic/releases.md
@@ -2,18 +2,18 @@
 title: Releases
 weight: 2100
 toc: true
-type: reference
-product: NIC
-docs: DOCS-616
+nd-content-type: reference
+nd-product: NIC
+nd-docs: DOCS-616
 ---
 ## 5.0.0
 
 16 Apr 2025
 
-Added support for [NGINX Plus R34](https://docs.nginx.com/nginx/releases/#nginxplusrelease-34-r34), users needing to use a forward proxy for license verification are now able to make use of the [`proxy`](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy) directives available in F5 NGINX Plus.
+Added support for [NGINX Plus R34]({{< ref "/nginx/releases.md#nginxplusrelease-34-r34" >}}), users needing to use a forward proxy for license verification are now able to make use of the [`proxy`](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy) directives available in F5 NGINX Plus.
 
 {{< important >}}
-With the removal of the OpenTracing dynamic module from [NGINX Plus R34](https://docs.nginx.com/nginx/releases/#nginxplusrelease-34-r34), NGINX Ingress Controller also removes full OpenTracing support.  This will affect users making use of OpenTracing with the ConfigMap, `server-snippets` & `location-snippets` parameters.  Support for tracing with [OpenTelemetry](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/opentelemetry/) will come in a future release.
+With the removal of the OpenTracing dynamic module from [NGINX Plus R34](({{< ref "/nginx/releases.md#nginxplusrelease-34-r34" >}}), NGINX Ingress Controller also removes full OpenTracing support.  This will affect users making use of OpenTracing with the ConfigMap, `server-snippets` & `location-snippets` parameters.  Support for tracing with [OpenTelemetry]({{< ref "/nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) will come in a future release.
 {{< /important >}}
 
 We have extended the rate-limit Policy to allow tiered rate limit groups with JWT claims.  This will also allow users to apply different rate limits to their `VirtualServer` or `VirtualServerRoutes` with the value of a JWT claim.  See [here](https://github.com/nginx/kubernetes-ingress/tree/v5.0.0/examples/custom-resources/rate-limit-tiered-jwt-claim/) for a working example.
@@ -102,11 +102,11 @@ versions: 1.25-1.32.
 
 16 Dec 2024
 
-With added support for [NGINX R33](https://docs.nginx.com/nginx/releases/#nginxplusrelease-33-r33), deployments of F5 NGINX Ingress Controller using NGINX Plus now require a valid JSON Web Token to run.
-Please see the [Upgrading to v4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4#create-license-secret" >}}) for full details on setting up your license `Secret`.
+With added support for [NGINX R33]({{< ref "/nginx/releases.md#nginxplusrelease-33-r33" >}}), deployments of F5 NGINX Ingress Controller using NGINX Plus now require a valid JSON Web Token to run.
+Please see the [Upgrading to v4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4.md#create-license-secret" >}}) for full details on setting up your license `Secret`.
 
 API Version `v1alpha1` of `GlobalConfiguration`, `Policy` and `TransportServer` resources are now deprecated.
-Please see [Update custom resource apiVersion]({{< ref "/nic/installation/installing-nic/upgrade-to-v4#update-custom-resource-apiversion" >}}) for full details on updating your resources.
+Please see [Update custom resource apiVersion]({{< ref "/nic/installation/installing-nic/upgrade-to-v4.md#update-custom-resource-apiversion" >}}) for full details on updating your resources.
 
 Updates have been made to our logging library. For a while, F5 NGINX Ingress Controller has been using the [golang/glog](https://github.com/golang/glog). For this release, we have moved to the native golang library [log/slog](https://pkg.go.dev/log/slog).
 This change was made for these reasons:
@@ -150,7 +150,7 @@ For more details on what this feature does, and how to configure it yourself, pl
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
 - For NGINX Plus, use the 4.0.0 images from the F5 Container registry or build your own image using the 4.0.0 source code
 - For Helm, use version 2.0.0 of the chart.
-- [Upgrading to v4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4" >}})
+- [Upgrading to v4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4.md" >}})
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
 
@@ -197,10 +197,7 @@ When `v4.0.0` is released, the release notes will contain the required upgrade s
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.7.2),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.7.2 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.7.2 source code
+- For NGINX Plus, use the 3.7.2 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.7.2 source code.
 - For Helm, use version 1.4.2 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -229,10 +226,7 @@ versions: 1.25-1.31.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.7.1),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.7.1 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.7.1 source code
+- For NGINX Plus, use the 3.7.1 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.7.1 source code.
 - For Helm, use version 1.4.1 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -290,10 +284,7 @@ When installing NGINX Ingress Controller via Helm, a uniquely named lease object
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.7.0),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.7.0 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.7.0 source code
+- For NGINX Plus, use the 3.7.0 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.7.0 source code.
 - For Helm, use version 1.4.0 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -321,10 +312,7 @@ versions: 1.25-1.31.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.6.2),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.6.2 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.6.2 source code
+- For NGINX Plus, use the 3.6.2 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace, or build your own image using the 3.6.2 source code.
 - For Helm, use version 1.3.2 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -353,10 +341,7 @@ versions: 1.25-1.31.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.6.1),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.6.1 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking), the [Azure Marketplace](https://azuremarketplace.microsoft.com/en-gb/marketplace/apps/category/containers?page=1&search=f5&subcategories=container-apps)
-or build your own image using the 3.6.1 source code
+- For NGINX Plus, use the 3.6.1 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace, the Azure Marketplace or build your own image using the 3.6.1 source code.
 - For Helm, use version 1.3.1 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -371,7 +356,7 @@ versions: 1.25-1.30.
 25 Jun 2024
 
 Added support for the latest generation of NGINX App Protect Web Application Firewall, v5. NGINX Ingress Controller will continue to support the NGINX App Protect v4 family to allow customers to implement new Policy Bundle workflow at their own pace.
-NGINX App Protect WAF v5 does not accept the JSON based policies, instead requiring users to compile a Policy Bundle outside of the NGINX Ingress Controller pod. Policy bundles contain a combination of custom Policy, signatures, and campaigns. Bundles can be compiled using either App Protect [compiler](https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/compiler/), or [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/nginx-app-protect/manage-waf-security-policies/#list-security-policy-bundles). Read more in the [NGINX App Protect WAF V5]({{< ref "/nic/installation/integrations/app-protect-waf-v5/" >}})  topic.
+NGINX App Protect WAF v5 does not accept the JSON based policies, instead requiring users to compile a Policy Bundle outside of the NGINX Ingress Controller pod. Policy bundles contain a combination of custom Policy, signatures, and campaigns. Bundles can be compiled using either App Protect [compiler]({{< ref "/nap-waf/v5/admin-guide/compiler/" >}}), or [NGINX Instance Manager]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies.md#list-security-policy-bundles" >}}). Read more in the [NGINX App Protect WAF V5]({{< ref "/nic/installation/integrations/app-protect-waf-v5/" >}})  topic.
 
 With this release, NGINX Ingress Controller is implementing a new image maintenance policy. Container images for subscribed users will be updated on a regular basis in-between releases to reduce the CVE vulnerabilities.
 Customers can observe the 3.6.x tag when listing images in the registry and select the latest image to update to for the current release.
@@ -402,10 +387,7 @@ Customers can observe the 3.6.x tag when listing images in the registry and sele
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.6.0),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.6.0 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking), the [Azure Marketplace](https://azuremarketplace.microsoft.com/en-gb/marketplace/apps/category/containers?page=1&search=f5&subcategories=container-apps)
-or build your own image using the 3.6.0 source code
+- For NGINX Plus, use the 3.6.0 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace, the Azure Marketplace or build your own image using the 3.6.0 source code.
 - For Helm, use version 1.3.0 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -436,10 +418,7 @@ versions: 1.25-1.30.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.5.2),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.5.2 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking), the [Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/nginxinc.nginx_ingress_premium?tab=Overview),
-or build your own image using the 3.5.2 source code
+- For NGINX Plus, use the 3.5.2 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace, the Azure Marketplace, or build your own image using the 3.5.2 source code
 - For Helm, use version 1.2.2 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -470,10 +449,7 @@ versions: 1.25-1.30.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.5.1),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.5.1 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.5.1 source code
+- For NGINX Plus, use the 3.5.1 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.5.1 source code.
 - For Helm, use version 1.2.1 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -486,7 +462,7 @@ versions: 1.23-1.29.
 
 26 Mar 2024
 
-NGINX Ingress Controller and NGINX App Protect WAF users can can now view violations through NGINX Instance Manager Security Monitor.  Security Monitor can be used to build Policy bundles, reducing reload time impacts on NGINX Ingress Controller.  Read more information in [NGINX App Protect WAF Bundles]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) and [Security Monitoring](https://docs.nginx.com/nginx-instance-manager/monitoring/security-monitoring/).
+NGINX Ingress Controller and NGINX App Protect WAF users can can now view violations through NGINX Instance Manager Security Monitor.  Security Monitor can be used to build Policy bundles, reducing reload time impacts on NGINX Ingress Controller.  Read more information in [NGINX App Protect WAF Bundles]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) and Security Monitoring.
 
 When using NGINX Plus for two version [split rollouts]({{ ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#split" }}), you can now control progressive rollouts of a new backend version without reloading NGINX using the [**-weight-changes-dynamic-reload**]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#-weight-changes-dynamic-reload" >}}) command line argument.
 
@@ -522,10 +498,7 @@ The [**use-cluster-ip**]({{< ref "/nic/configuration/ingress-resources/advanced-
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.5.0),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.5.0 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.5.0 source code
+- For NGINX Plus, use the 3.5.0 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.5.0 source code.
 - For Helm, use version 1.2.0 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -565,10 +538,7 @@ versions: 1.23-1.29.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.3),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.4.3 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.4.3 source code
+- For NGINX Plus, use the 3.4.3 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.4.3 source code.
 - For Helm, use version 1.1.3 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -590,10 +560,7 @@ versions: 1.23-1.29.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.2),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.4.2 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.4.2 source code
+- For NGINX Plus, use the 3.4.2 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.4.2 source code.
 - For Helm, use version 1.1.2 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -616,10 +583,7 @@ versions: 1.23-1.29.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.1),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.4.1 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.4.1 source code
+- For NGINX Plus, use the 3.4.1 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.4.1 source code.
 - For Helm, use version 1.1.1 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -676,10 +640,7 @@ We’ve added the functionality to define App Protect WAF bundles for VirtualSer
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.4.0),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.4.0 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.4.0 source code
+- For NGINX Plus, use the 3.4.0 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.4.0 source code.
 - For Helm, use version 1.1.0 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -708,14 +669,9 @@ versions: 1.22-1.29.
 [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.3.2),
 [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
 [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.3.2 images from the F5 Container registry,
-the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE),
-the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking)
-or build your own image using the 3.3.2 source code
+- For NGINX Plus, use the 3.3.2 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.3.2 source code.
 - For Helm, use version 1.0.2 of the chart.
 
-<hr>
-
 ## 3.3.1
 
 13 Oct 2023
@@ -732,9 +688,7 @@ This releases updates NGINX Plus to R30 P1 and dependencies to mitigate HTTP/2 R
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 3.3.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.3.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.3.1 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.3.1 source code
-
-<hr>
+- For NGINX Plus, use the 3.3.1 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.3.1 source code
 
 ## 3.3.0
 
@@ -797,7 +751,7 @@ listeners so they can tailor to their specific needs and policies.
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 3.3.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.3.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.3.0 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.3.0 source code
+- For NGINX Plus, use the 3.3.0 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.3.0 source code.
 - For Helm, use version 1.0.0 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -819,7 +773,7 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 3.2.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.2.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.2.1 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.2.1 source code
+- For NGINX Plus, use the 3.2.1 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.2.1 source code.
 - For Helm, use version 0.18.1 of the chart.
 
 <hr>
@@ -861,7 +815,7 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 3.2.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.2.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.2.0 images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the 3.2.0 source code.
+- For NGINX Plus, use the 3.2.0 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the 3.2.0 source code.
 - For Helm, use version 0.18.0 of the chart.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -1072,7 +1026,7 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 
 - Make sure the Kubernetes version is in the supported platforms listed below.
 - For NGINX, use the 3.0.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=3.0.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
-- For NGINX Plus, use the 3.0.0 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 3.0.0 source code.
+- For NGINX Plus, use the 3.0.0 images from the F5 Container registry or the AWS Marketplace or build your own image using the 3.0.0 source code.
 - For Helm, use version 0.16.0 of the chart. Helm does not upgrade the CRDs. If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -1116,7 +1070,7 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 2.4.1 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.4.1), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the 2.4.1 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.4.1 source code.
+- For NGINX Plus, use the 2.4.1 images from the F5 Container registry or the AWS Marketplace or build your own image using the 2.4.1 source code.
 - For Helm, use version 0.15.1 of the chart.
 
 <hr>
@@ -1181,7 +1135,7 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 2.4.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.4.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
-- For NGINX Plus, use the 2.4.0 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.4.0 source code.
+- For NGINX Plus, use the 2.4.0 images from the F5 Container registry or the AWS Marketplace or build your own image using the 2.4.0 source code.
 - For Helm, use version 0.15.0 of the chart. If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after you run the `helm upgrade` command, the CRDs will not be upgraded. After running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
 
 ### <i class="fa-solid fa-life-ring"></i> Supported Platforms
@@ -1263,7 +1217,7 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 2.3.0 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.3.0), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
-- For NGINX Plus, use the 2.3.0 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.3.0 source code.
+- For NGINX Plus, use the 2.3.0 images from the F5 Container registry or the AWS Marketplace or build your own image using the 2.3.0 source code.
 - For Helm, use version 0.14.0 of the chart. If you're using custom resources like VirtualServer and TransportServer (`controller.enableCustomResources` is set to `true`), after you run the `helm upgrade` command, the CRDs will not be upgraded. After running the `helm upgrade` command, run `kubectl apply -f deployments/helm-chart/crds` to upgrade the CRDs.
 - When upgrading using [Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), make sure to update the [ClusterRole](https://github.com/nginx/kubernetes-ingress/blob/v2.3.1/deployments/rbac/rbac.yaml). This is required to enable the ExternalDNS for VirtualServer resources integration.
 
@@ -1360,8 +1314,6 @@ the documentation here
 
 We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and which passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: 1.19-1.23.
 
-<hr>
-
 ## 2.1.2
 
 29 March 2022
@@ -1373,7 +1325,7 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 ### <i class="fa-solid fa-download"></i> Upgrade
 
 - For NGINX, use the 2.1.2 images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=2.1.2), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress) or [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress).
-- For NGINX Plus, use the 2.1.2 images from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the 2.1.2 source code.
+- For NGINX Plus, use the 2.1.2 images from the F5 Container registry or the AWS Marketplace or build your own image using the 2.1.2 source code.
 - For Helm, use version 0.12.2 of the chart.
 
 <hr>
@@ -1430,10 +1382,10 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 
 - Full support for gRPC services using the NGINX Ingress Controller [VirtualServer and VirtualServerRoute]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}) custom resource definitions.  This makes configuring and supporting gRPC services much easier, giving a simple YAML configuration and removing the need for snippets. Resource definition examples for gRPC can be found [here](https://github.com/nginx/kubernetes-ingress/tree/v2.1.1/examples/custom-resources/grpc-upstreams).
 
-- Implementation of NGINX mandatory and persistent health checks in VirtualServer and VirtualServerRoute to further reduce interruptions to your service traffic as configuration changes continuously happen in your dynamic Kubernetes environment(s). Health checks have been extended to include `mandatory` and `persistent` fields. Mandatory health checks ensures that a new upstream server starts receiving traffic only after the health check passes. Mandatory health checks can be marked as persistent, so that the previous state is remembered when the Ingress Controller reloads NGINX Plus configuration. When combined with the slow-start parameter, the mandatory health check give a new upstream server more time to connect to databases and “warm up” before being asked to handle their full share of traffic. See the settings [here]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#upstreamhealthcheck" >}}). More about the [NGINX Plus mandatory and persistent health check features](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#mandatory-health-checks).
+- Implementation of NGINX mandatory and persistent health checks in VirtualServer and VirtualServerRoute to further reduce interruptions to your service traffic as configuration changes continuously happen in your dynamic Kubernetes environment(s). Health checks have been extended to include `mandatory` and `persistent` fields. Mandatory health checks ensures that a new upstream server starts receiving traffic only after the health check passes. Mandatory health checks can be marked as persistent, so that the previous state is remembered when the Ingress Controller reloads NGINX Plus configuration. When combined with the slow-start parameter, the mandatory health check give a new upstream server more time to connect to databases and “warm up” before being asked to handle their full share of traffic. See the settings [here]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#upstreamhealthcheck" >}}). More about the [NGINX Plus mandatory and persistent health check features]({{< ref "/nginx/admin-guide/load-balancer/http-health-check.md#mandatory-health-checks" >}}).
 Mandatory health checks can be marked as persistent, so that the previous state is remembered when reloading configuration. When combined with the slow-start parameter, it gives a new service pod more time to connect to databases and “warm up” before being asked to handle their full share of traffic.
 See the settings [here]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#upstreamhealthcheck" >}}).
-More about the [NGINX Plus mandatory and persistent health check features](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#mandatory-health-checks)
+More about the [NGINX Plus mandatory and persistent health check features]({{< ref "/nginx/admin-guide/load-balancer/http-health-check.md#mandatory-health-checks" >}})
 
 ### <i class="fa-solid fa-rocket"></i> Features
 
@@ -1589,7 +1541,7 @@ Release 2.0.0 includes:
 
      We migrated all our documentation and examples to use `networking.k8s.io/v1` and the `ingressClassName` field of the Ingress resource.
 - *Scalability improvements*. We improved the time for an Ingress Controller pod to become ready and start receiving traffic. This is especially noticeable when you have hundreds of Ingress or other configuration resources like VirtualServers: instead of several minutes or more in rare cases, a pod will become ready within a few minutes.
-- *Documentation improvements* We changed the look and feel of our documentation at <https://docs.nginx.com/nginx-ingress-controller> as well as the underlying publishing technology, which will allow us to bring even more improvements in the next releases.
+- *Documentation improvements* We changed the look and feel of our documentation as well as the underlying publishing technology, which will allow us to bring even more improvements in the next releases.
 - *Upgrade path for k8s.nginx.org/v1alpha1 Policy resource* If you’re running release 1.9.0 and using the k8s.nginx.org/v1alpha1 Policy, the Ingress Controller now supports an upgrade path from v1alpha1 to v1 Policy version without downtime. See UPDATING POLICIES section below.
 
 You will find the complete changelog for release 2.0.0, including bug fixes, improvements, and changes below.
@@ -1686,8 +1638,6 @@ We will provide technical support for NGINX Ingress Controller on any Kubernetes
 - Alternatively, you can also build your own image using the 1.12.1 source code.
 - For Helm, use version 0.10.1 of the chart.
 
-<hr>
-
 ## 1.12.0
 
 30 June 2021
@@ -1851,7 +1801,7 @@ You will find the complete changelog for release 1.11.0, including bug fixes, im
 
 ### <i class="fa-solid fa-download"></i> Upgrade
 
-- For NGINX, use the 1.11.0 image from our DockerHub: `nginx/nginx-ingress:1.11.0`, `nginx/nginx-ingress:1.11.0-alpine` or `nginx-ingress:1.11.0-ubi`
+-- For NGINX, use the 1.11.0 image from our DockerHub: `nginx/nginx-ingress:1.11.0`, `nginx/nginx-ingress:1.11.0-alpine` or `nginx-ingress:1.11.0-ubi`
 - For NGINX Plus, please build your own image using the 1.11.0 source code.
 - For Helm, use version 0.9.0 of the chart.
 - [1241](https://github.com/nginx/kubernetes-ingress/pull/1241) improved the Makefile. As a result, the commands for building the Ingress Controller image were changed. See the updated commands [here]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}).
@@ -2029,7 +1979,7 @@ You will find the complete changelog for release 1.9.0, including bug fixes, imp
 - [1120](https://github.com/nginx/kubernetes-ingress/pull/1120) Add RateLimit policy support.
 - [1058](https://github.com/nginx/kubernetes-ingress/pull/1058) Support policies in VS routes and VSR subroutes.
 - [1147](https://github.com/nginx/kubernetes-ingress/pull/1147) Add option to specify other log destinations in AppProtect.
-- [1131](https://github.com/nginx/kubernetes-ingress/pull/1131) Update packages and CRDs to AppProtect 2.0. This update includes features such as: [JSON Schema Validation](https://docs.nginx.com/nginx-app-protect/configuration#applying-a-json-schema), [User-Defined URLs](https://docs.nginx.com/nginx-app-protect/configuration/#user-defined-urls) and [User-Defined Parameters](https://docs.nginx.com/nginx-app-protect/configuration/#user-defined-parameters). See the [release notes](https://docs.nginx.com/nginx-app-protect/releases/#release-2-0) for a complete feature list.
+- [1131](https://github.com/nginx/kubernetes-ingress/pull/1131) Update packages and CRDs to AppProtect 2.0. This update includes features such as: [JSON Schema Validation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#applying-a-json-schema" >}}), [User-Defined URLs]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-urls" >}}) and [User-Defined Parameters]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-parameters" >}}). See the [release notes]({{< ref "/nap-waf/v4/releases/about-2.0.md" >}}) for a complete feature list.
 - [1100](https://github.com/nginx/kubernetes-ingress/pull/1100) Add external references to AppProtect.
 - [1085](https://github.com/nginx/kubernetes-ingress/pull/1085) Add installation of threat campaigns package.
 - [1133](https://github.com/nginx/kubernetes-ingress/pull/1133) Add support for IngressClass resources.
@@ -2251,7 +2201,7 @@ FEATURES FOR VIRTUALSERVER AND VIRTUALSERVERROUTE RESOURCES:
 - For NGINX Plus, please build your own image using the 1.7.0 source code.
 - For Helm, use version 0.5.0 of the chart.
 
-When upgrading using the [manifests](/nginx-ingress-controller/installation/installation-with-manifests/), make sure to deploy the new TransportServer CRD (`common/ts-definition.yaml`), as it is required by the Ingress Controller. Otherwise, you will get error messages in the Ingress Controller logs.
+When upgrading using the [manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}), make sure to deploy the new TransportServer CRD (`common/ts-definition.yaml`), as it is required by the Ingress Controller. Otherwise, you will get error messages in the Ingress Controller logs.
 
 <hr>
 
@@ -2404,4 +2354,4 @@ Otherwise, the helm upgrade will not succeed.
 
 ## Previous Releases
 
-To see the previous releases, see the [Releases page](https://github.com/nginx/kubernetes-ingress/releases) on the Ingress Controller GitHub repo.
+To see the previous releases, see the [Releases page](https://github.com/nginx/kubernetes-ingress/releases) on the Ingress Controller GitHub repo.
\ No newline at end of file
diff --git a/content/nic/tutorials/ingress-path-regex-annotation.md b/content/nic/tutorials/ingress-path-regex-annotation.md
index 73d151bcc..9cee69351 100644
--- a/content/nic/tutorials/ingress-path-regex-annotation.md
+++ b/content/nic/tutorials/ingress-path-regex-annotation.md
@@ -1,17 +1,17 @@
 ---
-docs: DOCS-1451
-doctypes:
-- concept
 title: Ingresses Path Matching Using Path-Regex Annotation
 toc: true
 weight: 1800
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1451
 ---
 
 This document describes how to customize Ingress and Mergeable Ingress types with path-regex annotations.
 
 ## Customizing NGINX Ingress Controller with Path-Regex Annotations
 
-We suggest reading the NGINX [documentation on resolve location priority](https://docs.nginx.com/nginx/admin-guide/web-server/web-server/#nginx-location-priority)
+We suggest reading the NGINX [documentation on resolve location priority]({{< ref "/nginx/admin-guide/web-server/web-server.md#nginx-location-priority" >}})
 to gain additional context about NGINX and NGINX Plus before using the ``path-regex`` annotation.
 
 ## Ingress Type
diff --git a/content/nic/tutorials/nginx-dynamic-module.md b/content/nic/tutorials/nginx-dynamic-module.md
index bdf5da70d..46eb19a3c 100644
--- a/content/nic/tutorials/nginx-dynamic-module.md
+++ b/content/nic/tutorials/nginx-dynamic-module.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-1231
-doctypes:
-- concept
 title: Using NGINX Ingress Controller with NGINX Dynamic Modules
 toc: true
 weight: 1800
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1231
 ---
 
 This document describes how to use NGINX Ingress Controller with NGINX dynamic modules.
@@ -13,7 +13,7 @@ This document describes how to use NGINX Ingress Controller with NGINX dynamic m
 
 NGINX Plus has several Dynamic Modules that can add additional features and capabilities to NGINX, which NGINX Ingress Controller can also use. To do this, you must modify your NGINX Ingress Controller image to add a module, then load the updated image.
 
-For more information about Dynamic Modules, you can read [the documentation for NGINX Plus](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/dynamic-modules/).
+For more information about Dynamic Modules, you can read [the documentation for NGINX Plus]({{< ref "/nginx/admin-guide/dynamic-modules/dynamic-modules.md" >}}).
 
 There are two steps involved:
 
diff --git a/content/nic/tutorials/nginx-ingress-istio.md b/content/nic/tutorials/nginx-ingress-istio.md
index 63ab47ff5..0a200ae92 100644
--- a/content/nic/tutorials/nginx-ingress-istio.md
+++ b/content/nic/tutorials/nginx-ingress-istio.md
@@ -1,18 +1,18 @@
 ---
-docs: DOCS-889
-doctypes:
-- concept
 title: NGINX Ingress Controller and Istio Service Mesh
 toc: true
 weight: 1800
+nd-content-type: concept
+nd-product: NIC
+nd-docs: DOCS-889
 ---
 
 NGINX Ingress Controller can be used as the Ingress Controller for applications running inside an Istio service mesh. This allows you to continue using the advanced capabilities that NGINX IC provides on Istio-based environments without resorting to any workarounds.
-This is accomplished using the special setting [use-cluster-ip](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#upstream) for the backend.
+This is accomplished using the special setting [use-cluster-ip]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md#upstream" >}}) for the backend.
 
 Here is a standard deployment of NGINX Ingress Controller without a sidecar proxy injected into the pod.
 
-{{< img src="./img/nginx_plain.png" alt="NGINX stand alone." >}}
+{{< img src="/nic/nginx_plain.png" alt="NGINX stand alone." >}}
 
 Notice that NGINX Ingress Controller enumerates the pods of the backend service and balances traffic directly to them, granting full control of the backend load balancer and stickiness behavior.
 If your service pods support TLS, then NIC can re-encrypt the traffic to them and provide end-to-end encryption.
@@ -67,7 +67,7 @@ Now, our deployment will look like the following (with Envoy sidecar proxies).
 
 The image below shows how an NGINX Ingress Controller and Istio deployment looks:
 
-{{< img src="./img/nginx-envoy.png" alt="NGINX with envoy sidecar." >}}
+{{< img src="/nic/nginx-envoy.png" alt="NGINX with envoy sidecar." >}}
 
 ## Install NGINX Ingress Controller
 
@@ -111,7 +111,7 @@ spec:
         sidecar.istio.io/inject: 'true'
 ```
 
-{{< img src="./img/nginx_istio_small.png" alt="NGINX Ingress pod with envoy sidecar." >}}
+{{< img src="/nic/nginx_istio_small.png" alt="NGINX Ingress pod with envoy sidecar." >}}
 
 We can now see that after configuring Istio, an Istio sidecar proxy has been installed into the same pod as NGINX Ingress Controller. Now, there are two containers in the same pod for NGINX Ingress Controller: the NGINX Ingress controller container and the Istio sidecar proxy container.
 
diff --git a/content/nic/tutorials/nginx-ingress-linkerd.md b/content/nic/tutorials/nginx-ingress-linkerd.md
index 9910e9ef8..91cba6fd6 100644
--- a/content/nic/tutorials/nginx-ingress-linkerd.md
+++ b/content/nic/tutorials/nginx-ingress-linkerd.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-1450
-doctypes:
-- concept
 title: NGINX Ingress Controller and Linkerd
 toc: true
 weight: 1800
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1450
 ---
 
 This document explains how to integrate NGINX Ingress Controller with Linkerd using Linkerd's sidecar proxy. Linkerd works with both NGINX Ingress Controller open source and NGINX Ingress Controller using NGINX Plus.
@@ -37,7 +37,7 @@ You can do this through the use of NGINX Ingress Controller's custom resource de
 
 **Using Manifests**
 
-When installing NGINX Ingress Controller, you can [create a custom resource](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/#3-create-custom-resources) for Linkerd.
+When installing NGINX Ingress Controller, you can [create a custom resource]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md#create-optional-custom-resources" >}}) for Linkerd.
 
 ```yaml
 apiVersion: apps/v1
diff --git a/content/nic/tutorials/nginx-ingress-osm.md b/content/nic/tutorials/nginx-ingress-osm.md
index 7c5b55b0b..5b5b61307 100644
--- a/content/nic/tutorials/nginx-ingress-osm.md
+++ b/content/nic/tutorials/nginx-ingress-osm.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-1181
-doctypes:
-- concept
 title: NGINX Ingress Controller and Open Service Mesh
 toc: true
 weight: 1800
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1181
 ---
 
 
@@ -12,9 +12,6 @@ This document outlines how to integrate F5 NGINX Ingress Controller with Open Se
 
 Open Service Mesh will work with both versions of [F5 NGINX Ingress controller](https://github.com/nginx/kubernetes-ingress): the free as well as the NGINX Plus versions.
 
-Below is a link to the official F5 NGINX Ingress Controller documentation.
-[F5 NGINX Ingress controller](https://docs.nginx.com/nginx-ingress-controller/)
-
 # Integrating NGINX Ingress Controller with Open Service Mesh
 
 There are two ways to integrate NGINX Ingress Controller with Open Service Mesh (OSM):
@@ -53,8 +50,8 @@ The above command will use the mark the `nginx-ingress` namespace, where OSM wil
 
 Links to the complete install guides:
 
-[Using Helm to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-helm/)
-[Using Manifests to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
+[Using Helm to install NGINX Ingress]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}})
+[Using Manifests to install NGINX Ingress]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}})
 
 When using the sidecar method, ensure that you add the correct annotations listed below. This ensures proper integration of NGINX Ingress Controller with the envoy sidecar proxy.
 
@@ -224,8 +221,8 @@ osm namespace add nginx-ingress --mesh-name osm-nginx --disable-sidecar-injectio
 
 Links to the complete install guides:
 
-[Using Helm to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-helm/)
-[Using Manifests to install NGINX Ingress](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
+[Using Helm to install NGINX Ingress]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}})
+[Using Manifests to install NGINX Ingress]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}})
 
 *NOTE*: This method does NOT require annotations added to the deployment, compared to the sidecar install method.
 
diff --git a/content/nic/tutorials/security-monitoring.md b/content/nic/tutorials/security-monitoring.md
index a859b7b58..d41478b06 100644
--- a/content/nic/tutorials/security-monitoring.md
+++ b/content/nic/tutorials/security-monitoring.md
@@ -1,18 +1,18 @@
 ---
-doctypes:
-- concept
 title: Connect NGINX App Protect WAF to NGINX Security Monitoring
 toc: true
 weight: 1800
+nd-content-type: how-to
+nd-product: NIC
 ---
 
 This document explains how to use NGINX Ingress Controller to configure NGINX Agent for sending F5 NGINX App Protect WAF metrics to NGINX Security Monitoring.
 
 ## Prerequisites
 
-This guide assumes that you have an installation of NGINX Instance Manager with [NGINX Security Monitoring](https://docs.nginx.com/nginx-instance-manager/monitoring/security-monitoring/deploy/install-security-monitoring/) which is reachable from the Kubernetes cluster on which NGINX Ingress Controller is deployed.
+This guide assumes that you have an installation of NGINX Instance Manager with NGINX Security Monitoring which is reachable from the Kubernetes cluster on which NGINX Ingress Controller is deployed.
 
-If you use custom container images, NGINX Agent must be installed along with NGINX App Protect WAF. See the [Dockerfile](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/build/Dockerfile) for examples of how to install NGINX Agent or the [NGINX Agent installation documentation](https://docs.nginx.com/nginx-agent/installation-upgrade/) for more information.
+If you use custom container images, NGINX Agent must be installed along with NGINX App Protect WAF. See the [Dockerfile](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/build/Dockerfile) for examples of how to install NGINX Agent or the [NGINX Agent installation documentation]({{< ref "/agent/installation-upgrade/" >}}) for more information.
 
 ## Deploying NGINX Ingress Controller with NGINX Agent configuration
 
@@ -74,7 +74,7 @@ If you use custom container images, NGINX Agent must be installed along with NGI
           syslog_ip: 127.0.0.1
           syslog_port: 1514
    ```
-   See the [NGINX Agent Configuration Overview](https://docs.nginx.com/nginx-agent/configuration/configuration-overview/) for more configuration options.
+   See the [NGINX Agent Configuration Overview]({{< ref "/agent/configuration/configuration-overview.md" >}}) for more configuration options.
 
 {{< note >}} The `features` list must not contain `nginx-config-async` or `nginx-ssl-config` as these features can cause conflicts with NGINX Ingress Controller.{{< /note >}}
 
diff --git a/content/nic/usage-reporting.md b/content/nic/usage-reporting.md
index 0690a2679..f756237bc 100644
--- a/content/nic/usage-reporting.md
+++ b/content/nic/usage-reporting.md
@@ -4,9 +4,9 @@ toc: true
 weight: 1800
 noindex: true
 headless: true
-type: how-to
-product: NIC
-docs: DOCS-1445
+nd-content-type: how-to
+nd-product: NIC
+nd-docs: DOCS-1445
 ---
 
 {{< important >}}
@@ -32,8 +32,8 @@ To use Usage Reporting, you must have access to NGINX Instance Manager. For more
 
 To deploy Usage Reporting, you must have the following:
 
-- [NGINX Ingress Controller](https://docs.nginx.com/nginx-ingress-controller) 3.2.0 - 3.7.2
-- [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager) 2.11.0 or later
+- [NGINX Ingress Controller]({{< ref "/nic/" >}}) 3.2.0 - 3.7.2
+- [NGINX Instance Manager]({{< ref "/nim/" >}}) 2.11.0 or later
 
 In addition to the software requirements, you will need:
 
@@ -49,12 +49,12 @@ In addition to the software requirements, you will need:
 
 Usage Reporting needs a user account to send usage data to NGINX Instance Manager: these are the steps involved.
 
-1. Create a role following the steps in [Create a Role](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/create-roles/#create-roles) section of the NGINX Instance Manager documentation. Select these permissions in step 6 for the role:
+1. Create a role following the steps in [Create a Role]({{< ref "/nim/admin-guide/rbac/create-roles.md#create-roles" >}}) section of the NGINX Instance Manager documentation. Select these permissions in step 6 for the role:
    - Module: Instance Manager
    - Feature: NGINX Plus Usage
    - Access: CRUD
 
-1. Create a user account following the steps in [Add Users](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/assign-roles/#assign-roles-to-users-basic-authentication) section of the NGINX Instance Manager documentation. In step 5, assign the user to the role created above. Note that currently only "basic auth" authentication is supported for usage reporting purposes.
+1. Create a user account following the steps in [Add Users]({{< ref "/nim/admin-guide/rbac/assign-roles.md#assign-roles-to-users-basic-authentication" >}}) section of the NGINX Instance Manager documentation. In step 5, assign the user to the role created above. Note that currently only "basic auth" authentication is supported for usage reporting purposes.
 
 ---
 
@@ -152,6 +152,7 @@ Usage Reporting sends the number of NGINX Ingress Controller instances and nodes
 ```shell
 curl --user "foo:bar" https://nms.example.com/api/platform/v1/k8s-usage
 ```
+
 ```json
 {
   "items": [
@@ -212,6 +213,7 @@ You can query the usage data for a specific cluster by specifying the cluster ui
 ```shell
 curl --user "foo:bar" https://nms.example.com/api/platform/v1/k8s-usage/d290f1ee-6c54-4b01-90e6-d701748f0851
 ```
+
 ```json
 {
   "metadata": {

From 7b7cb948651cb51a402167e8af4b2fdc4feea4d9 Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Fri, 20 Jun 2025 14:59:46 +0100
Subject: [PATCH 039/117] feat: Update labeling configuration to tag NGINX
 Ingress Controller (#715)

---
 .github/labeler.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/labeler.yml b/.github/labeler.yml
index 1887bf358..569c08be8 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -73,6 +73,12 @@ product/nginxaas:
           - 'content/nginxaas-azure/**'
           - 'content/includes/nginxaas-azure/**'
 
+product/nic:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'content/nic/**'
+          - 'content/includes/nic/**'
+
 product/nim:
   - changed-files:
       - any-glob-to-any-file:

From 023b3814de336ff2856f4b50e699f84e30da49cd Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Fri, 20 Jun 2025 16:33:18 +0100
Subject: [PATCH 040/117] feat: Remove log file from documentation maintenance
 script (#716)

This commit removes an erroneously checked in log file from the
documentation repository, and adds *.log files to the gitignore file
with the intent that in the future, our scripts will output .log files
and thus avoid the possibility of this happening again.
---
 .gitignore      |   3 +-
 cleanup_log.txt | 929 ------------------------------------------------
 2 files changed, 2 insertions(+), 930 deletions(-)
 delete mode 100644 cleanup_log.txt

diff --git a/.gitignore b/.gitignore
index e0070f1b2..15fbca634 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,8 @@
 # See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
 **/.DS_Store
 
-# dependencies
+# Log files
+*.log
 
 # testing
 /coverage
diff --git a/cleanup_log.txt b/cleanup_log.txt
deleted file mode 100644
index e4a129c9c..000000000
--- a/cleanup_log.txt
+++ /dev/null
@@ -1,929 +0,0 @@
-2025-05-21 06:21:52,139: File read successfully.
-2025-05-21 06:21:52,140: Initial shape (rows x columns): (743, 39)
-2025-05-21 06:21:52,140: Subheading row detected and removed.
-2025-05-21 06:21:52,143: Dataframe shape after header adjustments: (741, 39)
-2025-05-21 06:21:52,143: Columns found: ['StartDate', 'EndDate', 'Status', 'IPAddress', 'Progress', 'Duration (in seconds)', 'Finished', 'RecordedDate', 'ResponseId', 'RecipientLastName', 'RecipientFirstName', 'RecipientEmail', 'ExternalReference', 'LocationLatitude', 'LocationLongitude', 'DistributionChannel', 'UserLanguage', 'Q1', 'Q2', 'Q3', 'Q4', 'current_url', 'QID2_OriginalResponse', 'QID2_AICategory', 'QID2_FollowUpPrompt', 'Link URL', 'Q2 - Actionability', 'Q2 - Effort', 'Q2 - Effort Numeric', 'Q2 - Emotion Intensity', 'Q2 - Emotion', 'Q2 - Parent Topics', 'Q2 - Sentiment Polarity', 'Q2 - Sentiment Score', 'Q2 - Sentiment', 'Q2 - Topic Sentiment Label', 'Q2 - Topic Sentiment Score', 'Q2 - Topics', 'Q2 - Topic Hierarchy Level 1']
-2025-05-21 06:21:52,157: Row 0 deleted because Link URL is missing.
-2025-05-21 06:21:52,157: Row 1 deleted because Link URL is missing.
-2025-05-21 06:21:52,157: Row 2 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 3 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 4 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 5 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 6 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 7 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 8 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 9 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 10 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 11 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 12 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 13 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 14 deleted because Link URL is missing.
-2025-05-21 06:21:52,158: Row 15 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 16 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 17 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 18 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 19 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 20 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 21 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 22 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 23 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 24 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 25 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 26 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 27 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 28 deleted because Link URL is missing.
-2025-05-21 06:21:52,159: Row 29 deleted because Link URL is missing.
-2025-05-21 06:21:52,160: Row 30 deleted because Link URL is missing.
-2025-05-21 06:21:52,160: Row 31 deleted because Link URL is missing.
-2025-05-21 06:21:52,160: Row 32 deleted because Link URL is missing.
-2025-05-21 06:21:52,160: Row 33 deleted because Link URL is missing.
-2025-05-21 06:21:52,160: Row 34 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 35 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 36 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 37 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 38 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 39 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 40 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 41 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 42 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 43 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 44 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 45 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 46 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 47 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 48 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 49 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 50 deleted because Link URL is missing.
-2025-05-21 06:21:52,161: Row 213 deleted because Link URL is missing.
-2025-05-21 06:21:52,162: Rows before removing missing Link URL: 741, after: 689
-2025-05-21 06:21:52,163: Row 51 deleted because Q2 contains 'testing'.
-2025-05-21 06:21:52,163: Row 77 deleted because Q2 contains 'testing'.
-2025-05-21 06:21:52,163: Row 78 deleted because Q2 contains 'testing'.
-2025-05-21 06:21:52,163: Row 169 deleted because Q2 contains 'testing'.
-2025-05-21 06:21:52,163: Rows before removing Q2='testing': 689, after: 685
-2025-05-21 06:21:52,165: Row 58: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
-2025-05-21 06:21:52,165: Row 59: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/upgrade-to-v4/#update-custom-resource-apiversion to https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/upgrade-to-v4/
-2025-05-21 06:21:52,165: Row 71: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/custom-templates to https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/custom-templates/
-2025-05-21 06:21:52,165: Row 88: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/overview/design/#nginx-ingress-controller-process-components to https://docs.nginx.com/nginx-ingress-controller/overview/design/
-2025-05-21 06:21:52,165: Row 115: Link URL updated from https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#weights to https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/
-2025-05-21 06:21:52,165: Row 120: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
-2025-05-21 06:21:52,165: Row 152: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/glossary/#ingress-controller-ingress-controller to https://docs.nginx.com/nginx-ingress-controller/glossary/
-2025-05-21 06:21:52,165: Row 297: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
-2025-05-21 06:21:52,165: Row 308: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
-2025-05-21 06:21:52,166: Row 324: Link URL updated from https://docs.nginx.com/nginxaas-azure/known-issues/ to https://docs.nginx.com/nginxaas/azure/known-issues/ (URL replacement)
-2025-05-21 06:21:52,166: Row 324: Link URL updated from https://docs.nginx.com/nginxaas-azure/known-issues/ to https://docs.nginx.com/nginxaas/azure/known-issues/
-2025-05-21 06:21:52,166: Row 367: Link URL updated from https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/#prebuilt to https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/
-2025-05-21 06:21:52,166: Row 395: Link URL updated from https://docs.nginx.com/nginx/admin-guide/web-server/web-server/#locations to https://docs.nginx.com/nginx/admin-guide/web-server/web-server/
-2025-05-21 06:21:52,166: Row 396: Link URL updated from https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/#method to https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/
-2025-05-21 06:21:52,166: Row 417: Link URL updated from https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/#virtual-servers to https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/
-2025-05-21 06:21:52,166: Row 418: Link URL updated from https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/#upgrading-nginx-plus to https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/
-2025-05-21 06:21:52,166: Row 477: Link URL updated from https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/#master-and-worker-processes to https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/
-2025-05-21 06:21:52,166: Row 501: Link URL updated from https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source to https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/
-2025-05-21 06:21:52,167: Row 587: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
-2025-05-21 06:21:52,167: Row 590: Link URL updated from https://docs.nginx.com/ossc to https://docs.nginx.com/ossc/
-2025-05-21 06:21:52,167: Row 592: Link URL updated from https://docs.nginx.com/nginx-one/getting-started/#enable-nginx-plus-api to https://docs.nginx.com/nginx-one/getting-started/
-2025-05-21 06:21:52,167: Row 617: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource to https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/globalconfiguration-resource/
-2025-05-21 06:21:52,167: Row 636: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
-2025-05-21 06:21:52,167: Row 692: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration to https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/
-2025-05-21 06:21:52,167: Row 695: Link URL updated from https://docs.nginx.com/nginx-management-suite/acm/how-to/infrastructure/manage-api-infrastructure/#add-environment to https://docs.nginx.com/nginx-management-suite/acm/how-to/infrastructure/manage-api-infrastructure/
-2025-05-21 06:21:52,167: Row 729: Link URL updated from https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments to https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/
-2025-05-21 06:21:52,168: Total Link URLs updated: 26
-2025-05-21 06:21:52,170: Exclude file loaded. Excluding 111 ResponseIDs.
-2025-05-21 06:21:52,172: Excluded bogus responses: removed 104 rows based on ResponseId.
-2025-05-21 06:21:52,172: Removed ResponseIDs: ['R_2BFXRROEE9C3BRP', 'R_2D8NGQPK1IWGIHY', 'R_2FP9OE7JF5GLHOP', 'R_2J2ML9WMO3BCXZ0', 'R_2LGQFCKEOOAPFCT', 'R_2RPFQ7PIR4C48DT', 'R_3J7OQ6V3GPEPYSJ', 'R_3JG7M3IHPME7LRX', 'R_401DHNTF0HMOWBL', 'R_40YHV7FFGANJU6F', 'R_424K44PYVRK8Y1G', 'R_429OWKCURJNOCTK', 'R_42NYN092DSVZXN7', 'R_45R6NUBXVOIPVEN', 'R_47VDGIRXA5NNCGO', 'R_4AK2INIGD1FFTDO', 'R_4BKCWEQU5MOZHA9', 'R_4DLQ3LQ6NHSZHBJ', 'R_4EFZQCTIWFGSTS9', 'R_4EXDDJGUFFTHDCC', 'R_4FO80F1TI4XXMDF', 'R_4GOFQWU2CBJQ9I8', 'R_4HOXH1YLAOVUM8Q', 'R_4JPODUU6FT5EJTD', 'R_4KHCYH2G4RX8GU6', 'R_4LGNMF3ZOJTCHSX', 'R_4MQKUOCWNMU1SPL', 'R_4N9TKVM3T4LLYKG', 'R_4NASUNJJHBDUNYB', 'R_4O67VYRCF2LMJJH', 'R_4OAKKCL6GPFZ6HE', 'R_4P2A79ACQ2DAXVN', 'R_4P9VTDYBBAGHH50', 'R_4QAAZ7C7ZBWLAZP', 'R_4QEFBD2SFDQ0REO', 'R_4QSJZTOLA1EOPTV', 'R_4QVW5AOMQL8JKAH', 'R_4QZ4BOZX5ZAWT8O', 'R_4SBC6FAX8YM8UGW', 'R_4SFJ4F2DSWFAHQZ', 'R_4ST9JXVOCQPNZWV', 'R_4U6KCOFBA0VPNFR', 'R_4VOH9KW1KCSSUJF', 'R_4WMMZUSHCE79AJG', 'R_4YE1NR6MWNJKK3P', 'R_51KKOSYZR16XRWF', 'R_5JBAKUSVN2PQSYJ', 'R_5MMU8NUYQQORLYE', 'R_6F3YPGOQKQMDPMC', 'R_6JLNAULKUPECILR', 'R_6PPUIKFYISENOOK', 'R_6VCPCX5BLHAFBKC', 'R_84BS33CREBBE09U', 'R_85HYVNJRFKFIUZ7', 'R_8C1JLR1AQTTTNE4', 'R_8NMFUZTTQCCOCN1', 'R_8OYXTWQHPPI60A9', 'R_8RTA9M4IQEQQDTR', 'R_8SBR3CGJS6QKOUL', 'R_8TTJC5OTE89JFJJ', 'R_8V8S2WSR76BZVDZ', 'R_8VPTIBSYWQJNJ42', 'R_8WBVOCJ7VLNATZF', 'R_906TQMCOD2GZKZH', 'R_93CMAHY49QS6HFS', 'R_93LGPITFTUNJBD4', 'R_96FPCSSZZ6OQGA5', 'R_97G6U0YYUPWZKAJ', 'R_9889CFZHAMBBJKL', 'R_9949KYHTOMG0ZXU', 'R_99ANGFU2UYWLPTX', 'R_9AGAOUORA4CPHTJ', 'R_9BAI4SFWRIEMME6', 'R_9BSJVEIWI90STOT', 'R_9C5BLPTCDY9OWIP', 'R_9CIYQQ0HJBEUA0O', 'R_9CPNDHPV7ZKBRFP', 'R_9DIMXPUAFKMVKJW', 'R_9DPMP66UHSZNLMP', 'R_9DUZARWZWO1OTNU', 'R_9EIFBZMGJ2RIMFJ', 'R_9EY7BUWKXFBNJWK', 'R_9FWXWDHSKHI0KCC', 'R_9HRYIJ0WJQNXLBV', 'R_9HVUPXH88UF2ALP', 'R_9J6C8A0F54FGTOE', 'R_9J9IEQJV2QIJNOO', 'R_9K6G6NUBNDQSLZC', 'R_9KOOA1DO1YZQCNN', 'R_9LIA90ICK0Z49X1', 'R_9MGHZSS6CHGXIGY', 'R_9MWUMGQY6B6KBSX', 'R_9OHCDWPHUIEEKKU', 'R_9OLOUQJMICBQCSJ', 'R_9PC2GVYGYM5RML5', 'R_9POGVOMHFMYBFJ2', 'R_9PPYOF1BOHS61LV', 'R_9QKQ89HE4TJYTIY', 'R_9ROSQUGFBCRUCUU', 'R_9RPKMREBNL1WAIO', 'R_9SUDDZVEJT2JFAS', 'R_9UASQESCV6I1RJD', 'R_9VIEDXC63JY6EL7', 'R_9ZAMFS0DAF1Z2ZT']
-2025-05-21 06:21:52,175: Row 712: Found and removed 1 email(s) from Q2.
-2025-05-21 06:21:52,175: Row 728: Found and removed 1 email(s) from Q2.
-2025-05-21 06:21:52,739: Row 52: Reverse geocoded lat=-29.9228, lon=-51.1744 -> country=Brazil, city=Canoas, state=Rio Grande do Sul
-2025-05-21 06:21:53,745: Row 53: Reverse geocoded lat=26.8756, lon=80.9115 -> country=India, city=Lucknow, state=Uttar Pradesh
-2025-05-21 06:21:54,735: Row 54: Reverse geocoded lat=13.6671, lon=100.5775 -> country=Thailand, city=Pu Chao Saming Phrai Town Municipality, state=None
-2025-05-21 06:21:55,697: Row 55: Reverse geocoded lat=36.6229, lon=114.4698 -> country=China, city=Handan, state=Hebei
-2025-05-21 06:21:56,656: Row 56: Reverse geocoded lat=-16.561, lon=-49.2063 -> country=Brazil, city=Goiânia, state=Goiás
-2025-05-21 06:21:57,664: Row 57: Reverse geocoded lat=-16.561, lon=-49.2063 -> country=Brazil, city=Goiânia, state=Goiás
-2025-05-21 06:21:58,695: Row 58: Reverse geocoded lat=53.481, lon=-2.2367 -> country=United Kingdom, city=Manchester, state=England
-2025-05-21 06:21:59,700: Row 60: Reverse geocoded lat=50.1187, lon=8.6842 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:22:00,919: Row 61: Reverse geocoded lat=17.9641, lon=102.5987 -> country=Laos, city=Vientiane Capital, state=Vientiane Prefecture
-2025-05-21 06:22:01,696: Row 62: Reverse geocoded lat=25.5908, lon=85.1348 -> country=India, city=Patna, state=Bihar
-2025-05-21 06:22:02,796: Row 63: Reverse geocoded lat=13.7159, lon=100.417 -> country=Thailand, city=Bangkok, state=None
-2025-05-21 06:22:04,250: Row 64: Reverse geocoded lat=48.157, lon=17.0915 -> country=Slovakia, city=Bratislava, state=Region of Bratislava
-2025-05-21 06:22:04,695: Row 65: Reverse geocoded lat=20.6381, lon=-103.348 -> country=Mexico, city=Guadalajara, state=Jalisco
-2025-05-21 06:22:05,783: Row 66: Reverse geocoded lat=22.155, lon=-101.9465 -> country=Mexico, city=Villa García, state=Zacatecas
-2025-05-21 06:22:07,105: Row 68: Reverse geocoded lat=49.1231, lon=8.6011 -> country=Germany, city=Bruchsal, state=Baden-Württemberg
-2025-05-21 06:22:07,783: Row 69: Reverse geocoded lat=49.1231, lon=8.6011 -> country=Germany, city=Bruchsal, state=Baden-Württemberg
-2025-05-21 06:22:08,729: Row 70: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
-2025-05-21 06:22:09,796: Row 71: Reverse geocoded lat=39.8655, lon=-86.122 -> country=United States, city=Indianapolis, state=Indiana
-2025-05-21 06:22:10,932: Row 72: Reverse geocoded lat=38.7584, lon=-9.2495 -> country=Portugal, city=Sintra, state=None
-2025-05-21 06:22:11,896: Row 73: Reverse geocoded lat=52.9044, lon=-1.2326 -> country=United Kingdom, city=Nottingham, state=England
-2025-05-21 06:22:12,850: Row 74: Reverse geocoded lat=50.1155, lon=14.4124 -> country=Czechia, city=Capital City of Prague, state=Prague
-2025-05-21 06:22:14,282: Row 75: Reverse geocoded lat=51.3593, lon=7.4763 -> country=Germany, city=Hagen, state=North Rhine-Westphalia
-2025-05-21 06:22:14,794: Row 76: Reverse geocoded lat=-1.2841, lon=36.8155 -> country=Kenya, city=Nairobi, state=Nairobi County
-2025-05-21 06:22:15,810: Row 79: Reverse geocoded lat=46.0653, lon=23.5917 -> country=Romania, city=Alba Iulia, state=None
-2025-05-21 06:22:16,899: Row 80: Reverse geocoded lat=46.7657, lon=23.5943 -> country=Romania, city=Cluj-Napoca, state=None
-2025-05-21 06:22:17,742: Row 81: Reverse geocoded lat=51.4964, lon=-0.1224 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:22:19,063: Row 82: Reverse geocoded lat=34.6946, lon=135.5021 -> country=Japan, city=Osaka, state=None
-2025-05-21 06:22:19,876: Row 83: Reverse geocoded lat=37.5079, lon=127.1177 -> country=South Korea, city=Seoul, state=None
-2025-05-21 06:22:20,974: Row 84: Reverse geocoded lat=46.4752, lon=30.7338 -> country=Ukraine, city=Odesa, state=Odesa Oblast
-2025-05-21 06:22:21,672: Row 85: Reverse geocoded lat=46.4752, lon=30.7338 -> country=Ukraine, city=Odesa, state=Odesa Oblast
-2025-05-21 06:22:22,667: Row 86: Reverse geocoded lat=-23.1798, lon=-46.8816 -> country=Brazil, city=Jundiaí, state=São Paulo
-2025-05-21 06:22:23,748: Row 87: Reverse geocoded lat=37.5537, lon=-77.4602 -> country=United States, city=Richmond, state=Virginia
-2025-05-21 06:22:24,717: Row 88: Reverse geocoded lat=22.2578, lon=114.1657 -> country=China, city=Hong Kong Island, state=Hong Kong
-2025-05-21 06:22:25,754: Row 89: Reverse geocoded lat=36.7637, lon=-119.7602 -> country=United States, city=Fresno, state=California
-2025-05-21 06:22:26,727: Row 90: Reverse geocoded lat=28.6542, lon=77.2373 -> country=India, city=Delhi, state=Delhi
-2025-05-21 06:22:27,804: Row 91: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
-2025-05-21 06:22:29,090: Row 92: Reverse geocoded lat=3.1685, lon=101.7034 -> country=Malaysia, city=Kuala Lumpur, state=Kuala Lumpur
-2025-05-21 06:22:29,779: Row 93: Reverse geocoded lat=36.7943, lon=-119.8856 -> country=United States, city=Fresno, state=California
-2025-05-21 06:22:30,928: Row 94: Reverse geocoded lat=47.1085, lon=15.7054 -> country=Austria, city=Gleisdorf, state=Styria
-2025-05-21 06:22:31,774: Row 95: Reverse geocoded lat=14.5971, lon=120.9798 -> country=Philippines, city=Manila, state=None
-2025-05-21 06:22:32,873: Row 96: Reverse geocoded lat=30.5851, lon=114.2662 -> country=China, city=Jianghan District, state=Hubei
-2025-05-21 06:22:33,711: Row 97: Reverse geocoded lat=32.4643, lon=14.5726 -> country=Libya, city=Zliten, state=Bani Walid
-2025-05-21 06:22:34,796: Row 98: Reverse geocoded lat=59.3591, lon=17.9951 -> country=Sweden, city=Solna, state=None
-2025-05-21 06:22:35,676: Row 99: Reverse geocoded lat=38.8897, lon=-121.2873 -> country=United States, city=Lincoln, state=California
-2025-05-21 06:22:36,708: Row 100: Reverse geocoded lat=-22.9616, lon=-49.8632 -> country=Brazil, city=Ourinhos, state=São Paulo
-2025-05-21 06:22:37,835: Row 101: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:22:38,698: Row 102: Reverse geocoded lat=39.018, lon=-77.539 -> country=United States, city=None, state=Virginia
-2025-05-21 06:22:39,654: Row 103: Reverse geocoded lat=40.1086, lon=-75.2835 -> country=United States, city=Plymouth Township, state=Pennsylvania
-2025-05-21 06:22:40,744: Row 104: Reverse geocoded lat=46.0653, lon=23.5917 -> country=Romania, city=Alba Iulia, state=None
-2025-05-21 06:22:41,718: Row 105: Reverse geocoded lat=-6.175, lon=106.8286 -> country=Indonesia, city=Special capital Region of Jakarta, state=None
-2025-05-21 06:22:42,737: Row 106: Reverse geocoded lat=37.1554, lon=9.7861 -> country=Tunisia, city=None, state=Bizerte
-2025-05-21 06:22:43,679: Row 107: Reverse geocoded lat=51.2437, lon=-2.2746 -> country=United Kingdom, city=None, state=England
-2025-05-21 06:22:44,800: Row 108: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
-2025-05-21 06:22:45,823: Row 109: Reverse geocoded lat=32.4633, lon=44.4179 -> country=Iraq, city=Al Hillah, state=Babil Governorate
-2025-05-21 06:22:46,743: Row 110: Reverse geocoded lat=-33.8715, lon=151.2006 -> country=Australia, city=Sydney, state=New South Wales
-2025-05-21 06:22:47,768: Row 111: Reverse geocoded lat=14.3269, lon=120.9336 -> country=Philippines, city=Dasmariñas, state=Cavite
-2025-05-21 06:22:48,782: Row 112: Reverse geocoded lat=36.3188, lon=139.579 -> country=Japan, city=Sano, state=None
-2025-05-21 06:22:49,815: Row 114: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
-2025-05-21 06:22:50,739: Row 115: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
-2025-05-21 06:22:51,687: Row 116: Reverse geocoded lat=39.018, lon=-77.539 -> country=United States, city=None, state=Virginia
-2025-05-21 06:22:52,702: Row 117: Reverse geocoded lat=42.6826, lon=23.3223 -> country=Bulgaria, city=Sofia, state=Sofia-City
-2025-05-21 06:22:53,690: Row 119: Reverse geocoded lat=38.7219, lon=-9.1398 -> country=Portugal, city=Lisbon, state=None
-2025-05-21 06:22:54,806: Row 120: Reverse geocoded lat=35.5641, lon=139.5295 -> country=Japan, city=Yokohama, state=None
-2025-05-21 06:22:55,755: Row 121: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
-2025-05-21 06:22:56,698: Row 122: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
-2025-05-21 06:22:57,803: Row 123: Reverse geocoded lat=11.3085, lon=106.0948 -> country=Vietnam, city=Tây Ninh, state=Tây Ninh Province
-2025-05-21 06:22:58,705: Row 124: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:22:59,737: Row 125: Reverse geocoded lat=14.3614, lon=121.4875 -> country=Philippines, city=Paete, state=Laguna
-2025-05-21 06:23:00,876: Row 126: Reverse geocoded lat=29.3959, lon=-98.4761 -> country=United States, city=San Antonio, state=Texas
-2025-05-21 06:23:01,698: Row 127: Reverse geocoded lat=26.1885, lon=91.7392 -> country=India, city=None, state=Assam
-2025-05-21 06:23:02,688: Row 128: Reverse geocoded lat=-18.913, lon=47.5296 -> country=Madagascar, city=Antananarivo, state=Analamanga
-2025-05-21 06:23:03,716: Row 129: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:23:05,028: Row 131: Reverse geocoded lat=52.1928, lon=5.4199 -> country=Netherlands, city=Amersfoort, state=Utrecht
-2025-05-21 06:23:06,180: Row 132: Reverse geocoded lat=51.9277, lon=4.5844 -> country=Netherlands, city=Capelle aan den IJssel, state=South Holland
-2025-05-21 06:23:06,676: Row 133: Reverse geocoded lat=40.5828, lon=-73.9532 -> country=United States, city=New York, state=New York
-2025-05-21 06:23:07,719: Row 134: Reverse geocoded lat=36.5312, lon=3.0698 -> country=Algeria, city=Bougara, state=Blida
-2025-05-21 06:23:09,028: Row 135: Reverse geocoded lat=49.2625, lon=8.6235 -> country=Germany, city=None, state=Baden-Württemberg
-2025-05-21 06:23:09,811: Row 137: Reverse geocoded lat=36.061, lon=120.3814 -> country=China, city=Shinan District, state=Shandong
-2025-05-21 06:23:11,054: Row 138: Reverse geocoded lat=20.0024, lon=73.7945 -> country=India, city=Nashik, state=Maharashtra
-2025-05-21 06:23:11,728: Row 139: Reverse geocoded lat=-25.0907, lon=-50.1653 -> country=Brazil, city=Ponta Grossa, state=Paraná
-2025-05-21 06:23:12,696: Row 140: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
-2025-05-21 06:23:14,214: Row 141: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
-2025-05-21 06:23:15,323: Row 142: Reverse geocoded lat=36.1898, lon=44.0157 -> country=Iraq, city=Erbil, state=Erbil Governorate
-2025-05-21 06:23:16,104: Row 143: Reverse geocoded lat=53.3382, lon=-6.2591 -> country=Ireland, city=Dublin, state=None
-2025-05-21 06:23:16,986: Row 144: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
-2025-05-21 06:23:18,038: Row 145: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:23:19,029: Row 146: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:23:20,112: Row 147: Reverse geocoded lat=40.7547, lon=-73.9614 -> country=United States, city=New York, state=New York
-2025-05-21 06:23:21,068: Row 148: Reverse geocoded lat=31.33, lon=75.5844 -> country=India, city=Jalandhar, state=Punjab
-2025-05-21 06:23:22,064: Row 149: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
-2025-05-21 06:23:23,110: Row 150: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:23:24,010: Row 151: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
-2025-05-21 06:23:24,998: Row 152: Reverse geocoded lat=36.61, lon=114.4876 -> country=China, city=Handan, state=Hebei
-2025-05-21 06:23:26,476: Row 154: Reverse geocoded lat=44.776, lon=17.1995 -> country=Bosnia and Herzegovina, city=Banja Luka, state=Republika Srpska
-2025-05-21 06:23:26,997: Row 155: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:23:28,037: Row 156: Reverse geocoded lat=51.4964, lon=-0.1224 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:23:29,244: Row 157: Reverse geocoded lat=35.5641, lon=45.4326 -> country=Iraq, city=Sulaymaniyah, state=Sulaymaniyah Governorate
-2025-05-21 06:23:29,989: Row 158: Reverse geocoded lat=35.5641, lon=45.4326 -> country=Iraq, city=Sulaymaniyah, state=Sulaymaniyah Governorate
-2025-05-21 06:23:31,087: Row 159: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:23:32,044: Row 160: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:23:33,016: Row 161: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:23:34,029: Row 162: Reverse geocoded lat=-22.8951, lon=-47.0439 -> country=Brazil, city=Campinas, state=São Paulo
-2025-05-21 06:23:35,059: Row 163: Reverse geocoded lat=4.0505, lon=9.7023 -> country=Cameroon, city=Douala I, state=Littoral
-2025-05-21 06:23:36,094: Row 164: Reverse geocoded lat=19.4371, lon=-99.0111 -> country=Mexico, city=Texcoco de Mora, state=State of Mexico
-2025-05-21 06:23:37,037: Row 165: Reverse geocoded lat=60.1719, lon=24.9347 -> country=Finland, city=Helsinki, state=Uusimaa
-2025-05-21 06:23:38,004: Row 166: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:23:39,241: Row 167: Reverse geocoded lat=49.5546, lon=25.5842 -> country=Ukraine, city=Ternopil, state=Ternopil Oblast
-2025-05-21 06:23:40,016: Row 168: Reverse geocoded lat=40.4327, lon=-3.621 -> country=Spain, city=Madrid, state=Community of Madrid
-2025-05-21 06:23:41,041: Row 170: Reverse geocoded lat=-24.0589, lon=-46.8456 -> country=Brazil, city=Itanhaem, state=São Paulo
-2025-05-21 06:23:42,079: Row 171: Reverse geocoded lat=33.3967, lon=-111.6545 -> country=United States, city=Mesa, state=Arizona
-2025-05-21 06:23:43,013: Row 172: Reverse geocoded lat=33.3967, lon=-111.6545 -> country=United States, city=Mesa, state=Arizona
-2025-05-21 06:23:44,056: Row 173: Reverse geocoded lat=21.9974, lon=79.0011 -> country=India, city=Malhanwara, state=Madhya Pradesh
-2025-05-21 06:23:45,153: Row 174: Reverse geocoded lat=51.7655, lon=-0.4482 -> country=United Kingdom, city=Dacorum, state=England
-2025-05-21 06:23:46,204: Row 175: Reverse geocoded lat=26.58, lon=106.7223 -> country=China, city=Yunyan, state=Guizhou
-2025-05-21 06:23:47,032: Row 176: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
-2025-05-21 06:23:48,146: Row 177: Reverse geocoded lat=30.6667, lon=104.0667 -> country=China, city=Chengdu, state=Sichuan
-2025-05-21 06:23:48,996: Row 178: Reverse geocoded lat=48, lon=68 -> country=Kazakhstan, city=Jezqazğan, state=Ulytau Region
-2025-05-21 06:23:50,382: Row 179: Reverse geocoded lat=41.0145, lon=28.9533 -> country=Turkey, city=Istanbul, state=Istanbul
-2025-05-21 06:23:51,037: Row 180: Reverse geocoded lat=60.1719, lon=24.9347 -> country=Finland, city=Helsinki, state=Uusimaa
-2025-05-21 06:23:52,005: Row 181: Reverse geocoded lat=37.1038, lon=-113.5764 -> country=United States, city=Saint George, state=Utah
-2025-05-21 06:23:53,205: Row 182: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:23:54,144: Row 183: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:23:55,048: Row 184: Reverse geocoded lat=22.6276, lon=110.1507 -> country=China, city=Yulin, state=Guangxi
-2025-05-21 06:23:55,996: Row 185: Reverse geocoded lat=-26.9873, lon=-48.6276 -> country=Brazil, city=Balneário Camboriú, state=Santa Catarina
-2025-05-21 06:23:57,100: Row 186: Reverse geocoded lat=-27.6157, lon=-48.6235 -> country=Brazil, city=São José, state=Santa Catarina
-2025-05-21 06:23:58,085: Row 187: Reverse geocoded lat=23.1181, lon=113.2539 -> country=China, city=Yuexiu District, state=Guangdong Province
-2025-05-21 06:23:59,137: Row 188: Reverse geocoded lat=58.0701, lon=11.8131 -> country=Sweden, city=Stenungsön, state=None
-2025-05-21 06:24:00,071: Row 189: Reverse geocoded lat=50.6223, lon=26.2396 -> country=Ukraine, city=Rivne, state=Rivne Oblast
-2025-05-21 06:24:01,008: Row 190: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
-2025-05-21 06:24:02,316: Row 191: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
-2025-05-21 06:24:03,051: Row 192: Reverse geocoded lat=11.5583, lon=104.9121 -> country=Cambodia, city=Khan Prampi Makara, state=Phnom Penh
-2025-05-21 06:24:04,186: Row 193: Reverse geocoded lat=29.3885, lon=76.9669 -> country=India, city=Panipat, state=Haryana
-2025-05-21 06:24:05,218: Row 194: Reverse geocoded lat=44.447, lon=26.0185 -> country=Romania, city=Roșu, state=None
-2025-05-21 06:24:06,146: Row 195: Reverse geocoded lat=-6.2114, lon=106.8446 -> country=Indonesia, city=Special capital Region of Jakarta, state=None
-2025-05-21 06:24:07,006: Row 196: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
-2025-05-21 06:24:08,129: Row 197: Reverse geocoded lat=33.8651, lon=-118.0673 -> country=United States, city=Cerritos, state=California
-2025-05-21 06:24:09,049: Row 198: Reverse geocoded lat=25.2925, lon=51.5321 -> country=Qatar, city=Doha, state=None
-2025-05-21 06:24:10,356: Row 199: Reverse geocoded lat=-6.2876, lon=106.722 -> country=Indonesia, city=South Tangerang, state=Banten
-2025-05-21 06:24:11,120: Row 200: Reverse geocoded lat=47.1449, lon=8.1551 -> country=Switzerland, city=Eich, state=Lucerne
-2025-05-21 06:24:12,261: Row 201: Reverse geocoded lat=41.6959, lon=44.832 -> country=Georgia, city=Tbilisi, state=None
-2025-05-21 06:24:13,784: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.0389&lon=102.7183&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:14,128: Row 202: Reverse geocoded lat=25.0389, lon=102.7183 -> country=China, city=Guandu, state=Yunnan
-2025-05-21 06:24:15,125: Row 203: Reverse geocoded lat=-23.4553, lon=-46.3348 -> country=Brazil, city=Itaquaquecetuba, state=São Paulo
-2025-05-21 06:24:16,063: Row 204: Reverse geocoded lat=19.3808, lon=-99.1982 -> country=Mexico, city=Mexico City, state=Mexico City
-2025-05-21 06:24:17,072: Row 206: Reverse geocoded lat=-23.5246, lon=-46.1835 -> country=Brazil, city=Mogi das Cruzes, state=São Paulo
-2025-05-21 06:24:18,143: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.7531&lon=10.1419&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:19,111: Row 207: Reverse geocoded lat=59.7531, lon=10.1419 -> country=Norway, city=Drammen, state=None
-2025-05-21 06:24:20,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.2253&lon=6.1516&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:21,105: Row 208: Reverse geocoded lat=46.2253, lon=6.1516 -> country=Switzerland, city=Geneva, state=Geneva
-2025-05-21 06:24:22,110: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5042&lon=-0.2199000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:23,207: Row 209: Reverse geocoded lat=51.5042, lon=-0.2199 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:24:24,090: Row 210: Reverse geocoded lat=51.5042, lon=-0.2199 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:24:25,124: Row 211: Reverse geocoded lat=51.5042, lon=-0.2199 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:24:26,220: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.7018&lon=90.3742&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:27,085: Row 212: Reverse geocoded lat=23.7018, lon=90.3742 -> country=Bangladesh, city=Keraniganj, state=Dhaka Division
-2025-05-21 06:24:28,068: Row 214: Reverse geocoded lat=34.7732, lon=113.722 -> country=China, city=Jinshui District, state=Henan
-2025-05-21 06:24:29,093: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.3917&lon=-0.5099000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:30,169: Row 215: Reverse geocoded lat=51.3917, lon=-0.5099 -> country=United Kingdom, city=Borough of Runnymede, state=England
-2025-05-21 06:24:31,174: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.3382&lon=-6.2591&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:32,217: Row 216: Reverse geocoded lat=53.3382, lon=-6.2591 -> country=Ireland, city=Dublin, state=None
-2025-05-21 06:24:33,108: Row 217: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
-2025-05-21 06:24:34,051: Row 218: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
-2025-05-21 06:24:35,082: Row 219: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:24:36,211: Row 220: Reverse geocoded lat=51.5088, lon=-0.093 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:24:37,231: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-30.3299&lon=-54.3251&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:38,102: Row 221: Reverse geocoded lat=-30.3299, lon=-54.3251 -> country=Brazil, city=São Gabriel, state=Rio Grande do Sul
-2025-05-21 06:24:39,107: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=36.7906&lon=118.0633&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:40,047: Row 222: Reverse geocoded lat=36.7906, lon=118.0633 -> country=China, city=Zhangdian District, state=Shandong
-2025-05-21 06:24:41,051: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.0&lon=70.0&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:42,032: Row 223: Reverse geocoded lat=30, lon=70 -> country=Pakistan, city=Fort Monroe, state=Punjab
-2025-05-21 06:24:43,041: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3388&lon=-121.8916&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:44,063: Row 224: Reverse geocoded lat=37.3388, lon=-121.8916 -> country=United States, city=San Jose, state=California
-2025-05-21 06:24:45,039: Row 225: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
-2025-05-21 06:24:46,071: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.6808&lon=112.4531&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:47,050: Row 226: Reverse geocoded lat=34.6808, lon=112.4531 -> country=China, city=Luoyang, state=Henan
-2025-05-21 06:24:48,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=31.9555&lon=35.9435&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:49,125: Row 228: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
-2025-05-21 06:24:50,043: Row 229: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
-2025-05-21 06:24:51,032: Row 230: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
-2025-05-21 06:24:52,058: Row 231: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
-2025-05-21 06:24:53,109: Row 232: Reverse geocoded lat=30.7488, lon=120.7486 -> country=China, city=Nanhu District, state=Zhejiang
-2025-05-21 06:24:54,077: Row 233: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
-2025-05-21 06:24:55,148: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=13.0895&lon=80.2739&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:56,076: Row 234: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:24:57,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-34.9087&lon=-56.1539&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:24:58,126: Row 235: Reverse geocoded lat=-34.9087, lon=-56.1539 -> country=Uruguay, city=Montevideo, state=Montevideo
-2025-05-21 06:24:59,082: Row 236: Reverse geocoded lat=38.3169, lon=116.8478 -> country=China, city=Yunhe District, state=Hebei
-2025-05-21 06:25:00,075: Row 240: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
-2025-05-21 06:25:01,094: Row 241: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
-2025-05-21 06:25:02,097: Row 243: Reverse geocoded lat=39.911, lon=116.395 -> country=China, city=Dongcheng District, state=Beijing
-2025-05-21 06:25:03,109: Row 244: Reverse geocoded lat=34.1794, lon=117.1612 -> country=China, city=Tongshan District, state=Jiangsu
-2025-05-21 06:25:04,149: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.4146&lon=-2.2274&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:05,127: Row 245: Reverse geocoded lat=53.4146, lon=-2.2274 -> country=United Kingdom, city=Manchester, state=England
-2025-05-21 06:25:06,129: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.9158&lon=-1.3601&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:07,140: Row 246: Reverse geocoded lat=50.9158, lon=-1.3601 -> country=United Kingdom, city=Southampton, state=England
-2025-05-21 06:25:08,145: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.1169&lon=8.6837&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:09,175: Row 247: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:25:10,113: Row 248: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
-2025-05-21 06:25:11,098: Row 250: Reverse geocoded lat=26.9136, lon=75.7858 -> country=India, city=Jaipur, state=Rajasthan
-2025-05-21 06:25:12,068: Row 251: Reverse geocoded lat=-34.1801, lon=-58.9181 -> country=Argentina, city=None, state=Buenos Aires
-2025-05-21 06:25:13,178: Row 252: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:25:14,161: Row 253: Reverse geocoded lat=31.8696, lon=117.293 -> country=China, city=Luyang District, state=Anhui
-2025-05-21 06:25:15,093: Row 254: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:25:16,115: Row 255: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
-2025-05-21 06:25:17,128: Row 257: Reverse geocoded lat=39.0469, lon=-77.4903 -> country=United States, city=Ashburn, state=Virginia
-2025-05-21 06:25:18,210: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=24.8591&lon=66.9983&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:19,043: Row 260: Reverse geocoded lat=24.8591, lon=66.9983 -> country=Pakistan, city=Karachi Division, state=None
-2025-05-21 06:25:20,047: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=24.8591&lon=66.9983&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:21,030: Row 261: Reverse geocoded lat=24.8591, lon=66.9983 -> country=Pakistan, city=Karachi Division, state=None
-2025-05-21 06:25:22,032: Row 264: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
-2025-05-21 06:25:23,036: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.5549&lon=13.4645&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:24,105: Row 265: Reverse geocoded lat=52.5549, lon=13.4645 -> country=Germany, city=Berlin, state=None
-2025-05-21 06:25:25,060: Row 266: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:25:26,113: Row 267: Reverse geocoded lat=51.5081, lon=-0.1278 -> country=United Kingdom, city=City of Westminster, state=England
-2025-05-21 06:25:27,068: Row 268: Reverse geocoded lat=39.911, lon=116.395 -> country=China, city=Dongcheng District, state=Beijing
-2025-05-21 06:25:28,127: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=21.1463&lon=79.0849&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:29,083: Row 269: Reverse geocoded lat=21.1463, lon=79.0849 -> country=India, city=Nagpur, state=Maharashtra
-2025-05-21 06:25:30,079: Row 270: Reverse geocoded lat=43.0147, lon=-81.3049 -> country=Canada, city=London, state=Ontario
-2025-05-21 06:25:31,088: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-33.914&lon=18.4129&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:32,098: Row 271: Reverse geocoded lat=-33.914, lon=18.4129 -> country=South Africa, city=Cape Town, state=Western Cape
-2025-05-21 06:25:33,102: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.5053&lon=-81.5566&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:25:34,193: Row 272: Reverse geocoded lat=41.5053, lon=-81.5566 -> country=United States, city=Cleveland Heights, state=Ohio
-2025-05-21 06:25:35,011: Row 273: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
-2025-05-21 06:25:36,116: Row 274: Reverse geocoded lat=-27.6157, lon=-48.6235 -> country=Brazil, city=São José, state=Santa Catarina
-2025-05-21 06:25:37,119: Row 275: Reverse geocoded lat=40.4422, lon=-79.9927 -> country=United States, city=Pittsburgh, state=Pennsylvania
-2025-05-21 06:25:38,061: Row 276: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
-2025-05-21 06:25:39,210: Row 277: Reverse geocoded lat=-36.8322, lon=174.7898 -> country=New Zealand, city=Devonport-Takapuna, state=Auckland
-2025-05-21 06:25:40,165: Row 278: Reverse geocoded lat=35.7204, lon=-0.6659 -> country=Algeria, city=Oran, state=Oran
-2025-05-21 06:25:41,206: Row 279: Reverse geocoded lat=41.4765, lon=1.9278 -> country=Spain, city=Martorell, state=Catalonia
-2025-05-21 06:25:42,175: Row 281: Reverse geocoded lat=21, lon=96 -> country=Myanmar, city=Wet Toe, state=Mandalay
-2025-05-21 06:25:43,213: Row 282: Reverse geocoded lat=14.6475, lon=121.0494 -> country=Philippines, city=Quezon City, state=None
-2025-05-21 06:25:44,084: Row 283: Reverse geocoded lat=14.6475, lon=121.0494 -> country=Philippines, city=Quezon City, state=None
-2025-05-21 06:25:45,232: Row 284: Reverse geocoded lat=59.4786, lon=18.2931 -> country=Sweden, city=Åkersberga, state=None
-2025-05-21 06:25:46,462: Row 285: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:25:47,405: Row 287: Reverse geocoded lat=35.4711, lon=44.3925 -> country=Iraq, city=Kirkuk, state=Kirkuk Governorate
-2025-05-21 06:25:48,051: Row 288: Reverse geocoded lat=33.8333, lon=35.8333 -> country=Lebanon, city=Jdita, state=Beqaa Governorate
-2025-05-21 06:25:49,219: Row 289: Reverse geocoded lat=48.0295, lon=7.573 -> country=France, city=Biesheim, state=Grand Est
-2025-05-21 06:25:50,104: Row 290: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
-2025-05-21 06:25:51,173: Row 291: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
-2025-05-21 06:25:52,465: Row 292: Reverse geocoded lat=51.2192, lon=4.3917 -> country=Belgium, city=Antwerp, state=Antwerp
-2025-05-21 06:25:53,220: Row 294: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:25:54,345: Row 295: Reverse geocoded lat=50.8397, lon=12.9358 -> country=Germany, city=Chemnitz, state=Saxony
-2025-05-21 06:25:55,064: Row 296: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
-2025-05-21 06:25:56,189: Row 297: Reverse geocoded lat=47.4121, lon=8.0864 -> country=Switzerland, city=Biberstein, state=Aargau
-2025-05-21 06:25:57,113: Row 299: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
-2025-05-21 06:25:58,134: Row 300: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:25:59,281: Row 301: Reverse geocoded lat=30.7096, lon=31.2554 -> country=Egypt, city=Mit Ghamr City, state=Ad Dakahliya
-2025-05-21 06:26:00,079: Row 302: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
-2025-05-21 06:26:01,121: Row 303: Reverse geocoded lat=-22.9035, lon=-47.0565 -> country=Brazil, city=Campinas, state=São Paulo
-2025-05-21 06:26:02,232: Row 304: Reverse geocoded lat=44.1145, lon=24.3402 -> country=Romania, city=Caracal, state=None
-2025-05-21 06:26:03,072: Row 305: Reverse geocoded lat=41.8835, lon=-87.6305 -> country=United States, city=Chicago, state=Illinois
-2025-05-21 06:26:04,061: Row 306: Reverse geocoded lat=49.2635, lon=-122.9331 -> country=Canada, city=Burnaby, state=British Columbia
-2025-05-21 06:26:05,101: Row 307: Reverse geocoded lat=36.5312, lon=3.0698 -> country=Algeria, city=Bougara, state=Blida
-2025-05-21 06:26:06,600: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.6113&lon=6.1294&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:07,249: Row 309: Reverse geocoded lat=49.6113, lon=6.1294 -> country=Luxembourg, city=Luxembourg, state=None
-2025-05-21 06:26:08,163: Row 310: Reverse geocoded lat=0.321, lon=32.5714 -> country=Uganda, city=Kampala, state=Central Region
-2025-05-21 06:26:09,135: Row 311: Reverse geocoded lat=-29.9434, lon=-50.9934 -> country=Brazil, city=Gravataí, state=Rio Grande do Sul
-2025-05-21 06:26:10,215: Row 312: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
-2025-05-21 06:26:11,056: Row 313: Reverse geocoded lat=-7.2333, lon=-62.9 -> country=Brazil, city=Humaitá, state=Amazonas
-2025-05-21 06:26:12,118: Row 314: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:26:13,119: Row 315: Reverse geocoded lat=-16.7267, lon=-49.1091 -> country=Brazil, city=Senador Canedo, state=Goiás
-2025-05-21 06:26:14,275: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4466&lon=5.4736&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:15,135: Row 316: Reverse geocoded lat=51.4466, lon=5.4736 -> country=Netherlands, city=Eindhoven, state=North Brabant
-2025-05-21 06:26:16,140: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.8661&lon=11.5154&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:17,081: Row 317: Reverse geocoded lat=3.8661, lon=11.5154 -> country=Cameroon, city=Yaoundé, state=Centre
-2025-05-21 06:26:18,086: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.8661&lon=11.5154&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:19,033: Row 318: Reverse geocoded lat=3.8661, lon=11.5154 -> country=Cameroon, city=Yaoundé, state=Centre
-2025-05-21 06:26:20,038: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=31.7126&lon=76.9328&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:21,081: Row 319: Reverse geocoded lat=31.7126, lon=76.9328 -> country=India, city=Mandi, state=Himachal Pradesh
-2025-05-21 06:26:22,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.5534&lon=7.9519&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:23,182: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.5534&lon=7.9519&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:24,156: Row 320: Reverse geocoded lat=47.5534, lon=7.9519 -> country=Germany, city=Säckingen, state=Baden-Württemberg
-2025-05-21 06:26:25,165: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:26,089: Row 321: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
-2025-05-21 06:26:27,095: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.0848&lon=14.4112&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:28,135: Row 322: Reverse geocoded lat=50.0848, lon=14.4112 -> country=Czechia, city=Capital City of Prague, state=Prague
-2025-05-21 06:26:29,141: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.1477&lon=-3.5655&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:30,020: Row 323: Reverse geocoded lat=37.1477, lon=-3.5655 -> country=Spain, city=Huétor Vega, state=Andalusia
-2025-05-21 06:26:31,024: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.0025&lon=8.9533&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:32,099: Row 325: Reverse geocoded lat=46.0025, lon=8.9533 -> country=Switzerland, city=Lugano, state=Ticino
-2025-05-21 06:26:33,104: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=12.3729&lon=-1.5264&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:34,075: Row 326: Reverse geocoded lat=12.3729, lon=-1.5264 -> country=Burkina Faso, city=Ouagadougou, state=None
-2025-05-21 06:26:35,078: Row 327: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
-2025-05-21 06:26:36,079: Row 328: Reverse geocoded lat=37.9842, lon=23.7353 -> country=Greece, city=Athens, state=Attica
-2025-05-21 06:26:37,067: Row 329: Reverse geocoded lat=54.8636, lon=-7.7557 -> country=Ireland, city=None, state=None
-2025-05-21 06:26:38,083: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.8305&lon=-87.656&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:39,123: Row 330: Reverse geocoded lat=34.8305, lon=-87.656 -> country=United States, city=Florence, state=Alabama
-2025-05-21 06:26:40,128: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.8978&lon=-77.2885&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:41,231: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.8978&lon=-77.2885&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:42,087: Row 331: Reverse geocoded lat=38.8978, lon=-77.2885 -> country=United States, city=Reston, state=Virginia
-2025-05-21 06:26:43,091: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.5&lon=19.0412&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:44,067: Row 332: Reverse geocoded lat=47.5, lon=19.0412 -> country=Hungary, city=Budapest, state=None
-2025-05-21 06:26:45,072: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=21.4668&lon=83.9764&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:46,159: Row 333: Reverse geocoded lat=21.4668, lon=83.9764 -> country=India, city=Sambalpur, state=Odisha
-2025-05-21 06:26:47,170: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.808&lon=-2.1118&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:48,040: Row 334: Reverse geocoded lat=52.808, lon=-2.1118 -> country=United Kingdom, city=Stafford, state=England
-2025-05-21 06:26:49,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-22.2635&lon=-49.1364&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:50,033: Row 335: Reverse geocoded lat=-22.2635, lon=-49.1364 -> country=Brazil, city=Bauru, state=São Paulo
-2025-05-21 06:26:51,039: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.8449&lon=14.2716&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:52,041: Row 336: Reverse geocoded lat=40.8449, lon=14.2716 -> country=Italy, city=Naples, state=Campania
-2025-05-21 06:26:53,045: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=13.6687&lon=100.579&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:54,087: Row 337: Reverse geocoded lat=13.6687, lon=100.579 -> country=Thailand, city=Pu Chao Saming Phrai Town Municipality, state=None
-2025-05-21 06:26:55,092: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.5211&lon=73.8502&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:56,061: Row 338: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:26:57,070: Row 339: Reverse geocoded lat=23.7018, lon=90.3742 -> country=Bangladesh, city=Keraniganj, state=Dhaka Division
-2025-05-21 06:26:58,077: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5112&lon=0.0300000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:26:59,110: Row 340: Reverse geocoded lat=51.5112, lon=0.03 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:27:00,093: Row 341: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:27:01,039: Row 342: Reverse geocoded lat=-7.2333, lon=-62.9 -> country=Brazil, city=Humaitá, state=Amazonas
-2025-05-21 06:27:02,085: Row 343: Reverse geocoded lat=40.7547, lon=-73.9614 -> country=United States, city=New York, state=New York
-2025-05-21 06:27:03,124: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.458&lon=30.5303&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:04,124: Row 344: Reverse geocoded lat=50.458, lon=30.5303 -> country=Ukraine, city=Kyiv, state=None
-2025-05-21 06:27:05,122: Row 347: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:27:06,130: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=11.0027&lon=124.6083&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:07,107: Row 348: Reverse geocoded lat=11.0027, lon=124.6083 -> country=Philippines, city=Ormoc, state=Leyte
-2025-05-21 06:27:08,086: Row 349: Reverse geocoded lat=22.717, lon=75.8337 -> country=India, city=Indore, state=Madhya Pradesh
-2025-05-21 06:27:09,050: Row 350: Reverse geocoded lat=22.717, lon=75.8337 -> country=India, city=Indore, state=Madhya Pradesh
-2025-05-21 06:27:10,056: Row 351: Reverse geocoded lat=7.0712, lon=125.6089 -> country=Philippines, city=Davao City, state=None
-2025-05-21 06:27:11,126: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-4.7776&lon=11.8659&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:12,027: Row 352: Reverse geocoded lat=-4.7776, lon=11.8659 -> country=Congo-Brazzaville, city=None, state=Pointe-Noire (département)
-2025-05-21 06:27:13,038: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=19.0748&lon=72.8856&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:14,086: Row 353: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
-2025-05-21 06:27:15,092: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.6874&lon=33.0366&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:16,128: Row 354: Reverse geocoded lat=34.6874, lon=33.0366 -> country=Cyprus, city=Limassol, state=Cyprus
-2025-05-21 06:27:17,066: Row 355: Reverse geocoded lat=34.6874, lon=33.0366 -> country=Cyprus, city=Limassol, state=Cyprus
-2025-05-21 06:27:18,138: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.1953&lon=6.1385&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:19,053: Row 356: Reverse geocoded lat=46.1953, lon=6.1385 -> country=Switzerland, city=Geneva, state=Geneva
-2025-05-21 06:27:20,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.8951&lon=-1.1585&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:21,045: Row 357: Reverse geocoded lat=51.8951, lon=-1.1585 -> country=United Kingdom, city=Cherwell District, state=England
-2025-05-21 06:27:22,055: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.8951&lon=-1.1585&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:23,039: Row 358: Reverse geocoded lat=51.8951, lon=-1.1585 -> country=United Kingdom, city=Cherwell District, state=England
-2025-05-21 06:27:24,046: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.3706&lon=47.9697&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:25,074: Row 359: Reverse geocoded lat=29.3706, lon=47.9697 -> country=Kuwait, city=Kuwait City, state=Capital Governorate
-2025-05-21 06:27:26,078: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3177&lon=-122.0438&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:27,058: Row 360: Reverse geocoded lat=37.3177, lon=-122.0438 -> country=United States, city=Cupertino, state=California
-2025-05-21 06:27:28,064: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.9609&lon=-77.3429&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:29,066: Row 361: Reverse geocoded lat=38.9609, lon=-77.3429 -> country=United States, city=Reston, state=Virginia
-2025-05-21 06:27:30,072: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.1613&lon=-113.9518&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:31,126: Row 363: Reverse geocoded lat=51.1613, lon=-113.9518 -> country=Canada, city=Calgary, state=Alberta
-2025-05-21 06:27:32,130: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.036&lon=114.4654&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:33,052: Row 364: Reverse geocoded lat=38.036, lon=114.4654 -> country=China, city=Shijiazhuang, state=Hebei
-2025-05-21 06:27:34,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.0&lon=105.0&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:35,079: Row 365: Reverse geocoded lat=18, lon=105 -> country=Laos, city=Phonkeo, state=Bolikhamsai
-2025-05-21 06:27:36,084: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=36.096&lon=114.3828&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:37,120: Row 366: Reverse geocoded lat=36.096, lon=114.3828 -> country=China, city=开发区银杏大街街道, state=Henan
-2025-05-21 06:27:38,126: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.6933&lon=-104.7865&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:39,074: Row 367: Reverse geocoded lat=39.6933, lon=-104.7865 -> country=United States, city=Aurora, state=Colorado
-2025-05-21 06:27:40,083: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.7219&lon=-9.1398&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:41,149: Row 368: Reverse geocoded lat=38.7219, lon=-9.1398 -> country=Portugal, city=Lisbon, state=None
-2025-05-21 06:27:42,154: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=17.3843&lon=78.4583&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:43,053: Row 369: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
-2025-05-21 06:27:44,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.8273&lon=-83.2813&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:45,126: Row 370: Reverse geocoded lat=40.8273, lon=-83.2813 -> country=United States, city=Upper Sandusky, state=Ohio
-2025-05-21 06:27:46,132: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=31.2222&lon=121.4581&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:47,091: Row 371: Reverse geocoded lat=31.2222, lon=121.4581 -> country=China, city=Shanghai, state=Shanghai
-2025-05-21 06:27:48,104: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6542&lon=77.2373&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:49,036: Row 372: Reverse geocoded lat=28.6542, lon=77.2373 -> country=India, city=Delhi, state=Delhi
-2025-05-21 06:27:50,026: Row 373: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:27:51,048: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=13.0895&lon=80.2739&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:52,072: Row 374: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:27:53,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.5&lon=-10.0&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:54,053: Row 375: Reverse geocoded lat=28.5, lon=-10 -> country=Morocco, city=Aouint Lahna عوينة لهنا, state=None
-2025-05-21 06:27:55,059: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.0729&lon=7.689&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:56,182: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.0729&lon=7.689&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:27:57,227: Row 377: Reverse geocoded lat=45.0729, lon=7.689 -> country=Italy, city=Turin, state=Piedmont
-2025-05-21 06:27:58,146: Row 378: Reverse geocoded lat=21.4668, lon=83.9764 -> country=India, city=Sambalpur, state=Odisha
-2025-05-21 06:27:59,096: Row 379: Reverse geocoded lat=33.1976, lon=-96.6178 -> country=United States, city=McKinney, state=Texas
-2025-05-21 06:28:00,242: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.7126&lon=-74.0066&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:01,224: Row 380: Reverse geocoded lat=40.7126, lon=-74.0066 -> country=United States, city=New York, state=New York
-2025-05-21 06:28:02,142: Row 381: Reverse geocoded lat=33.4306, lon=-111.9256 -> country=United States, city=Tempe, state=Arizona
-2025-05-21 06:28:03,102: Row 382: Reverse geocoded lat=38.7883, lon=-121.2366 -> country=United States, city=Rocklin, state=California
-2025-05-21 06:28:04,072: Row 383: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
-2025-05-21 06:28:05,222: Row 384: Reverse geocoded lat=51.1876, lon=71.4491 -> country=Kazakhstan, city=Astana, state=Astana
-2025-05-21 06:28:06,135: Row 385: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
-2025-05-21 06:28:07,247: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:08,080: Row 387: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
-2025-05-21 06:28:09,087: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:10,055: Row 388: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
-2025-05-21 06:28:11,060: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:12,078: Row 389: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
-2025-05-21 06:28:13,083: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:14,083: Row 390: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
-2025-05-21 06:28:15,090: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.1023&lon=101.6265&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:16,171: Row 391: Reverse geocoded lat=3.1023, lon=101.6265 -> country=Malaysia, city=Petaling Jaya, state=Selangor
-2025-05-21 06:28:17,178: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3392&lon=-77.4175&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:18,063: Row 392: Reverse geocoded lat=37.3392, lon=-77.4175 -> country=United States, city=None, state=Virginia
-2025-05-21 06:28:19,067: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=21.2339&lon=110.3875&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:20,071: Row 394: Reverse geocoded lat=21.2339, lon=110.3875 -> country=China, city=Chikan District, state=Guangdong Province
-2025-05-21 06:28:21,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=43.3699&lon=-8.4096&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:22,211: Row 395: Reverse geocoded lat=43.3699, lon=-8.4096 -> country=Spain, city=A Coruña, state=Galicia
-2025-05-21 06:28:23,221: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=43.3699&lon=-8.4096&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:24,158: Row 396: Reverse geocoded lat=43.3699, lon=-8.4096 -> country=Spain, city=A Coruña, state=Galicia
-2025-05-21 06:28:25,078: Row 398: Reverse geocoded lat=42.2645, lon=-88.0034 -> country=United States, city=Mundelein, state=Illinois
-2025-05-21 06:28:26,034: Row 399: Reverse geocoded lat=-1.4428, lon=-79.4627 -> country=Ecuador, city=Ventanas, state=Los Ríos
-2025-05-21 06:28:27,126: Row 400: Reverse geocoded lat=-1.4428, lon=-79.4627 -> country=Ecuador, city=Ventanas, state=Los Ríos
-2025-05-21 06:28:28,174: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.0507&lon=31.2489&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:29,174: Row 401: Reverse geocoded lat=30.0507, lon=31.2489 -> country=Egypt, city=Cairo, state=Cairo
-2025-05-21 06:28:30,179: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-33.914&lon=18.4129&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:31,130: Row 403: Reverse geocoded lat=-33.914, lon=18.4129 -> country=South Africa, city=Cape Town, state=Western Cape
-2025-05-21 06:28:32,139: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.4597&lon=77.0282&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:33,081: Row 406: Reverse geocoded lat=28.4597, lon=77.0282 -> country=India, city=Gurgaon, state=Haryana
-2025-05-21 06:28:34,082: Row 407: Reverse geocoded lat=37.3388, lon=-121.8916 -> country=United States, city=San Jose, state=California
-2025-05-21 06:28:35,092: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.1181&lon=113.2539&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:36,089: Row 408: Reverse geocoded lat=23.1181, lon=113.2539 -> country=China, city=Yuexiu District, state=Guangdong Province
-2025-05-21 06:28:37,093: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.3518&lon=0.8088000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:38,131: Row 409: Reverse geocoded lat=49.3518, lon=0.8088 -> country=France, city=Bourg-Achard, state=Normandy
-2025-05-21 06:28:39,141: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.315&lon=83.0058&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:40,072: Row 410: Reverse geocoded lat=25.315, lon=83.0058 -> country=India, city=Varanasi, state=Uttar Pradesh
-2025-05-21 06:28:41,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.3275&lon=78.0325&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:42,079: Row 411: Reverse geocoded lat=30.3275, lon=78.0325 -> country=India, city=Dehradun, state=Uttarakhand
-2025-05-21 06:28:43,089: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=11.9924&lon=8.5173&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:44,125: Row 412: Reverse geocoded lat=11.9924, lon=8.5173 -> country=Nigeria, city=Tudun Wazurchi, state=Kano State
-2025-05-21 06:28:45,133: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.0734&lon=55.2979&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:46,101: Row 413: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
-2025-05-21 06:28:47,057: Row 414: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
-2025-05-21 06:28:48,050: Row 415: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
-2025-05-21 06:28:49,113: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6542&lon=77.2373&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:50,092: Row 416: Reverse geocoded lat=28.6542, lon=77.2373 -> country=India, city=Delhi, state=Delhi
-2025-05-21 06:28:51,096: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.8835&lon=-87.6305&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:52,049: Row 417: Reverse geocoded lat=41.8835, lon=-87.6305 -> country=United States, city=Chicago, state=Illinois
-2025-05-21 06:28:53,056: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.8707&lon=120.0898&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:54,132: Row 418: Reverse geocoded lat=30.8707, lon=120.0898 -> country=China, city=Wuxing District, state=Zhejiang
-2025-05-21 06:28:55,135: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.1302&lon=13.329&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:56,025: Row 419: Reverse geocoded lat=38.1302, lon=13.329 -> country=Italy, city=Palermo, state=Sicily
-2025-05-21 06:28:57,030: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.5852&lon=-0.2360000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:28:58,078: Row 420: Reverse geocoded lat=52.5852, lon=-0.236 -> country=United Kingdom, city=Peterborough, state=England
-2025-05-21 06:28:59,082: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.4073&lon=-121.939&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:00,103: Row 421: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
-2025-05-21 06:29:01,100: Row 422: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
-2025-05-21 06:29:02,114: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6922&lon=12.5478&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:03,221: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6922&lon=12.5478&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:04,095: Row 423: Reverse geocoded lat=55.6922, lon=12.5478 -> country=Denmark, city=Copenhagen, state=Capital Region of Denmark
-2025-05-21 06:29:05,099: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.5943&lon=85.1352&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:06,049: Row 425: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
-2025-05-21 06:29:07,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5064&lon=-0.0200000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:08,080: Row 427: Reverse geocoded lat=51.5064, lon=-0.02 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:29:09,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=56.1567&lon=10.2153&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:10,051: Row 428: Reverse geocoded lat=56.1567, lon=10.2153 -> country=Denmark, city=Aarhus, state=Central Denmark Region
-2025-05-21 06:29:11,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.5547&lon=5.9801&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:12,079: Row 429: Reverse geocoded lat=45.5547, lon=5.9801 -> country=France, city=Challes-les-Eaux, state=Auvergne-Rhône-Alpes
-2025-05-21 06:29:13,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-19.9218&lon=-43.9359&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:14,028: Row 432: Reverse geocoded lat=-19.9218, lon=-43.9359 -> country=Brazil, city=Belo Horizonte, state=Minas Gerais
-2025-05-21 06:29:15,033: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.615&lon=-122.1619&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:16,027: Row 433: Reverse geocoded lat=47.615, lon=-122.1619 -> country=United States, city=Bellevue, state=Washington
-2025-05-21 06:29:17,033: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.8707&lon=120.0898&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:18,075: Row 436: Reverse geocoded lat=30.8707, lon=120.0898 -> country=China, city=Wuxing District, state=Zhejiang
-2025-05-21 06:29:19,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.4381&lon=24.7369&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:20,133: Row 437: Reverse geocoded lat=59.4381, lon=24.7369 -> country=Estonia, city=Tallinn, state=None
-2025-05-21 06:29:21,144: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.8373&lon=80.9165&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:22,051: Row 438: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
-2025-05-21 06:29:23,055: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.8373&lon=80.9165&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:24,064: Row 439: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
-2025-05-21 06:29:25,068: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.5211&lon=73.8502&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:26,114: Row 440: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:29:27,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.9439&lon=5.8939&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:28,100: Row 441: Reverse geocoded lat=51.9439, lon=5.8939 -> country=Netherlands, city=Arnhem, state=Gelderland
-2025-05-21 06:29:29,105: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.7857&lon=98.9736&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:30,104: Row 442: Reverse geocoded lat=18.7857, lon=98.9736 -> country=Thailand, city=Chiang Mai City Municipality, state=None
-2025-05-21 06:29:31,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.4636&lon=85.8783&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:32,202: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.4636&lon=85.8783&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:33,025: Row 443: Reverse geocoded lat=20.4636, lon=85.8783 -> country=India, city=Cuttack, state=Odisha
-2025-05-21 06:29:34,029: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=46.2253&lon=6.1516&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:35,072: Row 444: Reverse geocoded lat=46.2253, lon=6.1516 -> country=Switzerland, city=Geneva, state=Geneva
-2025-05-21 06:29:36,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.6667&lon=104.0667&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:37,169: Row 446: Reverse geocoded lat=30.6667, lon=104.0667 -> country=China, city=Chengdu, state=Sichuan
-2025-05-21 06:29:38,174: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.1169&lon=8.6837&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:39,115: Row 447: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:29:40,041: Row 448: Reverse geocoded lat=26.3304, lon=-81.5871 -> country=United States, city=None, state=Florida
-2025-05-21 06:29:41,056: Row 449: Reverse geocoded lat=-3.717, lon=-38.5287 -> country=Brazil, city=Fortaleza, state=Ceará
-2025-05-21 06:29:42,047: Row 450: Reverse geocoded lat=55.7481, lon=12.5347 -> country=Denmark, city=Jægersborg, state=Capital Region of Denmark
-2025-05-21 06:29:43,132: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.5625&lon=-122.0004&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:44,023: Row 451: Reverse geocoded lat=37.5625, lon=-122.0004 -> country=United States, city=Fremont, state=California
-2025-05-21 06:29:45,027: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-12.0432&lon=-77.0282&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:46,105: Row 452: Reverse geocoded lat=-12.0432, lon=-77.0282 -> country=Peru, city=Lima, state=Lima
-2025-05-21 06:29:47,111: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.3287&lon=18.0717&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:48,064: Row 453: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
-2025-05-21 06:29:49,045: Row 454: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
-2025-05-21 06:29:50,074: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.1922&lon=20.8846&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:51,089: Row 456: Reverse geocoded lat=52.1922, lon=20.8846 -> country=Poland, city=Warsaw, state=Masovian Voivodeship
-2025-05-21 06:29:52,059: Row 457: Reverse geocoded lat=40.4153, lon=-3.694 -> country=Spain, city=Madrid, state=Community of Madrid
-2025-05-21 06:29:53,098: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=40.4153&lon=-3.694&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:54,167: Row 458: Reverse geocoded lat=40.4153, lon=-3.694 -> country=Spain, city=Madrid, state=Community of Madrid
-2025-05-21 06:29:55,171: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.3247&lon=18.056&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:56,113: Row 459: Reverse geocoded lat=59.3247, lon=18.056 -> country=Sweden, city=Stockholm, state=None
-2025-05-21 06:29:57,067: Row 460: Reverse geocoded lat=59.3247, lon=18.056 -> country=Sweden, city=Stockholm, state=None
-2025-05-21 06:29:58,118: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.0596&lon=19.9338&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:29:59,092: Row 461: Reverse geocoded lat=50.0596, lon=19.9338 -> country=Poland, city=Krakow, state=Lesser Poland Voivodeship
-2025-05-21 06:30:00,095: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3924&lon=16.9019&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:01,130: Row 462: Reverse geocoded lat=52.3924, lon=16.9019 -> country=Poland, city=Poznan, state=Greater Poland Voivodeship
-2025-05-21 06:30:02,136: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=59.3287&lon=18.0717&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:03,111: Row 463: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
-2025-05-21 06:30:04,114: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.7599&lon=6.0953&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:05,112: Row 465: Reverse geocoded lat=50.7599, lon=6.0953 -> country=Germany, city=Aachen, state=North Rhine-Westphalia
-2025-05-21 06:30:06,118: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=60.3951&lon=5.3237&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:07,090: Row 466: Reverse geocoded lat=60.3951, lon=5.3237 -> country=Norway, city=Bergen, state=None
-2025-05-21 06:30:08,096: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=60.3951&lon=5.3237&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:09,200: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=60.3951&lon=5.3237&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:10,061: Row 467: Reverse geocoded lat=60.3951, lon=5.3237 -> country=Norway, city=Bergen, state=None
-2025-05-21 06:30:11,055: Row 468: Reverse geocoded lat=60.3951, lon=5.3237 -> country=Norway, city=Bergen, state=None
-2025-05-21 06:30:12,068: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3759&lon=4.8975&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:13,176: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3759&lon=4.8975&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:14,156: Row 469: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
-2025-05-21 06:30:15,095: Row 470: Reverse geocoded lat=-25.5283, lon=-49.2161 -> country=Brazil, city=São José dos Pinhais, state=Paraná
-2025-05-21 06:30:16,166: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.0042&lon=28.8574&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:17,106: Row 471: Reverse geocoded lat=47.0042, lon=28.8574 -> country=Moldova, city=Chișinău, state=None
-2025-05-21 06:30:18,110: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-3.1032&lon=-60.0288&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:19,094: Row 473: Reverse geocoded lat=-3.1032, lon=-60.0288 -> country=Brazil, city=Manaus, state=Amazonas
-2025-05-21 06:30:20,098: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=12.9753&lon=77.591&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:21,083: Row 474: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
-2025-05-21 06:30:22,086: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=54.5455&lon=18.4494&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:23,100: Row 476: Reverse geocoded lat=54.5455, lon=18.4494 -> country=Poland, city=Gdynia, state=Pomeranian Voivodeship
-2025-05-21 06:30:24,104: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.7219&lon=-9.1398&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:25,105: Row 477: Reverse geocoded lat=38.7219, lon=-9.1398 -> country=Portugal, city=Lisbon, state=None
-2025-05-21 06:30:26,109: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.3946&lon=2.1406&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:27,155: Row 478: Reverse geocoded lat=41.3946, lon=2.1406 -> country=Spain, city=Barcelona, state=Catalonia
-2025-05-21 06:30:28,105: Row 479: Reverse geocoded lat=-27.4683, lon=153.0322 -> country=Australia, city=None, state=Queensland
-2025-05-21 06:30:29,165: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.7537&lon=21.2257&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:30,276: Row 480: Reverse geocoded lat=45.7537, lon=21.2257 -> country=Romania, city=Timișoara, state=None
-2025-05-21 06:30:31,158: Row 481: Reverse geocoded lat=53.7606, lon=-0.3734 -> country=United Kingdom, city=Hull, state=England
-2025-05-21 06:30:32,164: Row 482: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
-2025-05-21 06:30:33,286: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.3759&lon=4.8975&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:34,191: Row 483: Reverse geocoded lat=52.3759, lon=4.8975 -> country=Netherlands, city=Amsterdam, state=North Holland
-2025-05-21 06:30:35,102: Row 484: Reverse geocoded lat=31.3709, lon=73.0336 -> country=Pakistan, city=Faisalabad City Tehsil, state=Punjab
-2025-05-21 06:30:36,097: Row 485: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
-2025-05-21 06:30:37,127: Row 486: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:30:38,115: Row 487: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
-2025-05-21 06:30:39,209: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.1836&lon=11.5754&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:40,049: Row 488: Reverse geocoded lat=48.1836, lon=11.5754 -> country=Germany, city=Munich, state=Bavaria
-2025-05-21 06:30:41,054: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=54.1085&lon=12.0645&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:42,050: Row 489: Reverse geocoded lat=54.1085, lon=12.0645 -> country=Germany, city=Rostock, state=Mecklenburg-Vorpommern
-2025-05-21 06:30:43,056: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.8327&lon=-9.166&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:44,122: Row 490: Reverse geocoded lat=38.8327, lon=-9.166 -> country=Portugal, city=Loures, state=None
-2025-05-21 06:30:45,127: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=56.9473&lon=24.0979&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:46,055: Row 491: Reverse geocoded lat=56.9473, lon=24.0979 -> country=Latvia, city=Riga, state=None
-2025-05-21 06:30:47,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.9192&lon=73.8741&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:48,167: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.9192&lon=73.8741&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:49,080: Row 494: Reverse geocoded lat=29.9192, lon=73.8741 -> country=India, city=Ganganagar, state=Rajasthan
-2025-05-21 06:30:50,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.1169&lon=8.6837&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:51,090: Row 495: Reverse geocoded lat=50.1169, lon=8.6837 -> country=Germany, city=Frankfurt, state=Hesse
-2025-05-21 06:30:52,043: Row 496: Reverse geocoded lat=-29.8553, lon=31.0428 -> country=South Africa, city=Durban, state=KwaZulu-Natal
-2025-05-21 06:30:53,095: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=29.5689&lon=106.5577&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:54,073: Row 498: Reverse geocoded lat=29.5689, lon=106.5577 -> country=China, city=Yuzhong District, state=Chongqing
-2025-05-21 06:30:55,048: Row 500: Reverse geocoded lat=22.5643, lon=88.3693 -> country=India, city=Kolkata, state=West Bengal
-2025-05-21 06:30:56,082: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.0582&lon=8.7868&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:57,050: Row 501: Reverse geocoded lat=53.0582, lon=8.7868 -> country=Germany, city=Bremen, state=Bremen
-2025-05-21 06:30:58,053: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=19.0748&lon=72.8856&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:30:59,082: Row 502: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
-2025-05-21 06:31:00,085: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.0&lon=105.0&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:01,139: Row 503: Reverse geocoded lat=35, lon=105 -> country=China, city=Bangluo, state=Gansu
-2025-05-21 06:31:02,145: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4537&lon=-0.2320000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:03,054: Row 505: Reverse geocoded lat=51.4537, lon=-0.232 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:31:04,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=33.8333&lon=35.8333&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:05,056: Row 507: Reverse geocoded lat=33.8333, lon=35.8333 -> country=Lebanon, city=Jdita, state=Beqaa Governorate
-2025-05-21 06:31:06,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.5971&lon=120.9798&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:07,077: Row 509: Reverse geocoded lat=14.5971, lon=120.9798 -> country=Philippines, city=Manila, state=None
-2025-05-21 06:31:08,081: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.0729&lon=4.5475&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:09,043: Row 510: Reverse geocoded lat=52.0729, lon=4.5475 -> country=Netherlands, city=Benthuizen, state=South Holland
-2025-05-21 06:31:10,049: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.0729&lon=4.5475&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:11,067: Row 511: Reverse geocoded lat=52.0729, lon=4.5475 -> country=Netherlands, city=Benthuizen, state=South Holland
-2025-05-21 06:31:12,073: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:13,109: Row 512: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
-2025-05-21 06:31:14,113: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=38.9757&lon=-77.6414&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:15,077: Row 513: Reverse geocoded lat=38.9757, lon=-77.6414 -> country=United States, city=Aldie, state=Virginia
-2025-05-21 06:31:16,081: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=10.4873&lon=-66.8738&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:17,046: Row 514: Reverse geocoded lat=10.4873, lon=-66.8738 -> country=Venezuela, city=Caracas, state=Miranda State
-2025-05-21 06:31:18,053: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-23.6301&lon=-46.6378&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:19,058: Row 515: Reverse geocoded lat=-23.6301, lon=-46.6378 -> country=Brazil, city=São Paulo, state=São Paulo
-2025-05-21 06:31:20,061: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.6475&lon=121.0494&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:21,038: Row 516: Reverse geocoded lat=14.6475, lon=121.0494 -> country=Philippines, city=Quezon City, state=None
-2025-05-21 06:31:22,043: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.9136&lon=75.7858&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:23,079: Row 519: Reverse geocoded lat=26.9136, lon=75.7858 -> country=India, city=Jaipur, state=Rajasthan
-2025-05-21 06:31:24,087: Row 520: Reverse geocoded lat=40.7592, lon=-111.8875 -> country=United States, city=Salt Lake City, state=Utah
-2025-05-21 06:31:25,091: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.2706&lon=85.8334&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:26,124: Row 523: Reverse geocoded lat=20.2706, lon=85.8334 -> country=India, city=Bhubaneswar Municipal Corporation, state=Odisha
-2025-05-21 06:31:27,131: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=17.3843&lon=78.4583&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:28,041: Row 525: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
-2025-05-21 06:31:29,047: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6327&lon=77.2198&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:30,139: Row 528: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:31:31,141: Row 529: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:31:32,145: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=25.5943&lon=85.1352&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:33,015: Row 530: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
-2025-05-21 06:31:34,021: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=24.6869&lon=46.7224&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:35,025: Row 531: Reverse geocoded lat=24.6869, lon=46.7224 -> country=Saudi Arabia, city=Riyadh, state=Riyadh Region
-2025-05-21 06:31:36,032: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.7556&lon=21.2526&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:37,089: Row 532: Reverse geocoded lat=48.7556, lon=21.2526 -> country=Slovakia, city=Košice, state=Region of Košice
-2025-05-21 06:31:38,094: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.3028&lon=-121.9982&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:39,114: Row 533: Reverse geocoded lat=37.3028, lon=-121.9982 -> country=United States, city=San Jose, state=California
-2025-05-21 06:31:40,108: Row 536: Reverse geocoded lat=35.7449, lon=0.5663 -> country=Algeria, city=Relizane, state=Relizane
-2025-05-21 06:31:41,081: Row 538: Reverse geocoded lat=23.1181, lon=113.2539 -> country=China, city=Yuexiu District, state=Guangdong Province
-2025-05-21 06:31:42,124: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.9707&lon=32.7316&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:43,051: Row 540: Reverse geocoded lat=39.9707, lon=32.7316 -> country=Turkey, city=Yenimahalle, state=Ankara
-2025-05-21 06:31:44,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.6533&lon=90.4923&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:45,101: Row 541: Reverse geocoded lat=23.6533, lon=90.4923 -> country=Bangladesh, city=Narayanganj, state=Dhaka Division
-2025-05-21 06:31:46,060: Row 542: Reverse geocoded lat=22.3008, lon=73.2043 -> country=India, city=Vadodara, state=Gujarat
-2025-05-21 06:31:47,109: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.0822&lon=-81.5498&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:48,085: Row 545: Reverse geocoded lat=30.0822, lon=-81.5498 -> country=United States, city=None, state=Florida
-2025-05-21 06:31:49,090: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=3.5847&lon=98.6629&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:50,083: Row 546: Reverse geocoded lat=3.5847, lon=98.6629 -> country=Indonesia, city=City of Medan, state=North Sumatra
-2025-05-21 06:31:51,089: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.8964&lon=76.5909&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:52,053: Row 547: Reverse geocoded lat=28.8964, lon=76.5909 -> country=India, city=Rohtak, state=Haryana
-2025-05-21 06:31:53,057: Row 548: Reverse geocoded lat=30.5394, lon=-91.0522 -> country=United States, city=Central, state=Louisiana
-2025-05-21 06:31:54,062: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4562&lon=6.0573&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:55,152: Row 550: Reverse geocoded lat=51.4562, lon=6.0573 -> country=Netherlands, city=Horst, state=Limburg
-2025-05-21 06:31:56,160: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.4073&lon=-121.939&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:57,154: Row 551: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
-2025-05-21 06:31:58,160: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:31:59,167: Row 552: Reverse geocoded lat=48.8558, lon=2.3494 -> country=France, city=Paris, state=Ile-de-France
-2025-05-21 06:32:00,017: Row 553: Reverse geocoded lat=25.5943, lon=85.1352 -> country=India, city=Patna, state=Bihar
-2025-05-21 06:32:01,177: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-37.867&lon=144.9973&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:02,067: Row 554: Reverse geocoded lat=-37.867, lon=144.9973 -> country=Australia, city=Melbourne, state=Victoria
-2025-05-21 06:32:03,073: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.5956&lon=10.0044&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:04,071: Row 555: Reverse geocoded lat=53.5956, lon=10.0044 -> country=Germany, city=Hamburg, state=None
-2025-05-21 06:32:05,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.144&lon=17.1332&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:06,024: Row 556: Reverse geocoded lat=51.144, lon=17.1332 -> country=Poland, city=Wrocław, state=Lower Silesian Voivodeship
-2025-05-21 06:32:07,029: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:08,151: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:09,192: Row 557: Reverse geocoded lat=48.8558, lon=2.3494 -> country=France, city=Paris, state=Ile-de-France
-2025-05-21 06:32:10,198: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=43.2951&lon=5.3861&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:11,103: Row 558: Reverse geocoded lat=43.2951, lon=5.3861 -> country=France, city=Marseille, state=Provence-Alpes-Côte d'Azur
-2025-05-21 06:32:12,084: Row 559: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
-2025-05-21 06:32:13,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.3275&lon=78.0325&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:14,090: Row 561: Reverse geocoded lat=30.3275, lon=78.0325 -> country=India, city=Dehradun, state=Uttarakhand
-2025-05-21 06:32:15,094: Row 562: Reverse geocoded lat=21.4913, lon=39.1841 -> country=Saudi Arabia, city=Jeddah, state=Makkah Region
-2025-05-21 06:32:16,099: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=1.3153&lon=103.9143&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:17,104: Row 563: Reverse geocoded lat=1.3153, lon=103.9143 -> country=Singapore, city=Singapore, state=None
-2025-05-21 06:32:18,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.9414&lon=40.1933&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:19,057: Row 565: Reverse geocoded lat=37.9414, lon=40.1933 -> country=Turkey, city=Kayapınar, state=None
-2025-05-21 06:32:20,062: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.767&lon=9.1827&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:21,042: Row 566: Reverse geocoded lat=48.767, lon=9.1827 -> country=Germany, city=Stuttgart, state=Baden-Württemberg
-2025-05-21 06:32:22,033: Row 568: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
-2025-05-21 06:32:23,047: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.3741&lon=9.5417&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:24,097: Row 569: Reverse geocoded lat=47.3741, lon=9.5417 -> country=Switzerland, city=Altstätten, state=St. Gallen
-2025-05-21 06:32:25,101: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.1454&lon=77.3281&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:26,203: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.1454&lon=77.3281&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:27,049: Row 573: Reverse geocoded lat=28.1454, lon=77.3281 -> country=India, city=Palwal, state=Haryana
-2025-05-21 06:32:28,056: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.4982&lon=13.4755&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:29,047: Row 575: Reverse geocoded lat=52.4982, lon=13.4755 -> country=Germany, city=Berlin, state=None
-2025-05-21 06:32:30,052: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=52.4982&lon=13.4755&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:31,102: Row 576: Reverse geocoded lat=52.4982, lon=13.4755 -> country=Germany, city=Berlin, state=None
-2025-05-21 06:32:32,107: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.6438&lon=120.9632&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:33,102: Row 578: Reverse geocoded lat=14.6438, lon=120.9632 -> country=Philippines, city=Caloocan, state=None
-2025-05-21 06:32:34,105: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.0396&lon=-111.9361&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:35,184: Row 579: Reverse geocoded lat=41.0396, lon=-111.9361 -> country=United States, city=Kaysville, state=Utah
-2025-05-21 06:32:36,189: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.8713&lon=4.3758&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:37,105: Row 580: Reverse geocoded lat=50.8713, lon=4.3758 -> country=Belgium, city=Schaerbeek - Schaarbeek, state=None
-2025-05-21 06:32:38,108: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.867&lon=-4.2621&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:39,115: Row 581: Reverse geocoded lat=55.867, lon=-4.2621 -> country=United Kingdom, city=Glasgow, state=Scotland
-2025-05-21 06:32:40,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.0&lon=105.0&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:41,107: Row 583: Reverse geocoded lat=18, lon=105 -> country=Laos, city=Phonkeo, state=Bolikhamsai
-2025-05-21 06:32:42,028: Row 584: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:32:43,031: Row 586: Reverse geocoded lat=26.8373, lon=80.9165 -> country=India, city=Lucknow, state=Uttar Pradesh
-2025-05-21 06:32:44,118: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.911&lon=116.395&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:45,043: Row 587: Reverse geocoded lat=39.911, lon=116.395 -> country=China, city=Dongcheng District, state=Beijing
-2025-05-21 06:32:46,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5081&lon=-0.1278000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:47,144: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.5081&lon=-0.1278000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:32:48,220: Row 591: Reverse geocoded lat=51.5081, lon=-0.1278 -> country=United Kingdom, city=City of Westminster, state=England
-2025-05-21 06:32:49,171: Row 592: Reverse geocoded lat=32.3039, lon=-110.8368 -> country=United States, city=None, state=Arizona
-2025-05-21 06:32:50,093: Row 594: Reverse geocoded lat=37.5453, lon=-77.9187 -> country=United States, city=Powhatan, state=Virginia
-2025-05-21 06:32:51,168: Row 595: Reverse geocoded lat=30.6798, lon=-88.2914 -> country=United States, city=None, state=Alabama
-2025-05-21 06:32:52,188: Row 596: Reverse geocoded lat=36.8178, lon=10.1656 -> country=Tunisia, city=Tunis, state=Tunis
-2025-05-21 06:32:53,174: Row 597: Reverse geocoded lat=34.2635, lon=108.9246 -> country=China, city=Lianhu District, state=Shaanxi
-2025-05-21 06:32:54,166: Row 598: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
-2025-05-21 06:32:55,079: Row 599: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
-2025-05-21 06:32:56,073: Row 600: Reverse geocoded lat=21.9974, lon=79.0011 -> country=India, city=Malhanwara, state=Madhya Pradesh
-2025-05-21 06:32:57,009: Row 602: Reverse geocoded lat=-29.8553, lon=31.0428 -> country=South Africa, city=Durban, state=KwaZulu-Natal
-2025-05-21 06:32:58,142: Row 603: Reverse geocoded lat=1.2872, lon=103.8507 -> country=Singapore, city=Singapore, state=None
-2025-05-21 06:32:59,091: Row 604: Reverse geocoded lat=23.7207, lon=90.5635 -> country=Bangladesh, city=None, state=Dhaka Division
-2025-05-21 06:33:00,155: Row 606: Reverse geocoded lat=51.5164, lon=-0.093 -> country=United Kingdom, city=City of London, state=England
-2025-05-21 06:33:01,195: Row 607: Reverse geocoded lat=29.572, lon=-95.54 -> country=United States, city=Missouri City, state=Texas
-2025-05-21 06:33:02,031: Row 609: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
-2025-05-21 06:33:03,096: Row 610: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:33:04,228: Row 611: Reverse geocoded lat=18.5211, lon=73.8502 -> country=India, city=Pune, state=Maharashtra
-2025-05-21 06:33:05,147: Row 612: Reverse geocoded lat=40.2584, lon=-111.6591 -> country=United States, city=Provo, state=Utah
-2025-05-21 06:33:06,139: Row 613: Reverse geocoded lat=37.4073, lon=-121.939 -> country=United States, city=San Jose, state=California
-2025-05-21 06:33:07,134: Row 614: Reverse geocoded lat=22.2904, lon=70.7915 -> country=India, city=Rajkot, state=Gujarat
-2025-05-21 06:33:08,126: Row 615: Reverse geocoded lat=37.9448, lon=-122.0279 -> country=United States, city=Concord, state=California
-2025-05-21 06:33:09,246: Row 617: Reverse geocoded lat=34.2619, lon=-6.5821 -> country=Morocco, city=Kenitra, state=None
-2025-05-21 06:33:10,158: Row 619: Reverse geocoded lat=45.3696, lon=-73.5654 -> country=Canada, city=Saint-Constant, state=Quebec
-2025-05-21 06:33:11,127: Row 620: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
-2025-05-21 06:33:12,055: Row 621: Reverse geocoded lat=-23.5475, lon=-46.6361 -> country=Brazil, city=São Paulo, state=São Paulo
-2025-05-21 06:33:13,134: Row 622: Reverse geocoded lat=55.6523, lon=12.0805 -> country=Denmark, city=Roskilde, state=Region Zealand
-2025-05-21 06:33:14,059: Row 623: Reverse geocoded lat=-33.914, lon=18.4129 -> country=South Africa, city=Cape Town, state=Western Cape
-2025-05-21 06:33:15,314: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.6113&lon=6.1294&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:16,173: Row 625: Reverse geocoded lat=49.6113, lon=6.1294 -> country=Luxembourg, city=Luxembourg, state=None
-2025-05-21 06:33:17,144: Row 626: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
-2025-05-21 06:33:18,159: Row 627: Reverse geocoded lat=30.7339, lon=76.7889 -> country=India, city=Chandigarh, state=Chandigarh
-2025-05-21 06:33:19,101: Row 628: Reverse geocoded lat=40.7547, lon=-73.9614 -> country=United States, city=New York, state=New York
-2025-05-21 06:33:20,165: Row 629: Reverse geocoded lat=51.5081, lon=-0.1278 -> country=United Kingdom, city=City of Westminster, state=England
-2025-05-21 06:33:21,085: Row 630: Reverse geocoded lat=31.2222, lon=121.4581 -> country=China, city=Shanghai, state=Shanghai
-2025-05-21 06:33:22,096: Row 631: Reverse geocoded lat=31.2222, lon=121.4581 -> country=China, city=Shanghai, state=Shanghai
-2025-05-21 06:33:23,172: Row 633: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
-2025-05-21 06:33:24,049: Row 634: Reverse geocoded lat=1, lon=38 -> country=Kenya, city=Waso ward, state=Samburu
-2025-05-21 06:33:25,067: Row 635: Reverse geocoded lat=-22.1231, lon=-51.3881 -> country=Brazil, city=Presidente Prudente, state=São Paulo
-2025-05-21 06:33:26,108: Row 636: Reverse geocoded lat=40.6036, lon=-3.7041 -> country=Spain, city=Tres Cantos, state=Community of Madrid
-2025-05-21 06:33:27,099: Row 637: Reverse geocoded lat=33.1371, lon=-96.7488 -> country=United States, city=Frisco, state=Texas
-2025-05-21 06:33:28,178: Row 638: Reverse geocoded lat=39.7593, lon=-104.9651 -> country=United States, city=Denver, state=Colorado
-2025-05-21 06:33:29,096: Row 639: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:33:30,217: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=36.1898&lon=44.0157&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:31,034: Row 640: Reverse geocoded lat=36.1898, lon=44.0157 -> country=Iraq, city=Erbil, state=Erbil Governorate
-2025-05-21 06:33:32,040: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=37.2845&lon=-107.8646&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:33,127: Row 641: Reverse geocoded lat=37.2845, lon=-107.8646 -> country=United States, city=Durango, state=Colorado
-2025-05-21 06:33:34,126: Row 642: Reverse geocoded lat=35.9825, lon=-78.5376 -> country=United States, city=Wake Forest, state=North Carolina
-2025-05-21 06:33:35,098: Row 643: Reverse geocoded lat=-14.785, lon=-39.2785 -> country=Brazil, city=Itabuna, state=Bahia
-2025-05-21 06:33:36,135: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-14.785&lon=-39.2785&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:37,095: Row 644: Reverse geocoded lat=-14.785, lon=-39.2785 -> country=Brazil, city=Itabuna, state=Bahia
-2025-05-21 06:33:38,100: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.3904&lon=-0.0992000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:39,138: Row 648: Reverse geocoded lat=51.3904, lon=-0.0992 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:33:40,142: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=11.0102&lon=76.9701&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:41,193: Row 649: Reverse geocoded lat=11.0102, lon=76.9701 -> country=India, city=Coimbatore, state=Tamil Nadu
-2025-05-21 06:33:42,021: Row 650: Reverse geocoded lat=-22.4851, lon=-47.1733 -> country=Brazil, city=Engenheiro Coelho, state=São Paulo
-2025-05-21 06:33:43,203: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.9171&lon=24.7158&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:44,162: Row 652: Reverse geocoded lat=48.9171, lon=24.7158 -> country=Ukraine, city=Ivano-Frankivsk, state=Ivano-Frankivsk Oblast
-2025-05-21 06:33:45,168: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8558&lon=2.3494&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:46,178: Row 653: Reverse geocoded lat=48.8558, lon=2.3494 -> country=France, city=Paris, state=Ile-de-France
-2025-05-21 06:33:47,182: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-6.3088&lon=107.316&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:48,153: Row 654: Reverse geocoded lat=-6.3088, lon=107.316 -> country=Indonesia, city=Karawang, state=West Java
-2025-05-21 06:33:49,151: Row 655: Reverse geocoded lat=43.6547, lon=-79.3623 -> country=Canada, city=Toronto, state=Ontario
-2025-05-21 06:33:50,154: Row 657: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:33:51,149: Row 658: Reverse geocoded lat=39.338, lon=-82.986 -> country=United States, city=Chillicothe, state=Ohio
-2025-05-21 06:33:52,164: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=22.2842&lon=114.1759&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:53,119: Row 659: Reverse geocoded lat=22.2842, lon=114.1759 -> country=China, city=Hong Kong Island, state=Hong Kong
-2025-05-21 06:33:54,091: Row 660: Reverse geocoded lat=17.3843, lon=78.4583 -> country=India, city=Hyderabad, state=Telangana
-2025-05-21 06:33:55,060: Row 661: Reverse geocoded lat=25.0734, lon=55.2979 -> country=United Arab Emirates, city=None, state=Dubai
-2025-05-21 06:33:56,075: Row 662: Reverse geocoded lat=7.3782, lon=3.9062 -> country=Nigeria, city=None, state=Oyo State
-2025-05-21 06:33:57,072: Row 663: Reverse geocoded lat=-31.8544, lon=115.8433 -> country=Australia, city=None, state=Western Australia
-2025-05-21 06:33:58,136: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6078&lon=12.9982&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:33:59,022: Row 664: Reverse geocoded lat=55.6078, lon=12.9982 -> country=Sweden, city=Malmö, state=None
-2025-05-21 06:34:00,027: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=55.6078&lon=12.9982&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:01,017: Row 665: Reverse geocoded lat=55.6078, lon=12.9982 -> country=Sweden, city=Malmö, state=None
-2025-05-21 06:34:02,020: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.2049&lon=16.3662&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:03,130: Row 667: Reverse geocoded lat=48.2049, lon=16.3662 -> country=Austria, city=Vienna, state=None
-2025-05-21 06:34:04,134: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.5466&lon=10.021&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:05,028: Row 668: Reverse geocoded lat=53.5466, lon=10.021 -> country=Germany, city=Hamburg, state=None
-2025-05-21 06:34:06,033: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=53.5247&lon=-7.3385&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:07,036: Row 669: Reverse geocoded lat=53.5247, lon=-7.3385 -> country=Ireland, city=Mullingar, state=None
-2025-05-21 06:34:08,040: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.5329&lon=69.1682&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:09,149: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.5329&lon=69.1682&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:10,180: Row 670: Reverse geocoded lat=34.5329, lon=69.1682 -> country=Afghanistan, city=Kabul, state=Kabul Province
-2025-05-21 06:34:11,115: Row 671: Reverse geocoded lat=59.3326, lon=18.0651 -> country=Sweden, city=Stockholm, state=None
-2025-05-21 06:34:12,117: Row 672: Reverse geocoded lat=-31.8544, lon=115.8433 -> country=Australia, city=None, state=Western Australia
-2025-05-21 06:34:13,143: Row 673: Reverse geocoded lat=-26.2309, lon=28.0583 -> country=South Africa, city=Johannesburg, state=Gauteng
-2025-05-21 06:34:14,190: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.7169&lon=-1.9716&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:15,189: Row 674: Reverse geocoded lat=51.7169, lon=-1.9716 -> country=United Kingdom, city=Cotswold District, state=England
-2025-05-21 06:34:16,111: Row 675: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
-2025-05-21 06:34:17,199: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-6.2056&lon=106.8376&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:18,107: Row 676: Reverse geocoded lat=-6.2056, lon=106.8376 -> country=Indonesia, city=Special capital Region of Jakarta, state=None
-2025-05-21 06:34:19,111: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=47.409&lon=9.3361&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:20,173: Row 677: Reverse geocoded lat=47.409, lon=9.3361 -> country=Switzerland, city=St. Gallen, state=St. Gallen
-2025-05-21 06:34:21,081: Row 678: Reverse geocoded lat=38.3802, lon=-75.6347 -> country=United States, city=None, state=Maryland
-2025-05-21 06:34:22,046: Row 679: Reverse geocoded lat=19.0748, lon=72.8856 -> country=India, city=Mumbai, state=Maharashtra
-2025-05-21 06:34:23,126: Row 681: Reverse geocoded lat=34.197, lon=-118.8199 -> country=United States, city=Thousand Oaks, state=California
-2025-05-21 06:34:24,189: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=26.9136&lon=75.7858&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:25,044: Row 682: Reverse geocoded lat=26.9136, lon=75.7858 -> country=India, city=Jaipur, state=Rajasthan
-2025-05-21 06:34:26,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-6.9172&lon=107.6296&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:27,069: Row 683: Reverse geocoded lat=-6.9172, lon=107.6296 -> country=Indonesia, city=Bandung City, state=West Java
-2025-05-21 06:34:28,072: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.7681&lon=139.6258&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:29,116: Row 685: Reverse geocoded lat=35.7681, lon=139.6258 -> country=Japan, city=Nerima, state=None
-2025-05-21 06:34:30,120: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=22.9505&lon=91.4608&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:31,051: Row 686: Reverse geocoded lat=22.9505, lon=91.4608 -> country=Bangladesh, city=Feni, state=Chittagong Division
-2025-05-21 06:34:32,055: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.1211&lon=-117.4362&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:33,140: Row 687: Reverse geocoded lat=34.1211, lon=-117.4362 -> country=United States, city=Fontana, state=California
-2025-05-21 06:34:34,135: Row 689: Reverse geocoded lat=-22.3135, lon=-42.8741 -> country=Brazil, city=Teresópolis, state=Rio de Janeiro
-2025-05-21 06:34:35,144: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=32.8908&lon=13.1796&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:36,120: Row 690: Reverse geocoded lat=32.8908, lon=13.1796 -> country=Libya, city=Tripoli, state=Tripoli
-2025-05-21 06:34:37,026: Row 691: Reverse geocoded lat=13.0895, lon=80.2739 -> country=India, city=Chennai, state=Tamil Nadu
-2025-05-21 06:34:38,118: Row 692: Reverse geocoded lat=59.3287, lon=18.0717 -> country=Sweden, city=Stockholm, state=None
-2025-05-21 06:34:39,129: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=16.2689&lon=-61.5073&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:40,073: Row 693: Reverse geocoded lat=16.2689, lon=-61.5073 -> country=France, city=Les Abymes, state=Guadeloupe
-2025-05-21 06:34:41,076: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=14.6343&lon=-90.5155&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:42,143: Row 694: Reverse geocoded lat=14.6343, lon=-90.5155 -> country=Guatemala, city=Guatemala City, state=Guatemala Department
-2025-05-21 06:34:43,097: Row 695: Reverse geocoded lat=-25.757, lon=28.1443 -> country=South Africa, city=Pretoria, state=Gauteng
-2025-05-21 06:34:44,152: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=50.8713&lon=4.3758&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:45,112: Row 696: Reverse geocoded lat=50.8713, lon=4.3758 -> country=Belgium, city=Schaerbeek - Schaarbeek, state=None
-2025-05-21 06:34:46,102: Row 698: Reverse geocoded lat=6.4474, lon=3.3903 -> country=Nigeria, city=Lagos, state=Lagos State
-2025-05-21 06:34:47,119: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=33.6099&lon=73.0301&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:48,060: Row 699: Reverse geocoded lat=33.6099, lon=73.0301 -> country=Pakistan, city=Rawalpindi Cantonment, state=Punjab
-2025-05-21 06:34:49,064: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=51.4964&lon=-0.1224000&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:50,061: Row 700: Reverse geocoded lat=51.4964, lon=-0.1224 -> country=United Kingdom, city=London, state=England
-2025-05-21 06:34:51,046: Row 701: Reverse geocoded lat=33.6128, lon=-117.6622 -> country=United States, city=Mission Viejo, state=California
-2025-05-21 06:34:52,037: Row 702: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:34:53,071: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-1.944&lon=30.062&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:54,102: Row 703: Reverse geocoded lat=-1.944, lon=30.062 -> country=Rwanda, city=Kigali, state=Kigali City
-2025-05-21 06:34:55,071: Row 704: Reverse geocoded lat=31.9555, lon=35.9435 -> country=Jordan, city=None, state=Amman
-2025-05-21 06:34:56,111: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=41.2615&lon=69.2177&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:57,076: Row 705: Reverse geocoded lat=41.2615, lon=69.2177 -> country=Uzbekistan, city=Tashkent, state=None
-2025-05-21 06:34:58,087: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=-22.9072&lon=-43.1883&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:34:59,053: Row 706: Reverse geocoded lat=-22.9072, lon=-43.1883 -> country=Brazil, city=Rio de Janeiro, state=Rio de Janeiro
-2025-05-21 06:35:00,057: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=35.6893&lon=139.6899&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:01,043: Row 707: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
-2025-05-21 06:35:02,050: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=30.9977&lon=29.7432&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:03,118: Row 708: Reverse geocoded lat=30.9977, lon=29.7432 -> country=Egypt, city=Al Wadi, state=Alexandria
-2025-05-21 06:35:04,124: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=20.0024&lon=73.7945&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:05,042: Row 709: Reverse geocoded lat=20.0024, lon=73.7945 -> country=India, city=Nashik, state=Maharashtra
-2025-05-21 06:35:06,046: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=28.6327&lon=77.2198&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:07,076: Row 712: Reverse geocoded lat=28.6327, lon=77.2198 -> country=India, city=New Delhi, state=Delhi
-2025-05-21 06:35:08,080: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=18.1667&lon=-77.25&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:09,053: Row 714: Reverse geocoded lat=18.1667, lon=-77.25 -> country=Jamaica, city=None, state=None
-2025-05-21 06:35:10,045: Row 715: Reverse geocoded lat=18.1667, lon=-77.25 -> country=Jamaica, city=None, state=None
-2025-05-21 06:35:11,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=34.2635&lon=108.9246&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:12,107: Row 716: Reverse geocoded lat=34.2635, lon=108.9246 -> country=China, city=Lianhu District, state=Shaanxi
-2025-05-21 06:35:13,112: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=9.0245&lon=38.7485&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:14,090: Row 717: Reverse geocoded lat=9.0245, lon=38.7485 -> country=Ethiopia, city=None, state=Addis Ababa
-2025-05-21 06:35:15,094: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8582&lon=2.3387&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:16,219: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8582&lon=2.3387&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:17,242: Row 718: Reverse geocoded lat=48.8582, lon=2.3387 -> country=France, city=Paris, state=None
-2025-05-21 06:35:18,209: Row 719: Reverse geocoded lat=48.8582, lon=2.3387 -> country=France, city=Paris, state=None
-2025-05-21 06:35:19,250: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=48.8582&lon=2.3387&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:20,228: Row 720: Reverse geocoded lat=48.8582, lon=2.3387 -> country=France, city=Paris, state=None
-2025-05-21 06:35:21,081: Row 721: Reverse geocoded lat=37.751, lon=-97.822 -> country=United States, city=None, state=Kansas
-2025-05-21 06:35:22,084: Row 722: Reverse geocoded lat=51.5164, lon=-0.093 -> country=United Kingdom, city=City of London, state=England
-2025-05-21 06:35:23,117: Row 723: Reverse geocoded lat=51.5164, lon=-0.093 -> country=United Kingdom, city=City of London, state=England
-2025-05-21 06:35:24,076: Row 724: Reverse geocoded lat=24.1844, lon=88.2673 -> country=India, city=Murshidabad, state=West Bengal
-2025-05-21 06:35:25,245: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=49.0719&lon=17.4638&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:26,063: Row 725: Reverse geocoded lat=49.0719, lon=17.4638 -> country=Czechia, city=Uherské Hradiště, state=Central Moravia
-2025-05-21 06:35:27,066: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=39.1994&lon=-84.526&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:28,048: Row 726: Reverse geocoded lat=39.1994, lon=-84.526 -> country=United States, city=Cincinnati, state=Ohio
-2025-05-21 06:35:29,058: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:30,181: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.0276&lon=72.5871&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:31,148: Row 727: Reverse geocoded lat=23.0276, lon=72.5871 -> country=India, city=Ahmedabad, state=Gujarat
-2025-05-21 06:35:32,083: Row 728: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
-2025-05-21 06:35:33,115: Row 729: Reverse geocoded lat=12.9753, lon=77.591 -> country=India, city=Bengaluru, state=Karnataka
-2025-05-21 06:35:34,141: Row 731: Reverse geocoded lat=34.7599, lon=113.6459 -> country=China, city=Zhengzhou, state=Henan
-2025-05-21 06:35:35,069: Row 732: Reverse geocoded lat=19.4324, lon=-99.1229 -> country=Mexico, city=Mexico City, state=Mexico City
-2025-05-21 06:35:36,162: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=45.4722&lon=9.1922&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:37,171: Row 733: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:35:38,131: Row 734: Reverse geocoded lat=29.1383, lon=-80.9956 -> country=United States, city=Port Orange, state=Florida
-2025-05-21 06:35:39,127: Row 735: Reverse geocoded lat=45.4722, lon=9.1922 -> country=Italy, city=Milan, state=Lombardy
-2025-05-21 06:35:40,054: Row 736: Reverse geocoded lat=35.6893, lon=139.6899 -> country=Japan, city=Shinjuku, state=None
-2025-05-21 06:35:41,169: Row 737: Reverse geocoded lat=38.8574, lon=-77.1 -> country=United States, city=Arlington, state=Virginia
-2025-05-21 06:35:42,189: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ReadTimeoutError("HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Read timed out. (read timeout=1)")': /reverse?lat=23.7891&lon=90.4126&format=json&accept-language=en-US&addressdetails=1
-2025-05-21 06:35:43,127: Row 739: Reverse geocoded lat=23.7891, lon=90.4126 -> country=Bangladesh, city=Dhaka, state=Dhaka Division
-2025-05-21 06:35:43,159: Created columns 'Country', 'City', and 'State' with reverse geocoded data.
-2025-05-21 06:35:43,429: Cleaned data written to /Users/T.Martin/Projects/reporting_doc_feedback/data_exports/cleaned_data.xlsx
-2025-05-21 06:35:43,429: Script completed successfully.

From 6397a101726cc6d27d3c63020cbbeedb0cc9ba34 Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Mon, 23 Jun 2025 11:04:18 +0100
Subject: [PATCH 041/117] feat: Update NGINX Ingress Helm Operator links from
 nginxinc to nginx (#727)

---
 .../installing-nic/installation-with-operator.md          | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/content/nic/installation/installing-nic/installation-with-operator.md b/content/nic/installation/installing-nic/installation-with-operator.md
index b3e94f990..3fc35a09f 100644
--- a/content/nic/installation/installing-nic/installation-with-operator.md
+++ b/content/nic/installation/installing-nic/installation-with-operator.md
@@ -20,10 +20,10 @@ If you're using NGINX Plus, get the NGINX Ingress Controller JWT and [create a l
     - For NGINX Plus Ingress Controller, view the [Get the F5 Registry NGINX Ingress Controller image]({{< ref "/nic/installation/nic-images/get-registry-image.md" >}}) topic for details on how to pull the image from the F5 Docker registry.
     - The [Get the NGINX Ingress Controller image with JWT]({{< ref "/nic/installation/nic-images/get-image-using-jwt.md" >}}) topic describes how to use your subscription JWT token to get the image.
     - The [Build NGINX Ingress Controller]({{< ref "/nic/installation/build-nginx-ingress-controller.md" >}}) topic explains how to push an image to a private Docker registry.
-1. Install the NGINX Ingress Operator following the [instructions](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/docs/installation.md).
-1. Create the SecurityContextConstraint as outlined in the ["Getting Started" instructions](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/README.md#getting-started).
+1. Install the NGINX Ingress Operator following the [instructions](https://github.com/nginx/nginx-ingress-helm-operator/blob/main/docs/installation.md).
+1. Create the SecurityContextConstraint as outlined in the ["Getting Started" instructions](https://github.com/nginx/nginx-ingress-helm-operator/blob/main/README.md#getting-started).
 
-{{< note >}} If you're upgrading your operator installation to a later release, navigate [here](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/helm-charts/nginx-ingress) and run `kubectl apply -f crds/` or `oc apply -f crds/` as a prerequisite {{< /note >}}
+{{< note >}} If you're upgrading your operator installation to a later release, navigate [here](https://github.com/nginx/nginx-ingress-helm-operator/blob/main/helm-charts/nginx-ingress) and run `kubectl apply -f crds/` or `oc apply -f crds/` as a prerequisite {{< /note >}}
 
 ## Create the NGINX Ingress Controller manifest
 
@@ -60,7 +60,7 @@ kubectl apply -f nginx-ingress-controller.yaml
 
 A new instance of NGINX Ingress Controller will be deployed by the NGINX Ingress Operator in the `default` namespace with default parameters.
 
-To configure other parameters of the NginxIngressController resource, check the [documentation](https://github.com/nginxinc/nginx-ingress-helm-operator/blob/main/docs/nginx-ingress-controller.md).
+To configure other parameters of the NginxIngressController resource, check the [documentation](https://github.com/nginx/nginx-ingress-helm-operator/blob/main/docs/nginx-ingress-controller.md).
 
 ## Troubleshooting
 

From cb9b7d15047f94dc1b0c2a4685b3ddede03120b8 Mon Sep 17 00:00:00 2001
From: Vleq <62358413+Vleq@users.noreply.github.com>
Date: Mon, 23 Jun 2025 06:50:01 -0700
Subject: [PATCH 042/117] feat: Simplify HTTP Load Balancer grammr (#515)

Update wording from beginning up through "Limit the Number of
Connections". Break up long sentences and clarify ambiguous wording,
using the linked pages on https://nginx.org/en/docs/ to disambiguate.

Consistency changes throughout, favoring the wording most used in this
document: Change all "load-balanc*" to "load balanc*" except in URLs.
Change "parameter of" to "parameter to".

Remove gerunds from subheadings throughout.

Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
---
 .../load-balancer/http-load-balancer.md       | 89 ++++++++++---------
 1 file changed, 48 insertions(+), 41 deletions(-)

diff --git a/content/nginx/admin-guide/load-balancer/http-load-balancer.md b/content/nginx/admin-guide/load-balancer/http-load-balancer.md
index cfce044ca..b76578a60 100644
--- a/content/nginx/admin-guide/load-balancer/http-load-balancer.md
+++ b/content/nginx/admin-guide/load-balancer/http-load-balancer.md
@@ -14,17 +14,17 @@ type:
 
 Load balancing across multiple application instances is a commonly used technique for optimizing resource utilization, maximizing throughput, reducing latency, and ensuring fault‑tolerant configurations.
 
-Watch the [F5 NGINX Plus for Load Balancing and Scaling](https://www.nginx.com/resources/webinars/nginx-plus-for-load-balancing-30-min/) webinar on demand for a deep dive on techniques that NGINX users employ to build large‑scale, highly available web services.
+Watch the [F5 NGINX Plus for Load Balancing and Scaling](https://www.nginx.com/resources/webinars/nginx-plus-for-load-balancing-30-min/) webinar, for a deep dive on techniques to build large‑scale, highly available web services.
 
 NGINX and NGINX Plus can be used in different deployment scenarios as a [very efficient HTTP load balancer](https://www.nginx.com/blog/nginx-load-balance-deployment-models/).
 
 
 <span id="proxy_pass"></span>
-## Proxying HTTP Traffic to a Group of Servers
+## Proxy HTTP Traffic to a Group of Servers
 
-To start using NGINX Plus or NGINX Open Source to load balance HTTP traffic to a group of servers, first you need to define the group with the [`upstream`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) directive. The directive is placed in the [`http`](https://nginx.org/en/docs/http/ngx_http_core_module.html#http) context.
+Use NGINX Plus or NGINX Open Source to load balance across a group of servers. First, define the group of servers with the [`upstream`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) directive. Place the directive in the [`http`](https://nginx.org/en/docs/http/ngx_http_core_module.html#http) context.
 
-Servers in the group are configured using the [`server`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#server) directive (not to be confused with the `server` block that defines a virtual server running on NGINX). For example, the following configuration defines a group named **backend** and consists of three server configurations (which may resolve in more than three actual servers):
+Servers in the group are configured using the [`server`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#server) directive (not to be confused with the `server` block that defines a virtual server running on NGINX). For example, the following configuration defines a group named **backend** and consists of three server configurations. This may resolve to more than three actual servers:
 
 ```nginx
 http {
@@ -36,7 +36,9 @@ http {
 }
 ```
 
-To pass requests to a server group, the name of the group is specified in the [`proxy_pass`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass) directive (or the [`fastcgi_pass`](https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_pass), [`memcached_pass`](https://nginx.org/en/docs/http/ngx_http_memcached_module.html#memcached_pass), [`scgi_pass`](https://nginx.org/en/docs/http/ngx_http_scgi_module.html#scgi_pass), or [`uwsgi_pass`](https://nginx.org/en/docs/http/ngx_http_uwsgi_module.html#uwsgi_pass) directives for those protocols.) In the next example, a virtual server running on NGINX passes all requests to the **backend** upstream group defined in the previous example:
+To pass requests to a server group, the name of the group is specified in the [`proxy_pass`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass) directive. If using an alternate protocol such as fastcgi, use that protocol's pass directive instead. The list of alternate pass directives is: [`fastcgi_pass`](https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_pass), [`memcached_pass`](https://nginx.org/en/docs/http/ngx_http_memcached_module.html#memcached_pass), [`scgi_pass`](https://nginx.org/en/docs/http/ngx_http_scgi_module.html#scgi_pass), [`uwsgi_pass`](https://nginx.org/en/docs/http/ngx_http_uwsgi_module.html#uwsgi_pass).
+
+In the next example, a virtual server running on NGINX passes all requests to the **backend** upstream group defined in the previous example:
 
 ```nginx
 server {
@@ -46,7 +48,7 @@ server {
 }
 ```
 
-The following example combines the two snippets above and shows how to proxy HTTP requests to the **backend** server group. The group consists of three servers, two of them running instances of the same application while the third is a backup server. Because no load‑balancing algorithm is specified in the `upstream` block, NGINX uses the default algorithm, Round Robin:
+The following example combines the two snippets above and shows how to proxy HTTP requests to the **backend** server group. The group consists of three servers, two of them running instances of the same application while the third is a backup server.
 
 ```nginx
 http {
@@ -66,11 +68,14 @@ http {
 
 
 <span id="method"></span>
-## Choosing a Load-Balancing Method
+## Choosing a Load Balancing Method
+
+NGINX Open Source supports four load balancing methods: Round Robin, Least Connections, IP Hash, and Generic Hash.
+NGINX Plus supports six load balancing methods: the four above, Least Time, and Random.
 
-NGINX Open Source supports four load‑balancing methods, and NGINX Plus adds two more methods:
+> **Note:** When configuring any method other than Round Robin, put the corresponding directive ([`hash`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash), [`ip_hash`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#ip_hash), [`least_conn`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_conn), [`least_time`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_time), or [`random`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#random)) above the list of `server` directives in the [`upstream {}`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) block.
 
-1. Round Robin – Requests are distributed evenly across the servers, with [server weights](#weights) taken into consideration. This method is used by default (there is no directive for enabling it):
+1. Round Robin – Requests are distributed evenly across the servers, with [server weights](#weights) taken into consideration. This method is used by default; there is no directive for enabling it.
 
     ```nginx
     upstream backend {
@@ -80,7 +85,7 @@ NGINX Open Source supports four load‑balancing methods, and NGINX Plus adds tw
     }
     ```
 
-2. [Least Connections](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_conn) – A request is sent to the server with the least number of active connections, again with [server weights](#weights) taken into consideration:
+2. [Least Connections](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_conn) – A request is sent to the server with the least number of active connections. This method also takes  [server weights](#weights) into consideration.
 
     ```nginx
     upstream backend {
@@ -90,7 +95,7 @@ NGINX Open Source supports four load‑balancing methods, and NGINX Plus adds tw
     }
     ```
 
-3. [IP Hash](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#ip_hash) – The server to which a request is sent is determined from the client IP address. In this case, either the first three octets of the IPv4 address or the whole IPv6 address are used to calculate the hash value. The method guarantees that requests from the same address get to the same server unless it is not available.
+3. [IP Hash](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#ip_hash) – The server to which a request is sent is determined from the client IP address. In this case, either the first three octets of the IPv4 address or the whole IPv6 address is used to calculate the hash value. The method guarantees that requests from the same address get to the same server unless it is not available.
 
     ```nginx
     upstream backend {
@@ -100,7 +105,7 @@ NGINX Open Source supports four load‑balancing methods, and NGINX Plus adds tw
     }
     ```
 
-    If one of the servers needs to be temporarily removed from the load‑balancing rotation, it can be marked with the [down](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#down) parameter in order to preserve the current hashing of client IP addresses. Requests that were to be processed by this server are automatically sent to the next server in the group:
+    If one of the servers needs to be temporarily removed from the load‑balancing rotation, it can be marked with the [down](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#down) parameter. This preserves the current hashing of client IP addresses. Requests that were to be processed by this server are automatically sent to the next server in the group.
 
     ```nginx
     upstream backend {
@@ -110,7 +115,7 @@ NGINX Open Source supports four load‑balancing methods, and NGINX Plus adds tw
     }
     ```
 
-4. Generic [Hash](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash) – The server to which a request is sent is determined from a user‑defined key which can be a text string, variable, or a combination. For example, the key may be a paired source IP address and port, or a URI as in this example:
+4. Generic [Hash](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash) – The server to which a request is sent is determined from a user‑defined key. This key can be a text string, a variable, or a combination. For example, the key may be a paired source IP address and port. This example uses a URI:
 
     ```nginx
     upstream backend {
@@ -120,9 +125,9 @@ NGINX Open Source supports four load‑balancing methods, and NGINX Plus adds tw
     }
     ```
 
-    The optional [consistent](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash) parameter to the `hash` directive enables [ketama](http://www.last.fm/user/RJ/journal/2007/04/10/rz_libketama_-_a_consistent_hashing_algo_for_memcache_clients) consistent‑hash load balancing. Requests are evenly distributed across all upstream servers based on the user‑defined hashed key value. If an upstream server is added to or removed from an upstream group, only a few keys are remapped which minimizes cache misses in the case of load‑balancing cache servers or other applications that accumulate state.
+    The optional [consistent](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash) parameter to the `hash` directive enables [ketama](http://www.last.fm/user/RJ/journal/2007/04/10/rz_libketama_-_a_consistent_hashing_algo_for_memcache_clients) consistent‑hash load balancing. Requests are evenly distributed across all upstream servers based on the user‑defined hashed key value. If an upstream server is added to or removed from an upstream group, only a few keys are remapped, which minimizes cache misses. This is useful for load balancing cache servers or other applications that accumulate state.
 
-5. [Least Time](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_time) (NGINX Plus only) – For each request, NGINX Plus selects the server with the lowest average latency and the lowest number of active connections, where the lowest average latency is calculated based on which of the following [parameters](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_time) to the `least_time` directive is included:
+5. [Least Time](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_time) (NGINX Plus only) – For each request, NGINX Plus selects the server with the lowest average latency and the lowest number of active connections. The lowest average latency is calculated based the [parameter](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_time) included with the `least_time` directive. This parameter can be one of the following:
 
     - `header` – Time to receive the first byte from the server
     - `last_byte` – Time to receive the full response from the server
@@ -136,8 +141,8 @@ NGINX Open Source supports four load‑balancing methods, and NGINX Plus adds tw
     }
     ```
 
-6. [Random](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#random) – Each request will be passed to a randomly selected server.
-If the `two` parameter is specified, first, NGINX randomly selects two servers taking into account server weights, and then chooses one of these servers using the specified method:
+6. [Random](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#random) (NGINX Plus only) – Each request will be passed to a randomly selected server. This method takes into account server weights.
+If the `two` parameter is specified, NGINX first randomly selects two servers, then chooses between these servers using one of the following specified methods:
 
     - `least_conn` – The least number of active connections
     - `least_time=header` (NGINX Plus) – The least average time to receive the response header from the server ([`$upstream_header_time`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#var_upstream_header_time))
@@ -153,15 +158,14 @@ If the `two` parameter is specified, first, NGINX randomly selects two servers t
     }
     ```
 
-    The **Random** load balancing method should be used for distributed environments where multiple load balancers are passing requests to the same set of backends. For environments where the load balancer has a full view of all requests, use other load balancing methods, such as round robin, least connections and least time.
+    The **Random** load balancing method should be used for distributed environments where multiple load balancers are passing requests to the same set of backends. For environments where the load balancer has a full view of all requests, use other load balancing methods.
 
-> **Note:** When configuring any method other than Round Robin, put the corresponding directive ([`hash`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash), [`ip_hash`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#ip_hash), [`least_conn`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_conn), [`least_time`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#least_time), or [`random`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#random)) above the list of `server` directives in the [`upstream {}`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) block.
 
 
 <span id="weights"></span>
 ## Server Weights
 
-By default, NGINX distributes requests among the servers in the group according to their weights using the Round Robin method. The [`weight`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#weight) parameter to the [`server`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#server) directive sets the weight of a server; the default is `1`:
+Some load balancing methods, including Round Robin, Least Connections, and Random, distribute requests according to their server weights. The [`weight`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#weight) parameter to the [`server`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#server) directive sets the weight of a server. If no weight is set, it defaults to `1`:
 
 ```nginx
 upstream backend {
@@ -171,15 +175,15 @@ upstream backend {
 }
 ```
 
-In the example, **backend1.example.com** has weight `5`; the other two servers have the default weight (`1`), but the one with IP address `192.0.0.1` is marked as a `backup` server and does not receive requests unless both of the other servers are unavailable. With this configuration of weights, out of every `6` requests, `5` are sent to **backend1.example.com** and `1` to **backend2.example.com**.
+In the example above, **backend1.example.com** has weight `5`, while the other two servers have the default weight (`1`). However, the one with IP address `192.0.0.1` is marked as a `backup` server and does not receive requests unless both of the other servers are unavailable. With this configuration of weights, out of every `6` requests, `5` are sent to **backend1.example.com** and `1` to **backend2.example.com**.
 
 
 <span id="slow_start"></span>
 ## Server Slow-Start
 
-The server slow‑start feature prevents a recently recovered server from being overwhelmed by connections, which may time out and cause the server to be marked as failed again.
+The server slow‑start feature prevents a recently recovered server from being overwhelmed by connections, which may time out and cause the server to be marked as failed again. This feature is only available in NGINX Plus.
 
-In NGINX Plus, slow‑start allows an upstream server to gradually recover its weight from `0` to its nominal value after it has been recovered or became available. This can be done with the [`slow_start`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start) parameter to the `server` directive:
+Slow‑start allows an upstream server to gradually recover its weight from `0` to its nominal value after it has recovered or become available. This can be done with the [`slow_start`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start) parameter to the `server` directive:
 
 ```nginx
 upstream backend {
@@ -189,19 +193,19 @@ upstream backend {
 }
 ```
 
-The time value (here, `30` seconds) sets the time during which NGINX Plus ramps up the number of connections to the server to the full value.
+The time value (here, `30` seconds) sets the time during which NGINX Plus ramps up the number of connections to the server to the full value. If no value is specified, it defaults to `0`, which disables slow-start.
 
-Note that if there is only a single server in a group, the [`max_fails`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails), [`fail_timeout`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout), and [`slow_start`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start) parameters to the `server` directive are ignored and the server is never considered unavailable.
+> **Note:** If there is only a single server in a group, the [`max_fails`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_fails), [`fail_timeout`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#fail_timeout), and [`slow_start`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#slow_start) parameters to the `server` directive are ignored, and the server is never considered unavailable.
 
 
 <span id="sticky"></span>
-## Enabling Session Persistence
+## Session Persistence
 
 Session persistence means that NGINX Plus identifies user sessions and routes all requests in a given session to the same upstream server.
 
 NGINX Plus supports three session persistence methods. The methods are set with the [`sticky`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky) directive. (For session persistence with NGINX Open Source, use the `hash` or `ip_hash` directive as described [above](#method).)
 
-- [Sticky cookie](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_cookie) – NGINX Plus adds a session cookie to the first response from the upstream group and identifies the server that sent the response. The client's next request contains the cookie value and NGINX Plus route the request to the upstream server that responded to the first request:
+- [Sticky cookie](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_cookie) – NGINX Plus adds a session cookie to the first response from the upstream group and identifies the server that sent the response. The client's next request contains the cookie value, and NGINX Plus routes the request to the upstream server that responded to the first request. This is the simplest session persistence method.
 
     ```nginx
     upstream backend {
@@ -211,9 +215,9 @@ NGINX Plus supports three session persistence methods. The methods are set with
     }
     ```
 
-    In the example, the `srv_id` parameter sets the name of the cookie. The optional `expires` parameter sets the time for the browser to keep the cookie (here, `1` hour). The optional `domain` parameter defines the domain for which the cookie is set, and the optional `path` parameter defines the path for which the cookie is set. This is the simplest session persistence method.
+    In the example above, the `srv_id` parameter sets the name of the cookie. The optional `expires` parameter sets the time for the browser to keep the cookie (here, `1` hour). The optional `domain` parameter defines the domain for which the cookie is set, and the optional `path` parameter defines the path for which the cookie is set.
 
-- [Sticky route](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_route) – NGINX Plus assigns a “route” to the client when it receives the first request. All subsequent requests are compared to the [`route`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#route) parameter of the `server` directive to identify the server to which the request is proxied. The route information is taken from either a cookie or the request URI.
+- [Sticky route](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_route) – Use the [`route`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#route) parameter to the `server` directive to assign a route identifier to each server. NGINX Plus assigns one of the route identifiers to the client when it receives the client's first request. Subsequent requests then compare these route identifiers, which are either stored in a cookie or passed in the request URI. 
 
     ```nginx
     upstream backend {
@@ -222,8 +226,9 @@ NGINX Plus supports three session persistence methods. The methods are set with
         sticky route $route_cookie $route_uri;
     }
     ```
-
-- [Sticky learn](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_learn) method – NGINX Plus first finds session identifiers by inspecting requests and responses. Then NGINX Plus “learns” which upstream server corresponds to which session identifier. Generally, these identifiers are passed in a HTTP cookie. If a request contains a session identifier already “learned”, NGINX Plus forwards the request to the corresponding server:
+    In the example above, the session cookie is checked first for the route identifier. If there is none, then the URI is checked second.
+  
+- [Sticky learn](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_learn) – NGINX Plus first finds session identifiers by inspecting requests and responses. Then NGINX Plus “learns” which upstream server corresponds to which session identifier. Generally, these identifiers are passed in a HTTP cookie. If a request contains a session identifier already “learned”, NGINX Plus forwards the request to the corresponding server:
 
     ```nginx
     upstream backend {
@@ -266,11 +271,15 @@ NGINX Plus supports three session persistence methods. The methods are set with
 
 
 <span id="maxconns"></span>
-## Limiting the Number of Connections
+## Limit the Number of Connections
+
+With NGINX Plus, it is possible to limit the number of active connections to an upstream server.
 
-With NGINX Plus, it is possible to limit the number of active connections to an upstream server by specifying the maximum number with the [`max_conns`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_conns) parameter.
+The [`max_conns`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#max_conns) parameter sets the maximum number of connections to the upstream server.
 
-If the `max_conns` limit has been reached, the request is placed in a queue for further processing, provided that the [`queue`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#queue) directive is also included to set the maximum number of requests that can be simultaneously in the queue:
+The [`queue`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#queue) directive allows excess connections to be held in a queue. It requires a maxmum number for the queue and a timeout.
+
+If the `max_conns` limit has been reached, the request is placed in a queue for further processing. If the queue limit has been reached, if no queue directive is specified, or if a client reaches the `timeout` time in queue, the client will receive an error. 
 
 ```nginx
 upstream backend {
@@ -280,13 +289,11 @@ upstream backend {
 }
 ```
 
-If the queue is filled up with requests or the upstream server cannot be selected during the timeout specified by the optional `timeout` parameter, the client receives an error.
-
-Note that the `max_conns` limit is ignored if there are idle [`keepalive`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) connections opened in other [`worker processes`](https://nginx.org/en/docs/ngx_core_module.html#worker_processes). As a result, the total number of connections to the server might exceed the `max_conns` value in a configuration where the memory is [shared with multiple worker processes](#zone).
+> **Note:** The `max_conns` limit is ignored if there are idle [`keepalive`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) connections opened in other [`worker processes`](https://nginx.org/en/docs/ngx_core_module.html#worker_processes). As a result, the total number of connections to the server might exceed the `max_conns` value in a configuration where the memory is [shared with multiple worker processes](#zone).
 
 
 <span id="health"></span>
-## Configuring Health Checks
+## Configure Health Checks
 
 NGINX can continually test your HTTP upstream servers, avoid the servers that have failed, and gracefully add the recovered servers into the load‑balanced group.
 
@@ -294,7 +301,7 @@ See [HTTP Health Checks]({{< ref "nginx/admin-guide/load-balancer/http-health-ch
 
 
 <span id="zone"></span>
-## Sharing Data with Multiple Worker Processes
+## Share Data with Multiple Worker Processes
 
 If an [`upstream`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) block does not include the [`zone`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone) directive, each worker process keeps its own copy of the server group configuration and maintains its own set of related counters. The counters include the current number of connections to each server in the group and the number of failed attempts to pass a request to a server. As a result, the server group configuration cannot be modified dynamically.
 
@@ -308,7 +315,7 @@ Similarly, the [Least Connections](#method) load‑balancing method might not wo
 
 
 <span id="zone-size"></span>
-### Setting the Zone Size
+### Set the Zone Size
 
 It is not possible to recommend an ideal memory‑zone size, because usage patterns vary widely. The required amount of memory is determined by which features (such as [session persistence](#sticky), [health checks](#health_active), or [DNS re‑resolving](#resolve)) are enabled and how the upstream servers are identified.
 
@@ -320,7 +327,7 @@ As an example, with the `sticky_route` session persistence method and a single h
 
 
 <span id="resolve"></span>
-## Configuring HTTP Load Balancing Using DNS
+## Configure HTTP Load Balancing Using DNS
 
 The configuration of a server group can be modified at runtime using DNS.
 

From 9df3955fbbb2f22b55a56dcda2e29405e97c4c76 Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Mon, 23 Jun 2025 14:50:58 +0100
Subject: [PATCH 043/117] feat: Add logo parameters to NGINX Ingress Controller
 & Gateway Fabric (#728)

---
 content/ngf/_index.md | 13 +++++++------
 content/nic/_index.md |  3 ++-
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/content/ngf/_index.md b/content/ngf/_index.md
index f4685bcf1..193663591 100644
--- a/content/ngf/_index.md
+++ b/content/ngf/_index.md
@@ -1,10 +1,11 @@
 ---
-title: "NGINX Gateway Fabric"
+title: NGINX Gateway Fabric
 url: /nginx-gateway-fabric/
 cascade:
-    banner:
-        enabled: true
-        type: deprecation
-        start-date: 2025-05-30
-        md: /_banners/ngf-2.0-release.md
+  logo: NGINX-Gateway-Fabric-product-icon.png
+  banner:
+    enabled: true
+    type: deprecation
+    start-date: 2025-05-30
+    md: /_banners/ngf-2.0-release.md
 ---
\ No newline at end of file
diff --git a/content/nic/_index.md b/content/nic/_index.md
index 8d93ce681..0ab007f88 100644
--- a/content/nic/_index.md
+++ b/content/nic/_index.md
@@ -1,5 +1,6 @@
 ---
 title: NGINX Ingress Controller
-menu: docs
 url: /nginx-ingress-controller/
+cascade:
+  logo: NGINX-Ingress-Controller-product-icon.png
 ---

From a50ded847ab0893db6dd1bbe56615add68db1ea1 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 24 Jun 2025 02:56:16 -0700
Subject: [PATCH 044/117] feat: Add landing page archetype (#668)

This commit adds a new landing page archetype, which has the
ability to display various cards to highlight specific items. The
archetype includes inline guidance like other archetypes, including
explanations of new frontmatter parameters and a new card shortcode.

---------

Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 archetypes/landing-page.md | 49 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 archetypes/landing-page.md

diff --git a/archetypes/landing-page.md b/archetypes/landing-page.md
new file mode 100644
index 000000000..91c1ab0d2
--- /dev/null
+++ b/archetypes/landing-page.md
@@ -0,0 +1,49 @@
+---
+# The title is the product name
+title: 
+# The URL is the base of the deployed path, becoming "docs.nginx.com/<url>/<other-pages>"
+url: 
+# The cascade directive applies its nested parameters down the page tree until overwritten
+cascade:
+  # The logo file is resolved from the theme, in the folder /static/images/icons/
+  logo:
+# The subtitle displays directly underneath the heading of a given page
+nd-subtitle: 
+# Indicates that this is a custom landing page
+nd-landing-page: true
+# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
+nd-content-type: landing-page
+# Intended for internal catalogue and search, case sensitive:
+# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
+nd-product:
+---
+
+## About
+[//]: # "These are Markdown comments to guide you through document structure. Remove them as you go, as well as any unnecessary sections."
+[//]: # "Use underscores for _italics_, and double asterisks for **bold**."
+[//]: # "Backticks are for `monospace`, used sparingly and reserved mostly for executable names - they can cause formatting problems. Avoid them in tables: use italics instead."
+
+[//]: # "This initial section introduces the product to a reader: give a short 1-2 sentence summary of what the product does and its value to the reader."
+[//]: # "Name specific functionality it provides: avoid ambiguous descriptions such as 'enables efficiency', focus on what makes it unique."
+
+## Featured content
+[//]: # "You can add a maximum of three cards: any extra will not display."
+[//]: # "One card will take full width page: two will take half width each. Three will stack like an inverse pyramid."
+[//]: # "Some examples of content could be the latest release note, the most common install path, and a popular new feature."
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" isFeaturedSection="true">}}
+    {{<card title="<some-title>">}}
+      <!-- Each description should be roughly 10 words or less. -->
+    {{</card>}}
+    <!-- The titleURL and icon are both optional -->
+    <!-- Lucide icon names can be found at https://lucide.dev/icons/ -->
+    {{<card title="<some-title>" titleUrl="<some-url>" icon="<some-lucide-icon>">}}
+      <!-- Each description should be roughly 10 words or less. -->
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
+
+## Other content 
+
+[//]: # "You can add any extra content for the page here, such as additional cards, diagrams or text."
\ No newline at end of file

From f205c7c0bc46c9c064d630ab3bc29648d6f9e001 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 24 Jun 2025 03:00:55 -0700
Subject: [PATCH 045/117] feat: Rename banner param to nd-banner (#732)

---
 content/agent/_index.md      | 2 +-
 content/controller/_index.md | 2 +-
 content/mesh/_index.md       | 2 +-
 content/ngf/_index.md        | 2 +-
 content/nim/deploy/_index.md | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/content/agent/_index.md b/content/agent/_index.md
index fcb621c38..35cc98e98 100644
--- a/content/agent/_index.md
+++ b/content/agent/_index.md
@@ -3,7 +3,7 @@ title: NGINX Agent
 url: /nginx-agent/
 cascade:
   logo: NGINX-product-icon.png
-  banner:
+  nd-banner:
     enabled: true
     type: deprecation
     start-date: 2025-05-29
diff --git a/content/controller/_index.md b/content/controller/_index.md
index e14138efd..de4760e6f 100644
--- a/content/controller/_index.md
+++ b/content/controller/_index.md
@@ -6,7 +6,7 @@ weight: 2100
 cascade:
   logo: "NGINX-Controller-product-icon-RGB.svg"
   noindex: true
-  banner:
+  nd-banner:
     enabled: true
     type: deprecation
     md: _banners/eos-cltr.md
diff --git a/content/mesh/_index.md b/content/mesh/_index.md
index 5cda71545..e28e00d61 100644
--- a/content/mesh/_index.md
+++ b/content/mesh/_index.md
@@ -8,7 +8,7 @@ description: 'NGINX Service Mesh is a fully integrated lightweight service mesh
 url: /nginx-service-mesh/
 cascade:
   noindex: true
-  banner:
+  nd-banner:
     enabled: true
     type: deprecation
     md: _banners/eos-mesh.md
diff --git a/content/ngf/_index.md b/content/ngf/_index.md
index 193663591..88824442a 100644
--- a/content/ngf/_index.md
+++ b/content/ngf/_index.md
@@ -3,7 +3,7 @@ title: NGINX Gateway Fabric
 url: /nginx-gateway-fabric/
 cascade:
   logo: NGINX-Gateway-Fabric-product-icon.png
-  banner:
+  nd-banner:
     enabled: true
     type: deprecation
     start-date: 2025-05-30
diff --git a/content/nim/deploy/_index.md b/content/nim/deploy/_index.md
index 37404e495..3d898823f 100644
--- a/content/nim/deploy/_index.md
+++ b/content/nim/deploy/_index.md
@@ -4,7 +4,7 @@ description:
 weight: 20
 url: /nginx-instance-manager/deploy/
 cascade:
-  banner:
+  nd-banner:
     enabled: true
     type: deprecation
     md: _banners/upgrade-r33.md

From cd32786ea4624d93902ecee4fd603743e0509aae Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Tue, 24 Jun 2025 11:57:21 +0100
Subject: [PATCH 046/117] feat: Move and update process documentation (#717)

This commit moves and updates some of the process documentation for the
repository. This is an iterative process, which will continue to improve
as time goes on. Some of the changes include:

- Moving the closed contributions document into the documentation folder
- Moving and reframing the F5/NGINX document as "Maintainers etiquette"
- Moving and renaming the "Managing content with Hugo" document
- Moving the style guide from the templates folder

These files will likely be updated in a subsequent PR as we clarify the
contribution process and user flow of other process artefacts, such as
the pull request and issue templates.

Although we do not draw attention to it, the templates folder is being
retained for reference until the style guide and Hugo archetypes contain
the relevant, useful information.
---
 CONTRIBUTING.md                               | 12 ++++++-----
 documentation/README.md                       |  6 +++++-
 .../closed-contributions.md                   |  2 +-
 .../maintainers-etiquette.md                  | 21 ++++++++-----------
 {templates => documentation}/style-guide.md   |  0
 .../writing-hugo.md                           |  4 ++--
 6 files changed, 24 insertions(+), 21 deletions(-)
 rename CLOSED_CONTRIBUTIONS.md => documentation/closed-contributions.md (98%)
 rename F5-NGINX-team-notes.md => documentation/maintainers-etiquette.md (60%)
 rename {templates => documentation}/style-guide.md (100%)
 rename CONTRIBUTING_DOCS.md => documentation/writing-hugo.md (98%)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1c3f94a48..01c0637ec 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,9 +1,10 @@
 # Contributing guidelines
 
-The following is a set of guidelines for community contributions to this
-project. We really appreciate your desire to contribute!
+The following is a set of guidelines for community contributions to this project. 
 
-If you are an F5 employee, see the following additional guidance [For F5 Employees](./F5-NGINX-team-notes.md).
+We really appreciate your desire to contribute!
+
+If you are an F5 employee, see the following additional guidance on [Maintainers etiquette](/documentation/maintainers-etiquette.md).
 
 ## Table of contents
 
@@ -12,8 +13,8 @@ If you are an F5 employee, see the following additional guidance [For F5 Employe
 - [Open a Discussion](#open-a-discussion)
 - [Submit a Pull Request](#submit-a-pull-request)
   - Review our [Git style guide](#git-style-guide)
-  - Review our Documentation [style guide](./templates/style-guide.md)
-  - Review our [Contributing guidelines for writers](./CONTRIBUTING_DOCS.md)
+  - Review the [Writing style guide](/documentation/style-guide.md)
+  - Review [Managing content with Hugo](/documentation/writing-hugo.md)
 - [Issue Lifecycle](#issue-lifecycle)
 - [Additional NGINX documentation](#additional-nginx-documentation)
 - [F5 Contributor License Agreement (CLA)](#f5-contributor-license-agreement)
@@ -51,6 +52,7 @@ our documentation as described in our [support](./SUPPORT.md) page.
 ### Git style guide
 
 - Keep a clean, concise and meaningful Git commit history on your branch, rebasing locally and squashing before you submit a PR
+- We use [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) formatting.
 - Follow the guidelines of writing a good commit message as described here <https://chris.beams.io/posts/git-commit/>
   and summarized in the next few points:
 
diff --git a/documentation/README.md b/documentation/README.md
index 4783c0baf..af9a01392 100644
--- a/documentation/README.md
+++ b/documentation/README.md
@@ -2,7 +2,7 @@
 
 This directory contains the documentation for the NGINX Documentation repository.
 
-It's used by the DocOps team to record how we configure our tools and instructions for certain precise tasks.
+It's used by the DocOps team to record how we use our tools and instructions for common tasks.
 
 There's also documentation around our ways of working, and ideas of significance wider than the scope of an issue or pull request.
 
@@ -12,4 +12,8 @@ If you're interested in contributing to the [NGINX documentation website](https:
 
 ## Topics
 
+- [Contributing closed content](/documentation/closed-contributions.md)
+- [Maintainers etiquette](/documentation/maintainers-etiquette.md)
+- [Managing content with Hugo](/documentation/writing-hugo.md)
 - [Proposals](/documentation/proposals/README.md)
+- [Writing style guide](/documentation/style-guide.md)
diff --git a/CLOSED_CONTRIBUTIONS.md b/documentation/closed-contributions.md
similarity index 98%
rename from CLOSED_CONTRIBUTIONS.md
rename to documentation/closed-contributions.md
index e031c3a24..cc0970362 100644
--- a/CLOSED_CONTRIBUTIONS.md
+++ b/documentation/closed-contributions.md
@@ -1,4 +1,4 @@
-# Contributing guidelines for closed content
+# Contributing closed content
 
 This document describes the process for authoring "closed content", which is content of a sensitive nature that cannot be publicised before release.
 
diff --git a/F5-NGINX-team-notes.md b/documentation/maintainers-etiquette.md
similarity index 60%
rename from F5-NGINX-team-notes.md
rename to documentation/maintainers-etiquette.md
index 1ddfa64cf..8aae8a61b 100644
--- a/F5-NGINX-team-notes.md
+++ b/documentation/maintainers-etiquette.md
@@ -1,24 +1,21 @@
-# For F5/NGINX Employees
+# Maintainers etiquette
 
-This repository is public, and we do as much of our work as possible in the public as a commitment to open source.
-
-Before new content is published at https://docs.nginx.com, it must be committed to this `documentation` repository. 
-
-If you are an F5 employee unable to assign yourself as an owner of an issue or a reviewer of a pull request, ask a member of the NGINX documentation team for help.
-
-If your content cannot be publicized before release, it is handled differently: read the [Contributing guidelines for closed content](/CLOSED_CONTRIBUTIONS.md) document.
+This document is intended for the maintainers of the repository, who are any F5/NGINX employees that contribute to it.
 
 We encourage you to work with community contributors. If you participate in PRs, issues, discussions, and more, follow these guidelines:
 
 - Follow the [Code of Conduct](./CODE_OF_CONDUCT.md).
 - Be helpful. We want to encourage people who contribute to continue.
-  - If you need to say "no," here's [an example](https://github.com/nginx/documentation/pull/307#issuecomment-2748521932) of how we interact with the community.
+  - If you need to say "no," here's [an example](https://github.com/nginx/documentation/pull/307#issuecomment-2748521932) of how to interact with the community.
 - Avoid references and links to internal content. 
-- Do not include information about future releases, changes, or features, unless
-  specifically authorized.
-- Do not include anything that even resembles PII.
+- Do not include information about future releases, changes, or features, unless specifically authorized.
+- Do not include anything that resembles PII.
 - Do not include information that is proprietary to and/or private within F5/NGINX.
 
+This repository is public, and we do as much of our work as possible in the public as a commitment to open source.
+
 As an F5/NGINX employee, if you have a GitHub account, you should be able to clone these repositories.
 
+If your content cannot be visible before release, you should read the [Contributing guidelines for closed content](/CLOSED_CONTRIBUTIONS.md) document.
+
 To protect F5/NGINX, the ability to merge pull requests is strictly limited to employees of F5/NGINX.
diff --git a/templates/style-guide.md b/documentation/style-guide.md
similarity index 100%
rename from templates/style-guide.md
rename to documentation/style-guide.md
diff --git a/CONTRIBUTING_DOCS.md b/documentation/writing-hugo.md
similarity index 98%
rename from CONTRIBUTING_DOCS.md
rename to documentation/writing-hugo.md
index 3fa8270f3..20587fafe 100644
--- a/CONTRIBUTING_DOCS.md
+++ b/documentation/writing-hugo.md
@@ -1,4 +1,4 @@
-# Contributing guidelines for writers
+# Managing content with Hugo
 
 This page describes our guidelines on using [Hugo](https://gohugo.io/) to write documentation.
 
@@ -6,7 +6,7 @@ You will need [git](https://git-scm.com/) to interact with the repository and fi
 
 Our workflow is to develop content locally, then submit a pull request once we've done our initial draft and editing passes.
 
-If you're an employee of F5/NGINX, also read [For F5/NGINX Employees](./F5-NGINX-team-notes.md).
+For guidance around how to write content, please check [the style guide](/documentation/style-guide.md).
 
 ## Setup
 

From f3c2ee4301368078f85aa1f20cae64208124445b Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Tue, 24 Jun 2025 12:01:12 +0100
Subject: [PATCH 047/117] feat: Add Information architecture heuristics
 document

This commit adds an IA heuristics page to our process documentation. The
NGINX DocOps teams spends a lot of time engaged with IA and is
increasingly involved with using heuristics to assess content.
---
 documentation/README.md        |   1 +
 documentation/ia-heuristics.md | 122 +++++++++++++++++++++++++++++++++
 2 files changed, 123 insertions(+)
 create mode 100644 documentation/ia-heuristics.md

diff --git a/documentation/README.md b/documentation/README.md
index af9a01392..565129184 100644
--- a/documentation/README.md
+++ b/documentation/README.md
@@ -13,6 +13,7 @@ If you're interested in contributing to the [NGINX documentation website](https:
 ## Topics
 
 - [Contributing closed content](/documentation/closed-contributions.md)
+- [Information architecture heuristics](/documentation/ia-heuristics.md)
 - [Maintainers etiquette](/documentation/maintainers-etiquette.md)
 - [Managing content with Hugo](/documentation/writing-hugo.md)
 - [Proposals](/documentation/proposals/README.md)
diff --git a/documentation/ia-heuristics.md b/documentation/ia-heuristics.md
new file mode 100644
index 000000000..a90849c75
--- /dev/null
+++ b/documentation/ia-heuristics.md
@@ -0,0 +1,122 @@
+# Information architecture heuristics
+
+This document describes some of the heuristics that the NGINX DocOps team uses to examine information architecture.
+
+It is intended as reference information for discussions and work management artefacts (Such as reports or issues).
+
+These heuristics are an adaptation of work done by [Abby Covert](https://abbycovert.com/).
+
+## Overview
+
+| Name                            | Description                                             |
+| --------------------------------| ------------------------------------------------------- |
+| [Accessible](#accessible)       | Where and how is information being accessed?            |
+| [Clear](#clear)                 | Does the user have clear and essential information?     |
+| [Communicative](#communicative) | Can the user anticipate content based on the structure? |
+| [Controllable](#controllable)   | Does the user retain agency throughout a process?       |
+| [Credible](#credible)           | Can the user trust the information?                     |
+| [Delightful](#delightful)       | Does the user experience feel fun and easy?             |
+| [Findable](#findable)           | Is information easily discoverable for users?           |
+| [Learnable](#learnable)         | Is navigating information familiar to the user?         |
+| [Useful](#useful)               | Does the information lead to the intended result?       |
+| [Valuable](#valuable)           | Is the information provided valuable, and how?          |
+
+## Accessible
+
+- Is the information accessible through the most common mediums and devices?
+- How does the information behave when perceived through other means?
+- Does the information match or exceed any compliance guidelines?
+
+_Accessible_ concerns how navigable the information is by users. A user should be able to traverse content using any input method, browser or device desired.
+
+If critical details are not available to a user based on the method they use to access information, it is not accessible.
+
+## Clear
+
+- Is the information easy to understand and explain?
+- How does the structure reduce noise for the user journey?
+- Does the structure fulfil the expectations of the user persona?
+
+_Clear_ concerns whether or not the information aligns with the user's background and if it is devoid of distractions.
+
+The structure should streamline the user experience for navigating and reading information, allowing them to understand intent without ambiguity.
+
+## Communicative
+
+- Is the structure effective in recognising the user's state?
+- Are the structure and information consistent?
+- How does the structure support the information being shared?
+
+_Communicative_ concerns the effectiveness of the user journey.
+
+A user should be able to make informed decisions about their actions in a timely manner, and able to orient themselves within the structure.
+
+## Controllable
+
+- Is the process state clear for a task from the information?
+- Can the user anticipate errors or mistakes?
+- Are important controls clearly marked?
+
+_Controllable_ concerns where information leads a user and how that affects them. They should be aware of the consequences when following instructions.
+
+If a document leaves a user in an inoperable state, it is not controllable. This could be caused by incomplete information, or information split across multiple places reliant on context to finish a task.
+
+## Credible
+
+- Is the tone and focus of the information consistent?
+- Can the user trust the accuracy of the information?
+- When and how is information updated?
+
+_Credible_ concerns trust in the information provided. If the tone or presentation of information is unclear, it may build uncertainty for a user.
+
+The credibility of information can be considered based on where it exists in overall structure, and indicators of how recently it was updated.
+
+## Delightful
+
+- Does the structure make a task feel easy?
+- Is supporting information provided where useful?
+- How does the information exceed expectation?
+
+_Delightful_ is the step beyond fulfilling basic expectations.
+
+This concerns overall quality of the user experience, such as smooth transitions between mediums and useful recommendations.
+
+## Findable
+
+- Is it easy for users to locate information?
+- What methods are available for users to discover information?
+- Does the information translate effectively for non-human users?
+
+_Findable_ concerns how a user discovers and traverses your collection of information.
+
+This can reflect the navigation tree or sitemap of a website, as well as contextual links between information. It is also related to how the information is percieved through search mechanisms.
+
+## Learnable
+
+- Is the structure clear and easy to understand?
+- Is the structure memorable?
+- How does the structure help someone understand the information?
+
+_Learnable_ concerns whether or not the structure makes sense to a user, and how it shapes their mental model of information.
+
+This can be examined from multiple angles, such as if the structure is consistent across products, or if it matches their journey.
+
+## Useful
+
+- Is the information correct?
+- Is the information complete?
+- Does the information serve both existing and new users?
+
+_Useful_ concerns the baseline for the user experience by enabling them to complete tasks.
+
+Information is useful if it accomodates new and old users, and if it enables them to concisely navigate through context with confidence.
+
+## Valuable
+
+- Is the information desireable to the user?
+- Does it fulfill expectations across all channels?
+- How is success quantified?
+
+_Valuable_ concerns if the information is desireable, and if the story presented compelling to the user.
+
+This can be emphasized by highlighting information that aligns with the user's mental models and the tangible benefits of a particular use case.
\ No newline at end of file

From 8487abfc86d3700f961937fe897e741e16f35589 Mon Sep 17 00:00:00 2001
From: Travis Martin <33876974+travisamartin@users.noreply.github.com>
Date: Tue, 24 Jun 2025 08:28:36 -0700
Subject: [PATCH 048/117] updated nginx plus api server block to enable the
 dashboard (#734)

* updated nginx plus api server block to enable the dashboard

* fixed link
---
 .../monitoring/enable-nginx-plus-api.md       | 63 ++++++++++++++-----
 1 file changed, 47 insertions(+), 16 deletions(-)

diff --git a/content/includes/use-cases/monitoring/enable-nginx-plus-api.md b/content/includes/use-cases/monitoring/enable-nginx-plus-api.md
index d9dd46dc0..c605d0c22 100644
--- a/content/includes/use-cases/monitoring/enable-nginx-plus-api.md
+++ b/content/includes/use-cases/monitoring/enable-nginx-plus-api.md
@@ -5,28 +5,59 @@ files:
   - content/nginx-one/getting-started.md
 ---
 <!-- include in content/nginx-one/getting-started.md disabled, hopefully temporarily -->
-To collect comprehensive metrics for NGINX Plus--including bytes streamed, information about upstream systems and caches, and counts of all HTTP status codes--add the following to your NGINX Plus configuration file (for example, `/etc/nginx/nginx.conf` or an included file):
+To collect comprehensive metrics for NGINX Plus -- including bytes streamed, information about upstream systems and caches, and counts of all HTTP status codes -- add the following to your NGINX Plus configuration file (for example, `/etc/nginx/nginx.conf` or an included file):
 
 ```nginx
-# Enable the /api/ location with appropriate access control
-# to use the NGINX Plus API.
-#
-location /api/ {
-    api write=on;
-    allow 127.0.0.1;
-    deny all;
-}
-```
+# This block:
+# - Enables the read-write NGINX Plus API under /api/
+# - Serves the built-in dashboard at /dashboard.html
+# - Restricts write methods (POST, PATCH, DELETE) to authenticated users
+#   and a specified IP range
+# Change the listen port if 9000 conflicts; 8080 is the conventional API port.
+server {
+    # Listen on port 9000 for API and dashboard traffic
+    listen 9000 default_server;
+
+    # Handle API calls under /api/
+    location /api/ {
+        # Enable write operations (POST, PATCH, DELETE)
+        api write=on;
+
+        # Allow GET requests from any IP
+        allow 0.0.0.0/0;
+        # Deny all other requests by default
+        deny all;
 
-This configuration:
+        # For methods other than GET, require auth and restrict to a network
+        limit_except GET {
+            # Prompt for credentials with this realm
+            auth_basic "NGINX Plus API";
+            # Path to the file with usernames and passwords
+            auth_basic_user_file /path/to/passwd/file;
 
-- Enables the NGINX Plus API.
-- Allows requests only from `127.0.0.1` (localhost).
-- Blocks all other requests for security.
+            # Allow only this IP range (replace with your own)
+            allow 192.0.2.0/24;
+            # Deny all other IPs
+            deny all;
+        }
+    }
+
+    # Serve the dashboard page at /dashboard.html
+    location = /dashboard.html {
+        # Files are located under this directory
+        root /usr/share/nginx/html;
+    }
+
+    # Redirect any request for / to the dashboard
+    location / {
+        return 301 /dashboard.html;
+    }
+}
+```
 
-For more details, see the [NGINX Plus API module documentation](https://nginx.org/en/docs/http/ngx_http_api_module.html).
+For more details, see the [NGINX Plus API module documentation](https://nginx.org/en/docs/http/ngx_http_api_module.html) and [Configuring the NGINX Plus API]({{< ref "nginx/admin-guide/monitoring/live-activity-monitoring.md#configuring-the-api" >}}).
 
-After saving the changes, reload NGINX to apply the new configuration:
+After saving the changes, reload NGINX:
 
 ```shell
 nginx -s reload

From 7de6e60e17af45fde1ab14c337043343b8636bc7 Mon Sep 17 00:00:00 2001
From: Michael McKeen <m.mckeen@f5.com>
Date: Tue, 24 Jun 2025 12:17:42 -0400
Subject: [PATCH 049/117] chore: update Makefile and contribution docs for Hugo
 bump (#718)

* chore: update Makefile to handle hugo bump to latest

* chore: update hugo version ref in CONTRIBUTING_DOCS

* CI: Update build-push job SHA ref

---------

Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 .github/workflows/build-push.yml |  2 +-
 Makefile                         | 10 +++++-----
 documentation/writing-hugo.md    |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index f87e5180f..5b833cfca 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -58,7 +58,7 @@ jobs:
 
   call-docs-build-push:
     needs: prod-check-branch
-    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@cc69def33942d819719164723b35b5163d838276 # v1.0.9
+    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@285440f02d9967b62aeb1b7e0b5c2c70d4f950cf # v1.0.10
     with:
       production_url_path: ""
       preview_url_path: "${{ vars.PREVIEW_URL_PATH }}"
diff --git a/Makefile b/Makefile
index 28c9379d7..9830d9e1e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,16 +1,16 @@
 HUGO?=hugo
 HUGO_VERSION?=$(shell hugo version 2>/dev/null | awk '{print $$2}' | cut -d '.' -f 2)
-HUGO_IMG?=hugomods/hugo:std-go-git-0.134.3
+HUGO_IMG?=hugomods/hugo:std-go-git-0.147.8
 
 THEME_MODULE = github.com/nginxinc/nginx-hugo-theme
 
-ifeq ($(shell [ $(HUGO_VERSION) -gt 133 2>/dev/null ] && echo true || echo false), true)
-    $(info Hugo is available and has a version greater than 133. Proceeding with build.)
+ifeq ($(shell [ $(HUGO_VERSION) -gt 146 2>/dev/null ] && echo true || echo false), true)
+    $(info Hugo is available and has a version greater than 146. Proceeding with build.)
 else
-    $(warning Hugo is not available or using a version less than 134. Attempting to use docker. HUGO_VERSION=$(HUGO_VERSION))
+    $(warning Hugo is not available or using a version less than 147. Attempting to use docker. HUGO_VERSION=$(HUGO_VERSION))
     HUGO=docker run --rm -it -v ${CURDIR}:/src -p 1313:1313 ${HUGO_IMG} /src/hugo-entrypoint.sh
     ifeq (, $(shell docker version 2> /dev/null))
-        $(error Hugo (>0.134) or Docker are required to build the local previews.)
+        $(error Hugo (>0.147) or Docker are required to build the local previews.)
     endif
 endif
 
diff --git a/documentation/writing-hugo.md b/documentation/writing-hugo.md
index 20587fafe..1997a3ad0 100644
--- a/documentation/writing-hugo.md
+++ b/documentation/writing-hugo.md
@@ -17,7 +17,7 @@ Read the [Hugo installation instructions](https://gohugo.io/getting-started/inst
 If you have [Docker](https://www.docker.com/get-started/) installed, there are fallbacks for all requirements in the [Makefile](Makefile), meaning you don't need to install them.
 
 - [Installing Hugo](https://gohugo.io/getting-started/installing/)
-  - **NOTE**: We are currently running [Hugo v0.134.2](https://github.com/gohugoio/hugo/releases/tag/v0.134.2) in production.
+  - **NOTE**: We are currently running [Hugo v0.147.8](https://github.com/gohugoio/hugo/releases/tag/v0.147.8) in production.
 - [Installing markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli?tab=readme-ov-file#installation)
 - [Installing markdown-link-check](https://github.com/tcort/markdown-link-check?tab=readme-ov-file#installation)
 

From 8280e8d506987c8084be7ba2fdaf4d3b642cd662 Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Tue, 24 Jun 2025 17:44:44 +0100
Subject: [PATCH 050/117] feat: NGINX App Protect 5.7 / 4.15 Release (#571)

This commit adds the documentation changes for NGINX App Protect WAF version
5.7 & 4.15. For information about feature changes, check the release notes.

---

Co-authored-by: kudriavitsky <109550454+kudriavitsky@users.noreply.github.com>
Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
Co-authored-by: mouraddmeiri <67323028+mouraddmeiri@users.noreply.github.com>
Co-authored-by: ohad-perets <126083286+ohad-perets@users.noreply.github.com>
Co-authored-by: Daniel Edgar <d.edgar@f5.com>
---
 .../config/common/forward-proxy-conf.md       |  20 ++
 .../config/common/ip-groups-override-rules.md |  62 ++++
 .../config/common/ip-groups-overview.md       |  81 +++++
 .../config/common/ip-intelligence-conf.md     | 121 +++++++
 .../v5/build-nginx-image-oss/build-rocky.md   |  41 +++
 .../v5/build-nginx-image-plus/build-rocky.md  |  35 ++
 content/includes/nap-waf/ip-intelligence.md   |  67 ++++
 content/includes/nap-waf/policy.html          | 152 +++++++--
 content/nap-waf/v4/admin-guide/install.md     | 299 +++++++++++++++++-
 .../v4/configuration-guide/configuration.md   | 121 +++++--
 content/nap-waf/v4/releases/about-4.15.md     |  43 +++
 .../v5/admin-guide/deploy-on-docker.md        |  30 ++
 .../v5/admin-guide/deploy-with-helm.md        |  15 +
 .../v5/admin-guide/deploy-with-manifests.md   |  96 ++++++
 content/nap-waf/v5/admin-guide/install.md     |  56 +++-
 content/nap-waf/v5/admin-guide/overview.md    |   4 +-
 .../v5/configuration-guide/configuration.md   | 124 ++++++--
 content/nap-waf/v5/releases/about-5.7.md      |  59 ++++
 .../troubleshooting-guide/troubleshooting.md  |   2 +-
 data/nap-waf/schema/policy.json               |  72 ++++-
 20 files changed, 1396 insertions(+), 104 deletions(-)
 create mode 100644 content/includes/nap-waf/config/common/forward-proxy-conf.md
 create mode 100644 content/includes/nap-waf/config/common/ip-groups-override-rules.md
 create mode 100644 content/includes/nap-waf/config/common/ip-groups-overview.md
 create mode 100644 content/includes/nap-waf/config/common/ip-intelligence-conf.md
 create mode 100644 content/includes/nap-waf/config/v5/build-nginx-image-oss/build-rocky.md
 create mode 100644 content/includes/nap-waf/config/v5/build-nginx-image-plus/build-rocky.md
 create mode 100644 content/includes/nap-waf/ip-intelligence.md
 create mode 100644 content/nap-waf/v4/releases/about-4.15.md
 create mode 100644 content/nap-waf/v5/releases/about-5.7.md

diff --git a/content/includes/nap-waf/config/common/forward-proxy-conf.md b/content/includes/nap-waf/config/common/forward-proxy-conf.md
new file mode 100644
index 000000000..eca8f09bc
--- /dev/null
+++ b/content/includes/nap-waf/config/common/forward-proxy-conf.md
@@ -0,0 +1,20 @@
+Enable Forward Proxy Settings for IP Intelligence Client. 
+
+To configure proxy settings, edit the client configuration file:
+Path:
+```shell
+/etc/app_protect/tools/iprepd.cfg
+```
+Example configuration:
+```shell
+EnableProxy=True 
+ProxyHost=5.1.2.4
+ProxyPort=8080
+ProxyUsername=admin        # Optional
+ProxyPassword=admin        # Optional
+CACertPath=/etc/ssl/certs/ca-certificates.crt  # Optional 
+```
+After saving the changes, restart the client to apply the new settings.
+```shell
+/opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+```
diff --git a/content/includes/nap-waf/config/common/ip-groups-override-rules.md b/content/includes/nap-waf/config/common/ip-groups-override-rules.md
new file mode 100644
index 000000000..e9c2ff0f5
--- /dev/null
+++ b/content/includes/nap-waf/config/common/ip-groups-override-rules.md
@@ -0,0 +1,62 @@
+#### IP-Address-Lists feature as part of Override Rules feature.
+
+The Override Rules feature allows you to override original or parent policy settings.
+
+Rules are defined using specific conditions, which can include an IP Address Lists based on the declarative policy JSON schema.
+
+When triggered, the rule is applied to the _clientIp_ attribute using the _matches_ function.
+
+'clientIp.matches(ipAddressLists["standalone"])'
+
+Here is a policy example:
+
+```json
+{ 
+  "policy": { 
+    "name": "ip_group_override_rule", 
+    "template": { 
+      "name": "POLICY_TEMPLATE_NGINX_BASE" 
+    }, 
+    "applicationLanguage": "utf-8", 
+    "caseInsensitive": false, 
+    "enforcementMode": "blocking", 
+    "ip-address-lists": [ 
+      { 
+        "name": "standalone", 
+        "ipAddresses": [ 
+          { 
+            "ipAddress": "1.1.1.1/32" 
+          } 
+        ] 
+      } 
+     ], 
+     "override-rules": [ 
+      { 
+        "name": "myRule1", 
+        "condition": "clientIp.matches(ipAddressLists['standalone'])", 
+        "actionType": "extend-policy",
+        "override": {
+          "policy": {
+            "enforcementMode": "transparent"
+          }
+        }  
+      }
+    ]
+  }
+}
+```
+
+The previous example policy contains an IP address lists with the name "standalone", used for the override rule condition "clientIp.matches(ipAddressLists['standalone'])".
+The condition means that the rule enforcement is applied and override base policy enforcement when clientIp is matched to one of ipAddresses in ipAddressList with name "standalone". 
+The value used for the override condition must exist and exactly match the name in "ip-address-lists".  
+
+#### Possible errors
+
+| Error text | Input          | Explanation |
+| -----------| ------------- | ------------ |
+| _Invalid field invalidList_ | _clientIp.matches(invalidList['standalone']);_ | An incorrect keyword was used instead of _ipAddressLists_ |
+| _Invalid value empty string_ | _clientIp.matches(ipAddressLists['']_ | An empty name was provided |
+| _Failed to compile policy - 'ipGroupOverridePolicy'_ | _uri.matches(ipAddressLists['standalone']);_ |  Used _ipAddressLists_ without the _clientIP_ attribute |
+
+
+ 
diff --git a/content/includes/nap-waf/config/common/ip-groups-overview.md b/content/includes/nap-waf/config/common/ip-groups-overview.md
new file mode 100644
index 000000000..d1729a7d0
--- /dev/null
+++ b/content/includes/nap-waf/config/common/ip-groups-overview.md
@@ -0,0 +1,81 @@
+IP address lists is a feature to organize lists of allowed and forbidden IP addresses across several lists with common attributes.
+
+This allows you to control unique policy settings for incoming requests based on specific IP addresses.
+
+Each IP address list contains a unique name, enforcement type (_always_, _never_ and _policy-default_), and list of IP addresses.
+
+
+An example of a declarative policy using IP address lists configuration: 
+
+```json
+{ 
+  "policy": { 
+    "name": "IpGroups_policy", 
+    "template": { 
+       "name": "POLICY_TEMPLATE_NGINX_BASE" 
+    }, 
+    "applicationLanguage": "utf-8", 
+    "caseInsensitive": false, 
+    "enforcementMode": "blocking", 
+    "ip-address-lists": [ 
+       { 
+         "name": "Standalone",
+         "description": "Optional Description",
+         "blockRequests": "policy-default",
+         "setGeolocation": "IN",
+         "ipAddresses": [
+          {
+             "ipAddress": "1.2.3.4/32"
+          },
+          {
+             "ipAddress": "1111:fc00:0:112::2"
+          }
+        ]
+      }
+    ]
+  }
+}
+
+```
+The example with IP-Group definition in external file external_ip_groups.json:
+
+```json
+{
+  "policy": { 
+    "name": "IpGroups_policy2", 
+    "template": { 
+       "name": "POLICY_TEMPLATE_NGINX_BASE" 
+    }, 
+    "applicationLanguage": "utf-8", 
+    "caseInsensitive": false, 
+    "enforcementMode": "blocking", 
+    "ip-address-lists": [
+      { 
+        "name": "external_ip_groups",
+        "description": "Optional Description",
+        "blockRequests": "always",
+        "setGeolocation": "IL",
+        "$ref": "file:///tmp/policy/external_ip_groups.json"
+      }
+    ]
+  }
+}
+```
+Example of the file external_ip_groups.json
+
+```json
+{ 
+    "name": "External IP address lists",
+    "description": "Optional Description",
+    "blockRequests": "always",
+    "setGeolocation": "IR",
+    "ipAddresses": [
+      {
+        "ipAddress": "66.51.41.21"
+      },
+      {
+        "ipAddress": "66.52.42.22"
+      }
+    ]
+}
+```
diff --git a/content/includes/nap-waf/config/common/ip-intelligence-conf.md b/content/includes/nap-waf/config/common/ip-intelligence-conf.md
new file mode 100644
index 000000000..094b42cb6
--- /dev/null
+++ b/content/includes/nap-waf/config/common/ip-intelligence-conf.md
@@ -0,0 +1,121 @@
+
+
+NGINX App Protect WAF provides an IP Intelligence feature, which allows customizing the enforcement based on the source IP of the request to limit access from IP addresses with questionable reputation. Please note that:
+- The IP intelligence feature is **disabled** by default and needs to be installed, enabled, and configured within the policy.
+- To review the installation steps, please refer to the administration guide: [App Protect v4]({{< ref "/nap-waf/v4/admin-guide/install.md#Prerequisites" >}}) / [App Protect v5]({{< ref "/nap-waf/v5/admin-guide/install.md#Prerequisites" >}})
+- The system must have an active Internet connection and a working DNS.
+- If NGINX App Protect is behind a firewall, ensure external access to vector.brightcloud.com over port 443 - this is the IP Intelligence server used for data retrieval.
+- If NGINX App Protect accesses the Internet through a forward proxy server, ensure that it is configured correctly [App Protect v4]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-forward-proxy-configuration" >}}) / [App Protect v5]({{< ref "/nap-waf/v5/configuration-guide/configuration.md##ip-intelligence-forward-proxy-configuration" >}}).
+  
+Once installed, make sure to enable the feature in the two relevant sections of the policy:
+1. By enabling the corresponding violation in the violation list: `"name": "VIOL_MALICIOUS_IP"` and assigning the appropriate `block` and `alarm` values to the violation.
+
+2. By enabling the feature in the corresponding IP Intelligence JSON section: `"ip-intelligence": {"enabled": true}` and defining actions for the IP Intelligence categories listed below.
+
+An example policy where both elements are enabled, and all the IP intelligence categories are configured to `block` and `alarm` can be found here:
+
+```json
+{
+    "policy": {
+        "name": "ip_intelligency_policy",
+        "template": {
+            "name": "POLICY_TEMPLATE_NGINX_BASE"
+        },
+        "applicationLanguage": "utf-8",
+        "caseInsensitive": false,
+        "enforcementMode": "blocking",
+        "blocking-settings": {
+            "violations": [
+                {
+                    "name": "VIOL_MALICIOUS_IP",
+                    "alarm": true,
+                    "block": true
+                }
+            ]
+        },
+        "ip-intelligence": {
+            "enabled": true,
+            "ipIntelligenceCategories": [
+                {
+                    "category": "Anonymous Proxy",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "BotNets",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Cloud-based Services",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Denial of Service",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Infected Sources",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Mobile Threats",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Phishing Proxies",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Scanners",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Spam Sources",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Tor Proxies",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Web Attacks",
+                    "alarm": true,
+                    "block": true
+                },
+                {
+                    "category": "Windows Exploits",
+                    "alarm": true,
+                    "block": true
+                }
+            ]
+        }
+    }
+}
+```
+
+This policy will basically block `"block": true` all IP addresses that are part of any threat category and add a log entry `"alarm": true` for the transaction.
+
+The IP address database is managed by an external provider and is constantly updated (every 1 minute by default). The database also categorizes IP addresses into one or more threat categories. These are the same categories that can be configured individually in the IP intelligence section:
+- Anonymous Proxy
+- BotNets
+- Cloud-based Services
+- Denial of Service
+- Infected Sources
+- Mobile Threats
+- Phishing Proxies
+- Scanners
+- Spam Sources
+- Tor Proxies
+- Web Attacks
+- Windows Exploits
+
+Note that since the IP address database is constantly updated, IP address enforcement is also expected to change. IP Addresses may be added, removed, or moved from one category to another based on the reported activity of the IP address.
diff --git a/content/includes/nap-waf/config/v5/build-nginx-image-oss/build-rocky.md b/content/includes/nap-waf/config/v5/build-nginx-image-oss/build-rocky.md
new file mode 100644
index 000000000..00f2fcd65
--- /dev/null
+++ b/content/includes/nap-waf/config/v5/build-nginx-image-oss/build-rocky.md
@@ -0,0 +1,41 @@
+```dockerfile
+# syntax=docker/dockerfile:1
+
+# Base Image
+FROM rockylinux:9
+
+# Install NGINX OSS and NGINX App Protect WAF v5 module
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf -y install wget ca-certificates yum-utils \
+    && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \
+    && echo "[nginx-mainline]" > /etc/yum.repos.d/nginx.repo \
+    && echo "name=nginx mainline repo" >> /etc/yum.repos.d/nginx.repo \
+    && echo "baseurl=http://nginx.org/packages/mainline/centos/\$releasever/\$basearch/" >> /etc/yum.repos.d/nginx.repo \
+    && echo "gpgcheck=1" >> /etc/yum.repos.d/nginx.repo \
+    && echo "enabled=1" >> /etc/yum.repos.d/nginx.repo \
+    && echo "gpgkey=https://nginx.org/keys/nginx_signing.key" >> /etc/yum.repos.d/nginx.repo \
+    && echo "module_hotfixes=true" >> /etc/yum.repos.d/nginx.repo \
+    && echo "[app-protect-x-oss]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \
+    && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \
+    && echo "baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \
+    && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \
+    && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \
+    && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \
+    && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \
+    && dnf clean all \
+    && dnf install -y app-protect-module-oss \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf \
+    && ln -sf /dev/stdout /var/log/nginx/access.log \
+    && ln -sf /dev/stderr /var/log/nginx/error.log
+
+# Expose port
+EXPOSE 80
+
+# Define stop signal
+STOPSIGNAL SIGQUIT
+
+# Set default command
+CMD ["nginx", "-g", "daemon off;"]
+```
diff --git a/content/includes/nap-waf/config/v5/build-nginx-image-plus/build-rocky.md b/content/includes/nap-waf/config/v5/build-nginx-image-plus/build-rocky.md
new file mode 100644
index 000000000..e0362cd74
--- /dev/null
+++ b/content/includes/nap-waf/config/v5/build-nginx-image-plus/build-rocky.md
@@ -0,0 +1,35 @@
+```dockerfile
+# syntax=docker/dockerfile:1
+
+# Base Image
+FROM rockylinux:9
+
+# Install NGINX Plus and NGINX App Protect WAF v5 module
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf -y install wget ca-certificates \
+    && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \
+    && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/${NGINX_PLUS_REPO} \
+    && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \
+    && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \
+    && echo "baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \
+    && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \
+    && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \
+    && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \
+    && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \
+    && dnf clean all \
+    && dnf install -y app-protect-module-plus \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf \
+    && ln -sf /dev/stdout /var/log/nginx/access.log \
+    && ln -sf /dev/stderr /var/log/nginx/error.log
+
+# Expose port
+EXPOSE 80
+
+# Define stop signal
+STOPSIGNAL SIGQUIT
+
+# Set default command
+CMD ["nginx", "-g", "daemon off;"]
+```
diff --git a/content/includes/nap-waf/ip-intelligence.md b/content/includes/nap-waf/ip-intelligence.md
new file mode 100644
index 000000000..31f173479
--- /dev/null
+++ b/content/includes/nap-waf/ip-intelligence.md
@@ -0,0 +1,67 @@
+If the deployment intends to use the IP intelligence Feature (available from version 5.7.0), then the IP intelligence container needs to be added to the deployment in the docker compose file.
+
+Modify the original `docker-compose.yml` file to include the additional IP Intelligence container:
+
+```yaml
+services:
+  waf-enforcer:
+    container_name: waf-enforcer
+    image: private-registry.nginx.com/nap/waf-enforcer:5.7.0
+    environment:
+      - ENFORCER_PORT=50000
+    ports:
+      - "50000:50000"
+    volumes:
+      - /opt/app_protect/bd_config:/opt/app_protect/bd_config
+      - /var/IpRep:/var/IpRep
+    networks:
+      - waf_network
+    restart: always
+    user: "101:101"
+    depends_on:
+      - waf-ip-intelligence
+
+  waf-config-mgr:
+    container_name: waf-config-mgr
+    image: private-registry.nginx.com/nap/waf-config-mgr:5.7.0
+    volumes:
+      - /opt/app_protect/bd_config:/opt/app_protect/bd_config
+      - /opt/app_protect/config:/opt/app_protect/config
+      - /etc/app_protect/conf:/etc/app_protect/conf
+    restart: always
+    user: "101:101"
+    network_mode: none
+    depends_on:
+      waf-enforcer:
+        condition: service_started
+
+  waf-ip-intelligence:
+    container_name: waf-ip-intelligence
+    image: private-registry.nginx.com/nap/waf-ip-intelligence:5.7.0
+    volumes:
+      - /var/IpRep:/var/IpRep
+    networks:
+      - waf_network
+    restart: always
+    user: "101:101"
+
+networks:
+  waf_network:
+    driver: bridge
+```
+
+Notes:
+- Replace `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` tags with the actual release version tag you are deploying. We are using version 5.7.0 for this example deployment.
+- By default, the containers `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` operate with the user and group IDs set to 101:101. Ensure that the folders and files are accessible to these IDs.
+
+Before creating the deployment in docker compose, create the required directories:
+
+```shell
+sudo mkdir -p /opt/app_protect/config /opt/app_protect/bd_config /var/IpRep
+```
+
+Then set correct ownership:
+
+```shell
+sudo chown -R 101:101 /opt/app_protect/ /var/IpRep
+```
diff --git a/content/includes/nap-waf/policy.html b/content/includes/nap-waf/policy.html
index de530f555..0d84e0c67 100644
--- a/content/includes/nap-waf/policy.html
+++ b/content/includes/nap-waf/policy.html
@@ -270,153 +270,160 @@ <h1 id="policy">policy</h1>
 <td></td>
 </tr>
 <tr class="even">
+<td><a href="#policy/ip-intelligence">ip-intelligence</a></td>
+<td>Yes</td>
+<td>object</td>
+<td></td>
+<td></td>
+</tr>
+<tr class="odd">
 <td><a href="#policy/json-profiles">json-profiles</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/json-validation-files">json-validation-files</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/login-enforcement">login-enforcement</a></td>
 <td>Yes</td>
 <td>object</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/login-pages">login-pages</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>A login page is a URL in a web application that requests must pass through to get to the authenticated URLs. Use login pages, for example, to prevent forceful browsing of restricted parts of the web application, by defining access permissions for users. Login pages also allow session tracking of user sessions.</td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/methods">methods</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><code>name</code></td>
 <td>No</td>
 <td>string</td>
 <td>The unique user-given name of the policy. Policy names cannot contain spaces or special characters. Allowed characters are a-z, A-Z, 0-9, dot, dash (-), colon (:) and underscore (_).</td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/open-api-files">open-api-files</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/override-rules">override-rules</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>This section defines policy override rules.</td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/parameters">parameters</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>This section defines parameters that the security policy permits in requests.</td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><code>performStaging</code></td>
 <td>No</td>
 <td>boolean</td>
 <td>Determines staging handling for all applicable entities in the policy, such as signatures, URLs, parameters, and cookies. If disabled, all entities will be enforced and any violations triggered will be considered illegal.</td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/response-pages">response-pages</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>The Security Policy has a default blocking response page that it returns to the client when the client request, or the web server response, is blocked by the security policy. You can change the way the system responds to blocked requests. All default response pages contain a variable, &lt;%TS.request.ID()%&gt;, that the system replaces with a support ID number when it issues the page.</td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/sensitive-parameters">sensitive-parameters</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>This section defines sensitive parameters. The contents of these parameters are not visible in logs nor in the user interfaces. Instead of actual values a string of asterisks is shown for these parameters. Use these parameters to protect sensitive user input, such as a password or a credit card number, in a validated request. A parameter name of "password" is always defined as sensitive by default.</td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/server-technologies">server-technologies</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>The server technology is a server-side application, framework, web server or operating system type that is configured in the policy in order to adapt the policy to the checks needed for the respective technology.</td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/signature-requirements">signature-requirements</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/signature-sets">signature-sets</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>Defines behavior when signatures found within a signature-set are detected in a request. Settings are culmulative, so if a signature is found in any set with block enabled, that signature will have block enabled.</td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/signature-settings">signature-settings</a></td>
 <td>Yes</td>
 <td>object</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/signatures">signatures</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>This section defines the properties of a signature on the policy.</td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/template">template</a></td>
 <td>Yes</td>
 <td>object</td>
 <td>Specifies the template to populate the default attributes of a new policy.</td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><a href="#policy/threat-campaigns">threat-campaigns</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>This section defines the enforcement state for the threat campaigns in the security policy.</td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/urls">urls</a></td>
 <td>Yes</td>
 <td>array of objects</td>
 <td>In a security policy, you can manually specify the HTTP URLs that are allowed (or disallowed) in traffic to the web application being protected. When you create a security policy, wildcard URLs of * (representing all HTTP URLs) are added to the Allowed HTTP URLs lists.</td>
 <td></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td><code>wafEngineVersion</code></td>
 <td>No</td>
 <td>string</td>
 <td></td>
 <td></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td><a href="#policy/xml-profiles">xml-profiles</a></td>
 <td>Yes</td>
 <td>array of objects</td>
@@ -2849,13 +2856,13 @@ <h2 id="policy/ip-address-lists">ip-address-lists</h2>
 <td><dl>
 <dt>Specifies how the system responds to blocking requests sent from this IP address list.</dt>
 <dd><ul>
-<li><strong>Policy Default:</strong> Specifies that the Policy Blocking Settings will be used for requests from this IP address list.</li>
+<li><strong>Policy Default:</strong> Specifies that the policy enforcementMode will be used for requests from this IP address list.</li>
 <li><strong>Never Block:</strong> Specifies that the system does not block requests sent from this IP address list, even if your security policy is configured to block all traffic.</li>
 <li><strong>Always Block:</strong> Specifies that the system blocks requests sent from this IP address list.</li>
 </ul>
 </dd>
 </dl>
-<p>Optional</p></td>
+<p>Optional, if absent Policy Default is used.</p></td>
 <td><ul>
 <li>always</li>
 <li>never</li>
@@ -2871,13 +2878,13 @@ <h2 id="policy/ip-address-lists">ip-address-lists</h2>
 <tr class="odd">
 <td><a href="#policy/ip-address-lists/ipAddresses">ipAddresses</a></td>
 <td>array of objects</td>
-<td>Specifies the IP addresses.</td>
+<td>Specifies the IP addresses. Use CIDR notation for subnet definition.</td>
 <td></td>
 </tr>
 <tr class="even">
 <td><code>matchOrder</code></td>
 <td>integer</td>
-<td>Specifies the order index for IP Address List matching. If unspecified, the order is implicitly as the lists appear in the policy. IP Address Groups with a lower matchOrder will be checked for a match prior to items with higher matchOrder.</td>
+<td>Specifies the order matching index between different IP Address Lists. If unspecified, the order is implicitly as the lists appear in the policy. IP Address Lists with a lower matchOrder will be checked for a match prior to items with higher matchOrder.</td>
 <td></td>
 </tr>
 <tr class="odd">
@@ -2889,13 +2896,13 @@ <h2 id="policy/ip-address-lists">ip-address-lists</h2>
 <tr class="even">
 <td><code>neverLogRequests</code></td>
 <td>boolean</td>
-<td>Specifies when enabled that the system does not log requests or responses sent from this IP address list, even if the traffic is illegal, and even if your security policy is configured to log all traffic.</td>
+<td>Specifies when enabled that the system does not log requests or responses sent from this IP address list, even if the traffic is illegal, and even if your security policy is configured to log all traffic. Optional, if absent default value is false.</td>
 <td></td>
 </tr>
 <tr class="odd">
 <td><code>setGeolocation</code></td>
 <td>string</td>
-<td>Specifies a geolocation to be associated for this IP address list. Optional</td>
+<td>Specifies a geolocation to be associated for this IP address list. This will force the IP addresses in the list to be considered as though they are in that geolocation. This applies to blocking via "disallowed-geolocations" and to logging. Optional</td>
 <td></td>
 </tr>
 </tbody>
@@ -2920,11 +2927,92 @@ <h3 id="policy/ip-address-lists/ipAddresses">ipAddresses</h3>
 <tr class="odd">
 <td><code>ipAddress</code></td>
 <td>string</td>
+<td>Specifies the IP address. Use CIDR notation for subnet definition.</td>
+<td></td>
+</tr>
+</tbody>
+</table>
+<h2 id="policy/ip-intelligence">ip-intelligence</h2>
+<table>
+<colgroup>
+<col style="width: 29%" />
+<col style="width: 5%" />
+<col style="width: 47%" />
+<col style="width: 17%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Field Name</th>
+<th>Type</th>
+<th>Description</th>
+<th>Allowed Values</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><code>enabled</code></td>
+<td>boolean</td>
+<td></td>
+<td></td>
+</tr>
+<tr class="even">
+<td><a href="#policy/ip-intelligence/ipIntelligenceCategories">ipIntelligenceCategories</a></td>
+<td>array of objects</td>
 <td></td>
 <td></td>
 </tr>
 </tbody>
 </table>
+<h3 id="policy/ip-intelligence/ipIntelligenceCategories">ipIntelligenceCategories</h3>
+<table>
+<colgroup>
+<col style="width: 29%" />
+<col style="width: 5%" />
+<col style="width: 47%" />
+<col style="width: 17%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Field Name</th>
+<th>Type</th>
+<th>Description</th>
+<th>Allowed Values</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><code>alarm</code></td>
+<td>boolean</td>
+<td></td>
+<td></td>
+</tr>
+<tr class="even">
+<td><code>block</code></td>
+<td>boolean</td>
+<td></td>
+<td></td>
+</tr>
+<tr class="odd">
+<td><code>category</code></td>
+<td>string</td>
+<td></td>
+<td><ul>
+<li>Anonymous Proxy</li>
+<li>BotNets</li>
+<li>Cloud-based Services</li>
+<li>Denial of Service</li>
+<li>Infected Sources</li>
+<li>Mobile Threats</li>
+<li>Phishing Proxies</li>
+<li>Scanners</li>
+<li>Spam Sources</li>
+<li>Tor Proxies</li>
+<li>Web Attacks</li>
+<li>Windows Exploits</li>
+</ul></td>
+</tr>
+</tbody>
+</table>
 <h2 id="policy/json-profiles">json-profiles</h2>
 <table>
 <colgroup>
@@ -3359,6 +3447,7 @@ <h2 id="policy/login-pages">login-pages</h2>
 <li><strong>http-digest</strong>: The web server performs the authentication; user names and passwords are not transmitted over the network, nor are they stored in plain text.</li>
 <li><strong>ntlm</strong>: Microsoft LAN Manager authentication (also called Integrated Windows Authentication) does not transmit credentials in plain text, but requires a continuous TCP connection between the server and client.</li>
 <li><strong>ajax-or-json-request</strong>: The web server uses JSON and AJAX requests to authenticate users trying to access the web application through the login URL. For this option, you also need to type the name of the JSON element containing the user name and password.</li>
+<li><strong>request-body</strong>: The web server uses the request body to authenticate users trying to access the web application through the login URL. This allows brute force login detection using, for example, SAML authentication used on Microsoft Federation Services for SSO which uses SOAP API to login.</li>
 </ul>
 </blockquote></td>
 <td><ul>
@@ -3380,7 +3469,7 @@ <h2 id="policy/login-pages">login-pages</h2>
 <tr class="even">
 <td><code>passwordRegex</code></td>
 <td>string</td>
-<td></td>
+<td>PCRE regular expression for capturing the password. The regular expression must include exactly one capturing group (in rounded parentheses) for the value of the password. For example: "pwd=(w+)". The entered expression is validated and any invalid code is noted and must be corrected. Note: This setting is only relevant if authenticationType is request-body.</td>
 <td></td>
 </tr>
 <tr class="odd">
@@ -3398,7 +3487,7 @@ <h2 id="policy/login-pages">login-pages</h2>
 <tr class="odd">
 <td><code>usernameRegex</code></td>
 <td>string</td>
-<td></td>
+<td>PCRE regular expression for capturing the username. The regular expression must include exactly one capturing group (in rounded parentheses) for the value of the username. For example: "user_id=(w+)". The entered expression is validated and any invalid code is noted and must be corrected. Note: This setting is only relevant if authenticationType is request-body.</td>
 <td></td>
 </tr>
 </tbody>
@@ -3605,7 +3694,7 @@ <h2 id="policy/override-rules">override-rules</h2>
 <p>Request Attributes:</p>
 <blockquote>
 <ul>
-<li><strong>clientIp</strong>: Client IP address in canonical IPv4 or IPv6 format. Use CIDR notation for subnet definition. Example: <em>192.168.1.2</em> or <em>fd00:1::/48</em>. If <em>trustXff</em> (X-Forwarded-For) is enabled in the containing policy, then the value is taken from the configured header (XFF or other). The only supported boolean function for the clientIP attribute is <em>matches</em>.</li>
+<li><strong>clientIp</strong>: Client IP address in canonical IPv4 or IPv6 format or ip-address-list. Use CIDR notation for subnet definition. Example: <em>192.168.1.2</em> or <em>fd00:1::/48</em>. If <em>trustXff</em> (X-Forwarded-For) is enabled in the containing policy, then the value is taken from the configured header (XFF or other). The only supported boolean function for the clientIP attribute is <em>matches</em>.</li>
 <li><strong>host</strong>: The value of the Host header</li>
 <li><strong>method</strong>: The HTTP method in the request</li>
 <li><strong>uri</strong>: The URI (path part) of the request</li>
@@ -3616,7 +3705,7 @@ <h2 id="policy/override-rules">override-rules</h2>
 <li><strong>headers['&lt;name&gt;']</strong>: (map-type) The value of the specified header name. Example: "headers['Accept'].startsWith('application')"</li>
 </ul>
 </blockquote>
-<p><strong>Note</strong>: The "headers['&lt;name&gt;']" attribute does not support 'Cookie' as a header name.</p></td>
+<p><strong>Note</strong>: The "headers['&lt;name&gt;']" attribute does not support 'Cookie' as a header name. Attribute "clientIp" supports using "ipAddressLists" in condition: "clientIp.matches(ipAddressLists['<name>'])</p></td>
 <td></td>
 </tr>
 <tr class="odd">
@@ -6414,6 +6503,7 @@ <h3 id="policy/blocking-settings_violations">violations</h3>
 <li>VIOL_XML_MALFORMED</li>
 <li>VIOL_GEOLOCATION</li>
 <li>VIOL_WEBSOCKET_BAD_REQUEST</li>
+<li>VIOL_MALICIOUS_IP</li>
 </ul></td>
 </tr>
 </tbody>
diff --git a/content/nap-waf/v4/admin-guide/install.md b/content/nap-waf/v4/admin-guide/install.md
index c3e0575dc..d0781d810 100644
--- a/content/nap-waf/v4/admin-guide/install.md
+++ b/content/nap-waf/v4/admin-guide/install.md
@@ -32,8 +32,8 @@ NGINX App Protect WAF supports the following operating systems:
 - [Debian 11 (Bullseye) & 12 (Bookworm)](#debian-10--debian-11--debian-12-installation)
 - [Oracle Linux 8.1.x and above](#oracle-linux-81-installation)
 - [RHEL 8.1.x and above](#rhel-81-installation)
-- [RHEL 9 and above](#rhel-9-installation)
-- [Ubuntu 20.04 (Focal), 22.04 (Jammy) & 24.04 (Noble)](#ubuntu-installation)
+- [RHEL 9, Rocky Linux 9 and above](#rhel-9-installation)
+- [Ubuntu 22.04 (Jammy) & 24.04 (Noble)](#ubuntu-installation)
 
 The NGINX App Protect WAF package has the following dependencies:
 
@@ -51,6 +51,8 @@ The NGINX App Protect WAF package has the following dependencies:
 
 See the NGINX Plus full list of prerequisites for more details. NGINX App Protect WAF can be installed as a module to an existing NGINX Plus installation or as a complete NGINX Plus with App Protect installation in a clean environment.
 
+Please note that an additional package **app-protect-ip-intelligence** is required if the customer intends to use the IP Intelligence feature. This package does not come as a dependency of App Protect and needs to be installed and maintained separately. This package installs the client that downloads and updates the database required for enforcing IP Intelligence.
+
 ## Storage I/O Performance
 
 When deploying App Protect on NGINX Plus take into consideration the performance of storage on which it is going to be installed.
@@ -214,6 +216,30 @@ If a user other than **nginx** is to be used, note the following:
     sudo service nginx start
     ```
 
+14. (Optional) A new feature, `IP Intelligence` is available (version 4.15.0 and above). The feature requires the installation of an additional package to function properly:
+
+    ```shell
+    sudo apk add app-protect-ip-intelligence
+    ```
+
+    After installing the package, run the client:
+
+    ```shell
+    /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+    ```
+
+    Verify the client is populating the database:
+
+    ```shell
+    tail -f iprepd.log
+    ```
+
+    Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
+
+    {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
+    
+    
+
 ---
 
 ## Amazon Linux Installation
@@ -328,6 +354,28 @@ If a user other than **nginx** is to be used, note the following:
     sudo systemctl start nginx
     ```
 
+1. (Optional) A new feature feature `IP Intelligence` is available (version 4.15.0 and above). The feature requires the installation of an additional package to function properly:
+
+    ```shell
+    sudo dnf install -y app-protect-ip-intelligence
+    ```
+
+    After installing the package, run the client:
+
+    ```shell
+    /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+    ```
+    
+    Verify the client is populating the database:
+
+    ```shell
+    tail -f iprepd.log
+    ```
+
+    Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
+
+    {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
+      
 ## Debian Installation
 
 1. If you already have NGINX packages in your system, back up your configs and logs:
@@ -467,6 +515,28 @@ If a user other than **nginx** is to be used, note the following:
     sudo systemctl start nginx
     ```
 
+16. (Optional) A new feature feature `IP Intelligence` is available (version 4.15.0 and above). The feature requires the installation of an additional package to function properly:
+
+    ```shell
+    sudo apt-get -y install app-protect-ip-intelligence
+    ```
+
+    After installing the package, run the client:
+    
+    ```shell
+    /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+    ```
+    
+    Verify the client is populating the database:
+
+    ```shell
+    tail -f iprepd.log
+    ```
+
+    Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
+
+    {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
+    
 {{< warning >}} Debian enables **AppArmor** by default, but NGINX App Protect WAF will run in unconfined mode after being installed as it is shipped with no AppArmor profile. To benefit from AppArmor access control capabilities for NGINX App Protect WAF, you will have to write your own AppArmor profile for NGINX App Protect WAF executables found in `/opt/app_protect/bin` such that it best suits your environment.
 {{< /warning >}}
 
@@ -588,7 +658,29 @@ If a user other than **nginx** is to be used, note the following:
     sudo systemctl start nginx
     ```
 
----
+17. (Optional) A new feature feature `IP Intelligence` is available (version 4.15.0 and above). The feature requires the installation of an additional package to function properly:
+
+    ```shell
+    sudo dnf install -y app-protect-ip-intelligence
+    ```
+
+    After installing the package, run the client:
+    
+    ```shell
+    /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+    ```
+    
+    Verify the client is populating the database:
+
+    ```shell
+    tail -f iprepd.log
+    ```
+
+    Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
+
+    {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
+
+    ---
 
 ## RHEL 9+ Installation
 
@@ -708,7 +800,29 @@ If a user other than **nginx** is to be used, note the following:
     sudo systemctl start nginx
     ```
 
----
+1. (Optional) A new feature `IP Intelligence` is available (version 4.15.0 and above). The feature requires the installation of an additional package to function properly:
+
+    ```shell
+    sudo dnf install -y app-protect-ip-intelligence
+    ```
+
+    After installing the package, run the client:
+    
+    ```shell
+    /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+    ```
+
+    Verify the client is populating the database:
+
+    ```shell
+    tail -f iprepd.log
+    ```
+
+    Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
+
+    {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
+
+   ---
 
 ## Ubuntu Installation
 
@@ -843,6 +957,28 @@ If a user other than **nginx** is to be used, note the following:
     sudo systemctl start nginx
     ```
 
+16. (Optional), a new feature `IP Intelligence` is supported (Check the release notes for the App Protect versions that support IP Intelligence). The feature requires the installation of an additional package to function properly:
+
+    ```shell
+    sudo apt-get -y install app-protect-ip-intelligence
+    ```
+
+    After installing the package, run the client:
+    
+    ```shell
+    /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+    ```
+
+    Verify the client is populating the database:
+
+    ```shell
+    tail -f iprepd.log
+    ```
+
+    Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
+
+    {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
+        
 {{< note >}} Ubuntu 20.04 / Ubuntu 22.04 / Ubuntu 24.04 activates **AppArmor** by default, but NGINX App Protect WAF will run in unconfined mode after being installed as it is shipped with no AppArmor profile. To benefit from AppArmor access control capabilities for NGINX App Protect WAF, you will have to write your own AppArmor profile for NGINX App Protect WAF executables found in `/opt/app_protect/bin` such that it best suits your environment.
 {{< /note >}}
 
@@ -933,7 +1069,13 @@ If a user other than **nginx** is to be used, note the following:
     /bin/su -s /bin/sh -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config 2>&1 >> /var/log/app_protect/bd-socket-plugin.log &" nginx
     /usr/sbin/nginx -g 'daemon off;'
     ```
+    
+    If you want to use IP intelligence feature (Available from versions 4.15.0 and above), add this additional line to your `entrypoint.sh` file:
 
+    ```shell
+    /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
+    ```
+    
 7. Create a Docker image:
 
     - For Oracle Linux/Debian/Ubuntu/Alpine/Amazon Linux:
@@ -996,6 +1138,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \
     --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \
     apk update && apk add app-protect
 
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \
+    apk update && apk add app-protect-ip-intelligence
+
 # Forward request logs to Docker log collector:
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log
@@ -1033,6 +1180,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     && dnf clean all \
     && rm -rf /var/cache/yum
 
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf -y install app-protect-ip-intelligence
+
 # Forward request logs to Docker log collector:
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log
@@ -1085,6 +1237,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
     apt-get update && apt-get install -y app-protect
 
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    apt-get install -y app-protect-ip-intelligence
+
 # Forward request logs to Docker log collector:
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log
@@ -1125,6 +1282,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     && dnf clean all \
     && rm -rf /var/cache/dnf
 
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf install -y app-protect-ip-intelligence
+
 # Forward request logs to Docker log collector:
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log
@@ -1163,6 +1325,53 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     && dnf clean all \
     && rm -rf /var/cache/dnf
 
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf install -y app-protect-ip-intelligence
+
+# Forward request logs to Docker log collector:
+RUN ln -sf /dev/stdout /var/log/nginx/access.log \
+    && ln -sf /dev/stderr /var/log/nginx/error.log
+
+# Copy configuration files:
+COPY nginx.conf custom_log_format.json /etc/nginx/
+COPY entrypoint.sh /root/
+
+CMD ["sh", "/root/entrypoint.sh"]
+```
+
+### Rocky Linux 9 Dockerfile example
+
+```dockerfile
+# syntax=docker/dockerfile:1
+# For Rocky Linux 9:
+FROM rockylinux:9
+
+# Install prerequisite packages:
+RUN dnf -y install wget ca-certificates 'dnf-command(config-manager)'
+
+# Add NGINX Plus repo to Yum:
+RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/plus-9.repo
+
+# Add NGINX App-protect & dependencies repo to Yum:
+RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-9.repo
+RUN dnf config-manager --set-enabled crb \
+    && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \
+    && dnf clean all
+
+# Install NGINX App Protect WAF:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf install --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms -y app-protect \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf install -y app-protect-ip-intelligence
+
 # Forward request logs to Docker log collector:
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log
@@ -1204,6 +1413,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     && dnf clean all \
     && rm -rf /var/cache/dnf
 
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf install -y app-protect-ip-intelligence
+
 # Forward request logs to Docker log collector:
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log
@@ -1256,6 +1470,11 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
     apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect
 
+# Only use if you want to install and use the IP intelligence feature:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    apt-get install -y app-protect-ip-intelligence
+
 # Forward request logs to Docker log collector:
 RUN ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log
@@ -1465,6 +1684,30 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     && rm -rf /var/cache/dnf
 ```
 
+### Rocky Linux 9 Converter Docker Deployment Example
+
+```dockerfile
+# syntax=docker/dockerfile:1
+# For Rocky Linux 9:
+FROM rockylinux:9
+
+# Install prerequisite packages:
+RUN dnf -y install wget ca-certificates 'dnf-command(config-manager)'
+
+# Add NGINX App-protect & dependencies repo to Yum:
+RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-9.repo
+RUN dnf config-manager --set-enabled crb \
+    && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \
+    && dnf clean all
+
+# Install NGINX App Protect WAF:
+RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+    --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+    dnf install -y app-protect-compiler \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+```    
+
 ### Oracle Linux 8 Converter Docker Deployment Example
 
 ```dockerfile
@@ -1628,6 +1871,12 @@ On a host with access to the NGINX App Protect WAF repository:
     yum install --downloadonly --downloaddir=/etc/packages/ app-protect
     ```
 
+    Only use if you want to install and use the IP intelligence feature:
+
+    ```shell
+    yum install --downloadonly --downloaddir=/etc/packages/ app-protect-ip-intelligence
+    ```
+
 3. Download the `epel-release` dependency package:
 
 For RHEL 8.1+ / Oracle Linux 8.1+:
@@ -1656,6 +1905,12 @@ On an offline host:
     yum -y install app-protect
     ```
 
+    Only use if you want to install and use the IP intelligence feature:
+
+    ```shell
+    yum -y install app-protect-ip-intelligence
+    ```
+
 ### Example Deployment for Debian/Ubuntu
 
 #### Add the NGINX App Protect WAF Packages to an Internal Repository
@@ -1670,6 +1925,13 @@ On a host with access to the NGINX App Protect WAF repository:
     apt-get update
     for i in $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances app-protect | grep "^\w" | sort -u); do apt-get download $i 2>>errors.txt; done
     ```
+    
+    Only use if you want to install and use the IP intelligence feature:
+
+    ```shell
+    cd /etc/packages/
+    apt-get download app-protect-ip-intelligence
+    ```
 
 2. Add the packages in `/etc/packages` to your local repository.
 
@@ -1685,6 +1947,11 @@ On an offline host:
     apt-get update
     apt-get install -y app-protect
     ```
+    Only use if you want to install and use the IP intelligence feature:
+
+    ```shell
+    apt-get install -y app-protect-ip-intelligence
+    ```
 
 ## Post-Installation Checks
 
@@ -2434,12 +2701,28 @@ You can uninstall the App Protect in below Operating Systems by using the follow
 
 ### RHEL 8.1+ / Oracle Linux 8.1+ / RHEL 9+
 
+If you have previously installed `app-protect-ip-intelligence` package, please make sure to uninstall it first:
+
+```shell
+sudo dnf remove app-protect-ip-intelligence
+```
+
+Then proceed with uninstalling App Protect packages:
+
 ```shell
 sudo dnf remove app-protect app-protect-selinux
 ```
 
 ### Debian 11 / Debian 12 / Ubuntu 20.04 / Ubuntu 22.04 / Ubuntu 24.04
 
+If you have previously installed `app-protect-ip-intelligence` package, please make sure to uninstall it first:
+
+```shell
+sudo apt-get remove app-protect-ip-intelligence
+```
+
+Then proceed with uninstalling App Protect packages:
+
 ```shell
 sudo apt-get remove app-protect \
 app-protect-plugin \
@@ -2455,6 +2738,14 @@ app-protect-bot-signatures
 
 ### Alpine 3.16 / Alpine 3.17 / Alpine 3.19
 
+If you have previously installed `app-protect-ip-intelligence` package, please make sure to uninstall it first:
+
+```shell
+sudo apk del app-protect-ip-intelligence
+```
+
+Then proceed with uninstalling App Protect packages:
+
 ```shell
 sudo apk del app-protect \
 app-protect-plugin \
diff --git a/content/nap-waf/v4/configuration-guide/configuration.md b/content/nap-waf/v4/configuration-guide/configuration.md
index 025870d05..6b3a9c2c0 100644
--- a/content/nap-waf/v4/configuration-guide/configuration.md
+++ b/content/nap-waf/v4/configuration-guide/configuration.md
@@ -38,7 +38,9 @@ When configuring NGINX App Protect WAF, `app_protect_enable` should always be en
 |[Deny and Allow IP lists](#deny-and-allow-ip-lists) | Manually define denied & allowed IP addresses as well as IP addresses to never log. |
 |[XFF headers & trust](#xff-headers-and-trust) | Disabled by default. User can enable it and optionally add a list of custom XFF headers. |
 |[gRPC Protection](#grpc-protection-for-unary-traffic) | gRPC content profile detects malformed content, parses well-formed content, and extracts the text fields for detecting attack signatures and disallowed meta-characters. In addition, it enforces size restrictions and prohibition of unknown fields. The Interface Definition Language (IDL) files for the gRPC API must be attached to the profile. gRPC protection can be on [unary](#grpc-protection-for-unary-traffic) or [bidirectional](#grpc-protection-for-bidirectional-streaming) traffic.|
-|[Brute Force Attack Preventions](#brute-force-attack-preventions) | Configure brute-force-attack-preventions parameters to secured areas of a web application from brute force attacks.|}
+|[Brute Force Attack Preventions](#brute-force-attack-preventions) | Configure brute-force-attack-preventions parameters to secured areas of a web application from brute force attacks.|
+|[IP Address Lists](#ip-address-lists) | Configure IP Address Lists feature to organize lists of allowed and forbidden IP addresses across several lists with common attributes.|
+|[IP Intelligence](#ip-intelligence-configuration) | Configure the IP Intelligence feature to customize enforcement based on the source IP of the request, limiting access from IP addresses with questionable reputation.|
 
 ### Disallowed File Types
 {{< include "nap-waf/config/common/disallowed-file-types.md" >}}
@@ -240,6 +242,14 @@ http {
 
 {{< include "nap-waf/config/common/enforcer-cookie-settings.md" >}}
 
+### IP Intelligence Configuration
+
+{{< include "nap-waf/config/common/ip-intelligence-conf.md" >}}
+
+### IP Intelligence Forward Proxy Configuration
+
+{{< include "nap-waf/config/common/forward-proxy-conf.md" >}}
+
 ### Additional Configuration Options
 
 
@@ -478,6 +488,15 @@ For the full reference of Override Rules condition syntax and usage see the NGIN
 
 {{< include "nap-waf/config/common/geolocation-override-rules.md" >}}
 
+## IP Address Lists
+
+### Overview
+
+{{< include "nap-waf/config/common/ip-groups-overview.md" >}}
+
+### IP Address Lists in Policy Override Rules Conditions
+
+{{< include "nap-waf/config/common/ip-groups-override-rules.md" >}}
 
 ## JSON Web Token Protection
 
@@ -660,12 +679,23 @@ systematic, username/password combinations to discover legitimate authentication
 To prevent brute force attacks, NGINX App Protect WAF monitors IP addresses, usernames, and the number of failed login attempts beyond a maximum threshold.
 When brute force patterns are detected, the NGINX App Protect WAF policy either trigger an alarm or block the attack if the failed
 login attempts reached a maximum threshold for a specific username or coming from a specific IP address.
-To enable brute force protection, at least one login page must be created.
-The login page entity is created separately and is not included in the brute force configuration block.
+In order to create a brute force configuration for a specific URL in NGINX App Protect you must first create a User-Defined URL, then a Login Page and finally define the URL element in the Brute Force configuration section. 
 
 ---
+### The User-Defined URL example
 
-### Login page policy example
+```json
+"urls": [
+      {
+        "method": "*",
+        "name": "/html_login",
+        "protocol": "http",
+        "type": "explicit"
+      }
+    ],
+```
+
+### Login pages example
 
 A login page specifies the login URL that users must pass through to get authenticated. The configuration of a login URL includes the URL itself, the username and passwords parameters and the validation criteria (how we know that a login was successful or failed)
 ```json
@@ -690,18 +720,10 @@ A login page specifies the login URL that users must pass through to get authent
 {{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< ref "/nap-waf/v4/declarative-policy/policy/#policy/login-pages" >}}). {{< /note >}}
 
 ---
-### Brute force policy example
+### Brute force prevention example
 
 Example1: A single brute force configuration is applied universally to all login pages.
 ```json
-{
-    "policy": {
-        "name": "BruteForcePolicy",
-        "template": {
-            "name": "POLICY_TEMPLATE_NGINX_BASE"
-        },
-        "applicationLanguage": "utf-8",
-        "enforcementMode": "blocking",
         "brute-force-attack-preventions" : [
             {
                "bruteForceProtectionForAllLoginPages" : true,
@@ -719,21 +741,11 @@ Example1: A single brute force configuration is applied universally to all login
                "sourceBasedProtectionDetectionPeriod" : 3600
             }
         ]
-    }
-}
 ```
 
 Example2: Different brute force configurations can be defined for individual login pages,
           with each configuration referencing a specific login page.
 ```json
-{
-    "policy": {
-        "name": "BruteForcePolicySpec",
-        "template": {
-            "name": "POLICY_TEMPLATE_NGINX_BASE"
-        },
-        "applicationLanguage": "utf-8",
-        "enforcementMode": "blocking",
         "brute-force-attack-preventions" : [
             {
                "bruteForceProtectionForAllLoginPages" : false,
@@ -753,13 +765,72 @@ Example2: Different brute force configurations can be defined for individual log
                  "method": "*",
                  "name": "/html_login",
                  "protocol": "http"
-		       }
+               }
             }
         ],
+```
 
-    }
+The following example adds all three of the pieces for a complete example policy.
+
+```json
+{
+  "policy": {
+    "name": "BruteForcePolicy",
+    "template": {
+      "name": "POLICY_TEMPLATE_NGINX_BASE"
+    },
+    "applicationLanguage": "utf-8",
+    "enforcementMode": "blocking",
+    "urls": [
+      {
+        "method": "*",
+        "name": "/html_login",
+        "protocol": "http",
+        "type": "explicit"
+      }
+    ],
+    "login-pages": [
+      {
+        "accessValidation": {
+          "responseContains": "Success"
+        },
+        "authenticationType": "form",
+        "url": {
+          "method": "*",
+          "name": "/html_login",
+          "protocol": "http",
+          "type": "explicit"
+        },
+        "usernameParameterName": "username",
+        "passwordParameterName": "password"
+      }
+    ],
+    "brute-force-attack-preventions": [
+      {
+        "bruteForceProtectionForAllLoginPages": false,
+        "loginAttemptsFromTheSameIp": {
+          "action": "alarm",
+          "enabled": true,
+          "threshold": 20
+        },
+        "loginAttemptsFromTheSameUser": {
+          "action": "alarm",
+          "enabled": true,
+          "threshold": 3
+        },
+        "reEnableLoginAfter": 3600,
+        "sourceBasedProtectionDetectionPeriod": 3600,
+        "url": {
+          "method": "*",
+          "name": "/html_login",
+          "protocol": "http"
+        }
+      }
+    ]
+  }
 }
 ```
+
 {{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< ref "/nap-waf/v4/declarative-policy/policy/#policy/brute-force-attack-preventions" >}}). {{< /note >}}
 
 ## Custom Dimensions Log Entries
diff --git a/content/nap-waf/v4/releases/about-4.15.md b/content/nap-waf/v4/releases/about-4.15.md
new file mode 100644
index 000000000..f56e4ac52
--- /dev/null
+++ b/content/nap-waf/v4/releases/about-4.15.md
@@ -0,0 +1,43 @@
+---
+title: NGINX App Protect WAF 4.15
+weight: 80
+toc: true
+nd-content-type: reference
+nd-product: NAP-WAF
+---
+
+June 24th, 2025
+
+## New features
+
+- Added support for [IP Intelligence]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}})
+- Added support for Rocky Linux 9 
+- Added support for Override rules for [IP Address Lists]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-address-lists" >}})
+
+## Important notes
+
+- Ubuntu 20.04 is no longer supported
+- 12447 - Upgrade libk5crypto3 package
+- 12520 - Upgrade Go compiler to 1.23.8
+
+## Resolved issues
+
+- 12527 - Remove CPAN - installed certs and source files
+- 11112 - Remove systemd/init.d leftovers in NAP WAF v5 pkgs
+- 12400 - Cookie attributes are not added to a TS cookie when there is more than one TS cookie
+- 12498 - Undefined behavior when using huge XFF 
+- 12731 - Multiple clean_resp_reset internal error messages in logs when loading NAP
+
+## Supported packages
+
+| Distribution name        | Package file                                       |
+|--------------------------|----------------------------------------------------|
+| Alpine 3.19              | _app-protect-34.5.442.0-r1.apk_                    |
+| Amazon Linux 2023        | _app-protect-34+5.442.0-1.amzn2023.ngx.x86_64.rpm_ |
+| Debian 11                | _app-protect_34+5.442.0-1\~bullseye_amd64.deb_     |
+| Debian 12                | _app-protect_34+5.442.0-1\~bookworm_amd64.deb_     |
+| Oracle Linux 8.1         | _app-protect-34+5.442.0-1.el8.ngx.x86_64.rpm_      | 
+| Ubuntu 22.04             | _app-protect_34+5.442.0-1\~jammy_amd64.deb_        |
+| Ubuntu 24.04             | _app-protect_34+5.442.0-1\~noble_amd64.deb_        |
+| RHEL 8 and Rocky Linux 8 | _app-protect-34+5.442.0-1.el8.ngx.x86_64.rpm_      |
+| RHEL 9 and Rocky Linux 9 | _app-protect-34+5.442.0-1.el9.ngx.x86_64.rpm_      |
diff --git a/content/nap-waf/v5/admin-guide/deploy-on-docker.md b/content/nap-waf/v5/admin-guide/deploy-on-docker.md
index 40ab5e5b3..a2f0e3821 100644
--- a/content/nap-waf/v5/admin-guide/deploy-on-docker.md
+++ b/content/nap-waf/v5/admin-guide/deploy-on-docker.md
@@ -104,6 +104,11 @@ CMD ["nginx", "-g", "daemon off;"]
 
 {{< include "nap-waf/config/v5/build-nginx-image-oss/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-oss/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -183,6 +188,11 @@ CMD ["nginx", "-g", "daemon off;"]
 
 {{< include "nap-waf/config/v5/build-nginx-image-plus/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-plus/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -346,6 +356,11 @@ volumes:
 ```
 
 
+### Docker Compose File with IP Intelligence
+
+{{< include "nap-waf/ip-intelligence.md" >}}
+
+
 ### Docker Compose File with mTLS
 
 To secure traffic between NGINX and App Protect Enforcer using mTLS, create a `docker-compose.yml` with the following configuration:
@@ -486,6 +501,11 @@ Proceed, by creating a `Dockerfile` using one of the examples provided below.
 
 {{< include "nap-waf/config/v5/build-nginx-image-oss/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-oss/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -518,6 +538,11 @@ You are ready to [Build the image](#build-image-sub)
 
 {{< include "nap-waf/config/v5/build-nginx-image-plus/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-plus/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -665,6 +690,11 @@ volumes:
   app_protect_config:
   app_protect_etc_config:
 ```
+
+#### Docker Compose File with IP Intelligence
+
+{{< include "nap-waf/ip-intelligence.md" >}}
+
 ### Start Deployment
 
 1. To start the NGINX and WAF services, navigate to the directory that contains the `docker-compose.yml` file and run:
diff --git a/content/nap-waf/v5/admin-guide/deploy-with-helm.md b/content/nap-waf/v5/admin-guide/deploy-with-helm.md
index 32b3105be..4a2eeb801 100644
--- a/content/nap-waf/v5/admin-guide/deploy-with-helm.md
+++ b/content/nap-waf/v5/admin-guide/deploy-with-helm.md
@@ -66,6 +66,11 @@ Next, create a `Dockerfile` using one of the examples provided below.
 
 {{< include "nap-waf/config/v5/build-nginx-image-oss/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-oss/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -108,6 +113,11 @@ You are ready to [Build the image](#build-image).
 
 {{< include "nap-waf/config/v5/build-nginx-image-plus/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-plus/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -231,6 +241,11 @@ To use the *mTLS Configuration* options, read the [Secure Traffic Between NGINX
 | | _appprotect.wafEnforcer.imagePullPolicy_ | Image pull policy. | IfNotPresent |
 | | _appprotect.wafEnforcer.env.enforcerPort_ | Port for the WAF Enforcer. | 50000 |
 | | _appprotect.wafEnforcer.resources_ | The resources of the WAF Enforcer container. | requests: cpu=20m,memory=256Mi |
+| **WAF IP Intelligence** | _appprotect.wafIpIntelligence.enable | Enable or disable the use of the IP intelligence container | false |
+| | _appprotect.wafIpIntelligence.image.repository_ | Docker image repository for the WAF IP Intelligence. | private-registry.nginx.com/nap/waf-ip-intelligence |
+| | _appprotect.wafIpIntelligence.image.tag_ | Docker image tag for the WAF Enforcer. | 5.6.0 |
+| | _appprotect.wafIpIntelligence.imagePullPolicy_ | Image pull policy. | IfNotPresent |
+| | _appprotect.wafIpIntelligence.resources_ | The resources of the WAF Enforcer container. | requests: cpu=10m,memory=256Mi |
 | **Config** | _appprotect.config.name_ | The name of the ConfigMap used by the NGINX container. | nginx-config |
 | | _appprotect.config.annotations_ | The annotations of the ConfigMap. | {} |
 | | _appprotect.config.nginxJWT_ | JWT license for NGINX. | "" |
diff --git a/content/nap-waf/v5/admin-guide/deploy-with-manifests.md b/content/nap-waf/v5/admin-guide/deploy-with-manifests.md
index 310d5400b..ded07b037 100644
--- a/content/nap-waf/v5/admin-guide/deploy-with-manifests.md
+++ b/content/nap-waf/v5/admin-guide/deploy-with-manifests.md
@@ -59,6 +59,11 @@ Proceed, by creating a `Dockerfile` using one of the examples provided below.
 
 {{< include "nap-waf/config/v5/build-nginx-image-oss/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-oss/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -101,6 +106,11 @@ You are ready to [Build the image](#build-image).
 
 {{< include "nap-waf/config/v5/build-nginx-image-plus/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-plus/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -281,6 +291,82 @@ spec:
             claimName: nap5-bundles-pvc
 ```
 
+An example `nap5-deployment-with-ip-intelligence.yaml` if you are using the IP Intelligence feature:
+
+Replace the `<your-private-registry>/nginx-app-protect-5:<your-tag>` with the actual image tag.
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nap5-deployment
+spec:
+  selector:
+    matchLabels:
+      app: nap5
+  replicas: 2
+  template:
+    metadata:
+      labels:
+        app: nap5
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: nginx
+          image: <your-private-registry>/nginx-app-protect-5:<your-tag>
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - name: app-protect-bd-config
+              mountPath: /opt/app_protect/bd_config
+            - name: app-protect-config
+              mountPath: /opt/app_protect/config
+        - name: waf-enforcer
+          image: private-registry.nginx.com/nap/waf-enforcer:<version-tag>
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: ENFORCER_PORT
+              value: "50000"
+          volumeMounts:
+            - name: app-protect-bd-config
+              mountPath: /opt/app_protect/bd_config
+            - name: var-iprep
+              mountPath: /var/IpRep
+        - name: waf-config-mgr
+          image: private-registry.nginx.com/nap/waf-config-mgr:<version-tag>
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - all
+          volumeMounts:
+            - name: app-protect-bd-config
+              mountPath: /opt/app_protect/bd_config
+            - name: app-protect-config
+              mountPath: /opt/app_protect/config
+            - name: app-protect-bundles
+              mountPath: /etc/app_protect/bundles
+        - name: waf-ip-intelligence
+          image: private-registry.nginx.com/napwaf-ip-intelligence:<version-tag>
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+          volumeMounts:
+            - name: var-iprep
+              mountPath: /var/IpRep
+      volumes:
+        - name: app-protect-bd-config
+          emptyDir: {}
+        - name: app-protect-config
+          emptyDir: {}
+         - name: var-iprep
+          emptyDir: {}
+        - name: app-protect-bundles
+          persistentVolumeClaim:
+            claimName: nap5-bundles-pvc
+```
+
 Finally, `nap5-service.yaml`:
 
 ```yaml
@@ -436,6 +522,11 @@ Proceed, by creating a `Dockerfile` using one of the examples provided below.
 
 {{< include "nap-waf/config/v5/build-nginx-image-oss/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-oss/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
@@ -468,6 +559,11 @@ You are ready to [Build the image](#build-image-sub)
 
 {{< include "nap-waf/config/v5/build-nginx-image-plus/build-rhel.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/build-nginx-image-plus/build-rocky.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu"%}}
 
diff --git a/content/nap-waf/v5/admin-guide/install.md b/content/nap-waf/v5/admin-guide/install.md
index 3a125b0a9..7e1f05355 100644
--- a/content/nap-waf/v5/admin-guide/install.md
+++ b/content/nap-waf/v5/admin-guide/install.md
@@ -68,6 +68,12 @@ Please follow these steps before you install either NGINX Open Source or NGINX P
 
 {{%/tab%}}
 
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/host-based-nginx-instructions/common-steps-with-dnf.md" >}}
+
+{{%/tab%}}
+
 {{%tab name="Ubuntu"%}}
 
 {{< include "nap-waf/config/v5/host-based-nginx-instructions/common-steps-with-ubuntu.md" >}}
@@ -111,6 +117,12 @@ Please follow these steps before you install either NGINX Open Source or NGINX P
 
 {{%/tab%}}
 
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-oss-centos.md" >}}
+
+{{%/tab%}}
+
 {{%tab name="Ubuntu"%}}
 
 {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-oss-ubuntu.md" >}}
@@ -166,7 +178,7 @@ sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/nginx-plus-8.rep
 
 {{%/tab%}}
 
-{{%tab name="RHEL 9"%}}
+{{%tab name="RHEL 9 / Rocky Linux 9"%}}
 
 Download the NGINX Plus repository file [plus-9.repo](https://cs.nginx.com/static/files/plus-9.repo) to `/etc/yum.repos.d`:
 
@@ -294,6 +306,10 @@ networks:
 In some operating systems, security mechanisms like **SELinux** or **AppArmor** are enabled by default, potentially blocking necessary file access for the `nginx` process and `waf-config-mgr` and `waf-enforcer` containers. To ensure NGINX App Protect WAF v5 operates smoothly without compromising security, consider setting up a custom SELinux policy or AppArmor profile. For short-term troubleshooting, you may use `permissive` (SELinux) or `complain` (AppArmor) mode to avoid these restrictions, but keep in mind that this lowers security and isn't advised for prolonged use.
 {{< /note >}}
 
+### Docker Compose File with IP Intelligence
+
+{{< include "nap-waf/ip-intelligence.md" >}}
+
 ## Start the Deployment
 
 1. To start the WAF services, navigate to the directory that contains the `docker-compose.yml` file and run:
@@ -314,6 +330,10 @@ In some operating systems, security mechanisms like **SELinux** or **AppArmor**
     curl "localhost/<script>"
     ```
 
+## Using IP intelligence feature
+
+{{< include "nap-waf/ip-intelligence.md" >}}
+
 ## Using Policy and Logging Profile Bundles
 
 {{< include "nap-waf/bundles-volume-mount.md" >}}
@@ -375,6 +395,11 @@ Follow these steps before you install NGINX Open Source or NGINX Plus.
 
 {{< include "nap-waf/config/v5/host-based-nginx-instructions/common-steps-with-dnf.md" >}}
 
+{{%/tab%}}
+{{%tab name="Rocky Linux 9"%}}
+
+{{< include "nap-waf/config/v5/host-based-nginx-instructions/common-steps-with-dnf.md" >}}
+
 {{%/tab%}}
 {{%tab name="Ubuntu 20.04"%}}
 
@@ -563,7 +588,7 @@ Follow these steps before you install NGINX Open Source or NGINX Plus.
     ```
 
 {{%/tab%}}
-{{%tab name="RHEL 9"%}}
+{{%tab name="RHEL 9 / Rocky Linux 9"%}}
 
 {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-oss-centos.md" >}}
 
@@ -739,7 +764,7 @@ Then you can move onto the next step, depending on your chosen operating system.
     ```
 
 {{%/tab%}}
-{{%tab name="RHEL 9"%}}
+{{%tab name="RHEL 9 / Rocky Linux 9"%}}
 
 {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-plus-centos.md" >}}
 
@@ -893,18 +918,25 @@ docker pull private-registry.nginx.com/nap/waf-enforcer:5.2.0
 docker pull private-registry.nginx.com/nap/waf-config-mgr:5.2.0
 ```
 
+If IP Intelligence feature is to be used on the deployment, download the `waf-ip-intelligence` as well:
+
+```shell
+docker pull private-registry.nginx.com/nap/waf-ip-intelligence:5.2.0
+```
+
 #### Saving and Transferring Images
 
-1. Save the `waf-enforcer` docker image:
+1. Save the `waf-enforcer` and `waf-config-mgr` docker images:
 
     ```shell
     docker save -o waf-enforcer.tar waf-enforcer:5.2.0
+    docker save -o waf-config-mgr.tar waf-config-mgr:5.2.0
     ```
 
-2. Save the `waf-config-mgr` docker image:
+2. If IP Intelligence feature is to be used on the deployment, save the `waf-ip-intelligence` docker image:
 
     ```shell
-    docker save -o waf-config-mgr.tar waf-config-mgr:5.2.0
+    docker save -o waf-ip-intelligence.tar waf-ip-intelligence:5.2.0
     ```
 
 3. Transfer the tar files from the online machine to the offline/air-gapped machine:
@@ -916,6 +948,12 @@ docker pull private-registry.nginx.com/nap/waf-config-mgr:5.2.0
     docker load -i waf-config-mgr.tar
     ```
 
+5. If IP Intelligence feature is to be used on the deployment, on the offline machine load the docker images:
+
+    ```shell
+    docker load -i waf-ip-intelligence.tar
+    ```
+
 #### Docker Compose File
 
 Create a `docker-compose.yml` with the following configuration on the offline machine:
@@ -959,6 +997,10 @@ networks:
 In some operating systems, security mechanisms like **SELinux** or **AppArmor** are enabled by default, potentially blocking necessary file access for the `nginx` process and `waf-config-mgr` and `waf-enforcer` containers. To ensure NGINX App Protect WAF v5 operates smoothly without compromising security, consider setting up a custom SELinux policy or AppArmor profile. For short-term troubleshooting, you may use `permissive` (SELinux) or `complain` (AppArmor) mode to avoid these restrictions, but keep in mind that this lowers security and isn't advised for prolonged use.
 {{< /note >}}
 
+#### Docker Compose File with IP Intelligence
+
+{{< include "nap-waf/ip-intelligence.md" >}}
+
 ### Start the Deployment
 
 1. To start the WAF services, navigate to the directory that contains the `docker-compose.yml` file and run:
@@ -1133,7 +1175,7 @@ sudo dnf remove app-protect-module-plus
 ```
 
 {{%/tab%}}
-{{%tab name="RHEL 9"%}}
+{{%tab name="RHEL 9 / Rocky Linux 9"%}}
 
 For NGINX Open Source
 Uninstall the NGINX App Protect WAF v5 package:
diff --git a/content/nap-waf/v5/admin-guide/overview.md b/content/nap-waf/v5/admin-guide/overview.md
index 5a24a5ca2..127e600e2 100644
--- a/content/nap-waf/v5/admin-guide/overview.md
+++ b/content/nap-waf/v5/admin-guide/overview.md
@@ -36,10 +36,10 @@ NGINX App Protect WAF v5 supports the following operating systems:
 | ------------ | ------------------- |
 | Alpine       | 3.19                |
 | Debian       | 11, 12              |
-| Ubuntu       | 20.04, 22.04, 24.04 |
+| Ubuntu       | 22.04, 24.04        |
 | Amazon Linux | 2023                |
 | RHEL         | 8, 9                |
-| Rocky Linux  | 8                   |
+| Rocky Linux  | 8, 9                |
 | Oracle Linux | 8.1                 |
 
 ## Deployment Types
diff --git a/content/nap-waf/v5/configuration-guide/configuration.md b/content/nap-waf/v5/configuration-guide/configuration.md
index a17322367..f654d70ee 100644
--- a/content/nap-waf/v5/configuration-guide/configuration.md
+++ b/content/nap-waf/v5/configuration-guide/configuration.md
@@ -15,7 +15,6 @@ This guide explains the F5 NGINX App Protect WAF security features and how to us
 
 For more information on the NGINX App Protect WAF security features, see [NGINX App Protect WAF Terminology](#nginx-app-protect-waf-terminology).
 
-
 ## Supported Security Policy Features
 
 |Protection Mechanism | Description |
@@ -38,6 +37,8 @@ For more information on the NGINX App Protect WAF security features, see [NGINX
 |[gRPC Protection](#grpc-protection-for-unary-traffic) | gRPC content profile detects malformed content, parses well-formed content, and extracts the text fields for detecting attack signatures and disallowed meta-characters. In addition, it enforces size restrictions and prohibition of unknown fields. The Interface Definition Language (IDL) files for the gRPC API must be attached to the profile. gRPC protection can be on [unary](#grpc-protection-for-unary-traffic) or [bidirectional](#grpc-protection-for-bidirectional-streaming) traffic.|
 |[Secure Traffic Between NGINX and App Protect Enforcer using mTLS](#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls) | Disabled by default. You can manually configure mTLS to secure the traffic between NGINX and App Protect Enforcer.|
 |[Brute Force Attack Preventions](#brute-force-attack-preventions) | Configure brute-force-attack-preventions parameters to secured areas of a web application from brute force attacks.|
+|[IP Address Lists](#ip-address-lists) | Configure IP Address Lists feature to organize lists of allowed and forbidden IP addresses across several lists with common attributes.|
+|[IP Intelligence](#ip-intelligence-configuration) | Configure the IP Intelligence feature to customize enforcement based on the source IP of the request, limiting access from IP addresses with questionable reputation.|
 
 ### Disallowed File Types
 
@@ -259,6 +260,14 @@ app_protect_policy_file /policies_mount/new_default_policy.tgz;
 
 {{< include "nap-waf/config/common/enforcer-cookie-settings.md" >}}
 
+### IP Intelligence Configuration
+
+{{< include "nap-waf/config/common/ip-intelligence-conf.md" >}}
+
+### IP Intelligence Forward Proxy Configuration
+
+{{< include "nap-waf/config/common/forward-proxy-conf.md" >}}
+
 ### Additional Configuration Options
 
 {{< include "nap-waf/config/common/additional-config-options.md" >}}
@@ -475,6 +484,16 @@ For the full reference of Override Rules condition syntax and usage see the NGIN
 
 {{< include "nap-waf/config/common/geolocation-override-rules.md" >}}
 
+## IP Address Lists
+
+### Overview
+
+{{< include "nap-waf/config/common/ip-groups-overview.md" >}}
+
+### IP Address Lists in Policy Override Rules Conditions
+
+{{< include "nap-waf/config/common/ip-groups-override-rules.md" >}}
+
 ## JSON Web Token Protection
 
 ### Overview
@@ -798,12 +817,25 @@ systematic, username/password combinations to discover legitimate authentication
 To prevent brute force attacks, NGINX App Protect WAF monitors IP addresses, usernames, and the number of failed login attempts beyond a maximum threshold.
 When brute force patterns are detected, the NGINX App Protect WAF policy either trigger an alarm or block the attack if the failed
 login attempts reached a maximum threshold for a specific username or coming from a specific IP address.
-To enable brute force protection, at least one login page must be created.
-The login page entity is created separately and is not included in the brute force configuration block
+In order to create a brute force configuration for a specific URL in Nginx App Protect you must first create a User-Defined URL, then a Login Page and finally define the URL element in the Brute Force configuration section.
+
 
 ---
 
-### Login page policy example
+### The User-Defined URL example
+
+```json
+"urls": [
+      {
+        "method": "*",
+        "name": "/html_login",
+        "protocol": "http",
+        "type": "explicit"
+      }
+    ],
+```
+
+### Login pages example
 
 A login page specifies the login URL that users must pass through to get authenticated. The configuration of a login URL includes the URL itself, the username and passwords parameters and the validation criteria (how we know that a login was successful or failed)
 ```json
@@ -829,18 +861,10 @@ A login page specifies the login URL that users must pass through to get authent
 
 ---
 
-### Brute force policy example
+### Brute force prevention example
 
 Example1: A single brute force configuration is applied universally to all login pages.
 ```json
-{
-    "policy": {
-        "name": "BruteForcePolicy",
-        "template": {
-            "name": "POLICY_TEMPLATE_NGINX_BASE"
-        },
-        "applicationLanguage": "utf-8",
-        "enforcementMode": "blocking",
         "brute-force-attack-preventions" : [
             {
                "bruteForceProtectionForAllLoginPages" : true,
@@ -858,21 +882,11 @@ Example1: A single brute force configuration is applied universally to all login
                "sourceBasedProtectionDetectionPeriod" : 3600
             }
         ]
-    }
-}
 ```
 
 Example2: Different brute force configurations can be defined for individual login pages,
           with each configuration referencing a specific login page.
 ```json
-{
-    "policy": {
-        "name": "BruteForcePolicySpec",
-        "template": {
-            "name": "POLICY_TEMPLATE_NGINX_BASE"
-        },
-        "applicationLanguage": "utf-8",
-        "enforcementMode": "blocking",
         "brute-force-attack-preventions" : [
             {
                "bruteForceProtectionForAllLoginPages" : false,
@@ -892,13 +906,71 @@ Example2: Different brute force configurations can be defined for individual log
                  "method": "*",
                  "name": "/html_login",
                  "protocol": "http"
-		       }
+               }
             }
-        ],
+        ]
+```
 
-    }
+The following example adds all three of the pieces for a complete example policy.
+```json
+{
+  "policy": {
+    "name": "BruteForcePolicy",
+    "template": {
+      "name": "POLICY_TEMPLATE_NGINX_BASE"
+    },
+    "applicationLanguage": "utf-8",
+    "enforcementMode": "blocking",
+    "urls": [
+      {
+        "method": "*",
+        "name": "/html_login",
+        "protocol": "http",
+        "type": "explicit"
+      }
+    ],
+    "login-pages": [
+      {
+        "accessValidation": {
+          "responseContains": "Success"
+        },
+        "authenticationType": "form",
+        "url": {
+          "method": "*",
+          "name": "/html_login",
+          "protocol": "http",
+          "type": "explicit"
+        },
+        "usernameParameterName": "username",
+        "passwordParameterName": "password"
+      }
+    ],
+    "brute-force-attack-preventions": [
+      {
+        "bruteForceProtectionForAllLoginPages": false,
+        "loginAttemptsFromTheSameIp": {
+          "action": "alarm",
+          "enabled": true,
+          "threshold": 20
+        },
+        "loginAttemptsFromTheSameUser": {
+          "action": "alarm",
+          "enabled": true,
+          "threshold": 3
+        },
+        "reEnableLoginAfter": 3600,
+        "sourceBasedProtectionDetectionPeriod": 3600,
+        "url": {
+          "method": "*",
+          "name": "/html_login",
+          "protocol": "http"
+        }
+      }
+    ]
+  }
 }
 ```
+
 {{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< ref "/nap-waf/v5/declarative-policy/policy/#policy/brute-force-attack-preventions" >}}). {{< /note >}}
 
 ## Custom Dimensions Log Entries
diff --git a/content/nap-waf/v5/releases/about-5.7.md b/content/nap-waf/v5/releases/about-5.7.md
new file mode 100644
index 000000000..7ad69b20c
--- /dev/null
+++ b/content/nap-waf/v5/releases/about-5.7.md
@@ -0,0 +1,59 @@
+---
+title: NGINX App Protect WAF 5.7
+weight: 840
+toc: true
+nd-content-type: reference
+nd-product: NAP-WAF
+---
+
+June 24th, 2025
+
+## New features
+
+- Added support for [IP Intelligence]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#ip-intelligence-configuration" >}})
+- Added support for Rocky Linux 9 
+- Added support for Override rules for [IP Address Lists]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#ip-address-lists" >}})
+  
+## Important notes
+
+- Ubuntu 20.04 is no longer supported
+- 12447 - Upgrade libk5crypto3 package
+- 12520 - Upgrade Go compiler to 1.23.8
+
+## Resolved issues
+
+- 12527 - Remove CPAN - installed certs and source files
+- 11112 - Remove systemd/init.d leftovers in NAP WAF v5 pkgs
+- 12400 - Cookie attributes are not added to a TS cookie when there is more than one TS cookie
+- 12498 - Undefined behavior when using huge XFF 
+- 12731 - Multiple clean_resp_reset internal error messages in logs when loading NAP
+
+## Supported packages
+
+### NGINX Open Source
+
+| Distribution name        | Package file                                                      |
+|--------------------------|-------------------------------------------------------------------|
+| Alpine 3.19              | _app-protect-module-oss-1.27.4+5.442.0-r1.apk_                    |
+| Amazon Linux 2023        | _app-protect-module-oss-1.27.4+5.442.0-1.amzn2023.ngx.x86_64.rpm_ |
+| Debian 11                | _app-protect-module-oss_1.27.4+5.442.0-1\~bullseye_amd64.deb_     |
+| Debian 12                | _app-protect-module-oss_1.27.4+5.442.0-1\~bookworm_amd64.deb_     |
+| Oracle Linux 8.1         | _app-protect-module-oss-1.27.4+5.442.0-1.el8.ngx.x86_64.rpm_      |
+| Ubuntu 22.04             | _app-protect-module-oss_1.27.4+5.442.0-1\~jammy_amd64.deb_        |
+| Ubuntu 24.04             | _app-protect-module-oss_1.27.4+5.442.0-1\~noble_amd64.deb_        |
+| RHEL 8 and Rocky Linux 8 | _app-protect-module-oss-1.27.4+5.442.0-1.el8.ngx.x86_64.rpm_      |
+| RHEL 9 and Rocky Linux 9 | _app-protect-module-oss-1.27.4+5.442.0-1.el9.ngx.x86_64.rpm_      |
+
+### NGINX Plus
+
+| Distribution name        | Package file                                                   |
+|--------------------------|----------------------------------------------------------------|
+| Alpine 3.19              | _app-protect-module-plus-34+5.442.0-r1.apk_                    |
+| Amazon Linux 2023        | _app-protect-module-plus-34+5.442.0-1.amzn2023.ngx.x86_64.rpm_ |
+| Debian 11                | _app-protect-module-plus_34+5.442.0-1\~bullseye_amd64.deb_     |
+| Debian 12                | _app-protect-module-plus_34+5.442.0-1\~bookworm_amd64.deb_     |
+| Oracle Linux 8.1         | _app-protect-module-plus-34+5.442.0-1.el8.ngx.x86_64.rpm_      |
+| Ubuntu 22.04             | _app-protect-module-plus_34+5.442.0-1\~jammy_amd64.deb_        |
+| Ubuntu 24.04             | _app-protect-module-plus_34+5.442.0-1\~noble_amd64.deb_        |
+| RHEL 8 and Rocky Linux 8 | _app-protect-module-plus-34+5.442.0-1.el8.ngx.x86_64.rpm_      |
+| RHEL 9 and Rocky Linux 9 | _app-protect-module-plus-34+5.442.0-1.el9.ngx.x86_64.rpm_      |
diff --git a/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md b/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md
index 69bf4a8fc..bbf4be2fb 100644
--- a/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md
+++ b/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md
@@ -91,7 +91,7 @@ In order to open a support ticket, collect the troubleshooting information in on
 
 3. If NGINX is directly installed on the host machine:
 
-    - For CentOS / RHEL / Amazon Linux / Oracle Linux:
+    - For CentOS / RHEL / Rocky Linux / Amazon Linux / Oracle Linux:
 
     ```shell
     rpm -qa nginx* app-protect* > package_versions.txt
diff --git a/data/nap-waf/schema/policy.json b/data/nap-waf/schema/policy.json
index 66234108d..8669dbf19 100644
--- a/data/nap-waf/schema/policy.json
+++ b/data/nap-waf/schema/policy.json
@@ -433,7 +433,8 @@
                                        "VIOL_XML_FORMAT",
                                        "VIOL_XML_MALFORMED",
                                        "VIOL_GEOLOCATION",
-                                       "VIOL_WEBSOCKET_BAD_REQUEST"
+                                       "VIOL_WEBSOCKET_BAD_REQUEST",
+                                       "VIOL_MALICIOUS_IP"
                                     ],
                                     "type" : "string"
                                  }
@@ -2367,7 +2368,7 @@
                            },
                            "blockRequests" : {
                               "default" : "policy-default",
-                              "description" : "Specifies how the system responds to blocking requests sent from this IP address list.\n- **Policy Default:** Specifies that the Policy Blocking Settings will be used for requests from this IP address list.\n- **Never Block:** Specifies that the system does not block requests sent from this IP address list, even if your security policy is configured to block all traffic.\n- **Always Block:** Specifies that the system blocks requests sent from this IP address list.\nOptional",
+                              "description" : "Specifies how the system responds to blocking requests sent from this IP address list.\n- **Policy Default:** Specifies that the policy enforcementMode will be used for requests from this IP address list.\n- **Never Block:** Specifies that the system does not block requests sent from this IP address list, even if your security policy is configured to block all traffic.\n- **Always Block:** Specifies that the system blocks requests sent from this IP address list.\nOptional,  if absent Policy Default is used.",
                               "enum" : [
                                  "always",
                                  "never",
@@ -2380,10 +2381,11 @@
                               "type" : "string"
                            },
                            "ipAddresses" : {
-                              "description" : "Specifies the IP addresses.",
+                              "description" : "Specifies the IP addresses. Use CIDR notation for subnet definition.",
                               "items" : {
                                  "properties" : {
                                     "ipAddress" : {
+                                       "description" : "Specifies the IP address. Use CIDR notation for subnet definition.",
                                        "type" : "string"
                                     }
                                  },
@@ -2395,7 +2397,7 @@
                               "type" : "array"
                            },
                            "matchOrder" : {
-                              "description" : "Specifies the order index for IP Address List matching. If unspecified, the order is implicitly as the lists appear in the policy.\nIP Address Groups with a lower matchOrder will be checked for a match prior to items with higher matchOrder.",
+                              "description" : "Specifies the order matching index between different IP Address Lists. If unspecified, the order is implicitly as the lists appear in the policy. IP Address Lists with a lower matchOrder will be checked for a match prior to items with higher matchOrder.",
                               "type" : "integer"
                            },
                            "name" : {
@@ -2404,11 +2406,11 @@
                            },
                            "neverLogRequests" : {
                               "default" : false,
-                              "description" : "Specifies when enabled that the system does not log requests or responses sent from this IP address list, even if the traffic is illegal, and even if your security policy is configured to log all traffic.",
+                              "description" : "Specifies when enabled that the system does not log requests or responses sent from this IP address list, even if the traffic is illegal, and even if your security policy is configured to log all traffic. Optional, if absent default value is false.",
                               "type" : "boolean"
                            },
                            "setGeolocation" : {
-                              "description" : "Specifies a geolocation to be associated for this IP address list. Optional",
+                              "description" : "Specifies a geolocation to be associated for this IP address list. This will force the IP addresses in the list to be considered as though they are in that geolocation. This applies to blocking via \"disallowed-geolocations\" and to logging. Optional",
                               "type" : "string"
                            }
                         },
@@ -2424,6 +2426,58 @@
                   }
                ]
             },
+            "ip-intelligence" : {
+               "oneOf" : [
+                  {
+                     "properties" : {
+                        "enabled" : {
+                           "default" : false,
+                           "type" : "boolean"
+                        },
+                        "ipIntelligenceCategories" : {
+                           "items" : {
+                              "properties" : {
+                                 "alarm" : {
+                                    "default" : false,
+                                    "type" : "boolean"
+                                 },
+                                 "block" : {
+                                    "default" : false,
+                                    "type" : "boolean"
+                                 },
+                                 "category" : {
+                                    "enum" : [
+                                       "Anonymous Proxy",
+                                       "BotNets",
+                                       "Cloud-based Services",
+                                       "Denial of Service",
+                                       "Infected Sources",
+                                       "Mobile Threats",
+                                       "Phishing Proxies",
+                                       "Scanners",
+                                       "Spam Sources",
+                                       "Tor Proxies",
+                                       "Web Attacks",
+                                       "Windows Exploits"
+                                    ],
+                                    "type" : "string"
+                                 }
+                              },
+                              "required" : [
+                                 "category"
+                              ],
+                              "type" : "object"
+                           },
+                           "type" : "array"
+                        }
+                     },
+                     "type" : "object"
+                  },
+                  {
+                     "$ref" : "#/definitions/reference"
+                  }
+               ]
+            },
             "json-profiles" : {
                "oneOf" : [
                   {
@@ -2848,7 +2902,7 @@
                            },
                            "authenticationType" : {
                               "default" : "none",
-                              "description" : "Authentication Type is method the web server uses to authenticate the login URL's credentials with a web user.\n\n- **none**: The web server does not authenticate users trying to access the web application through the login URL. This is the default setting.\n- **form**: The web application uses a form to collect and authenticate user credentials. If using this option, you also need to type the user name and password parameters written in the code of the HTML form.\n- **http-basic**: The user name and password are transmitted in Base64 and stored on the server in plain text.\n- **http-digest**: The web server performs the authentication; user names and passwords are not transmitted over the network, nor are they stored in plain text.\n- **ntlm**: Microsoft LAN Manager authentication (also called Integrated Windows Authentication) does not transmit credentials in plain text, but requires a continuous TCP connection between the server and client.\n- **ajax-or-json-request**: The web server uses JSON and AJAX requests to authenticate users trying to access the web application through the login URL. For this option, you also need to type the name of the JSON element containing the user name and password.",
+                              "description" : "Authentication Type is method the web server uses to authenticate the login URL's credentials with a web user.\n\n- **none**: The web server does not authenticate users trying to access the web application through the login URL. This is the default setting.\n- **form**: The web application uses a form to collect and authenticate user credentials. If using this option, you also need to type the user name and password parameters written in the code of the HTML form.\n- **http-basic**: The user name and password are transmitted in Base64 and stored on the server in plain text.\n- **http-digest**: The web server performs the authentication; user names and passwords are not transmitted over the network, nor are they stored in plain text.\n- **ntlm**: Microsoft LAN Manager authentication (also called Integrated Windows Authentication) does not transmit credentials in plain text, but requires a continuous TCP connection between the server and client.\n- **ajax-or-json-request**: The web server uses JSON and AJAX requests to authenticate users trying to access the web application through the login URL. For this option, you also need to type the name of the JSON element containing the user name and password.\n- **request-body**: The web server uses the request body to authenticate users trying to access the web application through the login URL. This allows brute force login detection using, for example, SAML authentication used on Microsoft Federation Services for SSO which uses SOAP API to login.",
                               "enum" : [
                                  "ajax-or-json-request",
                                  "form",
@@ -2865,6 +2919,7 @@
                               "type" : "string"
                            },
                            "passwordRegex" : {
+                              "description" : "PCRE regular expression for capturing the password. The regular expression must include exactly one capturing group (in rounded parentheses) for the value of the password. For example: \"pwd=(\\w+)\". The entered expression is validated and any invalid code is noted and must be corrected. Note: This setting is only relevant if authenticationType is request-body.",
                               "type" : "string"
                            },
                            "url" : {
@@ -2877,6 +2932,7 @@
                               "type" : "string"
                            },
                            "usernameRegex" : {
+                              "description" : "PCRE regular expression for capturing the username. The regular expression must include exactly one capturing group (in rounded parentheses) for the value of the username. For example: \"user_id=(\\w+)\". The entered expression is validated and any invalid code is noted and must be corrected. Note: This setting is only relevant if authenticationType is request-body.",
                               "type" : "string"
                            }
                         },
@@ -2990,7 +3046,7 @@
                               "type" : "string"
                            },
                            "condition" : {
-                              "description" : "Specifies the condition under which the override rule should be applied.\n\nExample: \"clientIp != '10.0.0.5' and userAgent.lower().contains('WebRobot')\"\n\nCondition Syntax:\n\n- The condition consists of one or more clauses separated by **and** or **or**.\n\n  Example: \"clientIp == '10.0.0.5' and (host.startsWith('internal') or uri.contains('api'))\"\n\n- Each clause can optionally start with **not** - to negate the expression.\n\n  Example: \"not clientIp == '127.0.0.1'\"\n\n- **not** can also be used to negate a parenthesized expression.\n\n  Example: \"not (method == 'GET' or method == 'PUT')\"\n\n- A clause can be a simple comparison between two value expressions, or a boolean function applied to a literal value.\n\nSupported comparison operators:\n\n  - **==** - Checks for equality between two value expressions.\n  - **!=** - Checks for inequality between two value expressions.\n\n  Example: \"clientIp != '10.0.0.5'\" (equivalent to \"not clientIp == '10.0.0.5'\")\n\nSupported boolean functions:\n\n  - **matches**: Performs an exact match of a value expression, equivalent to **==**.\n  - **startsWith**: Checks if a value expression starts with a specific substring.\n  - **contains**: Checks if a value expression contains a specific substring.\n\n  Example: \"uri.startsWith('/api')\"\n\n**Note**: Functions \"startsWith\" and \"contains\" are not applicable to the \"clientIp\" attribute. Regular expressions are not supported.\n\n- Value expressions can be a request attribute, literal value, or a value function.\n- A literal can be a string value enclosed in single quotes, or can be the keyword \"null\" without quotes.\n\n  Example: \"userAgent == null\"\n\nSupported value functions:\n\n  - **lower**: Any boolean function applied on the resulting string will be **case insensitive**. Applicable to ANSI characters only.\n\n  Example: \"uri.lower().contains('BaR')\" will match the URI \"/Foo/bAr\"\n\nRequest Attributes:\n\n- **clientIp**: Client IP address in canonical IPv4 or IPv6 format. Use CIDR notation for subnet definition. Example: *192.168.1.2* or *fd00:1::/48*. If *trustXff* (X-Forwarded-For) is enabled in the containing policy, then the value is taken from the configured header (XFF or other). The only supported boolean function for the clientIP attribute is *matches*.\n- **host**: The value of the Host header\n- **method**: The HTTP method in the request\n- **uri**: The URI (path part) of the request\n- **userAgent**: The value of the User-Agent header, or *null* (without quotes) if not present\n- **geolocation**: The geolocation of the client IP address. The value is the ISO 3166 two-letter code of the respective country.\n- **parameters['<name>']**: (map-type) The value of the specified parameter name (limited to query string parameters). Example: \"parameters['id'] == '11'\"\n- **cookies['<name>']**: (map-type) The value of the specified cookie name. Example: \"cookies['Path'].contains('product')\"\n- **headers['<name>']**: (map-type) The value of the specified header name. Example: \"headers['Accept'].startsWith('application')\"\n\n**Note**: The \"headers['<name>']\" attribute does not support 'Cookie' as a header name.",
+                              "description" : "Specifies the condition under which the override rule should be applied.\n\nExample: \"clientIp != '10.0.0.5' and userAgent.lower().contains('WebRobot')\"\n\nCondition Syntax:\n\n- The condition consists of one or more clauses separated by **and** or **or**.\n\n  Example: \"clientIp == '10.0.0.5' and (host.startsWith('internal') or uri.contains('api'))\"\n\n- Each clause can optionally start with **not** - to negate the expression.\n\n  Example: \"not clientIp == '127.0.0.1'\"\n\n- **not** can also be used to negate a parenthesized expression.\n\n  Example: \"not (method == 'GET' or method == 'PUT')\"\n\n- A clause can be a simple comparison between two value expressions, or a boolean function applied to a literal value.\n\nSupported comparison operators:\n\n  - **==** - Checks for equality between two value expressions.\n  - **!=** - Checks for inequality between two value expressions.\n\n  Example: \"clientIp != '10.0.0.5'\" (equivalent to \"not clientIp == '10.0.0.5'\")\n\nSupported boolean functions:\n\n  - **matches**: Performs an exact match of a value expression, equivalent to **==**.\n  - **startsWith**: Checks if a value expression starts with a specific substring.\n  - **contains**: Checks if a value expression contains a specific substring.\n\n  Example: \"uri.startsWith('/api')\"\n\n**Note**: Functions \"startsWith\" and \"contains\" are not applicable to the \"clientIp\" attribute. Regular expressions are not supported.\n\n- Value expressions can be a request attribute, literal value, or a value function.\n- A literal can be a string value enclosed in single quotes, or can be the keyword \"null\" without quotes.\n\n  Example: \"userAgent == null\"\n\nSupported value functions:\n\n  - **lower**: Any boolean function applied on the resulting string will be **case insensitive**. Applicable to ANSI characters only.\n\n  Example: \"uri.lower().contains('BaR')\" will match the URI \"/Foo/bAr\"\n\nRequest Attributes:\n\n- **clientIp**: Client IP address in canonical IPv4 or IPv6 format or ip-address-list. Use CIDR notation for subnet definition. Example: *192.168.1.2* or *fd00:1::/48*. If *trustXff* (X-Forwarded-For) is enabled in the containing policy, then the value is taken from the configured header (XFF or other). The only supported boolean function for the clientIP attribute is *matches*.\n- **host**: The value of the Host header\n- **method**: The HTTP method in the request\n- **uri**: The URI (path part) of the request\n- **userAgent**: The value of the User-Agent header, or *null* (without quotes) if not present\n- **geolocation**: The geolocation of the client IP address. The value is the ISO 3166 two-letter code of the respective country.\n- **parameters['<name>']**: (map-type) The value of the specified parameter name (limited to query string parameters). Example: \"parameters['id'] == '11'\"\n- **cookies['<name>']**: (map-type) The value of the specified cookie name. Example: \"cookies['Path'].contains('product')\"\n- **headers['<name>']**: (map-type) The value of the specified header name. Example: \"headers['Accept'].startsWith('application')\"\n\n**Note**: \n - The \"headers['<name>']\" attribute does not support 'Cookie' as a header name.\n - Attribute \"clientIp\" supports using \"ipAddressLists\" in condition: \"clientIp.matches(ipAddressLists['<name>'])\"",
                               "type" : "string"
                            },
                            "name" : {

From 592fda81a0ecd7a1e0741a718082109cfd5cd01c Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 25 Jun 2025 09:11:40 -0700
Subject: [PATCH 051/117] Updated N1 landing page to use new params (#738)

* chore: Updated N1 landing page to use new params

* Forgot to add last two params for uniformity
---
 content/nginx-one/_index.md | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index d5f57a9a6..f2c954904 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -1,10 +1,12 @@
 ---
 title: F5 NGINX One Console
-description: The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
+nd-subtitle: The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
 url: /nginx-one/
-hasCustomContent: true
+nd-landing-page: true
 cascade:
   logo: "NGINX-One-product-icon.svg"
+nd-content-type: landing-page
+nd-product: NGINX One
 ---
 {{< card-layout >}}
   {{< card-section >}}
@@ -35,38 +37,37 @@ cascade:
     {{< card title="Glossary" >}}
       Learn terms unique to NGINX One Console 
     {{</ card >}}
-    {{< card title="Changelog" >}}
-      {{< changelog-dates >}}
+    {{< card title="Changelog" >}}{{< changelog-dates >}}
     {{</ card >}}
   {{</ card-section >}}
 
   # Other Components 
   {{< card-section title="Kubernetes Solutions">}}
-    {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" icon="NGINX-Ingress-Controller-product-icon">}}
+    {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" brandIcon="NGINX-Ingress-Controller-product-icon">}}
       Kubernetes traffic management with API gateway, identity, and observability features. 
     {{</ card >}}
-    {{< card title="NGINX Gateway Fabric" titleUrl="/nginx-gateway-fabric" icon="NGINX-product-icon">}}
+    {{< card title="NGINX Gateway Fabric" titleUrl="/nginx-gateway-fabric" brandIcon="NGINX-product-icon">}}
       Next generation Kubernetes connectivity using the Gateway API. 
     {{</ card >}}
   {{</ card-section >}}
   {{< card-section title="Local Console Option">}}
-    {{< card title="NGINX Instance Manager" titleUrl="/nginx-instance-manager" icon="NGINX-Instance-Manager-product-icon">}}
+    {{< card title="NGINX Instance Manager" titleUrl="/nginx-instance-manager" brandIcon="NGINX-Instance-Manager-product-icon">}}
       Track and control NGINX Open Source and NGINX Plus instances. 
     {{</ card >}}
   {{</ card-section >}}
   {{< card-section title="Modern App Delivery">}}
-    {{< card title="NGINX Plus" titleUrl="/nginx" icon="NGINX-Plus-product-icon-RGB">}}
+    {{< card title="NGINX Plus" titleUrl="/nginx" brandIcon="NGINX-Plus-product-icon-RGB">}}
       The all-in-one load balancer, reverse proxy, web server, content cache, and API gateway. 
     {{</ card >}}
-    {{< card title="NGINX Open Source" titleUrl="https://nginx.org" icon="NGINX-product-icon">}}
+    {{< card title="NGINX Open Source" titleUrl="https://nginx.org" brandIcon="NGINX-product-icon">}}
       The open source all-in-one load balancer, content cache, and web server 
     {{</ card >}}
   {{</ card-section >}}
   {{< card-section title="Security">}}
-    {{< card title="NGINX App Protect WAF" titleUrl="/nginx-app-protect-waf" icon="NGINX-App-Protect-WAF-product-icon">}}
+    {{< card title="NGINX App Protect WAF" titleUrl="/nginx-app-protect-waf" brandIcon="NGINX-App-Protect-WAF-product-icon">}}
       Lightweight, high-performance, advanced protection against Layer 7 attacks on your apps and APIs. 
     {{</ card >}}
-    {{< card title="NGINX App Protect DoS" titleUrl="/nginx-app-protect-dos" icon="NGINX-App-Protect-DoS-product-icon">}}
+    {{< card title="NGINX App Protect DoS" titleUrl="/nginx-app-protect-dos" brandIcon="NGINX-App-Protect-DoS-product-icon">}}
       Defend, adapt, and mitigate against Layer 7 denial-of-service attacks on your apps and APIs. 
     {{</ card >}}
   {{</ card-section >}}

From 8b3c33864d27ed1f36e16ed503a2931e995952bc Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 25 Jun 2025 10:16:34 -0700
Subject: [PATCH 052/117] Bump theme version (#741)

chore: Bump theme version
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index eab95ad43..9c3f0049a 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/nginxinc/docs
 
 go 1.19
 
-require github.com/nginxinc/nginx-hugo-theme v0.42.37 // indirect
+require github.com/nginxinc/nginx-hugo-theme v0.43.2 // indirect
diff --git a/go.sum b/go.sum
index 2f4bc5017..672363914 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,2 @@
-github.com/nginxinc/nginx-hugo-theme v0.42.37 h1:KtESjG1VG6ioSQBWfwgIiDVEmq9mylpunV2NENM8XvI=
-github.com/nginxinc/nginx-hugo-theme v0.42.37/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
+github.com/nginxinc/nginx-hugo-theme v0.43.2 h1:g+5+egVI1OOsXRcDSQvWeRhihZfc7LDTnWceZWS7J/o=
+github.com/nginxinc/nginx-hugo-theme v0.43.2/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
\ No newline at end of file

From 1079afcabf88ae6a3163e2b6a27920e3fbe36f8a Mon Sep 17 00:00:00 2001
From: Travis Martin <33876974+travisamartin@users.noreply.github.com>
Date: Wed, 25 Jun 2025 11:10:42 -0700
Subject: [PATCH 053/117] Updated the config snippet for enabling the NGINX
 Plus API and dashboard (#739)

* updated the nginx config snippet for enabling the NGINX Plus API and dashboard

* edits

* Update content/includes/use-cases/monitoring/enable-nginx-plus-api.md

Co-authored-by: Alan Dooley <a.dooley@f5.com>

* edits per tech review

---------

Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 .../enable-nplus-api-dashboard.md             | 37 +++++++++++
 .../monitoring/enable-nginx-plus-api.md       | 62 +++----------------
 2 files changed, 45 insertions(+), 54 deletions(-)
 create mode 100644 content/includes/config-snippets/enable-nplus-api-dashboard.md

diff --git a/content/includes/config-snippets/enable-nplus-api-dashboard.md b/content/includes/config-snippets/enable-nplus-api-dashboard.md
new file mode 100644
index 000000000..0aaf4b750
--- /dev/null
+++ b/content/includes/config-snippets/enable-nplus-api-dashboard.md
@@ -0,0 +1,37 @@
+---
+docs:
+files:
+- content/nginx-one/workshops/lab5/upgrade-nginx-plus-to-latest-version.md
+- content/includes/use-cases/monitoring/enable-nginx-plus-api.md
+---
+
+```nginx
+# This block enables the NGINX Plus API and dashboard
+# For configuration and security recommendations, see:
+# https://docs.nginx.com/nginx/admin-guide/monitoring/live-activity-monitoring/#configuring-the-api
+server {
+    # Change the listen port if 9000 conflicts
+    # (8080 is the conventional API port)
+    listen 9000;
+
+    location /api/ {
+        # To restrict write methods (POST, PATCH, DELETE), uncomment:
+        # limit_except GET {
+        #     auth_basic "NGINX Plus API";
+        #     auth_basic_user_file /path/to/passwd/file;
+        # }
+
+        # Enable API in write mode
+        api write=on;
+
+        # To restrict access by network, uncomment and set your network:
+        # allow 192.0.2.0/24   # replace with your network
+        # deny  all;
+    }
+
+    # Serve the built-in dashboard at /dashboard.html
+    location = /dashboard.html {
+        root /usr/share/nginx/html;
+    }
+}
+```
\ No newline at end of file
diff --git a/content/includes/use-cases/monitoring/enable-nginx-plus-api.md b/content/includes/use-cases/monitoring/enable-nginx-plus-api.md
index c605d0c22..50fbd5be7 100644
--- a/content/includes/use-cases/monitoring/enable-nginx-plus-api.md
+++ b/content/includes/use-cases/monitoring/enable-nginx-plus-api.md
@@ -4,61 +4,15 @@ files:
   - content/nim/monitoring/overview-metrics.md
   - content/nginx-one/getting-started.md
 ---
-<!-- include in content/nginx-one/getting-started.md disabled, hopefully temporarily -->
-To collect comprehensive metrics for NGINX Plus -- including bytes streamed, information about upstream systems and caches, and counts of all HTTP status codes -- add the following to your NGINX Plus configuration file (for example, `/etc/nginx/nginx.conf` or an included file):
 
-```nginx
-# This block:
-# - Enables the read-write NGINX Plus API under /api/
-# - Serves the built-in dashboard at /dashboard.html
-# - Restricts write methods (POST, PATCH, DELETE) to authenticated users
-#   and a specified IP range
-# Change the listen port if 9000 conflicts; 8080 is the conventional API port.
-server {
-    # Listen on port 9000 for API and dashboard traffic
-    listen 9000 default_server;
+To collect comprehensive metrics for NGINX Plus, including bytes streamed, information about upstream systems and caches, and counts of all HTTP status codes, add the following to your NGINX Plus configuration file, for example `/etc/nginx/nginx.conf` or an included file:
 
-    # Handle API calls under /api/
-    location /api/ {
-        # Enable write operations (POST, PATCH, DELETE)
-        api write=on;
+{{< include "config-snippets/enable-nplus-api-dashboard.md" >}}
 
-        # Allow GET requests from any IP
-        allow 0.0.0.0/0;
-        # Deny all other requests by default
-        deny all;
+{{< call-out "note" "Security tip" >}}
+- By default, all clients can call the API.  
+- To limit who can access the API, uncomment the `allow` and `deny` lines under `api write=on` and replace the example CIDR with your trusted network.  
+- To restrict write methods (`POST`, `PATCH`, `DELETE`), uncomment and configure the `limit_except GET` block and set up [HTTP basic authentication](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html).  
+{{</ call-out >}}
 
-        # For methods other than GET, require auth and restrict to a network
-        limit_except GET {
-            # Prompt for credentials with this realm
-            auth_basic "NGINX Plus API";
-            # Path to the file with usernames and passwords
-            auth_basic_user_file /path/to/passwd/file;
-
-            # Allow only this IP range (replace with your own)
-            allow 192.0.2.0/24;
-            # Deny all other IPs
-            deny all;
-        }
-    }
-
-    # Serve the dashboard page at /dashboard.html
-    location = /dashboard.html {
-        # Files are located under this directory
-        root /usr/share/nginx/html;
-    }
-
-    # Redirect any request for / to the dashboard
-    location / {
-        return 301 /dashboard.html;
-    }
-}
-```
-
-For more details, see the [NGINX Plus API module documentation](https://nginx.org/en/docs/http/ngx_http_api_module.html) and [Configuring the NGINX Plus API]({{< ref "nginx/admin-guide/monitoring/live-activity-monitoring.md#configuring-the-api" >}}).
-
-After saving the changes, reload NGINX:
-
-```shell
-nginx -s reload
-```
+For more details, see the [NGINX Plus API module](https://nginx.org/en/docs/http/ngx_http_api_module.html) documentation and [Configuring the NGINX Plus API]({{< ref "/nginx/admin-guide/monitoring/live-activity-monitoring.md#configuring-the-api" >}}).
\ No newline at end of file

From c0725bf4765081a0da6e245f47a637b2746454f0 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 25 Jun 2025 14:47:28 -0700
Subject: [PATCH 054/117] Corrected links on N1 landing page (#743)

fix: Corrected links on N1 landing page
---
 content/nginx-one/_index.md          | 49 ++++++++++++++--------------
 layouts/partials/changelog-date.html |  2 +-
 2 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index f2c954904..b4a54d3e8 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -8,40 +8,41 @@ cascade:
 nd-content-type: landing-page
 nd-product: NGINX One
 ---
-{{< card-layout >}}
-  {{< card-section >}}
-    {{< card title="Manage your NGINX fleet" >}}
+{{<card-layout>}}
+  {{<card-section>}}
+    {{<card title="Manage your NGINX fleet" titleUrl="about/" >}}
       Simplify, scale, secure, and collaborate with your NGINX fleet 
-    {{</ card >}}
-    {{< card title="Get started" >}}
+    {{</card >}}
+    {{<card title="Get started" titleUrl="getting-started/">}}
       See benefits from the NGINX One Console
-    {{</ card >}}
-    {{< card title="Connect your instances" >}}
+    {{</card >}}
+    {{<card title="Connect your instances" titleUrl="connect-instances/" >}}
       Work with data plane keys, containers, and proxy servers
-    {{</ card >}}
-    {{< card title="Manage your NGINX instances" >}}
+    {{</card >}}
+    {{<card title="Manage your NGINX instances" titleUrl="nginx-configs/">}}
       Monitor and maintain your deployments
-    {{</ card >}}
-    {{< card title="Draft new configurations" >}}
+    {{</card >}}
+    {{<card title="Draft new configurations" titleUrl="staged-configs">}}
       Work with Staged Configurations
     {{</ card >}}
-    {{< card title="Set up metrics" >}}
+    {{<card title="Set up metrics" titleUrl="metrics/">}}
       Review your deployments in a dashboard 
-    {{</ card >}}
-    {{< card title="Organize users with RBAC" >}}
+    {{</card >}}
+    {{<card title="Organize users with RBAC" titleUrl="rbac/">}}
       Assign responsibilities with role-based access control 
-    {{</ card >}}
-    {{< card title="Automate with the NGINX One API" >}}
+    {{</card >}}
+    {{<card title="Automate with the NGINX One API" titleUrl="api/">}}
       Manage your NGINX fleet over REST 
-    {{</ card >}}
-    {{< card title="Glossary" >}}
+    {{</card >}}
+    {{<card title="Glossary" titleUrl="glossary/">}}
       Learn terms unique to NGINX One Console 
-    {{</ card >}}
-    {{< card title="Changelog" >}}{{< changelog-dates >}}
-    {{</ card >}}
-  {{</ card-section >}}
+    {{</card >}}
+    {{<card title="Changelog" titleUrl="changelog/" >}}{{< changelog-dates >}}{{</card >}}
+  {{</card-section >}}
+{{</card-layout >}}
 
-  # Other Components 
+# Other Components
+{{<card-layout>}}
   {{< card-section title="Kubernetes Solutions">}}
     {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" brandIcon="NGINX-Ingress-Controller-product-icon">}}
       Kubernetes traffic management with API gateway, identity, and observability features. 
@@ -71,4 +72,4 @@ nd-product: NGINX One
       Defend, adapt, and mitigate against Layer 7 denial-of-service attacks on your apps and APIs. 
     {{</ card >}}
   {{</ card-section >}}
-{{</ card-layout >}}
\ No newline at end of file
+{{</card-layout>}}
\ No newline at end of file
diff --git a/layouts/partials/changelog-date.html b/layouts/partials/changelog-date.html
index efe487b51..68c64d62f 100644
--- a/layouts/partials/changelog-date.html
+++ b/layouts/partials/changelog-date.html
@@ -1,7 +1,7 @@
 {{ $changelogContent := readFile "content/nginx-one/changelog.md" }}
 {{ $maxNumLogs := 3 }}
 {{ $headings := first $maxNumLogs (findRE `(?m)^##\s(.+)$` $changelogContent) }}
-<ul style="padding-top: 10px;">
+<ul>
   {{ range $headings }}
   {{ $title := replaceRE "^##\\s" "" . }}
   <li><a href="{{ absURL "nginx-one/changelog/" }}#{{urlize $title}}">{{ $title }}</a></li>

From 7efdd3b3f821f7ff2214e4e3a01bb16742522091 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Thu, 26 Jun 2025 01:19:09 -0700
Subject: [PATCH 055/117] Resolved n1 landing page links (#744)

fix: Resolved n1 landing page links
---
 content/nginx-one/_index.md | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index b4a54d3e8..85e0d0596 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -10,34 +10,34 @@ nd-product: NGINX One
 ---
 {{<card-layout>}}
   {{<card-section>}}
-    {{<card title="Manage your NGINX fleet" titleUrl="about/" >}}
+    {{<card title="Manage your NGINX fleet" titleUrl="/nginx-one/about/" >}}
       Simplify, scale, secure, and collaborate with your NGINX fleet 
     {{</card >}}
-    {{<card title="Get started" titleUrl="getting-started/">}}
+    {{<card title="Get started" titleUrl="/nginx-one/getting-started/">}}
       See benefits from the NGINX One Console
     {{</card >}}
-    {{<card title="Connect your instances" titleUrl="connect-instances/" >}}
+    {{<card title="Connect your instances" titleUrl="/nginx-one/connect-instances/" >}}
       Work with data plane keys, containers, and proxy servers
     {{</card >}}
-    {{<card title="Manage your NGINX instances" titleUrl="nginx-configs/">}}
+    {{<card title="Manage your NGINX instances" titleUrl="/nginx-one/nginx-configs/">}}
       Monitor and maintain your deployments
     {{</card >}}
-    {{<card title="Draft new configurations" titleUrl="staged-configs">}}
+    {{<card title="Draft new configurations" titleUrl="/nginx-one/staged-configs">}}
       Work with Staged Configurations
     {{</ card >}}
-    {{<card title="Set up metrics" titleUrl="metrics/">}}
+    {{<card title="Set up metrics" titleUrl="/nginx-one/metrics/">}}
       Review your deployments in a dashboard 
     {{</card >}}
-    {{<card title="Organize users with RBAC" titleUrl="rbac/">}}
+    {{<card title="Organize users with RBAC" titleUrl="/nginx-one/rbac/">}}
       Assign responsibilities with role-based access control 
     {{</card >}}
-    {{<card title="Automate with the NGINX One API" titleUrl="api/">}}
+    {{<card title="Automate with the NGINX One API" titleUrl="/nginx-one/api/">}}
       Manage your NGINX fleet over REST 
     {{</card >}}
-    {{<card title="Glossary" titleUrl="glossary/">}}
+    {{<card title="Glossary" titleUrl="/nginx-one/glossary/">}}
       Learn terms unique to NGINX One Console 
     {{</card >}}
-    {{<card title="Changelog" titleUrl="changelog/" >}}{{< changelog-dates >}}{{</card >}}
+    {{<card title="Changelog" titleUrl="/nginx-one/changelog/" >}}{{< changelog-dates >}}{{</card >}}
   {{</card-section >}}
 {{</card-layout >}}
 

From 89baa4fc4549536ba676b290580a59a189536f63 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Thu, 26 Jun 2025 11:22:36 +0100
Subject: [PATCH 056/117] docs: add nim to Agent v3 notice (#745)

---
 _banners/agent-v3-release.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/_banners/agent-v3-release.md b/_banners/agent-v3-release.md
index c82d87a10..9c42a7e6a 100644
--- a/_banners/agent-v3-release.md
+++ b/_banners/agent-v3-release.md
@@ -1,7 +1,7 @@
 {{< banner "notice" "NGINX Agent 3.0 is now available" >}}
 
 
-F5 NGINX One Console does not currently support Agent 3.x. If you are using NGINX One Console in your environment, upgrade to the latest Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
+F5 NGINX One Console and NGINX Instance Manager (NIM) do not currently support Agent 3.x. If you are using NGINX One Console or NGINX Instance Manager in your environment, upgrade to the latest Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
 
 Please see the [Technical specifications](/nginx-agent/technical-specifications/) for product compatibility.
 

From c6a4ac419900ecf099c591c83febb08afbf68f67 Mon Sep 17 00:00:00 2001
From: Chetan Jain <46200286+Chetan-99@users.noreply.github.com>
Date: Thu, 26 Jun 2025 16:00:39 +0530
Subject: [PATCH 057/117] fix: cleanup of nim charts + minor fixes (#737)

* fix: cleanup of nim charts + minor fixes

* fix: Update nms-chart-supported-module-versions.md

* Update content/includes/nim/kubernetes/access-webui-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

---------

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>
---
 .../nim/kubernetes/access-webui-helm.md       |  4 ++--
 .../nms-chart-supported-module-versions.md    | 19 -------------------
 .../deploy/kubernetes/deploy-using-helm.md    |  4 ----
 3 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/content/includes/nim/kubernetes/access-webui-helm.md b/content/includes/nim/kubernetes/access-webui-helm.md
index f64a81072..90c02e86c 100644
--- a/content/includes/nim/kubernetes/access-webui-helm.md
+++ b/content/includes/nim/kubernetes/access-webui-helm.md
@@ -7,10 +7,10 @@ You can access the NGINX Instance Manager web interface using the external IP ad
 1. To look up the external IP address for the API Gateway, run the following command:
 
    ```bash
-   kubectl -n nms get svc apigw
+   kubectl -n nim get svc apigw
    ```
 
-   This `kubectl` command retrieves the service named `apigw` from the namespace `nms`. It outputs the details of the service, such as its type, port, cluster and external IP addresses.
+   This `kubectl` command shows details for the `apigw` service in the `nim` namespace. You’ll see the service type, port, cluster IP, and external IP addresses.
 
    The default service type is `ClusterIP` and the output looks similar to the following example:
 
diff --git a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
index a23ff1c6e..238bc2f31 100644
--- a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
+++ b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
@@ -20,24 +20,5 @@ docs: DOCS-1324
 | 1.10.1                       | ngnx-stable/nms            | 2.13.1           |
 | 1.10.0                       | ngnx-stable/nms            | 2.13.1           |
 | 1.9.0                        | ngnx-stable/nms            | 2.13.0           |
-| 1.8.2                        | ngnx-stable/nms            | 2.12.0           |
-| 1.8.1                        | ngnx-stable/nms            | 2.12.0           |
-| 1.8.0                        | ngnx-stable/nms            | 2.12.0           |
-| 1.7.2                        | ngnx-stable/nms            | 2.11.0           |
-| 1.7.1                        | ngnx-stable/nms            | 2.11.0           |
-| 1.7.0                        | ngnx-stable/nms            | 2.11.0           |
-| 1.6.0                        | ngnx-stable/nms            | 2.10.1           |
-| 1.5.2                        | ngnx-stable/nms            | 2.10.0           |
-| 1.5.1                        | ngnx-stable/nms            | 2.10.0           |
-| 1.5.0                        | ngnx-stable/nms            | 2.10.0           |
-| 1.4.0                        | ngnx-stable/nms            | 2.9.1            |
-| 1.3.1                        | ngnx-stable/nms            | 2.9.0            |
-| 1.3.0                        | ngnx-stable/nms            | 2.9.0            |
-| 1.2.1                        | ngnx-stable/nms            | 2.8.0            |
-| 1.2.0                        | ngnx-stable/nms            | 2.8.0            |
-| 1.1.2                        | ngnx-stable/nms            | 2.7.0            |
-| 1.1.1                        | ngnx-stable/nms            | 2.7.0            |
-| 1.1.0                        | ngnx-stable/nms            | 2.7.0            |
-| 1.0.0                        | ngnx-stable/nms            | 2.6.0            |
 
 {{</bootstrap-table>}}
diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md
index 897d35e9a..dab74919c 100644
--- a/content/nim/deploy/kubernetes/deploy-using-helm.md
+++ b/content/nim/deploy/kubernetes/deploy-using-helm.md
@@ -29,10 +29,6 @@ Make sure to update your chart references if you’re using version 2.20.0 or la
 
 To deploy NGINX Instance Manager using a Helm chart, you need:
 
-## Requirements
-
-To deploy NGINX Instance Manager using a Helm chart, you need:
-
 {{< bootstrap-table "table table-striped table-bordered" >}}
 | Requirements                                 | Notes                                                                                                                                                                                                                  |
 |----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

From 3220fb7d4cc631fca7b4cda347ef5586f42d363c Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Thu, 26 Jun 2025 19:11:21 +0100
Subject: [PATCH 058/117] docs: add NGINX Unit to the catalog (#712)

docs: add unit to the catalog
---
 content/nim/deploy/vm-bare-metal/install.md           | 7 +++----
 content/unit/about.md                                 | 1 +
 content/unit/certificates.md                          | 1 +
 content/unit/changes.md                               | 1 +
 content/unit/community.md                             | 1 +
 content/unit/configuration.md                         | 1 +
 content/unit/controlapi.md                            | 1 +
 content/unit/howto/ansible.md                         | 1 +
 content/unit/howto/apps/apollo.md                     | 1 +
 content/unit/howto/apps/bugzilla.md                   | 1 +
 content/unit/howto/apps/datasette.md                  | 1 +
 content/unit/howto/apps/dokuwiki.md                   | 1 +
 content/unit/howto/apps/drupal.md                     | 1 +
 content/unit/howto/apps/grafana.md                    | 1 +
 content/unit/howto/apps/jira.md                       | 1 +
 content/unit/howto/apps/joomla.md                     | 1 +
 content/unit/howto/apps/mailman.md                    | 1 +
 content/unit/howto/apps/matomo.md                     | 1 +
 content/unit/howto/apps/mediawiki.md                  | 1 +
 content/unit/howto/apps/mercurial.md                  | 1 +
 content/unit/howto/apps/modx.md                       | 1 +
 content/unit/howto/apps/moin.md                       | 1 +
 content/unit/howto/apps/nextcloud.md                  | 1 +
 content/unit/howto/apps/opengrok.md                   | 1 +
 content/unit/howto/apps/phpbb.md                      | 1 +
 content/unit/howto/apps/phpmyadmin.md                 | 1 +
 content/unit/howto/apps/plone.md                      | 1 +
 content/unit/howto/apps/redmine.md                    | 1 +
 content/unit/howto/apps/reviewboard.md                | 1 +
 content/unit/howto/apps/roundcube.md                  | 1 +
 content/unit/howto/apps/trac.md                       | 1 +
 content/unit/howto/apps/wordpress.md                  | 1 +
 content/unit/howto/certbot.md                         | 1 +
 content/unit/howto/docker.md                          | 1 +
 content/unit/howto/frameworks/bottle.md               | 1 +
 content/unit/howto/frameworks/cakephp.md              | 1 +
 content/unit/howto/frameworks/catalyst.md             | 1 +
 content/unit/howto/frameworks/codeigniter.md          | 1 +
 content/unit/howto/frameworks/django.md               | 1 +
 content/unit/howto/frameworks/djangochannels.md       | 1 +
 content/unit/howto/frameworks/express.md              | 1 +
 content/unit/howto/frameworks/falcon.md               | 1 +
 content/unit/howto/frameworks/fastapi.md              | 1 +
 content/unit/howto/frameworks/flask.md                | 1 +
 content/unit/howto/frameworks/guillotina.md           | 1 +
 content/unit/howto/frameworks/koa.md                  | 1 +
 content/unit/howto/frameworks/laravel.md              | 1 +
 content/unit/howto/frameworks/lumen.md                | 1 +
 content/unit/howto/frameworks/pyramid.md              | 1 +
 content/unit/howto/frameworks/quart.md                | 1 +
 content/unit/howto/frameworks/rails.md                | 1 +
 content/unit/howto/frameworks/responder.md            | 1 +
 content/unit/howto/frameworks/sanic.md                | 1 +
 content/unit/howto/frameworks/springboot.md           | 1 +
 content/unit/howto/frameworks/starlette.md            | 1 +
 content/unit/howto/frameworks/symfony.md              | 1 +
 content/unit/howto/frameworks/yii.md                  | 1 +
 content/unit/howto/frameworks/zope.md                 | 1 +
 content/unit/howto/integration.md                     | 1 +
 content/unit/howto/modules.md                         | 1 +
 content/unit/howto/overview.md                        | 1 +
 content/unit/howto/samples.md                         | 1 +
 content/unit/howto/security.md                        | 1 +
 content/unit/howto/source.md                          | 1 +
 content/unit/howto/walkthrough.md                     | 1 +
 content/unit/installation.md                          | 1 +
 content/unit/keyfeatures.md                           | 1 +
 content/unit/news/2023/unit-1.30.0-released.md        | 1 +
 content/unit/news/2023/unit-1.31.0-released.md        | 1 +
 content/unit/news/2023/unit-1.31.1-released.md        | 1 +
 content/unit/news/2024/fermyon-spin-rust-sdk.md       | 3 ++-
 content/unit/news/2024/unit-1.32.0-released.md        | 1 +
 content/unit/news/2024/unit-1.32.1-released.md        | 1 +
 content/unit/news/2024/unit-1.33.0-released.md        | 1 +
 content/unit/news/2024/unit-1.34.0-released.md        | 1 +
 content/unit/news/2024/wasm-component-model-part-1.md | 1 +
 content/unit/news/2024/wasm-component-model-part-2.md | 1 +
 content/unit/news/2025/unit-1.34.1-released.md        | 1 +
 content/unit/news/2025/unit-1.34.2-released.md        | 1 +
 content/unit/news/archived-news/2018.md               | 1 +
 content/unit/news/archived-news/2019.md               | 3 ++-
 content/unit/news/archived-news/2020.md               | 1 +
 content/unit/news/archived-news/2021.md               | 1 +
 content/unit/news/archived-news/2022.md               | 1 +
 content/unit/scripting.md                             | 1 +
 content/unit/statusapi.md                             | 1 +
 content/unit/troubleshooting.md                       | 1 +
 content/unit/unitctl.md                               | 1 +
 88 files changed, 92 insertions(+), 6 deletions(-)

diff --git a/content/nim/deploy/vm-bare-metal/install.md b/content/nim/deploy/vm-bare-metal/install.md
index c6afac65d..af1cae1ab 100644
--- a/content/nim/deploy/vm-bare-metal/install.md
+++ b/content/nim/deploy/vm-bare-metal/install.md
@@ -1,6 +1,5 @@
 ---
 description: ''
-docs: DOCS-1211
 title: Install the latest NGINX Instance Manager with a script
 toc: true
 weight: 10
@@ -42,7 +41,7 @@ Follow these steps to prepare for installing NGINX Instance Manager:
 
 - **Check for previous deployments**:
   Ensure that NGINX Instance Manager and its components are not already installed.
-  
+
   If NGINX Instance Manager or its components (such as ClickHouse or NGINX) are detected, either follow the [upgrade instructions](#upgrade-nim) to update them or [manually remove the components](#uninstall-nim) before proceeding with the installation.
 
 - **(Optional) Install and configure Vault**:
@@ -122,7 +121,7 @@ If the script fails or if you prefer more control over the process, consider usi
 
 ### Run the installation script
 
-The `install-nim-bundle.sh` script automates installing NGINX Instance Manager. 
+The `install-nim-bundle.sh` script automates installing NGINX Instance Manager.
 
 By default, the script:
 
@@ -170,7 +169,7 @@ sudo bash install-nim-bundle.sh \
 
 <br>
 
-After installing NGINX Instance Manager and related packages, the script generates an admin password. This may take a few minutes to appear: 
+After installing NGINX Instance Manager and related packages, the script generates an admin password. This may take a few minutes to appear:
 
 ```bash
 Regenerated Admin password: <encrypted password>
diff --git a/content/unit/about.md b/content/unit/about.md
index c7a540cc4..06d5c17aa 100644
--- a/content/unit/about.md
+++ b/content/unit/about.md
@@ -2,6 +2,7 @@
 title: About NGINX Unit
 weight: 100
 toc: true
+docs: DOCS-1694
 ---
 
 # Universal web app server
diff --git a/content/unit/certificates.md b/content/unit/certificates.md
index 4861ca946..8d78c3209 100644
--- a/content/unit/certificates.md
+++ b/content/unit/certificates.md
@@ -2,6 +2,7 @@
 title: SSL/TLS certificates
 weight: 800
 toc: true
+docs: DOCS-1698
 ---
 
 The **/certificates** section of the [control API]({{< relref "/unit/controlapi.md" >}})
diff --git a/content/unit/changes.md b/content/unit/changes.md
index 87f369799..5ace5255d 100644
--- a/content/unit/changes.md
+++ b/content/unit/changes.md
@@ -2,6 +2,7 @@
 title: Changelog
 weight: 90000
 toc: true
+docs: DOCS-1695
 ---
 
 ```text
diff --git a/content/unit/community.md b/content/unit/community.md
index 0244eeb79..3c3b3e256 100644
--- a/content/unit/community.md
+++ b/content/unit/community.md
@@ -2,6 +2,7 @@
 title: Community
 weight: 1200
 toc: true
+docs: DOCS-1701
 ---
 
 <a name="community"></a>
diff --git a/content/unit/configuration.md b/content/unit/configuration.md
index a94af0aa4..1281aeea0 100644
--- a/content/unit/configuration.md
+++ b/content/unit/configuration.md
@@ -2,6 +2,7 @@
 title: Configuration
 weight: 600
 toc: true
+docs: DOCS-1700
 ---
 
 {{<note>}}
diff --git a/content/unit/controlapi.md b/content/unit/controlapi.md
index a8c57aab2..cea7c263c 100644
--- a/content/unit/controlapi.md
+++ b/content/unit/controlapi.md
@@ -2,6 +2,7 @@
 title: Control API
 weight: 500
 toc: true
+docs: DOCS-1693
 ---
 
 Unit's configuration is JSON-based, accessible via a RESTful control API,
diff --git a/content/unit/howto/ansible.md b/content/unit/howto/ansible.md
index b891e3235..0071973c1 100644
--- a/content/unit/howto/ansible.md
+++ b/content/unit/howto/ansible.md
@@ -2,6 +2,7 @@
 title: Unit in Ansible
 weight: 400
 toc: true
+docs: DOCS-1708
 ---
 
 The [Ansible collection](https://galaxy.ansible.com/steampunk/unit) by [XLAB
diff --git a/content/unit/howto/apps/apollo.md b/content/unit/howto/apps/apollo.md
index 5f0c7c992..0365f5e7b 100644
--- a/content/unit/howto/apps/apollo.md
+++ b/content/unit/howto/apps/apollo.md
@@ -2,6 +2,7 @@
 title: Apollo
 weight: 100
 toc: true
+docs: DOCS-1730
 ---
 
 To run the [Apollo](https://www.apollographql.com) GraphQL server
diff --git a/content/unit/howto/apps/bugzilla.md b/content/unit/howto/apps/bugzilla.md
index 4947be823..43172fc11 100644
--- a/content/unit/howto/apps/bugzilla.md
+++ b/content/unit/howto/apps/bugzilla.md
@@ -2,6 +2,7 @@
 title: Bugzilla
 weight: 200
 toc: true
+docs: DOCS-1779
 ---
 
 To run the [Bugzilla](https://www.bugzilla.org) bug tracking system using
diff --git a/content/unit/howto/apps/datasette.md b/content/unit/howto/apps/datasette.md
index 55782d2b2..b6fab14a2 100644
--- a/content/unit/howto/apps/datasette.md
+++ b/content/unit/howto/apps/datasette.md
@@ -2,6 +2,7 @@
 title: Datasette
 weight: 300
 toc: true
+docs: DOCS-1718
 ---
 
 To run the [Datasette](https://docs.datasette.io/en/stable/) data exploration tool using Unit:
diff --git a/content/unit/howto/apps/dokuwiki.md b/content/unit/howto/apps/dokuwiki.md
index 56ee87b6f..3d82b1716 100644
--- a/content/unit/howto/apps/dokuwiki.md
+++ b/content/unit/howto/apps/dokuwiki.md
@@ -2,6 +2,7 @@
 title: DokuWiki
 toc: true
 weight: 400
+docs: DOCS-1716
 ---
 
 To run the [DokuWiki](https://www.dokuwiki.org) content management system
diff --git a/content/unit/howto/apps/drupal.md b/content/unit/howto/apps/drupal.md
index ce917466f..b84a68f1d 100644
--- a/content/unit/howto/apps/drupal.md
+++ b/content/unit/howto/apps/drupal.md
@@ -2,6 +2,7 @@
 title: Drupal
 weight: 500
 toc: true
+docs: DOCS-1719
 ---
 
 To run the [Drupal](https://www.drupal.org) content management system using
diff --git a/content/unit/howto/apps/grafana.md b/content/unit/howto/apps/grafana.md
index 3a4b47952..22848b516 100644
--- a/content/unit/howto/apps/grafana.md
+++ b/content/unit/howto/apps/grafana.md
@@ -2,6 +2,7 @@
 title: Grafana
 toc: true
 weight: 600
+docs: DOCS-1715
 ---
 
 Here, we install Grafana from [sources](https://github.com/grafana/grafana/blob/main/contribute/developer-guide.md)
diff --git a/content/unit/howto/apps/jira.md b/content/unit/howto/apps/jira.md
index ad99fcd81..181a54270 100644
--- a/content/unit/howto/apps/jira.md
+++ b/content/unit/howto/apps/jira.md
@@ -2,6 +2,7 @@
 title: Jira
 toc: true
 weight: 700
+docs: DOCS-1725
 ---
 
 {{< note >}}
diff --git a/content/unit/howto/apps/joomla.md b/content/unit/howto/apps/joomla.md
index b451bef40..8e0859c06 100644
--- a/content/unit/howto/apps/joomla.md
+++ b/content/unit/howto/apps/joomla.md
@@ -2,6 +2,7 @@
 title: Joomla
 toc: true
 weight: 800
+docs: DOCS-1734
 ---
 
 To run the [Joomla](https://www.joomla.org) content management system using
diff --git a/content/unit/howto/apps/mailman.md b/content/unit/howto/apps/mailman.md
index 4893d59dc..37911f768 100644
--- a/content/unit/howto/apps/mailman.md
+++ b/content/unit/howto/apps/mailman.md
@@ -2,6 +2,7 @@
 title: Mailman Web
 toc: true
 weight: 800
+docs: DOCS-1721
 ---
 
 To install and run the web UI for the [Mailman 3](https://docs.list.org/en/latest/index.html) suite using Unit:
diff --git a/content/unit/howto/apps/matomo.md b/content/unit/howto/apps/matomo.md
index f518866f9..2cdcd95d1 100644
--- a/content/unit/howto/apps/matomo.md
+++ b/content/unit/howto/apps/matomo.md
@@ -2,6 +2,7 @@
 title: Matomo
 toc: true
 weight: 900
+docs: DOCS-1722
 ---
 
 To run the [Matomo](https://matomo.org) web analytics platform using Unit:
diff --git a/content/unit/howto/apps/mediawiki.md b/content/unit/howto/apps/mediawiki.md
index c8a8261da..42c94d7fd 100644
--- a/content/unit/howto/apps/mediawiki.md
+++ b/content/unit/howto/apps/mediawiki.md
@@ -2,6 +2,7 @@
 title: MediaWiki
 weight: 1000
 toc: true
+docs: DOCS-1720
 ---
 
 To run the [MediaWiki](https://www.mediawiki.org) collaboration and
diff --git a/content/unit/howto/apps/mercurial.md b/content/unit/howto/apps/mercurial.md
index 3dc69c8e4..a6570d0a8 100644
--- a/content/unit/howto/apps/mercurial.md
+++ b/content/unit/howto/apps/mercurial.md
@@ -2,6 +2,7 @@
 title: Mercurial
 weight: 1100
 toc: true
+docs: DOCS-1728
 ---
 
 To install and run the [Mercurial](https://www.mercurial-scm.org) source
diff --git a/content/unit/howto/apps/modx.md b/content/unit/howto/apps/modx.md
index cf2b9635b..071ae0f84 100644
--- a/content/unit/howto/apps/modx.md
+++ b/content/unit/howto/apps/modx.md
@@ -2,6 +2,7 @@
 title: MODX
 weight: 1200
 toc: true
+docs: DOCS-1726
 ---
 
 To run the [MODX](https://modx.com) content application platform using Unit:
diff --git a/content/unit/howto/apps/moin.md b/content/unit/howto/apps/moin.md
index f062b6edc..4408cde21 100644
--- a/content/unit/howto/apps/moin.md
+++ b/content/unit/howto/apps/moin.md
@@ -2,6 +2,7 @@
 title: MoinMoin
 toc: true
 weight: 1300
+docs: DOCS-1732
 ---
 
 {{< warning >}}
diff --git a/content/unit/howto/apps/nextcloud.md b/content/unit/howto/apps/nextcloud.md
index a1877a943..699399901 100644
--- a/content/unit/howto/apps/nextcloud.md
+++ b/content/unit/howto/apps/nextcloud.md
@@ -2,6 +2,7 @@
 title: NextCloud
 weight: 1400
 toc: true
+docs: DOCS-1724
 ---
 
 To run the [NextCloud](https://nextcloud.com) share and collaboration
diff --git a/content/unit/howto/apps/opengrok.md b/content/unit/howto/apps/opengrok.md
index 08e2c716f..6d641c3d2 100644
--- a/content/unit/howto/apps/opengrok.md
+++ b/content/unit/howto/apps/opengrok.md
@@ -2,6 +2,7 @@
 title: OpenGrok
 toc: true
 weight: 1500
+docs: DOCS-1735
 ---
 
 To run the [OpenGrok](https://github.com/oracle/opengrok) code search engine using Unit:
diff --git a/content/unit/howto/apps/phpbb.md b/content/unit/howto/apps/phpbb.md
index 52ac1dbc6..d61673705 100644
--- a/content/unit/howto/apps/phpbb.md
+++ b/content/unit/howto/apps/phpbb.md
@@ -2,6 +2,7 @@
 title: phpBB
 toc: true
 weight: 1600
+docs: DOCS-1723
 ---
 
 To run the [phpBB](https://www.phpbb.com) bulletin board using Unit:
diff --git a/content/unit/howto/apps/phpmyadmin.md b/content/unit/howto/apps/phpmyadmin.md
index bf6aedffb..5cac022cb 100644
--- a/content/unit/howto/apps/phpmyadmin.md
+++ b/content/unit/howto/apps/phpmyadmin.md
@@ -2,6 +2,7 @@
 title: phpMyAdmin
 toc: true
 weight: 1700
+docs: DOCS-1736
 ---
 
 To run the [phpMyAdmin](https://www.phpmyadmin.net) web tool using Unit:
diff --git a/content/unit/howto/apps/plone.md b/content/unit/howto/apps/plone.md
index aa1db6db6..f3536db1b 100644
--- a/content/unit/howto/apps/plone.md
+++ b/content/unit/howto/apps/plone.md
@@ -2,6 +2,7 @@
 title: Plone
 toc: true
 weight: 1800
+docs: DOCS-1733
 ---
 
 To run the [Plone](https://plone.org) content management system using Unit:
diff --git a/content/unit/howto/apps/redmine.md b/content/unit/howto/apps/redmine.md
index f71945e8a..475751616 100644
--- a/content/unit/howto/apps/redmine.md
+++ b/content/unit/howto/apps/redmine.md
@@ -2,6 +2,7 @@
 title: Redmine
 toc: true
 weight: 1900
+docs: DOCS-1717
 ---
 
 To run the [Redmine](https://www.redmine.org) project management system using
diff --git a/content/unit/howto/apps/reviewboard.md b/content/unit/howto/apps/reviewboard.md
index 559d7f016..2c49f1fd2 100644
--- a/content/unit/howto/apps/reviewboard.md
+++ b/content/unit/howto/apps/reviewboard.md
@@ -2,6 +2,7 @@
 title: Review Board
 toc: true
 weight: 2000
+docs: DOCS-1727
 ---
 
 To run the [Review Board](https://www.reviewboard.org) code review tool using Unit:
diff --git a/content/unit/howto/apps/roundcube.md b/content/unit/howto/apps/roundcube.md
index 58e52c77c..61dadbdb7 100644
--- a/content/unit/howto/apps/roundcube.md
+++ b/content/unit/howto/apps/roundcube.md
@@ -2,6 +2,7 @@
 title: Roundcube
 toc: true
 weight: 2100
+docs: DOCS-1731
 ---
 
 To run the [Roundcube](https://roundcube.net) webmail platform using Unit:
diff --git a/content/unit/howto/apps/trac.md b/content/unit/howto/apps/trac.md
index 3403037be..0a9e972fa 100644
--- a/content/unit/howto/apps/trac.md
+++ b/content/unit/howto/apps/trac.md
@@ -2,6 +2,7 @@
 title: Trac
 toc: true
 weight: 2200
+docs: DOCS-1729
 ---
 
 {{< warning >}}
diff --git a/content/unit/howto/apps/wordpress.md b/content/unit/howto/apps/wordpress.md
index 8651167af..bdbd8afb9 100644
--- a/content/unit/howto/apps/wordpress.md
+++ b/content/unit/howto/apps/wordpress.md
@@ -2,6 +2,7 @@
 title: WordPress
 toc: true
 weight: 2300
+docs: DOCS-1737
 ---
 
 {{< note >}}
diff --git a/content/unit/howto/certbot.md b/content/unit/howto/certbot.md
index cf24d8444..ba115fc16 100644
--- a/content/unit/howto/certbot.md
+++ b/content/unit/howto/certbot.md
@@ -2,6 +2,7 @@
 title: TLS with Certbot
 toc: true
 weight: 600
+docs: DOCS-1706
 ---
 
 To set up
diff --git a/content/unit/howto/docker.md b/content/unit/howto/docker.md
index c19019ecc..63c42c73b 100644
--- a/content/unit/howto/docker.md
+++ b/content/unit/howto/docker.md
@@ -2,6 +2,7 @@
 title: Unit in Docker
 weight: 200
 toc: true
+docs: DOCS-1712
 ---
 
 To run your apps in a containerized Unit using the
diff --git a/content/unit/howto/frameworks/bottle.md b/content/unit/howto/frameworks/bottle.md
index 98088a2de..aac3a94db 100644
--- a/content/unit/howto/frameworks/bottle.md
+++ b/content/unit/howto/frameworks/bottle.md
@@ -2,6 +2,7 @@
 title: Bottle
 weight: 100
 toc: true
+docs: DOCS-1747
 ---
 
 To run apps built with the [Bottle](https://bottlepy.org/docs/dev/) web
diff --git a/content/unit/howto/frameworks/cakephp.md b/content/unit/howto/frameworks/cakephp.md
index af88812b3..a33159f9b 100644
--- a/content/unit/howto/frameworks/cakephp.md
+++ b/content/unit/howto/frameworks/cakephp.md
@@ -2,6 +2,7 @@
 title: CakePHP
 weight: 200
 toc: true
+docs: DOCS-1745
 ---
 
 To run apps based on the [CakePHP](https://cakephp.org) framework using Unit:
diff --git a/content/unit/howto/frameworks/catalyst.md b/content/unit/howto/frameworks/catalyst.md
index 987499b08..189a794a0 100644
--- a/content/unit/howto/frameworks/catalyst.md
+++ b/content/unit/howto/frameworks/catalyst.md
@@ -2,6 +2,7 @@
 title: Catalyst
 weight: 300
 toc: true
+docs: DOCS-1753
 ---
 
 To run apps based on the [Catalyst](https://metacpan.org/dist/Catalyst-Manual) 5.9+ framework using Unit:
diff --git a/content/unit/howto/frameworks/codeigniter.md b/content/unit/howto/frameworks/codeigniter.md
index d577522c6..e038eecf9 100644
--- a/content/unit/howto/frameworks/codeigniter.md
+++ b/content/unit/howto/frameworks/codeigniter.md
@@ -2,6 +2,7 @@
 title: CodeIgniter
 weight: 400
 toc: true
+docs: DOCS-1739
 ---
 
 To run apps built with the [CodeIgniter](https://codeigniter.com) web
diff --git a/content/unit/howto/frameworks/django.md b/content/unit/howto/frameworks/django.md
index 896abe266..d952d2834 100644
--- a/content/unit/howto/frameworks/django.md
+++ b/content/unit/howto/frameworks/django.md
@@ -2,6 +2,7 @@
 title: Django
 toc: true
 weight: 500
+docs: DOCS-1746
 ---
 
 To run apps based on the Django [framework](https://www.djangoproject.com)
diff --git a/content/unit/howto/frameworks/djangochannels.md b/content/unit/howto/frameworks/djangochannels.md
index f2566ef41..cf248af47 100644
--- a/content/unit/howto/frameworks/djangochannels.md
+++ b/content/unit/howto/frameworks/djangochannels.md
@@ -2,6 +2,7 @@
 title: Django Channels
 toc: true
 weight: 600
+docs: DOCS-1742
 ---
 
 To run Django apps using the Django Channels [framework](https://channels.readthedocs.io/en/stable/) with Unit:
diff --git a/content/unit/howto/frameworks/express.md b/content/unit/howto/frameworks/express.md
index f18ef846d..4684d2c14 100644
--- a/content/unit/howto/frameworks/express.md
+++ b/content/unit/howto/frameworks/express.md
@@ -2,6 +2,7 @@
 title: Express
 toc: true
 weight: 700
+docs: DOCS-1741
 ---
 
 To run apps built with the [Express](https://expressjs.com) web framework
diff --git a/content/unit/howto/frameworks/falcon.md b/content/unit/howto/frameworks/falcon.md
index 8ee6419b6..e96658c29 100644
--- a/content/unit/howto/frameworks/falcon.md
+++ b/content/unit/howto/frameworks/falcon.md
@@ -2,6 +2,7 @@
 title: Falcon
 weight: 800
 toc: true
+docs: DOCS-1750
 ---
 
 To run apps built with the [Falcon](https://falcon.readthedocs.io/en/stable/)
diff --git a/content/unit/howto/frameworks/fastapi.md b/content/unit/howto/frameworks/fastapi.md
index dfef6891a..85ad09384 100644
--- a/content/unit/howto/frameworks/fastapi.md
+++ b/content/unit/howto/frameworks/fastapi.md
@@ -2,6 +2,7 @@
 title: FastAPI
 toc: true
 weight: 900
+docs: DOCS-1738
 ---
 
 To run apps built with the [FastAPI](https://fastapi.tiangolo.com) web framework using Unit:
diff --git a/content/unit/howto/frameworks/flask.md b/content/unit/howto/frameworks/flask.md
index caff1b38a..e8e56bcf0 100644
--- a/content/unit/howto/frameworks/flask.md
+++ b/content/unit/howto/frameworks/flask.md
@@ -2,6 +2,7 @@
 title: Flask
 toc: true
 weight: 1000
+docs: DOCS-1761
 ---
 
 To run apps built with the [Flask](https://flask.palletsprojects.com/en/1.1.x/) web framework using Unit:
diff --git a/content/unit/howto/frameworks/guillotina.md b/content/unit/howto/frameworks/guillotina.md
index 388b6e869..93c908421 100644
--- a/content/unit/howto/frameworks/guillotina.md
+++ b/content/unit/howto/frameworks/guillotina.md
@@ -2,6 +2,7 @@
 title: Gillotina
 toc: true
 weight: 1000
+docs: DOCS-1760
 ---
 
 To run apps built with the [Guillotina](https://guillotina.readthedocs.io/en/latest/) web framework using Unit:
diff --git a/content/unit/howto/frameworks/koa.md b/content/unit/howto/frameworks/koa.md
index 04c6a5fcf..84a62df3c 100644
--- a/content/unit/howto/frameworks/koa.md
+++ b/content/unit/howto/frameworks/koa.md
@@ -2,6 +2,7 @@
 title: Koa
 weight: 1100
 toc: true
+docs: DOCS-1743
 ---
 
 To run apps built with the [Koa](https://koajs.com) web framework using Unit:
diff --git a/content/unit/howto/frameworks/laravel.md b/content/unit/howto/frameworks/laravel.md
index ff7d23e0b..23c165199 100644
--- a/content/unit/howto/frameworks/laravel.md
+++ b/content/unit/howto/frameworks/laravel.md
@@ -2,6 +2,7 @@
 title: Laravel
 weight: 1200
 toc: true
+docs: DOCS-1754
 ---
 
 To run apps based on the [Laravel](https://laravel.com) framework using Unit:
diff --git a/content/unit/howto/frameworks/lumen.md b/content/unit/howto/frameworks/lumen.md
index d17beffe1..f9fb64a45 100644
--- a/content/unit/howto/frameworks/lumen.md
+++ b/content/unit/howto/frameworks/lumen.md
@@ -2,6 +2,7 @@
 title: Lumen
 weight: 1300
 toc: true
+docs: DOCS-1751
 ---
 
 To run apps based on the [Lumen](https://lumen.laravel.com) framework using
diff --git a/content/unit/howto/frameworks/pyramid.md b/content/unit/howto/frameworks/pyramid.md
index cfda4cdaa..09370718f 100644
--- a/content/unit/howto/frameworks/pyramid.md
+++ b/content/unit/howto/frameworks/pyramid.md
@@ -2,6 +2,7 @@
 title: Pyramid
 weight: 1300
 toc: true
+docs: DOCS-1757
 ---
 
 To run apps built with the [Pyramid](https://trypyramid.com) web framework
diff --git a/content/unit/howto/frameworks/quart.md b/content/unit/howto/frameworks/quart.md
index f705a7a8e..c195c49ca 100644
--- a/content/unit/howto/frameworks/quart.md
+++ b/content/unit/howto/frameworks/quart.md
@@ -2,6 +2,7 @@
 title: Quart
 weight: 1400
 toc: true
+docs: DOCS-1744
 ---
 
 
diff --git a/content/unit/howto/frameworks/rails.md b/content/unit/howto/frameworks/rails.md
index 1e7e0b32a..4527f3c1d 100644
--- a/content/unit/howto/frameworks/rails.md
+++ b/content/unit/howto/frameworks/rails.md
@@ -2,6 +2,7 @@
 title: Ruby on Rails
 weight: 1600
 toc: true
+docs: DOCS-1759
 ---
 
 To run apps based on the [Ruby on Rails](https://rubyonrails.org) framework
diff --git a/content/unit/howto/frameworks/responder.md b/content/unit/howto/frameworks/responder.md
index 9192953f9..3a5d21410 100644
--- a/content/unit/howto/frameworks/responder.md
+++ b/content/unit/howto/frameworks/responder.md
@@ -2,6 +2,7 @@
 title: Responder
 weight: 1500
 toc: true
+docs: DOCS-1740
 ---
 
 # Responder
diff --git a/content/unit/howto/frameworks/sanic.md b/content/unit/howto/frameworks/sanic.md
index a71adce94..44c1ec928 100644
--- a/content/unit/howto/frameworks/sanic.md
+++ b/content/unit/howto/frameworks/sanic.md
@@ -2,6 +2,7 @@
 title: Sanic
 weight: 1700
 toc: true
+docs: DOCS-1756
 ---
 
 To run apps built with the [Sanic](https://sanic.dev/) web framework
diff --git a/content/unit/howto/frameworks/springboot.md b/content/unit/howto/frameworks/springboot.md
index 2d8407bfd..c0b221e36 100644
--- a/content/unit/howto/frameworks/springboot.md
+++ b/content/unit/howto/frameworks/springboot.md
@@ -2,6 +2,7 @@
 title: Spring Boot
 weight: 1800
 toc: true
+docs: DOCS-1758
 ---
 
 To run apps based on the [Spring Boot](https://spring.io/projects/spring-boot) frameworks using Unit:
diff --git a/content/unit/howto/frameworks/starlette.md b/content/unit/howto/frameworks/starlette.md
index fa16f6735..ddecc242c 100644
--- a/content/unit/howto/frameworks/starlette.md
+++ b/content/unit/howto/frameworks/starlette.md
@@ -2,6 +2,7 @@
 title: Starlette
 toc: true
 weight: 1900
+docs: DOCS-1755
 ---
 
 # Starlette
diff --git a/content/unit/howto/frameworks/symfony.md b/content/unit/howto/frameworks/symfony.md
index c07b5a68e..7c6d5c342 100644
--- a/content/unit/howto/frameworks/symfony.md
+++ b/content/unit/howto/frameworks/symfony.md
@@ -2,6 +2,7 @@
 title: Symfony
 toc: true
 weight: 1900
+docs: DOCS-1749
 ---
 
 To run apps built with the [Symfony](https://symfony.com) framework using Unit:
diff --git a/content/unit/howto/frameworks/yii.md b/content/unit/howto/frameworks/yii.md
index ef92dc20d..8e5419e3c 100644
--- a/content/unit/howto/frameworks/yii.md
+++ b/content/unit/howto/frameworks/yii.md
@@ -2,6 +2,7 @@
 title: Yii
 weight: 2000
 toc: true
+docs: DOCS-1752
 ---
 
 
diff --git a/content/unit/howto/frameworks/zope.md b/content/unit/howto/frameworks/zope.md
index a02a62074..349aa5183 100644
--- a/content/unit/howto/frameworks/zope.md
+++ b/content/unit/howto/frameworks/zope.md
@@ -2,6 +2,7 @@
 title: Zope
 weight: 2100
 toc: true
+docs: DOCS-1748
 ---
 
 To run apps built with the [Zope](https://www.zope.dev/) web framework using
diff --git a/content/unit/howto/integration.md b/content/unit/howto/integration.md
index aa89d2267..7183e4d0c 100644
--- a/content/unit/howto/integration.md
+++ b/content/unit/howto/integration.md
@@ -2,6 +2,7 @@
 title: NGINX integration
 toc: true
 weight: 500
+docs: DOCS-1705
 ---
 
 Unit is a potent and versatile server in its own right. However, if you're
diff --git a/content/unit/howto/modules.md b/content/unit/howto/modules.md
index a2c61b31c..b986ca03d 100644
--- a/content/unit/howto/modules.md
+++ b/content/unit/howto/modules.md
@@ -2,6 +2,7 @@
 title: Working with language modules
 weight: 700
 toc: true
+docs: DOCS-1707
 ---
 
 Languages supported by Unit fall into these two categories:
diff --git a/content/unit/howto/overview.md b/content/unit/howto/overview.md
index fc9a92ba4..8bdda425d 100644
--- a/content/unit/howto/overview.md
+++ b/content/unit/howto/overview.md
@@ -2,6 +2,7 @@
 title: Overview
 weight: 100
 toc: true
+docs: DOCS-1709
 ---
 
 This section describes various real-life situations and issues that you may
diff --git a/content/unit/howto/samples.md b/content/unit/howto/samples.md
index 8f6c906b1..452ac6917 100644
--- a/content/unit/howto/samples.md
+++ b/content/unit/howto/samples.md
@@ -2,6 +2,7 @@
 title: App samples
 toc: true
 weight: 800
+docs: DOCS-1714
 ---
 
 
diff --git a/content/unit/howto/security.md b/content/unit/howto/security.md
index 790f5f9bd..9ba857bb0 100644
--- a/content/unit/howto/security.md
+++ b/content/unit/howto/security.md
@@ -2,6 +2,7 @@
 title: Security checklist
 weight: 800
 toc: true
+docs: DOCS-1710
 ---
 
 At its core, Unit has security as one of its top priorities; our development
diff --git a/content/unit/howto/source.md b/content/unit/howto/source.md
index 917af6855..d2c676913 100644
--- a/content/unit/howto/source.md
+++ b/content/unit/howto/source.md
@@ -2,6 +2,7 @@
 title: Building from source
 weight: 300
 toc: true
+docs: DOCS-1713
 ---
 
 After you've obtained Unit's
diff --git a/content/unit/howto/walkthrough.md b/content/unit/howto/walkthrough.md
index d39ca9358..c8b4bab24 100644
--- a/content/unit/howto/walkthrough.md
+++ b/content/unit/howto/walkthrough.md
@@ -2,6 +2,7 @@
 title: Walkthrough
 weight: 900
 toc: true
+docs: DOCS-1711
 ---
 
 OK, so you've decided to give Unit a try with your web app of choice. You may
diff --git a/content/unit/installation.md b/content/unit/installation.md
index dc973633d..bffa94997 100644
--- a/content/unit/installation.md
+++ b/content/unit/installation.md
@@ -2,6 +2,7 @@
 title: Installation
 weight: 400
 toc: true
+docs: DOCS-1697
 ---
 
 You can install NGINX Unit in four alternative ways:
diff --git a/content/unit/keyfeatures.md b/content/unit/keyfeatures.md
index 613bb327f..29d83137b 100644
--- a/content/unit/keyfeatures.md
+++ b/content/unit/keyfeatures.md
@@ -2,6 +2,7 @@
 title: Key features
 weight: 200
 toc: true
+docs: DOCS-1704
 ---
 
 From the start, our vision for Unit was versatility, speed, and reliability. Here's how we tackle these goals.
diff --git a/content/unit/news/2023/unit-1.30.0-released.md b/content/unit/news/2023/unit-1.30.0-released.md
index fcd7fae4c..3a9888013 100644
--- a/content/unit/news/2023/unit-1.30.0-released.md
+++ b/content/unit/news/2023/unit-1.30.0-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.30.0 Released
 weight: 300
+docs: DOCS-1777
 ---
 
 We are happy to announce Unit 1.30.0! This release brings a new level of
diff --git a/content/unit/news/2023/unit-1.31.0-released.md b/content/unit/news/2023/unit-1.31.0-released.md
index 2b9360d5d..b3c1aa6dd 100644
--- a/content/unit/news/2023/unit-1.31.0-released.md
+++ b/content/unit/news/2023/unit-1.31.0-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.31.0 Released
 weight: 200
+docs: DOCS-1778
 ---
 
 We are delighted to announce Unit 1.31.0, which marks a significant milestone
diff --git a/content/unit/news/2023/unit-1.31.1-released.md b/content/unit/news/2023/unit-1.31.1-released.md
index aa7476551..0c1976693 100644
--- a/content/unit/news/2023/unit-1.31.1-released.md
+++ b/content/unit/news/2023/unit-1.31.1-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.31.1 Released
 weight: 100
+docs: DOCS-1776
 ---
 
 We are delighted to announce Unit 1.31.1, a maintenance release that fixes
diff --git a/content/unit/news/2024/fermyon-spin-rust-sdk.md b/content/unit/news/2024/fermyon-spin-rust-sdk.md
index 5051b3cda..f3db56899 100644
--- a/content/unit/news/2024/fermyon-spin-rust-sdk.md
+++ b/content/unit/news/2024/fermyon-spin-rust-sdk.md
@@ -1,6 +1,7 @@
 ---
-title: "Wasm Components: Working with the Spin SDK for Rust"
+title: Wasm Components - Working with the Spin SDK for Rust
 weight: 500
+docs: DOCS-1765
 ---
 
 In our blog series [Part 1]({{< relref "/unit/news/2024/wasm-component-model-part-1.md" >}}) and [Part 2]({{< relref "/unit/news/2024/wasm-component-model-part-2.md" >}}) , we have covered the core mechanism of the WebAssembly Component Model and showcased how to create a Wasm Component using WASI 0.2 APIs and the **wasi/http:proxy** world.
diff --git a/content/unit/news/2024/unit-1.32.0-released.md b/content/unit/news/2024/unit-1.32.0-released.md
index 88e4fc752..badcef567 100644
--- a/content/unit/news/2024/unit-1.32.0-released.md
+++ b/content/unit/news/2024/unit-1.32.0-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.32.0 Released
 weight: 700
+docs: DOCS-1762
 ---
 
 Unit 1.32.0 comes with a new language module for WebAssembly that supports
diff --git a/content/unit/news/2024/unit-1.32.1-released.md b/content/unit/news/2024/unit-1.32.1-released.md
index 69dcfc261..4a014c16f 100644
--- a/content/unit/news/2024/unit-1.32.1-released.md
+++ b/content/unit/news/2024/unit-1.32.1-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.32.1 Released
 weight: 300
+docs: DOCS-1767
 ---
 
 NGINX Unit 1.32.1 is a maintenance release that fixes bugs in the new WebAssembly Language Module and in our njs implementation.
diff --git a/content/unit/news/2024/unit-1.33.0-released.md b/content/unit/news/2024/unit-1.33.0-released.md
index db840f0ba..40667b498 100644
--- a/content/unit/news/2024/unit-1.33.0-released.md
+++ b/content/unit/news/2024/unit-1.33.0-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.33.0 Released
 weight: 200
+docs: DOCS-1763
 ---
 
 We are pleased to announce the release of NGINX Unit 1.33.0. This release includes
diff --git a/content/unit/news/2024/unit-1.34.0-released.md b/content/unit/news/2024/unit-1.34.0-released.md
index 3a3e89f0c..e8ea04d08 100644
--- a/content/unit/news/2024/unit-1.34.0-released.md
+++ b/content/unit/news/2024/unit-1.34.0-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.34.0 Released
 weight: 100
+docs: DOCS-1768
 ---
 
 We are pleased to announce the release of NGINX Unit 1.34.0. This release
diff --git a/content/unit/news/2024/wasm-component-model-part-1.md b/content/unit/news/2024/wasm-component-model-part-1.md
index fde637994..0ebc92488 100644
--- a/content/unit/news/2024/wasm-component-model-part-1.md
+++ b/content/unit/news/2024/wasm-component-model-part-1.md
@@ -1,6 +1,7 @@
 ---
 title: The WebAssembly Component Model - Part 1
 weight: 500
+docs: DOCS-1764
 ---
 
 Are you interested in getting started with the WebAssembly Component Model but feel overwhelmed by the ecosystem and unsure where to begin? If so, this blog post is for you!
diff --git a/content/unit/news/2024/wasm-component-model-part-2.md b/content/unit/news/2024/wasm-component-model-part-2.md
index dda11ab81..a487c4914 100644
--- a/content/unit/news/2024/wasm-component-model-part-2.md
+++ b/content/unit/news/2024/wasm-component-model-part-2.md
@@ -1,6 +1,7 @@
 ---
 title: The WebAssembly Component Model - Part 2
 weight: 600
+docs: DOCS-1766
 ---
 
 This is Part 2 of our blog series about the Wasm Component Model, it's ecosytem and how to use Wasm Components with NGINX Unit.
diff --git a/content/unit/news/2025/unit-1.34.1-released.md b/content/unit/news/2025/unit-1.34.1-released.md
index c346111b0..476c7d6aa 100644
--- a/content/unit/news/2025/unit-1.34.1-released.md
+++ b/content/unit/news/2025/unit-1.34.1-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.34.1 Released
 weight: 1000
+docs: DOCS-1775
 ---
 
 We are pleased to announce the release of NGINX Unit 1.34.1. This is a
diff --git a/content/unit/news/2025/unit-1.34.2-released.md b/content/unit/news/2025/unit-1.34.2-released.md
index 1bcbcd90d..d298c4e39 100644
--- a/content/unit/news/2025/unit-1.34.2-released.md
+++ b/content/unit/news/2025/unit-1.34.2-released.md
@@ -1,6 +1,7 @@
 ---
 title: Unit 1.34.2 Released
 weight: 900
+docs: DOCS-1774
 ---
 
 We are pleased to announce the release of NGINX Unit 1.34.2. This is a maintenance release that fixes a couple of issues in the Java WebSocket code within the Java language module.
diff --git a/content/unit/news/archived-news/2018.md b/content/unit/news/archived-news/2018.md
index 947b16e63..01f76680e 100644
--- a/content/unit/news/archived-news/2018.md
+++ b/content/unit/news/archived-news/2018.md
@@ -2,6 +2,7 @@
 title: 2018
 weight: 500
 toc: true
+docs: DOCS-1770
 ---
 
 ## Unit 1.7 Released
diff --git a/content/unit/news/archived-news/2019.md b/content/unit/news/archived-news/2019.md
index 731f529c9..3e783f740 100644
--- a/content/unit/news/archived-news/2019.md
+++ b/content/unit/news/archived-news/2019.md
@@ -1,7 +1,8 @@
 ---
-title: "2019"
+title: 2019
 weight: 400
 toc: true
+docs: DOCS-1772
 ---
 
 ## Unit 1.14.0 Released
diff --git a/content/unit/news/archived-news/2020.md b/content/unit/news/archived-news/2020.md
index fc64c94a4..e39965671 100644
--- a/content/unit/news/archived-news/2020.md
+++ b/content/unit/news/archived-news/2020.md
@@ -2,6 +2,7 @@
 title: 2020
 weight: 300
 toc: true
+docs: DOCS-1771
 ----
 
 ## Unit 1.21.0 Released
diff --git a/content/unit/news/archived-news/2021.md b/content/unit/news/archived-news/2021.md
index 46600063d..cb16f00d5 100644
--- a/content/unit/news/archived-news/2021.md
+++ b/content/unit/news/archived-news/2021.md
@@ -2,6 +2,7 @@
 title: 2021
 weight: 200
 toc: true
+docs: DOCS-1773
 ---
 
 ## Unit 1.26.1 Released
diff --git a/content/unit/news/archived-news/2022.md b/content/unit/news/archived-news/2022.md
index f294c5891..e9541e3ac 100644
--- a/content/unit/news/archived-news/2022.md
+++ b/content/unit/news/archived-news/2022.md
@@ -2,6 +2,7 @@
 title: 2022
 weight: 100
 toc: true
+docs: DOCS-1769
 ---
 
 ## Unit 1.29.0 Released
diff --git a/content/unit/scripting.md b/content/unit/scripting.md
index ee058810c..6be0f49b3 100644
--- a/content/unit/scripting.md
+++ b/content/unit/scripting.md
@@ -2,6 +2,7 @@
 title: Scripting
 weight: 700
 toc: true
+docs: DOCS-1699
 ---
 
 NGINX Unit's [control API]({{< relref "/unit/controlapi.md" >}}) supports
diff --git a/content/unit/statusapi.md b/content/unit/statusapi.md
index ec4877474..d3b1a7cff 100644
--- a/content/unit/statusapi.md
+++ b/content/unit/statusapi.md
@@ -2,6 +2,7 @@
 title: Status API
 weight: 900
 toc: true
+docs: DOCS-1702
 ---
 
 <a name="configuration-stats"></a>
diff --git a/content/unit/troubleshooting.md b/content/unit/troubleshooting.md
index 3f185a864..4af08246b 100644
--- a/content/unit/troubleshooting.md
+++ b/content/unit/troubleshooting.md
@@ -2,6 +2,7 @@
 title: Troubleshooting
 weight: 1100
 toc: true
+docs: DOCS-1703
 ---
 
 {{< note >}}
diff --git a/content/unit/unitctl.md b/content/unit/unitctl.md
index ea4a0e73e..18a8cffdc 100644
--- a/content/unit/unitctl.md
+++ b/content/unit/unitctl.md
@@ -2,6 +2,7 @@
 title: CLI (unitctl)
 weight: 1000
 toc: true
+docs: DOCS-1696
 ---
 
 {{< note >}}

From c8cdef91927cb237ec7d8c1d45519e5c800a6a5b Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Thu, 26 Jun 2025 11:32:58 -0700
Subject: [PATCH 059/117] Bump theme version (#748)

chore: Bump theme version
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 9c3f0049a..733791f0f 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/nginxinc/docs
 
 go 1.19
 
-require github.com/nginxinc/nginx-hugo-theme v0.43.2 // indirect
+require github.com/nginxinc/nginx-hugo-theme v0.43.3 // indirect
diff --git a/go.sum b/go.sum
index 672363914..e6be901b5 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,2 @@
-github.com/nginxinc/nginx-hugo-theme v0.43.2 h1:g+5+egVI1OOsXRcDSQvWeRhihZfc7LDTnWceZWS7J/o=
-github.com/nginxinc/nginx-hugo-theme v0.43.2/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
\ No newline at end of file
+github.com/nginxinc/nginx-hugo-theme v0.43.3 h1:EpNIHtvxiqf2Xb0g9IuWvqqaF8w2i/NHDgtQzzPNPP0=
+github.com/nginxinc/nginx-hugo-theme v0.43.3/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
\ No newline at end of file

From f648d17376064e54b91d2a11d75d9f583ab3776e Mon Sep 17 00:00:00 2001
From: Jack Hickey <133868041+nginx-jack@users.noreply.github.com>
Date: Fri, 27 Jun 2025 10:22:14 +0100
Subject: [PATCH 060/117] Fix: Root urls in nic need nginx-ingress-controller
 prefix (#753)

---
 content/nic/configuration/_index.md          | 1 +
 content/nic/installation/_index.md           | 1 +
 content/nic/logging-and-monitoring/_index.md | 1 +
 content/nic/overview/_index.md               | 1 +
 content/nic/troubleshooting/_index.md        | 1 +
 5 files changed, 5 insertions(+)

diff --git a/content/nic/configuration/_index.md b/content/nic/configuration/_index.md
index 5554b2f83..2d146c07f 100644
--- a/content/nic/configuration/_index.md
+++ b/content/nic/configuration/_index.md
@@ -1,4 +1,5 @@
 ---
 title: Configuration
 weight: 1400
+url: /nginx-ingress-controller/configuration
 ---
diff --git a/content/nic/installation/_index.md b/content/nic/installation/_index.md
index 4ed49bfcb..ce047dd5a 100644
--- a/content/nic/installation/_index.md
+++ b/content/nic/installation/_index.md
@@ -2,6 +2,7 @@
 title: Installation
 description:
 weight: 400
+url: /nginx-ingress-controller/installation
 menu:
   docs:
     parent: NGINX Ingress Controller
diff --git a/content/nic/logging-and-monitoring/_index.md b/content/nic/logging-and-monitoring/_index.md
index 88551ab27..c2e745897 100644
--- a/content/nic/logging-and-monitoring/_index.md
+++ b/content/nic/logging-and-monitoring/_index.md
@@ -2,6 +2,7 @@
 title: Logging And Monitoring
 description:
 weight: 1500
+url: /nginx-ingress-controller/logging-and-monitoring
 menu:
   docs:
     parent: NGINX Ingress Controller
diff --git a/content/nic/overview/_index.md b/content/nic/overview/_index.md
index 05b03b934..7cff57e90 100644
--- a/content/nic/overview/_index.md
+++ b/content/nic/overview/_index.md
@@ -2,6 +2,7 @@
 title: Overview
 description:
 weight: 100
+url: /nginx-ingress-controller/overview
 menu:
   docs:
     parent: NGINX Ingress Controller
diff --git a/content/nic/troubleshooting/_index.md b/content/nic/troubleshooting/_index.md
index dd82dc52a..22d1244e0 100644
--- a/content/nic/troubleshooting/_index.md
+++ b/content/nic/troubleshooting/_index.md
@@ -2,6 +2,7 @@
 title: Troubleshooting
 description:
 weight: 1800
+url: /nginx-ingress-controller/troubleshooting
 menu:
   docs:
     parent: NGINX Ingress Controller

From a5bcaad3f3c13e210a20edb8a827cb8c7bcf17a1 Mon Sep 17 00:00:00 2001
From: Alex Russell <91080557+arussellf5@users.noreply.github.com>
Date: Mon, 30 Jun 2025 08:31:57 -0600
Subject: [PATCH 061/117] NGINXaaS Load Balancer for Kubernetes configuration
 update (#755)

NGINXaaS Load Balancer for Kubernetes configuration update to help users enforce TLS settings

The added guidance will ensure that users enforce a TLS connection with the dataplane API.
---
 content/nginxaas-azure/loadbalancer-kubernetes.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/content/nginxaas-azure/loadbalancer-kubernetes.md b/content/nginxaas-azure/loadbalancer-kubernetes.md
index bd845dac1..ef48fde68 100644
--- a/content/nginxaas-azure/loadbalancer-kubernetes.md
+++ b/content/nginxaas-azure/loadbalancer-kubernetes.md
@@ -150,7 +150,8 @@ Install the NLK controller using `helm install`. Be sure your kubectl context is
 ```bash
 helm install nlk oci://registry-1.docker.io/nginxcharts/nginxaas-loadbalancer-kubernetes --version 1.1.1 \
   --set "nlk.dataplaneApiKey=${keyValue}" \
-  --set "nlk.config.nginxHosts=${dataplaneAPIEndpoint}nplus"
+  --set "nlk.config.nginxHosts=${dataplaneAPIEndpoint}nplus" \
+  --set "nlk.config.tls.mode=ca-tls"
 ```
 
 ##### Install the AKS Extension using the Azure CLI
@@ -173,7 +174,8 @@ az k8s-extension create \
   --plan-publisher f5-networks \
   --release-namespace nlk \
   --config nlk.dataplaneApiKey=${keyValue} \
-  --config nlk.config.nginxHosts=${dataplaneAPIEndpoint}nplus
+  --config nlk.config.nginxHosts=${dataplaneAPIEndpoint}nplus \
+  --config nlk.config.tls.mode=ca-tls
 ```
 
 ##### Install the AKS Extension using the Azure portal
@@ -296,6 +298,7 @@ spec:
 | `nlk.config.logLevel` | How verbose should the NLK controller logs be. | Possible values are `debug`, `info`, `warn`, `error`. Default: `info`. |
 | `nlk.config.nginxHosts` | The NGINX Plus APIs to send upstream updates to. | Should be set to `{{dataplaneApiEndpoint}}nplus`.|
 | `nlk.config.serviceAnnotationMatch` | The value to match on a Service's `nginx.com/nginxaas` annotation. Useful when configuring multiple NLK controllers to update separate NGINXaaS deployemnts. | Default: `nginxaas`. |
+| `nlk.config.tls.mode` | The TLS mode to use when forming connections with the data plane API server. | Should be set to `ca-tls` to enforce TLS with the data plane API server.|
 | `nlk.dataplaneApiKey`   | The NGINXaaS data plane API key that will authorize the controller to talk to your NGINXaaS deployment.           |                                                                                         |
 
 ### Multiple AKS clusters

From 24c7cc043d92890b5607d6dc3c6aa7f8d6c3b981 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Mon, 30 Jun 2025 15:58:15 +0100
Subject: [PATCH 062/117] docs: add missing NAP-DOS docs to catalog (#761)

Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 content/nap-dos/releases/about-1.2.0.md | 2 +-
 content/nap-dos/releases/about-4.4.md   | 2 +-
 content/nap-dos/releases/about-4.5.md   | 2 +-
 content/nap-dos/releases/about-4.6.md   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/content/nap-dos/releases/about-1.2.0.md b/content/nap-dos/releases/about-1.2.0.md
index 8b147d81e..a9ed25646 100644
--- a/content/nap-dos/releases/about-1.2.0.md
+++ b/content/nap-dos/releases/about-1.2.0.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS Arbitrator 1.2.0
 toc: true
 weight: 61
-docs: DOCS-000
+docs: DOCS-1782
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS Arbitrator v1.2.0
diff --git a/content/nap-dos/releases/about-4.4.md b/content/nap-dos/releases/about-4.4.md
index d15c7b7b2..dd41bb6a9 100644
--- a/content/nap-dos/releases/about-4.4.md
+++ b/content/nap-dos/releases/about-4.4.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.4
 toc: true
 weight: 80
-docs: DOCS-1361
+docs: DOCS-1785
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.4. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-4.5.md b/content/nap-dos/releases/about-4.5.md
index ac889021e..cc9b71833 100644
--- a/content/nap-dos/releases/about-4.5.md
+++ b/content/nap-dos/releases/about-4.5.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.5
 toc: true
 weight: 70
-docs: DOCS-000
+docs: DOCS-1784
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.5  
diff --git a/content/nap-dos/releases/about-4.6.md b/content/nap-dos/releases/about-4.6.md
index c03e1e42a..3cf384d4f 100644
--- a/content/nap-dos/releases/about-4.6.md
+++ b/content/nap-dos/releases/about-4.6.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.6
 toc: true
 weight: 60
-docs: DOCS-000
+docs: DOCS-1783
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.6  

From 6eb06763c9fdef3a3868d7a0d3e21dba1086d230 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Mon, 30 Jun 2025 15:58:36 +0100
Subject: [PATCH 063/117] docs: Agent catalog audit (#760)

---
 content/agent/installation-upgrade/installation-unprivileged.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/agent/installation-upgrade/installation-unprivileged.md b/content/agent/installation-upgrade/installation-unprivileged.md
index 137bdf752..6f90985e8 100644
--- a/content/agent/installation-upgrade/installation-unprivileged.md
+++ b/content/agent/installation-upgrade/installation-unprivileged.md
@@ -4,6 +4,7 @@ weight: 450
 toc: true
 type: how-to
 product: Agent
+docs: DOCS-1781
 ---
 
 ## Overview

From 71af153bb60accc65b00c2003761aa573501e28f Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Mon, 30 Jun 2025 15:58:45 +0100
Subject: [PATCH 064/117] docs: Solutions catalog audit (#759)

---
 content/solutions/about-subscription-licenses.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/solutions/about-subscription-licenses.md b/content/solutions/about-subscription-licenses.md
index 6fb2e484f..057f5f43c 100644
--- a/content/solutions/about-subscription-licenses.md
+++ b/content/solutions/about-subscription-licenses.md
@@ -5,7 +5,7 @@ weight: 2
 type:
 - reference
 product: Solutions
-docs: DOCS-000
+docs: DOCS-1780
 ---
 
 ## Overview

From 6beae218a582b3894c409faac62a7238f5ebe893 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Mon, 30 Jun 2025 16:14:11 +0100
Subject: [PATCH 065/117] docs: add missing NAP-WAF docs to the catalog (#762)

---
 content/nap-waf/v4/releases/about-1.2.md           | 2 +-
 content/nap-waf/v4/releases/about-4.10.md          | 2 +-
 content/nap-waf/v4/releases/about-4.11.md          | 2 +-
 content/nap-waf/v4/releases/about-4.12.md          | 2 +-
 content/nap-waf/v4/releases/about-4.13.md          | 2 +-
 content/nap-waf/v4/releases/about-4.14.md          | 2 +-
 content/nap-waf/v4/releases/about-4.15.md          | 1 +
 content/nap-waf/v5/admin-guide/deploy-with-helm.md | 1 +
 content/nap-waf/v5/releases/about-5.2.md           | 2 +-
 content/nap-waf/v5/releases/about-5.3.md           | 2 +-
 content/nap-waf/v5/releases/about-5.4.md           | 2 +-
 content/nap-waf/v5/releases/about-5.5.md           | 2 +-
 content/nap-waf/v5/releases/about-5.6.md           | 2 +-
 content/nap-waf/v5/releases/about-5.7.md           | 1 +
 14 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/content/nap-waf/v4/releases/about-1.2.md b/content/nap-waf/v4/releases/about-1.2.md
index ec7a3eb72..8a9a348e1 100644
--- a/content/nap-waf/v4/releases/about-1.2.md
+++ b/content/nap-waf/v4/releases/about-1.2.md
@@ -4,7 +4,7 @@ weight: 1020
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1791
 ---
 
 June 30, 2020
diff --git a/content/nap-waf/v4/releases/about-4.10.md b/content/nap-waf/v4/releases/about-4.10.md
index 8097546aa..9762bd8f2 100644
--- a/content/nap-waf/v4/releases/about-4.10.md
+++ b/content/nap-waf/v4/releases/about-4.10.md
@@ -4,7 +4,7 @@ weight: 130
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1787
 ---
 
 May 29, 2024
diff --git a/content/nap-waf/v4/releases/about-4.11.md b/content/nap-waf/v4/releases/about-4.11.md
index 438bd8c99..b92e89ae1 100644
--- a/content/nap-waf/v4/releases/about-4.11.md
+++ b/content/nap-waf/v4/releases/about-4.11.md
@@ -4,7 +4,7 @@ weight: 120
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1786
 ---
 
 September 25, 2024
diff --git a/content/nap-waf/v4/releases/about-4.12.md b/content/nap-waf/v4/releases/about-4.12.md
index e735023b9..ae55a7ee8 100644
--- a/content/nap-waf/v4/releases/about-4.12.md
+++ b/content/nap-waf/v4/releases/about-4.12.md
@@ -4,7 +4,7 @@ weight: 110
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1788
 ---
 
 November 19th, 2024
diff --git a/content/nap-waf/v4/releases/about-4.13.md b/content/nap-waf/v4/releases/about-4.13.md
index b332f4aa9..ed2ca037c 100644
--- a/content/nap-waf/v4/releases/about-4.13.md
+++ b/content/nap-waf/v4/releases/about-4.13.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1790
 ---
 
 January 30th, 2025
diff --git a/content/nap-waf/v4/releases/about-4.14.md b/content/nap-waf/v4/releases/about-4.14.md
index 89ff9875d..6c2187fe9 100644
--- a/content/nap-waf/v4/releases/about-4.14.md
+++ b/content/nap-waf/v4/releases/about-4.14.md
@@ -4,7 +4,7 @@ weight: 90
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1792
 ---
 
 April 1st, 2025
diff --git a/content/nap-waf/v4/releases/about-4.15.md b/content/nap-waf/v4/releases/about-4.15.md
index f56e4ac52..cb004174f 100644
--- a/content/nap-waf/v4/releases/about-4.15.md
+++ b/content/nap-waf/v4/releases/about-4.15.md
@@ -4,6 +4,7 @@ weight: 80
 toc: true
 nd-content-type: reference
 nd-product: NAP-WAF
+docs: DOCS-1789
 ---
 
 June 24th, 2025
diff --git a/content/nap-waf/v5/admin-guide/deploy-with-helm.md b/content/nap-waf/v5/admin-guide/deploy-with-helm.md
index 4a2eeb801..677334d42 100644
--- a/content/nap-waf/v5/admin-guide/deploy-with-helm.md
+++ b/content/nap-waf/v5/admin-guide/deploy-with-helm.md
@@ -4,6 +4,7 @@ weight: 300
 toc: true
 type: how-to
 product: NAP-WAF
+docs: DOCS-1793
 ---
 
 ## Overview
diff --git a/content/nap-waf/v5/releases/about-5.2.md b/content/nap-waf/v5/releases/about-5.2.md
index 388397e9b..ab147a12f 100644
--- a/content/nap-waf/v5/releases/about-5.2.md
+++ b/content/nap-waf/v5/releases/about-5.2.md
@@ -4,7 +4,7 @@ weight: 890
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1796
 ---
 
 May 29, 2024
diff --git a/content/nap-waf/v5/releases/about-5.3.md b/content/nap-waf/v5/releases/about-5.3.md
index 4b5bb044d..f29be731d 100644
--- a/content/nap-waf/v5/releases/about-5.3.md
+++ b/content/nap-waf/v5/releases/about-5.3.md
@@ -4,7 +4,7 @@ weight: 880
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1799
 ---
 
 September 25, 2024
diff --git a/content/nap-waf/v5/releases/about-5.4.md b/content/nap-waf/v5/releases/about-5.4.md
index 4417b6781..88683bbec 100644
--- a/content/nap-waf/v5/releases/about-5.4.md
+++ b/content/nap-waf/v5/releases/about-5.4.md
@@ -4,7 +4,7 @@ weight: 870
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1798
 ---
 
 November 19th, 2024
diff --git a/content/nap-waf/v5/releases/about-5.5.md b/content/nap-waf/v5/releases/about-5.5.md
index 55f099321..78e1bfca0 100644
--- a/content/nap-waf/v5/releases/about-5.5.md
+++ b/content/nap-waf/v5/releases/about-5.5.md
@@ -4,7 +4,7 @@ weight: 860
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1795
 ---
 
 January 30th, 2025
diff --git a/content/nap-waf/v5/releases/about-5.6.md b/content/nap-waf/v5/releases/about-5.6.md
index fb8f057a0..79b290d5d 100644
--- a/content/nap-waf/v5/releases/about-5.6.md
+++ b/content/nap-waf/v5/releases/about-5.6.md
@@ -4,7 +4,7 @@ weight: 850
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-000
+docs: DOCS-1797
 ---
 
 April 1st, 2025
diff --git a/content/nap-waf/v5/releases/about-5.7.md b/content/nap-waf/v5/releases/about-5.7.md
index 7ad69b20c..48b48f248 100644
--- a/content/nap-waf/v5/releases/about-5.7.md
+++ b/content/nap-waf/v5/releases/about-5.7.md
@@ -4,6 +4,7 @@ weight: 840
 toc: true
 nd-content-type: reference
 nd-product: NAP-WAF
+docs: DOCS-1794
 ---
 
 June 24th, 2025

From 5019dac88aaa637faa1da4af6e771327bb046e3a Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Mon, 30 Jun 2025 08:53:38 -0700
Subject: [PATCH 066/117] fix: Update broken link in maintainers-etiquette.md
 (#758)

---
 documentation/maintainers-etiquette.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/documentation/maintainers-etiquette.md b/documentation/maintainers-etiquette.md
index 8aae8a61b..c183b1ac5 100644
--- a/documentation/maintainers-etiquette.md
+++ b/documentation/maintainers-etiquette.md
@@ -16,6 +16,6 @@ This repository is public, and we do as much of our work as possible in the publ
 
 As an F5/NGINX employee, if you have a GitHub account, you should be able to clone these repositories.
 
-If your content cannot be visible before release, you should read the [Contributing guidelines for closed content](/CLOSED_CONTRIBUTIONS.md) document.
+If your content cannot be visible before release, read the guidelines for [Contributing closed content](/documentation/closed-contributions.md).
 
 To protect F5/NGINX, the ability to merge pull requests is strictly limited to employees of F5/NGINX.

From f2a8261dd0744b3e78c83cbe7635425032156531 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Mon, 30 Jun 2025 17:06:17 +0100
Subject: [PATCH 067/117] docs: add missing NGF docs to the catalog (#763)

Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 content/ngf/changelog.md                      |  2 +-
 content/ngf/get-started.md                    |  6 +++---
 .../ngf/how-to/control-plane-configuration.md |  2 +-
 .../ngf/how-to/data-plane-configuration.md    |  4 ++--
 content/ngf/how-to/scaling.md                 | 20 +++++++++----------
 .../how-to/upgrade-apps-without-downtime.md   |  2 +-
 content/ngf/install/deploy-data-plane.md      | 12 +++++------
 content/ngf/install/nginx-plus.md             |  2 +-
 content/ngf/install/secure-certificates.md    |  7 ++++---
 content/ngf/install/upgrade-version.md        | 18 ++++++++---------
 content/ngf/monitoring/dashboard.md           |  4 ++--
 content/ngf/monitoring/tracing.md             |  2 +-
 content/ngf/overview/custom-policies.md       |  2 +-
 content/ngf/overview/gateway-architecture.md  | 10 +++++-----
 content/ngf/overview/nginx-plus.md            |  2 +-
 content/ngf/overview/product-telemetry.md     |  2 +-
 content/ngf/reference/api.md                  |  4 ++--
 content/ngf/reference/cli-help.md             |  4 ++--
 .../ngf/reference/technical-specifications.md |  4 ++--
 .../traffic-management/advanced-routing.md    |  4 ++--
 .../ngf/traffic-management/client-settings.md |  2 +-
 content/ngf/traffic-management/mirror.md      |  2 +-
 .../request-response-headers.md               |  4 ++--
 content/ngf/traffic-management/snippets.md    |  4 ++--
 .../ngf/traffic-management/tls-passthrough.md |  6 +++---
 .../traffic-management/upstream-settings.md   |  4 ++--
 .../ngf/traffic-security/secure-backend.md    |  2 +-
 27 files changed, 69 insertions(+), 68 deletions(-)

diff --git a/content/ngf/changelog.md b/content/ngf/changelog.md
index 5453d1b8f..4e16a7465 100644
--- a/content/ngf/changelog.md
+++ b/content/ngf/changelog.md
@@ -4,7 +4,7 @@ toc: true
 weight: 900
 nd-content-type: reference
 nd-product: NGF
-nd-docs: "DOCS-1359"
+nd-docs: DOCS-1359
 ---
 
 See the NGINX Gateway Fabric changelog page:
diff --git a/content/ngf/get-started.md b/content/ngf/get-started.md
index c6a03bd0c..83bd9029f 100644
--- a/content/ngf/get-started.md
+++ b/content/ngf/get-started.md
@@ -4,11 +4,11 @@ weight: 200
 toc: true
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1834
 ---
 
 {{< important >}}
-This document is for trying out NGINX Gateway Fabric, and not intended for a production environment. 
+This document is for trying out NGINX Gateway Fabric, and not intended for a production environment.
 
 For standard deployments, you should read the [Install NGINX Gateway Fabric]({{< ref "/ngf/install/" >}}) section.
 {{< /important >}}
@@ -102,7 +102,7 @@ customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking
 
 ### Install the Helm chart
 
-Use `helm` to install NGINX Gateway Fabric, specifying the NodePort configuration that will be set on the 
+Use `helm` to install NGINX Gateway Fabric, specifying the NodePort configuration that will be set on the
 NGINX Service when it is provisioned:
 
 ```shell
diff --git a/content/ngf/how-to/control-plane-configuration.md b/content/ngf/how-to/control-plane-configuration.md
index c7ca856b4..65a358784 100644
--- a/content/ngf/how-to/control-plane-configuration.md
+++ b/content/ngf/how-to/control-plane-configuration.md
@@ -4,7 +4,7 @@ weight: 400
 toc: true
 type: how-to
 product: NGF
-docs: DOCS-1416
+nd-docs: DOCS-1839
 ---
 
 Learn how to dynamically update the NGINX Gateway Fabric control plane configuration.
diff --git a/content/ngf/how-to/data-plane-configuration.md b/content/ngf/how-to/data-plane-configuration.md
index 994a86faa..ff16d6e1e 100644
--- a/content/ngf/how-to/data-plane-configuration.md
+++ b/content/ngf/how-to/data-plane-configuration.md
@@ -4,7 +4,7 @@ weight: 500
 toc: true
 type: how-to
 product: NGF
-docs: DOCS-000
+nd-docs: DOCS-1838
 ---
 
 Learn how to dynamically update the NGINX Gateway Fabric global data plane configuration.
@@ -342,7 +342,7 @@ EOF
 
 ## Configure infrastructure-related settings
 
-You can configure deployment and service settings for all data plane instances by editing the `NginxProxy` resource at the Gateway or GatewayClass level. These settings can also be specified under the `nginx` section in the Helm values file. You can edit things such as replicas, pod scheduling options, container resource limits, extra volume mounts, service types and load balancer settings. 
+You can configure deployment and service settings for all data plane instances by editing the `NginxProxy` resource at the Gateway or GatewayClass level. These settings can also be specified under the `nginx` section in the Helm values file. You can edit things such as replicas, pod scheduling options, container resource limits, extra volume mounts, service types and load balancer settings.
 
 The following command creates an `NginxProxy` resource with 2 replicas, sets `container.resources.requests` to 100m CPU and 128Mi memory, configures a 90 second `pod.terminationGracePeriodSeconds`, and sets the service type to `LoadBalancer` with IP `192.87.9.1` and AWS NLB annotation.
 
diff --git a/content/ngf/how-to/scaling.md b/content/ngf/how-to/scaling.md
index 22d181cdf..8e9961798 100644
--- a/content/ngf/how-to/scaling.md
+++ b/content/ngf/how-to/scaling.md
@@ -4,7 +4,7 @@ weight: 700
 toc: true
 type: how-to
 product: NGF
-docs: DOCS-0000
+nd-docs: DOCS-1840
 ---
 
 This document describes how you can separately scale the NGINX Gateway Fabric control plane and data plane.
@@ -14,7 +14,7 @@ It provides guidance on how to scale each plane effectively, and when you should
 
 ### Scaling the data plane
 
-The data plane is the NGINX deployment that handles user traffic to backend applications. Every Gateway object created provisions its own NGINX deployment and configuration. 
+The data plane is the NGINX deployment that handles user traffic to backend applications. Every Gateway object created provisions its own NGINX deployment and configuration.
 
 You have two options for scaling the data plane:
 
@@ -25,9 +25,9 @@ You have two options for scaling the data plane:
 
 Understanding when to increase replicas or create a new Gateway is key to managing traffic effectively.
 
-Increasing data plane replicas is ideal when you need to handle more traffic without changing the configuration. 
+Increasing data plane replicas is ideal when you need to handle more traffic without changing the configuration.
 
-For example, if you're routing traffic to `api.example.com` and notice an increase in load, you can scale the replicas from 1 to 5 to better distribute the traffic and reduce latency. 
+For example, if you're routing traffic to `api.example.com` and notice an increase in load, you can scale the replicas from 1 to 5 to better distribute the traffic and reduce latency.
 
 All replicas will share the same configuration from the Gateway used to set up the data plane, simplifying configuration management.
 
@@ -45,15 +45,15 @@ Secondly, you can update the `NginxProxy` resource while NGINX is running to mod
 kubectl edit nginxproxies.gateway.nginx.org ngf-proxy-config -n nginx-gateway
 ```
 
-The alternate way to scale the data plane is by creating a new Gateway.  This is beneficial when you need distinct configurations, isolation, or separate policies. 
+The alternate way to scale the data plane is by creating a new Gateway.  This is beneficial when you need distinct configurations, isolation, or separate policies.
 
-For example, if you're routing traffic to a new domain `admin.example.com` and require a different TLS certificate, stricter rate limits, or separate authentication policies, creating a new Gateway could be a good approach. 
+For example, if you're routing traffic to a new domain `admin.example.com` and require a different TLS certificate, stricter rate limits, or separate authentication policies, creating a new Gateway could be a good approach.
 
 It allows for safe experimentation with isolated configurations and makes it easier to enforce security boundaries and specific routing rules.
 
 ### Scaling the control plane
 
-The control plane builds configuration based on defined Gateway API resources and sends that configuration to the NGINX data planes. With leader election enabled by default, the control plane can be scaled horizontally by running multiple replicas, although only the pod with leader lease can actively manage configuration status updates. 
+The control plane builds configuration based on defined Gateway API resources and sends that configuration to the NGINX data planes. With leader election enabled by default, the control plane can be scaled horizontally by running multiple replicas, although only the pod with leader lease can actively manage configuration status updates.
 
 Scaling the control plane can be beneficial in the following scenarios:
 
@@ -70,11 +70,11 @@ To scale the control plane, use the `kubectl scale` command on the control plane
 
 When scaling the control plane, it's important to understand how status updates are handled for Gateway API resources.
 
-All control plane pods can send NGINX configuration to the data planes. However, only the leader control plane pod is allowed to write status updates to Gateway API resources. 
+All control plane pods can send NGINX configuration to the data planes. However, only the leader control plane pod is allowed to write status updates to Gateway API resources.
 
-If an NGINX instance connects to a non-leader pod, and an error occurs when applying the config, that error status will not be written to the Gateway object status. 
+If an NGINX instance connects to a non-leader pod, and an error occurs when applying the config, that error status will not be written to the Gateway object status.
 
-To mitigate the potential for this issue, ensure that the number of NGINX data plane pods equals or exceeds the number of control plane pods. 
+To mitigate the potential for this issue, ensure that the number of NGINX data plane pods equals or exceeds the number of control plane pods.
 
 This increases the likelihood that at least one of the data planes is connected to the leader control plane pod. If an applied configuration has an error, the leader pod will be aware of it and status can still be written.
 
diff --git a/content/ngf/how-to/upgrade-apps-without-downtime.md b/content/ngf/how-to/upgrade-apps-without-downtime.md
index 71e570f0b..f8aeb5e9d 100644
--- a/content/ngf/how-to/upgrade-apps-without-downtime.md
+++ b/content/ngf/how-to/upgrade-apps-without-downtime.md
@@ -4,7 +4,7 @@ weight: 600
 toc: true
 type: how-to
 product: NGF
-docs: DOCS-1420
+nd-docs: DOCS-1841
 ---
 
 Learn how to use NGINX Gateway Fabric to upgrade applications without downtime.
diff --git a/content/ngf/install/deploy-data-plane.md b/content/ngf/install/deploy-data-plane.md
index 114613026..dd7eaf598 100644
--- a/content/ngf/install/deploy-data-plane.md
+++ b/content/ngf/install/deploy-data-plane.md
@@ -4,7 +4,7 @@ weight: 600
 toc: true
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1854
 ---
 
 ## Overview
@@ -104,13 +104,13 @@ The NginxProxy custom resource can modify the provisioning of the Service object
 
 {{< note >}} Updating most Kubernetes related fields in NginxProxy will trigger a restart of the related resources. {{< /note >}}
 
-An NginxProxy resource is created by default after deploying NGINX Gateway Fabric. This NginxProxy resource is attached to the GatewayClass (created on NGINX Gateway Fabric installation), and 
+An NginxProxy resource is created by default after deploying NGINX Gateway Fabric. This NginxProxy resource is attached to the GatewayClass (created on NGINX Gateway Fabric installation), and
 its settings are applied globally to all Gateways.
 
 Use `kubectl get` and `kubectl describe` to get some more information on the resource:
 
 ```shell
-kubectl get nginxproxies -A   
+kubectl get nginxproxies -A
 ```
 ```text
 NAMESPACE       NAME                      AGE
@@ -159,7 +159,7 @@ Under `Spec.Kubernetes` you can see a few things:
 - How many NGINX Deployment replicas are specified
 - The type of Service and external traffic policy
 
-{{< note >}} Depending on installation configuration, the default NginxProxy settings may be slightly different from what is shown in the example. 
+{{< note >}} Depending on installation configuration, the default NginxProxy settings may be slightly different from what is shown in the example.
 For more information on NginxProxy and its configurable fields, see the [API reference]({{< ref "/ngf/reference/api.md" >}}). {{< /note >}}
 
 Modify the NginxProxy resource to change the type of Service.
@@ -173,7 +173,7 @@ type: NodePort
 After saving the changes, use `kubectl get` on the service, and you should see the service type has changed to `LoadBalancer`.
 
 ```shell
-kubectl get service cafe-nginx      
+kubectl get service cafe-nginx
 ```
 ```text
 NAME         TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
@@ -184,7 +184,7 @@ cafe-nginx   NodePort       10.96.172.204   <none>        80:32615/TCP   3h5m
 
 While the majority of configuration will happen on the NginxProxy resource, that is not always the case. Uniquely, if
 you want to set any annotations or labels on the NGINX Deployment or Service, you need to set those annotations on the Gateway which
-provisioned them. 
+provisioned them.
 
 You can use `kubectl edit` on the Gateway and add the following to the `spec`:
 
diff --git a/content/ngf/install/nginx-plus.md b/content/ngf/install/nginx-plus.md
index 4c7eb0e17..535b3bfac 100644
--- a/content/ngf/install/nginx-plus.md
+++ b/content/ngf/install/nginx-plus.md
@@ -4,7 +4,7 @@ weight: 300
 toc: true
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1853
 ---
 
 ## Overview
diff --git a/content/ngf/install/secure-certificates.md b/content/ngf/install/secure-certificates.md
index 01283eabf..92b78bb85 100644
--- a/content/ngf/install/secure-certificates.md
+++ b/content/ngf/install/secure-certificates.md
@@ -4,13 +4,14 @@ weight: 100
 toc: true
 nd-content-type: how-to
 nd-product: NGF
+nd-docs: DOCS-1851
 ---
 
-By default, NGINX Gateway Fabric installs self-signed certificates to secure the connection between the NGINX Gateway Fabric control plane and the NGINX data plane pods. These certificates are created by a `cert-generator` job when NGINX Gateway Fabric is first installed. 
+By default, NGINX Gateway Fabric installs self-signed certificates to secure the connection between the NGINX Gateway Fabric control plane and the NGINX data plane pods. These certificates are created by a `cert-generator` job when NGINX Gateway Fabric is first installed.
 
 However, because these certificates are self-signed and will expire after 3 years, we recommend a solution such as [cert-manager](https://cert-manager.io) to create and manage these certificates in a production environment.
 
-This guide will step through how to install and use `cert-manager` to secure this connection. 
+This guide will step through how to install and use `cert-manager` to secure this connection.
 
 {{< caution >}}
 
@@ -179,7 +180,7 @@ Specify the Secret name using the `certGenerator.agentTLSSecretName` helm value.
 
 {{%tab name="Manifests"%}}
 
-Specify the Secret name using the `agent-tls-secret` command-line argument. 
+Specify the Secret name using the `agent-tls-secret` command-line argument.
 
 {{% /tab %}}
 
diff --git a/content/ngf/install/upgrade-version.md b/content/ngf/install/upgrade-version.md
index e8e0f16ef..fedadffe0 100644
--- a/content/ngf/install/upgrade-version.md
+++ b/content/ngf/install/upgrade-version.md
@@ -4,18 +4,18 @@ weight: 700
 toc: true
 type: how-to
 product: NGF
-docs: DOCS-0000
+nd-docs: DOCS-1852
 ---
 
-This document describes how to upgrade NGINX Gateway Fabric when a new version releases. 
+This document describes how to upgrade NGINX Gateway Fabric when a new version releases.
 
 It covers the necessary steps for minor versions as well as major versions (such as 1.x to 2.x).
 
 Many of the nuances in upgrade paths relate to how custom resource definitions (CRDs) are managed.
 
-{{< tip >}} 
+{{< tip >}}
 
-To avoid interruptions, review the [Delay pod termination for zero downtime upgrades](#configure-delayed-pod-termination-for-zero-downtime-upgrades) section. 
+To avoid interruptions, review the [Delay pod termination for zero downtime upgrades](#configure-delayed-pod-termination-for-zero-downtime-upgrades) section.
 
 {{< /tip >}}
 
@@ -24,7 +24,7 @@ To avoid interruptions, review the [Delay pod termination for zero downtime upgr
 
 {{< important >}} NGINX Plus users need a JWT secret before upgrading from version 1.4.0 to 1.5.x.
 
-Follow the steps in [Set up the JWT]({{< ref "/ngf/install/nginx-plus.md#set-up-the-jwt" >}}) to create the Secret. 
+Follow the steps in [Set up the JWT]({{< ref "/ngf/install/nginx-plus.md#set-up-the-jwt" >}}) to create the Secret.
 
 {{< /important >}}
 
@@ -33,7 +33,7 @@ Follow the steps in [Set up the JWT]({{< ref "/ngf/install/nginx-plus.md#set-up-
 
 To upgrade your Gateway API resources, take the following steps:
 
-- Use [Technical specifications]({{< ref "/ngf/reference/technical-specifications.md" >}}) to verify your Gateway API resources are compatible with your NGINX Gateway Fabric version. 
+- Use [Technical specifications]({{< ref "/ngf/reference/technical-specifications.md" >}}) to verify your Gateway API resources are compatible with your NGINX Gateway Fabric version.
 - Review the [release notes](https://github.com/kubernetes-sigs/gateway-api/releases) for any important upgrade-specific information.
 
 To upgrade the Gateway API resources, run the following command:
@@ -56,7 +56,7 @@ Run the following command to upgrade the CRDs:
 kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
 ```
 
-{{< note >}} 
+{{< note >}}
 
 Ignore the following warning, as it is expected.
 
@@ -119,7 +119,7 @@ To remove the previous version 1.x of NGINX Gateway Fabric, follow these steps:
 First, run the following command to uninstall NGINX Gateway Fabric from the `nginx-gateway` namespace, and update `ngf` to your release name if it is different:
 
 ```shell
-helm uninstall ngf -n nginx-gateway 
+helm uninstall ngf -n nginx-gateway
 ```
 
 Afterwards, remove CRDs associated with NGINX Gateway Fabric version 1.x with the following command:
@@ -240,7 +240,7 @@ You can then follow [this localhost link](http://localhost:1313/nginx-gateway-fa
 
 ## Upgrade from NGINX Open Source to NGINX Plus
 
-{{< important >}} 
+{{< important >}}
 
 Ensure that you [Set up the JWT]({{< ref "/ngf/install/nginx-plus.md#set-up-the-jwt" >}}) before upgrading. These instructions only apply to Helm.
 
diff --git a/content/ngf/monitoring/dashboard.md b/content/ngf/monitoring/dashboard.md
index 56cfc31d2..60ee15e29 100644
--- a/content/ngf/monitoring/dashboard.md
+++ b/content/ngf/monitoring/dashboard.md
@@ -9,7 +9,7 @@ nd-docs: DOCS-1417
 
 This topic describes how to view the NGINX Plus dashboard to see real-time metrics.
 
-The NGINX Plus dashboard offers a real-time live activity monitoring interface that shows key load and performance metrics of your server infrastructure. 
+The NGINX Plus dashboard offers a real-time live activity monitoring interface that shows key load and performance metrics of your server infrastructure.
 
 The dashboard is enabled by default for NGINX Gateway Fabric deployments that use NGINX Plus as the data plane, and is available on port 8765.
 
@@ -33,7 +33,7 @@ The dashboard will look like this:
 
 To access the NGINX Plus dashboard from sources than the default `127.0.0.1`, you can use the NginxProxy resource to allow access to other IP Addresses or CIDR blocks.
 
-The following example configuration allows access to the NGINX Plus dashboard from the IP Addresses `192.0.2.8` and 
+The following example configuration allows access to the NGINX Plus dashboard from the IP Addresses `192.0.2.8` and
 `192.0.2.0` and the CIDR block `198.51.100.0/24`:
 
 ```yaml
diff --git a/content/ngf/monitoring/tracing.md b/content/ngf/monitoring/tracing.md
index fe241cad5..ae895179c 100644
--- a/content/ngf/monitoring/tracing.md
+++ b/content/ngf/monitoring/tracing.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1844
 ---
 
 This guide explains how to enable tracing on HTTPRoutes in NGINX Gateway Fabric using the OpenTelemetry Collector. Jaeger is used to process and collect the traces.
diff --git a/content/ngf/overview/custom-policies.md b/content/ngf/overview/custom-policies.md
index 02c04d899..03dda319b 100644
--- a/content/ngf/overview/custom-policies.md
+++ b/content/ngf/overview/custom-policies.md
@@ -4,7 +4,7 @@ weight: 600
 toc: true
 nd-content-type: reference
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1835
 ---
 
 ## Overview
diff --git a/content/ngf/overview/gateway-architecture.md b/content/ngf/overview/gateway-architecture.md
index fa45758e7..7d826635c 100644
--- a/content/ngf/overview/gateway-architecture.md
+++ b/content/ngf/overview/gateway-architecture.md
@@ -179,7 +179,7 @@ graph LR
 
     %% Kubernetes Configuration Flow
     HTTPRouteA --> GatewayAB
-    HTTPRouteB --> GatewayAB 
+    HTTPRouteB --> GatewayAB
     HTTPRouteC --> GatewayC
 
     NGFPod --> KubernetesAPI
@@ -247,9 +247,9 @@ The figure shows:
 - _Application B_ with one pod deployed in the _applications_ namespace by _Application Developer B_. To expose the application to its clients (_Clients B_) via the host `b.example.com`, _Application Developer B_ creates _HTTPRoute B_ and attaches it to `Gateway AB`.
 - _Application C_ with one pod deployed in the _applications2_ namespace by _Application Developer C_. To expose the application to its clients (_Clients C_) via the host `c.other-example.com`, _Application Developer C_ creates _HTTPRoute C_ and attaches it to `Gateway C`.
 - _Public Endpoint AB_, and _Public Endpoint C_ and  which fronts the _NGINX AB_, and _NGINX C_ pods respectively. A public endpoint is typically a TCP load balancer (cloud, software, or hardware) or a combination of such load balancer with a NodePort service. _Clients A_ and _B_ connect to their applications via the _Public Endpoint AB_, and _Clients C_ connect to their applications via the _Public Endpoint C_.
-- The bold arrows represent connections related to the client traffic. Note that the traffic from _Clients C_ to _Application C_ is completely isolated from the traffic between _Clients A_ and _B_ and _Application A_ and _B_ respectively. 
+- The bold arrows represent connections related to the client traffic. Note that the traffic from _Clients C_ to _Application C_ is completely isolated from the traffic between _Clients A_ and _B_ and _Application A_ and _B_ respectively.
 
-The resources within the cluster are color-coded based on the user responsible for their creation. 
+The resources within the cluster are color-coded based on the user responsible for their creation.
 For example, the Cluster Operator is denoted by the color green, indicating they create and manage all the green resources.
 
 ---
@@ -340,12 +340,12 @@ The following list describes the connections, preceeded by their types in parent
 1. (HTTPS)
    - Read: _NGF_ reads the _Kubernetes API_ to get the latest versions of the resources in the cluster.
    - Write: _NGF_ writes to the _Kubernetes API_ to update the handled resources' statuses and emit events. If there's more than one replica of _NGF_ and [leader election](https://github.com/nginx/nginx-gateway-fabric/tree/v1.6.1/charts/nginx-gateway-fabric#configuration) is enabled, only the _NGF_ pod that is leading will write statuses to the _Kubernetes API_.
-1. (HTTP, HTTPS) _Prometheus_ fetches the `controller-runtime` metrics via an HTTP endpoint that _NGF_ exposes (`:9113/metrics` by default). 
+1. (HTTP, HTTPS) _Prometheus_ fetches the `controller-runtime` metrics via an HTTP endpoint that _NGF_ exposes (`:9113/metrics` by default).
 Prometheus is **not** required by NGINX Gateway Fabric, and its endpoint can be turned off.
 1. (HTTPS) NGF sends [product telemetry data]({{< ref "/ngf/overview/product-telemetry.md" >}}) to the F5 telemetry service.
 1. (File I/O) _NGF_ writes logs to its _stdout_ and _stderr_, which are collected by the container runtime.
 1. (HTTP, HTTPS) _Prometheus_ fetches the NGINX metrics via an HTTP endpoint that _NGINX_ exposes (`:9113/metrics` by default). Prometheus is **not** required by NGINX, and its endpoint can be turned off.
-1. (gRPC) _NGF_ generates NGINX _configuration_ based on the cluster resources and sends them to _NGINX Agent_ over a secure gRPC connection. 
+1. (gRPC) _NGF_ generates NGINX _configuration_ based on the cluster resources and sends them to _NGINX Agent_ over a secure gRPC connection.
     - NGF sends a message containing file metadata to all pods (subscriptions) for the deployment.
     - Agent receives a ConfigApplyRequest with the list of file metadata.
     - Agent calls GetFile for each file in the list, which NGF sends back to the agent.
diff --git a/content/ngf/overview/nginx-plus.md b/content/ngf/overview/nginx-plus.md
index 30543eca3..b19de51fc 100644
--- a/content/ngf/overview/nginx-plus.md
+++ b/content/ngf/overview/nginx-plus.md
@@ -3,7 +3,7 @@ title: Advanced features with NGINX Plus
 weight: 300
 type: reference
 product: NGF
-docs: DOCS-1415
+nd-docs: DOCS-1837
 ---
 
 NGINX Gateway Fabric can use NGINX Open Source or NGINX Plus as its data plane. [NGINX Plus](https://www.nginx.com/products/nginx/) is the closed source, commercial version of NGINX. Using NGINX Plus as the data plane offers additional benefits compared to the open source version.
diff --git a/content/ngf/overview/product-telemetry.md b/content/ngf/overview/product-telemetry.md
index 1213eff4b..837f71eda 100644
--- a/content/ngf/overview/product-telemetry.md
+++ b/content/ngf/overview/product-telemetry.md
@@ -3,7 +3,7 @@ title: Product telemetry
 weight: 500
 nd-content-type: reference
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1836
 ---
 
 Learn why, what and how NGINX Gateway Fabric collects telemetry.
diff --git a/content/ngf/reference/api.md b/content/ngf/reference/api.md
index 39928f8dc..d88e6111b 100644
--- a/content/ngf/reference/api.md
+++ b/content/ngf/reference/api.md
@@ -1,9 +1,9 @@
 ---
-title: "API reference"
+title: API reference
 weight: 100
 type: reference
 product: NGF
-docs: DOCS-000
+nd-docs: DOCS-1855
 ---
 ## Overview
 NGINX Gateway API Reference
diff --git a/content/ngf/reference/cli-help.md b/content/ngf/reference/cli-help.md
index a526ce149..193f1c45e 100644
--- a/content/ngf/reference/cli-help.md
+++ b/content/ngf/reference/cli-help.md
@@ -1,10 +1,10 @@
 ---
-title: "Command-line reference guide"
+title: Command-line reference guide
 weight: 100
 toc: true
 type: reference
 product: NGF
-docs: "DOCS-1435"
+nd-docs: DOCS-1843
 ---
 
 ## Overview
diff --git a/content/ngf/reference/technical-specifications.md b/content/ngf/reference/technical-specifications.md
index d6dc24406..cd8658f51 100644
--- a/content/ngf/reference/technical-specifications.md
+++ b/content/ngf/reference/technical-specifications.md
@@ -1,11 +1,11 @@
 ---
 title: Technical specifications
-description: "NGINX Gateway Fabric technical specifications."
+description: NGINX Gateway Fabric technical specifications.
 weight: 200
 toc: true
 type: reference
 product: NGF
-docs: DOCS-1434
+nd-docs: DOCS-1842
 ---
 
 See the NGINX Gateway Fabric technical specifications page:
diff --git a/content/ngf/traffic-management/advanced-routing.md b/content/ngf/traffic-management/advanced-routing.md
index bfbc54bef..8f187c223 100644
--- a/content/ngf/traffic-management/advanced-routing.md
+++ b/content/ngf/traffic-management/advanced-routing.md
@@ -62,9 +62,9 @@ GW_IP=XXX.YYY.ZZZ.III
 GW_PORT=<port number>
 ```
 
-{{< note >}} 
+{{< note >}}
 
-In a production environment, you should have a DNS record for the external IP address that is exposed, and it should refer to the hostname that the gateway will forward for. 
+In a production environment, you should have a DNS record for the external IP address that is exposed, and it should refer to the hostname that the gateway will forward for.
 
 {{< /note >}}
 
diff --git a/content/ngf/traffic-management/client-settings.md b/content/ngf/traffic-management/client-settings.md
index 61de5de79..881f890af 100644
--- a/content/ngf/traffic-management/client-settings.md
+++ b/content/ngf/traffic-management/client-settings.md
@@ -4,7 +4,7 @@ toc: true
 weight: 800
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1846
 ---
 
 Learn how to use the `ClientSettingsPolicy` API.
diff --git a/content/ngf/traffic-management/mirror.md b/content/ngf/traffic-management/mirror.md
index 03ab98793..a1d3e95e7 100644
--- a/content/ngf/traffic-management/mirror.md
+++ b/content/ngf/traffic-management/mirror.md
@@ -4,7 +4,7 @@ toc: true
 weight: 700
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1847
 ---
 
 Learn how to mirror your HTTP or gRPC traffic using NGINX Gateway Fabric.
diff --git a/content/ngf/traffic-management/request-response-headers.md b/content/ngf/traffic-management/request-response-headers.md
index 24740cbb1..724b27096 100644
--- a/content/ngf/traffic-management/request-response-headers.md
+++ b/content/ngf/traffic-management/request-response-headers.md
@@ -4,7 +4,7 @@ weight: 600
 toc: true
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1849
 ---
 
 Learn how to modify the request and response headers of your application using NGINX Gateway Fabric.
@@ -51,7 +51,7 @@ GW_IP=XXX.YYY.ZZZ.III
 GW_PORT=<port number>
 ```
 
-{{< note >}} 
+{{< note >}}
 
 In a production environment, you should have a DNS record for the external IP address that is exposed, and it should refer to the hostname that the gateway will forward for.
 
diff --git a/content/ngf/traffic-management/snippets.md b/content/ngf/traffic-management/snippets.md
index 0112d01a5..6fc35d1f5 100644
--- a/content/ngf/traffic-management/snippets.md
+++ b/content/ngf/traffic-management/snippets.md
@@ -1,10 +1,10 @@
 ---
-title: "Use the SnippetsFilter API"
+title: Use the SnippetsFilter API
 weight: 800
 toc: true
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: "DOCS-000"
+nd-docs: DOCS-1848
 ---
 
 This topic introduces Snippets, how to implement them using the `SnippetsFilter` API, and provides an example of how to use `SnippetsFilter` for rate limiting.
diff --git a/content/ngf/traffic-management/tls-passthrough.md b/content/ngf/traffic-management/tls-passthrough.md
index 82637e353..2306f01e6 100644
--- a/content/ngf/traffic-management/tls-passthrough.md
+++ b/content/ngf/traffic-management/tls-passthrough.md
@@ -4,7 +4,7 @@ weight: 800
 toc: true
 nd-content-type: how-to
 nd-product: NGF
-nd-docs: DOCS-000
+nd-docs: DOCS-1850
 ---
 
 Learn how to use TLSRoutes to configure TLS passthrough load-balancing with NGINX Gateway Fabric.
@@ -164,9 +164,9 @@ GW_IP=XXX.YYY.ZZZ.III
 GW_TLS_PORT=<port number>
 ```
 
-{{< note >}} 
+{{< note >}}
 
-In a production environment, you should have a DNS record for the external IP address that is exposed, and it should refer to the hostname that the Gateway will forward for. 
+In a production environment, you should have a DNS record for the external IP address that is exposed, and it should refer to the hostname that the Gateway will forward for.
 
 {{< /note >}}
 
diff --git a/content/ngf/traffic-management/upstream-settings.md b/content/ngf/traffic-management/upstream-settings.md
index f57d4d13f..153e9d4b3 100644
--- a/content/ngf/traffic-management/upstream-settings.md
+++ b/content/ngf/traffic-management/upstream-settings.md
@@ -1,10 +1,10 @@
 ---
-title: "Upstream Settings Policy API"
+title: Upstream Settings Policy API
 weight: 900
 toc: true
 type: how-to
 product: NGF
-docs: "DOCS-000"
+nd-docs: DOCS-1845
 ---
 
 Learn how to use the `UpstreamSettingsPolicy` API.
diff --git a/content/ngf/traffic-security/secure-backend.md b/content/ngf/traffic-security/secure-backend.md
index cde85cd2a..b2545c9ec 100644
--- a/content/ngf/traffic-security/secure-backend.md
+++ b/content/ngf/traffic-security/secure-backend.md
@@ -11,7 +11,7 @@ Learn how to encrypt HTTP traffic between NGINX Gateway Fabric and your backend
 
 ## Overview
 
-In this guide, we will show how to specify the TLS configuration of the connection from the Gateway to a backend pod with the Service API object using a [BackendTLSPolicy](https://gateway-api.sigs.k8s.io/api-types/backendtlspolicy/). 
+In this guide, we will show how to specify the TLS configuration of the connection from the Gateway to a backend pod with the Service API object using a [BackendTLSPolicy](https://gateway-api.sigs.k8s.io/api-types/backendtlspolicy/).
 
 The intended use-case is when a service or backend owner is managing their own TLS and NGINX Gateway Fabric needs to know how to connect to this backend pod that has its own certificate over HTTPS.
 

From 95290109b71a9b7854dd9feab102475422516054 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Mon, 30 Jun 2025 17:15:23 +0100
Subject: [PATCH 068/117] docs: add missing NIC docs to the catalog (#764)

---
 content/nic/configuration/access-control.md       |  2 +-
 .../nic/configuration/configuration-examples.md   |  2 +-
 .../command-line-arguments.md                     |  2 +-
 .../global-configuration/configmap-resource.md    |  6 +++---
 .../global-configuration/custom-templates.md      |  2 +-
 .../globalconfiguration-resource.md               |  2 +-
 .../mgmt-configmap-resource.md                    |  4 ++--
 .../configuration/host-and-listener-collisions.md |  2 +-
 .../advanced-configuration-with-snippets.md       | 10 +++++-----
 .../ingress-resources/basic-configuration.md      |  6 +++---
 content/nic/configuration/policy-resource.md      |  2 +-
 .../nic/configuration/transportserver-resource.md |  2 +-
 content/nic/glossary.md                           |  2 +-
 .../build-nginx-ingress-controller.md             |  2 +-
 content/nic/installation/create-license-secret.md | 15 ++++++++-------
 content/nic/installation/ingress-nginx.md         |  2 +-
 .../installing-nic/deploy-with-nap-using-helm.md  |  9 +++++----
 .../installing-nic/installation-with-manifests.md |  2 +-
 .../installing-nic/installation-with-operator.md  |  2 +-
 .../installation/installing-nic/upgrade-to-v4.md  |  2 +-
 .../integrations/app-protect-dos/installation.md  |  2 +-
 .../app-protect-waf-v5/compile-waf-policies.md    |  2 +-
 .../app-protect-waf-v5/configuration.md           |  2 +-
 .../app-protect-waf-v5/installation.md            |  2 +-
 .../troubleshoot-app-protect-waf.md               |  2 +-
 .../integrations/app-protect-waf/configuration.md |  2 +-
 .../integrations/app-protect-waf/installation.md  |  2 +-
 .../installation/integrations/f5-ingresslink.md   |  2 +-
 .../nic/installation/integrations/opentracing.md  |  2 +-
 .../installation/nic-images/get-registry-image.md |  2 +-
 .../nic/installation/nic-images/use-aws-image.md  |  4 ++--
 .../nic/installation/nic-images/use-gcp-image.md  |  2 +-
 .../run-multiple-ingress-controllers.md           |  2 +-
 content/nic/logging-and-monitoring/prometheus.md  |  2 +-
 content/nic/overview/about.md                     |  2 +-
 content/nic/overview/nginx-plus.md                |  2 +-
 content/nic/overview/product-telemetry.md         |  1 +
 content/nic/releases.md                           |  2 +-
 content/nic/technical-specifications.md           |  2 +-
 .../nic/troubleshooting/troubleshoot-common.md    |  2 +-
 .../troubleshoot-configmap-policy.md              |  2 +-
 .../nic/troubleshooting/troubleshoot-ingress.md   |  2 +-
 .../nic/troubleshooting/troubleshoot-support.md   |  2 +-
 .../troubleshooting/troubleshoot-virtualserver.md |  2 +-
 content/nic/tutorials/custom-listen-ports.md      |  2 +-
 .../nic/tutorials/oidc-custom-configuration.md    |  3 +--
 content/nic/tutorials/security-monitoring.md      |  1 +
 47 files changed, 68 insertions(+), 65 deletions(-)

diff --git a/content/nic/configuration/access-control.md b/content/nic/configuration/access-control.md
index 54fee5f91..4af2ecb27 100644
--- a/content/nic/configuration/access-control.md
+++ b/content/nic/configuration/access-control.md
@@ -2,7 +2,7 @@
 title: Deploy a Policy for access control
 weight: 900
 toc: true
-docs: DOCS-000
+nd-docs: DOCS-1858
 ---
 
 This topic describes how to use F5 NGINX Ingress Controller to apply and update a Policy for access control. It demonstrates it using an example application and a [VirtualServer custom resource]({{< ref "/nic/configuration/virtualserver-and-virtualserverroute-resources.md" >}}).
diff --git a/content/nic/configuration/configuration-examples.md b/content/nic/configuration/configuration-examples.md
index 0a0e6e3bb..c49c0790e 100644
--- a/content/nic/configuration/configuration-examples.md
+++ b/content/nic/configuration/configuration-examples.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-584
+nd-docs: DOCS-584
 doctypes:
 - ''
 title: Configuration examples
diff --git a/content/nic/configuration/global-configuration/command-line-arguments.md b/content/nic/configuration/global-configuration/command-line-arguments.md
index 79d8f3f02..e7ca266e9 100644
--- a/content/nic/configuration/global-configuration/command-line-arguments.md
+++ b/content/nic/configuration/global-configuration/command-line-arguments.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-585
+nd-docs: DOCS-585
 doctypes:
 - ''
 title: Command-line arguments
diff --git a/content/nic/configuration/global-configuration/configmap-resource.md b/content/nic/configuration/global-configuration/configmap-resource.md
index 662c9a4a2..499f7733a 100644
--- a/content/nic/configuration/global-configuration/configmap-resource.md
+++ b/content/nic/configuration/global-configuration/configmap-resource.md
@@ -184,12 +184,12 @@ For more information, view the [VirtualServer and VirtualServerRoute resources](
 
 Zone Sync enables the [ngx_stream_zone_sync_module](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html) in NGINX Ingress Controller when NGINX Plus is used.  Multiple replicas are required to effectively utililise this functionality. More information is available in the [How NGINX Plus Performs Zone Synchronization]({{< ref "/nginx/admin-guide/high-availability/zone_sync_details.md" >}}) topic.
 
-Zone synchronization with TLS for NGINX Ingress Controller is not yet available with ConfigMap. If you would like to enable Zone Sync with TLS, please remove `zone-sync` from ConfigMap and add Zone Sync parameters via [`stream-snippets`]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) similar to [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-config.yaml) and adding the [zone_sync_ssl directive](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_ssl) along with any other TLS parameters to the `stream-snippets`. 
+Zone synchronization with TLS for NGINX Ingress Controller is not yet available with ConfigMap. If you would like to enable Zone Sync with TLS, please remove `zone-sync` from ConfigMap and add Zone Sync parameters via [`stream-snippets`]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) similar to [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-config.yaml) and adding the [zone_sync_ssl directive](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_ssl) along with any other TLS parameters to the `stream-snippets`.
 
 You will also need to manually add the headless service, such as in [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml).
 
-{{< caution >}} 
-If you previously installed OIDC or used the `zone_sync` directive with `stream-snippets` in [v4.0.1](https://github.com/nginx/kubernetes-ingress/tree/v4.0.1) or earlier, and you plan to enable the `zone-sync` ConfigMap key, the `zone_sync` directive should be removed from `stream-snippets`. 
+{{< caution >}}
+If you previously installed OIDC or used the `zone_sync` directive with `stream-snippets` in [v4.0.1](https://github.com/nginx/kubernetes-ingress/tree/v4.0.1) or earlier, and you plan to enable the `zone-sync` ConfigMap key, the `zone_sync` directive should be removed from `stream-snippets`.
 
 If you encounter the error `error [emerg] 13#13: "zone_sync" directive is duplicate in /etc/nginx/nginx.conf:164` it is likely due to `zone_sync` being enabled in both `stream-snippets` and the ConfigMap. Once upgraded, remove the [old headless service](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml) deployed for OIDC.
 {{< /caution >}}
diff --git a/content/nic/configuration/global-configuration/custom-templates.md b/content/nic/configuration/global-configuration/custom-templates.md
index 589ce5951..6bb99f87f 100644
--- a/content/nic/configuration/global-configuration/custom-templates.md
+++ b/content/nic/configuration/global-configuration/custom-templates.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-587
+nd-docs: DOCS-587
 doctypes:
 - ''
 title: Custom templates
diff --git a/content/nic/configuration/global-configuration/globalconfiguration-resource.md b/content/nic/configuration/global-configuration/globalconfiguration-resource.md
index 80d05bd55..16fd90edc 100644
--- a/content/nic/configuration/global-configuration/globalconfiguration-resource.md
+++ b/content/nic/configuration/global-configuration/globalconfiguration-resource.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-588
+nd-docs: DOCS-588
 doctypes:
 - ''
 title: GlobalConfiguration resource
diff --git a/content/nic/configuration/global-configuration/mgmt-configmap-resource.md b/content/nic/configuration/global-configuration/mgmt-configmap-resource.md
index e1d9a120c..f7eb66aea 100644
--- a/content/nic/configuration/global-configuration/mgmt-configmap-resource.md
+++ b/content/nic/configuration/global-configuration/mgmt-configmap-resource.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-586
+nd-docs: DOCS-1859
 doctypes:
 - ''
 title: Management ConfigMap resource
@@ -7,7 +7,7 @@ toc: true
 weight: 300
 ---
 
-When using F5 NGINX Ingress Controller with NGINX Plus, it is required to pass a [command line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) to NGINX Ingress Controller, `--mgmt-configmap=<namespace/name>` which specifies the ConfigMap to use. The minimal required ConfigMap must have a `license-token-secret-name` key. Helm users will not need to create this map or pass the argument, it will be created with a Helm install. 
+When using F5 NGINX Ingress Controller with NGINX Plus, it is required to pass a [command line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) to NGINX Ingress Controller, `--mgmt-configmap=<namespace/name>` which specifies the ConfigMap to use. The minimal required ConfigMap must have a `license-token-secret-name` key. Helm users will not need to create this map or pass the argument, it will be created with a Helm install.
 
 ---
 
diff --git a/content/nic/configuration/host-and-listener-collisions.md b/content/nic/configuration/host-and-listener-collisions.md
index 502ef830c..3336bb21e 100644
--- a/content/nic/configuration/host-and-listener-collisions.md
+++ b/content/nic/configuration/host-and-listener-collisions.md
@@ -2,7 +2,7 @@
 title: Host and Listener collisions
 toc: true
 weight: 800
-docs: DOCS-590
+nd-docs: DOCS-590
 ---
 
 This document explains how F5 NGINX Ingress Controller handles host and listener collisions between resources.
diff --git a/content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md b/content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
index 0060a7e3b..8f5c8b764 100644
--- a/content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
+++ b/content/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-592
+nd-docs: DOCS-592
 doctypes:
 - ''
 title: Advanced configuration with Snippets
@@ -7,9 +7,9 @@ toc: true
 weight: 400
 ---
 
-Snippets allow you to insert raw NGINX config into different contexts of the NGINX configurations that F5 NGINX Ingress Controller generates. 
+Snippets allow you to insert raw NGINX config into different contexts of the NGINX configurations that F5 NGINX Ingress Controller generates.
 
-Snippets are intended for advanced NGINX users who need more control over the generated NGINX configuration, and can be used in cases where Annotations and ConfigMap entries would not apply. 
+Snippets are intended for advanced NGINX users who need more control over the generated NGINX configuration, and can be used in cases where Annotations and ConfigMap entries would not apply.
 
 
 
@@ -27,7 +27,7 @@ Snippets have the following disadvantages:
 - *Decreased robustness*. An incorrect snippet can invalidate NGINX configuration, causing reload failures. Until the snippet is fixed, it will prevent any new configuration updates, including updates for the other Ingress resources.
 - *Security implications*. Snippets give access to NGINX configuration primitives, which are not validated by NGINX Ingress Controller. For example, a snippet can configure NGINX to serve the TLS certificates and keys used for TLS termination for Ingress resources.
 
-{{< note >}} If the NGINX configuration includes an invalid snippet, NGINX will continue to operate with the last valid configuration. {{< /note >}} 
+{{< note >}} If the NGINX configuration includes an invalid snippet, NGINX will continue to operate with the last valid configuration. {{< /note >}}
 
 ## Using snippets
 
@@ -68,7 +68,7 @@ spec:
 
 These snippets generate the following NGINX configuration:
 
-{{< note >}} The example is shortened for conciseness. {{< /note >}} 
+{{< note >}} The example is shortened for conciseness. {{< /note >}}
 
 ```nginx
 server {
diff --git a/content/nic/configuration/ingress-resources/basic-configuration.md b/content/nic/configuration/ingress-resources/basic-configuration.md
index 8d1948693..00ed51ef6 100644
--- a/content/nic/configuration/ingress-resources/basic-configuration.md
+++ b/content/nic/configuration/ingress-resources/basic-configuration.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: reference
 product: NIC
-docs: DOCS-593
+nd-docs: DOCS-593
 ---
 
 This document shows a basic Ingress resource definition for F5 NGINX Ingress Controller. It load balances requests for two services as part of a single application.
@@ -93,9 +93,9 @@ NGINX Ingress Controller imposes the following restrictions on Ingress resources
 
 ## Advanced configuration
 
-NGINX Ingress Controller generates NGINX configuration by executing a template file that contains the configuration options. 
+NGINX Ingress Controller generates NGINX configuration by executing a template file that contains the configuration options.
 
-These options are set with the Ingress resource and NGINX Ingress Controller's ConfigMap.  
+These options are set with the Ingress resource and NGINX Ingress Controller's ConfigMap.
 
 The Ingress resource only allows you to use basic NGINX features: host and path-based routing and TLS termination.
 
diff --git a/content/nic/configuration/policy-resource.md b/content/nic/configuration/policy-resource.md
index a6c33e3e4..6b4fd7cde 100644
--- a/content/nic/configuration/policy-resource.md
+++ b/content/nic/configuration/policy-resource.md
@@ -201,7 +201,7 @@ The rate limit policy will only apply to requests that contain a JWT with the sp
 {
   "user_details": {
     "level": "premium"
-  }, 
+  },
   "sub": "client1"
 }
 ```
diff --git a/content/nic/configuration/transportserver-resource.md b/content/nic/configuration/transportserver-resource.md
index b725ea2e6..ea2f3c688 100644
--- a/content/nic/configuration/transportserver-resource.md
+++ b/content/nic/configuration/transportserver-resource.md
@@ -2,7 +2,7 @@
 title: TransportServer resources
 toc: true
 weight: 600
-docs: DOCS-598
+nd-docs: DOCS-598
 ---
 
 This document is reference material for the TransportServer resource used by F5 NGINX Ingress Controller.
diff --git a/content/nic/glossary.md b/content/nic/glossary.md
index d76f9e3db..3985d7857 100644
--- a/content/nic/glossary.md
+++ b/content/nic/glossary.md
@@ -1,6 +1,6 @@
 ---
 description: null
-docs: DOCS-1446
+nd-docs: DOCS-1446
 title: Glossary
 weight: 10000
 ---
diff --git a/content/nic/installation/build-nginx-ingress-controller.md b/content/nic/installation/build-nginx-ingress-controller.md
index 4f37d8f25..560a46ca4 100644
--- a/content/nic/installation/build-nginx-ingress-controller.md
+++ b/content/nic/installation/build-nginx-ingress-controller.md
@@ -4,7 +4,7 @@ toc: true
 weight: 400
 type: how-to
 product: NIC
-docs: DOCS-1453
+nd-docs: DOCS-1453
 ---
 
 This document describes how to build an F5 NGINX Ingress Controller image from source code and upload it to a private Docker registry.
diff --git a/content/nic/installation/create-license-secret.md b/content/nic/installation/create-license-secret.md
index 91be0f9f9..3b13bc543 100644
--- a/content/nic/installation/create-license-secret.md
+++ b/content/nic/installation/create-license-secret.md
@@ -1,12 +1,13 @@
 ---
-title: Create a license Secret 
+title: Create a license Secret
 toc: true
 weight: 300
 nd-content-type: how-to
 nd-product: NIC
+nd-docs: DOCS-1860
 ---
 
-This document explains how to create and use a license secret for F5 NGINX Ingress Controller. 
+This document explains how to create and use a license secret for F5 NGINX Ingress Controller.
 
 # Overview
 
@@ -18,18 +19,18 @@ The JWT is required for validating your subscription and reporting telemetry dat
 
 {{< note >}} Read the [subscription licenses topic]({{< ref "/solutions/about-subscription-licenses.md#for-internet-connected-environments" >}}) for a list of IPs associated with F5's licensing endpoint (`product.connect.nginx.com`). {{</ note >}}
 
-## Set up your NGINX Plus license 
+## Set up your NGINX Plus license
 
 ### Download the JWT
 
 {{< include "/nic/installation/download-jwt.md" >}}
 
-### Create the Secret 
+### Create the Secret
 
 The JWT needs to be configured before deploying NGINX Ingress Controller. The JWT will be stored in a Kubernetes Secret of type `nginx.com/license`, and can be created with the following command.
 
 ```shell
-kubectl create secret generic license-token --from-file=license.jwt=<path-to-your-jwt> --type=nginx.com/license -n <Your Namespace> 
+kubectl create secret generic license-token --from-file=license.jwt=<path-to-your-jwt> --type=nginx.com/license -n <Your Namespace>
 ```
 You can now delete the downloaded `.jwt` file.
 
@@ -91,7 +92,7 @@ Specify the endpoint in the `usage-report-endpoint` Management ConfigMap key.
 
 To configure SSL certificates or SSL trusted certificates, extra steps are necessary.
 
-To use Client Auth with NGINX Instance Manager, first create a Secret of type `kubernetes.io/tls` in the same namespace as the NGINX Ingress Controller pods. 
+To use Client Auth with NGINX Instance Manager, first create a Secret of type `kubernetes.io/tls` in the same namespace as the NGINX Ingress Controller pods.
 
 ```shell
 kubectl create secret tls ssl-certificate --cert=<path-to-your-client.pem> --key=<path-to-your-client.key> -n <Your Namespace>
@@ -112,7 +113,7 @@ Providing an optional CRL (certificate revocation list) will configure the [`ssl
 
 {{%tab name="Helm"%}}
 
-Specify the SSL certificate Secret name using the `controller.mgmt.sslCertificateSecretName` Helm value. 
+Specify the SSL certificate Secret name using the `controller.mgmt.sslCertificateSecretName` Helm value.
 
 Specify the SSL trusted certificate Secret name using the `controller.mgmt.sslTrustedCertificateSecretName` Helm value.
 
diff --git a/content/nic/installation/ingress-nginx.md b/content/nic/installation/ingress-nginx.md
index cc8fc2ebb..faa3d3b04 100644
--- a/content/nic/installation/ingress-nginx.md
+++ b/content/nic/installation/ingress-nginx.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1469
+nd-docs: DOCS-1469
 doctypes:
 - tutorial
 tags:
diff --git a/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md b/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
index 815ac0166..054b4e887 100644
--- a/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
+++ b/content/nic/installation/installing-nic/deploy-with-nap-using-helm.md
@@ -4,9 +4,10 @@ toc: true
 weight: 500
 nd-content-type: how-to
 nd-product: NIC
+nd-docs: DOCS-1861
 ---
 
-This document describes how to build a local F5 NGINX App Protect WAF v5 Docker image with NGINX Plus Ingress 
+This document describes how to build a local F5 NGINX App Protect WAF v5 Docker image with NGINX Plus Ingress
 Controller, which can be used to compile WAF policies.
 
 This is accomplished with the following steps:
@@ -21,7 +22,7 @@ This is accomplished with the following steps:
 
 ## Prepare Secrets and credentials
 
-1. Download your NGINX Ingress Controller subscription's JSON Web Token, SSL Certificate, and Private Key from MyF5. 
+1. Download your NGINX Ingress Controller subscription's JSON Web Token, SSL Certificate, and Private Key from MyF5.
    You can use the same JSON Web Token, Certificate, and Key as NGINX Plus in your MyF5 portal.
 1. Rename the files to the following:
    - `nginx-repo.crt`
@@ -330,7 +331,7 @@ curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP "http://webapp.example.co
 ```
 
 ```text
-<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your 
+<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your
 administrator.<br><br>Your support ID is: 11241918873745059631<br><br>
 <a href='javascript:history.back();'>[Go Back]</a></body></html>
 ```
@@ -338,6 +339,6 @@ administrator.<br><br>Your support ID is: 11241918873745059631<br><br>
 This is mostly the same as the [examples/custom_resources/app-protect-waf-v5](https://github.com/nginx/kubernetes-ingress/tree/main/examples/custom-resources/app-protect-waf-v5)
 deployment in a single file with the policy bundle already set.
 
-You now have a fully operational NGINX Ingress Controller instance with NGINX App Protect deployed in your Kubernetes environment. 
+You now have a fully operational NGINX Ingress Controller instance with NGINX App Protect deployed in your Kubernetes environment.
 
 For further details, troubleshooting, or support, refer to the [official NGINX documentation]({{< ref "/" >}}) or reach out directly to your F5/NGINX account team.
diff --git a/content/nic/installation/installing-nic/installation-with-manifests.md b/content/nic/installation/installing-nic/installation-with-manifests.md
index 61f457808..2f44611f6 100644
--- a/content/nic/installation/installing-nic/installation-with-manifests.md
+++ b/content/nic/installation/installing-nic/installation-with-manifests.md
@@ -4,7 +4,7 @@ toc: true
 weight: 200
 type: how-to
 product: NIC
-docs: DOCS-603
+nd-docs: DOCS-603
 ---
 
 This guide explains how to use Manifests to install F5 NGINX Ingress Controller, then create both common and custom resources and set up role-based access control.
diff --git a/content/nic/installation/installing-nic/installation-with-operator.md b/content/nic/installation/installing-nic/installation-with-operator.md
index 3fc35a09f..459d7cfd1 100644
--- a/content/nic/installation/installing-nic/installation-with-operator.md
+++ b/content/nic/installation/installing-nic/installation-with-operator.md
@@ -4,7 +4,7 @@ toc: true
 weight: 300
 type: how-to
 product: NIC
-docs: DOCS-604
+nd-docs: DOCS-604
 ---
 
 This document explains how to install F5 NGINX Ingress Controller using NGINX Ingress Operator.
diff --git a/content/nic/installation/installing-nic/upgrade-to-v4.md b/content/nic/installation/installing-nic/upgrade-to-v4.md
index 23382a540..36b3e798d 100644
--- a/content/nic/installation/installing-nic/upgrade-to-v4.md
+++ b/content/nic/installation/installing-nic/upgrade-to-v4.md
@@ -4,7 +4,7 @@ toc: true
 weight: 400
 type: how-to
 product: NIC
-docs: DOCS-000
+nd-docs: DOCS-1862
 ---
 
 This document explains how to upgrade F5 NGINX Ingress Controller to 4.0.0.
diff --git a/content/nic/installation/integrations/app-protect-dos/installation.md b/content/nic/installation/integrations/app-protect-dos/installation.md
index 9471d48c5..75a4439ae 100644
--- a/content/nic/installation/integrations/app-protect-dos/installation.md
+++ b/content/nic/installation/integrations/app-protect-dos/installation.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: how-to
 product: NIC
-docs: DOCS-583
+nd-docs: DOCS-583
 ---
 
 This document explains how to build an image for F5 NGINX Ingress Controller with NGINX App Protect DoS from source code.
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
index c34785d49..e21c90e4e 100644
--- a/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
+++ b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md
@@ -4,7 +4,7 @@ weight: 300
 toc: true
 nd-content-type: how-to
 nd-product: NIC
-nd-docs: DOCS-000
+nd-docs: DOCS-1863
 ---
 
 ## Overview
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/configuration.md b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
index 748e56d79..d6cbc208a 100644
--- a/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
+++ b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md
@@ -4,7 +4,7 @@ weight: 200
 toc: true
 nd-content-type: how-to
 nd-product: NIC
-nd-docs: DOCS-000
+nd-docs: DOCS-1866
 ---
 
 ## Overview
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/installation.md b/content/nic/installation/integrations/app-protect-waf-v5/installation.md
index 40f638f1a..2cdc5964c 100644
--- a/content/nic/installation/integrations/app-protect-waf-v5/installation.md
+++ b/content/nic/installation/integrations/app-protect-waf-v5/installation.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: how-to
 product: NIC
-docs: DOCS-000
+nd-docs: DOCS-1865
 ---
 
 This document explains how to build a F5 NGINX Ingress Controller image with NGINX App Protect WAF v5 from source code.
diff --git a/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
index 65594dcf6..aca3370d7 100644
--- a/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
+++ b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md
@@ -4,7 +4,7 @@ weight: 400
 toc: true
 nd-content-type: how-to
 nd-product: NIC
-nd-docs: DOCS-000
+nd-docs: DOCS-1864
 ---
 
 This document describes how to troubleshoot problems when using NGINX Ingress Controller and the NGINX App Protect WAF module version 5.
diff --git a/content/nic/installation/integrations/app-protect-waf/configuration.md b/content/nic/installation/integrations/app-protect-waf/configuration.md
index 50d2c6352..ce77de634 100644
--- a/content/nic/installation/integrations/app-protect-waf/configuration.md
+++ b/content/nic/installation/integrations/app-protect-waf/configuration.md
@@ -4,7 +4,7 @@ weight: 200
 toc: true
 type: how-to
 product: NIC
-docs: DOCS-578
+nd-docs: DOCS-578
 ---
 
 This document explains how to use F5 NGINX Ingress Controller to configure NGINX App Protect WAF.
diff --git a/content/nic/installation/integrations/app-protect-waf/installation.md b/content/nic/installation/integrations/app-protect-waf/installation.md
index 08e7404e9..ed7732450 100644
--- a/content/nic/installation/integrations/app-protect-waf/installation.md
+++ b/content/nic/installation/integrations/app-protect-waf/installation.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: how-to
 product: NIC
-docs: DOCS-579
+nd-docs: DOCS-579
 ---
 
 This document explains how to build a F5 NGINX Ingress Controller image with F5 NGINX App Protect WAF from source code.
diff --git a/content/nic/installation/integrations/f5-ingresslink.md b/content/nic/installation/integrations/f5-ingresslink.md
index 1e06bbab7..887138ac3 100644
--- a/content/nic/installation/integrations/f5-ingresslink.md
+++ b/content/nic/installation/integrations/f5-ingresslink.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-600
+nd-docs: DOCS-600
 doctypes:
 - concept
 title: F5 BIG-IP
diff --git a/content/nic/installation/integrations/opentracing.md b/content/nic/installation/integrations/opentracing.md
index 55c6efd2a..9b131dc8c 100644
--- a/content/nic/installation/integrations/opentracing.md
+++ b/content/nic/installation/integrations/opentracing.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-618
+nd-docs: DOCS-618
 doctypes:
 - ''
 title: OpenTracing (Deprecated in v5.0.0)
diff --git a/content/nic/installation/nic-images/get-registry-image.md b/content/nic/installation/nic-images/get-registry-image.md
index 9fadafa08..9cf8dd08a 100644
--- a/content/nic/installation/nic-images/get-registry-image.md
+++ b/content/nic/installation/nic-images/get-registry-image.md
@@ -7,7 +7,7 @@ nd-product: NIC
 nd-docs: DOCS-605
 ---
 
-Learn how to pull an F5 NGINX Plus Ingress Controller image from the official F5 Docker registry and upload it to your private registry. 
+Learn how to pull an F5 NGINX Plus Ingress Controller image from the official F5 Docker registry and upload it to your private registry.
 
 The F5 Registry images include versions with NGINX App Protect WAF and NGINX App Protect DoS.
 
diff --git a/content/nic/installation/nic-images/use-aws-image.md b/content/nic/installation/nic-images/use-aws-image.md
index 38178778c..4198e253c 100644
--- a/content/nic/installation/nic-images/use-aws-image.md
+++ b/content/nic/installation/nic-images/use-aws-image.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-607
+nd-docs: DOCS-607
 doctypes:
 - ''
 title: Use the AWS Marketplace NGINX Ingress Controller image
@@ -107,7 +107,7 @@ Follow this guide to set up NGINX Ingress Controller using AWS Marketplace. This
 
     <br>
 
-    Ensure the service account name matches the one in your _values.yaml_ file for helm deployment.  
+    Ensure the service account name matches the one in your _values.yaml_ file for helm deployment.
     Ensure the EKS `role-arn` matches the service account annotation in your _values.yaml_ file for helm deployment.  You can use this command to retrieve the `role-arn`
     ``` shell
     aws iam list-roles | jq -r --arg role "my-cluster-sa" '.Roles[] | select(.RoleName==$role) | .Arn'
diff --git a/content/nic/installation/nic-images/use-gcp-image.md b/content/nic/installation/nic-images/use-gcp-image.md
index 2c38c8cff..2eb4e2f76 100644
--- a/content/nic/installation/nic-images/use-gcp-image.md
+++ b/content/nic/installation/nic-images/use-gcp-image.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1455
+nd-docs: DOCS-1455
 doctypes:
 - ''
 title: Use the GCP Marketplace NGINX Ingress Controller image
diff --git a/content/nic/installation/run-multiple-ingress-controllers.md b/content/nic/installation/run-multiple-ingress-controllers.md
index 3c2bd7116..98f3417b8 100644
--- a/content/nic/installation/run-multiple-ingress-controllers.md
+++ b/content/nic/installation/run-multiple-ingress-controllers.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-606
+nd-docs: DOCS-606
 doctypes:
 - ''
 title: Run multiple NGINX Ingress Controllers
diff --git a/content/nic/logging-and-monitoring/prometheus.md b/content/nic/logging-and-monitoring/prometheus.md
index 3d56d486f..17f32abe5 100644
--- a/content/nic/logging-and-monitoring/prometheus.md
+++ b/content/nic/logging-and-monitoring/prometheus.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-614
+nd-docs: DOCS-614
 doctypes:
 - concept
 title: Prometheus
diff --git a/content/nic/overview/about.md b/content/nic/overview/about.md
index f6231c24a..ef6bdeaf6 100644
--- a/content/nic/overview/about.md
+++ b/content/nic/overview/about.md
@@ -8,7 +8,7 @@ nd-docs: DOCS-612
 
 This document describes the F5 NGINX Ingress Controller, an Ingress Controller implementation for NGINX and NGINX Plus.
 
-NGINX Ingress Controller is an [Ingress Controller]({{< ref "/nic/glossary.md#ingress-controller">}}) implementation for [NGINX](https://nginx.org) and [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) that can load balance Websocket, gRPC, TCP and UDP applications. NGINX Ingress Controller gives you a way to manage NGINX through the [Kubernetes](https://kubernetes.io/) API, and is built to handle the continuous change that happens in Kubernetes environments. 
+NGINX Ingress Controller is an [Ingress Controller]({{< ref "/nic/glossary.md#ingress-controller">}}) implementation for [NGINX](https://nginx.org) and [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) that can load balance Websocket, gRPC, TCP and UDP applications. NGINX Ingress Controller gives you a way to manage NGINX through the [Kubernetes](https://kubernetes.io/) API, and is built to handle the continuous change that happens in Kubernetes environments.
 
 It supports standard [Ingress]({{< ref "/nic/glossary.md#ingress">}}) features such as content-based routing and TLS/SSL termination.Several NGINX and NGINX Plus features are available as extensions to Ingress resources through [Annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations">}}) and the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource">}}) resource.
 
diff --git a/content/nic/overview/nginx-plus.md b/content/nic/overview/nginx-plus.md
index 67adfa515..07316c039 100644
--- a/content/nic/overview/nginx-plus.md
+++ b/content/nic/overview/nginx-plus.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-611
+nd-docs: DOCS-611
 doctypes:
 - concept
 title: Extensibility with NGINX Plus
diff --git a/content/nic/overview/product-telemetry.md b/content/nic/overview/product-telemetry.md
index f6421b1f1..29f1ad409 100644
--- a/content/nic/overview/product-telemetry.md
+++ b/content/nic/overview/product-telemetry.md
@@ -2,6 +2,7 @@
 title: Product telemetry
 toc: true
 weight: 500
+nd-docs: DOCS-1857
 ---
 
 Learn why, what and how F5 NGINX Ingress Controller collects telemetry.
diff --git a/content/nic/releases.md b/content/nic/releases.md
index 4738b69be..cfed5b4ab 100644
--- a/content/nic/releases.md
+++ b/content/nic/releases.md
@@ -18,7 +18,7 @@ With the removal of the OpenTracing dynamic module from [NGINX Plus R34](({{< re
 
 We have extended the rate-limit Policy to allow tiered rate limit groups with JWT claims.  This will also allow users to apply different rate limits to their `VirtualServer` or `VirtualServerRoutes` with the value of a JWT claim.  See [here](https://github.com/nginx/kubernetes-ingress/tree/v5.0.0/examples/custom-resources/rate-limit-tiered-jwt-claim/) for a working example.
 
-We introduced NGINX Plus Zone Sync as a managed service within NGINX Ingress Controller in this release.  In previous releases, we had examples using `stream-snippets` for OIDC support, users can now enable `zone-sync` without the need for `snippets`.  NGINX Plus Zone Sync is available when utilising two or more replicas, it supports OIDC & rate limiting. 
+We introduced NGINX Plus Zone Sync as a managed service within NGINX Ingress Controller in this release.  In previous releases, we had examples using `stream-snippets` for OIDC support, users can now enable `zone-sync` without the need for `snippets`.  NGINX Plus Zone Sync is available when utilising two or more replicas, it supports OIDC & rate limiting.
 
 {{< note >}}
 For users who have previously installed OIDC or used the `zone_sync` directive with `stream-snippets`, please see the note in the [Configmap resources]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) topic to use the new `zone-sync` ConfigMap option.
diff --git a/content/nic/technical-specifications.md b/content/nic/technical-specifications.md
index ad9d5b2e4..524cbd358 100644
--- a/content/nic/technical-specifications.md
+++ b/content/nic/technical-specifications.md
@@ -4,7 +4,7 @@ toc: true
 weight: 200
 doctype: reference
 product: NIC
-docs: DOCS-617
+nd-docs: DOCS-617
 ---
 
 This page describes technical specifications for F5 NGINX Ingress Controller, such as its version compatibility with Kubernetes and other NGINX software.
diff --git a/content/nic/troubleshooting/troubleshoot-common.md b/content/nic/troubleshooting/troubleshoot-common.md
index 23438408c..4207917a9 100644
--- a/content/nic/troubleshooting/troubleshoot-common.md
+++ b/content/nic/troubleshooting/troubleshoot-common.md
@@ -92,7 +92,7 @@ args:
   - -log-level=debug
 ```
 
-**ConfigMap settings**  
+**ConfigMap settings**
 You can configure `error-log-level` in NGINX Ingress Controller `configMap`:
 
 ```yaml
diff --git a/content/nic/troubleshooting/troubleshoot-configmap-policy.md b/content/nic/troubleshooting/troubleshoot-configmap-policy.md
index fa5f44059..32169d55c 100644
--- a/content/nic/troubleshooting/troubleshoot-configmap-policy.md
+++ b/content/nic/troubleshooting/troubleshoot-configmap-policy.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1457
+nd-docs: DOCS-1457
 doctypes:
 - ''
 title: Troubleshooting Policy resources
diff --git a/content/nic/troubleshooting/troubleshoot-ingress.md b/content/nic/troubleshooting/troubleshoot-ingress.md
index e970b2548..3fccf4aec 100644
--- a/content/nic/troubleshooting/troubleshoot-ingress.md
+++ b/content/nic/troubleshooting/troubleshoot-ingress.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1458
+nd-docs: DOCS-1458
 doctypes:
 - ''
 title: Troubleshooting Ingress resources
diff --git a/content/nic/troubleshooting/troubleshoot-support.md b/content/nic/troubleshooting/troubleshoot-support.md
index 37308268b..340796320 100644
--- a/content/nic/troubleshooting/troubleshoot-support.md
+++ b/content/nic/troubleshooting/troubleshoot-support.md
@@ -1,7 +1,7 @@
 ---
 title: Commercial support
 weight: 100
-docs: DOCS-000
+nd-docs: DOCS-1867
 ---
 
 F5 NGINX Ingress Controller adheres to the support policy detailed in the following knowledge base article: [K000140156](https://my.f5.com/manage/s/article/K000140156).
diff --git a/content/nic/troubleshooting/troubleshoot-virtualserver.md b/content/nic/troubleshooting/troubleshoot-virtualserver.md
index 72af8d32c..b671aa00e 100644
--- a/content/nic/troubleshooting/troubleshoot-virtualserver.md
+++ b/content/nic/troubleshooting/troubleshoot-virtualserver.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1461
+nd-docs: DOCS-1461
 doctypes:
 - ''
 title: Troubleshooting VirtualServer resources
diff --git a/content/nic/tutorials/custom-listen-ports.md b/content/nic/tutorials/custom-listen-ports.md
index a2ab3347f..5e263f288 100644
--- a/content/nic/tutorials/custom-listen-ports.md
+++ b/content/nic/tutorials/custom-listen-ports.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1449
+nd-docs: DOCS-1449
 doctypes:
 - concept
 title: Customizing NGINX Ingress Controller Ports
diff --git a/content/nic/tutorials/oidc-custom-configuration.md b/content/nic/tutorials/oidc-custom-configuration.md
index 460f88070..a38143ad4 100644
--- a/content/nic/tutorials/oidc-custom-configuration.md
+++ b/content/nic/tutorials/oidc-custom-configuration.md
@@ -4,7 +4,7 @@ weight: 1800
 toc: true
 type: how-to
 product: NIC
-docs: DOCS-000
+nd-docs: DOCS-1448
 ---
 
 The F5 NGINX Ingress Controller implements OpenID Connect (OIDC) using the NGINX OpenID Connect Reference implementation: [nginx-openid-connect](https://github.com/nginxinc/nginx-openid-connect).
@@ -46,7 +46,6 @@ Annotations:  <none>
 Data
 ====
 oidc.conf:
-docs: "DOCS-1448"
 ----
     # Advanced configuration START
     set $internal_error_message "NGINX / OpenID Connect login failure\n";
diff --git a/content/nic/tutorials/security-monitoring.md b/content/nic/tutorials/security-monitoring.md
index d41478b06..4f2f17340 100644
--- a/content/nic/tutorials/security-monitoring.md
+++ b/content/nic/tutorials/security-monitoring.md
@@ -4,6 +4,7 @@ toc: true
 weight: 1800
 nd-content-type: how-to
 nd-product: NIC
+nd-docs: DOCS-1856
 ---
 
 This document explains how to use NGINX Ingress Controller to configure NGINX Agent for sending F5 NGINX App Protect WAF metrics to NGINX Security Monitoring.

From 306518134ea55ff2328731b796ddc67347622609 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Mon, 30 Jun 2025 17:29:15 +0100
Subject: [PATCH 069/117] chore: replace docs metadata key with nd-docs (#765)

---
 content/agent/changelog.md                    |  2 +-
 .../configuration/configuration-overview.md   | 14 ++--
 .../configure-nginx-agent-features.md         |  2 +-
 .../configure-nginx-agent-group.md            |  2 +-
 .../configuration/encrypt-communication.md    |  2 +-
 content/agent/configuration/health-checks.md  |  2 +-
 content/agent/contribute/community.md         |  2 +-
 .../agent/contribute/dev-environment-setup.md |  2 +-
 .../container-environments/docker-images.md   |  2 +-
 .../container-environments/docker-support.md  |  2 +-
 .../installation-upgrade/getting-started.md   |  2 +-
 .../installation-github.md                    |  2 +-
 .../installation-upgrade/installation-oss.md  |  2 +-
 .../installation-upgrade/installation-plus.md |  2 +-
 .../installation-unprivileged.md              |  2 +-
 .../agent/installation-upgrade/uninstall.md   |  2 +-
 content/agent/installation-upgrade/upgrade.md | 34 +++++-----
 content/agent/overview.md                     |  2 +-
 content/agent/technical-specifications.md     |  6 +-
 content/amplify/additional-resources.md       |  2 +-
 content/amplify/changelog.md                  |  2 +-
 content/amplify/faq/general.md                |  2 +-
 content/amplify/faq/metrics-and-metadata.md   |  2 +-
 content/amplify/faq/nginx-amplify-agent.md    |  2 +-
 content/amplify/faq/user-interface.md         |  2 +-
 content/amplify/known-issues.md               |  2 +-
 .../metrics-metadata/metrics-overview.md      |  2 +-
 .../amplify/metrics-metadata/nginx-metrics.md |  8 +--
 .../amplify/metrics-metadata/os-metrics.md    |  2 +-
 .../amplify/metrics-metadata/other-metrics.md |  2 +-
 .../amplify-agent-overview.md                 |  2 +-
 .../configuration-analysis.md                 |  2 +-
 .../configuring-metric-collection.md          |  2 +-
 .../detecting-monitoring-instances.md         |  2 +-
 .../install/configuring-amplify-agent.md      |  2 +-
 .../install/installing-amplify-agent.md       |  2 +-
 .../install/uninstalling-amplify-agent.md     |  2 +-
 .../install/updating-amplify-agent.md         |  2 +-
 .../install/using-amplify-agent-docker.md     |  2 +-
 .../metadata-metrics-collection.md            |  2 +-
 .../nginx-amplify-agent/source-code.md        |  2 +-
 .../troubleshooting-metrics-collection.md     |  2 +-
 .../overview/overview-main-components.md      |  2 +-
 .../user-interface/account-settings.md        |  2 +-
 content/amplify/user-interface/alerts.md      |  2 +-
 content/amplify/user-interface/analyzer.md    |  2 +-
 content/amplify/user-interface/dashboards.md  |  2 +-
 content/amplify/user-interface/graphs.md      |  2 +-
 content/amplify/user-interface/inventory.md   |  2 +-
 content/amplify/user-interface/overview.md    |  2 +-
 .../backup-restore-cluster-config.md          |  2 +-
 .../backup-restore-embedded-config-db.md      |  2 +-
 .../backup-restore-external-config-db.md      |  2 +-
 .../backup-restore-metrics-db.md              |  2 +-
 .../config-agent/about-controller-agent.md    |  2 +-
 .../configure-metrics-collection.md           |  2 +-
 .../config-agent/configure-the-agent.md       |  2 +-
 .../config-agent/use-agent-with-docker.md     |  2 +-
 .../admin-guides/install/agent-restart.md     |  2 +-
 .../install/get-n-plus-cert-and-key.md        |  2 +-
 .../install/install-agent-non-root.md         |  2 +-
 .../install/install-for-controller.md         |  2 +-
 .../install/install-nginx-controller-agent.md |  2 +-
 .../install-nginx-controller-rhel-8.md        |  2 +-
 .../install/install-nginx-controller.md       |  2 +-
 .../install/nginx-controller-tech-specs.md    |  2 +-
 .../install/resilient-cluster-aws.md          |  2 +-
 .../resilient-cluster-private-cloud.md        |  2 +-
 .../install/try-nginx-controller-app-sec.md   |  2 +-
 .../install/try-nginx-controller.md           |  2 +-
 .../install/using-helper-script.md            |  2 +-
 .../analytics/alerts/about-alerts.md          |  2 +-
 .../analytics/alerts/manage-alerts.md         |  2 +-
 .../alerts/manage-registered-emails.md        |  2 +-
 .../alerts/service-now-notifications.md       |  2 +-
 .../analytics/catalogs/dimensions.md          |  2 +-
 .../controller/analytics/catalogs/metrics.md  |  2 +-
 .../dashboards/application-health-score.md    |  2 +-
 .../analytics/dashboards/custom-dashboards.md |  2 +-
 .../dashboards/overview-dashboard.md          |  2 +-
 .../analytics/data-explorer/how-to-use.md     |  2 +-
 .../analytics/events/view-events.md           |  2 +-
 .../forward-analytics-to-datadog.md           |  2 +-
 .../forwarders/forward-analytics-to-otlp.md   |  2 +-
 .../forwarders/forward-analytics-to-splunk.md |  2 +-
 .../forwarders/forward-analytics-to-syslog.md |  2 +-
 .../analytics/metrics/metrics-api.md          |  2 +-
 .../metrics/overview-metrics-metadata.md      |  2 +-
 .../metrics/overview-traffic-metrics.md       |  2 +-
 .../analytics/metrics/view-traffic-metrics.md |  2 +-
 .../analytics/view-app-security-analytics.md  |  2 +-
 .../controller/api-management/manage-apis.md  |  2 +-
 .../api-management/manage-dev-portals.md      |  2 +-
 content/controller/api/overview.md            |  2 +-
 .../controller/api/reference/ctlr-adc-api.md  |  2 +-
 .../api/reference/ctlr-analytics-api.md       |  2 +-
 .../controller/api/reference/ctlr-apim-api.md |  2 +-
 .../api/reference/ctlr-platform-api.md        |  2 +-
 .../app-delivery/about-app-delivery.md        |  2 +-
 .../controller/app-delivery/about-caching.md  |  2 +-
 .../controller/app-delivery/about-snippets.md |  2 +-
 .../app-delivery/deploy-simple-app.md         |  2 +-
 .../controller/app-delivery/manage-apps.md    |  2 +-
 .../app-sec-default-policy-original.md        |  2 +-
 .../security/concepts/app-sec-metrics.md      |  2 +-
 .../concepts/bring-your-own-policy.md         |  2 +-
 .../concepts/extend-app-security-snippets.md  |  2 +-
 .../security/concepts/what-is-waf.md          |  2 +-
 .../tutorials/add-app-security-with-waf.md    |  2 +-
 .../tutorials/set-waf-monitor-mode.md         |  2 +-
 .../security/tutorials/tune-waf-for-app.md    |  2 +-
 .../tutorials/using-rbac-with-app-security.md |  2 +-
 .../tutorials/view-app-security-analytics.md  |  2 +-
 .../instances/add-aws-instance.md             |  2 +-
 .../instances/add-azure-instance.md           |  2 +-
 .../instances/add-nap-instance.md             |  2 +-
 .../instances/add-vsphere-instance.md         |  2 +-
 .../infrastructure/instances/analyzer.md      |  2 +-
 .../infrastructure/instances/graphs.md        |  2 +-
 .../infrastructure/instances/ha-data-plane.md |  2 +-
 .../manage-containerized-instances.md         |  2 +-
 .../instances/manage-instance-templates.md    |  2 +-
 .../instances/manage-instances.md             |  2 +-
 .../locations/manage-locations.md             |  2 +-
 .../platform/about/get-controller-version.md  |  2 +-
 .../platform/about/what-is-controller.md      |  2 +-
 .../manage-active-directory-auth-provider.md  |  2 +-
 .../access-management/manage-roles.md         |  2 +-
 .../access-management/manage-users.md         |  2 +-
 .../platform/integrations/aws-integration.md  |  2 +-
 .../integrations/big-ip-self-service.md       |  2 +-
 .../integrations/datadog-integration.md       |  2 +-
 .../platform/integrations/otlp-integration.md |  2 +-
 .../integrations/splunk-integration.md        |  2 +-
 .../integrations/syslog-integration.md        |  2 +-
 .../platform/licensing-controller.md          |  2 +-
 .../maintenance/changing-ip-address.md        |  2 +-
 content/controller/platform/manage-cluster.md |  2 +-
 .../releases/adc/adc-release-notes-3.20.1.md  |  2 +-
 .../releases/adc/adc-release-notes-3.20.md    |  2 +-
 .../releases/adc/adc-release-notes-3.21.md    |  2 +-
 .../releases/adc/adc-release-notes-3.22.1.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.2.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.3.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.4.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.5.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.6.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.7.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.8.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.9.md  |  2 +-
 .../releases/adc/adc-release-notes-3.22.md    |  2 +-
 .../apim/apim-release-notes-3.18.1.md         |  2 +-
 .../releases/apim/apim-release-notes-3.18.md  |  2 +-
 .../apim/apim-release-notes-3.19.1.md         |  2 +-
 .../apim/apim-release-notes-3.19.2.md         |  2 +-
 .../apim/apim-release-notes-3.19.3.md         |  2 +-
 .../apim/apim-release-notes-3.19.4.md         |  2 +-
 .../apim/apim-release-notes-3.19.5.md         |  2 +-
 .../apim/apim-release-notes-3.19.6.md         |  2 +-
 .../releases/apim/apim-release-notes-3.19.md  |  2 +-
 content/controller/releases/release-notes.md  |  2 +-
 .../controller/services/available-policies.md |  2 +-
 content/controller/services/manage-certs.md   |  2 +-
 .../services/manage-environments.md           |  2 +-
 .../controller/services/manage-gateways.md    |  2 +-
 .../services/manage-identity-providers.md     |  2 +-
 content/controller/services/overview.md       |  2 +-
 content/controller/support/contact-support.md |  2 +-
 .../support/troubleshooting-controller.md     |  2 +-
 .../support/troubleshooting-forwarders.md     |  2 +-
 content/includes/acm/about/global-policies.md |  2 +-
 .../how-to/policies-proxy-cluster-intro.md    |  2 +-
 .../acm/how-to/policies-proxy-intro.md        |  2 +-
 content/includes/acm/openapi-support.md       |  2 +-
 content/includes/acm/webui-acm-login.md       |  2 +-
 .../agent/installation/install-agent-api.md   |  2 +-
 .../includes/controller/apim-rn-preamble.md   |  2 +-
 .../includes/installation/access-web-ui.md    |  2 +-
 content/includes/installation/add-nms-repo.md |  4 +-
 .../includes/installation/agent-selinux.md    |  2 +-
 .../configuration-options.md                  |  2 +-
 .../configure-devportal-helm-api-mtls.md      |  2 +-
 ...figure-devportal-helm-embedded-postgres.md |  2 +-
 ...figure-devportal-helm-external-postgres.md |  2 +-
 .../configure-helm-devportal-sqlite.md        |  2 +-
 .../installation/nms-prerequisites.md         |  2 +-
 .../optional-installation-steps.md            |  2 +-
 .../installation/secure-installation.md       |  2 +-
 .../build-from-official-nginx-image.md        |  2 +-
 .../includes/nap-waf/build-nginx-image-cmd.md |  2 +-
 .../includes/nap-waf/bundles-volume-mount.md  |  2 +-
 content/includes/nap-waf/concept/apreload.md  |  2 +-
 .../nap-waf/concept/attack-signatures.md      |  2 +-
 .../concept/basic-config-default-policy.md    |  2 +-
 .../nap-waf/concept/external-references.md    |  2 +-
 .../nap-waf/concept/global-directives.md      |  2 +-
 .../nap-waf/concept/graphql-profile.md        |  2 +-
 .../includes/nap-waf/concept/grpc-logging.md  |  2 +-
 .../common/additional-config-options.md       |  2 +-
 .../common/additional-policy-features.md      |  2 +-
 .../nap-waf/config/common/anti-automation.md  |  2 +-
 .../common/associating-graphql-profiles.md    |  2 +-
 .../common/associating-profiles-urls.md       |  2 +-
 .../nap-waf/config/common/attack-types.md     |  2 +-
 ...-signature-sets-included-in-app-protect.md |  2 +-
 .../bidirectional-streaming-overview.md       |  2 +-
 .../config/common/clickjacking-protection.md  |  2 +-
 .../common/configure-client-authorization.md  |  2 +-
 .../config/common/configure-nginx-mirror.md   |  2 +-
 .../nap-waf/config/common/configure-njs.md    |  2 +-
 .../nap-waf/config/common/configure-ranges.md |  2 +-
 .../nap-waf/config/common/configure-slice.md  |  2 +-
 .../common/configure-static-location.md       |  2 +-
 .../nap-waf/config/common/csrf-protection.md  |  2 +-
 .../config/common/custom-log-configuration.md |  2 +-
 .../common/custom-log-errors-warnings.md      |  2 +-
 .../common/custom-log-logging-reporting.md    |  2 +-
 .../config/common/custom-log-overview.md      |  2 +-
 .../common/custom-log-things-to-remember.md   |  2 +-
 .../common/deny-allow-never-log-lists.md      |  2 +-
 .../common/detect-base64-string-values.md     |  2 +-
 .../nap-waf/config/common/detect-base64.md    |  2 +-
 .../disallow-application-use-geolocation.md   |  2 +-
 .../config/common/disallowed-file-types.md    |  2 +-
 .../do-nothing-and-user-defined-parameters.md |  2 +-
 .../config/common/enforcer-cookie-settings.md |  2 +-
 .../evasion-techniques-subviolations.md       |  2 +-
 .../config/common/filetypes-and-responses.md  |  2 +-
 .../config/common/first-match-principle.md    |  2 +-
 .../common/geolocation-override-rules.md      |  2 +-
 .../config/common/geolocation-overview.md     |  2 +-
 .../config/common/graphql-advanced-config.md  |  2 +-
 .../common/graphql-define-url-settings.md     |  2 +-
 .../nap-waf/config/common/graphql-overview.md |  2 +-
 .../config/common/graphql-response-pages.md   |  2 +-
 .../nap-waf/config/common/graphql-security.md |  2 +-
 .../config/common/graphql-violations.md       |  2 +-
 .../grpc-bidirectional-stream-enforcement.md  |  2 +-
 .../config/common/grpc-content-profiles.md    |  2 +-
 .../common/grpc-handling-slow-post-attacks.md |  2 +-
 .../config/common/grpc-message-compression.md |  2 +-
 .../common/grpc-protection-unary-traffic.md   |  2 +-
 .../config/common/grpc-response-pages.md      |  2 +-
 .../config/common/grpc-server-reflection.md   |  2 +-
 .../nap-waf/config/common/grpc-size-limits.md |  2 +-
 .../config/common/grpc-slow-post-attacks.md   |  2 +-
 .../nap-waf/config/common/grpc-violations.md  |  2 +-
 .../common/handling-xml-and-json-content.md   |  2 +-
 .../common/http-compliance-subviolations.md   |  2 +-
 .../common/important-things-override-rules.md |  2 +-
 .../config/common/json-web-token-overview.md  |  2 +-
 .../common/json-web-tokens-attack-sigs.md     |  2 +-
 .../json-web-tokens-other-references.md       |  2 +-
 .../json-web-tokens-violation-rating.md       |  2 +-
 .../common/json-web-tokens-violations.md      |  2 +-
 .../config/common/modifying-configurations.md |  2 +-
 .../nginx-app-protect-waf-terminology.md      |  2 +-
 .../common/override-rules-errors-warnings.md  |  2 +-
 .../override-rules-logging-reporting.md       |  2 +-
 .../config/common/override-rules-overview.md  |  2 +-
 .../parameters-and-user-defined-urls.md       |  2 +-
 .../config/common/partial-masking-of-data.md  |  2 +-
 .../common/policy-authoring-and-tuning.md     |  2 +-
 .../config/common/policy-configuration.md     |  2 +-
 .../protocol-buffers-supported-version.md     |  2 +-
 .../signature-sets-in-default-policy.md       |  2 +-
 .../nap-waf/config/common/signature-sets.md   |  2 +-
 .../config/common/signature-settings.md       |  2 +-
 .../config/common/supported-violations.md     | 68 +++++++++----------
 .../config/common/time-based-sig-config.md    |  2 +-
 .../common/time-based-sig-enforce-mod-sig.md  |  2 +-
 .../common/time-based-sig-latest-cert-time.md |  4 +-
 .../common/time-based-sig-log-report.md       |  4 +-
 .../common/time-based-sig-new-policy.md       |  2 +-
 .../config/common/time-based-sig-overview.md  |  2 +-
 .../common/time-based-sig-update-sig.md       |  2 +-
 .../common/types-of-openapi-references.md     |  2 +-
 .../config/common/types-of-references.md      |  2 +-
 .../common/unsupported-configuration.md       |  2 +-
 .../common/user-defined-browser-control.md    |  2 +-
 .../common/user-defined-signature-sets.md     |  2 +-
 .../config/common/user-defined-signatures.md  |  2 +-
 .../nap-waf/config/common/violations.md       |  2 +-
 .../includes/nap-waf/default-conf-hostname.md |  2 +-
 .../nap-waf/default-conf-localhost.md         |  2 +-
 .../includes/nap-waf/download-certificates.md |  2 +-
 .../how-to/bidirectional-configuration.md     |  2 +-
 .../nap-waf/nginx-conf-hostname-docker.md     |  2 +-
 .../includes/nap-waf/nginx-conf-localhost.md  |  2 +-
 .../includes/nap-waf/setup-docker-registry.md |  2 +-
 .../nap-waf/upgrade-recompile-warning.md      |  4 +-
 .../delay-pod-termination-overview.md         |  2 +-
 .../termination-grace-period.md               |  2 +-
 .../expose-nginx-gateway-fabric.md            |  2 +-
 .../installation/helm/pulling-the-chart.md    |  2 +-
 ...stall-gateway-api-experimental-features.md |  2 +-
 .../install-gateway-api-resources.md          |  2 +-
 .../ngf/installation/jwt-password-note.md     |  2 +-
 .../nginx-plus/docker-registry-secret.md      |  2 +-
 .../installation/nginx-plus/download-jwt.md   |  2 +-
 .../nginx-plus/nginx-plus-secret.md           |  2 +-
 .../uninstall-gateway-api-resources.md        |  2 +-
 .../ngf/installation/upgrade-api-resources.md |  4 +-
 .../nginx-one/staged-config-overview.md       |  2 +-
 .../pin-to-version/pin-debian-ubuntu-R32.md   |  2 +-
 .../install/pin-to-version/pin-rhel7-R32.md   |  4 +-
 .../install/pin-to-version/pin-rhel8-R32.md   |  4 +-
 .../install/pin-to-version/pin-rhel9-R32.md   |  4 +-
 .../usage-tracking/agentless-reporting.md     |  2 +-
 .../get-list-k8s-deployments.md               |  2 +-
 .../usage-tracking/http-health-check.md       |  2 +-
 .../usage-tracking/install-nginx-agent.md     |  2 +-
 .../nginx-plus/usage-tracking/install-nim.md  |  2 +-
 .../nginx-plus/usage-tracking/overview.md     |  2 +-
 .../usage-tracking/view-nginx-plus-count.md   |  2 +-
 .../logging-analysis-azure-storage.md         |  2 +-
 .../logging-analysis-logs-analytics.md        |  2 +-
 .../logging-config-access-logs.md             |  2 +-
 .../logging-config-error-logs.md              |  2 +-
 .../nginxaas-azure/logging-limitations.md     |  2 +-
 .../nginxaas-azure/ncu-description.md         |  2 +-
 .../nginxaas-azure/ssl-tls-prerequisites.md   |  2 +-
 .../nginxaas-azure/terraform-prerequisites.md |  2 +-
 .../nginxaas-azure/terraform-resources.md     |  2 +-
 .../nic/configuration/access-control.md       |  2 +-
 .../configuration/configuration-examples.md   |  2 +-
 .../command-line-arguments.md                 |  2 +-
 .../configmap-resource.md                     |  8 +--
 .../global-configuration/custom-templates.md  |  2 +-
 .../globalconfiguration-resource.md           |  2 +-
 .../mgmt-configmap-resource.md                |  4 +-
 .../reporting-resources-status.md             |  2 +-
 .../host-and-listener-collisions.md           |  2 +-
 ...advanced-configuration-with-annotations.md |  2 +-
 .../advanced-configuration-with-snippets.md   | 10 +--
 .../ingress-resources/basic-configuration.md  |  6 +-
 .../cross-namespace-configuration.md          |  2 +-
 .../ingress-resources/custom-annotations.md   |  2 +-
 .../nic/configuration/policy-resource.md      |  4 +-
 .../includes/nic/configuration/security.md    |  2 +-
 .../configuration/transportserver-resource.md |  2 +-
 ...server-and-virtualserverroute-resources.md |  2 +-
 .../installation/create-common-resources.md   |  2 +-
 .../installation/create-custom-resources.md   |  2 +-
 .../nic/installation/deploy-controller.md     |  2 +-
 .../includes/nic/installation/download-jwt.md |  2 +-
 .../nic/installation/jwt-password-note.md     |  2 +-
 .../nic/installation/manifests/daemonset.md   |  2 +-
 .../nic/installation/manifests/deployment.md  |  2 +-
 .../manifests/verify-pods-are-running.md      |  2 +-
 content/includes/nic/rbac/set-up-rbac.md      |  2 +-
 .../auth/basic-auth-api-requests.md           |  2 +-
 .../admin-guide/license/add-license-webui.md  |  2 +-
 .../nim/clickhouse/clickhouse-defaults.md     |  2 +-
 .../decoupling/note-legacy-nms-references.md  |  2 +-
 .../license-usage-offline-script.md           | 10 +--
 .../set-mode-of-operation-disconnected.md     |  2 +-
 .../nim/docker/docker-registry-login.md       |  4 +-
 .../includes/nim/how-to-access-api-docs.md    |  2 +-
 content/includes/nim/how-to-access-nim-api.md |  2 +-
 .../nim/kubernetes/access-webui-helm.md       |  2 +-
 .../nms-chart-supported-module-versions.md    |  2 +-
 .../nim/nap-waf/restart-nms-integrations.md   |  2 +-
 .../nim/rbac/assign-roles-to-user-groups.md   |  2 +-
 .../nim/rbac/assign-roles-to-users.md         |  2 +-
 content/includes/nim/rbac/create-roles.md     |  2 +-
 .../includes/nim/rbac/create-user-groups.md   |  2 +-
 content/includes/nim/rbac/what-is-rbac.md     |  2 +-
 .../nim/tech-specs/nim-app-protect-support.md |  2 +-
 .../nim/tech-specs/supported-distros.md       |  2 +-
 .../tech-specs/supported-nginx-versions.md    |  2 +-
 .../additional-templating-resources.md        |  2 +-
 content/includes/nim/webui-nim-login.md       |  2 +-
 .../nms/services/platform-services.md         |  2 +-
 .../includes/security/jwt-password-note.md    |  6 +-
 content/includes/security/rbac-intro.md       |  2 +-
 .../includes/support/how-to-get-support.md    |  2 +-
 content/mesh/about/architecture.md            |  2 +-
 content/mesh/about/mesh-tech-specs.md         |  2 +-
 content/mesh/about/what-is-nsm.md             |  2 +-
 .../mesh/get-started/install/configuration.md |  2 +-
 .../get-started/install/install-with-helm.md  |  2 +-
 content/mesh/get-started/install/install.md   |  2 +-
 .../mesh/get-started/platform-setup/gke.md    |  2 +-
 .../get-started/platform-setup/kubeadm.md     |  2 +-
 .../get-started/platform-setup/kubespray.md   |  2 +-
 .../get-started/platform-setup/openshift.md   |  2 +-
 .../platform-setup/persistent-storage.md      |  2 +-
 .../mesh/get-started/platform-setup/rke.md    |  2 +-
 .../platform-setup/supported-platforms.md     |  2 +-
 .../uninstall/uninstall-with-helm.md          |  2 +-
 .../mesh/get-started/uninstall/uninstall.md   |  2 +-
 .../get-started/upgrade/upgrade-with-helm.md  |  2 +-
 content/mesh/get-started/upgrade/upgrade.md   |  2 +-
 content/mesh/guides/inject-sidecar-proxy.md   |  2 +-
 content/mesh/guides/monitoring-and-tracing.md |  2 +-
 content/mesh/guides/private-registry.md       |  2 +-
 content/mesh/guides/production-tuning.md      |  2 +-
 content/mesh/guides/prometheus-metrics.md     |  2 +-
 content/mesh/guides/secure-traffic-mtls.md    |  2 +-
 content/mesh/guides/smi-traffic-metrics.md    |  2 +-
 content/mesh/guides/smi-traffic-policies.md   |  2 +-
 content/mesh/guides/v1alpha1-ratelimit.md     |  8 +--
 content/mesh/reference/api-usage.md           |  2 +-
 content/mesh/reference/nginx-meshctl.md       |  2 +-
 content/mesh/reference/permissions.md         |  2 +-
 content/mesh/releases/release-notes-0.5.0.md  |  2 +-
 content/mesh/releases/release-notes-0.6.0.md  |  2 +-
 content/mesh/releases/release-notes-0.7.0.md  |  2 +-
 content/mesh/releases/release-notes-0.8.0.md  |  2 +-
 content/mesh/releases/release-notes-0.9.0.md  |  2 +-
 content/mesh/releases/release-notes-0.9.1.md  |  2 +-
 content/mesh/releases/release-notes-1.0.0.md  |  2 +-
 content/mesh/releases/release-notes-1.0.1.md  |  2 +-
 content/mesh/releases/release-notes-1.1.0.md  |  2 +-
 content/mesh/releases/release-notes-1.2.0.md  |  2 +-
 content/mesh/releases/release-notes-1.2.1.md  |  2 +-
 content/mesh/releases/release-notes-1.3.0.md  |  2 +-
 content/mesh/releases/release-notes-1.3.1.md  |  2 +-
 content/mesh/releases/release-notes-1.4.0.md  |  2 +-
 content/mesh/releases/release-notes-1.4.1.md  |  2 +-
 content/mesh/releases/release-notes-1.5.0.md  |  2 +-
 content/mesh/releases/release-notes-1.6.0.md  |  2 +-
 content/mesh/releases/release-notes-1.7.0.md  |  2 +-
 content/mesh/releases/release-notes-2.0.0.md  |  2 +-
 content/mesh/support/contact-support.md       |  2 +-
 .../tutorials/accesscontrol-walkthrough.md    |  2 +-
 content/mesh/tutorials/deploy-example-app.md  |  2 +-
 content/mesh/tutorials/kic/deploy-with-kic.md |  2 +-
 .../mesh/tutorials/kic/egress-walkthrough.md  |  2 +-
 .../tutorials/kic/ingress-udp-walkthrough.md  |  2 +-
 .../mesh/tutorials/kic/ingress-walkthrough.md |  2 +-
 content/mesh/tutorials/observability.md       |  2 +-
 .../mesh/tutorials/ratelimit-walkthrough.md   |  2 +-
 .../tutorials/trafficsplit-deployments.md     |  2 +-
 ...us-modsecurity-waf-installation-logging.md |  2 +-
 .../nginx-plus-modsecurity-waf-owasp-crs.md   |  2 +-
 ...security-waf-trustwave-spiderlabs-rules.md |  2 +-
 content/modsec-waf/technical-specs.md         |  2 +-
 ...with-dos-and-waf-on-amazon-web-services.md |  2 +-
 .../learn-about-deployment.md                 | 10 +--
 .../learn-about-directives-and-policy.md      |  2 +-
 content/nap-dos/monitoring/access-log.md      |  2 +-
 .../monitoring/live-activity-monitoring.md    |  2 +-
 content/nap-dos/monitoring/operation-log.md   |  2 +-
 content/nap-dos/monitoring/security-log.md    |  2 +-
 content/nap-dos/monitoring/types-of-logs.md   |  2 +-
 content/nap-dos/releases/about-1.0.md         |  2 +-
 content/nap-dos/releases/about-1.1.0.md       |  2 +-
 content/nap-dos/releases/about-1.1.1.md       |  2 +-
 content/nap-dos/releases/about-1.2.0.md       |  2 +-
 content/nap-dos/releases/about-2.0.md         |  2 +-
 content/nap-dos/releases/about-2.1.md         |  2 +-
 content/nap-dos/releases/about-2.2.md         |  2 +-
 content/nap-dos/releases/about-2.3.md         |  2 +-
 content/nap-dos/releases/about-2.4.md         |  2 +-
 content/nap-dos/releases/about-3.0.md         |  2 +-
 content/nap-dos/releases/about-3.1.md         |  2 +-
 content/nap-dos/releases/about-4.0.md         |  2 +-
 content/nap-dos/releases/about-4.1.md         |  2 +-
 content/nap-dos/releases/about-4.2.md         |  2 +-
 content/nap-dos/releases/about-4.3.md         |  2 +-
 content/nap-dos/releases/about-4.4.md         |  2 +-
 content/nap-dos/releases/about-4.5.md         |  8 +--
 content/nap-dos/releases/about-4.6.md         |  8 +--
 .../how-to-troubleshoot.md                    |  2 +-
 content/nap-waf/v4/admin-guide/install-nms.md |  2 +-
 content/nap-waf/v4/admin-guide/install.md     | 38 +++++------
 .../nap-waf/v4/admin-guide/upgrade-nap-waf.md |  2 +-
 .../v4/configuration-guide/configuration.md   |  4 +-
 .../nap-waf/v4/declarative-policy/policy.md   |  2 +-
 .../nap-waf/v4/logging-overview/access-log.md |  2 +-
 .../nap-waf/v4/logging-overview/debug-logs.md |  2 +-
 .../v4/logging-overview/logs-overview.md      |  2 +-
 .../v4/logging-overview/operation-logs.md     |  2 +-
 .../v4/logging-overview/security-log.md       |  2 +-
 content/nap-waf/v4/releases/about-1.0.md      |  2 +-
 content/nap-waf/v4/releases/about-1.1.md      |  2 +-
 content/nap-waf/v4/releases/about-1.2.md      |  2 +-
 content/nap-waf/v4/releases/about-1.3.md      |  2 +-
 content/nap-waf/v4/releases/about-2.0.md      |  2 +-
 content/nap-waf/v4/releases/about-2.1.md      |  2 +-
 content/nap-waf/v4/releases/about-2.2.md      |  2 +-
 content/nap-waf/v4/releases/about-2.3.md      |  2 +-
 content/nap-waf/v4/releases/about-3.0.md      |  2 +-
 content/nap-waf/v4/releases/about-3.1.md      |  2 +-
 content/nap-waf/v4/releases/about-3.10.md     |  2 +-
 content/nap-waf/v4/releases/about-3.11.md     |  2 +-
 content/nap-waf/v4/releases/about-3.12.2.md   |  2 +-
 content/nap-waf/v4/releases/about-3.12.md     |  2 +-
 content/nap-waf/v4/releases/about-3.2.md      |  2 +-
 content/nap-waf/v4/releases/about-3.3.md      |  2 +-
 content/nap-waf/v4/releases/about-3.4.md      |  2 +-
 content/nap-waf/v4/releases/about-3.5.md      |  2 +-
 content/nap-waf/v4/releases/about-3.6.md      |  2 +-
 content/nap-waf/v4/releases/about-3.7.md      |  2 +-
 content/nap-waf/v4/releases/about-3.8.md      |  2 +-
 content/nap-waf/v4/releases/about-3.9.1.md    |  2 +-
 content/nap-waf/v4/releases/about-3.9.md      |  2 +-
 content/nap-waf/v4/releases/about-4.0.md      |  2 +-
 content/nap-waf/v4/releases/about-4.1.md      |  2 +-
 content/nap-waf/v4/releases/about-4.10.md     |  6 +-
 content/nap-waf/v4/releases/about-4.11.md     |  2 +-
 content/nap-waf/v4/releases/about-4.12.md     |  2 +-
 content/nap-waf/v4/releases/about-4.13.md     |  2 +-
 content/nap-waf/v4/releases/about-4.14.md     |  2 +-
 content/nap-waf/v4/releases/about-4.15.md     |  8 +--
 content/nap-waf/v4/releases/about-4.2.md      |  2 +-
 content/nap-waf/v4/releases/about-4.3.md      |  2 +-
 content/nap-waf/v4/releases/about-4.4.md      |  2 +-
 content/nap-waf/v4/releases/about-4.5.md      |  2 +-
 content/nap-waf/v4/releases/about-4.6.md      |  2 +-
 content/nap-waf/v4/releases/about-4.7.md      |  2 +-
 content/nap-waf/v4/releases/about-4.8.1.md    |  2 +-
 content/nap-waf/v4/releases/about-4.8.md      |  2 +-
 content/nap-waf/v4/releases/about-4.9.md      |  2 +-
 .../troubleshooting-guide/troubleshooting.md  |  2 +-
 content/nap-waf/v5/admin-guide/compiler.md    |  2 +-
 .../v5/admin-guide/deploy-on-docker.md        |  2 +-
 .../v5/admin-guide/deploy-with-helm.md        |  8 +--
 .../v5/admin-guide/deploy-with-manifests.md   |  6 +-
 content/nap-waf/v5/admin-guide/install.md     |  4 +-
 content/nap-waf/v5/admin-guide/overview.md    |  2 +-
 .../nap-waf/v5/admin-guide/upgrade-nap-waf.md |  2 +-
 .../v5/configuration-guide/configuration.md   |  2 +-
 .../nap-waf/v5/declarative-policy/policy.md   |  2 +-
 .../nap-waf/v5/logging-overview/access-log.md |  2 +-
 .../v5/logging-overview/logs-overview.md      |  2 +-
 .../v5/logging-overview/security-log.md       |  2 +-
 content/nap-waf/v5/releases/about-5.0.md      |  2 +-
 content/nap-waf/v5/releases/about-5.1.md      |  2 +-
 content/nap-waf/v5/releases/about-5.2.md      |  2 +-
 content/nap-waf/v5/releases/about-5.3.md      |  2 +-
 content/nap-waf/v5/releases/about-5.4.md      |  2 +-
 content/nap-waf/v5/releases/about-5.5.md      |  2 +-
 content/nap-waf/v5/releases/about-5.6.md      |  2 +-
 content/nap-waf/v5/releases/about-5.7.md      |  8 +--
 .../troubleshooting-guide/troubleshooting.md  |  2 +-
 content/nginx-one/about.md                    |  2 +-
 content/nginx-one/api/api-reference-guide.md  |  2 +-
 content/nginx-one/api/authentication.md       |  2 +-
 content/nginx-one/changelog.md                |  2 +-
 ...ginx-plus-container-images-to-nginx-one.md |  2 +-
 .../create-manage-data-plane-keys.md          |  2 +-
 .../set-up-nginx-proxy-for-nginx-one.md       |  2 +-
 content/nginx-one/getting-started.md          |  4 +-
 content/nginx-one/glossary.md                 |  2 +-
 content/nginx-one/nginx-configs/add-file.md   |  2 +-
 .../certificates/manage-certificates.md       |  2 +-
 .../clean-up-unavailable-instances.md         |  2 +-
 .../config-sync-groups/add-file-csg.md        |  2 +-
 .../manage-config-sync-groups.md              |  2 +-
 content/nginx-one/rbac/overview.md            |  2 +-
 content/nginx-one/rbac/rbac-api.md            |  4 +-
 content/nginx-one/rbac/roles.md               |  4 +-
 .../managing-configuration-files.md           |  4 +-
 .../basic-functionality/runtime-control.md    |  2 +-
 .../content-cache/content-caching.md          |  2 +-
 .../admin-guide/dynamic-modules/brotli.md     |  2 +-
 .../dynamic-modules/cookie-flag.md            |  2 +-
 .../dynamic-modules/dynamic-modules.md        |  6 +-
 .../dynamic-modules/encrypted-session.md      |  2 +-
 .../nginx/admin-guide/dynamic-modules/fips.md |  2 +-
 .../admin-guide/dynamic-modules/geoip.md      |  2 +-
 .../admin-guide/dynamic-modules/geoip2.md     |  2 +-
 .../dynamic-modules/headers-more.md           |  2 +-
 .../http-substitutions-filter.md              |  2 +-
 .../dynamic-modules/image-filter.md           |  2 +-
 .../nginx/admin-guide/dynamic-modules/lua.md  |  2 +-
 .../nginx/admin-guide/dynamic-modules/ndk.md  |  2 +-
 .../admin-guide/dynamic-modules/nginscript.md |  2 +-
 .../admin-guide/dynamic-modules/nginx-waf.md  |  2 +-
 .../dynamic-modules/opentelemetry.md          |  2 +-
 .../dynamic-modules/opentracing.md            |  2 +-
 .../dynamic-modules/passenger-open-source.md  |  2 +-
 .../nginx/admin-guide/dynamic-modules/perl.md |  2 +-
 .../dynamic-modules/prometheus-njs.md         |  2 +-
 .../nginx/admin-guide/dynamic-modules/rtmp.md |  2 +-
 .../admin-guide/dynamic-modules/set-misc.md   |  2 +-
 .../admin-guide/dynamic-modules/spnego.md     |  2 +-
 .../admin-guide/dynamic-modules/uninstall.md  |  4 +-
 .../nginx/admin-guide/dynamic-modules/xslt.md |  2 +-
 .../configuration-sharing.md                  |  2 +-
 .../high-availability/ha-keepalived-nodes.md  |  2 +-
 .../high-availability/ha-keepalived.md        |  2 +-
 .../high-availability/zone_sync.md            |  2 +-
 .../high-availability/zone_sync_details.md    |  2 +-
 .../installing-nginx-docker.md                |  4 +-
 .../installing-nginx-open-source.md           |  6 +-
 ...stalling-nginx-plus-amazon-web-services.md |  2 +-
 ...alling-nginx-plus-google-cloud-platform.md |  2 +-
 .../installing-nginx-plus-microsoft-azure.md  |  2 +-
 .../installing-nginx/installing-nginx-plus.md |  6 +-
 .../dynamic-configuration-api.md              |  2 +-
 .../load-balancer/grpc-health-check.md        |  2 +-
 .../load-balancer/http-health-check.md        |  2 +-
 .../load-balancer/http-load-balancer.md       |  8 +--
 .../load-balancer/tcp-health-check.md         |  2 +-
 .../load-balancer/tcp-udp-load-balancer.md    |  2 +-
 .../load-balancer/udp-health-check.md         |  4 +-
 .../load-balancer/using-proxy-protocol.md     |  2 +-
 .../admin-guide/mail-proxy/mail-proxy.md      |  2 +-
 .../nginx/admin-guide/monitoring/debugging.md |  2 +-
 .../monitoring/diagnostic-package.md          |  2 +-
 .../monitoring/live-activity-monitoring.md    |  2 +-
 .../nginx/admin-guide/monitoring/logging.md   |  6 +-
 .../monitoring/new-relic-plugin.md            |  2 +-
 .../configuring-http-basic-authentication.md  |  2 +-
 .../configuring-jwt-authentication.md         |  2 +-
 .../security-controls/configuring-oidc.md     | 10 +--
 .../configuring-subrequest-authentication.md  |  2 +-
 .../controlling-access-by-geoip.md            |  2 +-
 .../controlling-access-proxied-http.md        |  2 +-
 .../controlling-access-proxied-tcp.md         |  2 +-
 .../denylisting-ip-addresses.md               |  2 +-
 .../securing-http-traffic-upstream.md         |  4 +-
 .../securing-tcp-traffic-upstream.md          |  4 +-
 .../security-controls/terminating-ssl-http.md |  2 +-
 .../security-controls/terminating-ssl-tcp.md  |  2 +-
 .../web-server/app-gateway-uwsgi-django.md    |  2 +-
 .../admin-guide/web-server/compression.md     |  2 +-
 .../admin-guide/web-server/reverse-proxy.md   |  6 +-
 .../web-server/serving-static-content.md      |  2 +-
 .../admin-guide/web-server/web-server.md      |  2 +-
 .../ec2-instances-for-nginx.md                |  2 +-
 .../high-availability-keepalived.md           |  2 +-
 ...high-availability-network-load-balancer.md |  2 +-
 ...-controller-elastic-kubernetes-services.md | 16 ++---
 .../route-53-global-server-load-balancing.md  |  2 +-
 .../ns1-global-server-load-balancing.md       |  2 +-
 .../high-availability-all-active.md           |  2 +-
 .../load-balance-third-party/apache-tomcat.md |  2 +-
 .../microsoft-exchange.md                     |  2 +-
 .../load-balance-third-party/node-js.md       |  2 +-
 .../oracle-e-business-suite.md                |  2 +-
 .../oracle-weblogic-server.md                 |  2 +-
 .../load-balance-third-party/wildfly.md       |  2 +-
 ...igh-availability-standard-load-balancer.md |  2 +-
 .../virtual-machines-for-nginx.md             |  2 +-
 .../citrix-adc-configuration.md               |  2 +-
 .../f5-big-ip-configuration.md                |  2 +-
 .../nginx-plus-high-availability-chef.md      |  2 +-
 .../setting-up-nginx-demo-environment.md      |  2 +-
 .../active-directory-federation-services.md   |  2 +-
 .../deployment-guides/single-sign-on/auth0.md |  4 +-
 .../single-sign-on/cognito.md                 |  6 +-
 .../single-sign-on/entra-id.md                |  6 +-
 .../single-sign-on/keycloak.md                |  8 +--
 .../active-directory-federation-services.md   |  2 +-
 .../single-sign-on/oidc-njs/auth0.md          |  2 +-
 .../single-sign-on/oidc-njs/cognito.md        |  2 +-
 .../single-sign-on/oidc-njs/keycloak.md       |  2 +-
 .../single-sign-on/oidc-njs/okta.md           |  2 +-
 .../single-sign-on/oidc-njs/onelogin.md       |  2 +-
 .../single-sign-on/oidc-njs/ping-identity.md  |  2 +-
 .../deployment-guides/single-sign-on/okta.md  |  2 +-
 .../single-sign-on/onelogin.md                |  2 +-
 .../single-sign-on/ping-identity.md           |  4 +-
 content/nginx/directives.md                   |  2 +-
 content/nginx/fips-compliance-nginx-plus.md   |  2 +-
 content/nginx/open-source-components.md       |  2 +-
 content/nginx/releases.md                     |  2 +-
 content/nginx/technical-specs.md              |  2 +-
 content/nginx/variables.md                    |  2 +-
 content/nginxaas-azure/billing/overview.md    |  2 +-
 .../billing/usage-and-cost-estimator.md       |  2 +-
 content/nginxaas-azure/changelog.md           |  2 +-
 content/nginxaas-azure/client-tools/cli.md    |  2 +-
 content/nginxaas-azure/client-tools/sdk.md    |  2 +-
 .../nginxaas-azure/client-tools/templates.md  |  2 +-
 .../nginxaas-azure/client-tools/terraform.md  |  2 +-
 content/nginxaas-azure/get-help.md            |  2 +-
 .../create-deployment/deploy-azure-portal.md  |  2 +-
 .../managed-identity-portal.md                |  2 +-
 .../nginx-configuration-portal.md             |  2 +-
 .../getting-started/prerequisites.md          |  2 +-
 .../ssl-tls-certificates-portal.md            |  2 +-
 content/nginxaas-azure/known-issues.md        |  6 +-
 .../monitoring/configure-alerts.md            |  2 +-
 .../enable-logging/logging-using-cli.md       |  2 +-
 .../enable-logging/logging-using-portal.md    |  2 +-
 .../enable-logging/logging-using-terraform.md |  2 +-
 .../monitoring/enable-monitoring.md           |  2 +-
 .../monitoring/metrics-catalog.md             |  2 +-
 .../overview/feature-comparison.md            |  2 +-
 content/nginxaas-azure/overview/overview.md   |  2 +-
 .../quickstart/basic-caching.md               |  2 +-
 .../quickstart/hosting-static-content.md      |  2 +-
 .../nginxaas-azure/quickstart/njs-support.md  |  2 +-
 .../quickstart/rate-limiting.md               |  2 +-
 content/nginxaas-azure/quickstart/recreate.md |  2 +-
 .../quickstart/runtime-state-sharing.md       |  2 +-
 content/nginxaas-azure/quickstart/scaling.md  |  2 +-
 .../security-controls/auth-basic.md           |  2 +-
 .../quickstart/security-controls/jwt.md       |  2 +-
 .../quickstart/security-controls/oidc.md      |  2 +-
 .../securing-upstream-traffic.md              |  2 +-
 .../quickstart/upgrade-channels.md            |  2 +-
 content/nim/admin-guide/add-license.md        |  2 +-
 .../basic-auth/set-up-basic-authentication.md |  2 +-
 .../authentication/oidc/getting-started.md    |  2 +-
 .../authentication/oidc/keycloak-setup.md     |  2 +-
 .../oidc/microsoft-entra-automation.md        |  2 +-
 .../oidc/microsoft-entra-setup.md             |  2 +-
 .../authentication/oidc/scim-provisioning.md  |  2 +-
 .../maintenance/backup-and-recovery.md        |  2 +-
 .../maintenance/sqlite-installation.md        |  2 +-
 content/nim/admin-guide/rbac/assign-roles.md  |  2 +-
 content/nim/admin-guide/rbac/create-roles.md  |  2 +-
 .../rbac/manage-resource-groups.md            |  2 +-
 content/nim/admin-guide/rbac/overview-rbac.md |  2 +-
 .../report-usage-connected-deployment.md      |  2 +-
 ...y-nginx-instance-manager-docker-compose.md |  6 +-
 .../deploy-nginx-plus-and-agent-docker.md     |  2 +-
 .../build-and-deploy.md                       |  2 +-
 .../infrastructure-as-code/configuration.md   |  2 +-
 .../deploy/infrastructure-as-code/overview.md |  2 +-
 .../deploy/kubernetes/deploy-using-helm.md    |  6 +-
 .../frequently-used-helm-configs.md           |  2 +-
 .../deploy/kubernetes/helm-config-settings.md |  4 +-
 .../vm-bare-metal/install-nim-manual.md       |  2 +-
 .../add-license-disconnected-deployment.md    |  8 +--
 .../offline-install-guide-manual.md           |  2 +-
 .../nim/disconnected/offline-install-guide.md |  2 +-
 .../report-usage-disconnected-deployment.md   | 10 +--
 content/nim/fundamentals/api-overview.md      |  2 +-
 .../nim/fundamentals/dashboard-overview.md    |  2 +-
 content/nim/fundamentals/tech-specs.md        |  2 +-
 content/nim/monitoring/catalogs/dimensions.md |  2 +-
 content/nim/monitoring/catalogs/events.md     |  2 +-
 content/nim/monitoring/catalogs/metrics.md    |  2 +-
 content/nim/monitoring/metrics-api.md         |  2 +-
 content/nim/monitoring/overview-metrics.md    |  2 +-
 content/nim/monitoring/view-events-metrics.md |  2 +-
 .../manage-waf-security-policies.md           | 30 ++++----
 .../overview-nap-waf-config-management.md     | 20 +++---
 ...ccess-to-security-monitoring-dashboards.md |  2 +-
 .../set-up-app-protect-instances.md           |  2 +-
 .../security-monitoring/troubleshooting.md    |  2 +-
 .../security-monitoring/update-geo-db.md      |  2 +-
 .../security-monitoring/update-signatures.md  |  2 +-
 .../setup-waf-config-management.md            | 10 +--
 .../concepts/augment-templates.md             |  2 +-
 .../concepts/config-templates.md              |  2 +-
 .../concepts/default-base-template.md         |  2 +-
 .../concepts/template-resources.md            |  2 +-
 .../manage-nginx-configs-with-templates.md    |  2 +-
 .../rbac-config-templates-and-submissions.md  |  2 +-
 .../reference/json-schema-reference.md        |  2 +-
 .../tutorials/round-robin-reverse-proxy.md    |  2 +-
 .../publish-configs-version-control.md        |  2 +-
 content/nim/nginx-configs/publish-configs.md  |  2 +-
 content/nim/nginx-configs/stage-configs.md    |  2 +-
 content/nim/nginx-instances/add-tags.md       |  2 +-
 .../nginx-instances/manage-certificates.md    |  2 +-
 .../nginx-instances/manage-instance-groups.md |  2 +-
 content/nim/nginx-instances/scan-instances.md |  2 +-
 content/nim/releases/known-issues.md          |  2 +-
 content/nim/releases/release-notes.md         |  2 +-
 content/nim/support/contact-support.md        |  2 +-
 content/nim/support/k8s-support-package.md    |  2 +-
 content/nim/support/support-package.md        |  2 +-
 .../configure-clickhouse.md                   |  6 +-
 .../system-configuration/configure-gateway.md |  4 +-
 .../system-configuration/configure-selinux.md |  2 +-
 .../configure-telemetry.md                    |  2 +-
 .../system-configuration/configure-vault.md   |  2 +-
 .../configure-with-config.md                  |  2 +-
 .../system-configuration/secure-traffic.md    |  2 +-
 content/nim/troubleshooting.md                |  2 +-
 content/nms/about.md                          |  2 +-
 content/nms/acm/about/api-overview.md         |  2 +-
 content/nms/acm/about/architecture.md         |  2 +-
 content/nms/acm/about/introduction.md         |  2 +-
 content/nms/acm/about/policies-overview.md    |  2 +-
 content/nms/acm/about/rbac-roles.md           |  2 +-
 .../nms/acm/about/technical-specifications.md |  2 +-
 .../acm/getting-started/add-api-gateway.md    |  2 +-
 .../nms/acm/getting-started/add-devportal.md  |  2 +-
 content/nms/acm/getting-started/overview.md   |  2 +-
 .../acm/getting-started/publish-api-proxy.md  |  2 +-
 content/nms/acm/how-to/backup-recovery.md     |  2 +-
 .../how-to/deploy-api-connectivity-manager.md |  2 +-
 .../devportals/devportal-support-package.md   |  2 +-
 .../configure-devportal-helm-options.md       |  2 +-
 .../installation/devportal-helm-chart.md      |  2 +-
 .../installation/install-dev-portal.md        |  2 +-
 .../installation/install-devportal-offline.md |  2 +-
 .../how-to/devportals/publish-to-devportal.md |  2 +-
 .../configure-devportal-backend.md            |  2 +-
 .../infrastructure/customize-devportal.md     |  2 +-
 .../enable-create-credentials.md              |  2 +-
 .../infrastructure/enable-sso-devportal.md    |  2 +-
 .../manage-api-infrastructure.md              |  2 +-
 .../publish-developer-portal.md               |  2 +-
 content/nms/acm/how-to/install-acm-offline.md |  2 +-
 content/nms/acm/how-to/install-acm.md         |  2 +-
 .../how-to/policies/access-control-routing.md |  2 +-
 .../acm/how-to/policies/advanced-security.md  |  2 +-
 .../how-to/policies/allowed-http-methods.md   |  2 +-
 .../policies/api-access-control-lists.md      |  2 +-
 .../nms/acm/how-to/policies/apikey-authn.md   |  2 +-
 .../nms/acm/how-to/policies/basic-authn.md    |  2 +-
 .../how-to/policies/cluster-wide-config.md    |  2 +-
 .../acm/how-to/policies/cluster-zone-sync.md  |  2 +-
 content/nms/acm/how-to/policies/cors.md       |  2 +-
 .../how-to/policies/error-response-format.md  |  2 +-
 .../nms/acm/how-to/policies/grpc-policies.md  |  2 +-
 .../nms/acm/how-to/policies/health-check.md   |  2 +-
 .../policies/http-backend-configuration.md    |  2 +-
 .../nms/acm/how-to/policies/introspection.md  |  2 +-
 .../nms/acm/how-to/policies/jwt-assertion.md  |  2 +-
 content/nms/acm/how-to/policies/log-format.md |  2 +-
 .../acm/how-to/policies/manage-policies.md    |  2 +-
 .../nms/acm/how-to/policies/openID-connect.md |  2 +-
 .../nms/acm/how-to/policies/proxy-cache.md    |  2 +-
 .../how-to/policies/proxy-request-headers.md  |  2 +-
 .../how-to/policies/proxy-response-headers.md |  2 +-
 content/nms/acm/how-to/policies/rate-limit.md |  2 +-
 .../policies/request-body-size-limit.md       |  2 +-
 .../how-to/policies/request-correlation-id.md |  2 +-
 .../policies/request-header-specification.md  |  2 +-
 .../nms/acm/how-to/policies/tls-policies.md   |  2 +-
 .../nms/acm/how-to/services/publish-api.md    |  2 +-
 .../acm/how-to/services/publish-gRPC-proxy.md |  2 +-
 content/nms/acm/releases/known-issues.md      |  2 +-
 content/nms/acm/releases/release-notes.md     |  2 +-
 content/nms/acm/troubleshooting.md            |  2 +-
 content/nms/acm/tutorials/advanced-routing.md |  2 +-
 content/nms/acm/tutorials/aws-deploy.md       |  2 +-
 content/nms/acm/tutorials/enable-metrics.md   |  2 +-
 .../acm/tutorials/introspection-keycloak.md   |  2 +-
 .../nms/acm/tutorials/oas-security-schemes.md |  2 +-
 content/nms/acm/tutorials/rbac-api-owners.md  |  2 +-
 .../nms/acm/tutorials/rbac-infra-admins.md    |  2 +-
 .../nms/nginx-agent/install-nginx-agent.md    |  2 +-
 .../install-nginx-plus-advanced-metrics.md    |  2 +-
 .../getting-started/waf-config-management.md  |  2 +-
 content/nms/nms-resilience.md                 |  2 +-
 content/nms/oss-attribution-notice.md         |  2 +-
 content/nms/reference/catalogs/dimensions.md  |  2 +-
 content/nms/reference/catalogs/events.md      |  2 +-
 content/nms/reference/catalogs/metrics.md     |  2 +-
 content/nms/support/contact-support.md        |  2 +-
 content/nms/support/k8s-support-package.md    |  2 +-
 content/nms/support/support-package.md        |  2 +-
 content/ossc.md                               |  2 +-
 content/solutions/_index.md                   |  2 +-
 .../solutions/about-subscription-licenses.md  |  2 +-
 content/solutions/nginx-one-subscription.md   |  2 +-
 ...release-guidance-for-automatic-upgrades.md |  2 +-
 content/unit/about.md                         |  2 +-
 content/unit/certificates.md                  |  2 +-
 content/unit/changes.md                       |  2 +-
 content/unit/community.md                     |  2 +-
 content/unit/configuration.md                 |  2 +-
 content/unit/controlapi.md                    |  2 +-
 content/unit/howto/ansible.md                 |  2 +-
 content/unit/howto/apps/apollo.md             |  2 +-
 content/unit/howto/apps/bugzilla.md           |  2 +-
 content/unit/howto/apps/datasette.md          |  2 +-
 content/unit/howto/apps/dokuwiki.md           |  2 +-
 content/unit/howto/apps/drupal.md             |  2 +-
 content/unit/howto/apps/grafana.md            |  2 +-
 content/unit/howto/apps/jira.md               |  2 +-
 content/unit/howto/apps/joomla.md             |  2 +-
 content/unit/howto/apps/mailman.md            |  2 +-
 content/unit/howto/apps/matomo.md             |  2 +-
 content/unit/howto/apps/mediawiki.md          |  2 +-
 content/unit/howto/apps/mercurial.md          |  2 +-
 content/unit/howto/apps/modx.md               |  2 +-
 content/unit/howto/apps/moin.md               |  2 +-
 content/unit/howto/apps/nextcloud.md          |  2 +-
 content/unit/howto/apps/opengrok.md           |  2 +-
 content/unit/howto/apps/phpbb.md              |  2 +-
 content/unit/howto/apps/phpmyadmin.md         |  2 +-
 content/unit/howto/apps/plone.md              |  2 +-
 content/unit/howto/apps/redmine.md            |  2 +-
 content/unit/howto/apps/reviewboard.md        |  2 +-
 content/unit/howto/apps/roundcube.md          |  2 +-
 content/unit/howto/apps/trac.md               |  2 +-
 content/unit/howto/apps/wordpress.md          |  2 +-
 content/unit/howto/certbot.md                 |  2 +-
 content/unit/howto/docker.md                  |  2 +-
 content/unit/howto/frameworks/bottle.md       |  2 +-
 content/unit/howto/frameworks/cakephp.md      |  2 +-
 content/unit/howto/frameworks/catalyst.md     |  2 +-
 content/unit/howto/frameworks/codeigniter.md  |  2 +-
 content/unit/howto/frameworks/django.md       |  2 +-
 .../unit/howto/frameworks/djangochannels.md   |  2 +-
 content/unit/howto/frameworks/express.md      |  2 +-
 content/unit/howto/frameworks/falcon.md       |  2 +-
 content/unit/howto/frameworks/fastapi.md      |  2 +-
 content/unit/howto/frameworks/flask.md        |  2 +-
 content/unit/howto/frameworks/guillotina.md   |  2 +-
 content/unit/howto/frameworks/koa.md          |  2 +-
 content/unit/howto/frameworks/laravel.md      |  2 +-
 content/unit/howto/frameworks/lumen.md        |  2 +-
 content/unit/howto/frameworks/pyramid.md      |  2 +-
 content/unit/howto/frameworks/quart.md        |  2 +-
 content/unit/howto/frameworks/rails.md        |  2 +-
 content/unit/howto/frameworks/responder.md    |  2 +-
 content/unit/howto/frameworks/sanic.md        |  2 +-
 content/unit/howto/frameworks/springboot.md   |  2 +-
 content/unit/howto/frameworks/starlette.md    |  2 +-
 content/unit/howto/frameworks/symfony.md      |  2 +-
 content/unit/howto/frameworks/yii.md          |  2 +-
 content/unit/howto/frameworks/zope.md         |  2 +-
 content/unit/howto/integration.md             |  2 +-
 content/unit/howto/modules.md                 |  2 +-
 content/unit/howto/overview.md                |  2 +-
 content/unit/howto/samples.md                 |  2 +-
 content/unit/howto/security.md                |  2 +-
 content/unit/howto/source.md                  |  2 +-
 content/unit/howto/walkthrough.md             |  2 +-
 content/unit/installation.md                  |  2 +-
 content/unit/keyfeatures.md                   |  2 +-
 .../unit/news/2023/unit-1.30.0-released.md    |  2 +-
 .../unit/news/2023/unit-1.31.0-released.md    |  2 +-
 .../unit/news/2023/unit-1.31.1-released.md    |  2 +-
 .../unit/news/2024/fermyon-spin-rust-sdk.md   |  2 +-
 .../unit/news/2024/unit-1.32.0-released.md    |  2 +-
 .../unit/news/2024/unit-1.32.1-released.md    |  2 +-
 .../unit/news/2024/unit-1.33.0-released.md    |  2 +-
 .../unit/news/2024/unit-1.34.0-released.md    |  2 +-
 .../news/2024/wasm-component-model-part-1.md  |  2 +-
 .../news/2024/wasm-component-model-part-2.md  |  2 +-
 .../unit/news/2025/unit-1.34.1-released.md    |  2 +-
 .../unit/news/2025/unit-1.34.2-released.md    |  2 +-
 content/unit/news/archived-news/2018.md       |  2 +-
 content/unit/news/archived-news/2019.md       |  2 +-
 content/unit/news/archived-news/2020.md       |  2 +-
 content/unit/news/archived-news/2021.md       |  2 +-
 content/unit/news/archived-news/2022.md       |  2 +-
 content/unit/scripting.md                     |  2 +-
 content/unit/statusapi.md                     |  2 +-
 content/unit/troubleshooting.md               |  2 +-
 content/unit/unitctl.md                       |  2 +-
 938 files changed, 1156 insertions(+), 1156 deletions(-)

diff --git a/content/agent/changelog.md b/content/agent/changelog.md
index b0f79ce37..607f5a25f 100644
--- a/content/agent/changelog.md
+++ b/content/agent/changelog.md
@@ -2,7 +2,7 @@
 title: "Changelog"
 weight: 1200
 toc: true
-docs: "DOCS-1093"
+nd-docs: "DOCS-1093"
 ---
 
 {{< note >}}You can find the full changelog, contributor list and assets for NGINX Agent in the [GitHub repository](https://github.com/nginx/agent/releases).{{< /note >}}
diff --git a/content/agent/configuration/configuration-overview.md b/content/agent/configuration/configuration-overview.md
index 51e724fa2..d82ffec91 100644
--- a/content/agent/configuration/configuration-overview.md
+++ b/content/agent/configuration/configuration-overview.md
@@ -3,7 +3,7 @@ title: Basic configuration
 draft: false
 weight: 100
 toc: true
-docs: DOCS-1229
+nd-docs: DOCS-1229
 type:
 - how-to
 ---
@@ -50,7 +50,7 @@ server:
   # host of the control plane
   host: <FQDN>
   grpcPort: 443
-  backoff: # note: default values are prepopulated 
+  backoff: # note: default values are prepopulated
     initial_interval: 100ms # Add the appropriate duration value here, for example, "100ms" for 100 milliseconds, "5s" for 5 seconds, "1m" for 1 minute, "1h" for 1 hour
     randomization_factor: 0.10 # Add the appropriate float value here, for example, 0.10
     multiplier: 1.5 # Add the appropriate float value here, for example, 1.5
@@ -88,7 +88,7 @@ metrics:
   report_interval: 1m
   collection_interval: 15s
   mode: aggregated
-    backoff: # note: default values are prepopulated 
+    backoff: # note: default values are prepopulated
       initial_interval: 100ms # Add the appropriate duration value here, for example, "100ms" for 100 milliseconds, "5s" for 5 seconds, "1m" for 1 minute, "1h" for 1 hour
       randomization_factor: 0.10 # Add the appropriate float value here, for example, 0.10
       multiplier: 1.5 # Add the appropriate float value here, for example, 1.5
@@ -170,9 +170,9 @@ nginx-agent
 
 ### CLI Flags and Environment Variables
 
-{{< warning >}} 
+{{< warning >}}
 
-Before version 2.35.0, the environment variables were prefixed with `NMS_` instead of `NGINX_AGENT_`. 
+Before version 2.35.0, the environment variables were prefixed with `NMS_` instead of `NGINX_AGENT_`.
 
 If you are upgrading from an older version, update your configuration accordingly.
 
@@ -220,9 +220,9 @@ If you are upgrading from an older version, update your configuration accordingl
 <br>
 
 {{<note>}}
-Use the `--config-dirs` command-line option, or the `config_dirs` key in the `nginx-agent.conf` file, to identify the directories NGINX Agent can read from or write to. This setting also defines the location to which you can upload config files when using a control plane. 
+Use the `--config-dirs` command-line option, or the `config_dirs` key in the `nginx-agent.conf` file, to identify the directories NGINX Agent can read from or write to. This setting also defines the location to which you can upload config files when using a control plane.
 
-NGINX Agent cannot write to directories outside the specified location when updating a config and cannot upload files to directories outside of the configured location. 
+NGINX Agent cannot write to directories outside the specified location when updating a config and cannot upload files to directories outside of the configured location.
 
 NGINX Agent follows NGINX configuration directives to file paths outside the designated directories and reads certificates' metadata. NGINX Agent uses the following directives:
 
diff --git a/content/agent/configuration/configure-nginx-agent-features.md b/content/agent/configuration/configure-nginx-agent-features.md
index 486059eb4..4bf5b1b24 100644
--- a/content/agent/configuration/configure-nginx-agent-features.md
+++ b/content/agent/configuration/configure-nginx-agent-features.md
@@ -5,7 +5,7 @@ weight: 150
 toc: true
 type:
 - how-to
-docs: DOCS-1678
+nd-docs: DOCS-1678
 ---
 
 ## Overview
diff --git a/content/agent/configuration/configure-nginx-agent-group.md b/content/agent/configuration/configure-nginx-agent-group.md
index 47e6f15e0..772922178 100644
--- a/content/agent/configuration/configure-nginx-agent-group.md
+++ b/content/agent/configuration/configure-nginx-agent-group.md
@@ -3,7 +3,7 @@ title: Add NGINX users to nginx-agent Group
 draft: false
 weight: 300
 toc: true
-docs: DOCS-933
+nd-docs: DOCS-933
 type:
 - how-to
 ---
diff --git a/content/agent/configuration/encrypt-communication.md b/content/agent/configuration/encrypt-communication.md
index a7cf75134..6a1503cf6 100644
--- a/content/agent/configuration/encrypt-communication.md
+++ b/content/agent/configuration/encrypt-communication.md
@@ -2,7 +2,7 @@
 title: Encrypt communication
 toc: true
 weight: 200
-docs: DOCS-802
+nd-docs: DOCS-802
 ---
 
 ## Overview
diff --git a/content/agent/configuration/health-checks.md b/content/agent/configuration/health-checks.md
index 16a9bf53d..104311a9e 100644
--- a/content/agent/configuration/health-checks.md
+++ b/content/agent/configuration/health-checks.md
@@ -5,7 +5,7 @@ weight: 400
 toc: true
 type:
 - how-to
-docs: DOCS-1677
+nd-docs: DOCS-1677
 ---
 
 ## Overview
diff --git a/content/agent/contribute/community.md b/content/agent/contribute/community.md
index da54b13b0..80af280bf 100644
--- a/content/agent/contribute/community.md
+++ b/content/agent/contribute/community.md
@@ -3,7 +3,7 @@ title: Community and contribution
 draft: false
 weight: 100
 toc: true
-docs: DOCS-1087
+nd-docs: DOCS-1087
 type:
 - how-to
 ---
diff --git a/content/agent/contribute/dev-environment-setup.md b/content/agent/contribute/dev-environment-setup.md
index 7f75df9d8..b854af4c5 100644
--- a/content/agent/contribute/dev-environment-setup.md
+++ b/content/agent/contribute/dev-environment-setup.md
@@ -3,7 +3,7 @@ title: Development environment setup
 draft: false
 weight: 200
 toc: true
-docs: DOCS-1088
+nd-docs: DOCS-1088
 type:
 - how-to
 ---
diff --git a/content/agent/installation-upgrade/container-environments/docker-images.md b/content/agent/installation-upgrade/container-environments/docker-images.md
index d12f94e5e..2302bed3c 100644
--- a/content/agent/installation-upgrade/container-environments/docker-images.md
+++ b/content/agent/installation-upgrade/container-environments/docker-images.md
@@ -3,7 +3,7 @@ title: Build container images
 draft: false
 weight: 100
 toc: true
-docs: DOCS-1410
+nd-docs: DOCS-1410
 type:
 - how-to
 ---
diff --git a/content/agent/installation-upgrade/container-environments/docker-support.md b/content/agent/installation-upgrade/container-environments/docker-support.md
index 2f9c5eafc..d1d624799 100644
--- a/content/agent/installation-upgrade/container-environments/docker-support.md
+++ b/content/agent/installation-upgrade/container-environments/docker-support.md
@@ -3,7 +3,7 @@ title: Container support and troubleshooting
 draft: false
 toc: true
 weight: 200
-docs: DOCS-909
+nd-docs: DOCS-909
 type:
 - task
 ---
diff --git a/content/agent/installation-upgrade/getting-started.md b/content/agent/installation-upgrade/getting-started.md
index e3dc9f3a2..b8cbdb783 100644
--- a/content/agent/installation-upgrade/getting-started.md
+++ b/content/agent/installation-upgrade/getting-started.md
@@ -3,7 +3,7 @@ title: Getting started
 draft: false
 weight: 100
 toc: true
-docs: DOCS-1089
+nd-docs: DOCS-1089
 type:
 - how-to
 ---
diff --git a/content/agent/installation-upgrade/installation-github.md b/content/agent/installation-upgrade/installation-github.md
index 282f1e8d9..f2452d56c 100644
--- a/content/agent/installation-upgrade/installation-github.md
+++ b/content/agent/installation-upgrade/installation-github.md
@@ -3,7 +3,7 @@ title: Installation from GitHub release
 draft: false
 weight: 200
 toc: true
-docs: DOCS-1090
+nd-docs: DOCS-1090
 type:
 - how-to
 ---
diff --git a/content/agent/installation-upgrade/installation-oss.md b/content/agent/installation-upgrade/installation-oss.md
index 92c3a3306..251627629 100644
--- a/content/agent/installation-upgrade/installation-oss.md
+++ b/content/agent/installation-upgrade/installation-oss.md
@@ -3,7 +3,7 @@ title: Installation from NGINX repository
 draft: false
 weight: 300
 toc: true
-docs: DOCS-1216
+nd-docs: DOCS-1216
 type:
 - how-to
 ---
diff --git a/content/agent/installation-upgrade/installation-plus.md b/content/agent/installation-upgrade/installation-plus.md
index 6ee2482d4..c0d5fdf9f 100644
--- a/content/agent/installation-upgrade/installation-plus.md
+++ b/content/agent/installation-upgrade/installation-plus.md
@@ -3,7 +3,7 @@ title: Installation from NGINX Plus repository
 draft: false
 weight: 400
 toc: true
-docs: DOCS-1217
+nd-docs: DOCS-1217
 type:
 - how-to
 ---
diff --git a/content/agent/installation-upgrade/installation-unprivileged.md b/content/agent/installation-upgrade/installation-unprivileged.md
index 6f90985e8..1324bc27c 100644
--- a/content/agent/installation-upgrade/installation-unprivileged.md
+++ b/content/agent/installation-upgrade/installation-unprivileged.md
@@ -4,7 +4,7 @@ weight: 450
 toc: true
 type: how-to
 product: Agent
-docs: DOCS-1781
+nd-docs: DOCS-1781
 ---
 
 ## Overview
diff --git a/content/agent/installation-upgrade/uninstall.md b/content/agent/installation-upgrade/uninstall.md
index 2f783dbb6..dc356c2f5 100644
--- a/content/agent/installation-upgrade/uninstall.md
+++ b/content/agent/installation-upgrade/uninstall.md
@@ -3,7 +3,7 @@ title: Uninstall NGINX Agent package
 draft: false
 weight: 700
 toc: true
-docs: DOCS-1230
+nd-docs: DOCS-1230
 type:
 - how-to
 ---
diff --git a/content/agent/installation-upgrade/upgrade.md b/content/agent/installation-upgrade/upgrade.md
index cd11db359..e62fe59e4 100644
--- a/content/agent/installation-upgrade/upgrade.md
+++ b/content/agent/installation-upgrade/upgrade.md
@@ -3,7 +3,7 @@ title: Upgrade NGINX Agent package
 draft: false
 weight: 600
 toc: true
-docs: DOCS-1227
+nd-docs: DOCS-1227
 type:
 - how-to
 ---
@@ -39,48 +39,48 @@ To upgrade NGINX Agent, follow these steps:
         sudo apt-get install -y --only-upgrade nginx-agent -o Dpkg::Options::="--force-confold"
         ```
 
-## Upgrade NGINX Agent to a Specific Version 
+## Upgrade NGINX Agent to a Specific Version
 
-To upgrade NGINX Agent to a specific **v2.x version**, follow these steps: 
+To upgrade NGINX Agent to a specific **v2.x version**, follow these steps:
 
-#### Steps to Upgrade: 
+#### Steps to Upgrade:
 
 1. Open an SSH connection to the server running  NGINX Agent and log in.
 
-1. Back up the following files and directories to ensure you can restore the environment in case of issues during the upgrade: 
+1. Back up the following files and directories to ensure you can restore the environment in case of issues during the upgrade:
 
     - `/etc/nginx-agent`
     - Any `config_dirs` directory specified in `/etc/nginx-agent/nginx-agent.conf`.
 
-1. Perform the version-controlled upgrade. 
+1. Perform the version-controlled upgrade.
 
    - Debian, Ubuntu, Deb-Based
-        
+
         ```shell
         sudo apt-get update
         sudo apt-get install -y nginx-agent=<specific-version> -o Dpkg::Options::="--force-confold"
         ```
-        
-        Example (to upgrade to version 2.41.1~noble): 
-        
+
+        Example (to upgrade to version 2.41.1~noble):
+
         ```shell
         sudo apt-get install -y nginx-agent=2.41.1~noble -o Dpkg::Options::="--force-confold"
         ```
 
-    - CentOS, RHEL, RPM-Based        
-       
+    - CentOS, RHEL, RPM-Based
+
         ```shell
         sudo yum install -y nginx-agent-<specific-version>
         ```
-        
-        Example (to upgrade to version `2.41.1`): 
-    
+
+        Example (to upgrade to version `2.41.1`):
+
         ```shell
         sudo yum install -y nginx-agent-2.41.1
         ```
 
-1. Verify the installed version:    
-    
+1. Verify the installed version:
+
     ```shell
     sudo nginx-agent --version
     ```
diff --git a/content/agent/overview.md b/content/agent/overview.md
index 289b6ebab..c6103489c 100644
--- a/content/agent/overview.md
+++ b/content/agent/overview.md
@@ -3,7 +3,7 @@ title: Overview
 draft: false
 weight: 100
 toc: true
-docs: DOCS-1091
+nd-docs: DOCS-1091
 type:
 - how-to
 ---
diff --git a/content/agent/technical-specifications.md b/content/agent/technical-specifications.md
index 149b08df9..63561ed94 100644
--- a/content/agent/technical-specifications.md
+++ b/content/agent/technical-specifications.md
@@ -3,7 +3,7 @@ title: Technical specifications
 draft: false
 weight: 200
 toc: true
-docs: DOCS-1092
+nd-docs: DOCS-1092
 type:
 - how-to
 ---
@@ -12,12 +12,12 @@ type:
 
 This document provides technical specifications for NGINX Agent. It includes information on supported distributions, deployment environments, NGINX versions, sizing recommendations, and logging.
 
-## NGINX Agent v3.0 Compatibility 
+## NGINX Agent v3.0 Compatibility
 {{< bootstrap-table "table table-striped table-bordered" >}}
 | NGINX Product                | Agent Version  |
 |------------------------------|----------------|
 | **NGINX One Console**        | 2.x            |
-| **NGINX Gateway Fabric**     | 3.x            | 
+| **NGINX Gateway Fabric**     | 3.x            |
 | **NGINX Plus**               | 2.x, 3.x       |
 | **NGINX Ingress Controller** | 2.x            |
 | **NGINX Instance Manager**   | 2.x            |
diff --git a/content/amplify/additional-resources.md b/content/amplify/additional-resources.md
index 554e6c8b3..f794475ce 100644
--- a/content/amplify/additional-resources.md
+++ b/content/amplify/additional-resources.md
@@ -2,7 +2,7 @@
 title: Other NGINX Amplify Resources
 weight: 899
 toc: true
-docs: DOCS-977
+nd-docs: DOCS-977
 ---
 
 If you are interested in learning more about F5 NGINX Amplify, visit the [NGINX Amplify Resources Page](https://amplify.nginx.com/docs/), where you will find links to:
diff --git a/content/amplify/changelog.md b/content/amplify/changelog.md
index d965086f0..b39e69e95 100644
--- a/content/amplify/changelog.md
+++ b/content/amplify/changelog.md
@@ -3,7 +3,7 @@ title: Changelog
 description: These release notes list and describe the new features, enhancements, and resolved issues in F5 NGINX Amplify
 weight: 900
 toc: true
-docs: DOCS-1691
+nd-docs: DOCS-1691
 ---
 
 ## Sept 21, 2023
diff --git a/content/amplify/faq/general.md b/content/amplify/faq/general.md
index 5aab8c8f2..53d0775bd 100644
--- a/content/amplify/faq/general.md
+++ b/content/amplify/faq/general.md
@@ -3,7 +3,7 @@ title: General
 description: General questions about F5 NGINX Amplify
 weight: 10
 toc: true
-docs: DOCS-956
+nd-docs: DOCS-956
 ---
 
 ### What Is F5 NGINX Amplify?
diff --git a/content/amplify/faq/metrics-and-metadata.md b/content/amplify/faq/metrics-and-metadata.md
index ea7820bd5..f91ae8dd8 100644
--- a/content/amplify/faq/metrics-and-metadata.md
+++ b/content/amplify/faq/metrics-and-metadata.md
@@ -3,7 +3,7 @@ title: NGINX Amplify Metrics and Metadata
 description: Questions about F5 NGINX Amplify's Metrics and Metadata
 weight: 40
 toc: true
-docs: DOCS-957
+nd-docs: DOCS-957
 ---
 
 ### What Data Does F5 NGINX Amplify Agent Gather?
diff --git a/content/amplify/faq/nginx-amplify-agent.md b/content/amplify/faq/nginx-amplify-agent.md
index f6965a94b..eec52dc82 100644
--- a/content/amplify/faq/nginx-amplify-agent.md
+++ b/content/amplify/faq/nginx-amplify-agent.md
@@ -3,7 +3,7 @@ title: NGINX Amplify Agent
 description: Questions about F5 NGINX Amplify Agent
 weight: 20
 toc: true
-docs: DOCS-958
+nd-docs: DOCS-958
 ---
 
 ### What Operating Systems are Supported?
diff --git a/content/amplify/faq/user-interface.md b/content/amplify/faq/user-interface.md
index 26277afee..5bad6022b 100644
--- a/content/amplify/faq/user-interface.md
+++ b/content/amplify/faq/user-interface.md
@@ -3,7 +3,7 @@ title: NGINX Amplify User Interface
 description: Questions about F5 NGINX Amplify's User Interface
 weight: 30
 toc: true
-docs: DOCS-959
+nd-docs: DOCS-959
 ---
 
 ### What Browsers are Supported?
diff --git a/content/amplify/known-issues.md b/content/amplify/known-issues.md
index bf5ea989c..38b7db320 100644
--- a/content/amplify/known-issues.md
+++ b/content/amplify/known-issues.md
@@ -3,7 +3,7 @@ title: Known Issues
 weight: 1000
 description: List of known issues in the latest release of F5 NGINX Amplify
 toc: true
-docs: DOCS-1692
+nd-docs: DOCS-1692
 ---
 
 {{<rn-styles>}}
diff --git a/content/amplify/metrics-metadata/metrics-overview.md b/content/amplify/metrics-metadata/metrics-overview.md
index 6a6b34f2c..8a1970ed4 100644
--- a/content/amplify/metrics-metadata/metrics-overview.md
+++ b/content/amplify/metrics-metadata/metrics-overview.md
@@ -3,7 +3,7 @@ title: Metrics and Metadata Overview
 description: Learn about the metrics and metadata F5 NGINX Amplify collects.
 weight: 10
 toc: true
-docs: DOCS-972
+nd-docs: DOCS-972
 ---
 
 Most metrics are collected by F5 NGINX Amplify Agent without requiring the user to perform any additional setup. For troubleshooting, see [Troubleshooting Metrics Collection]({{< ref "/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md" >}}).
diff --git a/content/amplify/metrics-metadata/nginx-metrics.md b/content/amplify/metrics-metadata/nginx-metrics.md
index 34971aab6..fd0e5e61c 100644
--- a/content/amplify/metrics-metadata/nginx-metrics.md
+++ b/content/amplify/metrics-metadata/nginx-metrics.md
@@ -3,7 +3,7 @@ title: NGINX Metrics
 description: List of NGINX Metrics
 weight: 30
 toc: true
-docs: DOCS-973
+nd-docs: DOCS-973
 ---
 
 ## HTTP Connections and Requests
@@ -48,7 +48,7 @@ docs: DOCS-973
 
   ```
   Type:        gauge, integer
-  Description: Number of currently active requests (reading and writing). 
+  Description: Number of currently active requests (reading and writing).
                Number of requests reading headers or writing responses to clients.
   Source:      stub_status (or NGINX Plus status API)
   ```
@@ -127,7 +127,7 @@ docs: DOCS-973
 
   ```
   Type:        counter, integer
-  Description: Number of requests finalized with status code 499 which is 
+  Description: Number of requests finalized with status code 499 which is
                logged when the client closes the connection.
   Source:      access.log
   ```
@@ -213,7 +213,7 @@ docs: DOCS-973
 
   ```
   Type:        gauge, integer
-  Description: Hard limit on the number of file descriptors as seen 
+  Description: Hard limit on the number of file descriptors as seen
                by NGINX worker processes.
   ```
 
diff --git a/content/amplify/metrics-metadata/os-metrics.md b/content/amplify/metrics-metadata/os-metrics.md
index 6a204d0df..7de32fcb0 100644
--- a/content/amplify/metrics-metadata/os-metrics.md
+++ b/content/amplify/metrics-metadata/os-metrics.md
@@ -3,7 +3,7 @@ title: OS Metrics
 description: List of OS Metrics
 weight: 20
 toc: true
-docs: DOCS-974
+nd-docs: DOCS-974
 ---
 
 ## System Metrics
diff --git a/content/amplify/metrics-metadata/other-metrics.md b/content/amplify/metrics-metadata/other-metrics.md
index 83b583573..2241f57e4 100644
--- a/content/amplify/metrics-metadata/other-metrics.md
+++ b/content/amplify/metrics-metadata/other-metrics.md
@@ -3,7 +3,7 @@ title: Other Metrics
 description: Learn about other metrics used by F5 NGINX Amplify
 weight: 40
 toc: true
-docs: DOCS-975
+nd-docs: DOCS-975
 ---
 
 {{< note >}}Monitoring PHP-FPM and MySQL metrics is only supported by F5 NGINX Amplify Agent.{{< /note >}}
diff --git a/content/amplify/nginx-amplify-agent/amplify-agent-overview.md b/content/amplify/nginx-amplify-agent/amplify-agent-overview.md
index 235fb15cd..51cc08ccb 100644
--- a/content/amplify/nginx-amplify-agent/amplify-agent-overview.md
+++ b/content/amplify/nginx-amplify-agent/amplify-agent-overview.md
@@ -3,7 +3,7 @@ title: NGINX Amplify Agent Overview
 description: Learn about F5 NGINX Amplify Agent.
 weight: 1
 toc: true
-docs: DOCS-960
+nd-docs: DOCS-960
 ---
 
 F5 NGINX Amplify Agent is a compact application written in Python. Its role is to collect various metrics and metadata and send them securely to the backend for storage and visualization.
diff --git a/content/amplify/nginx-amplify-agent/configuration-analysis.md b/content/amplify/nginx-amplify-agent/configuration-analysis.md
index 0110f4a9b..0c227c3a9 100644
--- a/content/amplify/nginx-amplify-agent/configuration-analysis.md
+++ b/content/amplify/nginx-amplify-agent/configuration-analysis.md
@@ -3,7 +3,7 @@ title: NGINX Configuration Analysis
 description: Learn about F5 NGINX Amplify Agent's configuration analysis feature.
 weight: 600
 toc: true
-docs: DOCS-961
+nd-docs: DOCS-961
 ---
 
 F5 NGINX Amplify Agent can automatically find all relevant NGINX configuration files, parse them, extract their logical structure, and send the associated JSON data to the Amplify backend for further analysis and reporting. For more information on configuration analysis, please see the [Analyzer]({{< ref "/amplify/user-interface/analyzer.md" >}})) documentation.
diff --git a/content/amplify/nginx-amplify-agent/configuring-metric-collection.md b/content/amplify/nginx-amplify-agent/configuring-metric-collection.md
index b3bf29981..311967d69 100644
--- a/content/amplify/nginx-amplify-agent/configuring-metric-collection.md
+++ b/content/amplify/nginx-amplify-agent/configuring-metric-collection.md
@@ -3,7 +3,7 @@ title: Configuring NGINX for Metric Collection
 description: Learn how to configure NGINX Instances to collect data.
 weight: 400
 toc: true
-docs: DOCS-963
+nd-docs: DOCS-963
 ---
 
 To monitor an NGINX instance, F5 NGINX Amplify Agent must [find the relevant NGINX master process]({{< ref "/amplify/nginx-amplify-agent/detecting-monitoring-instances" >}}) and determine its key characteristics.
diff --git a/content/amplify/nginx-amplify-agent/detecting-monitoring-instances.md b/content/amplify/nginx-amplify-agent/detecting-monitoring-instances.md
index 1df04cd92..85508a998 100644
--- a/content/amplify/nginx-amplify-agent/detecting-monitoring-instances.md
+++ b/content/amplify/nginx-amplify-agent/detecting-monitoring-instances.md
@@ -3,7 +3,7 @@ title: Detecting and Monitoring NGINX Instances
 description: Learn how F5 NGINX Amplify Agent detects NGINX Instances.
 weight: 300
 toc: true
-docs: DOCS-962
+nd-docs: DOCS-962
 ---
 
 F5 NGINX Amplify Agent is capable of detecting several types of NGINX instances:
diff --git a/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md b/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md
index b8d5e3f41..572725403 100644
--- a/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md
+++ b/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md
@@ -3,7 +3,7 @@ title: Configuring NGINX Amplify Agent
 description: Learn how to configure F5 NGINX Amplify Agent.
 weight: 300
 toc: true
-docs: DOCS-967
+nd-docs: DOCS-967
 ---
 
 F5 NGINX Amplify Agent keeps its configuration in `/etc/amplify-agent/agent.conf`. The NGINX Amplify Agent configuration is a text-based file.
diff --git a/content/amplify/nginx-amplify-agent/install/installing-amplify-agent.md b/content/amplify/nginx-amplify-agent/install/installing-amplify-agent.md
index dea514179..1dcbb9241 100644
--- a/content/amplify/nginx-amplify-agent/install/installing-amplify-agent.md
+++ b/content/amplify/nginx-amplify-agent/install/installing-amplify-agent.md
@@ -3,7 +3,7 @@ title: Install NGINX Amplify Agent
 description: Learn how to install F5 NGINX Amplify Agent.
 weight: 100
 toc: true
-docs: DOCS-968
+nd-docs: DOCS-968
 ---
 
 To use F5 NGINX Amplify to monitor your infrastructure, you need to install NGINX Amplify Agent on each system you wish to monitor.
diff --git a/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md b/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md
index 341d5d1bb..702c0ff87 100644
--- a/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md
+++ b/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md
@@ -3,7 +3,7 @@ title: Uninstall NGINX Amplify Agent
 description: Learn how to uninstall F5 NGINX Amplify Agent.
 weight: 400
 toc: true
-docs: DOCS-969
+nd-docs: DOCS-969
 ---
 
 To completely delete a previously monitored object, perform the following steps:
diff --git a/content/amplify/nginx-amplify-agent/install/updating-amplify-agent.md b/content/amplify/nginx-amplify-agent/install/updating-amplify-agent.md
index a616bccdf..e7c0f2c57 100644
--- a/content/amplify/nginx-amplify-agent/install/updating-amplify-agent.md
+++ b/content/amplify/nginx-amplify-agent/install/updating-amplify-agent.md
@@ -3,7 +3,7 @@ title: Update NGINX Amplify Agent
 description: Learn how to update F5 NGINX Amplify Agent.
 weight: 200
 toc: true
-docs: DOCS-970
+nd-docs: DOCS-970
 ---
 
 {{< important >}}
diff --git a/content/amplify/nginx-amplify-agent/install/using-amplify-agent-docker.md b/content/amplify/nginx-amplify-agent/install/using-amplify-agent-docker.md
index 6b979affb..ee91d9b50 100644
--- a/content/amplify/nginx-amplify-agent/install/using-amplify-agent-docker.md
+++ b/content/amplify/nginx-amplify-agent/install/using-amplify-agent-docker.md
@@ -3,7 +3,7 @@ title: Use NGINX Amplify Agent with Docker
 description: Learn how to use F5 NGINX Amplify Agent with Docker.
 weight: 500
 toc: true
-docs: DOCS-971
+nd-docs: DOCS-971
 ---
 
 You can use F5 NGINX Amplify Agent in a Docker environment. Although it's still work-in-progress, NGINX Amplify Agent can collect most of the metrics and send them over to the Amplify backend in either "standalone" or "aggregate" mode. The standalone mode of operation is the simplest one, with a separate "host" created for each Docker container. Alternatively, the metrics from NGINX Amplify Agents running in different containers can be aggregated on a "per-image" basis — this is the aggregate mode of deploying NGINX Amplify Agent with Docker.
diff --git a/content/amplify/nginx-amplify-agent/metadata-metrics-collection.md b/content/amplify/nginx-amplify-agent/metadata-metrics-collection.md
index 0263c68f6..b5ea87f65 100644
--- a/content/amplify/nginx-amplify-agent/metadata-metrics-collection.md
+++ b/content/amplify/nginx-amplify-agent/metadata-metrics-collection.md
@@ -3,7 +3,7 @@ title: Metadata and Metrics Collection
 description: Learn how F5 NGINX Amplify Agent collects data.
 weight: 200
 toc: true
-docs: DOCS-964
+nd-docs: DOCS-964
 ---
 
 F5 NGINX Amplify Agent collects the following types of data:
diff --git a/content/amplify/nginx-amplify-agent/source-code.md b/content/amplify/nginx-amplify-agent/source-code.md
index 4730d4d2c..6aa36975e 100644
--- a/content/amplify/nginx-amplify-agent/source-code.md
+++ b/content/amplify/nginx-amplify-agent/source-code.md
@@ -3,7 +3,7 @@ title: NGINX Amplify Agent Source Code
 description: Learn where to find F5 NGINX Amplify Agent's source code.
 weight: 700
 toc: true
-docs: DOCS-965
+nd-docs: DOCS-965
 ---
 
 F5 NGINX Amplify Agent is an open source application. It is licensed under the [2-clause BSD license](https://github.com/nginxinc/nginx-amplify-agent/blob/master/LICENSE), and is available here:
diff --git a/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md b/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md
index 5501b2fbe..d15fbe0f9 100644
--- a/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md
+++ b/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md
@@ -3,7 +3,7 @@ title: Troubleshooting Metrics Collection
 description: Learn what to check if F5 NGINX Amplify Agent isn't reporting metrics.
 weight: 500
 toc: true
-docs: DOCS-966
+nd-docs: DOCS-966
 ---
 
 After you [install and start]({{< ref "/amplify/nginx-amplify-agent/install/installing-amplify-agent" >}}) F5 NGINX Amplify Agent, it should start reporting right away, pushing aggregated data to the Amplify backend at regular 1 minute intervals. It'll take about a minute for a new system to appear in the Amplify web interface.
diff --git a/content/amplify/overview/overview-main-components.md b/content/amplify/overview/overview-main-components.md
index 3ae2416ee..ecb453b6e 100644
--- a/content/amplify/overview/overview-main-components.md
+++ b/content/amplify/overview/overview-main-components.md
@@ -3,7 +3,7 @@ title: Overview and Main Components
 description: Learn about F5 NGINX Amplify and its main components.
 weight: 10
 toc: true
-docs: DOCS-976
+nd-docs: DOCS-976
 ---
 
 ## What Is F5 NGINX Amplify?
diff --git a/content/amplify/user-interface/account-settings.md b/content/amplify/user-interface/account-settings.md
index bef423f0b..d39312e95 100644
--- a/content/amplify/user-interface/account-settings.md
+++ b/content/amplify/user-interface/account-settings.md
@@ -3,7 +3,7 @@ title: Account Settings
 description: Learn about the Account settings for the User Interface.
 weight: 70
 toc: true
-docs: DOCS-978
+nd-docs: DOCS-978
 ---
 
 The **Account** option in the user menu at the top right corner of the user interface povides access to several user settings.
diff --git a/content/amplify/user-interface/alerts.md b/content/amplify/user-interface/alerts.md
index f89818d48..490cc6eb7 100644
--- a/content/amplify/user-interface/alerts.md
+++ b/content/amplify/user-interface/alerts.md
@@ -3,7 +3,7 @@ title: Alerts
 description: Learn about the Alerts page of the User Interface.
 weight: 60
 toc: false
-docs: DOCS-979
+nd-docs: DOCS-979
 ---
 
 The **Alerts** page describes the configuration of the alert rules used to notify you of any anomalies in the behavior of your systems.
diff --git a/content/amplify/user-interface/analyzer.md b/content/amplify/user-interface/analyzer.md
index 054790cdd..40ce6d0b5 100644
--- a/content/amplify/user-interface/analyzer.md
+++ b/content/amplify/user-interface/analyzer.md
@@ -3,7 +3,7 @@ title: Analyzer
 description: Learn about the Analyzer page of the User Interface.
 weight: 50
 toc: false
-docs: DOCS-980
+nd-docs: DOCS-980
 ---
 
 F5 NGINX Amplify Agent parses NGINX configuration files and transmits them to the backend component for further analysis. NGINX Amplify offers configuration recommendations to help improve the performance, reliability, and security of your applications. With well-thought-out and detailed recommendations, you’ll know exactly where the problem is, why it is a problem, and how to fix it.
diff --git a/content/amplify/user-interface/dashboards.md b/content/amplify/user-interface/dashboards.md
index eef3fcd73..24dd0814d 100644
--- a/content/amplify/user-interface/dashboards.md
+++ b/content/amplify/user-interface/dashboards.md
@@ -3,7 +3,7 @@ title: Dashboards
 description: Learn about the Dashboards page of the User Interface.
 weight: 40
 toc: false
-docs: DOCS-981
+nd-docs: DOCS-981
 ---
 
 You can create your own dashboards populated with highly customizable graphs of NGINX and system-level metrics.
diff --git a/content/amplify/user-interface/graphs.md b/content/amplify/user-interface/graphs.md
index 701138cb7..d33421876 100644
--- a/content/amplify/user-interface/graphs.md
+++ b/content/amplify/user-interface/graphs.md
@@ -3,7 +3,7 @@ title: Graphs
 description: Learn about the Graphs page of the User Interface.
 weight: 20
 toc: false
-docs: DOCS-982
+nd-docs: DOCS-982
 ---
 
  On the **Graphs** page, you can find a collection of predefined graphs. Here you can see an overview of the key metric stats, such as CPU, memory, and disk usage for all your systems.
diff --git a/content/amplify/user-interface/inventory.md b/content/amplify/user-interface/inventory.md
index f57cc399a..dc7e4d198 100644
--- a/content/amplify/user-interface/inventory.md
+++ b/content/amplify/user-interface/inventory.md
@@ -3,7 +3,7 @@ title: Inventory
 description: Learn about the Inventory page of the User Interface.
 weight: 30
 toc: false
-docs: DOCS-983
+nd-docs: DOCS-983
 ---
 
 You can access the inventory by selecting the first icon on the top menu. The inventory gives an overview of the systems that are being monitored. When F5 NGINX Amplify Agent is running and reporting on a new system, it's listed in the system index on the left side of the user interface and in the **Inventory** section.
diff --git a/content/amplify/user-interface/overview.md b/content/amplify/user-interface/overview.md
index 5fbb45d7e..02437219d 100644
--- a/content/amplify/user-interface/overview.md
+++ b/content/amplify/user-interface/overview.md
@@ -3,7 +3,7 @@ title: Overview
 description: Learn about the Overview page of the User Interface.
 weight: 10
 toc: true
-docs: DOCS-984
+nd-docs: DOCS-984
 ---
 
 The Overview page is designed to provide a quick summary of the state of your NGINX infrastructure. Here you can quickly check the total sum of HTTP 5xx errors over the past 24 hours and compare it to the previous 24 hours.
diff --git a/content/controller/admin-guides/backup-restore/backup-restore-cluster-config.md b/content/controller/admin-guides/backup-restore/backup-restore-cluster-config.md
index 93dfdad4b..146217e3b 100644
--- a/content/controller/admin-guides/backup-restore/backup-restore-cluster-config.md
+++ b/content/controller/admin-guides/backup-restore/backup-restore-cluster-config.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to back up your F5 NGINX Controller cluster configuration and
   encryption keys.
-docs: DOCS-247
+nd-docs: DOCS-247
 title: Back Up & Restore Cluster Config and Encryption Keys
 toc: true
 weight: 97
diff --git a/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md b/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md
index f4cdadd2f..a1d53cf56 100644
--- a/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md
+++ b/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to back up and restore the embedded F5 NGINX Controller config
   database.
-docs: DOCS-248
+nd-docs: DOCS-248
 title: Back Up & Restore an Embedded Config Database
 toc: true
 weight: 98
diff --git a/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md b/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md
index 983ec1321..bc2adbeeb 100644
--- a/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md
+++ b/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to back up and restore the external F5 NGINX Controller config
   database.
-docs: DOCS-249
+nd-docs: DOCS-249
 title: Back Up & Restore an External Config Database
 toc: true
 weight: 99
diff --git a/content/controller/admin-guides/backup-restore/backup-restore-metrics-db.md b/content/controller/admin-guides/backup-restore/backup-restore-metrics-db.md
index bce77e9f2..bd372ded2 100644
--- a/content/controller/admin-guides/backup-restore/backup-restore-metrics-db.md
+++ b/content/controller/admin-guides/backup-restore/backup-restore-metrics-db.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to back up and restore the F5 NGINX Controller analytics database.
-docs: DOCS-250
+nd-docs: DOCS-250
 title: Back Up & Restore the Analytics Database
 toc: true
 weight: 100
diff --git a/content/controller/admin-guides/config-agent/about-controller-agent.md b/content/controller/admin-guides/config-agent/about-controller-agent.md
index 3976422ab..2ab44950d 100644
--- a/content/controller/admin-guides/config-agent/about-controller-agent.md
+++ b/content/controller/admin-guides/config-agent/about-controller-agent.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the NGINX Controller Agent.
-docs: DOCS-508
+nd-docs: DOCS-508
 title: Get to Know the F5 NGINX Controller Agent
 toc: true
 weight: 100
diff --git a/content/controller/admin-guides/config-agent/configure-metrics-collection.md b/content/controller/admin-guides/config-agent/configure-metrics-collection.md
index 492cbd5e1..6fadc382c 100644
--- a/content/controller/admin-guides/config-agent/configure-metrics-collection.md
+++ b/content/controller/admin-guides/config-agent/configure-metrics-collection.md
@@ -1,7 +1,7 @@
 ---
 description: Contains instructions for setting up the F5 NGINX Controller Agent to
   collect metrics for NGINX Plus instances.
-docs: DOCS-509
+nd-docs: DOCS-509
 title: Set up Metrics Collection
 toc: true
 weight: 120
diff --git a/content/controller/admin-guides/config-agent/configure-the-agent.md b/content/controller/admin-guides/config-agent/configure-the-agent.md
index 37a7d5c7b..468755759 100644
--- a/content/controller/admin-guides/config-agent/configure-the-agent.md
+++ b/content/controller/admin-guides/config-agent/configure-the-agent.md
@@ -1,6 +1,6 @@
 ---
 description: Customize the F5 NGINX Controller Agent configuration.
-docs: DOCS-510
+nd-docs: DOCS-510
 title: Configure the NGINX Controller Agent
 toc: true
 weight: 110
diff --git a/content/controller/admin-guides/config-agent/use-agent-with-docker.md b/content/controller/admin-guides/config-agent/use-agent-with-docker.md
index 3c5980a2b..12a1786b8 100644
--- a/content/controller/admin-guides/config-agent/use-agent-with-docker.md
+++ b/content/controller/admin-guides/config-agent/use-agent-with-docker.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to use the F5 NGINX Controller Agent in a Docker environment.
-docs: DOCS-511
+nd-docs: DOCS-511
 title: Use the NGINX Controller Agent with Docker
 toc: true
 weight: 200
diff --git a/content/controller/admin-guides/install/agent-restart.md b/content/controller/admin-guides/install/agent-restart.md
index 103b35573..acc3e9173 100644
--- a/content/controller/admin-guides/install/agent-restart.md
+++ b/content/controller/admin-guides/install/agent-restart.md
@@ -1,7 +1,7 @@
 ---
 description: How to start, stop, and verify the state of the F5 NGINX Controller Agent
   service.
-docs: DOCS-251
+nd-docs: DOCS-251
 title: Manage the NGINX Controller Agent Service
 toc: true
 weight: 210
diff --git a/content/controller/admin-guides/install/get-n-plus-cert-and-key.md b/content/controller/admin-guides/install/get-n-plus-cert-and-key.md
index 48a9ecef5..55a141570 100644
--- a/content/controller/admin-guides/install/get-n-plus-cert-and-key.md
+++ b/content/controller/admin-guides/install/get-n-plus-cert-and-key.md
@@ -1,7 +1,7 @@
 ---
 description: How to download the F5 NGINX Plus nginx.crt and nginx.key files using
   the NGINX Controller API.
-docs: DOCS-252
+nd-docs: DOCS-252
 title: Download the NGINX Plus Cert and Key Bundle
 toc: true
 weight: 105
diff --git a/content/controller/admin-guides/install/install-agent-non-root.md b/content/controller/admin-guides/install/install-agent-non-root.md
index 51934094a..7d4dd31bf 100644
--- a/content/controller/admin-guides/install/install-agent-non-root.md
+++ b/content/controller/admin-guides/install/install-agent-non-root.md
@@ -1,6 +1,6 @@
 ---
 description: How to install the F5 NGINX Controller Agent to run as a non-root user.
-docs: DOCS-253
+nd-docs: DOCS-253
 title: Install NGINX Controller Agent for Non-root Users
 toc: true
 weight: 205
diff --git a/content/controller/admin-guides/install/install-for-controller.md b/content/controller/admin-guides/install/install-for-controller.md
index b359e637d..bd104db9f 100644
--- a/content/controller/admin-guides/install/install-for-controller.md
+++ b/content/controller/admin-guides/install/install-for-controller.md
@@ -1,7 +1,7 @@
 ---
 description: Take the steps in this guide to deploy F5 NGINX App Protect WAF as a
   datapath instance for use with NGINX Controller.
-docs: DOCS-645
+nd-docs: DOCS-645
 title: Using NGINX App Protect WAF with NGINX Controller
 toc: true
 weight: 500
diff --git a/content/controller/admin-guides/install/install-nginx-controller-agent.md b/content/controller/admin-guides/install/install-nginx-controller-agent.md
index 594f865c1..2ee592106 100644
--- a/content/controller/admin-guides/install/install-nginx-controller-agent.md
+++ b/content/controller/admin-guides/install/install-nginx-controller-agent.md
@@ -1,6 +1,6 @@
 ---
 description: How to install, upgrade, and uninstall the F5 Controller Agent.
-docs: DOCS-254
+nd-docs: DOCS-254
 title: Install NGINX Controller Agent
 toc: true
 weight: 150
diff --git a/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md b/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md
index 82d4e9651..34431a5a2 100644
--- a/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md
+++ b/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md
@@ -1,7 +1,7 @@
 ---
 description: This guide explains how to prepare your RHEL 8 system to install F5 NGINX
   Controller and the NGINX Controller Agent.
-docs: DOCS-342
+nd-docs: DOCS-342
 title: Install NGINX Controller on RHEL 8 (experimental)
 toc: true
 weight: 200
diff --git a/content/controller/admin-guides/install/install-nginx-controller.md b/content/controller/admin-guides/install/install-nginx-controller.md
index d6d6eb972..0607d2240 100644
--- a/content/controller/admin-guides/install/install-nginx-controller.md
+++ b/content/controller/admin-guides/install/install-nginx-controller.md
@@ -1,6 +1,6 @@
 ---
 description: This guide explains how to install and update F5 NGINX Controller.
-docs: DOCS-255
+nd-docs: DOCS-255
 title: Install NGINX Controller
 toc: true
 weight: 120
diff --git a/content/controller/admin-guides/install/nginx-controller-tech-specs.md b/content/controller/admin-guides/install/nginx-controller-tech-specs.md
index 1940cf75d..39b8a7da6 100644
--- a/content/controller/admin-guides/install/nginx-controller-tech-specs.md
+++ b/content/controller/admin-guides/install/nginx-controller-tech-specs.md
@@ -1,6 +1,6 @@
 ---
 description: Guidelines and recommendations for configuring F5 NGINX Controller.
-docs: DOCS-256
+nd-docs: DOCS-256
 title: NGINX Controller Tech Specs
 toc: true
 weight: 100
diff --git a/content/controller/admin-guides/install/resilient-cluster-aws.md b/content/controller/admin-guides/install/resilient-cluster-aws.md
index f544492e6..240c0edc5 100644
--- a/content/controller/admin-guides/install/resilient-cluster-aws.md
+++ b/content/controller/admin-guides/install/resilient-cluster-aws.md
@@ -1,7 +1,7 @@
 ---
 description: This guide explains how to deploy F5 NGINX Controller as a multi-node
   resilient cluster on AWS.
-docs: DOCS-257
+nd-docs: DOCS-257
 title: Deploy NGINX Controller as a Resilient Cluster on AWS
 toc: true
 weight: 310
diff --git a/content/controller/admin-guides/install/resilient-cluster-private-cloud.md b/content/controller/admin-guides/install/resilient-cluster-private-cloud.md
index 22cc5e1db..cb2339eb0 100644
--- a/content/controller/admin-guides/install/resilient-cluster-private-cloud.md
+++ b/content/controller/admin-guides/install/resilient-cluster-private-cloud.md
@@ -1,7 +1,7 @@
 ---
 description: This guide explains how to deploy F5 NGINX Controller as a multi-node
   resilient cluster on a private cloud.
-docs: DOCS-258
+nd-docs: DOCS-258
 title: Deploy NGINX Controller as a Resilient Cluster on a Private Cloud
 toc: true
 weight: 300
diff --git a/content/controller/admin-guides/install/try-nginx-controller-app-sec.md b/content/controller/admin-guides/install/try-nginx-controller-app-sec.md
index 74b41240b..ecba8d0f9 100644
--- a/content/controller/admin-guides/install/try-nginx-controller-app-sec.md
+++ b/content/controller/admin-guides/install/try-nginx-controller-app-sec.md
@@ -1,7 +1,7 @@
 ---
 description: This quick-start tutorial shows you how to get started using F5 NGINX
   Controller with the Application Security Add-on.
-docs: DOCS-259
+nd-docs: DOCS-259
 title: Trial NGINX Controller with App Security
 toc: true
 weight: 115
diff --git a/content/controller/admin-guides/install/try-nginx-controller.md b/content/controller/admin-guides/install/try-nginx-controller.md
index c5565c412..dd2883d56 100644
--- a/content/controller/admin-guides/install/try-nginx-controller.md
+++ b/content/controller/admin-guides/install/try-nginx-controller.md
@@ -1,7 +1,7 @@
 ---
 description: This quick-start tutorial shows you how to get started using F5 NGINX
   Controller with NGINX Plus.
-docs: DOCS-260
+nd-docs: DOCS-260
 title: Trial NGINX Controller with NGINX Plus
 toc: true
 weight: 110
diff --git a/content/controller/admin-guides/install/using-helper-script.md b/content/controller/admin-guides/install/using-helper-script.md
index 2a880d7ce..382332f63 100644
--- a/content/controller/admin-guides/install/using-helper-script.md
+++ b/content/controller/admin-guides/install/using-helper-script.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to update F5 NGINX Controller installation settings and manage
   the NGINX Controller service using the helper.sh script.
-docs: DOCS-261
+nd-docs: DOCS-261
 title: Update NGINX Controller Settings with helper.sh
 toc: true
 weight: 200
diff --git a/content/controller/analytics/alerts/about-alerts.md b/content/controller/analytics/alerts/about-alerts.md
index c870c9a75..af1813eba 100644
--- a/content/controller/analytics/alerts/about-alerts.md
+++ b/content/controller/analytics/alerts/about-alerts.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about NGINX Controller Alerts and Notifications.
-docs: DOCS-520
+nd-docs: DOCS-520
 title: About Alerts
 toc: true
 weight: 100
diff --git a/content/controller/analytics/alerts/manage-alerts.md b/content/controller/analytics/alerts/manage-alerts.md
index de167234f..839506968 100644
--- a/content/controller/analytics/alerts/manage-alerts.md
+++ b/content/controller/analytics/alerts/manage-alerts.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to view, add, mute, and delete Alerts.
-docs: DOCS-521
+nd-docs: DOCS-521
 title: Manage Alerts
 toc: true
 weight: 200
diff --git a/content/controller/analytics/alerts/manage-registered-emails.md b/content/controller/analytics/alerts/manage-registered-emails.md
index 81131b9da..6a0bb6bbf 100644
--- a/content/controller/analytics/alerts/manage-registered-emails.md
+++ b/content/controller/analytics/alerts/manage-registered-emails.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to manage the email addresses that receive automatic alert
   notifications.
-docs: DOCS-522
+nd-docs: DOCS-522
 title: Manage Registered Email Addresses
 toc: true
 weight: 310
diff --git a/content/controller/analytics/alerts/service-now-notifications.md b/content/controller/analytics/alerts/service-now-notifications.md
index 8e857b14e..fe4ca3c43 100644
--- a/content/controller/analytics/alerts/service-now-notifications.md
+++ b/content/controller/analytics/alerts/service-now-notifications.md
@@ -1,6 +1,6 @@
 ---
 description: Set up Alerts Integration with ServiceNow. Deprecated in v3.13.
-docs: DOCS-523
+nd-docs: DOCS-523
 title: ServiceNow Alerts Integration
 toc: true
 weight: 600
diff --git a/content/controller/analytics/catalogs/dimensions.md b/content/controller/analytics/catalogs/dimensions.md
index db1629c2d..4ed5ea5b4 100644
--- a/content/controller/analytics/catalogs/dimensions.md
+++ b/content/controller/analytics/catalogs/dimensions.md
@@ -1,7 +1,7 @@
 ---
 description: Information about all of the Dimensions collected by F5 NGINX Controller
   Agent.
-docs: DOCS-524
+nd-docs: DOCS-524
 title: NGINX Controller Dimensions Catalog
 toc: false
 weight: 20
diff --git a/content/controller/analytics/catalogs/metrics.md b/content/controller/analytics/catalogs/metrics.md
index 3e457a0a9..ff4c9b25b 100644
--- a/content/controller/analytics/catalogs/metrics.md
+++ b/content/controller/analytics/catalogs/metrics.md
@@ -1,7 +1,7 @@
 ---
 description: Information about all of the Metrics collected by F5 NGINX Controller
   Agent.
-docs: DOCS-525
+nd-docs: DOCS-525
 title: NGINX Controller Metrics Catalog
 toc: false
 weight: 20
diff --git a/content/controller/analytics/dashboards/application-health-score.md b/content/controller/analytics/dashboards/application-health-score.md
index 5ec0bd4f0..1a4940ffd 100644
--- a/content/controller/analytics/dashboards/application-health-score.md
+++ b/content/controller/analytics/dashboards/application-health-score.md
@@ -1,6 +1,6 @@
 ---
 description: View and understand the Application Health Score for your application.
-docs: DOCS-526
+nd-docs: DOCS-526
 title: Understanding the Application Health Score
 toc: true
 weight: 20
diff --git a/content/controller/analytics/dashboards/custom-dashboards.md b/content/controller/analytics/dashboards/custom-dashboards.md
index 8a4913194..a7593369d 100644
--- a/content/controller/analytics/dashboards/custom-dashboards.md
+++ b/content/controller/analytics/dashboards/custom-dashboards.md
@@ -1,6 +1,6 @@
 ---
 description: Create custom dashboards to view custom graphs.
-docs: DOCS-527
+nd-docs: DOCS-527
 title: Create Custom Dashboards
 toc: true
 weight: 20
diff --git a/content/controller/analytics/dashboards/overview-dashboard.md b/content/controller/analytics/dashboards/overview-dashboard.md
index c16a87cc3..e3c9c2073 100644
--- a/content/controller/analytics/dashboards/overview-dashboard.md
+++ b/content/controller/analytics/dashboards/overview-dashboard.md
@@ -1,7 +1,7 @@
 ---
 description: Learn about the Dashboards that displays cumulative metrics for your
   NGINX Instances.
-docs: DOCS-528
+nd-docs: DOCS-528
 title: Analytics Overview
 toc: true
 weight: 10
diff --git a/content/controller/analytics/data-explorer/how-to-use.md b/content/controller/analytics/data-explorer/how-to-use.md
index 2d9129225..2efebdc8a 100644
--- a/content/controller/analytics/data-explorer/how-to-use.md
+++ b/content/controller/analytics/data-explorer/how-to-use.md
@@ -1,7 +1,7 @@
 ---
 description: Use the Data Explorer to examine the metrics that F5 NGINX Controller
   collects.
-docs: DOCS-529
+nd-docs: DOCS-529
 title: How To Use the Data Explorer
 toc: true
 weight: 20
diff --git a/content/controller/analytics/events/view-events.md b/content/controller/analytics/events/view-events.md
index 39babcac8..a2baabfbe 100644
--- a/content/controller/analytics/events/view-events.md
+++ b/content/controller/analytics/events/view-events.md
@@ -1,6 +1,6 @@
 ---
 description: View the audit log of system and user actions.
-docs: DOCS-530
+nd-docs: DOCS-530
 title: View Events
 toc: true
 weight: 20
diff --git a/content/controller/analytics/forwarders/forward-analytics-to-datadog.md b/content/controller/analytics/forwarders/forward-analytics-to-datadog.md
index 93527425e..852b44b7b 100644
--- a/content/controller/analytics/forwarders/forward-analytics-to-datadog.md
+++ b/content/controller/analytics/forwarders/forward-analytics-to-datadog.md
@@ -1,6 +1,6 @@
 ---
 description: How to forward Analytics data to Datadog.
-docs: DOCS-531
+nd-docs: DOCS-531
 title: Forward Analytics Data to Datadog
 toc: true
 weight: 100
diff --git a/content/controller/analytics/forwarders/forward-analytics-to-otlp.md b/content/controller/analytics/forwarders/forward-analytics-to-otlp.md
index ea705f2d9..838073a53 100644
--- a/content/controller/analytics/forwarders/forward-analytics-to-otlp.md
+++ b/content/controller/analytics/forwarders/forward-analytics-to-otlp.md
@@ -1,6 +1,6 @@
 ---
 description: How to forward Analytics Metrics to OpenTelemetry Collector.
-docs: DOCS-532
+nd-docs: DOCS-532
 title: Forward Analytics Metrics to OpenTelemetry Collector
 toc: true
 weight: 201
diff --git a/content/controller/analytics/forwarders/forward-analytics-to-splunk.md b/content/controller/analytics/forwarders/forward-analytics-to-splunk.md
index 81d2cfcd2..5c48c0e73 100644
--- a/content/controller/analytics/forwarders/forward-analytics-to-splunk.md
+++ b/content/controller/analytics/forwarders/forward-analytics-to-splunk.md
@@ -1,6 +1,6 @@
 ---
 description: How to forward Analytics data to Splunk.
-docs: DOCS-533
+nd-docs: DOCS-533
 title: Forward Analytics Data to Splunk
 toc: true
 weight: 200
diff --git a/content/controller/analytics/forwarders/forward-analytics-to-syslog.md b/content/controller/analytics/forwarders/forward-analytics-to-syslog.md
index 669046a4d..f135c3322 100644
--- a/content/controller/analytics/forwarders/forward-analytics-to-syslog.md
+++ b/content/controller/analytics/forwarders/forward-analytics-to-syslog.md
@@ -1,6 +1,6 @@
 ---
 description: How to forward Analytics Events to Syslog.
-docs: DOCS-534
+nd-docs: DOCS-534
 title: Forward Analytics Events to Syslog
 toc: true
 weight: 201
diff --git a/content/controller/analytics/metrics/metrics-api.md b/content/controller/analytics/metrics/metrics-api.md
index 29f5cef7b..867c62308 100644
--- a/content/controller/analytics/metrics/metrics-api.md
+++ b/content/controller/analytics/metrics/metrics-api.md
@@ -1,7 +1,7 @@
 ---
 description: Tips and tricks for using the Metrics API query parameters to refine
   your data.
-docs: DOCS-535
+nd-docs: DOCS-535
 title: Using the Metrics API
 toc: true
 weight: 50
diff --git a/content/controller/analytics/metrics/overview-metrics-metadata.md b/content/controller/analytics/metrics/overview-metrics-metadata.md
index cec6969a1..72e0382a6 100644
--- a/content/controller/analytics/metrics/overview-metrics-metadata.md
+++ b/content/controller/analytics/metrics/overview-metrics-metadata.md
@@ -1,7 +1,7 @@
 ---
 description: Understanding how the F5 NGINX Controller Agent collects and reports
   metrics and metadata.
-docs: DOCS-536
+nd-docs: DOCS-536
 title: 'Overview: Metrics and Metadata'
 toc: true
 weight: 20
diff --git a/content/controller/analytics/metrics/overview-traffic-metrics.md b/content/controller/analytics/metrics/overview-traffic-metrics.md
index b1d871a6d..7df193b20 100644
--- a/content/controller/analytics/metrics/overview-traffic-metrics.md
+++ b/content/controller/analytics/metrics/overview-traffic-metrics.md
@@ -1,6 +1,6 @@
 ---
 description: Understanding how traffic metrics are collected, aggregated, and reported.
-docs: DOCS-537
+nd-docs: DOCS-537
 title: 'Overview: Traffic Metrics'
 toc: true
 weight: 100
diff --git a/content/controller/analytics/metrics/view-traffic-metrics.md b/content/controller/analytics/metrics/view-traffic-metrics.md
index b63268ff9..055658de3 100644
--- a/content/controller/analytics/metrics/view-traffic-metrics.md
+++ b/content/controller/analytics/metrics/view-traffic-metrics.md
@@ -1,6 +1,6 @@
 ---
 description: How to view the traffic metrics gathered by NGINX Controller Analytics.
-docs: DOCS-538
+nd-docs: DOCS-538
 title: View Traffic Metrics
 toc: true
 weight: 150
diff --git a/content/controller/analytics/view-app-security-analytics.md b/content/controller/analytics/view-app-security-analytics.md
index c26533250..2d9407d5b 100644
--- a/content/controller/analytics/view-app-security-analytics.md
+++ b/content/controller/analytics/view-app-security-analytics.md
@@ -1,6 +1,6 @@
 ---
 description: How to view App Security Analytics.
-docs: DOCS-539
+nd-docs: DOCS-539
 title: View App Security Analytics
 toc: true
 weight: 500
diff --git a/content/controller/api-management/manage-apis.md b/content/controller/api-management/manage-apis.md
index a16e213ac..1ee149fb0 100644
--- a/content/controller/api-management/manage-apis.md
+++ b/content/controller/api-management/manage-apis.md
@@ -1,7 +1,7 @@
 ---
 description: Use the F5 NGINX Controller API Manager to add APIs and control how your
   APIs are exposed and consumed.
-docs: DOCS-569
+nd-docs: DOCS-569
 title: Manage Your APIs
 toc: true
 weight: 110
diff --git a/content/controller/api-management/manage-dev-portals.md b/content/controller/api-management/manage-dev-portals.md
index 3caa8b685..6bf5fdc68 100644
--- a/content/controller/api-management/manage-dev-portals.md
+++ b/content/controller/api-management/manage-dev-portals.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to create and manage Developer Portals for your API documentation.
-docs: DOCS-570
+nd-docs: DOCS-570
 title: Manage Developer Portals
 toc: true
 weight: 120
diff --git a/content/controller/api/overview.md b/content/controller/api/overview.md
index c5812a63e..1610f6021 100644
--- a/content/controller/api/overview.md
+++ b/content/controller/api/overview.md
@@ -1,6 +1,6 @@
 ---
 description: Provides information about the F5 NGINX Controller API.
-docs: DOCS-343
+nd-docs: DOCS-343
 layout: docs
 title: API Overview
 toc: true
diff --git a/content/controller/api/reference/ctlr-adc-api.md b/content/controller/api/reference/ctlr-adc-api.md
index 4683b5e48..e1226fa0f 100644
--- a/content/controller/api/reference/ctlr-adc-api.md
+++ b/content/controller/api/reference/ctlr-adc-api.md
@@ -1,7 +1,7 @@
 ---
 description: Represents the state of the F5 NGINX Controller Application Delivery
   REST API.
-docs: DOCS-1280
+nd-docs: DOCS-1280
 type:
 - reference
 doctypes:
diff --git a/content/controller/api/reference/ctlr-analytics-api.md b/content/controller/api/reference/ctlr-analytics-api.md
index b01f0fdbf..b1d69e9bb 100644
--- a/content/controller/api/reference/ctlr-analytics-api.md
+++ b/content/controller/api/reference/ctlr-analytics-api.md
@@ -1,6 +1,6 @@
 ---
 description: Represents the state of the F5 NGINX Controller Analytics REST API.
-docs: DOCS-1279
+nd-docs: DOCS-1279
 type:
 - reference
 doctypes:
diff --git a/content/controller/api/reference/ctlr-apim-api.md b/content/controller/api/reference/ctlr-apim-api.md
index b4dfa40ce..0b673cb8d 100644
--- a/content/controller/api/reference/ctlr-apim-api.md
+++ b/content/controller/api/reference/ctlr-apim-api.md
@@ -1,6 +1,6 @@
 ---
 description: Represents the state of the F5 NGINX Controller API Management REST API.
-docs: DOCS-1281
+nd-docs: DOCS-1281
 type:
 - reference
 doctypes:
diff --git a/content/controller/api/reference/ctlr-platform-api.md b/content/controller/api/reference/ctlr-platform-api.md
index c999e18d1..d64ad61f5 100644
--- a/content/controller/api/reference/ctlr-platform-api.md
+++ b/content/controller/api/reference/ctlr-platform-api.md
@@ -1,6 +1,6 @@
 ---
 description: Represents the state of the F5 NGINX Controller Platform REST API.
-docs: DOCS-1278
+nd-docs: DOCS-1278
 doctypes:
   - reference
 type: redoc
diff --git a/content/controller/app-delivery/about-app-delivery.md b/content/controller/app-delivery/about-app-delivery.md
index e63b24722..81e50b6fb 100644
--- a/content/controller/app-delivery/about-app-delivery.md
+++ b/content/controller/app-delivery/about-app-delivery.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about F5 NGINX Controller Application Delivery concepts.
-docs: DOCS-474
+nd-docs: DOCS-474
 title: About Application Delivery
 toc: true
 weight: 100
diff --git a/content/controller/app-delivery/about-caching.md b/content/controller/app-delivery/about-caching.md
index e4b39ef17..3a58056ad 100644
--- a/content/controller/app-delivery/about-caching.md
+++ b/content/controller/app-delivery/about-caching.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how F5 NGINX Controller handles caching configurations and what
   NGINX cache directives are supported.
-docs: DOCS-339
+nd-docs: DOCS-339
 title: About Caching
 toc: true
 weight: 200
diff --git a/content/controller/app-delivery/about-snippets.md b/content/controller/app-delivery/about-snippets.md
index 8afb6b974..21eb1e83b 100644
--- a/content/controller/app-delivery/about-snippets.md
+++ b/content/controller/app-delivery/about-snippets.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-340
+nd-docs: DOCS-340
 title: About Snippets
 toc: true
 weight: 300
diff --git a/content/controller/app-delivery/deploy-simple-app.md b/content/controller/app-delivery/deploy-simple-app.md
index 999742480..37e36fe58 100644
--- a/content/controller/app-delivery/deploy-simple-app.md
+++ b/content/controller/app-delivery/deploy-simple-app.md
@@ -1,6 +1,6 @@
 ---
 description: Overview of the steps required to deploy a simple App.
-docs: DOCS-477
+nd-docs: DOCS-477
 title: Deploy a Simple Application
 toc: true
 weight: 400
diff --git a/content/controller/app-delivery/manage-apps.md b/content/controller/app-delivery/manage-apps.md
index da56c055d..1462c8f25 100644
--- a/content/controller/app-delivery/manage-apps.md
+++ b/content/controller/app-delivery/manage-apps.md
@@ -1,6 +1,6 @@
 ---
 description: Create, view, and edit Apps and Components.
-docs: DOCS-478
+nd-docs: DOCS-478
 title: Manage Apps & Components
 toc: true
 weight: 300
diff --git a/content/controller/app-delivery/security/concepts/app-sec-default-policy-original.md b/content/controller/app-delivery/security/concepts/app-sec-default-policy-original.md
index 12105faae..f701a423d 100644
--- a/content/controller/app-delivery/security/concepts/app-sec-default-policy-original.md
+++ b/content/controller/app-delivery/security/concepts/app-sec-default-policy-original.md
@@ -1,7 +1,7 @@
 ---
 description: Learn about the default protections provided by F5 NGINX Controller App
   Security.
-docs: DOCS-479
+nd-docs: DOCS-479
 title: Default WAF Policy
 toc: true
 weight: 200
diff --git a/content/controller/app-delivery/security/concepts/app-sec-metrics.md b/content/controller/app-delivery/security/concepts/app-sec-metrics.md
index 99ce76f41..fe7798b33 100644
--- a/content/controller/app-delivery/security/concepts/app-sec-metrics.md
+++ b/content/controller/app-delivery/security/concepts/app-sec-metrics.md
@@ -1,7 +1,7 @@
 ---
 description: Learn about the F5 NGINX Controller Application Security metrics and
   events.
-docs: DOCS-480
+nd-docs: DOCS-480
 title: App Security Metrics
 toc: true
 weight: 400
diff --git a/content/controller/app-delivery/security/concepts/bring-your-own-policy.md b/content/controller/app-delivery/security/concepts/bring-your-own-policy.md
index 2441867ff..f14497b08 100644
--- a/content/controller/app-delivery/security/concepts/bring-your-own-policy.md
+++ b/content/controller/app-delivery/security/concepts/bring-your-own-policy.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use your own F5 NGINX App Protect WAF policies with NGINX
   Controller.
-docs: DOCS-481
+nd-docs: DOCS-481
 title: Bring Your Own WAF Policy
 toc: true
 weight: 300
diff --git a/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md b/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md
index 761e2f779..9933ec89a 100644
--- a/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md
+++ b/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to extend your App Security configurations using F5 NGINX Controller
   Snippets.
-docs: DOCS-338
+nd-docs: DOCS-338
 title: Extend App Security with Snippets
 toc: true
 weight: 400
diff --git a/content/controller/app-delivery/security/concepts/what-is-waf.md b/content/controller/app-delivery/security/concepts/what-is-waf.md
index 51e8214ae..3aede1a1a 100644
--- a/content/controller/app-delivery/security/concepts/what-is-waf.md
+++ b/content/controller/app-delivery/security/concepts/what-is-waf.md
@@ -1,6 +1,6 @@
 ---
 description: Overview of the App Security module's WAF feature.
-docs: DOCS-483
+nd-docs: DOCS-483
 title: About App Security
 toc: true
 weight: 100
diff --git a/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md b/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md
index e2b31f6e4..29fbc7280 100644
--- a/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md
+++ b/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md
@@ -1,6 +1,6 @@
 ---
 description: How to add F5 NGINX Controller App Security to your applications.
-docs: DOCS-484
+nd-docs: DOCS-484
 title: Manage App Security
 toc: true
 weight: 100
diff --git a/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md b/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md
index aa4788632..616aa7070 100644
--- a/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md
+++ b/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md
@@ -1,7 +1,7 @@
 ---
 description: How to use F5 NGINX Controller App Security to monitor or block security
   violations.
-docs: DOCS-485
+nd-docs: DOCS-485
 title: Set Up App Security Monitor Mode
 toc: true
 weight: 200
diff --git a/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md b/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md
index 87de7192e..0a28a751e 100644
--- a/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md
+++ b/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md
@@ -1,6 +1,6 @@
 ---
 description: How to tune WAF for your App.
-docs: DOCS-486
+nd-docs: DOCS-486
 title: Manage WAF Tuning for App Components
 toc: true
 weight: 300
diff --git a/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md b/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md
index dc043934d..6249fe5b9 100644
--- a/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md
+++ b/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md
@@ -1,6 +1,6 @@
 ---
 description: How to use Role Based Access Control with App Security.
-docs: DOCS-845
+nd-docs: DOCS-845
 title: Using RBAC with the App Security Add-On
 toc: true
 weight: 400
diff --git a/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md b/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md
index ae20f8d92..2bdafffd0 100644
--- a/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md
+++ b/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md
@@ -1,6 +1,6 @@
 ---
 description: How to view App Security Analytics.
-docs: DOCS-487
+nd-docs: DOCS-487
 title: View App Security Analytics
 toc: true
 weight: 500
diff --git a/content/controller/infrastructure/instances/add-aws-instance.md b/content/controller/infrastructure/instances/add-aws-instance.md
index 1f558cc5a..fc8dacba6 100644
--- a/content/controller/infrastructure/instances/add-aws-instance.md
+++ b/content/controller/infrastructure/instances/add-aws-instance.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to deploy an AWS F5 NGINX instance using NGINX Controller.
-docs: DOCS-768
+nd-docs: DOCS-768
 title: Add an AWS NGINX Instance
 toc: true
 weight: 30
diff --git a/content/controller/infrastructure/instances/add-azure-instance.md b/content/controller/infrastructure/instances/add-azure-instance.md
index a537cee78..c5b222733 100644
--- a/content/controller/infrastructure/instances/add-azure-instance.md
+++ b/content/controller/infrastructure/instances/add-azure-instance.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to deploy an Azure NGINX instance using F5 NGINX Controller.
-docs: DOCS-769
+nd-docs: DOCS-769
 title: Add an Azure NGINX Instance
 toc: true
 weight: 35
diff --git a/content/controller/infrastructure/instances/add-nap-instance.md b/content/controller/infrastructure/instances/add-nap-instance.md
index 6a18eb991..9d6c5f63f 100644
--- a/content/controller/infrastructure/instances/add-nap-instance.md
+++ b/content/controller/infrastructure/instances/add-nap-instance.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to register an F5 NGINX App Protect instance with NGINX Controller
   for use with the ADC module.
-docs: DOCS-770
+nd-docs: DOCS-770
 title: Add an NGINX App Protect Instance
 toc: true
 weight: 20
diff --git a/content/controller/infrastructure/instances/add-vsphere-instance.md b/content/controller/infrastructure/instances/add-vsphere-instance.md
index 1a2ae31eb..30ec206ed 100644
--- a/content/controller/infrastructure/instances/add-vsphere-instance.md
+++ b/content/controller/infrastructure/instances/add-vsphere-instance.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to deploy a vSphere NGINX instance using F5 NGINX Controller.
-docs: DOCS-771
+nd-docs: DOCS-771
 title: Add a vSphere NGINX Instance
 toc: true
 weight: 35
diff --git a/content/controller/infrastructure/instances/analyzer.md b/content/controller/infrastructure/instances/analyzer.md
index 2afeaf0e3..b98aecdc4 100644
--- a/content/controller/infrastructure/instances/analyzer.md
+++ b/content/controller/infrastructure/instances/analyzer.md
@@ -1,6 +1,6 @@
 ---
 description: View graphs and system reports for your Instances.
-docs: DOCS-772
+nd-docs: DOCS-772
 title: View Performance Reports for Your Instances
 toc: true
 weight: 60
diff --git a/content/controller/infrastructure/instances/graphs.md b/content/controller/infrastructure/instances/graphs.md
index 96d4e7440..a2d43805c 100644
--- a/content/controller/infrastructure/instances/graphs.md
+++ b/content/controller/infrastructure/instances/graphs.md
@@ -1,6 +1,6 @@
 ---
 description: View key metrics for all of your monitored systems.
-docs: DOCS-773
+nd-docs: DOCS-773
 title: View System Metrics Graphs
 toc: true
 weight: 70
diff --git a/content/controller/infrastructure/instances/ha-data-plane.md b/content/controller/infrastructure/instances/ha-data-plane.md
index 7420a7e59..2d7c1e757 100644
--- a/content/controller/infrastructure/instances/ha-data-plane.md
+++ b/content/controller/infrastructure/instances/ha-data-plane.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to configure a high-availability data plane for your apps in
   on-premises deployments using F5 NGINX Controller, NGINX Plus, and keepalived.
-docs: DOCS-774
+nd-docs: DOCS-774
 title: Set Up Data Plane High Availability
 toc: true
 weight: 40
diff --git a/content/controller/infrastructure/instances/manage-containerized-instances.md b/content/controller/infrastructure/instances/manage-containerized-instances.md
index 83329e067..68a4796be 100644
--- a/content/controller/infrastructure/instances/manage-containerized-instances.md
+++ b/content/controller/infrastructure/instances/manage-containerized-instances.md
@@ -1,7 +1,7 @@
 ---
 description: How to set up Kubernetes-native API Gateways using Instance Groups (requires
   the API Management module).
-docs: DOCS-775
+nd-docs: DOCS-775
 title: Manage Containerized Instances
 toc: true
 weight: 15
diff --git a/content/controller/infrastructure/instances/manage-instance-templates.md b/content/controller/infrastructure/instances/manage-instance-templates.md
index cb55716d2..5af936c72 100644
--- a/content/controller/infrastructure/instances/manage-instance-templates.md
+++ b/content/controller/infrastructure/instances/manage-instance-templates.md
@@ -1,6 +1,6 @@
 ---
 description: Create and manage templates for your F5 NGINX Plus instances.
-docs: DOCS-776
+nd-docs: DOCS-776
 title: Manage Your Instance Templates
 toc: true
 weight: 50
diff --git a/content/controller/infrastructure/instances/manage-instances.md b/content/controller/infrastructure/instances/manage-instances.md
index 402215ce1..9042b12c5 100644
--- a/content/controller/infrastructure/instances/manage-instances.md
+++ b/content/controller/infrastructure/instances/manage-instances.md
@@ -1,6 +1,6 @@
 ---
 description: Use the Instance Overview page to view and manage your F5 NGINX Instances.
-docs: DOCS-777
+nd-docs: DOCS-777
 title: Manage Your NGINX Instances
 toc: true
 weight: 10
diff --git a/content/controller/infrastructure/locations/manage-locations.md b/content/controller/infrastructure/locations/manage-locations.md
index e9bfa813d..d9dbd175c 100644
--- a/content/controller/infrastructure/locations/manage-locations.md
+++ b/content/controller/infrastructure/locations/manage-locations.md
@@ -1,6 +1,6 @@
 ---
 description: Create and manage Locations for your F5 NGINX Instances.
-docs: DOCS-778
+nd-docs: DOCS-778
 title: Manage Locations
 toc: true
 weight: 10
diff --git a/content/controller/platform/about/get-controller-version.md b/content/controller/platform/about/get-controller-version.md
index 32df5daf1..39cd5840c 100644
--- a/content/controller/platform/about/get-controller-version.md
+++ b/content/controller/platform/about/get-controller-version.md
@@ -1,6 +1,6 @@
 ---
 description: How to look up the version details for F5 NGINX Controller and its components.
-docs: DOCS-780
+nd-docs: DOCS-780
 title: Look Up Version Information
 toc: true
 weight: 130
diff --git a/content/controller/platform/about/what-is-controller.md b/content/controller/platform/about/what-is-controller.md
index 8f3089c4b..fa5ee4c8e 100644
--- a/content/controller/platform/about/what-is-controller.md
+++ b/content/controller/platform/about/what-is-controller.md
@@ -1,6 +1,6 @@
 ---
 description: Overview of F5 NGINX Controller.
-docs: DOCS-781
+nd-docs: DOCS-781
 title: Get to Know NGINX Controller
 toc: true
 weight: 100
diff --git a/content/controller/platform/access-management/manage-active-directory-auth-provider.md b/content/controller/platform/access-management/manage-active-directory-auth-provider.md
index b5ef6a79d..8eeedb348 100644
--- a/content/controller/platform/access-management/manage-active-directory-auth-provider.md
+++ b/content/controller/platform/access-management/manage-active-directory-auth-provider.md
@@ -1,7 +1,7 @@
 ---
 description: Set up Active Directory authentication for F5 NGINX Controller using
   OIDC with Microsoft Entra or LDAP, LDAPs, and StartTLS with Windows Active Directory.
-docs: DOCS-782
+nd-docs: DOCS-782
 title: Configure Active Directory Integration
 toc: true
 weight: 10
diff --git a/content/controller/platform/access-management/manage-roles.md b/content/controller/platform/access-management/manage-roles.md
index bffb8654e..166fb8e77 100644
--- a/content/controller/platform/access-management/manage-roles.md
+++ b/content/controller/platform/access-management/manage-roles.md
@@ -1,6 +1,6 @@
 ---
 description: Create and manage Roles and Role Groups.
-docs: DOCS-783
+nd-docs: DOCS-783
 title: Manage Roles and Role Groups
 toc: true
 weight: 30
diff --git a/content/controller/platform/access-management/manage-users.md b/content/controller/platform/access-management/manage-users.md
index fa3f8b087..4ff0d6fd0 100644
--- a/content/controller/platform/access-management/manage-users.md
+++ b/content/controller/platform/access-management/manage-users.md
@@ -1,6 +1,6 @@
 ---
 description: Create and manage User resources.
-docs: DOCS-784
+nd-docs: DOCS-784
 title: Manage Users
 toc: true
 weight: 20
diff --git a/content/controller/platform/integrations/aws-integration.md b/content/controller/platform/integrations/aws-integration.md
index 9d4a2e0e9..98f44a9eb 100644
--- a/content/controller/platform/integrations/aws-integration.md
+++ b/content/controller/platform/integrations/aws-integration.md
@@ -1,6 +1,6 @@
 ---
 description: Integrate F5 NGINX Controller with Amazon Web Services.
-docs: DOCS-785
+nd-docs: DOCS-785
 title: AWS Integration
 toc: true
 weight: 20
diff --git a/content/controller/platform/integrations/big-ip-self-service.md b/content/controller/platform/integrations/big-ip-self-service.md
index adb9e1d0b..66acd46c5 100644
--- a/content/controller/platform/integrations/big-ip-self-service.md
+++ b/content/controller/platform/integrations/big-ip-self-service.md
@@ -1,6 +1,6 @@
 ---
 description: Integrate F5 NGINX Controller with a BIG-IP cluster.
-docs: DOCS-786
+nd-docs: DOCS-786
 title: BIG-IP Integration
 toc: true
 weight: 20
diff --git a/content/controller/platform/integrations/datadog-integration.md b/content/controller/platform/integrations/datadog-integration.md
index 18f41e82b..47ceb8bc8 100644
--- a/content/controller/platform/integrations/datadog-integration.md
+++ b/content/controller/platform/integrations/datadog-integration.md
@@ -1,6 +1,6 @@
 ---
 description: Create a Datadog Integration for F5 NGINX Controller.
-docs: DOCS-564
+nd-docs: DOCS-564
 title: Datadog Integration
 weight: 30
 ---
diff --git a/content/controller/platform/integrations/otlp-integration.md b/content/controller/platform/integrations/otlp-integration.md
index 95f66b7a0..4f898317e 100644
--- a/content/controller/platform/integrations/otlp-integration.md
+++ b/content/controller/platform/integrations/otlp-integration.md
@@ -1,6 +1,6 @@
 ---
 description: Create an OpenTelemetry Protocol (OTLP) Integration for F5 NGINX Controller.
-docs: DOCS-565
+nd-docs: DOCS-565
 title: OTLP Integration
 weight: 30
 ---
diff --git a/content/controller/platform/integrations/splunk-integration.md b/content/controller/platform/integrations/splunk-integration.md
index 81bcdd06a..5ae9b7b8f 100644
--- a/content/controller/platform/integrations/splunk-integration.md
+++ b/content/controller/platform/integrations/splunk-integration.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-566
+nd-docs: DOCS-566
 title: Splunk Integration
 weight: 40
 ---
diff --git a/content/controller/platform/integrations/syslog-integration.md b/content/controller/platform/integrations/syslog-integration.md
index 939dff7c2..00f5787ce 100644
--- a/content/controller/platform/integrations/syslog-integration.md
+++ b/content/controller/platform/integrations/syslog-integration.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-567
+nd-docs: DOCS-567
 title: Syslog Integration
 weight: 30
 ---
diff --git a/content/controller/platform/licensing-controller.md b/content/controller/platform/licensing-controller.md
index d302723bd..a1b5c8602 100644
--- a/content/controller/platform/licensing-controller.md
+++ b/content/controller/platform/licensing-controller.md
@@ -1,6 +1,6 @@
 ---
 description: Follow these steps to license your F5 NGINX Controller.
-docs: DOCS-787
+nd-docs: DOCS-787
 title: License NGINX Controller
 toc: true
 weight: 120
diff --git a/content/controller/platform/maintenance/changing-ip-address.md b/content/controller/platform/maintenance/changing-ip-address.md
index 5377f8752..8d4cf28a2 100644
--- a/content/controller/platform/maintenance/changing-ip-address.md
+++ b/content/controller/platform/maintenance/changing-ip-address.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to safely change the management IP of F5 NGINX Controller.
-docs: DOCS-779
+nd-docs: DOCS-779
 title: Changing the IP address
 toc: true
 weight: 135
diff --git a/content/controller/platform/manage-cluster.md b/content/controller/platform/manage-cluster.md
index c187e0c3e..b5e2bf6ef 100644
--- a/content/controller/platform/manage-cluster.md
+++ b/content/controller/platform/manage-cluster.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to add and manage additional F5 NGINX Controller nodes to create
   a resilient cluster.
-docs: DOCS-788
+nd-docs: DOCS-788
 title: Manage Your Cluster
 toc: true
 weight: 140
diff --git a/content/controller/releases/adc/adc-release-notes-3.20.1.md b/content/controller/releases/adc/adc-release-notes-3.20.1.md
index 3d3d02852..d9ee49128 100644
--- a/content/controller/releases/adc/adc-release-notes-3.20.1.md
+++ b/content/controller/releases/adc/adc-release-notes-3.20.1.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-362
+nd-docs: DOCS-362
 title: Release Notes 3.20.1
 toc: true
 weight: 99
diff --git a/content/controller/releases/adc/adc-release-notes-3.20.md b/content/controller/releases/adc/adc-release-notes-3.20.md
index eeb4b45ac..9c446f0af 100644
--- a/content/controller/releases/adc/adc-release-notes-3.20.md
+++ b/content/controller/releases/adc/adc-release-notes-3.20.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-363
+nd-docs: DOCS-363
 title: Release Notes 3.20.0
 toc: true
 weight: 100
diff --git a/content/controller/releases/adc/adc-release-notes-3.21.md b/content/controller/releases/adc/adc-release-notes-3.21.md
index 1f8fdacc4..6356e2b1b 100644
--- a/content/controller/releases/adc/adc-release-notes-3.21.md
+++ b/content/controller/releases/adc/adc-release-notes-3.21.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-364
+nd-docs: DOCS-364
 title: Release Notes 3.21.0
 toc: true
 weight: 98
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.1.md b/content/controller/releases/adc/adc-release-notes-3.22.1.md
index be4725b06..1edfce2a2 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.1.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.1.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-834
+nd-docs: DOCS-834
 title: Release Notes 3.22.1
 toc: true
 weight: 96
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.2.md b/content/controller/releases/adc/adc-release-notes-3.22.2.md
index 5c34ef08d..be60921c1 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.2.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.2.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-844
+nd-docs: DOCS-844
 title: Release Notes 3.22.2
 toc: true
 weight: 95
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.3.md b/content/controller/releases/adc/adc-release-notes-3.22.3.md
index 2e5b929a0..f2cd355dd 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.3.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.3.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-903
+nd-docs: DOCS-903
 title: Release Notes 3.22.3
 toc: true
 weight: 94
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.4.md b/content/controller/releases/adc/adc-release-notes-3.22.4.md
index d9a643241..b3e57e438 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.4.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.4.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-904
+nd-docs: DOCS-904
 title: Release Notes 3.22.4
 toc: true
 weight: 93
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.5.md b/content/controller/releases/adc/adc-release-notes-3.22.5.md
index 1a2d67d64..62d7320f4 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.5.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.5.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-945
+nd-docs: DOCS-945
 title: Release Notes 3.22.5
 toc: true
 weight: 92
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.6.md b/content/controller/releases/adc/adc-release-notes-3.22.6.md
index 75d6bd8ac..ccc955ea1 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.6.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.6.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-1086
+nd-docs: DOCS-1086
 title: Release Notes 3.22.6
 toc: true
 weight: 91
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.7.md b/content/controller/releases/adc/adc-release-notes-3.22.7.md
index a1883fb55..4c6c304d9 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.7.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.7.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-1388
+nd-docs: DOCS-1388
 title: Release Notes 3.22.7
 toc: true
 weight: 90
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.8.md b/content/controller/releases/adc/adc-release-notes-3.22.8.md
index 43d27fea1..2b5615851 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.8.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.8.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-1128
+nd-docs: DOCS-1128
 title: Release Notes 3.22.8
 toc: true
 weight: 89
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.9.md b/content/controller/releases/adc/adc-release-notes-3.22.9.md
index 7a073233a..dc2273c0a 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.9.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.9.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-1341
+nd-docs: DOCS-1341
 title: Release Notes 3.22.9
 toc: true
 weight: 88
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.md b/content/controller/releases/adc/adc-release-notes-3.22.md
index 3aa65aa56..c6766cdb9 100644
--- a/content/controller/releases/adc/adc-release-notes-3.22.md
+++ b/content/controller/releases/adc/adc-release-notes-3.22.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller Application Delivery Module.
-docs: DOCS-833
+nd-docs: DOCS-833
 title: Release Notes 3.22.0
 toc: true
 weight: 97
diff --git a/content/controller/releases/apim/apim-release-notes-3.18.1.md b/content/controller/releases/apim/apim-release-notes-3.18.1.md
index daa7f82d4..95a88a006 100644
--- a/content/controller/releases/apim/apim-release-notes-3.18.1.md
+++ b/content/controller/releases/apim/apim-release-notes-3.18.1.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-365
+nd-docs: DOCS-365
 title: Release Notes 3.18.1
 toc: true
 weight: 99
diff --git a/content/controller/releases/apim/apim-release-notes-3.18.md b/content/controller/releases/apim/apim-release-notes-3.18.md
index 4e165a625..c76b7d9ab 100644
--- a/content/controller/releases/apim/apim-release-notes-3.18.md
+++ b/content/controller/releases/apim/apim-release-notes-3.18.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-366
+nd-docs: DOCS-366
 title: Release Notes 3.18.0
 toc: true
 weight: 100
diff --git a/content/controller/releases/apim/apim-release-notes-3.19.1.md b/content/controller/releases/apim/apim-release-notes-3.19.1.md
index 6bb063f3e..a1861b9f2 100644
--- a/content/controller/releases/apim/apim-release-notes-3.19.1.md
+++ b/content/controller/releases/apim/apim-release-notes-3.19.1.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-367
+nd-docs: DOCS-367
 title: Release Notes 3.19.1
 toc: true
 weight: 96
diff --git a/content/controller/releases/apim/apim-release-notes-3.19.2.md b/content/controller/releases/apim/apim-release-notes-3.19.2.md
index 8767ed6f3..02d25e6f8 100644
--- a/content/controller/releases/apim/apim-release-notes-3.19.2.md
+++ b/content/controller/releases/apim/apim-release-notes-3.19.2.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-368
+nd-docs: DOCS-368
 title: Release Notes 3.19.2
 toc: true
 weight: 95
diff --git a/content/controller/releases/apim/apim-release-notes-3.19.3.md b/content/controller/releases/apim/apim-release-notes-3.19.3.md
index 111d667e4..58766df89 100644
--- a/content/controller/releases/apim/apim-release-notes-3.19.3.md
+++ b/content/controller/releases/apim/apim-release-notes-3.19.3.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-887
+nd-docs: DOCS-887
 title: Release Notes 3.19.3
 toc: true
 weight: 94
diff --git a/content/controller/releases/apim/apim-release-notes-3.19.4.md b/content/controller/releases/apim/apim-release-notes-3.19.4.md
index a836bb66f..6ac037e35 100644
--- a/content/controller/releases/apim/apim-release-notes-3.19.4.md
+++ b/content/controller/releases/apim/apim-release-notes-3.19.4.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-888
+nd-docs: DOCS-888
 title: Release Notes 3.19.4
 toc: true
 weight: 93
diff --git a/content/controller/releases/apim/apim-release-notes-3.19.5.md b/content/controller/releases/apim/apim-release-notes-3.19.5.md
index 2a8d44b63..f426e942b 100644
--- a/content/controller/releases/apim/apim-release-notes-3.19.5.md
+++ b/content/controller/releases/apim/apim-release-notes-3.19.5.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-1113
+nd-docs: DOCS-1113
 title: Release Notes 3.19.5
 toc: true
 weight: 92
diff --git a/content/controller/releases/apim/apim-release-notes-3.19.6.md b/content/controller/releases/apim/apim-release-notes-3.19.6.md
index caa74a837..cc69889cd 100644
--- a/content/controller/releases/apim/apim-release-notes-3.19.6.md
+++ b/content/controller/releases/apim/apim-release-notes-3.19.6.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-1282
+nd-docs: DOCS-1282
 title: Release Notes 3.19.6
 toc: true
 weight: 91
diff --git a/content/controller/releases/apim/apim-release-notes-3.19.md b/content/controller/releases/apim/apim-release-notes-3.19.md
index d443b7f00..fb1077f9b 100644
--- a/content/controller/releases/apim/apim-release-notes-3.19.md
+++ b/content/controller/releases/apim/apim-release-notes-3.19.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes contain information about new features, improvements,
   known issues, and bug fixes in the NGINX Controller API Management Module.
-docs: DOCS-369
+nd-docs: DOCS-369
 title: Release Notes 3.19.0
 toc: true
 weight: 97
diff --git a/content/controller/releases/release-notes.md b/content/controller/releases/release-notes.md
index f5d74c780..139e644d2 100644
--- a/content/controller/releases/release-notes.md
+++ b/content/controller/releases/release-notes.md
@@ -1,7 +1,7 @@
 ---
 description: Learn about the new features, enhancements, resolved issues, and known
   issues in F5 NGINX Controller.
-docs: DOCS-370
+nd-docs: DOCS-370
 title: NGINX Controller v3.0.0–3.18.3
 toc: true
 weight: 10
diff --git a/content/controller/services/available-policies.md b/content/controller/services/available-policies.md
index e8d81dbea..17b49ec6f 100644
--- a/content/controller/services/available-policies.md
+++ b/content/controller/services/available-policies.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the policies available for use in the F5 NGINX Controller.
-docs: DOCS-568
+nd-docs: DOCS-568
 title: Learn About Policies
 toc: true
 weight: 130
diff --git a/content/controller/services/manage-certs.md b/content/controller/services/manage-certs.md
index 32fcf9bc1..d87d72aab 100644
--- a/content/controller/services/manage-certs.md
+++ b/content/controller/services/manage-certs.md
@@ -1,6 +1,6 @@
 ---
 description: Create, apply, and mange Certs to use with your environments.
-docs: DOCS-371
+nd-docs: DOCS-371
 title: Manage Certs
 toc: true
 weight: 120
diff --git a/content/controller/services/manage-environments.md b/content/controller/services/manage-environments.md
index c381c88b6..5ffa5a3f6 100644
--- a/content/controller/services/manage-environments.md
+++ b/content/controller/services/manage-environments.md
@@ -1,6 +1,6 @@
 ---
 description: Create and manage environments to use with your apps, gateways, and certs.
-docs: DOCS-372
+nd-docs: DOCS-372
 title: Manage Environments
 toc: true
 weight: 100
diff --git a/content/controller/services/manage-gateways.md b/content/controller/services/manage-gateways.md
index 2eb87b8ec..e99d66ae9 100644
--- a/content/controller/services/manage-gateways.md
+++ b/content/controller/services/manage-gateways.md
@@ -1,6 +1,6 @@
 ---
 description: Create, view, and edit Gateways.
-docs: DOCS-373
+nd-docs: DOCS-373
 title: Manage Gateways
 toc: true
 weight: 120
diff --git a/content/controller/services/manage-identity-providers.md b/content/controller/services/manage-identity-providers.md
index 3df64f6d7..e234ca0e5 100644
--- a/content/controller/services/manage-identity-providers.md
+++ b/content/controller/services/manage-identity-providers.md
@@ -1,6 +1,6 @@
 ---
 description: Create and Manage Identity Providers.
-docs: DOCS-571
+nd-docs: DOCS-571
 title: Manage Identity Providers
 toc: true
 weight: 140
diff --git a/content/controller/services/overview.md b/content/controller/services/overview.md
index a073c6a04..caf809da7 100644
--- a/content/controller/services/overview.md
+++ b/content/controller/services/overview.md
@@ -1,7 +1,7 @@
 ---
 description: Learn about the common tasks and resources that are required to deploy
   and manage Services using F5 NGINX Controller.
-docs: DOCS-374
+nd-docs: DOCS-374
 title: Set Up NGINX Controller Services
 toc: true
 weight: 10
diff --git a/content/controller/support/contact-support.md b/content/controller/support/contact-support.md
index c526b6fed..f440bac71 100644
--- a/content/controller/support/contact-support.md
+++ b/content/controller/support/contact-support.md
@@ -1,6 +1,6 @@
 ---
 description: Contact information and knowledge resources for F5 NGINX Support.
-docs: DOCS-375
+nd-docs: DOCS-375
 title: Where to Go for Support
 toc: true
 weight: 10
diff --git a/content/controller/support/troubleshooting-controller.md b/content/controller/support/troubleshooting-controller.md
index 09cf2eac5..3f0c11e05 100644
--- a/content/controller/support/troubleshooting-controller.md
+++ b/content/controller/support/troubleshooting-controller.md
@@ -1,7 +1,7 @@
 ---
 description: Steps to take to investigate and fix issues with F5 NGINX Controller
   and the Controller Agent.
-docs: DOCS-376
+nd-docs: DOCS-376
 title: Troubleshoot NGINX Controller and the Controller Agent
 toc: true
 weight: 100
diff --git a/content/controller/support/troubleshooting-forwarders.md b/content/controller/support/troubleshooting-forwarders.md
index ce2ae120f..235579408 100644
--- a/content/controller/support/troubleshooting-forwarders.md
+++ b/content/controller/support/troubleshooting-forwarders.md
@@ -1,6 +1,6 @@
 ---
 description: Steps to take to investigate and fix issues with data forwarders.
-docs: DOCS-377
+nd-docs: DOCS-377
 title: Troubleshoot Data Forwarders
 toc: true
 weight: 200
diff --git a/content/includes/acm/about/global-policies.md b/content/includes/acm/about/global-policies.md
index 6d4e66500..5c5c47df3 100644
--- a/content/includes/acm/about/global-policies.md
+++ b/content/includes/acm/about/global-policies.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1283
+nd-docs: DOCS-1283
 ---
 
 The following table shows the available Global Policies you can use when creating a new cluster.
diff --git a/content/includes/acm/how-to/policies-proxy-cluster-intro.md b/content/includes/acm/how-to/policies-proxy-cluster-intro.md
index 066e5d1bf..d109bfcf3 100644
--- a/content/includes/acm/how-to/policies-proxy-cluster-intro.md
+++ b/content/includes/acm/how-to/policies-proxy-cluster-intro.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1285
+nd-docs: DOCS-1285
 ---
 
 In API Connectivity Manager, you can apply cluster policies to API Gateways and Developer Portals to further enhance their configuration to meet your requirements. A proxy cluster is a group of instances configured as API Gateways or Developer Portals. Any cluster policy will apply to all instances in a group.
diff --git a/content/includes/acm/how-to/policies-proxy-intro.md b/content/includes/acm/how-to/policies-proxy-intro.md
index 79053568f..63f57ba84 100644
--- a/content/includes/acm/how-to/policies-proxy-intro.md
+++ b/content/includes/acm/how-to/policies-proxy-intro.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1286
+nd-docs: DOCS-1286
 ---
 
 In API Connectivity Manager, you can apply policies to an API Gateway to further enhance their configuration to meet your requirements.
diff --git a/content/includes/acm/openapi-support.md b/content/includes/acm/openapi-support.md
index 382b55d4e..1d4393653 100644
--- a/content/includes/acm/openapi-support.md
+++ b/content/includes/acm/openapi-support.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1188
+nd-docs: DOCS-1188
 ---
 
 {{< note >}}API Connectivity Manager supports the [OpenAPI Specification version 3.0 and 3.1](https://swagger.io/specification/). If your spec uses the 2.0 standard, you must convert it before uploading it.{{< /note >}}
diff --git a/content/includes/acm/webui-acm-login.md b/content/includes/acm/webui-acm-login.md
index ce33502dc..bd38ca740 100644
--- a/content/includes/acm/webui-acm-login.md
+++ b/content/includes/acm/webui-acm-login.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1189
+nd-docs: DOCS-1189
 ---
 
 In a web browser, go to the FQDN for your NGINX Instance Manager host and log in. Then, from the Launchpad menu, select **API Connectivity Manager**.
diff --git a/content/includes/agent/installation/install-agent-api.md b/content/includes/agent/installation/install-agent-api.md
index 15009d21f..5474f995b 100644
--- a/content/includes/agent/installation/install-agent-api.md
+++ b/content/includes/agent/installation/install-agent-api.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1031
+nd-docs: DOCS-1031
 files:
   - content/nim/nginx-app-protect/setup-waf-config-management.md
 ---
diff --git a/content/includes/controller/apim-rn-preamble.md b/content/includes/controller/apim-rn-preamble.md
index fbd0ea643..85429019e 100644
--- a/content/includes/controller/apim-rn-preamble.md
+++ b/content/includes/controller/apim-rn-preamble.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1306
+nd-docs: DOCS-1306
 ---
 
 We encourage you to install the latest version of the NGINX Controller APIM module to take advantage of the newest features and updates.
diff --git a/content/includes/installation/access-web-ui.md b/content/includes/installation/access-web-ui.md
index 4f0199cc7..d51fe6f73 100644
--- a/content/includes/installation/access-web-ui.md
+++ b/content/includes/installation/access-web-ui.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1241
+nd-docs: DOCS-1241
 ---
 
 To access the NGINX Instance Manager web interface, open a web browser and go to `https://<NMS_FQDN>`, replacing `<NMS_FQDN>` with the Fully Qualified Domain Name of your NGINX Instance Manager host.
diff --git a/content/includes/installation/add-nms-repo.md b/content/includes/installation/add-nms-repo.md
index eac86faa7..05639f135 100644
--- a/content/includes/installation/add-nms-repo.md
+++ b/content/includes/installation/add-nms-repo.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1243
+nd-docs: DOCS-1243
 ---
 
 Select the tab matching your Linux distribution, then follow the instructions to add the NGINX Instance Manager repository.
@@ -41,7 +41,7 @@ Add the NGINX Instance Manager repository:
   ```shell
   wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key \
       | gpg --dearmor \
-      | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null 
+      | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
   ```
 
 2. Add the NGINX Instance Manager repository:
diff --git a/content/includes/installation/agent-selinux.md b/content/includes/installation/agent-selinux.md
index 4a8cf0741..f8bdfe4d0 100644
--- a/content/includes/installation/agent-selinux.md
+++ b/content/includes/installation/agent-selinux.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1403
+nd-docs: DOCS-1403
 ---
 
 ```bash
diff --git a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configuration-options.md b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configuration-options.md
index e2b41be4c..6cea14a5c 100644
--- a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configuration-options.md
+++ b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configuration-options.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1308
+nd-docs: DOCS-1308
 ---
 
 The `values.yaml` file within the `nginx-devportal` Helm chart contains the deployment configuration for the Developer Portal.
diff --git a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-api-mtls.md b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-api-mtls.md
index a7f7d99ac..1d7358f1e 100644
--- a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-api-mtls.md
+++ b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-api-mtls.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1309
+nd-docs: DOCS-1309
 ---
 
 When deploying the Developer Portal using a helm chart, you can configure TLS to secure communication between the NGINX API Gateway and backend API service.
diff --git a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-embedded-postgres.md b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-embedded-postgres.md
index 694a88c1d..b14932a4e 100644
--- a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-embedded-postgres.md
+++ b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-embedded-postgres.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1311
+nd-docs: DOCS-1311
 ---
 
 You can use an embedded PostgreSQL database for backend API service storage when deploying the Developer Portal from a Helm chart. This configuration uses a [PersistentVolumeClaim (PVC)](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) for storage of the the PostgreSQL data files. Access between the backend API service and the database is secured using auto-generated client TLS certificates.
diff --git a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-external-postgres.md b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-external-postgres.md
index a2acc97df..54bdc7396 100644
--- a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-external-postgres.md
+++ b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-devportal-helm-external-postgres.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1307
+nd-docs: DOCS-1307
 ---
 
 You can use an external PostgreSQL database for backend API service storage when deploying the Developer Portal from a Helm chart. Access between the backend API service and the database can be secured using TLS server certificates and optional client TLS certificates.
diff --git a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-helm-devportal-sqlite.md b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-helm-devportal-sqlite.md
index 2edd94094..d1a4b970a 100644
--- a/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-helm-devportal-sqlite.md
+++ b/content/includes/installation/helm/acm/dev-portal-helm-configurations/configure-helm-devportal-sqlite.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1312
+nd-docs: DOCS-1312
 ---
 
 You can use an SQLite database for backend API service storage when deploying the Developer Portal from a Helm chart. This configuration uses a [PersistentVolumeClaim (PVC)](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) for storage of the SQLite data files.
diff --git a/content/includes/installation/nms-prerequisites.md b/content/includes/installation/nms-prerequisites.md
index da6a17fd7..db01872ea 100644
--- a/content/includes/installation/nms-prerequisites.md
+++ b/content/includes/installation/nms-prerequisites.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1242
+nd-docs: DOCS-1242
 ---
 
 {{< important >}}
diff --git a/content/includes/installation/optional-installation-steps.md b/content/includes/installation/optional-installation-steps.md
index d8051f7d3..71674e85b 100644
--- a/content/includes/installation/optional-installation-steps.md
+++ b/content/includes/installation/optional-installation-steps.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1030
+nd-docs: DOCS-1030
 ---
 
 The following steps may be necessary depending on your installation configuration.
diff --git a/content/includes/installation/secure-installation.md b/content/includes/installation/secure-installation.md
index 35a08c963..509d72e65 100644
--- a/content/includes/installation/secure-installation.md
+++ b/content/includes/installation/secure-installation.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1405
+nd-docs: DOCS-1405
 ---
 
 To ensure that your NGINX Instance Manager deployment remains secure, follow the recommendations in this section:
diff --git a/content/includes/nap-waf/build-from-official-nginx-image.md b/content/includes/nap-waf/build-from-official-nginx-image.md
index 9946fefd5..e6b0e4c8d 100644
--- a/content/includes/nap-waf/build-from-official-nginx-image.md
+++ b/content/includes/nap-waf/build-from-official-nginx-image.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1509"
+nd-docs: "DOCS-1509"
 ---
 
 {{< note >}}
diff --git a/content/includes/nap-waf/build-nginx-image-cmd.md b/content/includes/nap-waf/build-nginx-image-cmd.md
index fcb89d363..4e7e2387f 100644
--- a/content/includes/nap-waf/build-nginx-image-cmd.md
+++ b/content/includes/nap-waf/build-nginx-image-cmd.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1512"
+nd-docs: "DOCS-1512"
 ---
 
 {{< note >}}
diff --git a/content/includes/nap-waf/bundles-volume-mount.md b/content/includes/nap-waf/bundles-volume-mount.md
index c42242fee..c65050849 100644
--- a/content/includes/nap-waf/bundles-volume-mount.md
+++ b/content/includes/nap-waf/bundles-volume-mount.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1511"
+nd-docs: "DOCS-1511"
 ---
 
 To work with custom policy and logging profile bundles, these files must be accessible to the `waf-config-mgr` container.
diff --git a/content/includes/nap-waf/concept/apreload.md b/content/includes/nap-waf/concept/apreload.md
index cfd5f6fd0..2da2e366c 100644
--- a/content/includes/nap-waf/concept/apreload.md
+++ b/content/includes/nap-waf/concept/apreload.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 apreload is a tool that can update that can update the NGINX App Protect WAF configuration without having to reload NGINX if only the App Protect configuration is changed and the `nginx.conf` file remains unchanged. apreload does not affect the existing NGINX reload process and it functions in the same manner as before.
diff --git a/content/includes/nap-waf/concept/attack-signatures.md b/content/includes/nap-waf/concept/attack-signatures.md
index dbdf294b7..1b56c1a9b 100644
--- a/content/includes/nap-waf/concept/attack-signatures.md
+++ b/content/includes/nap-waf/concept/attack-signatures.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 Attack signatures are rules or patterns that identify attack sequences or classes of attacks on a web application and its components. You can apply attack signatures to both requests and responses. App Protect includes predefined attack signatures to protect your application against all attack types identified by the system.
\ No newline at end of file
diff --git a/content/includes/nap-waf/concept/basic-config-default-policy.md b/content/includes/nap-waf/concept/basic-config-default-policy.md
index fc56a65c7..3854b5a45 100644
--- a/content/includes/nap-waf/concept/basic-config-default-policy.md
+++ b/content/includes/nap-waf/concept/basic-config-default-policy.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 The base template is the common starting point to any policy you write. The default policy just reflects that template without any further modifications, thus we use the terms **base template** and **default policy** interchangeably. The default policy appears as follows
diff --git a/content/includes/nap-waf/concept/external-references.md b/content/includes/nap-waf/concept/external-references.md
index 5de006331..d0c2cdf31 100644
--- a/content/includes/nap-waf/concept/external-references.md
+++ b/content/includes/nap-waf/concept/external-references.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 External references in policy are defined as any code blocks that can be used as part of the policy without being explicitly pasted within the policy file. This means that you can have a set of pre-defined configurations for parts of the policy, and you can incorporate them as part of the policy by simply referencing them. This would save a lot of overhead having to concentrate everything into a single policy file.
diff --git a/content/includes/nap-waf/concept/global-directives.md b/content/includes/nap-waf/concept/global-directives.md
index 46dd8852c..d3b998312 100644
--- a/content/includes/nap-waf/concept/global-directives.md
+++ b/content/includes/nap-waf/concept/global-directives.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 Global configuration consists of a series of `nginx.conf` directives at the `http` context controlling aspects that are not specific to a specific application.
diff --git a/content/includes/nap-waf/concept/graphql-profile.md b/content/includes/nap-waf/concept/graphql-profile.md
index da2e0bc23..c23175f8d 100644
--- a/content/includes/nap-waf/concept/graphql-profile.md
+++ b/content/includes/nap-waf/concept/graphql-profile.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 The GraphQL Profile defines the GraphQL properties that are enforced by the security policy.
diff --git a/content/includes/nap-waf/concept/grpc-logging.md b/content/includes/nap-waf/concept/grpc-logging.md
index b4c7c826d..bcce1d690 100644
--- a/content/includes/nap-waf/concept/grpc-logging.md
+++ b/content/includes/nap-waf/concept/grpc-logging.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 Security log for gRPC requests has unique fields: `uri`, `grpc_method`, and `grpc_service`. Also, since the content of gRPC requests is binary (Protocol Buffers), it is better transferred in Base64 encoding. Hence, it is recommended to use the `headers` and `request_body_base64` fields instead of the `request` field. A new predefined log format called `grpc` should be used in all gRPC locations that also use policies with gRPC Content Profiles.
diff --git a/content/includes/nap-waf/config/common/additional-config-options.md b/content/includes/nap-waf/config/common/additional-config-options.md
index 80e253d6c..d9bdd6b10 100644
--- a/content/includes/nap-waf/config/common/additional-config-options.md
+++ b/content/includes/nap-waf/config/common/additional-config-options.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1552"
+nd-docs: "DOCS-1552"
 ---
 
 #### XFF Headers and Trust
diff --git a/content/includes/nap-waf/config/common/additional-policy-features.md b/content/includes/nap-waf/config/common/additional-policy-features.md
index 190c24a06..ce5395a0e 100644
--- a/content/includes/nap-waf/config/common/additional-policy-features.md
+++ b/content/includes/nap-waf/config/common/additional-policy-features.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1592"
+nd-docs: "DOCS-1592"
 ---
 
 {{<bootstrap-table "table table-striped table-bordered table-sm table-responsive">}}
diff --git a/content/includes/nap-waf/config/common/anti-automation.md b/content/includes/nap-waf/config/common/anti-automation.md
index 229037e39..93459aaba 100644
--- a/content/includes/nap-waf/config/common/anti-automation.md
+++ b/content/includes/nap-waf/config/common/anti-automation.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1575"
+nd-docs: "DOCS-1575"
 ---
 
 Anti Automation provides basic bot protection by detecting bot signatures and clients that falsely claim to be browsers or search engines. The `bot-defense` section in the policy is enabled by default. Anti Automation encompasses both Bot Signatures and Header Anomalies, each of which can be disabled separately.
diff --git a/content/includes/nap-waf/config/common/associating-graphql-profiles.md b/content/includes/nap-waf/config/common/associating-graphql-profiles.md
index 60b86bfa8..6956777bc 100644
--- a/content/includes/nap-waf/config/common/associating-graphql-profiles.md
+++ b/content/includes/nap-waf/config/common/associating-graphql-profiles.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1607"
+nd-docs: "DOCS-1607"
 ---
 
 The last step is to associate the GraphQL profiles with the URLs. As with JSON and XML profiles, in order for a GraphQL Profile to become effective, it has to be associated with a URL that represents the service. Add the GraphQL profile name which you defined previously under the GraphQL profiles in the name field. For example, here we have defined two GraphQL profiles with the "name": "Default" and "My Custom Profile" under the urlContentProfiles. Later we also associated these profiles in "graphql-profiles".
diff --git a/content/includes/nap-waf/config/common/associating-profiles-urls.md b/content/includes/nap-waf/config/common/associating-profiles-urls.md
index 4afe9e486..32759a008 100644
--- a/content/includes/nap-waf/config/common/associating-profiles-urls.md
+++ b/content/includes/nap-waf/config/common/associating-profiles-urls.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1555"
+nd-docs: "DOCS-1555"
 ---
 
 As with JSON and XML profiles, in order for a gRPC Content Profile to become effective, it has to be associated with a URL that represents the service. However, in the sample policy above, the profile was apparently not associated with any URL and yet the profile is active. How did this happen? By setting `associateUrls` with `true`, App Protect **implicitly** creates the URL based on the package and service name as defined in the IDL file and associates the profile with that URL. In this example, the URL is `/myorg.services.photo_album/*`. Note it is a wildcard URL so that all methods in this service match it in its suffix; for example `/myorg.services.photo_album/get_photos` represents the `get_photos` RPC method.
diff --git a/content/includes/nap-waf/config/common/attack-types.md b/content/includes/nap-waf/config/common/attack-types.md
index fff386874..520850bd6 100644
--- a/content/includes/nap-waf/config/common/attack-types.md
+++ b/content/includes/nap-waf/config/common/attack-types.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1570"
+nd-docs: "DOCS-1570"
 ---
 
 Each signature, factory or user-defined, and violation has an **Attack Type**, the attack vector it protects from. When you create a user-defined signature you associate it with the most appropriate attack type from the list below. If you do not find an Attack Type that matches the threat for which your signature was written, use `Other Application Activity` Attack Type. Attach Types are also useful as part of the filter in user-defined signature **sets**.
diff --git a/content/includes/nap-waf/config/common/basic-signature-sets-included-in-app-protect.md b/content/includes/nap-waf/config/common/basic-signature-sets-included-in-app-protect.md
index ebdf79117..43d69be2d 100644
--- a/content/includes/nap-waf/config/common/basic-signature-sets-included-in-app-protect.md
+++ b/content/includes/nap-waf/config/common/basic-signature-sets-included-in-app-protect.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1568"
+nd-docs: "DOCS-1568"
 ---
 
 These signatures sets are included but are not part of the default template.
diff --git a/content/includes/nap-waf/config/common/bidirectional-streaming-overview.md b/content/includes/nap-waf/config/common/bidirectional-streaming-overview.md
index 950cf9c7b..f55ad2820 100644
--- a/content/includes/nap-waf/config/common/bidirectional-streaming-overview.md
+++ b/content/includes/nap-waf/config/common/bidirectional-streaming-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1565"
+nd-docs: "DOCS-1565"
 ---
 
 A gRPC service can have a stream of messages on each side: client, server, or both. Bidirectional Streaming leverages HTTP/2 streaming capability, namely the ability to send multiple gRPC messages from either side ended by the message having the `END_STREAM` flag set to 1.
diff --git a/content/includes/nap-waf/config/common/clickjacking-protection.md b/content/includes/nap-waf/config/common/clickjacking-protection.md
index 3bde2ddca..c73c94b8e 100644
--- a/content/includes/nap-waf/config/common/clickjacking-protection.md
+++ b/content/includes/nap-waf/config/common/clickjacking-protection.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1611"
+nd-docs: "DOCS-1611"
 ---
 
 Clickjacking refers to a technique used by malicious actors to embed remote website content into their malicious websites, tricking the end users to click on the embedded frames triggering actions the users were not aware of, such as liking a certain Facebook page or giving a restaurant a 5 star rating. To protect against such attacks, NGINX App Protect WAF uses the `X-Frame-Options` header capabilities. The `X-Frame-Options` header is injected by NGINX App Protect WAF to indicate to the browser whether it should embed  the content or not. Please note that this additional layer of security is available only in browsers that support the `X-Frame-Options` headers.
diff --git a/content/includes/nap-waf/config/common/configure-client-authorization.md b/content/includes/nap-waf/config/common/configure-client-authorization.md
index 1fdd8cf30..81388383d 100644
--- a/content/includes/nap-waf/config/common/configure-client-authorization.md
+++ b/content/includes/nap-waf/config/common/configure-client-authorization.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1571"
+nd-docs: "DOCS-1571"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/config/common/configure-nginx-mirror.md b/content/includes/nap-waf/config/common/configure-nginx-mirror.md
index a50e33357..1a5f75833 100644
--- a/content/includes/nap-waf/config/common/configure-nginx-mirror.md
+++ b/content/includes/nap-waf/config/common/configure-nginx-mirror.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1561"
+nd-docs: "DOCS-1561"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/config/common/configure-njs.md b/content/includes/nap-waf/config/common/configure-njs.md
index 8e5949b18..266180b6a 100644
--- a/content/includes/nap-waf/config/common/configure-njs.md
+++ b/content/includes/nap-waf/config/common/configure-njs.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1579"
+nd-docs: "DOCS-1579"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/config/common/configure-ranges.md b/content/includes/nap-waf/config/common/configure-ranges.md
index 73f5773cd..1e13c9e84 100644
--- a/content/includes/nap-waf/config/common/configure-ranges.md
+++ b/content/includes/nap-waf/config/common/configure-ranges.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1544"
+nd-docs: "DOCS-1544"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/config/common/configure-slice.md b/content/includes/nap-waf/config/common/configure-slice.md
index 07b4f0ab2..413a113bf 100644
--- a/content/includes/nap-waf/config/common/configure-slice.md
+++ b/content/includes/nap-waf/config/common/configure-slice.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1613"
+nd-docs: "DOCS-1613"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/config/common/configure-static-location.md b/content/includes/nap-waf/config/common/configure-static-location.md
index a1f4d39e6..750905c70 100644
--- a/content/includes/nap-waf/config/common/configure-static-location.md
+++ b/content/includes/nap-waf/config/common/configure-static-location.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1581"
+nd-docs: "DOCS-1581"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/config/common/csrf-protection.md b/content/includes/nap-waf/config/common/csrf-protection.md
index 9720eaada..f17fd9dd0 100644
--- a/content/includes/nap-waf/config/common/csrf-protection.md
+++ b/content/includes/nap-waf/config/common/csrf-protection.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1590"
+nd-docs: "DOCS-1590"
 ---
 
 CSRF (Cross-Site Request Forgery) is an attack vector in which the victim user that visits a sensitive site such as a bank account, is lured to click on a malicious link attempting a fraudulent operation on that sensitive site. The link may be sent over email or in a hidden frame in another site. NGINX App Protect WAF provides protection against CSRF attacks by validating the Origin header for AJAX POST requests (default configuration).
diff --git a/content/includes/nap-waf/config/common/custom-log-configuration.md b/content/includes/nap-waf/config/common/custom-log-configuration.md
index e24115d26..59a231191 100644
--- a/content/includes/nap-waf/config/common/custom-log-configuration.md
+++ b/content/includes/nap-waf/config/common/custom-log-configuration.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1585"
+nd-docs: "DOCS-1585"
 ---
 
 A new directive `app_protect_custom_log_attribute` will be added to the `nginx.conf` file. You can set this directive at all scopes: http, server and location. The setting at the location scope overrides the setting in the server and/or http scopes and the server scope overrides the http scope. The `app_protect_custom_log_attribute` directive syntax will consist of a **name/value** or **key/value** pair i.e. "app_protect_custom_log_attribute <name> <value>".
diff --git a/content/includes/nap-waf/config/common/custom-log-errors-warnings.md b/content/includes/nap-waf/config/common/custom-log-errors-warnings.md
index c0a0f521d..b9684fee0 100644
--- a/content/includes/nap-waf/config/common/custom-log-errors-warnings.md
+++ b/content/includes/nap-waf/config/common/custom-log-errors-warnings.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1560"
+nd-docs: "DOCS-1560"
 ---
 
 An error message "`app_protect_custom_log_attribute` directive is invalid" will be displayed in the Security Log if the below conditions are met:
diff --git a/content/includes/nap-waf/config/common/custom-log-logging-reporting.md b/content/includes/nap-waf/config/common/custom-log-logging-reporting.md
index 3497a3ccb..0e2ba3e01 100644
--- a/content/includes/nap-waf/config/common/custom-log-logging-reporting.md
+++ b/content/includes/nap-waf/config/common/custom-log-logging-reporting.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1609"
+nd-docs: "DOCS-1609"
 ---
 
 When `app_protect_custom_log_attribute` is assigned to a particular location/server/http context, it will appear in the `json_log` field as a new JSON property called "customLogAttributes" at the top level. The property will not appear if no `app_protect_custom_log_attribute` directive was assigned.
diff --git a/content/includes/nap-waf/config/common/custom-log-overview.md b/content/includes/nap-waf/config/common/custom-log-overview.md
index 20015b968..3ae13b711 100644
--- a/content/includes/nap-waf/config/common/custom-log-overview.md
+++ b/content/includes/nap-waf/config/common/custom-log-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1614"
+nd-docs: "DOCS-1614"
 ---
 
 Custom dimensions log entries feature refers to the new configuration in NGINX App Protect WAF, where the new directive called `app_protect_custom_log_attribute` is assigned to a particular location or server or http level in the `nginx.conf` file. The need is to be able to add custom identifiers to the respective location and/or server and identify requests in the Security Log by those identifiers.
diff --git a/content/includes/nap-waf/config/common/custom-log-things-to-remember.md b/content/includes/nap-waf/config/common/custom-log-things-to-remember.md
index 46a472e88..97e18eae5 100644
--- a/content/includes/nap-waf/config/common/custom-log-things-to-remember.md
+++ b/content/includes/nap-waf/config/common/custom-log-things-to-remember.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1589"
+nd-docs: "DOCS-1589"
 ---
 
 The `app_protect_custom_log_attribute` directive has a few limitations which should be kept in mind while configuring this directive:
diff --git a/content/includes/nap-waf/config/common/deny-allow-never-log-lists.md b/content/includes/nap-waf/config/common/deny-allow-never-log-lists.md
index 4e5d8398e..7c7e7a847 100644
--- a/content/includes/nap-waf/config/common/deny-allow-never-log-lists.md
+++ b/content/includes/nap-waf/config/common/deny-allow-never-log-lists.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1604"
+nd-docs: "DOCS-1604"
 ---
 
 It is possible to define IP addresses or ranges for which the traffic will always be allowed or denied or never logged despite the rest of the configuration settings in the policy.
diff --git a/content/includes/nap-waf/config/common/detect-base64-string-values.md b/content/includes/nap-waf/config/common/detect-base64-string-values.md
index 7ab9b1e2a..56e58f6a7 100644
--- a/content/includes/nap-waf/config/common/detect-base64-string-values.md
+++ b/content/includes/nap-waf/config/common/detect-base64-string-values.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1563"
+nd-docs: "DOCS-1563"
 ---
 
 The Detect Base64 feature allows NGINX App Protect WAF to detect whether values in string fields in gRPC payload are Base64 encoded. When a value is detected as Base64 encoded NGINX App Protect WAF will enforce the configured signatures on the decoded value __and__ on the original value.
diff --git a/content/includes/nap-waf/config/common/detect-base64.md b/content/includes/nap-waf/config/common/detect-base64.md
index 28a89ba16..c80861c63 100644
--- a/content/includes/nap-waf/config/common/detect-base64.md
+++ b/content/includes/nap-waf/config/common/detect-base64.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1593"
+nd-docs: "DOCS-1593"
 ---
 
 The Detect Base64 feature allows NGINX App Protect WAF to detect whether values in headers, cookies, and parameters are Base64 encoded. When an entity is detected as Base64 encoded NGINX App Protect WAF will enforce the configured signatures on the decoded value, instead of on the original value.
diff --git a/content/includes/nap-waf/config/common/disallow-application-use-geolocation.md b/content/includes/nap-waf/config/common/disallow-application-use-geolocation.md
index 6ba14cc0d..9d605a922 100644
--- a/content/includes/nap-waf/config/common/disallow-application-use-geolocation.md
+++ b/content/includes/nap-waf/config/common/disallow-application-use-geolocation.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1547"
+nd-docs: "DOCS-1547"
 ---
 
 For applications protected by app protect, you can use Geolocation enforcement to restrict or allow application use in specific countries. You can adjust the lists of which countries or locations are allowed or disallowed in a app protect security policy. If the user tries to access the web application from a location that is not allowed, the `VIOL_GEOLOCATION` violation will be triggered. By default, all locations are allowed, and the alarm and block flags are enabled.
diff --git a/content/includes/nap-waf/config/common/disallowed-file-types.md b/content/includes/nap-waf/config/common/disallowed-file-types.md
index f253018dd..a2466410d 100644
--- a/content/includes/nap-waf/config/common/disallowed-file-types.md
+++ b/content/includes/nap-waf/config/common/disallowed-file-types.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1556"
+nd-docs: "DOCS-1556"
 ---
 
 The following file types are disallowed by default:
diff --git a/content/includes/nap-waf/config/common/do-nothing-and-user-defined-parameters.md b/content/includes/nap-waf/config/common/do-nothing-and-user-defined-parameters.md
index 570801a7d..5627e1b85 100644
--- a/content/includes/nap-waf/config/common/do-nothing-and-user-defined-parameters.md
+++ b/content/includes/nap-waf/config/common/do-nothing-and-user-defined-parameters.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1586"
+nd-docs: "DOCS-1586"
 ---
 
 The do-nothing in urlContentProfiles allows the user to avoid inspecting or parsing the content in a policy, and instead handle the request's header according to the specifications outlined in the security policy.
diff --git a/content/includes/nap-waf/config/common/enforcer-cookie-settings.md b/content/includes/nap-waf/config/common/enforcer-cookie-settings.md
index 27e5857a5..0b66474af 100644
--- a/content/includes/nap-waf/config/common/enforcer-cookie-settings.md
+++ b/content/includes/nap-waf/config/common/enforcer-cookie-settings.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1608"
+nd-docs: "DOCS-1608"
 ---
 
 NGINX App Protect WAF generates its own cookies and adds them on top of the application cookies.
diff --git a/content/includes/nap-waf/config/common/evasion-techniques-subviolations.md b/content/includes/nap-waf/config/common/evasion-techniques-subviolations.md
index bcdb34373..f485fcb9a 100644
--- a/content/includes/nap-waf/config/common/evasion-techniques-subviolations.md
+++ b/content/includes/nap-waf/config/common/evasion-techniques-subviolations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1542"
+nd-docs: "DOCS-1542"
 ---
 
 The following table specifies the Evasion Techniques sub-violation settings. All are supported in NGINX App Protect WAF.
diff --git a/content/includes/nap-waf/config/common/filetypes-and-responses.md b/content/includes/nap-waf/config/common/filetypes-and-responses.md
index 51624683c..c65c0aa33 100644
--- a/content/includes/nap-waf/config/common/filetypes-and-responses.md
+++ b/content/includes/nap-waf/config/common/filetypes-and-responses.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1617"
+nd-docs: "DOCS-1617"
 ---
 
 A user can enable/disable specific file types in the policy.
diff --git a/content/includes/nap-waf/config/common/first-match-principle.md b/content/includes/nap-waf/config/common/first-match-principle.md
index 309f7dd2e..60caf2f69 100644
--- a/content/includes/nap-waf/config/common/first-match-principle.md
+++ b/content/includes/nap-waf/config/common/first-match-principle.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1572"
+nd-docs: "DOCS-1572"
 ---
 
 The policy enforcement operates on the **first match** principle. This principle is applied when multiple conditions match or are similar, indicating that any incoming requests that match the first condition will be processed. In the following example, the "override_rules_example2" policy uses two override rules: "this_rule_will_match" and "non_matching_rule". Since both conditions match, the first match principle will be applied, and requests with "api" in the URI will be processed. It will reference an external policy file named "NginxStrictPolicy.json" to override the current policy. .
diff --git a/content/includes/nap-waf/config/common/geolocation-override-rules.md b/content/includes/nap-waf/config/common/geolocation-override-rules.md
index d35f33d28..56394ded4 100644
--- a/content/includes/nap-waf/config/common/geolocation-override-rules.md
+++ b/content/includes/nap-waf/config/common/geolocation-override-rules.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1567"
+nd-docs: "DOCS-1567"
 ---
 
 The below example represents a security policy for a web application. The policy named as "override_rule_example" is based on a template called "POLICY_TEMPLATE_NGINX_BASE." The policy is set to operate in "blocking" mode, which means it will prevent certain activities.
diff --git a/content/includes/nap-waf/config/common/geolocation-overview.md b/content/includes/nap-waf/config/common/geolocation-overview.md
index 44c0b29a6..4cf2e1833 100644
--- a/content/includes/nap-waf/config/common/geolocation-overview.md
+++ b/content/includes/nap-waf/config/common/geolocation-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1615"
+nd-docs: "DOCS-1615"
 ---
 
 Geolocation refers to the process of assessing or determining the geographic location of an object. This feature helps in identifying the geographic location of a client or web application user.
diff --git a/content/includes/nap-waf/config/common/graphql-advanced-config.md b/content/includes/nap-waf/config/common/graphql-advanced-config.md
index 51e62e079..30221b397 100644
--- a/content/includes/nap-waf/config/common/graphql-advanced-config.md
+++ b/content/includes/nap-waf/config/common/graphql-advanced-config.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1551"
+nd-docs: "DOCS-1551"
 ---
 
 The below sections provides details about enabling GraphQL with advanced configuration.
diff --git a/content/includes/nap-waf/config/common/graphql-define-url-settings.md b/content/includes/nap-waf/config/common/graphql-define-url-settings.md
index 76541f335..9a4e59b5b 100644
--- a/content/includes/nap-waf/config/common/graphql-define-url-settings.md
+++ b/content/includes/nap-waf/config/common/graphql-define-url-settings.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1588"
+nd-docs: "DOCS-1588"
 ---
 
 The second step to configure GraphQL is to define the URL settings. Set the values for "isAllowed": **true**, "name": **/graphql** in the URLs section, which means URLs with **/graphql** name are permitted. This path will be used for all GraphQL API requests.
diff --git a/content/includes/nap-waf/config/common/graphql-overview.md b/content/includes/nap-waf/config/common/graphql-overview.md
index db60fb1cd..f06189e83 100644
--- a/content/includes/nap-waf/config/common/graphql-overview.md
+++ b/content/includes/nap-waf/config/common/graphql-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1595"
+nd-docs: "DOCS-1595"
 ---
 
 GraphQL is an API technology that has grown rapidly in recent years and is continuing to gain traction. GraphQL is a query language designed for APIs to use in the development of client applications that access large data sets with intricate relations among themselves. It provides an intuitive application and flexible syntax for describing data requirements. <br>
diff --git a/content/includes/nap-waf/config/common/graphql-response-pages.md b/content/includes/nap-waf/config/common/graphql-response-pages.md
index 511058ef9..73ed50f16 100644
--- a/content/includes/nap-waf/config/common/graphql-response-pages.md
+++ b/content/includes/nap-waf/config/common/graphql-response-pages.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1557"
+nd-docs: "DOCS-1557"
 ---
 
 A GraphQL error response page is returned when a request is blocked. This GraphQL response page, like other blocking response pages, can be customized, but the GraphQL JSON syntax must be preserved for them to be displayed correctly. The default page returns the GraphQL status code Blocking Response Page (BRP) and a short JSON error message which includes the support ID.
diff --git a/content/includes/nap-waf/config/common/graphql-security.md b/content/includes/nap-waf/config/common/graphql-security.md
index 2342ca0f9..067eb4833 100644
--- a/content/includes/nap-waf/config/common/graphql-security.md
+++ b/content/includes/nap-waf/config/common/graphql-security.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1566"
+nd-docs: "DOCS-1566"
 ---
 
 Securing GraphQL APIs with NGINX App Protect WAF involves using WAF to monitor and protect against security threats and attacks. GraphQL, like REST, is usually [served over HTTP](http://graphql.org/learn/serving-over-http/), using GET and POST requests and a proprietary [query language](https://graphql.org/learn/schema/#the-query-and-mutation-types). It is prone to the typical Web APIs security vulnerabilities, such as injection attacks, Denial of Service (DoS) attacks and abuse of flawed authorization.
diff --git a/content/includes/nap-waf/config/common/graphql-violations.md b/content/includes/nap-waf/config/common/graphql-violations.md
index 0045ec2c1..288fa29a4 100644
--- a/content/includes/nap-waf/config/common/graphql-violations.md
+++ b/content/includes/nap-waf/config/common/graphql-violations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1578"
+nd-docs: "DOCS-1578"
 ---
 
 NGINX App Protect WAF introduces four new violations specific to GraphQL: `VIOL_GRAPHQL_FORMAT`, `VIOL_GRAPHQL_MALFORMED`, `VIOL_GRAPHQL_INTROSPECTION_QUERY` and `VIOL_GRAPHQL_ERROR_RESPONSE`. <br>
diff --git a/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md b/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md
index d8d14d0f6..468da8b55 100644
--- a/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md
+++ b/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1606"
+nd-docs: "DOCS-1606"
 ---
 
 #### Client Request Flow
diff --git a/content/includes/nap-waf/config/common/grpc-content-profiles.md b/content/includes/nap-waf/config/common/grpc-content-profiles.md
index 2f5ec344c..dbdffe203 100644
--- a/content/includes/nap-waf/config/common/grpc-content-profiles.md
+++ b/content/includes/nap-waf/config/common/grpc-content-profiles.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1616"
+nd-docs: "DOCS-1616"
 ---
 
 The gRPC Content Profile contains all the definitions for protecting a gRPC service. It is similar in nature to the **JSON and XML profiles** handling JSON and XML traffic respectively. Roughly it includes:
diff --git a/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md b/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md
index 1a7189010..78c430827 100644
--- a/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md
+++ b/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1599"
+nd-docs: "DOCS-1599"
 ---
 
 Slow POST attack mitigation - A client sending messages very slowly for a long time may be cut off by resetting the connection.
diff --git a/content/includes/nap-waf/config/common/grpc-message-compression.md b/content/includes/nap-waf/config/common/grpc-message-compression.md
index 7fdf1b923..ff28c8674 100644
--- a/content/includes/nap-waf/config/common/grpc-message-compression.md
+++ b/content/includes/nap-waf/config/common/grpc-message-compression.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1574"
+nd-docs: "DOCS-1574"
 ---
 
 Currently, Message Compression is not supported. Therefore, a violation `VIOL_GRPC_MALFORMED` will be raised and the connection will be blocked if a compressed message is sent.
\ No newline at end of file
diff --git a/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md b/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md
index a9de83d0e..dac89ee48 100644
--- a/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md
+++ b/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1558"
+nd-docs: "DOCS-1558"
 ---
 
 gRPC is a remote API standard and is an alternative to OpenAPI. If your applications expose gRPC APIs, NGINX App Protect WAF can protect them by parsing the messages; making sure they comply with the API definition; and enforcing security restrictions - such as size limits, detecting attack signatures, threat campaigns, and suspicious metacharacters in message string field values.
diff --git a/content/includes/nap-waf/config/common/grpc-response-pages.md b/content/includes/nap-waf/config/common/grpc-response-pages.md
index 14529e719..11f7efc51 100644
--- a/content/includes/nap-waf/config/common/grpc-response-pages.md
+++ b/content/includes/nap-waf/config/common/grpc-response-pages.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1597"
+nd-docs: "DOCS-1597"
 ---
 
 A gRPC error response page is returned when a request is blocked. The default page returns gRPC status code `UNKNOWN` (numeric value of 2) and a short textual message that includes the support ID. You can customize any of these two by configuring a custom gRPC response page in your policy.
diff --git a/content/includes/nap-waf/config/common/grpc-server-reflection.md b/content/includes/nap-waf/config/common/grpc-server-reflection.md
index 0d27f1f8e..e8cab8f9e 100644
--- a/content/includes/nap-waf/config/common/grpc-server-reflection.md
+++ b/content/includes/nap-waf/config/common/grpc-server-reflection.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1610"
+nd-docs: "DOCS-1610"
 ---
 
 [gRPC Server Reflection](https://grpc.github.io/grpc/core/md_doc_server_reflection_tutorial.html) provides information about publicly-accessible gRPC services on a server, and assists clients at runtime to construct RPC requests and responses without precompiled service information. gRPC Server reflection is not currently supported in App Protect. If Server Reflection support is required, App Protect must be disabled on the reflection URIs by adding a location block such as this:
diff --git a/content/includes/nap-waf/config/common/grpc-size-limits.md b/content/includes/nap-waf/config/common/grpc-size-limits.md
index bb9439081..407f6cb2c 100644
--- a/content/includes/nap-waf/config/common/grpc-size-limits.md
+++ b/content/includes/nap-waf/config/common/grpc-size-limits.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1619"
+nd-docs: "DOCS-1619"
 ---
 
 The maximum total request size is applied to each message on its own, rather than to the total stream messages. By default, the maximum gRPC message size is 4MB.
diff --git a/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md b/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md
index 744878c1c..55dc41ed9 100644
--- a/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md
+++ b/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1637"
+nd-docs: "DOCS-1637"
 ---
 
 A Slow POST attack or Slow HTTP POST attack is a type of denial of service attack. The attacker sends a legitimate HTTP POST request with the header Content-Length specified. The attacker then proceeds to send this content slowly. The server establishes a connection to the client and keeps it open to receive the request that it thinks is legitimate.
diff --git a/content/includes/nap-waf/config/common/grpc-violations.md b/content/includes/nap-waf/config/common/grpc-violations.md
index 9eb2d75bf..e93bac516 100644
--- a/content/includes/nap-waf/config/common/grpc-violations.md
+++ b/content/includes/nap-waf/config/common/grpc-violations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1562"
+nd-docs: "DOCS-1562"
 ---
 
 There are three violations that are specific to gRPC. They are all enabled in the default policy. See also the [Violations](#violations) section.
diff --git a/content/includes/nap-waf/config/common/handling-xml-and-json-content.md b/content/includes/nap-waf/config/common/handling-xml-and-json-content.md
index 32285a4e2..a8a54c409 100644
--- a/content/includes/nap-waf/config/common/handling-xml-and-json-content.md
+++ b/content/includes/nap-waf/config/common/handling-xml-and-json-content.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1545"
+nd-docs: "DOCS-1545"
 ---
 
 #### XML and JSON Content Profiles
diff --git a/content/includes/nap-waf/config/common/http-compliance-subviolations.md b/content/includes/nap-waf/config/common/http-compliance-subviolations.md
index 77f6f144d..c9482ea62 100644
--- a/content/includes/nap-waf/config/common/http-compliance-subviolations.md
+++ b/content/includes/nap-waf/config/common/http-compliance-subviolations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1576"
+nd-docs: "DOCS-1576"
 ---
 
 The following table specifies the HTTP Compliance sub-violation settings. All are supported in NGINX App Protect WAF, but not all are enabled in the default App Protect security template. The table specifies which. Some of the checks are enforced by NGINX Plus and App Protect only gets a notification. **Note:**  In this case, the request is **always** blocked regardless of the App Protect policy.
diff --git a/content/includes/nap-waf/config/common/important-things-override-rules.md b/content/includes/nap-waf/config/common/important-things-override-rules.md
index dd17232f5..c065639cb 100644
--- a/content/includes/nap-waf/config/common/important-things-override-rules.md
+++ b/content/includes/nap-waf/config/common/important-things-override-rules.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1549"
+nd-docs: "DOCS-1549"
 ---
 
 Here are some key points to remember regarding the Override Rules feature:
diff --git a/content/includes/nap-waf/config/common/json-web-token-overview.md b/content/includes/nap-waf/config/common/json-web-token-overview.md
index 9e5ee5741..76cf116ba 100644
--- a/content/includes/nap-waf/config/common/json-web-token-overview.md
+++ b/content/includes/nap-waf/config/common/json-web-token-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1550"
+nd-docs: "DOCS-1550"
 ---
 
 JSON Web Token (JWT) is a compact and self-contained way to represent information between two parties in a JSON (JavaScript Object Notation) format and is commonly used for authentication and authorization. With NGINX App Protect now it is possible to control access to its application using JWT validation. NGINX App Protect WAF validates the authenticity and well-formedness of JWTs coming from a client, denying access to the service exclusively when the validation process fails. JWT is mainly used for API access.
diff --git a/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md b/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md
index 76e8255a2..4ad55d12e 100644
--- a/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md
+++ b/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1602"
+nd-docs: "DOCS-1602"
 ---
 
 Attack signatures are detected within the JSON values of the token, i.e. the header and claims parts, but not on the digital signature part of the token. The detection of signatures, and specifically which signatures are recognized, depends on the configuration entity within the Policy. Typically, this configuration entity is the Authorization HTTP header or else, the header or parameter entity configured as the location of the token in the access profile.
diff --git a/content/includes/nap-waf/config/common/json-web-tokens-other-references.md b/content/includes/nap-waf/config/common/json-web-tokens-other-references.md
index e07b94a20..c79eb0dd0 100644
--- a/content/includes/nap-waf/config/common/json-web-tokens-other-references.md
+++ b/content/includes/nap-waf/config/common/json-web-tokens-other-references.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1573"
+nd-docs: "DOCS-1573"
 ---
 
 For more information about JSON Web Token (JWT) see below reference links:
diff --git a/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md b/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md
index f0ef872b8..67875b1b9 100644
--- a/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md
+++ b/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1584"
+nd-docs: "DOCS-1584"
 ---
 
 The default violation rating is set to the level of **5** regardless of any violation. Any changes to these violation settings here will override the default settings. The details regarding logs will be recorded in the security log. All violations will be disabled on upgrade.
diff --git a/content/includes/nap-waf/config/common/json-web-tokens-violations.md b/content/includes/nap-waf/config/common/json-web-tokens-violations.md
index c161e93b4..b04d82780 100644
--- a/content/includes/nap-waf/config/common/json-web-tokens-violations.md
+++ b/content/includes/nap-waf/config/common/json-web-tokens-violations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1594"
+nd-docs: "DOCS-1594"
 ---
 
 NGINX App Protect WAF introduces three new violations specific to JWT: `VIOL_ACCESS_INVALID`, `VIOL_ACCESS_MISSING` and `VIOL_ACCESS_MALFORMED`.
diff --git a/content/includes/nap-waf/config/common/modifying-configurations.md b/content/includes/nap-waf/config/common/modifying-configurations.md
index 41341a7ad..557d97eae 100644
--- a/content/includes/nap-waf/config/common/modifying-configurations.md
+++ b/content/includes/nap-waf/config/common/modifying-configurations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1591"
+nd-docs: "DOCS-1591"
 ---
 
 What we have been seeing so far has been related to making changes by actually overriding specific configuration values. What would happen in the case we wanted to remove a specific configuration entity from the policy. For example, let's say we have added file types "aaa", "bbb", and "ccc", and now we wish to remove "bbb" from the list of disallowed file types. Deleting this entity from the declarative configuration file will simply mean that this entity will be left intact when the policy is rebuilt, meaning that the entity is still in the disallowed file types list. To resolve such situations, we have a `modifications` section where we can force modification where otherwise it is not possible using direct declarative configuration.
diff --git a/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md b/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md
index 54db35538..f1f28bb0c 100644
--- a/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md
+++ b/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1605"
+nd-docs: "DOCS-1605"
 ---
 
 This guide assumes that you have some familiarity with various Layer 7 (L7) Hypertext Transfer Protocol (HTTP) concepts, such as Uniform Resource Identifier (URI)/Uniform Resource Locator (URL), method, header, cookie, status code, request, response, and parameters.
diff --git a/content/includes/nap-waf/config/common/override-rules-errors-warnings.md b/content/includes/nap-waf/config/common/override-rules-errors-warnings.md
index d0795f339..cea216022 100644
--- a/content/includes/nap-waf/config/common/override-rules-errors-warnings.md
+++ b/content/includes/nap-waf/config/common/override-rules-errors-warnings.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1600"
+nd-docs: "DOCS-1600"
 ---
 
 #### Missing Policy Name
diff --git a/content/includes/nap-waf/config/common/override-rules-logging-reporting.md b/content/includes/nap-waf/config/common/override-rules-logging-reporting.md
index 814d95b17..250065b66 100644
--- a/content/includes/nap-waf/config/common/override-rules-logging-reporting.md
+++ b/content/includes/nap-waf/config/common/override-rules-logging-reporting.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1583"
+nd-docs: "DOCS-1583"
 ---
 
 If a request matches an override rule, the `json_log` field will include a new block named 'overrideRule'. However, if no rules match the request, the log will not contain any related information. When the 'actionType' flag is set to "replace-policy", the 'originalPolicyName' field in the log will reflect the name of the original policy name (the one that contains override rules), and the `policy_name` field will reflect the policy that was enforced.
diff --git a/content/includes/nap-waf/config/common/override-rules-overview.md b/content/includes/nap-waf/config/common/override-rules-overview.md
index d67e14240..59d547719 100644
--- a/content/includes/nap-waf/config/common/override-rules-overview.md
+++ b/content/includes/nap-waf/config/common/override-rules-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1553"
+nd-docs: "DOCS-1553"
 ---
 
 The **Override Rules** feature allows overriding of the **default policy** settings. Each override rule consists of a condition followed by changes to the original policy applied to requests that meet the respective condition. This feature provides the ability to include the override rules within a declarative policy such that all incoming requests are verified against those rules.
diff --git a/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md b/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md
index de4214a29..53aa7f98d 100644
--- a/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md
+++ b/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1618"
+nd-docs: "DOCS-1618"
 ---
 
 When configuring handling of parameters, it is a bit different from other configurations we have dealt with earlier, where we enable a violation and configure its details. With parameters, there are a number of independent violations that need to be enabled on their own, as well as a parameter section to define further customization. The full list of parameter violations can be extracted from the above violation list.
diff --git a/content/includes/nap-waf/config/common/partial-masking-of-data.md b/content/includes/nap-waf/config/common/partial-masking-of-data.md
index 207e04921..86769895e 100644
--- a/content/includes/nap-waf/config/common/partial-masking-of-data.md
+++ b/content/includes/nap-waf/config/common/partial-masking-of-data.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1559"
+nd-docs: "DOCS-1559"
 ---
 
 Here is an example showing partial masking on custom patterns. Custom patterns are specified in `customPatternsList`, number of unmasked leading and trailing characters are defined in `firstCustomCharactersToExpose` and `lastCustomCharactersToExpose` parameters.
diff --git a/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md b/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md
index ca16dc85f..59d7b39cb 100644
--- a/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md
+++ b/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1564"
+nd-docs: "DOCS-1564"
 ---
 
 The policy JSON file specifies the settings that are different from the base template, such as enabling more signatures, disabling some violations, adding server technologies, etc. These will be shown in the next sections.
diff --git a/content/includes/nap-waf/config/common/policy-configuration.md b/content/includes/nap-waf/config/common/policy-configuration.md
index 9ef118bdc..a58c4464e 100644
--- a/content/includes/nap-waf/config/common/policy-configuration.md
+++ b/content/includes/nap-waf/config/common/policy-configuration.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1548"
+nd-docs: "DOCS-1548"
 ---
 
 The NGINX App Protect WAF ships with two reference policies, both with a default enforcement mode set to Blocking:
diff --git a/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md b/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md
index c71632671..1e17edc7d 100644
--- a/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md
+++ b/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1598"
+nd-docs: "DOCS-1598"
 ---
 
 The supported Protocol Buffer version is 3 i.e. only proto3 is supported. Version 2 is not supported. Hence any obsolete feature of version 2, such as message extensions in the IDL files, will be rejected. IDL files that have the `syntax = "proto2";` statement is also rejected.
\ No newline at end of file
diff --git a/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md b/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md
index 0beb9f005..39fe22e09 100644
--- a/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md
+++ b/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1587"
+nd-docs: "DOCS-1587"
 ---
 
 The following signature sets are included in the default policy. Most of the sets are defined by the Attack Type they protect from. In all sets the **Alarm** flag is enabled and **Block** disabled except High Accuracy Signatures, which are set to **blocked** (`block` parameter is enabled).
diff --git a/content/includes/nap-waf/config/common/signature-sets.md b/content/includes/nap-waf/config/common/signature-sets.md
index 4afb8fe65..fb07dca5e 100644
--- a/content/includes/nap-waf/config/common/signature-sets.md
+++ b/content/includes/nap-waf/config/common/signature-sets.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1580"
+nd-docs: "DOCS-1580"
 ---
 
 The default and strict policies include and enable common signature sets, which are categorized groups of [signatures](#attack-signatures-overview) applied to the policy. However, you may wish to modify the list of signature sets and their logging and enforcement settings via the `signature-sets` array property. There are several ways to configure the enforced signature sets.
diff --git a/content/includes/nap-waf/config/common/signature-settings.md b/content/includes/nap-waf/config/common/signature-settings.md
index 9f2121af7..39fff1ce4 100644
--- a/content/includes/nap-waf/config/common/signature-settings.md
+++ b/content/includes/nap-waf/config/common/signature-settings.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1554"
+nd-docs: "DOCS-1554"
 ---
 
 {{<bootstrap-table "table table-striped table-bordered table-sm table-responsive">}}
diff --git a/content/includes/nap-waf/config/common/supported-violations.md b/content/includes/nap-waf/config/common/supported-violations.md
index bf1b4c882..7fcf200b5 100644
--- a/content/includes/nap-waf/config/common/supported-violations.md
+++ b/content/includes/nap-waf/config/common/supported-violations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1582"
+nd-docs: "DOCS-1582"
 ---
 
 The following violations are supported and can be enabled by turning on the **alarm** and/or **block** flags.
@@ -31,39 +31,39 @@ The following violations are supported and can be enabled by turning on the **al
 |VIOL_GRAPHQL_FORMAT | GraphQL format data does not comply with format settings | Alarm & Block | This violation will be issued when the GraphQL profile settings are not satisfied, for example the length is too long, depth is too deep, a specific value is too long or too many batched queries. <br> The violation details will note what happened and the found length, depth or which value is too long and by what. <br> The depth violation is not learnable. The reason is that we don't know the actual depth of the query - we stop parsing at the max depth. <br> Note that the values will be used on the variables JSON part as well as the query. In a way, we can see these values as a JSON profile attributes just for the variables. | |
 |VIOL_GRAPHQL_INTROSPECTION_QUERY| GraphQL introspection Query | Alarm & Block | This violation will be issued when an introspection query was seen. |  |
 |VIOL_GRAPHQL_ERROR_RESPONSE | GraphQL Error Response | Alarm & Block | GraphQL disallowed pattern in response. | |
-|VIOL_GRPC_FORMAT | gRPC data does not comply with format settings | Alarm | The system checks that the request contains gRPC content and complies with the various request limits within the defense configuration in the security policy's gRPC Content Profile. Enforces valid gRPC requests and protects the server from Protocol Buffers parser attacks. This violation is generated when a gRPC request does not meet restrictive conditions in the gRPC Content Profile, such as the message length or existence of unknown fields. |  | 
-|VIOL_GRPC_MALFORMED | Malformed gRPC data | Alarm & Block | The system checks that the request contains gRPC content that is well-formed. Enforces parsable gRPC requests. |  | 
-|VIOL_GRPC_METHOD | Illegal gRPC method | Alarm | The system checks that the gRPC service method invoked matches one of the methods defined in the IDL file. The violation is triggered if the method does not appear there. |  | 
-|VIOL_HEADER_LENGTH | Illegal header length | Alarm | The system checks that the request includes a total HTTP header length that does not exceed the length specified in the security policy. | The actual size in default policy is 4 KB | 
-|VIOL_HEADER_METACHAR | Illegal meta character in header | Alarm | The system checks that the values of all headers within the request only contain meta characters defined as allowed in the security policy. |  | 
-|VIOL_HTTP_PROTOCOL | HTTP protocol compliance failed | Alarm | This category contains a list of validation checks that the system performs on HTTP requests to ensure that the requests are formatted properly. |  | 
-|VIOL_HTTP_RESPONSE_STATUS | Illegal HTTP response status | Alarm | The server response contains an HTTP status code that is not defined as valid in the security policy. |  | 
-|VIOL_JSON_FORMAT | JSON data does not comply with format settings | Alarm | The system checks that the request contains JSON content and complies with the various request limits within the defense configuration in the security policy's JSON profile. Enforces valid JSON requests and protects the server from JSON parser attacks. This violation is generated when a problem is detected in a JSON request, generally checking the message according to boundaries such as the message's size and meta characters in parameter value. | Controlled from the default JSON profile. | 
-|VIOL_JSON_MALFORMED | Malformed JSON data | Alarm & Block | The system checks that the request contains JSON content that is well-formed. Enforces parsable JSON requests. |  | 
-|VIOL_JSON_SCHEMA | JSON data does not comply with JSON schema | Alarm | The system checks that the incoming request contains JSON data that matches the schema file that is part of a JSON profile configured in the security policy. Enforces proper JSON requests defined by the schema. |  | 
-|VIOL_MANDATORY_PARAMETER | Mandatory parameter is missing | Alarm | The system checks that parameter marked as mandatory exists in the request. |  | 
-|VIOL_MANDATORY_REQUEST_BODY | Mandatory request body is missing | Alarm | The system checks that the body exists in the request |  | 
-|VIOL_METHOD | Illegal method | Alarm | The system checks that the request references an HTTP request method that is found in the security policy. Enforces desired HTTP methods; GET and POST are always allowed. | These HTTP methods are supported:<br><ul><li>GET</li><li>HEAD</li><li>POST</li><li>PUT</li><li>PATCH</li><li>DELETE</li><li>OPTIONS</li></ul> | 
-|VIOL_PARAMETER | Illegal parameter | Alarm | The system checks that every parameter in the request is defined in the security policy. |  | 
-|VIOL_PARAMETER_ARRAY_VALUE | Illegal parameter array value | Alarm | The value of an item in an array parameter is not according to the defined data type. |  | 
-|VIOL_PARAMETER_DATA_TYPE | Illegal parameter data type | Alarm | The system checks that the request contains a parameter whose data type matches the data type defined in the security policy. The data types that this violation applies to are integer, email, and phone. |  | 
-|VIOL_PARAMETER_EMPTY_VALUE | Illegal empty parameter value | Alarm | The system checks that the request contains a parameter whose value is not empty when it must contain a value. |  | 
-|VIOL_PARAMETER_LOCATION | Illegal parameter location | Alarm | The parameter was found in a different location than it was configured in the policy. |  | 
-|VIOL_PARAMETER_MULTIPART_NULL_VALUE | Null in multi-part parameter value | Disabled | The system checks that the multi-part request has a parameter value that does not contain the NULL character (0x00). If a multipart parameter with binary content type contains NULL in its value, the Enforcer issues this violation. The exceptions to this are:<br><ul><li>If that parameter is configured in the policy as `Ignore value`.</li><li>If that parameter is configured in the security policy as `user-input file-upload`.</li><li>If the parameter has a content-type that contains the string 'XML' and the parameter value contains a valid UTF16 encoded XML document (the encoding is valid). In this case NULL is allowed as it is part of the UTF16 encoding.</li></ul> |  | 
-|VIOL_PARAMETER_NAME_METACHAR | Illegal meta character in parameter name | Alarm | The system checks that all parameter names within the incoming request only contain meta characters defined as allowed in the security policy. |  | 
-|VIOL_PARAMETER_NUMERIC_VALUE | Illegal parameter numeric value | Alarm | The system checks that the incoming request contains a parameter whose value is in the range of decimal or integer values defined in the security policy. |  | 
-|VIOL_PARAMETER_REPEATED | Illegal repeated parameter name | Alarm | Detected multiple parameters of the same name in a single HTTP request. |  | 
-|VIOL_PARAMETER_STATIC_VALUE | Illegal static parameter value | Alarm | The system checks that the request contains a static parameter whose value is defined in the security policy. Prevents static parameter change. NGINX App Protect WAF can be configured to block parameter values that are not in a predefined list. Parameters can be defined on each of the following levels: file type, URL, and flow. Each parameter can be one of the following types: explicit or wildcard. |  | 
-|VIOL_PARAMETER_VALUE_BASE64 | Illegal Base64 value | Alarm | The system checks that the value is a valid Base64 string. If the value is indeed Base64, the system decodes this value and continues with its security checks. |  | 
-|VIOL_PARAMETER_VALUE_LENGTH | Illegal parameter value length | Alarm | The system checks that the request contains a parameter whose value length (in bytes) matches the value length defined in the security policy. |  | 
-|VIOL_PARAMETER_VALUE_METACHAR | Illegal meta character in value | Alarm | The system checks that all parameter values, XML element/attribute values, or JSON values within the request only contain meta characters defined as allowed in the security policy. Enforces proper input values. In case of a violation, the reported value represents the decimal ASCII value (metachar_index), or, in case of using "json_log" the hexadecimal ASCII value (metachar) of the violating character. |  | 
-|VIOL_PARAMETER_VALUE_REGEXP | Parameter value does not comply with regular expression | Alarm | The system checks that the request contains an alphanumeric parameter value that matches the expected pattern specified by the regular-expression field for that parameter. Prevents HTTP requests which do not comply with a defined pattern. NGINX App Protect WAF lets you set up a regular expression to block requests where a parameter value does not match the regular expression. |  | 
-|VIOL_POST_DATA_LENGTH | Illegal POST data length | Alarm | The system checks that the request contains POST data whose length does not exceed the acceptable length specified in the security policy. | In * file type entity. This check is disabled by default. | 
-|VIOL_QUERY_STRING_LENGTH | Illegal query string length | Alarm | The system checks that the request contains a query string whose length does not exceed the acceptable length specified in the security policy. | In * file type entity. Actual size is 2 KB. | 
-|VIOL_RATING_THREAT | Request is likely a threat | Alarm & Block | The combination of violations in this request determined that the request is likely to be a threat. | For VR = 4 or 5 | 
-|VIOL_RATING_NEED_EXAMINATION | Request needs further examination | Disabled | The combination of violations could not determine whether the request is a threat or violations are false positives thus requiring more examination. | For VR = 3 | 
-|VIOL_REQUEST_LENGTH | Illegal request length | Alarm | The system checks that the request length does not exceed the  acceptable length specified in the security policy per the requested file type. | In * file type entity. This check is disabled by default. | 
-|VIOL_REQUEST_MAX_LENGTH | Request length exceeds defined buffer size | Alarm & Block| The system checks that the request length is not larger than the maximum memory buffer size. Note that this protects NGINX App Protect WAF from consuming too much memory across all security policies which are active on the device. | Default is 10MB | 
+|VIOL_GRPC_FORMAT | gRPC data does not comply with format settings | Alarm | The system checks that the request contains gRPC content and complies with the various request limits within the defense configuration in the security policy's gRPC Content Profile. Enforces valid gRPC requests and protects the server from Protocol Buffers parser attacks. This violation is generated when a gRPC request does not meet restrictive conditions in the gRPC Content Profile, such as the message length or existence of unknown fields. |  |
+|VIOL_GRPC_MALFORMED | Malformed gRPC data | Alarm & Block | The system checks that the request contains gRPC content that is well-formed. Enforces parsable gRPC requests. |  |
+|VIOL_GRPC_METHOD | Illegal gRPC method | Alarm | The system checks that the gRPC service method invoked matches one of the methods defined in the IDL file. The violation is triggered if the method does not appear there. |  |
+|VIOL_HEADER_LENGTH | Illegal header length | Alarm | The system checks that the request includes a total HTTP header length that does not exceed the length specified in the security policy. | The actual size in default policy is 4 KB |
+|VIOL_HEADER_METACHAR | Illegal meta character in header | Alarm | The system checks that the values of all headers within the request only contain meta characters defined as allowed in the security policy. |  |
+|VIOL_HTTP_PROTOCOL | HTTP protocol compliance failed | Alarm | This category contains a list of validation checks that the system performs on HTTP requests to ensure that the requests are formatted properly. |  |
+|VIOL_HTTP_RESPONSE_STATUS | Illegal HTTP response status | Alarm | The server response contains an HTTP status code that is not defined as valid in the security policy. |  |
+|VIOL_JSON_FORMAT | JSON data does not comply with format settings | Alarm | The system checks that the request contains JSON content and complies with the various request limits within the defense configuration in the security policy's JSON profile. Enforces valid JSON requests and protects the server from JSON parser attacks. This violation is generated when a problem is detected in a JSON request, generally checking the message according to boundaries such as the message's size and meta characters in parameter value. | Controlled from the default JSON profile. |
+|VIOL_JSON_MALFORMED | Malformed JSON data | Alarm & Block | The system checks that the request contains JSON content that is well-formed. Enforces parsable JSON requests. |  |
+|VIOL_JSON_SCHEMA | JSON data does not comply with JSON schema | Alarm | The system checks that the incoming request contains JSON data that matches the schema file that is part of a JSON profile configured in the security policy. Enforces proper JSON requests defined by the schema. |  |
+|VIOL_MANDATORY_PARAMETER | Mandatory parameter is missing | Alarm | The system checks that parameter marked as mandatory exists in the request. |  |
+|VIOL_MANDATORY_REQUEST_BODY | Mandatory request body is missing | Alarm | The system checks that the body exists in the request |  |
+|VIOL_METHOD | Illegal method | Alarm | The system checks that the request references an HTTP request method that is found in the security policy. Enforces desired HTTP methods; GET and POST are always allowed. | These HTTP methods are supported:<br><ul><li>GET</li><li>HEAD</li><li>POST</li><li>PUT</li><li>PATCH</li><li>DELETE</li><li>OPTIONS</li></ul> |
+|VIOL_PARAMETER | Illegal parameter | Alarm | The system checks that every parameter in the request is defined in the security policy. |  |
+|VIOL_PARAMETER_ARRAY_VALUE | Illegal parameter array value | Alarm | The value of an item in an array parameter is not according to the defined data type. |  |
+|VIOL_PARAMETER_DATA_TYPE | Illegal parameter data type | Alarm | The system checks that the request contains a parameter whose data type matches the data type defined in the security policy. The data types that this violation applies to are integer, email, and phone. |  |
+|VIOL_PARAMETER_EMPTY_VALUE | Illegal empty parameter value | Alarm | The system checks that the request contains a parameter whose value is not empty when it must contain a value. |  |
+|VIOL_PARAMETER_LOCATION | Illegal parameter location | Alarm | The parameter was found in a different location than it was configured in the policy. |  |
+|VIOL_PARAMETER_MULTIPART_NULL_VALUE | Null in multi-part parameter value | Disabled | The system checks that the multi-part request has a parameter value that does not contain the NULL character (0x00). If a multipart parameter with binary content type contains NULL in its value, the Enforcer issues this violation. The exceptions to this are:<br><ul><li>If that parameter is configured in the policy as `Ignore value`.</li><li>If that parameter is configured in the security policy as `user-input file-upload`.</li><li>If the parameter has a content-type that contains the string 'XML' and the parameter value contains a valid UTF16 encoded XML document (the encoding is valid). In this case NULL is allowed as it is part of the UTF16 encoding.</li></ul> |  |
+|VIOL_PARAMETER_NAME_METACHAR | Illegal meta character in parameter name | Alarm | The system checks that all parameter names within the incoming request only contain meta characters defined as allowed in the security policy. |  |
+|VIOL_PARAMETER_NUMERIC_VALUE | Illegal parameter numeric value | Alarm | The system checks that the incoming request contains a parameter whose value is in the range of decimal or integer values defined in the security policy. |  |
+|VIOL_PARAMETER_REPEATED | Illegal repeated parameter name | Alarm | Detected multiple parameters of the same name in a single HTTP request. |  |
+|VIOL_PARAMETER_STATIC_VALUE | Illegal static parameter value | Alarm | The system checks that the request contains a static parameter whose value is defined in the security policy. Prevents static parameter change. NGINX App Protect WAF can be configured to block parameter values that are not in a predefined list. Parameters can be defined on each of the following levels: file type, URL, and flow. Each parameter can be one of the following types: explicit or wildcard. |  |
+|VIOL_PARAMETER_VALUE_BASE64 | Illegal Base64 value | Alarm | The system checks that the value is a valid Base64 string. If the value is indeed Base64, the system decodes this value and continues with its security checks. |  |
+|VIOL_PARAMETER_VALUE_LENGTH | Illegal parameter value length | Alarm | The system checks that the request contains a parameter whose value length (in bytes) matches the value length defined in the security policy. |  |
+|VIOL_PARAMETER_VALUE_METACHAR | Illegal meta character in value | Alarm | The system checks that all parameter values, XML element/attribute values, or JSON values within the request only contain meta characters defined as allowed in the security policy. Enforces proper input values. In case of a violation, the reported value represents the decimal ASCII value (metachar_index), or, in case of using "json_log" the hexadecimal ASCII value (metachar) of the violating character. |  |
+|VIOL_PARAMETER_VALUE_REGEXP | Parameter value does not comply with regular expression | Alarm | The system checks that the request contains an alphanumeric parameter value that matches the expected pattern specified by the regular-expression field for that parameter. Prevents HTTP requests which do not comply with a defined pattern. NGINX App Protect WAF lets you set up a regular expression to block requests where a parameter value does not match the regular expression. |  |
+|VIOL_POST_DATA_LENGTH | Illegal POST data length | Alarm | The system checks that the request contains POST data whose length does not exceed the acceptable length specified in the security policy. | In * file type entity. This check is disabled by default. |
+|VIOL_QUERY_STRING_LENGTH | Illegal query string length | Alarm | The system checks that the request contains a query string whose length does not exceed the acceptable length specified in the security policy. | In * file type entity. Actual size is 2 KB. |
+|VIOL_RATING_THREAT | Request is likely a threat | Alarm & Block | The combination of violations in this request determined that the request is likely to be a threat. | For VR = 4 or 5 |
+|VIOL_RATING_NEED_EXAMINATION | Request needs further examination | Disabled | The combination of violations could not determine whether the request is a threat or violations are false positives thus requiring more examination. | For VR = 3 |
+|VIOL_REQUEST_LENGTH | Illegal request length | Alarm | The system checks that the request length does not exceed the  acceptable length specified in the security policy per the requested file type. | In * file type entity. This check is disabled by default. |
+|VIOL_REQUEST_MAX_LENGTH | Request length exceeds defined buffer size | Alarm & Block| The system checks that the request length is not larger than the maximum memory buffer size. Note that this protects NGINX App Protect WAF from consuming too much memory across all security policies which are active on the device. | Default is 10MB |
 |VIOL_RULE | Actionable override rule was triggered. | Disabled |A policy override rule with an action was triggered.| |
 |VIOL_THREAT_CAMPAIGN | Threat Campaign detected | Alarm & Block | The system examines the HTTP message for known threat campaigns by matching it against known attack patterns. |  |
 |VIOL_URL | Illegal URL | Alarm | The system checks that the requested URL is configured as a valid URL, or not configured as an invalid URL, within the security policy. |  |
diff --git a/content/includes/nap-waf/config/common/time-based-sig-config.md b/content/includes/nap-waf/config/common/time-based-sig-config.md
index 1c636970c..6c5427e39 100644
--- a/content/includes/nap-waf/config/common/time-based-sig-config.md
+++ b/content/includes/nap-waf/config/common/time-based-sig-config.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1491
+nd-docs: DOCS-1491
 ---
 
 A new property known as `stagingCertificationDatetime` is added to `signature-settings` section. All signatures that were created or modified in a signature update that is later than that time are in staging while all the rest are enforced and not in staging.
diff --git a/content/includes/nap-waf/config/common/time-based-sig-enforce-mod-sig.md b/content/includes/nap-waf/config/common/time-based-sig-enforce-mod-sig.md
index f7994084d..cfd8d0534 100644
--- a/content/includes/nap-waf/config/common/time-based-sig-enforce-mod-sig.md
+++ b/content/includes/nap-waf/config/common/time-based-sig-enforce-mod-sig.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1495
+nd-docs: DOCS-1495
 ---
 
 All signatures are considered to be in staging if their creation or modification time is later than the `stagingCertificationDatetime`.
diff --git a/content/includes/nap-waf/config/common/time-based-sig-latest-cert-time.md b/content/includes/nap-waf/config/common/time-based-sig-latest-cert-time.md
index 8e4841a36..01af06ac1 100644
--- a/content/includes/nap-waf/config/common/time-based-sig-latest-cert-time.md
+++ b/content/includes/nap-waf/config/common/time-based-sig-latest-cert-time.md
@@ -1,9 +1,9 @@
 ---
-docs: DOCS-1490
+nd-docs: DOCS-1490
 ---
 
 The latest signatures certification time is the timestamp (in date-time ISO format) as the time the signatures in the policy are considered as “trusted” by the user and separates enforced signatures from signatures in staging.
 
-When this value is not defined and the staging flag is enabled, it means that all the signatures in the policy are in staging. If the signature was added to the policy but was created and last modified before the certification date-time then it will not be in staging. 
+When this value is not defined and the staging flag is enabled, it means that all the signatures in the policy are in staging. If the signature was added to the policy but was created and last modified before the certification date-time then it will not be in staging.
 
 A signature is considered new if it was introduced by a recent signature update that was applied to the respective policy. Note that signatures that were added later to the policy (by adding a new signature set) are not considered new unless they were added in the recent signature update. These signatures will not be in staging.
\ No newline at end of file
diff --git a/content/includes/nap-waf/config/common/time-based-sig-log-report.md b/content/includes/nap-waf/config/common/time-based-sig-log-report.md
index b340c819e..bd7711a9b 100644
--- a/content/includes/nap-waf/config/common/time-based-sig-log-report.md
+++ b/content/includes/nap-waf/config/common/time-based-sig-log-report.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1494
+nd-docs: DOCS-1494
 ---
 
 Time-based Signature will be logged and reported in the Security log without blocking the request as discussed in the above section.
@@ -7,7 +7,7 @@ Time-based Signature will be logged and reported in the Security log without blo
 Security log will have the following new fields under the enforcementState:
 -	The Violation Rating if there was no staging - `ratingIncludingViolationsInStaging`
 -	The `stagingCertificationDatetime` from the policy
--	The specific staging state of the signature 
+-	The specific staging state of the signature
 -	The `lastUpdateTime` of the signature - for the user to be able to determine why the signature was (or was not) in staging.
 
 ```json
diff --git a/content/includes/nap-waf/config/common/time-based-sig-new-policy.md b/content/includes/nap-waf/config/common/time-based-sig-new-policy.md
index b1ec698a5..23a19ee97 100644
--- a/content/includes/nap-waf/config/common/time-based-sig-new-policy.md
+++ b/content/includes/nap-waf/config/common/time-based-sig-new-policy.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1493
+nd-docs: DOCS-1493
 ---
 
 When a new policy is deployed, the user prefers to have all its signatures present in the staging environment. To facilitate this, the `performStaging` flag is configured to true at the signature settings level.
\ No newline at end of file
diff --git a/content/includes/nap-waf/config/common/time-based-sig-overview.md b/content/includes/nap-waf/config/common/time-based-sig-overview.md
index 30970d3ba..e3b89949f 100644
--- a/content/includes/nap-waf/config/common/time-based-sig-overview.md
+++ b/content/includes/nap-waf/config/common/time-based-sig-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1498
+nd-docs: DOCS-1498
 ---
 
 When new attack signatures are introduced in an App Protect policy, the policy is tested in a staging environment first before being promoted to production. However, in some instances where it is challenging to replicate real traffic accurately in the staging environment, the detection of genuine attacks becomes difficult. There can be false positives and expose the application to attacks. For such cases, we need to deploy the new signatures in staging environment in “staging” mode.
diff --git a/content/includes/nap-waf/config/common/time-based-sig-update-sig.md b/content/includes/nap-waf/config/common/time-based-sig-update-sig.md
index 557b2ec5a..191dfdc52 100644
--- a/content/includes/nap-waf/config/common/time-based-sig-update-sig.md
+++ b/content/includes/nap-waf/config/common/time-based-sig-update-sig.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1492
+nd-docs: DOCS-1492
 ---
 
 After applying a signature update (F5 or user-defined), and assuming the update creation time is later than the previous signature update applied to the policy (in other words, the signatures are upgraded, not downgraded), then all the signatures that were affected by the update (created or modified) are automatically put in staging. That's because their modification time is newer than the current `stagingCertificationDatetime`. Signatures that were not affected by the update will **not** be in staging.
\ No newline at end of file
diff --git a/content/includes/nap-waf/config/common/types-of-openapi-references.md b/content/includes/nap-waf/config/common/types-of-openapi-references.md
index c04f0c2c2..8316e15fc 100644
--- a/content/includes/nap-waf/config/common/types-of-openapi-references.md
+++ b/content/includes/nap-waf/config/common/types-of-openapi-references.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1636"
+nd-docs: "DOCS-1636"
 ---
 
 There are different ways of referencing OpenAPI Specification files. The configuration is similar to [External References](#external-references).
diff --git a/content/includes/nap-waf/config/common/types-of-references.md b/content/includes/nap-waf/config/common/types-of-references.md
index 44c116c73..dfc5403c3 100644
--- a/content/includes/nap-waf/config/common/types-of-references.md
+++ b/content/includes/nap-waf/config/common/types-of-references.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1601"
+nd-docs: "DOCS-1601"
 ---
 
 There are different implementations based on the type of references that are being made.
diff --git a/content/includes/nap-waf/config/common/unsupported-configuration.md b/content/includes/nap-waf/config/common/unsupported-configuration.md
index edc358d1d..b378143df 100644
--- a/content/includes/nap-waf/config/common/unsupported-configuration.md
+++ b/content/includes/nap-waf/config/common/unsupported-configuration.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1569"
+nd-docs: "DOCS-1569"
 ---
 
 There are some NGINX features that don't work well with NGINX App Protect WAF. Modules that use subrequest do not work when calling or being called from a scope that contains `app_protect_enable on`. Other modules that expect to receive the Range header (Slice for example) are also unsupported in the same scope as `app_protect_enable on`. For example, the following configuration is unsupported, but in the examples above you can find examples of work arounds for these features.
diff --git a/content/includes/nap-waf/config/common/user-defined-browser-control.md b/content/includes/nap-waf/config/common/user-defined-browser-control.md
index 788ee9d8a..90ffce2c3 100644
--- a/content/includes/nap-waf/config/common/user-defined-browser-control.md
+++ b/content/includes/nap-waf/config/common/user-defined-browser-control.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1543"
+nd-docs: "DOCS-1543"
 ---
 
 The User-Defined Browser Control feature allows a user to define new custom browsers, and create a list of allowed or disallowed browsers (both user-defined and factory preset browsers) used by the client application. It mainly provides the opportunity:
diff --git a/content/includes/nap-waf/config/common/user-defined-signature-sets.md b/content/includes/nap-waf/config/common/user-defined-signature-sets.md
index 230bcb52f..f9c2f0a76 100644
--- a/content/includes/nap-waf/config/common/user-defined-signature-sets.md
+++ b/content/includes/nap-waf/config/common/user-defined-signature-sets.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1596"
+nd-docs: "DOCS-1596"
 ---
 
 NGINX App Protect WAF comes with pre-defined signatures and signature sets. Also, the user can create their own user-defined signatures (as we have seen above) as well as user-defined signature sets. User-defined Signature sets are suitable for organizing the sheer number of pre-defined and user-defined signatures into logical sets for better use in the policy. For pre-defined signatures, there are two ways of managing signature sets: manual addition of signatures using the signature unique IDs, or filtering signatures based on specific criteria, like request/response, risk level, accuracy level, attack type, systems, etc. For the user-defined signatures, signature IDs are automatically generated, and they cannot be used in manual addition of signatures. Therefore, only one way is possible: filtering based on tag, request/response, risk level, accuracy level, attack type, systems, etc.
diff --git a/content/includes/nap-waf/config/common/user-defined-signatures.md b/content/includes/nap-waf/config/common/user-defined-signatures.md
index 98c3dc4dc..f98ad16dd 100644
--- a/content/includes/nap-waf/config/common/user-defined-signatures.md
+++ b/content/includes/nap-waf/config/common/user-defined-signatures.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1603"
+nd-docs: "DOCS-1603"
 ---
 
 Another useful expansion to the customization capabilities is the ability to create user-defined signatures. This capability allows the user to define new signatures, configure how they behave in terms of enforcement, and categorize them in user-defined signature sets (using tags) for ease of management.
diff --git a/content/includes/nap-waf/config/common/violations.md b/content/includes/nap-waf/config/common/violations.md
index 38ddf9b57..7feaabc9d 100644
--- a/content/includes/nap-waf/config/common/violations.md
+++ b/content/includes/nap-waf/config/common/violations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1577"
+nd-docs: "DOCS-1577"
 ---
 
 App Protect violations are rated by the App Protect algorithms to help distinguish between attacks and potential false positive alerts.  A violation rating is a numerical rating that our algorithms give to requests based on the presence of violation(s). Each violation type and severity contributes to the calculation of the final rating. The final rating then defines the action taken for the specific request. As per the default policy, any violation rating of 1, 2 and 3 will not cause the request to be blocked and only a log will be generated with **alerted** status. If the violation rating is 4 or 5, the request is blocked: a blocking page is displayed and a log generated for the transaction with **blocked** status. Violation ratings are displayed in the logs by default.
\ No newline at end of file
diff --git a/content/includes/nap-waf/default-conf-hostname.md b/content/includes/nap-waf/default-conf-hostname.md
index 406d6b92e..9dc5316fb 100644
--- a/content/includes/nap-waf/default-conf-hostname.md
+++ b/content/includes/nap-waf/default-conf-hostname.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1514"
+nd-docs: "DOCS-1514"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/default-conf-localhost.md b/content/includes/nap-waf/default-conf-localhost.md
index 24d2fb837..070afb43a 100644
--- a/content/includes/nap-waf/default-conf-localhost.md
+++ b/content/includes/nap-waf/default-conf-localhost.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1515"
+nd-docs: "DOCS-1515"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/download-certificates.md b/content/includes/nap-waf/download-certificates.md
index 16dd460a0..f4d83ff12 100644
--- a/content/includes/nap-waf/download-certificates.md
+++ b/content/includes/nap-waf/download-certificates.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1517"
+nd-docs: "DOCS-1517"
 ---
 
 Log in to [My F5](https://my.f5.com) and download the following two files from your active NGINX App Protect WAF subscription:
diff --git a/content/includes/nap-waf/how-to/bidirectional-configuration.md b/content/includes/nap-waf/how-to/bidirectional-configuration.md
index f9db4a918..8ef9c6dd6 100644
--- a/content/includes/nap-waf/how-to/bidirectional-configuration.md
+++ b/content/includes/nap-waf/how-to/bidirectional-configuration.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 The only configuration related to streaming is the IDL file or more specifically the `rpc` declaration. The keyword `stream` indicates that the message on the respective side is streaming. <br> <br>For example:
diff --git a/content/includes/nap-waf/nginx-conf-hostname-docker.md b/content/includes/nap-waf/nginx-conf-hostname-docker.md
index f4e4dea4b..301738d44 100644
--- a/content/includes/nap-waf/nginx-conf-hostname-docker.md
+++ b/content/includes/nap-waf/nginx-conf-hostname-docker.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1516"
+nd-docs: "DOCS-1516"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/nginx-conf-localhost.md b/content/includes/nap-waf/nginx-conf-localhost.md
index a87a5b16a..018bcba33 100644
--- a/content/includes/nap-waf/nginx-conf-localhost.md
+++ b/content/includes/nap-waf/nginx-conf-localhost.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1518"
+nd-docs: "DOCS-1518"
 ---
 
 ```nginx
diff --git a/content/includes/nap-waf/setup-docker-registry.md b/content/includes/nap-waf/setup-docker-registry.md
index fc2896154..9ace0cb63 100644
--- a/content/includes/nap-waf/setup-docker-registry.md
+++ b/content/includes/nap-waf/setup-docker-registry.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1508"
+nd-docs: "DOCS-1508"
 ---
 
 Configure Docker to interact with the F5 Container Registry at `private-registry.nginx.com`:
diff --git a/content/includes/nap-waf/upgrade-recompile-warning.md b/content/includes/nap-waf/upgrade-recompile-warning.md
index aeb993e2a..970b58e72 100644
--- a/content/includes/nap-waf/upgrade-recompile-warning.md
+++ b/content/includes/nap-waf/upgrade-recompile-warning.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 {{< warning >}}
 
-When upgrading, you must recompile all policy and log bundles using the latest WAF compiler. 
+When upgrading, you must recompile all policy and log bundles using the latest WAF compiler.
 
 Older bundles will be detected and disallowed.
 
diff --git a/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md b/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md
index b22a14342..5979df586 100644
--- a/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md
+++ b/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1441"
+nd-docs: "DOCS-1441"
 ---
 
 To avoid client service interruptions when upgrading NGINX Gateway Fabric, you can configure [`PreStop` hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/) to delay terminating the NGINX Gateway Fabric pod, allowing the pod to complete certain actions before shutting down. This ensures a smooth upgrade without any downtime, also known as a zero downtime upgrade.
diff --git a/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md b/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md
index 8b2b3f473..6f21d5702 100644
--- a/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md
+++ b/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1440"
+nd-docs: "DOCS-1440"
 ---
 
 Set `terminationGracePeriodSeconds` to a value that is equal to or greater than the `sleep` duration specified in the `preStop` hook (default is `30`). This setting prevents Kubernetes from terminating the pod before before the `preStop` hook has completed running.
diff --git a/content/includes/ngf/installation/expose-nginx-gateway-fabric.md b/content/includes/ngf/installation/expose-nginx-gateway-fabric.md
index 9ae213ed8..7820399a0 100644
--- a/content/includes/ngf/installation/expose-nginx-gateway-fabric.md
+++ b/content/includes/ngf/installation/expose-nginx-gateway-fabric.md
@@ -1,7 +1,7 @@
 ---
 title: "Expose NGINX Gateway Fabric"
 weight: 300
-docs: "DOCS-1427"
+nd-docs: "DOCS-1427"
 ---
 
 There are two options for accessing NGINX Gateway Fabric depending on the type of LoadBalancer service you chose during installation:
diff --git a/content/includes/ngf/installation/helm/pulling-the-chart.md b/content/includes/ngf/installation/helm/pulling-the-chart.md
index b82b2f809..e42fb7f6a 100644
--- a/content/includes/ngf/installation/helm/pulling-the-chart.md
+++ b/content/includes/ngf/installation/helm/pulling-the-chart.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1439"
+nd-docs: "DOCS-1439"
 ---
 
 ```shell
diff --git a/content/includes/ngf/installation/install-gateway-api-experimental-features.md b/content/includes/ngf/installation/install-gateway-api-experimental-features.md
index aa95d1eb9..aec27817e 100644
--- a/content/includes/ngf/installation/install-gateway-api-experimental-features.md
+++ b/content/includes/ngf/installation/install-gateway-api-experimental-features.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 To use Gateway API experimental resources, the Gateway API resources from the experimental channel must be installed before deploying NGINX Gateway Fabric. Additionally, NGINX Gateway Fabric must have experimental features enabled.
diff --git a/content/includes/ngf/installation/install-gateway-api-resources.md b/content/includes/ngf/installation/install-gateway-api-resources.md
index 3932dad32..bab5a44bd 100644
--- a/content/includes/ngf/installation/install-gateway-api-resources.md
+++ b/content/includes/ngf/installation/install-gateway-api-resources.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1438"
+nd-docs: "DOCS-1438"
 ---
 
 {{< note >}} The [Gateway API resources](https://github.com/kubernetes-sigs/gateway-api) from the standard channel must be installed before deploying NGINX Gateway Fabric. If they are already installed in your cluster, please ensure they are the correct version as supported by the NGINX Gateway Fabric - [see the Technical Specifications](https://github.com/nginx/nginx-gateway-fabric/blob/v{{< version-ngf >}}/README.md#technical-specifications). {{</ note >}}
diff --git a/content/includes/ngf/installation/jwt-password-note.md b/content/includes/ngf/installation/jwt-password-note.md
index 4cfeec8b9..6cc40d962 100644
--- a/content/includes/ngf/installation/jwt-password-note.md
+++ b/content/includes/ngf/installation/jwt-password-note.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 {{< note >}} For security, follow these practices with JSON Web Tokens (JWTs), passwords, and shell history:
diff --git a/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md b/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md
index 0bfceec95..0ad007efa 100644
--- a/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md
+++ b/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 {{< note >}} If you would rather pull the NGINX Plus image and push to a private registry, you can skip this specific step and instead follow [this step]({{< ref "/ngf/install/nginx-plus.md#pull-an-image-for-local-use" >}}). {{< /note >}}
diff --git a/content/includes/ngf/installation/nginx-plus/download-jwt.md b/content/includes/ngf/installation/nginx-plus/download-jwt.md
index d89c65a43..78ad1cbf8 100644
--- a/content/includes/ngf/installation/nginx-plus/download-jwt.md
+++ b/content/includes/ngf/installation/nginx-plus/download-jwt.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 1. Log in to [MyF5](https://my.f5.com/manage/s/).
diff --git a/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md b/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md
index 1a5beb474..be8a0b9f4 100644
--- a/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md
+++ b/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 Place the JWT in a file called `license.jwt`. Create a Kubernetes Secret using the contents of the JWT file.
diff --git a/content/includes/ngf/installation/uninstall-gateway-api-resources.md b/content/includes/ngf/installation/uninstall-gateway-api-resources.md
index d5631d1f5..92a857ff6 100644
--- a/content/includes/ngf/installation/uninstall-gateway-api-resources.md
+++ b/content/includes/ngf/installation/uninstall-gateway-api-resources.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1436"
+nd-docs: "DOCS-1436"
 ---
 
 {{< warning >}} This will remove all corresponding custom resources in your entire cluster, across all namespaces. Double-check to make sure you don't have any custom resources you need to keep, and confirm that there are no other Gateway API implementations active in your cluster. {{</ warning >}}
diff --git a/content/includes/ngf/installation/upgrade-api-resources.md b/content/includes/ngf/installation/upgrade-api-resources.md
index c8ad3d706..adaed0b1a 100644
--- a/content/includes/ngf/installation/upgrade-api-resources.md
+++ b/content/includes/ngf/installation/upgrade-api-resources.md
@@ -1,10 +1,10 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 To upgrade your Gateway API resources, take the following steps:
 
-- Use [Technical specifications]({{< ref "/ngf/reference/technical-specifications.md" >}}) to verify your Gateway API resources are compatible with your NGINX Gateway Fabric version. 
+- Use [Technical specifications]({{< ref "/ngf/reference/technical-specifications.md" >}}) to verify your Gateway API resources are compatible with your NGINX Gateway Fabric version.
 - Review the [release notes](https://github.com/kubernetes-sigs/gateway-api/releases) for any important upgrade-specific information.
 
 To upgrade the Gateway API resources, run the following command:
diff --git a/content/includes/nginx-one/staged-config-overview.md b/content/includes/nginx-one/staged-config-overview.md
index 9d5a6fe35..f47aec5d5 100644
--- a/content/includes/nginx-one/staged-config-overview.md
+++ b/content/includes/nginx-one/staged-config-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 files:
   - content/nginx-one/how-to/staged-configs/add-staged-config.md
   - content/nginx-one/how-to/staged-configs/edit-staged-config.md
diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md
index 126379d99..4f082614c 100644
--- a/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md
+++ b/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 To pin NGINX Plus to a specific version (for example, R33):
diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md
index 763f8f7d3..6e38a6922 100644
--- a/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md
+++ b/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md
@@ -1,11 +1,11 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 To pin NGINX Plus to a specific version (for example, R32):
 
 1. Edit the `/etc/yum.repos.d/nginx-plus-7.4.repo` file.
-1. Update the repository base URL to the desired version: 
+1. Update the repository base URL to the desired version:
 
    ```shell
    baseurl=https://pkgs.nginx.com/plus/R32/centos/7/$basearch/
diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md
index 369a9ebb9..d970d82c2 100644
--- a/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md
+++ b/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md
@@ -1,11 +1,11 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 To pin NGINX Plus to a specific version (for example, R33):
 
 1. Edit the `/etc/yum.repos.d/nginx-plus-8.repo` file.
-1. Update the repository base URL to the desired version: 
+1. Update the repository base URL to the desired version:
 
    ```shell
    baseurl=https://pkgs.nginx.com/plus/R33/centos/8/$basearch/
diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md
index 6085a8c7d..80b5571db 100644
--- a/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md
+++ b/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md
@@ -1,11 +1,11 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 To pin NGINX Plus to a specific version (for example, R33):
 
 1. Edit the `/etc/yum.repos.d/plus-9.repo` file.
-1. Update the repository base URL to the desired version: 
+1. Update the repository base URL to the desired version:
 
    ```shell
    baseurl=https://pkgs.nginx.com/plus/R33/centos/9/$basearch/
diff --git a/content/includes/nginx-plus/usage-tracking/agentless-reporting.md b/content/includes/nginx-plus/usage-tracking/agentless-reporting.md
index 0cbdce2f4..55af846c6 100644
--- a/content/includes/nginx-plus/usage-tracking/agentless-reporting.md
+++ b/content/includes/nginx-plus/usage-tracking/agentless-reporting.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1408
+nd-docs: DOCS-1408
 ---
 
 Since [Release 31]({{< ref "/nginx/releases.md#nginxplusrelease-31-r31" >}}), NGINX Plus provides a built-in support for reporting of your NGINX Plus instances to NGINX Instance Manager without the need of installing NGINX Agent or tuning HTTP Health checks. If you participate in the [F5 Flex Consumption Program](https://www.f5.com/products/get-f5/flex-consumption-program), you will no longer need to manually track your NGINX Plus instances.
diff --git a/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md b/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md
index 41caaa2d1..2f8a092b1 100644
--- a/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md
+++ b/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1352
+nd-docs: DOCS-1352
 ---
 
 To report your NGINX Ingress Controller clusters to F5, follow these steps:
diff --git a/content/includes/nginx-plus/usage-tracking/http-health-check.md b/content/includes/nginx-plus/usage-tracking/http-health-check.md
index 0a0e0a90d..7cf3e8cd6 100644
--- a/content/includes/nginx-plus/usage-tracking/http-health-check.md
+++ b/content/includes/nginx-plus/usage-tracking/http-health-check.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1351
+nd-docs: DOCS-1351
 ---
 
 You can track NGINX Plus instances using an [HTTP Health Check]({{< ref "nginx/admin-guide/load-balancer/http-health-check" >}}) without installing NGINX Agent. This involves updating the NGINX Plus configuration file. Follow these steps:
diff --git a/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md b/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md
index 9779c6c38..855a4b90d 100644
--- a/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md
+++ b/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1354
+nd-docs: DOCS-1354
 ---
 
 When you install NGINX Agent on an NGINX Plus instance, it will establish a connection with Instance Manager and begin transmitting usage data.
diff --git a/content/includes/nginx-plus/usage-tracking/install-nim.md b/content/includes/nginx-plus/usage-tracking/install-nim.md
index b5d048227..cdbb7f7b4 100644
--- a/content/includes/nginx-plus/usage-tracking/install-nim.md
+++ b/content/includes/nginx-plus/usage-tracking/install-nim.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1355
+nd-docs: DOCS-1355
 ---
 
 {{<note>}}A separate license for NGINX Instance Manager is not required to track your NGINX product usage.{{</note>}}
diff --git a/content/includes/nginx-plus/usage-tracking/overview.md b/content/includes/nginx-plus/usage-tracking/overview.md
index 85af6fb49..d903d54a1 100644
--- a/content/includes/nginx-plus/usage-tracking/overview.md
+++ b/content/includes/nginx-plus/usage-tracking/overview.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1349
+nd-docs: DOCS-1349
 ---
 
 Start by installing NGINX Instance Manager on a dedicated host. Then, configure your NGINX Plus systems to report back to Instance Manager. Once connected, you can easily view and report on your NGINX Plus inventory using the NGINX Instance Manager REST API or web interface. You can send these reports to your F5 contact as needed.
diff --git a/content/includes/nginx-plus/usage-tracking/view-nginx-plus-count.md b/content/includes/nginx-plus/usage-tracking/view-nginx-plus-count.md
index 9ddc0a2ef..4b63bbdfd 100644
--- a/content/includes/nginx-plus/usage-tracking/view-nginx-plus-count.md
+++ b/content/includes/nginx-plus/usage-tracking/view-nginx-plus-count.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1350
+nd-docs: DOCS-1350
 ---
 
 Follow these steps to view and export the list of NGINX Plus instances that have successfully registered with Instance Manager:
diff --git a/content/includes/nginxaas-azure/logging-analysis-azure-storage.md b/content/includes/nginxaas-azure/logging-analysis-azure-storage.md
index 67bc3f358..54e2cc824 100644
--- a/content/includes/nginxaas-azure/logging-analysis-azure-storage.md
+++ b/content/includes/nginxaas-azure/logging-analysis-azure-storage.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 If the diagnostic setting destination details included a storage account, logs show up in the storage container "insights-logs-nginxlogs" with the following format: `resourceID=/<NGINXaaS-resourceID>/y=<YYYY>/m=<MM>/d=<DD>/h=<HH>/PT1H.json`
diff --git a/content/includes/nginxaas-azure/logging-analysis-logs-analytics.md b/content/includes/nginxaas-azure/logging-analysis-logs-analytics.md
index 8809a824d..418c8edfc 100644
--- a/content/includes/nginxaas-azure/logging-analysis-logs-analytics.md
+++ b/content/includes/nginxaas-azure/logging-analysis-logs-analytics.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 If the diagnostic setting destination details included a Logs Analytics workspace, logs show up in the table "NGXOperationLogs" with the following non-standard attributes:
diff --git a/content/includes/nginxaas-azure/logging-config-access-logs.md b/content/includes/nginxaas-azure/logging-config-access-logs.md
index 01fba8215..63e7c12ec 100644
--- a/content/includes/nginxaas-azure/logging-config-access-logs.md
+++ b/content/includes/nginxaas-azure/logging-config-access-logs.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 NGINX access logs are disabled by default. You can enable access logs by adding **access_log** directives to your NGINX configuration to specify the location of the logs and formats. The log path should always be configured to be inside **/var/log/nginx**.
diff --git a/content/includes/nginxaas-azure/logging-config-error-logs.md b/content/includes/nginxaas-azure/logging-config-error-logs.md
index c27d8ace8..149a960ac 100644
--- a/content/includes/nginxaas-azure/logging-config-error-logs.md
+++ b/content/includes/nginxaas-azure/logging-config-error-logs.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 By default, NGINXaaS for Azure puts the error log at **/var/log/nginx/error.log**. It includes messages with severity **error** and above.
diff --git a/content/includes/nginxaas-azure/logging-limitations.md b/content/includes/nginxaas-azure/logging-limitations.md
index a6b636d66..8e4f9722a 100644
--- a/content/includes/nginxaas-azure/logging-limitations.md
+++ b/content/includes/nginxaas-azure/logging-limitations.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 1. File-based logs must be configured to use the path **/var/log/nginx**.
diff --git a/content/includes/nginxaas-azure/ncu-description.md b/content/includes/nginxaas-azure/ncu-description.md
index 138b593e6..17c015e54 100644
--- a/content/includes/nginxaas-azure/ncu-description.md
+++ b/content/includes/nginxaas-azure/ncu-description.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1476"
+nd-docs: "DOCS-1476"
 ---
 
 An NGINX Capacity Unit (NCU) quantifies the capacity of an NGINX instance based on the underlying compute resources. This abstraction allows you to specify the desired capacity in NCUs without having to consider the regional hardware differences.
diff --git a/content/includes/nginxaas-azure/ssl-tls-prerequisites.md b/content/includes/nginxaas-azure/ssl-tls-prerequisites.md
index 1d95d498d..def7a9e97 100644
--- a/content/includes/nginxaas-azure/ssl-tls-prerequisites.md
+++ b/content/includes/nginxaas-azure/ssl-tls-prerequisites.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 NGINXaaS natively integrates with [Azure Key Vault (AKV)](https://azure.microsoft.com/en-us/products/key-vault), so you can bring your own certificates and manage them in a centralized location. You will need:
diff --git a/content/includes/nginxaas-azure/terraform-prerequisites.md b/content/includes/nginxaas-azure/terraform-prerequisites.md
index a0267168b..aafb6908f 100644
--- a/content/includes/nginxaas-azure/terraform-prerequisites.md
+++ b/content/includes/nginxaas-azure/terraform-prerequisites.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 - Confirm that you meet the [NGINXaaS Prerequisites]({{< ref "/nginxaas-azure/getting-started/prerequisites.md" >}}).
diff --git a/content/includes/nginxaas-azure/terraform-resources.md b/content/includes/nginxaas-azure/terraform-resources.md
index f45c36671..0a830ca19 100644
--- a/content/includes/nginxaas-azure/terraform-resources.md
+++ b/content/includes/nginxaas-azure/terraform-resources.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 - [NGINXaaS Managed Identity Documentation]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}})
diff --git a/content/includes/nic/configuration/access-control.md b/content/includes/nic/configuration/access-control.md
index fade2941c..769bfbabf 100644
--- a/content/includes/nic/configuration/access-control.md
+++ b/content/includes/nic/configuration/access-control.md
@@ -2,7 +2,7 @@
 title: Deploy a Policy for access control
 weight: 900
 toc: true
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 This topic describes how to use F5 NGINX Ingress Controller to apply and update a Policy for access control. It demonstrates it using an example application and a [VirtualServer custom resource]({{< ref "/configuration/virtualserver-and-virtualserverroute-resources.md" >}}).
diff --git a/content/includes/nic/configuration/configuration-examples.md b/content/includes/nic/configuration/configuration-examples.md
index 0a0e6e3bb..c49c0790e 100644
--- a/content/includes/nic/configuration/configuration-examples.md
+++ b/content/includes/nic/configuration/configuration-examples.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-584
+nd-docs: DOCS-584
 doctypes:
 - ''
 title: Configuration examples
diff --git a/content/includes/nic/configuration/global-configuration/command-line-arguments.md b/content/includes/nic/configuration/global-configuration/command-line-arguments.md
index 230345052..552bba1be 100644
--- a/content/includes/nic/configuration/global-configuration/command-line-arguments.md
+++ b/content/includes/nic/configuration/global-configuration/command-line-arguments.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-585
+nd-docs: DOCS-585
 doctypes:
 - ''
 title: Command-line arguments
diff --git a/content/includes/nic/configuration/global-configuration/configmap-resource.md b/content/includes/nic/configuration/global-configuration/configmap-resource.md
index afa0bcf17..28296e291 100644
--- a/content/includes/nic/configuration/global-configuration/configmap-resource.md
+++ b/content/includes/nic/configuration/global-configuration/configmap-resource.md
@@ -4,7 +4,7 @@ weight: 300
 toc: true
 type: how-to
 product: NIC
-docs: DOCS-586
+nd-docs: DOCS-586
 ---
 
 When using F5 NGINX Ingress Controller, you can customize or fine tune NGINX behavior using ConfigMap resources. Examples include setting the number of worker processes or customizing the access log format.
@@ -184,12 +184,12 @@ For more information, view the [VirtualServer and VirtualServerRoute resources](
 
 Zone Sync enables the [ngx_stream_zone_sync_module](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html) in NGINX Ingress Controller when NGINX Plus is used.  Multiple replicas are required to effectively utililise this functionality. More information is available in the [How NGINX Plus Performs Zone Synchronization](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync_details/) topic.
 
-Zone synchronization with TLS for NGINX Ingress Controller is not yet available with ConfigMap. If you would like to enable Zone Sync with TLS, please remove `zone-sync` from ConfigMap and add Zone Sync parameters via [`stream-snippets`]({{< ref "/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) similar to [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-config.yaml) and adding the [zone_sync_ssl directive](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_ssl) along with any other TLS parameters to the `stream-snippets`. 
+Zone synchronization with TLS for NGINX Ingress Controller is not yet available with ConfigMap. If you would like to enable Zone Sync with TLS, please remove `zone-sync` from ConfigMap and add Zone Sync parameters via [`stream-snippets`]({{< ref "/configuration/ingress-resources/advanced-configuration-with-snippets.md" >}}) similar to [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-config.yaml) and adding the [zone_sync_ssl directive](https://nginx.org/en/docs/stream/ngx_stream_zone_sync_module.html#zone_sync_ssl) along with any other TLS parameters to the `stream-snippets`.
 
 You will also need to manually add the headless service, such as in [this example](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml).
 
-{{< caution >}} 
-If you previously installed OIDC or used the `zone_sync` directive with `stream-snippets` in [v4.0.1](https://github.com/nginx/kubernetes-ingress/tree/v4.0.1) or earlier, and you plan to enable the `zone-sync` ConfigMap key, the `zone_sync` directive should be removed from `stream-snippets`. 
+{{< caution >}}
+If you previously installed OIDC or used the `zone_sync` directive with `stream-snippets` in [v4.0.1](https://github.com/nginx/kubernetes-ingress/tree/v4.0.1) or earlier, and you plan to enable the `zone-sync` ConfigMap key, the `zone_sync` directive should be removed from `stream-snippets`.
 
 If you encounter the error `error [emerg] 13#13: "zone_sync" directive is duplicate in /etc/nginx/nginx.conf:164` it is likely due to `zone_sync` being enabled in both `stream-snippets` and the ConfigMap. Once upgraded, remove the [old headless service](https://github.com/nginx/kubernetes-ingress/blob/v4.0.1/examples/custom-resources/oidc/nginx-ingress-headless.yaml) deployed for OIDC.
 {{< /caution >}}
diff --git a/content/includes/nic/configuration/global-configuration/custom-templates.md b/content/includes/nic/configuration/global-configuration/custom-templates.md
index 589ce5951..6bb99f87f 100644
--- a/content/includes/nic/configuration/global-configuration/custom-templates.md
+++ b/content/includes/nic/configuration/global-configuration/custom-templates.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-587
+nd-docs: DOCS-587
 doctypes:
 - ''
 title: Custom templates
diff --git a/content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md b/content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md
index 605ab301f..b5f88b689 100644
--- a/content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md
+++ b/content/includes/nic/configuration/global-configuration/globalconfiguration-resource.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-588
+nd-docs: DOCS-588
 doctypes:
 - ''
 title: GlobalConfiguration resource
diff --git a/content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md b/content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md
index e1d9a120c..e291de510 100644
--- a/content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md
+++ b/content/includes/nic/configuration/global-configuration/mgmt-configmap-resource.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-586
+nd-docs: DOCS-586
 doctypes:
 - ''
 title: Management ConfigMap resource
@@ -7,7 +7,7 @@ toc: true
 weight: 300
 ---
 
-When using F5 NGINX Ingress Controller with NGINX Plus, it is required to pass a [command line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) to NGINX Ingress Controller, `--mgmt-configmap=<namespace/name>` which specifies the ConfigMap to use. The minimal required ConfigMap must have a `license-token-secret-name` key. Helm users will not need to create this map or pass the argument, it will be created with a Helm install. 
+When using F5 NGINX Ingress Controller with NGINX Plus, it is required to pass a [command line argument]({{< ref "/nic/configuration/global-configuration/command-line-arguments" >}}) to NGINX Ingress Controller, `--mgmt-configmap=<namespace/name>` which specifies the ConfigMap to use. The minimal required ConfigMap must have a `license-token-secret-name` key. Helm users will not need to create this map or pass the argument, it will be created with a Helm install.
 
 ---
 
diff --git a/content/includes/nic/configuration/global-configuration/reporting-resources-status.md b/content/includes/nic/configuration/global-configuration/reporting-resources-status.md
index 8e36733eb..f2e72fb03 100644
--- a/content/includes/nic/configuration/global-configuration/reporting-resources-status.md
+++ b/content/includes/nic/configuration/global-configuration/reporting-resources-status.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-589
+nd-docs: DOCS-589
 doctypes:
 - ''
 title: Reporting resource status
diff --git a/content/includes/nic/configuration/host-and-listener-collisions.md b/content/includes/nic/configuration/host-and-listener-collisions.md
index 502ef830c..3336bb21e 100644
--- a/content/includes/nic/configuration/host-and-listener-collisions.md
+++ b/content/includes/nic/configuration/host-and-listener-collisions.md
@@ -2,7 +2,7 @@
 title: Host and Listener collisions
 toc: true
 weight: 800
-docs: DOCS-590
+nd-docs: DOCS-590
 ---
 
 This document explains how F5 NGINX Ingress Controller handles host and listener collisions between resources.
diff --git a/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
index ecc12435f..952b8ebb1 100644
--- a/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
+++ b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-annotations.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-591
+nd-docs: DOCS-591
 doctypes:
 - ''
 title: Advanced configuration with Annotations
diff --git a/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
index 642d041ae..f31e7057b 100644
--- a/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
+++ b/content/includes/nic/configuration/ingress-resources/advanced-configuration-with-snippets.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-592
+nd-docs: DOCS-592
 doctypes:
 - ''
 title: Advanced configuration with Snippets
@@ -7,9 +7,9 @@ toc: true
 weight: 400
 ---
 
-Snippets allow you to insert raw NGINX config into different contexts of the NGINX configurations that F5 NGINX Ingress Controller generates. 
+Snippets allow you to insert raw NGINX config into different contexts of the NGINX configurations that F5 NGINX Ingress Controller generates.
 
-Snippets are intended for advanced NGINX users who need more control over the generated NGINX configuration, and can be used in cases where Annotations and ConfigMap entries would not apply. 
+Snippets are intended for advanced NGINX users who need more control over the generated NGINX configuration, and can be used in cases where Annotations and ConfigMap entries would not apply.
 
 
 
@@ -27,7 +27,7 @@ Snippets have the following disadvantages:
 - *Decreased robustness*. An incorrect snippet can invalidate NGINX configuration, causing reload failures. Until the snippet is fixed, it will prevent any new configuration updates, including updates for the other Ingress resources.
 - *Security implications*. Snippets give access to NGINX configuration primitives, which are not validated by NGINX Ingress Controller. For example, a snippet can configure NGINX to serve the TLS certificates and keys used for TLS termination for Ingress resources.
 
-{{< note >}} If the NGINX configuration includes an invalid snippet, NGINX will continue to operate with the last valid configuration. {{< /note >}} 
+{{< note >}} If the NGINX configuration includes an invalid snippet, NGINX will continue to operate with the last valid configuration. {{< /note >}}
 
 ## Using snippets
 
@@ -68,7 +68,7 @@ spec:
 
 These snippets generate the following NGINX configuration:
 
-{{< note >}} The example is shortened for conciseness. {{< /note >}} 
+{{< note >}} The example is shortened for conciseness. {{< /note >}}
 
 ```nginx
 server {
diff --git a/content/includes/nic/configuration/ingress-resources/basic-configuration.md b/content/includes/nic/configuration/ingress-resources/basic-configuration.md
index bd2c10d26..6884e42b5 100644
--- a/content/includes/nic/configuration/ingress-resources/basic-configuration.md
+++ b/content/includes/nic/configuration/ingress-resources/basic-configuration.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: reference
 product: NIC
-docs: DOCS-593
+nd-docs: DOCS-593
 ---
 
 This document shows a basic Ingress resource definition for F5 NGINX Ingress Controller. It load balances requests for two services as part of a single application.
@@ -93,9 +93,9 @@ NGINX Ingress Controller imposes the following restrictions on Ingress resources
 
 ## Advanced configuration
 
-NGINX Ingress Controller generates NGINX configuration by executing a template file that contains the configuration options. 
+NGINX Ingress Controller generates NGINX configuration by executing a template file that contains the configuration options.
 
-These options are set with the Ingress resource and NGINX Ingress Controller's ConfigMap.  
+These options are set with the Ingress resource and NGINX Ingress Controller's ConfigMap.
 
 The Ingress resource only allows you to use basic NGINX features: host and path-based routing and TLS termination.
 
diff --git a/content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md b/content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md
index 3e92b6403..e877c906a 100644
--- a/content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md
+++ b/content/includes/nic/configuration/ingress-resources/cross-namespace-configuration.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-594
+nd-docs: DOCS-594
 doctypes:
 - ''
 title: Cross-namespace configuration
diff --git a/content/includes/nic/configuration/ingress-resources/custom-annotations.md b/content/includes/nic/configuration/ingress-resources/custom-annotations.md
index 8bbd136b0..9cd6621de 100644
--- a/content/includes/nic/configuration/ingress-resources/custom-annotations.md
+++ b/content/includes/nic/configuration/ingress-resources/custom-annotations.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-595
+nd-docs: DOCS-595
 doctypes:
 - ''
 title: Custom annotations
diff --git a/content/includes/nic/configuration/policy-resource.md b/content/includes/nic/configuration/policy-resource.md
index 6ea2c8121..5de80b1c1 100644
--- a/content/includes/nic/configuration/policy-resource.md
+++ b/content/includes/nic/configuration/policy-resource.md
@@ -4,7 +4,7 @@ weight: 500
 toc: true
 type: how-to
 product: NIC
-docs: DOCS-596
+nd-docs: DOCS-596
 ---
 
 The Policy resource allows you to configure features like access control and rate-limiting, which you can add to your [VirtualServer and VirtualServerRoute resources](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/).
@@ -201,7 +201,7 @@ The rate limit policy will only apply to requests that contain a JWT with the sp
 {
   "user_details": {
     "level": "premium"
-  }, 
+  },
   "sub": "client1"
 }
 ```
diff --git a/content/includes/nic/configuration/security.md b/content/includes/nic/configuration/security.md
index ae2f9648f..7267eaa01 100644
--- a/content/includes/nic/configuration/security.md
+++ b/content/includes/nic/configuration/security.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-597
+nd-docs: DOCS-597
 doctypes:
 - ''
 title: Security recommendations
diff --git a/content/includes/nic/configuration/transportserver-resource.md b/content/includes/nic/configuration/transportserver-resource.md
index b725ea2e6..ea2f3c688 100644
--- a/content/includes/nic/configuration/transportserver-resource.md
+++ b/content/includes/nic/configuration/transportserver-resource.md
@@ -2,7 +2,7 @@
 title: TransportServer resources
 toc: true
 weight: 600
-docs: DOCS-598
+nd-docs: DOCS-598
 ---
 
 This document is reference material for the TransportServer resource used by F5 NGINX Ingress Controller.
diff --git a/content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md b/content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md
index 1acd05b02..a129629ed 100644
--- a/content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md
+++ b/content/includes/nic/configuration/virtualserver-and-virtualserverroute-resources.md
@@ -2,7 +2,7 @@
 title: VirtualServer and VirtualServerRoute resources
 toc: true
 weight: 700
-docs: DOCS-599
+nd-docs: DOCS-599
 ---
 
 This document is reference material for the VirtualServer and VirtualServerRoute resources used by F5 NGINX Ingress Controller.
diff --git a/content/includes/nic/installation/create-common-resources.md b/content/includes/nic/installation/create-common-resources.md
index 7cfe90e48..db3ef05ea 100644
--- a/content/includes/nic/installation/create-common-resources.md
+++ b/content/includes/nic/installation/create-common-resources.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1464
+nd-docs: DOCS-1464
 ---
 
 In this section, you'll create resources that most NGINX Ingress Controller installations require:
diff --git a/content/includes/nic/installation/create-custom-resources.md b/content/includes/nic/installation/create-custom-resources.md
index d7ad9ec27..dbdbf6065 100644
--- a/content/includes/nic/installation/create-custom-resources.md
+++ b/content/includes/nic/installation/create-custom-resources.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1463
+nd-docs: DOCS-1463
 ---
 
 To make sure your NGINX Ingress Controller pods reach the `Ready` state, you'll need to create custom resource definitions (CRDs) for various components.
diff --git a/content/includes/nic/installation/deploy-controller.md b/content/includes/nic/installation/deploy-controller.md
index 5723c73ae..7dcec97bd 100644
--- a/content/includes/nic/installation/deploy-controller.md
+++ b/content/includes/nic/installation/deploy-controller.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1462
+nd-docs: DOCS-1462
 ---
 
 You have two options for deploying NGINX Ingress Controller:
diff --git a/content/includes/nic/installation/download-jwt.md b/content/includes/nic/installation/download-jwt.md
index d89c65a43..78ad1cbf8 100644
--- a/content/includes/nic/installation/download-jwt.md
+++ b/content/includes/nic/installation/download-jwt.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-000"
+nd-docs: "DOCS-000"
 ---
 
 1. Log in to [MyF5](https://my.f5.com/manage/s/).
diff --git a/content/includes/nic/installation/jwt-password-note.md b/content/includes/nic/installation/jwt-password-note.md
index 147c67af3..040a3e142 100644
--- a/content/includes/nic/installation/jwt-password-note.md
+++ b/content/includes/nic/installation/jwt-password-note.md
@@ -1,5 +1,5 @@
 ---
-docs: 
+nd-docs:
 ---
 
 {{< note >}} For security, follow these practices with JSON Web Tokens (JWTs), passwords, and shell history:
diff --git a/content/includes/nic/installation/manifests/daemonset.md b/content/includes/nic/installation/manifests/daemonset.md
index c19376eb2..ff9cb072b 100644
--- a/content/includes/nic/installation/manifests/daemonset.md
+++ b/content/includes/nic/installation/manifests/daemonset.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1465
+nd-docs: DOCS-1465
 ---
 
 For additional context on managing containers using Kubernetes DaemonSets, refer to the official Kubernetes [DaemonSets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) documentation.
diff --git a/content/includes/nic/installation/manifests/deployment.md b/content/includes/nic/installation/manifests/deployment.md
index 3786a2256..1c0f4932f 100644
--- a/content/includes/nic/installation/manifests/deployment.md
+++ b/content/includes/nic/installation/manifests/deployment.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1467
+nd-docs: DOCS-1467
 ---
 
 For additional context on managing containers using Kubernetes Deployments, refer to the official Kubernetes [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) documentation.
diff --git a/content/includes/nic/installation/manifests/verify-pods-are-running.md b/content/includes/nic/installation/manifests/verify-pods-are-running.md
index 9f11fa7b0..79976859f 100644
--- a/content/includes/nic/installation/manifests/verify-pods-are-running.md
+++ b/content/includes/nic/installation/manifests/verify-pods-are-running.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1466
+nd-docs: DOCS-1466
 ---
 
 
diff --git a/content/includes/nic/rbac/set-up-rbac.md b/content/includes/nic/rbac/set-up-rbac.md
index a8bd5a176..eaf9a6c6f 100644
--- a/content/includes/nic/rbac/set-up-rbac.md
+++ b/content/includes/nic/rbac/set-up-rbac.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1468
+nd-docs: DOCS-1468
 ---
 
 {{<call-out "important" "Admin access required" >}}To complete these steps you need admin access to your cluster. Refer to to your Kubernetes platform's documentation to set up admin access. For Google Kubernetes Engine (GKE), you can refer to their [Role-Based Access Control guide](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).{{</call-out>}}
diff --git a/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md b/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md
index 6e94ced35..fd850214f 100644
--- a/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md
+++ b/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1295
+nd-docs: DOCS-1295
 ---
 
 To use basic authentication for API requests, include your base64-encoded credentials as a "Basic" token in the "Authorization" header. To create the base64-encoded credentials, run the following command:
diff --git a/content/includes/nim/admin-guide/license/add-license-webui.md b/content/includes/nim/admin-guide/license/add-license-webui.md
index 805615b34..709d58e38 100644
--- a/content/includes/nim/admin-guide/license/add-license-webui.md
+++ b/content/includes/nim/admin-guide/license/add-license-webui.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1660"
+nd-docs: "DOCS-1660"
 ---
 
 1. Go to the FQDN of your NGINX Instance Manager host and log in.
diff --git a/content/includes/nim/clickhouse/clickhouse-defaults.md b/content/includes/nim/clickhouse/clickhouse-defaults.md
index 1848b75f7..0fcb4cfd8 100644
--- a/content/includes/nim/clickhouse/clickhouse-defaults.md
+++ b/content/includes/nim/clickhouse/clickhouse-defaults.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1238
+nd-docs: DOCS-1238
 files:
 - content/nim/system-configuration/configure-clickhouse.md
 - content/nim/deploy/vm-bare-metal/install-nim-manual.md
diff --git a/content/includes/nim/decoupling/note-legacy-nms-references.md b/content/includes/nim/decoupling/note-legacy-nms-references.md
index 2f2263f25..89c87b10e 100644
--- a/content/includes/nim/decoupling/note-legacy-nms-references.md
+++ b/content/includes/nim/decoupling/note-legacy-nms-references.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1661"
+nd-docs: "DOCS-1661"
 ---
 
 {{<call-out "tip" "Legacy 'nms' references" "fa-solid fa-sync" >}}Some commands, file paths, and configuration references still use `nms` due to the ongoing transition from NGINX Management Suite (NMS) to NGINX Instance Manager (NIM). These will be updated in future releases.{{</call-out>}}
\ No newline at end of file
diff --git a/content/includes/nim/disconnected/license-usage-offline-script.md b/content/includes/nim/disconnected/license-usage-offline-script.md
index 6f3578cea..72a5e49e0 100644
--- a/content/includes/nim/disconnected/license-usage-offline-script.md
+++ b/content/includes/nim/disconnected/license-usage-offline-script.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1662"
+nd-docs: "DOCS-1662"
 ---
 
 <details closed>
@@ -26,13 +26,13 @@ if [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
   echo
   echo "For Licensing in Disconnected Mode:"
   echo "$0 -j my-jwt.jwt -i <NIM-IP> -u admin -p <password> -o report.zip -s initial"
-  echo 
+  echo
   echo "For Usage Reporting in Disconnected Mode:"
   echo "$0 -j my-jwt.jwt -i <NIM-IP> -u admin -p <password> -o report.zip -s telemetry"
-  echo 
-  echo "Note: Since NGINX Instance Manager comes with self-signed certificates by default, the --insecure flag is set in this script to run specific Curl commands." 
+  echo
+  echo "Note: Since NGINX Instance Manager comes with self-signed certificates by default, the --insecure flag is set in this script to run specific Curl commands."
   echo "You can alter this script if you wish to change from self-signed to verified certificates in Instance Manager."
-  echo 
+  echo
   exit 1
 fi
 
diff --git a/content/includes/nim/disconnected/set-mode-of-operation-disconnected.md b/content/includes/nim/disconnected/set-mode-of-operation-disconnected.md
index 327fd7f18..066afb1b8 100644
--- a/content/includes/nim/disconnected/set-mode-of-operation-disconnected.md
+++ b/content/includes/nim/disconnected/set-mode-of-operation-disconnected.md
@@ -1,5 +1,5 @@
 ---
-docs: "DOCS-1663"
+nd-docs: "DOCS-1663"
 ---
 
 1. Open the `/etc/nms/nms.conf` file and add the following in the `integrations:license` section:
diff --git a/content/includes/nim/docker/docker-registry-login.md b/content/includes/nim/docker/docker-registry-login.md
index 05de77a8a..961380426 100644
--- a/content/includes/nim/docker/docker-registry-login.md
+++ b/content/includes/nim/docker/docker-registry-login.md
@@ -1,12 +1,12 @@
 ---
-docs: "DOCS-1666"
+nd-docs: "DOCS-1666"
 ---
 
 1. Download your NGINX Instance Manager subscription's JSON Web Token from MyF5. You can use the same JSON Web Token as NGINX Plus in your MyF5 portal.
 
    {{< include "licensing-and-reporting/download-jwt-from-myf5.md" >}}
 
-1. Open the JSON Web Token file you downloaded from [MyF5](https://my.f5.com/manage/s/subscriptions) and copy its contents. 
+1. Open the JSON Web Token file you downloaded from [MyF5](https://my.f5.com/manage/s/subscriptions) and copy its contents.
 
    {{<call-out "tip" "Copying the JWT token" "" >}} Make sure there are **no extra characters or spaces** when copying the contents of the JWT token: they can invalidate the token and cause 401 errors during authentication.{{</call-out>}}
 
diff --git a/content/includes/nim/how-to-access-api-docs.md b/content/includes/nim/how-to-access-api-docs.md
index 26a1e6d8a..4375880e2 100644
--- a/content/includes/nim/how-to-access-api-docs.md
+++ b/content/includes/nim/how-to-access-api-docs.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-991
+nd-docs: DOCS-991
 ---
 
 You can access the NGINX Instance Manager API documentation from the web interface:
diff --git a/content/includes/nim/how-to-access-nim-api.md b/content/includes/nim/how-to-access-nim-api.md
index d5af8cac6..66cea5c68 100644
--- a/content/includes/nim/how-to-access-nim-api.md
+++ b/content/includes/nim/how-to-access-nim-api.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1050
+nd-docs: DOCS-1050
 ---
 
 You can use tools like `curl` or [Postman](https://www.postman.com) to interact with the NGINX Instance Manager REST API. The API URL is `https://<NIM-FQDN>/api/[nim|platform]/<API_VERSION>`, and each request requires authentication. For more details on authentication options, see the [API Overview]({{< ref "/nim/fundamentals/api-overview.md" >}}).
diff --git a/content/includes/nim/kubernetes/access-webui-helm.md b/content/includes/nim/kubernetes/access-webui-helm.md
index 90c02e86c..76e22288e 100644
--- a/content/includes/nim/kubernetes/access-webui-helm.md
+++ b/content/includes/nim/kubernetes/access-webui-helm.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1323
+nd-docs: DOCS-1323
 ---
 
 You can access the NGINX Instance Manager web interface using the external IP address for the API Gateway.
diff --git a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
index 238bc2f31..ab9779cf4 100644
--- a/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
+++ b/content/includes/nim/kubernetes/nms-chart-supported-module-versions.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1324
+nd-docs: DOCS-1324
 ---
 
 {{<bootstrap-table "table table-striped table-bordered">}}
diff --git a/content/includes/nim/nap-waf/restart-nms-integrations.md b/content/includes/nim/nap-waf/restart-nms-integrations.md
index bca3636f9..e0e0a7f64 100644
--- a/content/includes/nim/nap-waf/restart-nms-integrations.md
+++ b/content/includes/nim/nap-waf/restart-nms-integrations.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-000
+nd-docs: DOCS-000
 files:
   - content/nim/nginx-app-protect/setup-waf-config-management.md
 ---
diff --git a/content/includes/nim/rbac/assign-roles-to-user-groups.md b/content/includes/nim/rbac/assign-roles-to-user-groups.md
index 961de496a..9c3b03292 100644
--- a/content/includes/nim/rbac/assign-roles-to-user-groups.md
+++ b/content/includes/nim/rbac/assign-roles-to-user-groups.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1301
+nd-docs: DOCS-1301
 ---
 
 {{< call-out "important" "User groups require an OIDC identity provider" >}}User groups require an external identity provider configured for OpenID Connect (OIDC) authentication, as described in [Getting started with OIDC]({{< ref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}). Users from an external identity provider cannot be assigned roles directly in NGINX Instance Manager. Instead, they inherit roles based on their group membership.{{< /call-out >}}
diff --git a/content/includes/nim/rbac/assign-roles-to-users.md b/content/includes/nim/rbac/assign-roles-to-users.md
index 4c50bb72c..040a4cf52 100644
--- a/content/includes/nim/rbac/assign-roles-to-users.md
+++ b/content/includes/nim/rbac/assign-roles-to-users.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1025
+nd-docs: DOCS-1025
 ---
 
 To assign roles to a user in NGINX Instance Manager, follow these steps:
diff --git a/content/includes/nim/rbac/create-roles.md b/content/includes/nim/rbac/create-roles.md
index 174ed3057..1fd1d37f8 100644
--- a/content/includes/nim/rbac/create-roles.md
+++ b/content/includes/nim/rbac/create-roles.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1028
+nd-docs: DOCS-1028
 ---
 
 Roles in NGINX Instance Manager are a critical part of [role-based access control (RBAC)]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}). By creating roles, you define the access levels and permissions for different user groups that correspond to groups in your Identity Provider (IdP).
diff --git a/content/includes/nim/rbac/create-user-groups.md b/content/includes/nim/rbac/create-user-groups.md
index 2504af468..9c9c1db12 100644
--- a/content/includes/nim/rbac/create-user-groups.md
+++ b/content/includes/nim/rbac/create-user-groups.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1027
+nd-docs: DOCS-1027
 ---
 
 {{< call-out "important" "Group names must match with your IdP" >}}To ensure that NGINX Instance Manager and your IdP work together seamlessly, group names must exactly match between the two systems. If the group names don’t match, the OIDC integration will fail, preventing users from accessing NGINX Instance Manager. For example, if you have a group called "app-developers" in your IdP, you must create a user group called "app-developers" in NGINX Instance Manager. The group claim must also be part of the token your IdP generates. Refer to your IdP's documentation for guidance on adding group claims.{{</call-out>}}
diff --git a/content/includes/nim/rbac/what-is-rbac.md b/content/includes/nim/rbac/what-is-rbac.md
index c30034a9f..93fb5b72c 100644
--- a/content/includes/nim/rbac/what-is-rbac.md
+++ b/content/includes/nim/rbac/what-is-rbac.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1179
+nd-docs: DOCS-1179
 ---
 
 RBAC (Role-Based Access Control) is a security framework that provides access control based on roles assigned to users or user groups. This framework defines the roles and responsibilities of users within the system and restricts access to resources according to the user’s role. RBAC ensures only authorized users have access to specific resources and prevents unauthorized access.
diff --git a/content/includes/nim/tech-specs/nim-app-protect-support.md b/content/includes/nim/tech-specs/nim-app-protect-support.md
index cf6a03365..fda626499 100644
--- a/content/includes/nim/tech-specs/nim-app-protect-support.md
+++ b/content/includes/nim/tech-specs/nim-app-protect-support.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1068
+nd-docs: DOCS-1068
 ---
 
 NGINX Instance Manager supports the following versions of [NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect/):
diff --git a/content/includes/nim/tech-specs/supported-distros.md b/content/includes/nim/tech-specs/supported-distros.md
index 632059861..7ede72fc3 100644
--- a/content/includes/nim/tech-specs/supported-distros.md
+++ b/content/includes/nim/tech-specs/supported-distros.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1071
+nd-docs: DOCS-1071
 files:
 - content/nim/fundamentals/tech-specs.md
 ---
diff --git a/content/includes/nim/tech-specs/supported-nginx-versions.md b/content/includes/nim/tech-specs/supported-nginx-versions.md
index ddabfd9b2..9e13fa2ef 100644
--- a/content/includes/nim/tech-specs/supported-nginx-versions.md
+++ b/content/includes/nim/tech-specs/supported-nginx-versions.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1075
+nd-docs: DOCS-1075
 files:
 - content/nim/fundamentals/tech-specs.md
 ---
diff --git a/content/includes/nim/templates/additional-templating-resources.md b/content/includes/nim/templates/additional-templating-resources.md
index cd21b7d82..9eae64a38 100644
--- a/content/includes/nim/templates/additional-templating-resources.md
+++ b/content/includes/nim/templates/additional-templating-resources.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1500
+nd-docs: DOCS-1500
 ---
 
 <br>
diff --git a/content/includes/nim/webui-nim-login.md b/content/includes/nim/webui-nim-login.md
index 65b5bfd19..85bbf101d 100644
--- a/content/includes/nim/webui-nim-login.md
+++ b/content/includes/nim/webui-nim-login.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1334
+nd-docs: DOCS-1334
 ---
 
 In a web browser, go to the FQDN for your NGINX Instance Manager host and log in. Then, select **Instance Manager** from the Launchpad menu.
diff --git a/content/includes/nms/services/platform-services.md b/content/includes/nms/services/platform-services.md
index 33224eeea..4c9a58d6a 100644
--- a/content/includes/nms/services/platform-services.md
+++ b/content/includes/nms/services/platform-services.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1186
+nd-docs: DOCS-1186
 ---
 
 {{<bootstrap-table "table table-striped table-bordered">}}
diff --git a/content/includes/security/jwt-password-note.md b/content/includes/security/jwt-password-note.md
index d7c1640a3..69a32ad80 100644
--- a/content/includes/security/jwt-password-note.md
+++ b/content/includes/security/jwt-password-note.md
@@ -1,12 +1,12 @@
 ---
-docs: 
+nd-docs:
 ---
 
 {{<call-out "important" "Protect sensitive data" "fas fa-shield-alt" >}}
 To protect your system and data, follow these security practices:
- 
+
 1. **JWTs:** Treat JSON Web Tokens (JWTs) as sensitive data. Store them securely and delete them after use to prevent unauthorized access.
- 
+
 2. **Shell history:** Commands with JWTs or passwords are saved in plain text in your shell history. After running such commands, clear the history to protect credentials. For example:
    - Edit your shell history file (such as ~/.bash_history or ~/.zsh_history) to remove specific commands.
    - Use `history -c` to clear all shell history in bash or zsh.
diff --git a/content/includes/security/rbac-intro.md b/content/includes/security/rbac-intro.md
index 7122c1110..e45dce9c5 100644
--- a/content/includes/security/rbac-intro.md
+++ b/content/includes/security/rbac-intro.md
@@ -2,7 +2,7 @@
 files:
   - content/nginx-one/rbac/overview.md
   - content/nim/admin-guide/rbac/overview-rbac.md
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 Role-based access control (RBAC) is a security system that governs access to resources within a software application. By assigning specific roles to users or groups, RBAC ensures that only authorized individuals have the ability to perform certain actions or access particular areas.
 
diff --git a/content/includes/support/how-to-get-support.md b/content/includes/support/how-to-get-support.md
index e03f3a791..570d29774 100644
--- a/content/includes/support/how-to-get-support.md
+++ b/content/includes/support/how-to-get-support.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1225
+nd-docs: DOCS-1225
 ---
 
 If you need additional assistance, refer to the following topics for guidance on how to contact Support and create a Support Package:
diff --git a/content/mesh/about/architecture.md b/content/mesh/about/architecture.md
index c5db8f34f..1d0fb6fc1 100644
--- a/content/mesh/about/architecture.md
+++ b/content/mesh/about/architecture.md
@@ -3,7 +3,7 @@ title: Architecture
 weight: 200
 description: Learn about F5 NGINX Service Mesh Architecture.
 toc: true
-docs: DOCS-676
+nd-docs: DOCS-676
 type:
 - concept
 - reference
diff --git a/content/mesh/about/mesh-tech-specs.md b/content/mesh/about/mesh-tech-specs.md
index 737a6b493..7bcc87d8a 100644
--- a/content/mesh/about/mesh-tech-specs.md
+++ b/content/mesh/about/mesh-tech-specs.md
@@ -3,7 +3,7 @@ title: Technical Specifications
 weight: 110
 description: Cluster requirements and F5 NGINX Service Mesh footprint.
 toc: true
-docs: DOCS-677
+nd-docs: DOCS-677
 type:
 - reference
 ---
diff --git a/content/mesh/about/what-is-nsm.md b/content/mesh/about/what-is-nsm.md
index 1b212f4e0..1ae385795 100644
--- a/content/mesh/about/what-is-nsm.md
+++ b/content/mesh/about/what-is-nsm.md
@@ -3,7 +3,7 @@ title: What is NGINX Service Mesh?
 weight: 100
 description: Learn about F5 NGINX Service Mesh fundamentals.
 toc: true
-docs: DOCS-678
+nd-docs: DOCS-678
 type:
 - concept
 ---
diff --git a/content/mesh/get-started/install/configuration.md b/content/mesh/get-started/install/configuration.md
index 4c801a585..7d8605389 100644
--- a/content/mesh/get-started/install/configuration.md
+++ b/content/mesh/get-started/install/configuration.md
@@ -3,7 +3,7 @@ title: Configuration Options
 weight: 100
 description: Learn about F5 NGINX Service Mesh features and deployment options.
 toc: true
-docs: DOCS-679
+nd-docs: DOCS-679
 type:
 - concept
 ---
diff --git a/content/mesh/get-started/install/install-with-helm.md b/content/mesh/get-started/install/install-with-helm.md
index d3c8154bc..e11f34b93 100644
--- a/content/mesh/get-started/install/install-with-helm.md
+++ b/content/mesh/get-started/install/install-with-helm.md
@@ -4,7 +4,7 @@ draft: false
 toc: true
 description: This guide explains how to install F5 NGINX Service Mesh using Helm.
 weight: 300
-docs: DOCS-680
+nd-docs: DOCS-680
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/install/install.md b/content/mesh/get-started/install/install.md
index 4d6a4a5d4..a58a337e7 100644
--- a/content/mesh/get-started/install/install.md
+++ b/content/mesh/get-started/install/install.md
@@ -3,7 +3,7 @@ title: Install with nginx-meshctl
 draft: false
 toc: true
 weight: 200
-docs: DOCS-681
+nd-docs: DOCS-681
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/platform-setup/gke.md b/content/mesh/get-started/platform-setup/gke.md
index 5ee197288..fd6e977c9 100644
--- a/content/mesh/get-started/platform-setup/gke.md
+++ b/content/mesh/get-started/platform-setup/gke.md
@@ -3,7 +3,7 @@ title: Google Kubernetes Engine
 description: Learn how to set up Google Kubernetes Engine (GKE) for use with F5 NGINX
   Service Mesh.
 toc: true
-docs: DOCS-683
+nd-docs: DOCS-683
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/platform-setup/kubeadm.md b/content/mesh/get-started/platform-setup/kubeadm.md
index 971db529a..6f892b73c 100644
--- a/content/mesh/get-started/platform-setup/kubeadm.md
+++ b/content/mesh/get-started/platform-setup/kubeadm.md
@@ -2,7 +2,7 @@
 title: Kubeadm
 description: Learn how to set up Kubeadm for use with F5 NGINX Service Mesh.
 toc: true
-docs: DOCS-684
+nd-docs: DOCS-684
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/platform-setup/kubespray.md b/content/mesh/get-started/platform-setup/kubespray.md
index ee99ce369..24f49fead 100644
--- a/content/mesh/get-started/platform-setup/kubespray.md
+++ b/content/mesh/get-started/platform-setup/kubespray.md
@@ -2,7 +2,7 @@
 title: Kubespray
 description: Learn how to set up Kubespray for use with F5 NGINX Service Mesh.
 toc: true
-docs: DOCS-685
+nd-docs: DOCS-685
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/platform-setup/openshift.md b/content/mesh/get-started/platform-setup/openshift.md
index b2cc39ce9..ba5bfb5c6 100644
--- a/content/mesh/get-started/platform-setup/openshift.md
+++ b/content/mesh/get-started/platform-setup/openshift.md
@@ -3,7 +3,7 @@ title: OpenShift
 description: Learn what is different in OpenShift, and the considerations a user must
   make.
 toc: true
-docs: DOCS-689
+nd-docs: DOCS-689
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/platform-setup/persistent-storage.md b/content/mesh/get-started/platform-setup/persistent-storage.md
index 06051f8ca..aa6310f39 100644
--- a/content/mesh/get-started/platform-setup/persistent-storage.md
+++ b/content/mesh/get-started/platform-setup/persistent-storage.md
@@ -4,7 +4,7 @@ description: Learn how to set up persistent storage for use with F5 NGINX Servic
   Mesh.
 weight: 101
 toc: true
-docs: DOCS-686
+nd-docs: DOCS-686
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/platform-setup/rke.md b/content/mesh/get-started/platform-setup/rke.md
index 2e4bd98e0..f67b55d94 100644
--- a/content/mesh/get-started/platform-setup/rke.md
+++ b/content/mesh/get-started/platform-setup/rke.md
@@ -3,7 +3,7 @@ title: Rancher Kubernetes Engine
 description: Learn how to set up Rancher Kubernetes Engine (RKE) for use with F5 NGINX
   Service Mesh.
 toc: true
-docs: DOCS-687
+nd-docs: DOCS-687
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/platform-setup/supported-platforms.md b/content/mesh/get-started/platform-setup/supported-platforms.md
index 67f5b13a6..d5966a1d2 100644
--- a/content/mesh/get-started/platform-setup/supported-platforms.md
+++ b/content/mesh/get-started/platform-setup/supported-platforms.md
@@ -4,7 +4,7 @@ description: Find out which platforms are supported for use with F5 NGINX Servic
   Mesh.
 weight: 100
 toc: true
-docs: DOCS-688
+nd-docs: DOCS-688
 ---
 
 ## Kubernetes
diff --git a/content/mesh/get-started/uninstall/uninstall-with-helm.md b/content/mesh/get-started/uninstall/uninstall-with-helm.md
index b2b2af62d..5df1a2085 100644
--- a/content/mesh/get-started/uninstall/uninstall-with-helm.md
+++ b/content/mesh/get-started/uninstall/uninstall-with-helm.md
@@ -4,7 +4,7 @@ draft: false
 toc: true
 description: This topic explains how to uninstall F5 NGINX Service Mesh using Helm.
 weight: 300
-docs: DOCS-699
+nd-docs: DOCS-699
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/uninstall/uninstall.md b/content/mesh/get-started/uninstall/uninstall.md
index 32ae4838e..59c7f8149 100644
--- a/content/mesh/get-started/uninstall/uninstall.md
+++ b/content/mesh/get-started/uninstall/uninstall.md
@@ -3,7 +3,7 @@ title: Uninstall with nginx-meshctl
 draft: false
 toc: true
 weight: 200
-docs: DOCS-1481
+nd-docs: DOCS-1481
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/upgrade/upgrade-with-helm.md b/content/mesh/get-started/upgrade/upgrade-with-helm.md
index 5519d9446..ad8cf6c73 100644
--- a/content/mesh/get-started/upgrade/upgrade-with-helm.md
+++ b/content/mesh/get-started/upgrade/upgrade-with-helm.md
@@ -4,7 +4,7 @@ draft: false
 toc: true
 description: This guide explains how to upgrade F5 NGINX Service Mesh using Helm.
 weight: 300
-docs: DOCS-700
+nd-docs: DOCS-700
 type:
 - how-to
 ---
diff --git a/content/mesh/get-started/upgrade/upgrade.md b/content/mesh/get-started/upgrade/upgrade.md
index 5d1ac3e68..744974dec 100644
--- a/content/mesh/get-started/upgrade/upgrade.md
+++ b/content/mesh/get-started/upgrade/upgrade.md
@@ -4,7 +4,7 @@ draft: false
 toc: true
 description: This guide explains how to upgrade F5 NGINX Service Mesh using nginx-meshctl.
 weight: 200
-docs: DOCS-1482
+nd-docs: DOCS-1482
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/inject-sidecar-proxy.md b/content/mesh/guides/inject-sidecar-proxy.md
index 9ddd2d3bf..99f1d6a77 100644
--- a/content/mesh/guides/inject-sidecar-proxy.md
+++ b/content/mesh/guides/inject-sidecar-proxy.md
@@ -4,7 +4,7 @@ toc: true
 description: Learn about the configuration options for F5 NGINX Service Mesh sidecar
   proxy injection.
 weight: 10
-docs: DOCS-692
+nd-docs: DOCS-692
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/monitoring-and-tracing.md b/content/mesh/guides/monitoring-and-tracing.md
index dec5da3c0..b2ce80d04 100644
--- a/content/mesh/guides/monitoring-and-tracing.md
+++ b/content/mesh/guides/monitoring-and-tracing.md
@@ -4,7 +4,7 @@ toc: true
 description: Learn about the monitoring and tracing features available in F5 NGINX
   Service Mesh.
 weight: 20
-docs: DOCS-693
+nd-docs: DOCS-693
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/private-registry.md b/content/mesh/guides/private-registry.md
index 8d97f4565..821f86b43 100644
--- a/content/mesh/guides/private-registry.md
+++ b/content/mesh/guides/private-registry.md
@@ -3,7 +3,7 @@ title: Private Registry
 description: How to set up access to a private registry
 weight: 70
 toc: true
-docs: DOCS-694
+nd-docs: DOCS-694
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/production-tuning.md b/content/mesh/guides/production-tuning.md
index 15be7ee28..4dc90023d 100644
--- a/content/mesh/guides/production-tuning.md
+++ b/content/mesh/guides/production-tuning.md
@@ -2,7 +2,7 @@
 title: Production Tuning
 weight: 80
 toc: true
-docs: DOCS-695
+nd-docs: DOCS-695
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/prometheus-metrics.md b/content/mesh/guides/prometheus-metrics.md
index 84a829ddf..2574e480d 100644
--- a/content/mesh/guides/prometheus-metrics.md
+++ b/content/mesh/guides/prometheus-metrics.md
@@ -3,7 +3,7 @@ title: Prometheus Metrics
 description: How to set up and view prometheus metrics for valuable workload insights
 weight: 40
 toc: true
-docs: DOCS-840
+nd-docs: DOCS-840
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/secure-traffic-mtls.md b/content/mesh/guides/secure-traffic-mtls.md
index 2bd7b30c9..ba6ca46fd 100644
--- a/content/mesh/guides/secure-traffic-mtls.md
+++ b/content/mesh/guides/secure-traffic-mtls.md
@@ -3,7 +3,7 @@ title: Secure Mesh Traffic using mTLS
 toc: true
 description: Learn about the mTLS options available in F5 NGINX Service Mesh.
 weight: 30
-docs: DOCS-696
+nd-docs: DOCS-696
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/smi-traffic-metrics.md b/content/mesh/guides/smi-traffic-metrics.md
index 6421adbcb..9c07ed559 100644
--- a/content/mesh/guides/smi-traffic-metrics.md
+++ b/content/mesh/guides/smi-traffic-metrics.md
@@ -3,7 +3,7 @@ title: SMI Traffic Metrics
 description: How to set up and view SMI traffic metrics
 weight: 50
 toc: true
-docs: DOCS-697
+nd-docs: DOCS-697
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/smi-traffic-policies.md b/content/mesh/guides/smi-traffic-policies.md
index 16bf93a3f..8053f5d9b 100644
--- a/content/mesh/guides/smi-traffic-policies.md
+++ b/content/mesh/guides/smi-traffic-policies.md
@@ -4,7 +4,7 @@ toc: true
 description: Learn about the traffic policies supported by F5 NGINX Service Mesh and
   how to configure them.
 weight: 60
-docs: DOCS-698
+nd-docs: DOCS-698
 type:
 - how-to
 ---
diff --git a/content/mesh/guides/v1alpha1-ratelimit.md b/content/mesh/guides/v1alpha1-ratelimit.md
index 38735b6a3..dfc4e0d62 100644
--- a/content/mesh/guides/v1alpha1-ratelimit.md
+++ b/content/mesh/guides/v1alpha1-ratelimit.md
@@ -1,6 +1,6 @@
 ---
 title: v1alpha1 RateLimit Documentation
-docs: DOCS-701
+nd-docs: DOCS-701
 description: v1alpha1 RateLimit documentation.
 ---
 
@@ -53,10 +53,10 @@ The rate limit spec contains the following fields:
 
   Each Pod in the destination accepts the total rate defined in a rate limit policy. If a policy has
   a rate of 100 r/m, and the destination consists of 3 Pods, each Pod accepts 100 r/m.
-  
+
   If a single rate limit policy contains multiple sources, the rate divides evenly amongst them. For
   example, a policy defined with
-  
+
   ```yaml
   destination:
   name: destService
@@ -65,7 +65,7 @@ The rate limit spec contains the following fields:
   - name: source2
   rate: 100 r/m
   ```
-  
+
   would result in `destService` accepting 50 requests per minute from `source1`, and 50 requests per minute
   from `source2`, for a total rate of 100 requests per minute. If two separate policies are defined for the
   same destination, then the rate is not divided amongst the sources.
diff --git a/content/mesh/reference/api-usage.md b/content/mesh/reference/api-usage.md
index c68955b8e..558a693e8 100644
--- a/content/mesh/reference/api-usage.md
+++ b/content/mesh/reference/api-usage.md
@@ -3,7 +3,7 @@ title: NGINX Service Mesh API
 description: Instructions for interacting with the F5 NGINX Service Mesh API.
 toc: true
 weight: 200
-docs: DOCS-702
+nd-docs: DOCS-702
 type:
 - reference
 ---
diff --git a/content/mesh/reference/nginx-meshctl.md b/content/mesh/reference/nginx-meshctl.md
index cf6f21812..46a68e55d 100644
--- a/content/mesh/reference/nginx-meshctl.md
+++ b/content/mesh/reference/nginx-meshctl.md
@@ -4,7 +4,7 @@ description: Man page and instructions for using the F5 NGINX Service Mesh CLI
 draft: false
 weight: 300
 toc: true
-docs: DOCS-704
+nd-docs: DOCS-704
 type:
 - reference
 ---
diff --git a/content/mesh/reference/permissions.md b/content/mesh/reference/permissions.md
index ee54c919b..b4e9af739 100644
--- a/content/mesh/reference/permissions.md
+++ b/content/mesh/reference/permissions.md
@@ -3,7 +3,7 @@ title: NGINX Service Mesh Permissions
 weight: 100
 draft: false
 toc: true
-docs: DOCS-883
+nd-docs: DOCS-883
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-0.5.0.md b/content/mesh/releases/release-notes-0.5.0.md
index 4a1f859df..b1428bf96 100644
--- a/content/mesh/releases/release-notes-0.5.0.md
+++ b/content/mesh/releases/release-notes-0.5.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -500
-docs: DOCS-705
+nd-docs: DOCS-705
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-0.6.0.md b/content/mesh/releases/release-notes-0.6.0.md
index e5cdabf49..015ae0ef6 100644
--- a/content/mesh/releases/release-notes-0.6.0.md
+++ b/content/mesh/releases/release-notes-0.6.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -600
-docs: DOCS-706
+nd-docs: DOCS-706
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-0.7.0.md b/content/mesh/releases/release-notes-0.7.0.md
index 82314c63d..4f09ce78f 100644
--- a/content/mesh/releases/release-notes-0.7.0.md
+++ b/content/mesh/releases/release-notes-0.7.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -700
-docs: DOCS-707
+nd-docs: DOCS-707
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-0.8.0.md b/content/mesh/releases/release-notes-0.8.0.md
index a7e25c1eb..e42c5934c 100644
--- a/content/mesh/releases/release-notes-0.8.0.md
+++ b/content/mesh/releases/release-notes-0.8.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -800
-docs: DOCS-708
+nd-docs: DOCS-708
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-0.9.0.md b/content/mesh/releases/release-notes-0.9.0.md
index 15e672b6e..e288cf92f 100644
--- a/content/mesh/releases/release-notes-0.9.0.md
+++ b/content/mesh/releases/release-notes-0.9.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 GINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -900
-docs: DOCS-709
+nd-docs: DOCS-709
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-0.9.1.md b/content/mesh/releases/release-notes-0.9.1.md
index 64f893130..c16f5f20e 100644
--- a/content/mesh/releases/release-notes-0.9.1.md
+++ b/content/mesh/releases/release-notes-0.9.1.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs). Lists of new features and known issues are provided.
 weight: -901
-docs: DOCS-710
+nd-docs: DOCS-710
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.0.0.md b/content/mesh/releases/release-notes-1.0.0.md
index bb042d2dc..c6b7d211c 100644
--- a/content/mesh/releases/release-notes-1.0.0.md
+++ b/content/mesh/releases/release-notes-1.0.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1000
-docs: DOCS-711
+nd-docs: DOCS-711
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.0.1.md b/content/mesh/releases/release-notes-1.0.1.md
index 3a34c347a..4075f2ffe 100644
--- a/content/mesh/releases/release-notes-1.0.1.md
+++ b/content/mesh/releases/release-notes-1.0.1.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs). Lists of new features and known issues are provided.
 weight: -1001
-docs: DOCS-712
+nd-docs: DOCS-712
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.1.0.md b/content/mesh/releases/release-notes-1.1.0.md
index 5eb066f52..52a5075b9 100644
--- a/content/mesh/releases/release-notes-1.1.0.md
+++ b/content/mesh/releases/release-notes-1.1.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1100
-docs: DOCS-713
+nd-docs: DOCS-713
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.2.0.md b/content/mesh/releases/release-notes-1.2.0.md
index b1cfbb9b0..d94655a4f 100644
--- a/content/mesh/releases/release-notes-1.2.0.md
+++ b/content/mesh/releases/release-notes-1.2.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1200
-docs: DOCS-714
+nd-docs: DOCS-714
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.2.1.md b/content/mesh/releases/release-notes-1.2.1.md
index 1515a829d..8ebe77cb5 100644
--- a/content/mesh/releases/release-notes-1.2.1.md
+++ b/content/mesh/releases/release-notes-1.2.1.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs). Lists of new features and known issues are provided.
 weight: -1201
-docs: DOCS-715
+nd-docs: DOCS-715
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.3.0.md b/content/mesh/releases/release-notes-1.3.0.md
index 94fd659fd..e4af48714 100644
--- a/content/mesh/releases/release-notes-1.3.0.md
+++ b/content/mesh/releases/release-notes-1.3.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1300
-docs: DOCS-716
+nd-docs: DOCS-716
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.3.1.md b/content/mesh/releases/release-notes-1.3.1.md
index b44e30f8a..561253f38 100644
--- a/content/mesh/releases/release-notes-1.3.1.md
+++ b/content/mesh/releases/release-notes-1.3.1.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs). Lists of new features and known issues are provided.
 weight: -1301
-docs: DOCS-717
+nd-docs: DOCS-717
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.4.0.md b/content/mesh/releases/release-notes-1.4.0.md
index f34791b3c..bfca72bfe 100644
--- a/content/mesh/releases/release-notes-1.4.0.md
+++ b/content/mesh/releases/release-notes-1.4.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1400
-docs: DOCS-1488
+nd-docs: DOCS-1488
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.4.1.md b/content/mesh/releases/release-notes-1.4.1.md
index 89cbbaaae..dc220dea2 100644
--- a/content/mesh/releases/release-notes-1.4.1.md
+++ b/content/mesh/releases/release-notes-1.4.1.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1401
-docs: DOCS-1484
+nd-docs: DOCS-1484
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.5.0.md b/content/mesh/releases/release-notes-1.5.0.md
index a203ae1d2..a17a2b63f 100644
--- a/content/mesh/releases/release-notes-1.5.0.md
+++ b/content/mesh/releases/release-notes-1.5.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1500
-docs: DOCS-1487
+nd-docs: DOCS-1487
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.6.0.md b/content/mesh/releases/release-notes-1.6.0.md
index 78269f6ca..77e9d4c4d 100644
--- a/content/mesh/releases/release-notes-1.6.0.md
+++ b/content/mesh/releases/release-notes-1.6.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1600
-docs: DOCS-1486
+nd-docs: DOCS-1486
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-1.7.0.md b/content/mesh/releases/release-notes-1.7.0.md
index 83dad0860..d28676239 100644
--- a/content/mesh/releases/release-notes-1.7.0.md
+++ b/content/mesh/releases/release-notes-1.7.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1700
-docs: DOCS-1483
+nd-docs: DOCS-1483
 type:
 - reference
 ---
diff --git a/content/mesh/releases/release-notes-2.0.0.md b/content/mesh/releases/release-notes-2.0.0.md
index d9273f36d..64a49211d 100644
--- a/content/mesh/releases/release-notes-2.0.0.md
+++ b/content/mesh/releases/release-notes-2.0.0.md
@@ -7,7 +7,7 @@ description: Release information for F5 NGINX Service Mesh, a configurable, low
   communication among application infrastructure services using application programming
   interfaces (APIs).  Lists of new features and known issues are provided.
 weight: -1800
-docs: DOCS-1485
+nd-docs: DOCS-1485
 type:
 - reference
 ---
diff --git a/content/mesh/support/contact-support.md b/content/mesh/support/contact-support.md
index 132facbc9..17e6e5772 100644
--- a/content/mesh/support/contact-support.md
+++ b/content/mesh/support/contact-support.md
@@ -4,7 +4,7 @@ weight: 100
 description: Learn where to go for F5 NGINX Service Mesh support.
 toc: true
 draft: false
-docs: DOCS-718
+nd-docs: DOCS-718
 type:
 - task
 ---
diff --git a/content/mesh/tutorials/accesscontrol-walkthrough.md b/content/mesh/tutorials/accesscontrol-walkthrough.md
index 8672082c8..0ea9af63e 100644
--- a/content/mesh/tutorials/accesscontrol-walkthrough.md
+++ b/content/mesh/tutorials/accesscontrol-walkthrough.md
@@ -3,7 +3,7 @@ title: "Services using Access Control"
 description: "This article provides a guide for using access control between services."
 weight: 130
 toc: true
-docs: "DOCS-719"
+nd-docs: "DOCS-719"
 ---
 
 ## Overview
diff --git a/content/mesh/tutorials/deploy-example-app.md b/content/mesh/tutorials/deploy-example-app.md
index 771bdd8c4..bbe048c50 100644
--- a/content/mesh/tutorials/deploy-example-app.md
+++ b/content/mesh/tutorials/deploy-example-app.md
@@ -5,7 +5,7 @@ toc: true
 description: This topic provides a walkthrough of deploying an App with F5 NGINX Service
   Mesh.
 weight: 100
-docs: DOCS-720
+nd-docs: DOCS-720
 type:
 - tutorial
 ---
diff --git a/content/mesh/tutorials/kic/deploy-with-kic.md b/content/mesh/tutorials/kic/deploy-with-kic.md
index 1176823f1..2d79bb40b 100644
--- a/content/mesh/tutorials/kic/deploy-with-kic.md
+++ b/content/mesh/tutorials/kic/deploy-with-kic.md
@@ -5,7 +5,7 @@ description: This topic describes how to install and use F5 NGINX Ingress Contro
 weight: 200
 draft: false
 toc: true
-docs: DOCS-721
+nd-docs: DOCS-721
 type:
 - tutorial
 ---
diff --git a/content/mesh/tutorials/kic/egress-walkthrough.md b/content/mesh/tutorials/kic/egress-walkthrough.md
index e245e7d91..fda82ee11 100644
--- a/content/mesh/tutorials/kic/egress-walkthrough.md
+++ b/content/mesh/tutorials/kic/egress-walkthrough.md
@@ -4,7 +4,7 @@ description: This topic provides a walkthrough of how to securely route egress t
   through F5 NGINX Ingress Controller for Kubernetes with NGINX Service Mesh.
 weight: 210
 toc: true
-docs: DOCS-722
+nd-docs: DOCS-722
 type:
 - tutorial
 ---
diff --git a/content/mesh/tutorials/kic/ingress-udp-walkthrough.md b/content/mesh/tutorials/kic/ingress-udp-walkthrough.md
index 303bcc959..4470a9f91 100644
--- a/content/mesh/tutorials/kic/ingress-udp-walkthrough.md
+++ b/content/mesh/tutorials/kic/ingress-udp-walkthrough.md
@@ -4,7 +4,7 @@ description: This topic describes the steps to deploy F5 NGINX Ingress Controlle
   for Kubernetes, to expose a UDP application within NGINX Service Mesh.
 weight: 230
 toc: true
-docs: DOCS-841
+nd-docs: DOCS-841
 type:
 - tutorial
 ---
diff --git a/content/mesh/tutorials/kic/ingress-walkthrough.md b/content/mesh/tutorials/kic/ingress-walkthrough.md
index 3360add08..578095f64 100644
--- a/content/mesh/tutorials/kic/ingress-walkthrough.md
+++ b/content/mesh/tutorials/kic/ingress-walkthrough.md
@@ -4,7 +4,7 @@ description: This topic provides a walkthrough of deploying F5 NGINX Ingress Con
   for Kubernetes to expose an application within NGINX Service Mesh.
 weight: 220
 toc: true
-docs: DOCS-723
+nd-docs: DOCS-723
 type:
 - tutorial
 ---
diff --git a/content/mesh/tutorials/observability.md b/content/mesh/tutorials/observability.md
index 7bc39dfbd..e555409ed 100644
--- a/content/mesh/tutorials/observability.md
+++ b/content/mesh/tutorials/observability.md
@@ -5,7 +5,7 @@ toc: true
 description: This topic provides a walkthrough of deploying F5 NGINX Service Mesh
   with basic observability components.
 weight: 90
-docs: DOCS-886
+nd-docs: DOCS-886
 type:
 - tutorial
 ---
diff --git a/content/mesh/tutorials/ratelimit-walkthrough.md b/content/mesh/tutorials/ratelimit-walkthrough.md
index 812903586..9d8488846 100644
--- a/content/mesh/tutorials/ratelimit-walkthrough.md
+++ b/content/mesh/tutorials/ratelimit-walkthrough.md
@@ -4,7 +4,7 @@ description: Learn how to configure rate limiting between workloads.
 draft: false
 toc: true
 weight: 140
-docs: DOCS-724
+nd-docs: DOCS-724
 type:
 - tutorial
 ---
diff --git a/content/mesh/tutorials/trafficsplit-deployments.md b/content/mesh/tutorials/trafficsplit-deployments.md
index b578c79e3..1a2a5018e 100644
--- a/content/mesh/tutorials/trafficsplit-deployments.md
+++ b/content/mesh/tutorials/trafficsplit-deployments.md
@@ -4,7 +4,7 @@ description: This topic provides a guide for using traffic splits with different
   strategies.
 weight: 110
 toc: true
-docs: DOCS-725
+nd-docs: DOCS-725
 type:
 - tutorial
 ---
diff --git a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md
index 0c0e49a45..bf7cffa0d 100644
--- a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md
+++ b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-726
+nd-docs: DOCS-726
 title: Installing the NGINX ModSecurity WAF
 toc: true
 weight: 100
diff --git a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md
index 9a688eb53..224acea09 100644
--- a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md
+++ b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-727
+nd-docs: DOCS-727
 title: Using the OWASP CRS with the NGINX ModSecurity WAF
 toc: true
 weight: 200
diff --git a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md
index 3f29fa1de..2be3c5cef 100644
--- a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md
+++ b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-728
+nd-docs: DOCS-728
 title: Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity
   WAF
 toc: true
diff --git a/content/modsec-waf/technical-specs.md b/content/modsec-waf/technical-specs.md
index 6342fde0e..47266a3d6 100644
--- a/content/modsec-waf/technical-specs.md
+++ b/content/modsec-waf/technical-specs.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-729
+nd-docs: DOCS-729
 title: Technical Specifications
 toc: true
 weight: 300
diff --git a/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md b/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md
index 694beb930..a3eae476c 100644
--- a/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md
+++ b/content/nap-dos/deployment-guide/installing-nginx-plus-with-dos-and-waf-on-amazon-web-services.md
@@ -3,7 +3,7 @@ description: Install F5 NGINX Plus, NGINX App Protect WAF + DoS on Amazon Web Se
   (AWS), to provide sophisticated Layer 7 load balancing, Modern app security solution,
   behavioral DoS detection and mitigation that works seamlessly in DevOps environments
   for your apps running on CentOS, RHEL, Debian and Ubuntu Linux OS.
-docs: DOCS-1204
+nd-docs: DOCS-1204
 title: NGINX App Protect WAF + DoS AMIs on Amazon EC2
 toc: true
 weight: 110
diff --git a/content/nap-dos/deployment-guide/learn-about-deployment.md b/content/nap-dos/deployment-guide/learn-about-deployment.md
index 430fd9e2e..8fe7c9059 100644
--- a/content/nap-dos/deployment-guide/learn-about-deployment.md
+++ b/content/nap-dos/deployment-guide/learn-about-deployment.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about F5 NGINX App Protect DoS Deployment.
-docs: DOCS-666
+nd-docs: DOCS-666
 title: NGINX App Protect DoS Deployment
 toc: true
 weight: 100
@@ -33,7 +33,7 @@ NGINX App Protect DoS supports the following operating systems:
 - [Ubuntu 22.04 (Jammy)](#debian--ubuntu-installation)
 - [Ubuntu 24.04 (Noble)](#debian--ubuntu-installation)
 - [Alpine 3.15](#alpine-315x--317x--319x-installation) - (Deprecated starting from NGINX Plus R30)
-- [Alpine 3.17](#alpine-315x--317x--319x-installation) - (Deprecated starting from NGINX Plus R34) 
+- [Alpine 3.17](#alpine-315x--317x--319x-installation) - (Deprecated starting from NGINX Plus R34)
 - [Alpine 3.19](#alpine-315x--317x--319x-installation)
 - [AmazonLinux 2023](#amazonlinux-linux-2023-installation)
 
@@ -402,7 +402,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s
     ```
 
 1. {{< include "nginx-plus/install/create-dir-for-crt-key.md" >}}
- 
+
 1. {{< include "nginx-plus/install/create-dir-for-jwt.md" >}}
 
 1. {{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}}
@@ -2621,7 +2621,7 @@ ${DIR}/appprotect-dos-arb/install_appprotect-dos-arb.sh
 ## App Protect DoS eBPF manager
 
 ### Overview
-The eBPF Manager is a powerful and efficient tool designed to simplify and secure the deployment of eBPF (Extended Berkeley Packet Filter) programs for advanced networking use cases. 
+The eBPF Manager is a powerful and efficient tool designed to simplify and secure the deployment of eBPF (Extended Berkeley Packet Filter) programs for advanced networking use cases.
 Its primary responsibilities include program installation and managing client interactions to enable real-time packet processing and mitigation solutions.
 
 ### CLI Options for Flexible Configuration
@@ -2632,4 +2632,4 @@ The eBPF Manager comes with configurable command-line flags for ease of use and
 * gRPC UDS Ownership:
   * -u, --user <user_name>: Set the user ownership for the gRPC Unix Domain Socket (UDS). Defaults to nginx.
   * -g, --group <group_name>: Set the group ownership for the gRPC Unix Domain Socket (UDS). Defaults to nginx.
-    
+
diff --git a/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md b/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md
index 2d018750a..f1cca1a75 100644
--- a/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md
+++ b/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS Directives and Policy
 toc: true
 weight: 120
-docs: DOCS-667
+nd-docs: DOCS-667
 ---
 
 ## Introduction
diff --git a/content/nap-dos/monitoring/access-log.md b/content/nap-dos/monitoring/access-log.md
index 61ef69359..296155491 100644
--- a/content/nap-dos/monitoring/access-log.md
+++ b/content/nap-dos/monitoring/access-log.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect DoS Request Log Mechanism.
-docs: DOCS-668
+nd-docs: DOCS-668
 title: NGINX App Protect DoS Access Log Request Mechanism
 toc: true
 weight: 160
diff --git a/content/nap-dos/monitoring/live-activity-monitoring.md b/content/nap-dos/monitoring/live-activity-monitoring.md
index bd9df7724..e28fb571b 100644
--- a/content/nap-dos/monitoring/live-activity-monitoring.md
+++ b/content/nap-dos/monitoring/live-activity-monitoring.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect DoS Live Activity Monitoring.
-docs: DOCS-1389
+nd-docs: DOCS-1389
 title: NGINX App Protect DoS Live Activity Monitoring
 toc: true
 weight: 140
diff --git a/content/nap-dos/monitoring/operation-log.md b/content/nap-dos/monitoring/operation-log.md
index 8439995da..2a12d5eaf 100644
--- a/content/nap-dos/monitoring/operation-log.md
+++ b/content/nap-dos/monitoring/operation-log.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect DoS Operation Log.
-docs: DOCS-669
+nd-docs: DOCS-669
 title: NGINX App Protect DoS Operation Log
 toc: true
 weight: 180
diff --git a/content/nap-dos/monitoring/security-log.md b/content/nap-dos/monitoring/security-log.md
index 6d2f3ce1a..642cde34e 100644
--- a/content/nap-dos/monitoring/security-log.md
+++ b/content/nap-dos/monitoring/security-log.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect DoS Security Log.
-docs: DOCS-670
+nd-docs: DOCS-670
 title: NGINX App Protect DoS Security Log
 toc: true
 weight: 140
diff --git a/content/nap-dos/monitoring/types-of-logs.md b/content/nap-dos/monitoring/types-of-logs.md
index ed0345d8b..0d6cc61ea 100644
--- a/content/nap-dos/monitoring/types-of-logs.md
+++ b/content/nap-dos/monitoring/types-of-logs.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect DoS Logs Overview.
-docs: DOCS-671
+nd-docs: DOCS-671
 title: NGINX App Protect DoS Logs Overview
 toc: true
 weight: 130
diff --git a/content/nap-dos/releases/about-1.0.md b/content/nap-dos/releases/about-1.0.md
index f4534665d..b3741d126 100644
--- a/content/nap-dos/releases/about-1.0.md
+++ b/content/nap-dos/releases/about-1.0.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect 1.0
 toc: true
 weight: 260
-docs: DOCS-672
+nd-docs: DOCS-672
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v1. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-1.1.0.md b/content/nap-dos/releases/about-1.1.0.md
index 8fc5bff2a..f853f5843 100644
--- a/content/nap-dos/releases/about-1.1.0.md
+++ b/content/nap-dos/releases/about-1.1.0.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS Arbitrator 1.1.0
 toc: true
 weight: 220
-docs: DOCS-673
+nd-docs: DOCS-673
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS Arbitrator v1.1.0.
diff --git a/content/nap-dos/releases/about-1.1.1.md b/content/nap-dos/releases/about-1.1.1.md
index c9f90779e..173b8e1cd 100644
--- a/content/nap-dos/releases/about-1.1.1.md
+++ b/content/nap-dos/releases/about-1.1.1.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS Arbitrator 1.1.1
 toc: true
 weight: 115
-docs: DOCS-1205
+nd-docs: DOCS-1205
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS Arbitrator v1.1.1.
diff --git a/content/nap-dos/releases/about-1.2.0.md b/content/nap-dos/releases/about-1.2.0.md
index a9ed25646..ed606e4e0 100644
--- a/content/nap-dos/releases/about-1.2.0.md
+++ b/content/nap-dos/releases/about-1.2.0.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS Arbitrator 1.2.0
 toc: true
 weight: 61
-docs: DOCS-1782
+nd-docs: DOCS-1782
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS Arbitrator v1.2.0
diff --git a/content/nap-dos/releases/about-2.0.md b/content/nap-dos/releases/about-2.0.md
index 76d9385e5..7fb5b9005 100644
--- a/content/nap-dos/releases/about-2.0.md
+++ b/content/nap-dos/releases/about-2.0.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 2.0
 toc: true
 weight: 220
-docs: DOCS-674
+nd-docs: DOCS-674
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v2.0. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-2.1.md b/content/nap-dos/releases/about-2.1.md
index 0590e9624..462ba2bbe 100644
--- a/content/nap-dos/releases/about-2.1.md
+++ b/content/nap-dos/releases/about-2.1.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 2.1
 toc: true
 weight: 200
-docs: DOCS-831
+nd-docs: DOCS-831
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v2.1. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-2.2.md b/content/nap-dos/releases/about-2.2.md
index d18e23956..147cd6f51 100644
--- a/content/nap-dos/releases/about-2.2.md
+++ b/content/nap-dos/releases/about-2.2.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 2.2
 toc: true
 weight: 180
-docs: DOCS-839
+nd-docs: DOCS-839
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v2.2. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-2.3.md b/content/nap-dos/releases/about-2.3.md
index 39e5ceb90..c98c7be28 100644
--- a/content/nap-dos/releases/about-2.3.md
+++ b/content/nap-dos/releases/about-2.3.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 2.3
 toc: true
 weight: 170
-docs: DOCS-856
+nd-docs: DOCS-856
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v2.3. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-2.4.md b/content/nap-dos/releases/about-2.4.md
index a594409bd..bf8502638 100644
--- a/content/nap-dos/releases/about-2.4.md
+++ b/content/nap-dos/releases/about-2.4.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 2.4
 toc: true
 weight: 160
-docs: DOCS-890
+nd-docs: DOCS-890
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v2.4. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-3.0.md b/content/nap-dos/releases/about-3.0.md
index c36756554..9310fa583 100644
--- a/content/nap-dos/releases/about-3.0.md
+++ b/content/nap-dos/releases/about-3.0.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 3.0
 toc: true
 weight: 150
-docs: DOCS-946
+nd-docs: DOCS-946
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v3.0. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-3.1.md b/content/nap-dos/releases/about-3.1.md
index e3e7c6842..6c2311330 100644
--- a/content/nap-dos/releases/about-3.1.md
+++ b/content/nap-dos/releases/about-3.1.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 3.1
 toc: true
 weight: 140
-docs: DOCS-995
+nd-docs: DOCS-995
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v3.1. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-4.0.md b/content/nap-dos/releases/about-4.0.md
index 0616d3350..5dab6acfd 100644
--- a/content/nap-dos/releases/about-4.0.md
+++ b/content/nap-dos/releases/about-4.0.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.0
 toc: true
 weight: 120
-docs: DOCS-1115
+nd-docs: DOCS-1115
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.0. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-4.1.md b/content/nap-dos/releases/about-4.1.md
index b14bcbd77..442e20563 100644
--- a/content/nap-dos/releases/about-4.1.md
+++ b/content/nap-dos/releases/about-4.1.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.1
 toc: true
 weight: 110
-docs: DOCS-1203
+nd-docs: DOCS-1203
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.1. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-4.2.md b/content/nap-dos/releases/about-4.2.md
index be4ee293b..03152db74 100644
--- a/content/nap-dos/releases/about-4.2.md
+++ b/content/nap-dos/releases/about-4.2.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.2
 toc: true
 weight: 100
-docs: DOCS-1254
+nd-docs: DOCS-1254
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.2. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-4.3.md b/content/nap-dos/releases/about-4.3.md
index f571b0f47..5ae85ca28 100644
--- a/content/nap-dos/releases/about-4.3.md
+++ b/content/nap-dos/releases/about-4.3.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.3
 toc: true
 weight: 90
-docs: DOCS-1361
+nd-docs: DOCS-1361
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.3. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-4.4.md b/content/nap-dos/releases/about-4.4.md
index dd41bb6a9..9bd7ac240 100644
--- a/content/nap-dos/releases/about-4.4.md
+++ b/content/nap-dos/releases/about-4.4.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect DoS 4.4
 toc: true
 weight: 80
-docs: DOCS-1785
+nd-docs: DOCS-1785
 ---
 
 Here you can find the release information for F5 NGINX App Protect DoS v4.4. NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
diff --git a/content/nap-dos/releases/about-4.5.md b/content/nap-dos/releases/about-4.5.md
index cc9b71833..969d4e6b1 100644
--- a/content/nap-dos/releases/about-4.5.md
+++ b/content/nap-dos/releases/about-4.5.md
@@ -2,10 +2,10 @@
 title: NGINX App Protect DoS 4.5
 toc: true
 weight: 70
-docs: DOCS-1784
+nd-docs: DOCS-1784
 ---
 
-Here you can find the release information for F5 NGINX App Protect DoS v4.5  
+Here you can find the release information for F5 NGINX App Protect DoS v4.5
 
 NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
 
@@ -24,8 +24,8 @@ NGINX App Protect DoS 4.5 adds support for NGINX Plus R33.
 - Support for NGINX Plus R33
 - Add support for Alpine 3.19
 - Add support for Ubuntu 24.04
-- Remove support for CentOS 7 / RHEL 7 
-- *eBPF Manager - Privileged Process for Secure Command Handling*  
+- Remove support for CentOS 7 / RHEL 7
+- *eBPF Manager - Privileged Process for Secure Command Handling*
 This feature introduces the eBPF Manager, a process that securely handles eBPF commands on behalf of other processes. By allowing certain processes to operate without elevated privileges, it enhances system security. As part of this enhancement, NGINX now runs under a non-root user account, which is required for deploying specific security solutions.
 
 ---
diff --git a/content/nap-dos/releases/about-4.6.md b/content/nap-dos/releases/about-4.6.md
index 3cf384d4f..b45af1e0d 100644
--- a/content/nap-dos/releases/about-4.6.md
+++ b/content/nap-dos/releases/about-4.6.md
@@ -2,10 +2,10 @@
 title: NGINX App Protect DoS 4.6
 toc: true
 weight: 60
-docs: DOCS-1783
+nd-docs: DOCS-1783
 ---
 
-Here you can find the release information for F5 NGINX App Protect DoS v4.6  
+Here you can find the release information for F5 NGINX App Protect DoS v4.6
 
 NGINX App Protect DoS provides behavioral protection against Denial of Service (DoS) for your web applications.
 
@@ -21,7 +21,7 @@ April 1, 2025
 
 - Support for NGINX Plus R34
 - Add support for AmazonLinux 2023
-- Remove support for Alpine 3.17 
+- Remove support for Alpine 3.17
 - Bug fixes
 
 ---
@@ -31,7 +31,7 @@ April 1, 2025
 | Distribution name        | Package file                                         |
 |--------------------------|------------------------------------------------------|
 | Alpine 3.19              | _app-protect-dos-34+4.6.1-r1.apk_                    |
-| Amazon Linux 2023         | _app-protect-dos-34+4.6.1-1.amzn2023.ngx.x86_64.rpm_ |  
+| Amazon Linux 2023         | _app-protect-dos-34+4.6.1-1.amzn2023.ngx.x86_64.rpm_ |
 | RHEL 8 and Rocky Linux 8 | _app-protect-dos-34+4.6.1-1.el8.ngx.x86_64.rpm_      |
 | RHEL 9                   | _app-protect-dos-34+4.6.1-1.el9.ngx.x86_64.rpm_      |
 | Debian 11                | _app-protect-dos_34+4.6.1-1\~bullseye_amd64.deb_     |
diff --git a/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md b/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md
index ed5b89c44..7ac06a6a7 100644
--- a/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md
+++ b/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect DoS Troubleshooting Guide.
-docs: DOCS-675
+nd-docs: DOCS-675
 title: NGINX App Protect DoS Troubleshooting Guide
 toc: true
 weight: 200
diff --git a/content/nap-waf/v4/admin-guide/install-nms.md b/content/nap-waf/v4/admin-guide/install-nms.md
index ce95fd9e0..63b341b37 100644
--- a/content/nap-waf/v4/admin-guide/install-nms.md
+++ b/content/nap-waf/v4/admin-guide/install-nms.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to get more from F5 NGINX App Protect WAF with the NGINX Management
   Suite Security Monitoring and Instance Manager modules.
-docs: DOCS-1126
+nd-docs: DOCS-1126
 title: Using NGINX App Protect WAF with NGINX Management Suite
 toc: true
 weight: 100
diff --git a/content/nap-waf/v4/admin-guide/install.md b/content/nap-waf/v4/admin-guide/install.md
index d0781d810..67cfa0518 100644
--- a/content/nap-waf/v4/admin-guide/install.md
+++ b/content/nap-waf/v4/admin-guide/install.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-646
+nd-docs: DOCS-646
 
 ---
 
@@ -17,7 +17,7 @@ This guide explains how to deploy NGINX App Protect WAF as well as upgrade App P
 ### Using NGINX App Protect with NGINX Instance Manager
 
 NGINX Instance Manager provides centralized configuration management and visibility for your NGINX App Protect WAF fleet.
-After completing the NGINX App Protect WAF installation, refer to the [NGINX Instance Manager Installation Guide](https://docs.nginx.com/nginx-instance-manager/deploy/) for the deployment instructions.  
+After completing the NGINX App Protect WAF installation, refer to the [NGINX Instance Manager Installation Guide](https://docs.nginx.com/nginx-instance-manager/deploy/) for the deployment instructions.
 
 ## Prerequisites
 
@@ -237,8 +237,8 @@ If a user other than **nginx** is to be used, note the following:
     Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
 
     {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
-    
-    
+
+
 
 ---
 
@@ -365,7 +365,7 @@ If a user other than **nginx** is to be used, note the following:
     ```shell
     /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
     ```
-    
+
     Verify the client is populating the database:
 
     ```shell
@@ -375,7 +375,7 @@ If a user other than **nginx** is to be used, note the following:
     Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
 
     {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
-      
+
 ## Debian Installation
 
 1. If you already have NGINX packages in your system, back up your configs and logs:
@@ -522,11 +522,11 @@ If a user other than **nginx** is to be used, note the following:
     ```
 
     After installing the package, run the client:
-    
+
     ```shell
     /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
     ```
-    
+
     Verify the client is populating the database:
 
     ```shell
@@ -536,7 +536,7 @@ If a user other than **nginx** is to be used, note the following:
     Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
 
     {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
-    
+
 {{< warning >}} Debian enables **AppArmor** by default, but NGINX App Protect WAF will run in unconfined mode after being installed as it is shipped with no AppArmor profile. To benefit from AppArmor access control capabilities for NGINX App Protect WAF, you will have to write your own AppArmor profile for NGINX App Protect WAF executables found in `/opt/app_protect/bin` such that it best suits your environment.
 {{< /warning >}}
 
@@ -665,11 +665,11 @@ If a user other than **nginx** is to be used, note the following:
     ```
 
     After installing the package, run the client:
-    
+
     ```shell
     /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
     ```
-    
+
     Verify the client is populating the database:
 
     ```shell
@@ -807,7 +807,7 @@ If a user other than **nginx** is to be used, note the following:
     ```
 
     After installing the package, run the client:
-    
+
     ```shell
     /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
     ```
@@ -964,7 +964,7 @@ If a user other than **nginx** is to be used, note the following:
     ```
 
     After installing the package, run the client:
-    
+
     ```shell
     /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
     ```
@@ -978,7 +978,7 @@ If a user other than **nginx** is to be used, note the following:
     Update your policy to include the new configuration, then run [apreload]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#apreload" >}})  command to make changes take effect
 
     {{< note >}} For this capability to function properly, please follow the guidelines listed in the [configuration guide]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}}){{< /note >}}
-        
+
 {{< note >}} Ubuntu 20.04 / Ubuntu 22.04 / Ubuntu 24.04 activates **AppArmor** by default, but NGINX App Protect WAF will run in unconfined mode after being installed as it is shipped with no AppArmor profile. To benefit from AppArmor access control capabilities for NGINX App Protect WAF, you will have to write your own AppArmor profile for NGINX App Protect WAF executables found in `/opt/app_protect/bin` such that it best suits your environment.
 {{< /note >}}
 
@@ -1069,13 +1069,13 @@ If a user other than **nginx** is to be used, note the following:
     /bin/su -s /bin/sh -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config 2>&1 >> /var/log/app_protect/bd-socket-plugin.log &" nginx
     /usr/sbin/nginx -g 'daemon off;'
     ```
-    
+
     If you want to use IP intelligence feature (Available from versions 4.15.0 and above), add this additional line to your `entrypoint.sh` file:
 
     ```shell
     /opt/app_protect/bin/iprepd /etc/app_protect/tools/iprepd.cfg > ipi.log 2>&1 &
     ```
-    
+
 7. Create a Docker image:
 
     - For Oracle Linux/Debian/Ubuntu/Alpine/Amazon Linux:
@@ -1706,7 +1706,7 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
     dnf install -y app-protect-compiler \
     && dnf clean all \
     && rm -rf /var/cache/dnf
-```    
+```
 
 ### Oracle Linux 8 Converter Docker Deployment Example
 
@@ -1925,7 +1925,7 @@ On a host with access to the NGINX App Protect WAF repository:
     apt-get update
     for i in $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances app-protect | grep "^\w" | sort -u); do apt-get download $i 2>>errors.txt; done
     ```
-    
+
     Only use if you want to install and use the IP intelligence feature:
 
     ```shell
@@ -2815,7 +2815,7 @@ app-protect=27+3.1088.2-1~[OS_CODENAME]
 
 ## Upgrading App Protect to the latest version
 
-### RHEL 8.1+ / RHEL 9+ / Oracle Linux 8.1+ 
+### RHEL 8.1+ / RHEL 9+ / Oracle Linux 8.1+
 
 Upgrade the NGINX App Protect WAF to the latest 4.x version:
 
diff --git a/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md b/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md
index c29b4b765..43e115650 100644
--- a/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md
+++ b/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md
@@ -3,7 +3,7 @@ title: Upgrade NGINX App Protect WAF on Managed Instances
 description: How to Upgrade F5 NGINX App Protect WAF on managed NGINX instances
 weight: 300
 toc: true
-docs: DOCS-1198
+nd-docs: DOCS-1198
 ---
 
 ## Overview
diff --git a/content/nap-waf/v4/configuration-guide/configuration.md b/content/nap-waf/v4/configuration-guide/configuration.md
index 6b3a9c2c0..a98931787 100644
--- a/content/nap-waf/v4/configuration-guide/configuration.md
+++ b/content/nap-waf/v4/configuration-guide/configuration.md
@@ -1,6 +1,6 @@
 ---
 description: F5 NGINX App Protect WAF security features.
-docs: DOCS-647
+nd-docs: DOCS-647
 title: NGINX App Protect WAF Configuration Guide
 toc: true
 weight: 200
@@ -679,7 +679,7 @@ systematic, username/password combinations to discover legitimate authentication
 To prevent brute force attacks, NGINX App Protect WAF monitors IP addresses, usernames, and the number of failed login attempts beyond a maximum threshold.
 When brute force patterns are detected, the NGINX App Protect WAF policy either trigger an alarm or block the attack if the failed
 login attempts reached a maximum threshold for a specific username or coming from a specific IP address.
-In order to create a brute force configuration for a specific URL in NGINX App Protect you must first create a User-Defined URL, then a Login Page and finally define the URL element in the Brute Force configuration section. 
+In order to create a brute force configuration for a specific URL in NGINX App Protect you must first create a User-Defined URL, then a Login Page and finally define the URL element in the Brute Force configuration section.
 
 ---
 ### The User-Defined URL example
diff --git a/content/nap-waf/v4/declarative-policy/policy.md b/content/nap-waf/v4/declarative-policy/policy.md
index b5c71b808..10d28c6f1 100644
--- a/content/nap-waf/v4/declarative-policy/policy.md
+++ b/content/nap-waf/v4/declarative-policy/policy.md
@@ -2,7 +2,7 @@
 title: NGINX App Protect WAF Declarative Policy
 toc: true
 weight: 300
-docs: DOCS-648
+nd-docs: DOCS-648
 ---
 
 {{< include "nap-waf/policy.html" >}}
diff --git a/content/nap-waf/v4/logging-overview/access-log.md b/content/nap-waf/v4/logging-overview/access-log.md
index eaff647a6..bc9125538 100644
--- a/content/nap-waf/v4/logging-overview/access-log.md
+++ b/content/nap-waf/v4/logging-overview/access-log.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect WAF Access Log Request Mechanism.
-docs: DOCS-910
+nd-docs: DOCS-910
 title: NGINX App Protect WAF Access Log
 toc: true
 weight: 550
diff --git a/content/nap-waf/v4/logging-overview/debug-logs.md b/content/nap-waf/v4/logging-overview/debug-logs.md
index 154d95b5f..ef14ba848 100644
--- a/content/nap-waf/v4/logging-overview/debug-logs.md
+++ b/content/nap-waf/v4/logging-overview/debug-logs.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the NGINX App Protect WAF Debug Log.
-docs: DOCS-913
+nd-docs: DOCS-913
 title: NGINX App Protect WAF Debug Log
 toc: true
 weight: 540
diff --git a/content/nap-waf/v4/logging-overview/logs-overview.md b/content/nap-waf/v4/logging-overview/logs-overview.md
index 9e6ebdc5c..1ad2fd13d 100644
--- a/content/nap-waf/v4/logging-overview/logs-overview.md
+++ b/content/nap-waf/v4/logging-overview/logs-overview.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect WAF Logs Overview.
-docs: DOCS-911
+nd-docs: DOCS-911
 title: NGINX App Protect WAF Logs Overview
 toc: true
 weight: 510
diff --git a/content/nap-waf/v4/logging-overview/operation-logs.md b/content/nap-waf/v4/logging-overview/operation-logs.md
index bc51c423e..e84052974 100644
--- a/content/nap-waf/v4/logging-overview/operation-logs.md
+++ b/content/nap-waf/v4/logging-overview/operation-logs.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect WAF Operation Log.
-docs: DOCS-912
+nd-docs: DOCS-912
 title: NGINX App Protect WAF Operation Log
 toc: true
 weight: 530
diff --git a/content/nap-waf/v4/logging-overview/security-log.md b/content/nap-waf/v4/logging-overview/security-log.md
index d0211d06a..870950b77 100644
--- a/content/nap-waf/v4/logging-overview/security-log.md
+++ b/content/nap-waf/v4/logging-overview/security-log.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect WAF Security Log.
-docs: DOCS-915
+nd-docs: DOCS-915
 title: NGINX App Protect WAF Security Log
 toc: true
 weight: 520
diff --git a/content/nap-waf/v4/releases/about-1.0.md b/content/nap-waf/v4/releases/about-1.0.md
index a92eb466c..0d7ad81e4 100644
--- a/content/nap-waf/v4/releases/about-1.0.md
+++ b/content/nap-waf/v4/releases/about-1.0.md
@@ -4,7 +4,7 @@ weight: 1060
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-649
+nd-docs: DOCS-649
 ---
 
 May 19, 2020
diff --git a/content/nap-waf/v4/releases/about-1.1.md b/content/nap-waf/v4/releases/about-1.1.md
index 658adcae8..4799b4da9 100644
--- a/content/nap-waf/v4/releases/about-1.1.md
+++ b/content/nap-waf/v4/releases/about-1.1.md
@@ -4,7 +4,7 @@ weight: 1040
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-650
+nd-docs: DOCS-650
 ---
 
 June 9, 2020
diff --git a/content/nap-waf/v4/releases/about-1.2.md b/content/nap-waf/v4/releases/about-1.2.md
index 8a9a348e1..483b108a3 100644
--- a/content/nap-waf/v4/releases/about-1.2.md
+++ b/content/nap-waf/v4/releases/about-1.2.md
@@ -4,7 +4,7 @@ weight: 1020
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1791
+nd-docs: DOCS-1791
 ---
 
 June 30, 2020
diff --git a/content/nap-waf/v4/releases/about-1.3.md b/content/nap-waf/v4/releases/about-1.3.md
index 949b826f0..9dc5f8788 100644
--- a/content/nap-waf/v4/releases/about-1.3.md
+++ b/content/nap-waf/v4/releases/about-1.3.md
@@ -4,7 +4,7 @@ weight: 1000
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-652
+nd-docs: DOCS-652
 ---
 
 July 21, 2020
diff --git a/content/nap-waf/v4/releases/about-2.0.md b/content/nap-waf/v4/releases/about-2.0.md
index 41d7edf01..af8deb50e 100644
--- a/content/nap-waf/v4/releases/about-2.0.md
+++ b/content/nap-waf/v4/releases/about-2.0.md
@@ -4,7 +4,7 @@ weight: 980
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-653
+nd-docs: DOCS-653
 ---
 
 September 08, 2020
diff --git a/content/nap-waf/v4/releases/about-2.1.md b/content/nap-waf/v4/releases/about-2.1.md
index 1043a365c..b06400d96 100644
--- a/content/nap-waf/v4/releases/about-2.1.md
+++ b/content/nap-waf/v4/releases/about-2.1.md
@@ -4,7 +4,7 @@ weight: 960
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-654
+nd-docs: DOCS-654
 ---
 
 October 28, 2020
diff --git a/content/nap-waf/v4/releases/about-2.2.md b/content/nap-waf/v4/releases/about-2.2.md
index b62160c1f..25664110f 100644
--- a/content/nap-waf/v4/releases/about-2.2.md
+++ b/content/nap-waf/v4/releases/about-2.2.md
@@ -4,7 +4,7 @@ weight: 940
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-655
+nd-docs: DOCS-655
 ---
 
 December 09, 2020
diff --git a/content/nap-waf/v4/releases/about-2.3.md b/content/nap-waf/v4/releases/about-2.3.md
index a3b527394..0b77716f3 100644
--- a/content/nap-waf/v4/releases/about-2.3.md
+++ b/content/nap-waf/v4/releases/about-2.3.md
@@ -4,7 +4,7 @@ weight: 920
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-656
+nd-docs: DOCS-656
 ---
 
 December 30, 2020
diff --git a/content/nap-waf/v4/releases/about-3.0.md b/content/nap-waf/v4/releases/about-3.0.md
index d8cb52787..d1a728e27 100644
--- a/content/nap-waf/v4/releases/about-3.0.md
+++ b/content/nap-waf/v4/releases/about-3.0.md
@@ -4,7 +4,7 @@ weight: 800
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-657
+nd-docs: DOCS-657
 ---
 
 January 29, 2021
diff --git a/content/nap-waf/v4/releases/about-3.1.md b/content/nap-waf/v4/releases/about-3.1.md
index 543004cba..ac627cc31 100644
--- a/content/nap-waf/v4/releases/about-3.1.md
+++ b/content/nap-waf/v4/releases/about-3.1.md
@@ -4,7 +4,7 @@ weight: 790
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-658
+nd-docs: DOCS-658
 ---
 
 March 31, 2021
diff --git a/content/nap-waf/v4/releases/about-3.10.md b/content/nap-waf/v4/releases/about-3.10.md
index 76bd2d094..b4ce69183 100644
--- a/content/nap-waf/v4/releases/about-3.10.md
+++ b/content/nap-waf/v4/releases/about-3.10.md
@@ -4,7 +4,7 @@ weight: 680
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-846
+nd-docs: DOCS-846
 ---
 
 May 25, 2022
diff --git a/content/nap-waf/v4/releases/about-3.11.md b/content/nap-waf/v4/releases/about-3.11.md
index fd7e40baf..72015ea43 100644
--- a/content/nap-waf/v4/releases/about-3.11.md
+++ b/content/nap-waf/v4/releases/about-3.11.md
@@ -4,7 +4,7 @@ weight: 660
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-891
+nd-docs: DOCS-891
 ---
 
 June 28, 2022
diff --git a/content/nap-waf/v4/releases/about-3.12.2.md b/content/nap-waf/v4/releases/about-3.12.2.md
index 579b98006..915e68336 100644
--- a/content/nap-waf/v4/releases/about-3.12.2.md
+++ b/content/nap-waf/v4/releases/about-3.12.2.md
@@ -4,7 +4,7 @@ weight: 620
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-988
+nd-docs: DOCS-988
 ---
 
 November 17, 2022
diff --git a/content/nap-waf/v4/releases/about-3.12.md b/content/nap-waf/v4/releases/about-3.12.md
index 80d60f15e..81ee0c65c 100644
--- a/content/nap-waf/v4/releases/about-3.12.md
+++ b/content/nap-waf/v4/releases/about-3.12.md
@@ -4,7 +4,7 @@ weight: 640
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-943
+nd-docs: DOCS-943
 ---
 
 September 21, 2022
diff --git a/content/nap-waf/v4/releases/about-3.2.md b/content/nap-waf/v4/releases/about-3.2.md
index 216030019..5abd54264 100644
--- a/content/nap-waf/v4/releases/about-3.2.md
+++ b/content/nap-waf/v4/releases/about-3.2.md
@@ -4,7 +4,7 @@ weight: 780
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-659
+nd-docs: DOCS-659
 ---
 
 April 28, 2021
diff --git a/content/nap-waf/v4/releases/about-3.3.md b/content/nap-waf/v4/releases/about-3.3.md
index 1321cf141..4ce5ac26b 100644
--- a/content/nap-waf/v4/releases/about-3.3.md
+++ b/content/nap-waf/v4/releases/about-3.3.md
@@ -4,7 +4,7 @@ weight: 770
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-660
+nd-docs: DOCS-660
 ---
 
 July 7, 2021
diff --git a/content/nap-waf/v4/releases/about-3.4.md b/content/nap-waf/v4/releases/about-3.4.md
index ae3880eed..1c2027f08 100644
--- a/content/nap-waf/v4/releases/about-3.4.md
+++ b/content/nap-waf/v4/releases/about-3.4.md
@@ -4,7 +4,7 @@ weight: 760
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-661
+nd-docs: DOCS-661
 ---
 
 August 10, 2021
diff --git a/content/nap-waf/v4/releases/about-3.5.md b/content/nap-waf/v4/releases/about-3.5.md
index 895f68c39..a21285446 100644
--- a/content/nap-waf/v4/releases/about-3.5.md
+++ b/content/nap-waf/v4/releases/about-3.5.md
@@ -4,7 +4,7 @@ weight: 750
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-662
+nd-docs: DOCS-662
 ---
 
 September 6, 2021
diff --git a/content/nap-waf/v4/releases/about-3.6.md b/content/nap-waf/v4/releases/about-3.6.md
index aff52b5b5..ba4d35512 100644
--- a/content/nap-waf/v4/releases/about-3.6.md
+++ b/content/nap-waf/v4/releases/about-3.6.md
@@ -4,7 +4,7 @@ weight: 740
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-663
+nd-docs: DOCS-663
 ---
 
 October 13, 2021
diff --git a/content/nap-waf/v4/releases/about-3.7.md b/content/nap-waf/v4/releases/about-3.7.md
index a9e4e2886..304d869c7 100644
--- a/content/nap-waf/v4/releases/about-3.7.md
+++ b/content/nap-waf/v4/releases/about-3.7.md
@@ -4,7 +4,7 @@ weight: 730
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-664
+nd-docs: DOCS-664
 ---
 
 December 15, 2021
diff --git a/content/nap-waf/v4/releases/about-3.8.md b/content/nap-waf/v4/releases/about-3.8.md
index 0511b6708..94acc1198 100644
--- a/content/nap-waf/v4/releases/about-3.8.md
+++ b/content/nap-waf/v4/releases/about-3.8.md
@@ -4,7 +4,7 @@ weight: 720
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-832
+nd-docs: DOCS-832
 ---
 
 January 18, 2022
diff --git a/content/nap-waf/v4/releases/about-3.9.1.md b/content/nap-waf/v4/releases/about-3.9.1.md
index e3356ba9f..7185041b9 100644
--- a/content/nap-waf/v4/releases/about-3.9.1.md
+++ b/content/nap-waf/v4/releases/about-3.9.1.md
@@ -4,7 +4,7 @@ weight: 700
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-842
+nd-docs: DOCS-842
 ---
 
 March 9, 2022
diff --git a/content/nap-waf/v4/releases/about-3.9.md b/content/nap-waf/v4/releases/about-3.9.md
index ffede02ad..73bd50c6c 100644
--- a/content/nap-waf/v4/releases/about-3.9.md
+++ b/content/nap-waf/v4/releases/about-3.9.md
@@ -4,7 +4,7 @@ weight: 710
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-838
+nd-docs: DOCS-838
 ---
 
 February 15, 2022
diff --git a/content/nap-waf/v4/releases/about-4.0.md b/content/nap-waf/v4/releases/about-4.0.md
index 61411fd29..e4c985f0d 100644
--- a/content/nap-waf/v4/releases/about-4.0.md
+++ b/content/nap-waf/v4/releases/about-4.0.md
@@ -4,7 +4,7 @@ weight: 410
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-994
+nd-docs: DOCS-994
 ---
 
 November 29, 2022
diff --git a/content/nap-waf/v4/releases/about-4.1.md b/content/nap-waf/v4/releases/about-4.1.md
index 63b806c94..e993f2425 100644
--- a/content/nap-waf/v4/releases/about-4.1.md
+++ b/content/nap-waf/v4/releases/about-4.1.md
@@ -4,7 +4,7 @@ weight: 400
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1116
+nd-docs: DOCS-1116
 ---
 
 January 31, 2023
diff --git a/content/nap-waf/v4/releases/about-4.10.md b/content/nap-waf/v4/releases/about-4.10.md
index 9762bd8f2..7bdd5c45c 100644
--- a/content/nap-waf/v4/releases/about-4.10.md
+++ b/content/nap-waf/v4/releases/about-4.10.md
@@ -4,7 +4,7 @@ weight: 130
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1787
+nd-docs: DOCS-1787
 ---
 
 May 29, 2024
@@ -23,7 +23,7 @@ In this release, NGINX App Protect WAF supports NGINX Plus R32.
 #### App Protect
 
 
-##### Alpine Linux 3.16 
+##### Alpine Linux 3.16
 
 - app-protect-32.5.48.0-r1.apk
 
@@ -47,7 +47,7 @@ In this release, NGINX App Protect WAF supports NGINX Plus R32.
 
 - app-protect-32+5.48.0-1.el8.ngx.x86_64.rpm
 
-##### RHEL 8.1+ 
+##### RHEL 8.1+
 
 - app-protect-32+5.48.0-1.el8.ngx.x86_64.rpm
 
diff --git a/content/nap-waf/v4/releases/about-4.11.md b/content/nap-waf/v4/releases/about-4.11.md
index b92e89ae1..daf3c93ad 100644
--- a/content/nap-waf/v4/releases/about-4.11.md
+++ b/content/nap-waf/v4/releases/about-4.11.md
@@ -4,7 +4,7 @@ weight: 120
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1786
+nd-docs: DOCS-1786
 ---
 
 September 25, 2024
diff --git a/content/nap-waf/v4/releases/about-4.12.md b/content/nap-waf/v4/releases/about-4.12.md
index ae55a7ee8..61e77bb4c 100644
--- a/content/nap-waf/v4/releases/about-4.12.md
+++ b/content/nap-waf/v4/releases/about-4.12.md
@@ -4,7 +4,7 @@ weight: 110
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1788
+nd-docs: DOCS-1788
 ---
 
 November 19th, 2024
diff --git a/content/nap-waf/v4/releases/about-4.13.md b/content/nap-waf/v4/releases/about-4.13.md
index ed2ca037c..e664466d3 100644
--- a/content/nap-waf/v4/releases/about-4.13.md
+++ b/content/nap-waf/v4/releases/about-4.13.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1790
+nd-docs: DOCS-1790
 ---
 
 January 30th, 2025
diff --git a/content/nap-waf/v4/releases/about-4.14.md b/content/nap-waf/v4/releases/about-4.14.md
index 6c2187fe9..ef20b99f6 100644
--- a/content/nap-waf/v4/releases/about-4.14.md
+++ b/content/nap-waf/v4/releases/about-4.14.md
@@ -4,7 +4,7 @@ weight: 90
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1792
+nd-docs: DOCS-1792
 ---
 
 April 1st, 2025
diff --git a/content/nap-waf/v4/releases/about-4.15.md b/content/nap-waf/v4/releases/about-4.15.md
index cb004174f..1dba23851 100644
--- a/content/nap-waf/v4/releases/about-4.15.md
+++ b/content/nap-waf/v4/releases/about-4.15.md
@@ -4,7 +4,7 @@ weight: 80
 toc: true
 nd-content-type: reference
 nd-product: NAP-WAF
-docs: DOCS-1789
+nd-docs: DOCS-1789
 ---
 
 June 24th, 2025
@@ -12,7 +12,7 @@ June 24th, 2025
 ## New features
 
 - Added support for [IP Intelligence]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-intelligence-configuration" >}})
-- Added support for Rocky Linux 9 
+- Added support for Rocky Linux 9
 - Added support for Override rules for [IP Address Lists]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#ip-address-lists" >}})
 
 ## Important notes
@@ -26,7 +26,7 @@ June 24th, 2025
 - 12527 - Remove CPAN - installed certs and source files
 - 11112 - Remove systemd/init.d leftovers in NAP WAF v5 pkgs
 - 12400 - Cookie attributes are not added to a TS cookie when there is more than one TS cookie
-- 12498 - Undefined behavior when using huge XFF 
+- 12498 - Undefined behavior when using huge XFF
 - 12731 - Multiple clean_resp_reset internal error messages in logs when loading NAP
 
 ## Supported packages
@@ -37,7 +37,7 @@ June 24th, 2025
 | Amazon Linux 2023        | _app-protect-34+5.442.0-1.amzn2023.ngx.x86_64.rpm_ |
 | Debian 11                | _app-protect_34+5.442.0-1\~bullseye_amd64.deb_     |
 | Debian 12                | _app-protect_34+5.442.0-1\~bookworm_amd64.deb_     |
-| Oracle Linux 8.1         | _app-protect-34+5.442.0-1.el8.ngx.x86_64.rpm_      | 
+| Oracle Linux 8.1         | _app-protect-34+5.442.0-1.el8.ngx.x86_64.rpm_      |
 | Ubuntu 22.04             | _app-protect_34+5.442.0-1\~jammy_amd64.deb_        |
 | Ubuntu 24.04             | _app-protect_34+5.442.0-1\~noble_amd64.deb_        |
 | RHEL 8 and Rocky Linux 8 | _app-protect-34+5.442.0-1.el8.ngx.x86_64.rpm_      |
diff --git a/content/nap-waf/v4/releases/about-4.2.md b/content/nap-waf/v4/releases/about-4.2.md
index ef9503d21..73d5d0f38 100644
--- a/content/nap-waf/v4/releases/about-4.2.md
+++ b/content/nap-waf/v4/releases/about-4.2.md
@@ -4,7 +4,7 @@ weight: 310
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1172
+nd-docs: DOCS-1172
 ---
 
 March 29, 2023
diff --git a/content/nap-waf/v4/releases/about-4.3.md b/content/nap-waf/v4/releases/about-4.3.md
index d5f160777..a7820e169 100644
--- a/content/nap-waf/v4/releases/about-4.3.md
+++ b/content/nap-waf/v4/releases/about-4.3.md
@@ -4,7 +4,7 @@ weight: 210
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1202
+nd-docs: DOCS-1202
 ---
 
 May 2, 2023
diff --git a/content/nap-waf/v4/releases/about-4.4.md b/content/nap-waf/v4/releases/about-4.4.md
index 47c0d4e34..98065a6d6 100644
--- a/content/nap-waf/v4/releases/about-4.4.md
+++ b/content/nap-waf/v4/releases/about-4.4.md
@@ -4,7 +4,7 @@ weight: 200
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1252
+nd-docs: DOCS-1252
 ---
 
 July 5, 2023
diff --git a/content/nap-waf/v4/releases/about-4.5.md b/content/nap-waf/v4/releases/about-4.5.md
index 4ac361f74..752812849 100644
--- a/content/nap-waf/v4/releases/about-4.5.md
+++ b/content/nap-waf/v4/releases/about-4.5.md
@@ -4,7 +4,7 @@ weight: 190
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1253
+nd-docs: DOCS-1253
 ---
 
 August 15, 2023
diff --git a/content/nap-waf/v4/releases/about-4.6.md b/content/nap-waf/v4/releases/about-4.6.md
index 100e4059f..9b71d7b58 100644
--- a/content/nap-waf/v4/releases/about-4.6.md
+++ b/content/nap-waf/v4/releases/about-4.6.md
@@ -4,7 +4,7 @@ weight: 180
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1347
+nd-docs: DOCS-1347
 ---
 
 October 17, 2023
diff --git a/content/nap-waf/v4/releases/about-4.7.md b/content/nap-waf/v4/releases/about-4.7.md
index 62181c049..447cbb919 100644
--- a/content/nap-waf/v4/releases/about-4.7.md
+++ b/content/nap-waf/v4/releases/about-4.7.md
@@ -4,7 +4,7 @@ weight: 170
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1360
+nd-docs: DOCS-1360
 ---
 
 December 19, 2023
diff --git a/content/nap-waf/v4/releases/about-4.8.1.md b/content/nap-waf/v4/releases/about-4.8.1.md
index ed85394d9..8a978fe6e 100644
--- a/content/nap-waf/v4/releases/about-4.8.1.md
+++ b/content/nap-waf/v4/releases/about-4.8.1.md
@@ -4,7 +4,7 @@ weight: 150
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1477
+nd-docs: DOCS-1477
 ---
 
 March 6, 2024
diff --git a/content/nap-waf/v4/releases/about-4.8.md b/content/nap-waf/v4/releases/about-4.8.md
index 37efe6ae7..268dcd877 100644
--- a/content/nap-waf/v4/releases/about-4.8.md
+++ b/content/nap-waf/v4/releases/about-4.8.md
@@ -4,7 +4,7 @@ weight: 160
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1391
+nd-docs: DOCS-1391
 ---
 
 February 6, 2024
diff --git a/content/nap-waf/v4/releases/about-4.9.md b/content/nap-waf/v4/releases/about-4.9.md
index 17b2af609..aeb44e88d 100644
--- a/content/nap-waf/v4/releases/about-4.9.md
+++ b/content/nap-waf/v4/releases/about-4.9.md
@@ -4,7 +4,7 @@ weight: 140
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1478
+nd-docs: DOCS-1478
 ---
 
 April 18, 2024
diff --git a/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md b/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md
index f4971a732..cd5da81be 100644
--- a/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md
+++ b/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX App Protect WAF Troubleshooting Guide.
-docs: DOCS-665
+nd-docs: DOCS-665
 title: NGINX App Protect WAF Troubleshooting Guide
 toc: true
 weight: 400
diff --git a/content/nap-waf/v5/admin-guide/compiler.md b/content/nap-waf/v5/admin-guide/compiler.md
index ea0f28500..0e1a3564c 100644
--- a/content/nap-waf/v5/admin-guide/compiler.md
+++ b/content/nap-waf/v5/admin-guide/compiler.md
@@ -4,7 +4,7 @@ weight: 500
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-1367
+nd-docs: DOCS-1367
 ---
 
 ## Overview
diff --git a/content/nap-waf/v5/admin-guide/deploy-on-docker.md b/content/nap-waf/v5/admin-guide/deploy-on-docker.md
index a2f0e3821..a135e5a5f 100644
--- a/content/nap-waf/v5/admin-guide/deploy-on-docker.md
+++ b/content/nap-waf/v5/admin-guide/deploy-on-docker.md
@@ -4,7 +4,7 @@ weight: 500
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-1365
+nd-docs: DOCS-1365
 ---
 
 ## Prerequisites
diff --git a/content/nap-waf/v5/admin-guide/deploy-with-helm.md b/content/nap-waf/v5/admin-guide/deploy-with-helm.md
index 677334d42..3d2c81e9e 100644
--- a/content/nap-waf/v5/admin-guide/deploy-with-helm.md
+++ b/content/nap-waf/v5/admin-guide/deploy-with-helm.md
@@ -4,7 +4,7 @@ weight: 300
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-1793
+nd-docs: DOCS-1793
 ---
 
 ## Overview
@@ -39,7 +39,7 @@ Next, create a `Dockerfile` using one of the examples provided below.
 
 {{<tabs name="nap5_nginx_OSS_dockerfiles">}}
 {{%tab name="Alpine Linux"%}}
- 
+
 {{< include "nap-waf/config/v5/build-nginx-image-oss/build-alpine.md" >}}
 
 {{%/tab%}}
@@ -86,7 +86,7 @@ You are ready to [Build the image](#build-image).
 
 {{<tabs name="nap5_nginx_plus_dockerfiles">}}
 {{%tab name="Alpine Linux"%}}
- 
+
 {{< include "nap-waf/config/v5/build-nginx-image-plus/build-alpine.md" >}}
 
 {{%/tab%}}
@@ -133,7 +133,7 @@ You are ready to [Build the image](#build-image).
 
 Next, push it to your private image repository, ensuring it's accessible to your Kubernetes cluster.
 
---- 
+---
 
 ## Pull the chart
 
diff --git a/content/nap-waf/v5/admin-guide/deploy-with-manifests.md b/content/nap-waf/v5/admin-guide/deploy-with-manifests.md
index ded07b037..751c778c8 100644
--- a/content/nap-waf/v5/admin-guide/deploy-with-manifests.md
+++ b/content/nap-waf/v5/admin-guide/deploy-with-manifests.md
@@ -4,7 +4,7 @@ weight: 400
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-1366
+nd-docs: DOCS-1366
 ---
 
 ## Prerequisites
@@ -457,8 +457,8 @@ spec:
 
 {{< include "/nap-waf/nap-k8s-readonly-paths.md" >}}
 
---- 
- 
+---
+
 ### Possible issues
 
 {{< include "/nap-waf/nap-k8s-readonly-issues.md" >}}
diff --git a/content/nap-waf/v5/admin-guide/install.md b/content/nap-waf/v5/admin-guide/install.md
index 7e1f05355..b6263a507 100644
--- a/content/nap-waf/v5/admin-guide/install.md
+++ b/content/nap-waf/v5/admin-guide/install.md
@@ -4,7 +4,7 @@ weight: 200
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-1363
+nd-docs: DOCS-1363
 ---
 
 ## Prerequisites
@@ -39,7 +39,7 @@ Please follow these steps before you install either NGINX Open Source or NGINX P
 {{<tabs name="common_steps_for_nginx_oss_and_plus">}}
 
 {{%tab name="Alpine Linux"%}}
- 
+
 {{< include "nap-waf/config/v5/host-based-nginx-instructions/common-steps-with-alpine" >}}
 
 {{%/tab%}}
diff --git a/content/nap-waf/v5/admin-guide/overview.md b/content/nap-waf/v5/admin-guide/overview.md
index 127e600e2..4470b987b 100644
--- a/content/nap-waf/v5/admin-guide/overview.md
+++ b/content/nap-waf/v5/admin-guide/overview.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-1362
+nd-docs: DOCS-1362
 ---
 
 ## Introduction
diff --git a/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md b/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md
index c5d688a9c..c7e1e6496 100644
--- a/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md
+++ b/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md
@@ -4,7 +4,7 @@ weight: 600
 toc: true
 type: how-to
 product: NAP-WAF
-docs: DOCS-1640
+nd-docs: DOCS-1640
 ---
 
 ## Overview
diff --git a/content/nap-waf/v5/configuration-guide/configuration.md b/content/nap-waf/v5/configuration-guide/configuration.md
index f654d70ee..df837908e 100644
--- a/content/nap-waf/v5/configuration-guide/configuration.md
+++ b/content/nap-waf/v5/configuration-guide/configuration.md
@@ -1,7 +1,7 @@
 ---
 description: This guide explains the F5 NGINX App Protect WAF security features and
   how to use them.
-docs: DOCS-1368
+nd-docs: DOCS-1368
 title: NGINX App Protect WAF Configuration Guide
 toc: true
 weight: 200
diff --git a/content/nap-waf/v5/declarative-policy/policy.md b/content/nap-waf/v5/declarative-policy/policy.md
index 7b038b1f0..5ecdbefbb 100644
--- a/content/nap-waf/v5/declarative-policy/policy.md
+++ b/content/nap-waf/v5/declarative-policy/policy.md
@@ -3,7 +3,7 @@ description: ''
 title: NGINX App Protect WAF Declarative Policy
 toc: false
 weight: 300
-docs: DOCS-1644
+nd-docs: DOCS-1644
 type:
 - reference
 ---
diff --git a/content/nap-waf/v5/logging-overview/access-log.md b/content/nap-waf/v5/logging-overview/access-log.md
index 5c7f0de2c..198a3c2ac 100644
--- a/content/nap-waf/v5/logging-overview/access-log.md
+++ b/content/nap-waf/v5/logging-overview/access-log.md
@@ -3,7 +3,7 @@ description: Learn about the F5 NGINX App Protect WAF Access Log Request Mechani
 title: NGINX App Protect WAF Access Log
 toc: true
 weight: 550
-docs: DOCS-1641
+nd-docs: DOCS-1641
 type:
 - concept
 ---
diff --git a/content/nap-waf/v5/logging-overview/logs-overview.md b/content/nap-waf/v5/logging-overview/logs-overview.md
index 4b4c7b590..6c30a6e80 100644
--- a/content/nap-waf/v5/logging-overview/logs-overview.md
+++ b/content/nap-waf/v5/logging-overview/logs-overview.md
@@ -1,6 +1,6 @@
 ---
 description: Learn the types of logs available in F5 NGINX App Protect WAF v5.
-docs: DOCS-1374
+nd-docs: DOCS-1374
 title: NGINX App Protect WAF Logs Overview
 toc: true
 weight: 1010
diff --git a/content/nap-waf/v5/logging-overview/security-log.md b/content/nap-waf/v5/logging-overview/security-log.md
index e23f281c1..2b91b63b1 100644
--- a/content/nap-waf/v5/logging-overview/security-log.md
+++ b/content/nap-waf/v5/logging-overview/security-log.md
@@ -3,7 +3,7 @@ description: Learn about the F5 NGINX App Protect WAF Security Log.
 title: NGINX App Protect WAF Security Log
 toc: true
 weight: 520
-docs: DOCS-1642
+nd-docs: DOCS-1642
 type:
 - concept
 ---
diff --git a/content/nap-waf/v5/releases/about-5.0.md b/content/nap-waf/v5/releases/about-5.0.md
index b27436767..fdbc765df 100644
--- a/content/nap-waf/v5/releases/about-5.0.md
+++ b/content/nap-waf/v5/releases/about-5.0.md
@@ -4,7 +4,7 @@ weight: 1000
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1643
+nd-docs: DOCS-1643
 ---
 
 March 19, 2024
diff --git a/content/nap-waf/v5/releases/about-5.1.md b/content/nap-waf/v5/releases/about-5.1.md
index 77e5348f5..51f0e5324 100644
--- a/content/nap-waf/v5/releases/about-5.1.md
+++ b/content/nap-waf/v5/releases/about-5.1.md
@@ -4,7 +4,7 @@ weight: 900
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1479
+nd-docs: DOCS-1479
 ---
 
 April 18, 2024
diff --git a/content/nap-waf/v5/releases/about-5.2.md b/content/nap-waf/v5/releases/about-5.2.md
index ab147a12f..670f9b4f7 100644
--- a/content/nap-waf/v5/releases/about-5.2.md
+++ b/content/nap-waf/v5/releases/about-5.2.md
@@ -4,7 +4,7 @@ weight: 890
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1796
+nd-docs: DOCS-1796
 ---
 
 May 29, 2024
diff --git a/content/nap-waf/v5/releases/about-5.3.md b/content/nap-waf/v5/releases/about-5.3.md
index f29be731d..344f49a2b 100644
--- a/content/nap-waf/v5/releases/about-5.3.md
+++ b/content/nap-waf/v5/releases/about-5.3.md
@@ -4,7 +4,7 @@ weight: 880
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1799
+nd-docs: DOCS-1799
 ---
 
 September 25, 2024
diff --git a/content/nap-waf/v5/releases/about-5.4.md b/content/nap-waf/v5/releases/about-5.4.md
index 88683bbec..eb7312f10 100644
--- a/content/nap-waf/v5/releases/about-5.4.md
+++ b/content/nap-waf/v5/releases/about-5.4.md
@@ -4,7 +4,7 @@ weight: 870
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1798
+nd-docs: DOCS-1798
 ---
 
 November 19th, 2024
diff --git a/content/nap-waf/v5/releases/about-5.5.md b/content/nap-waf/v5/releases/about-5.5.md
index 78e1bfca0..2a3bf94a7 100644
--- a/content/nap-waf/v5/releases/about-5.5.md
+++ b/content/nap-waf/v5/releases/about-5.5.md
@@ -4,7 +4,7 @@ weight: 860
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1795
+nd-docs: DOCS-1795
 ---
 
 January 30th, 2025
diff --git a/content/nap-waf/v5/releases/about-5.6.md b/content/nap-waf/v5/releases/about-5.6.md
index 79b290d5d..8c952dbaf 100644
--- a/content/nap-waf/v5/releases/about-5.6.md
+++ b/content/nap-waf/v5/releases/about-5.6.md
@@ -4,7 +4,7 @@ weight: 850
 toc: true
 type: reference
 product: NAP-WAF
-docs: DOCS-1797
+nd-docs: DOCS-1797
 ---
 
 April 1st, 2025
diff --git a/content/nap-waf/v5/releases/about-5.7.md b/content/nap-waf/v5/releases/about-5.7.md
index 48b48f248..050cce97e 100644
--- a/content/nap-waf/v5/releases/about-5.7.md
+++ b/content/nap-waf/v5/releases/about-5.7.md
@@ -4,7 +4,7 @@ weight: 840
 toc: true
 nd-content-type: reference
 nd-product: NAP-WAF
-docs: DOCS-1794
+nd-docs: DOCS-1794
 ---
 
 June 24th, 2025
@@ -12,9 +12,9 @@ June 24th, 2025
 ## New features
 
 - Added support for [IP Intelligence]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#ip-intelligence-configuration" >}})
-- Added support for Rocky Linux 9 
+- Added support for Rocky Linux 9
 - Added support for Override rules for [IP Address Lists]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#ip-address-lists" >}})
-  
+
 ## Important notes
 
 - Ubuntu 20.04 is no longer supported
@@ -26,7 +26,7 @@ June 24th, 2025
 - 12527 - Remove CPAN - installed certs and source files
 - 11112 - Remove systemd/init.d leftovers in NAP WAF v5 pkgs
 - 12400 - Cookie attributes are not added to a TS cookie when there is more than one TS cookie
-- 12498 - Undefined behavior when using huge XFF 
+- 12498 - Undefined behavior when using huge XFF
 - 12731 - Multiple clean_resp_reset internal error messages in logs when loading NAP
 
 ## Supported packages
diff --git a/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md b/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md
index bbf4be2fb..8de5fd315 100644
--- a/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md
+++ b/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md
@@ -3,7 +3,7 @@ description: Learn about the F5 NGINX App Protect WAF Troubleshooting Guide.
 title: NGINX App Protect WAF Troubleshooting Guide
 toc: true
 weight: 400
-docs: DOCS-1645
+nd-docs: DOCS-1645
 type:
 - concept
 ---
diff --git a/content/nginx-one/about.md b/content/nginx-one/about.md
index 72e06d6bb..1811cba97 100644
--- a/content/nginx-one/about.md
+++ b/content/nginx-one/about.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1392
+nd-docs: DOCS-1392
 title: Manage your NGINX fleet
 toc: true
 weight: 10
diff --git a/content/nginx-one/api/api-reference-guide.md b/content/nginx-one/api/api-reference-guide.md
index 43adf2b6a..d3034aa1e 100644
--- a/content/nginx-one/api/api-reference-guide.md
+++ b/content/nginx-one/api/api-reference-guide.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1398
+nd-docs: DOCS-1398
 doctypes:
   - reference
 type: redoc
diff --git a/content/nginx-one/api/authentication.md b/content/nginx-one/api/authentication.md
index 101c0d81d..7518c3677 100644
--- a/content/nginx-one/api/authentication.md
+++ b/content/nginx-one/api/authentication.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1397
+nd-docs: DOCS-1397
 title: Authentication
 toc: true
 weight: 10
diff --git a/content/nginx-one/changelog.md b/content/nginx-one/changelog.md
index ab541049a..33da1c9d9 100644
--- a/content/nginx-one/changelog.md
+++ b/content/nginx-one/changelog.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1394
+nd-docs: DOCS-1394
 title: Changelog
 toc: true
 weight: 99999
diff --git a/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md b/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
index 8545e0419..15eb1985b 100644
--- a/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
+++ b/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: null
+nd-docs: null
 title: Connect NGINX Plus container images
 toc: true
 weight: 400
diff --git a/content/nginx-one/connect-instances/create-manage-data-plane-keys.md b/content/nginx-one/connect-instances/create-manage-data-plane-keys.md
index 224b3ff51..243edd970 100644
--- a/content/nginx-one/connect-instances/create-manage-data-plane-keys.md
+++ b/content/nginx-one/connect-instances/create-manage-data-plane-keys.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1395
+nd-docs: DOCS-1395
 title: Prepare - Create and manage data plane keys
 toc: true
 weight: 100
diff --git a/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md b/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md
index 6c97ffccc..11ea0c245 100644
--- a/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md
+++ b/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: null
+nd-docs: null
 title: Minimize connections - Set up NGINX as a proxy
 toc: true
 weight: 300
diff --git a/content/nginx-one/getting-started.md b/content/nginx-one/getting-started.md
index 6a761fa2f..72e9756b5 100644
--- a/content/nginx-one/getting-started.md
+++ b/content/nginx-one/getting-started.md
@@ -4,7 +4,7 @@ toc: true
 weight: 100
 type: how-to
 product: NGINX One
-docs: DOCS-1393
+nd-docs: DOCS-1393
 ---
 
 This guide provides step-by-step instructions on how to activate and start using F5 NGINX One Console. NGINX One is a management console for monitoring and managing NGINX data plane instances.
@@ -149,7 +149,7 @@ The NGINX One Console dashboard relies on APIs for NGINX Plus and NGINX Open Sou
 
 {{< include "/use-cases/monitoring/enable-nginx-oss-stub-status.md" >}}
 
---- 
+---
 
 ## View instance metrics with the NGINX One dashboard
 
diff --git a/content/nginx-one/glossary.md b/content/nginx-one/glossary.md
index 04951c14c..4c07b2185 100644
--- a/content/nginx-one/glossary.md
+++ b/content/nginx-one/glossary.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1396
+nd-docs: DOCS-1396
 title: Glossary
 toc: true
 weight: 800
diff --git a/content/nginx-one/nginx-configs/add-file.md b/content/nginx-one/nginx-configs/add-file.md
index 574ba30e4..4a25f64ee 100644
--- a/content/nginx-one/nginx-configs/add-file.md
+++ b/content/nginx-one/nginx-configs/add-file.md
@@ -1,5 +1,5 @@
 ---
-docs: null
+nd-docs: null
 title: Add a file to an instance
 toc: true
 weight: 300
diff --git a/content/nginx-one/nginx-configs/certificates/manage-certificates.md b/content/nginx-one/nginx-configs/certificates/manage-certificates.md
index b80d52c3c..5fff39b2f 100644
--- a/content/nginx-one/nginx-configs/certificates/manage-certificates.md
+++ b/content/nginx-one/nginx-configs/certificates/manage-certificates.md
@@ -1,5 +1,5 @@
 ---
-docs: null
+nd-docs: null
 title: Manage certificates
 toc: true
 weight: 100
diff --git a/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md b/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md
index 9e7979e34..aec1d3b1c 100644
--- a/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md
+++ b/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: null
+nd-docs: null
 title: Clean up unavailable NGINX instances
 toc: true
 weight: 1000
diff --git a/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md b/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md
index 147b83950..1b1f279b8 100644
--- a/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md
+++ b/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md
@@ -1,5 +1,5 @@
 ---
-docs: null
+nd-docs: null
 title: Add a file to a Config Sync Group
 toc: true
 weight: 400
diff --git a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
index d5811fe1a..418612d7d 100644
--- a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
+++ b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
@@ -1,5 +1,5 @@
 ---
-docs: null
+nd-docs: null
 title: Manage Config Sync Groups
 toc: true
 weight: 300
diff --git a/content/nginx-one/rbac/overview.md b/content/nginx-one/rbac/overview.md
index 2bcdfc17b..7282834e4 100644
--- a/content/nginx-one/rbac/overview.md
+++ b/content/nginx-one/rbac/overview.md
@@ -4,7 +4,7 @@ weight: 400
 toc: true
 type: reference
 product: NGINX One
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 {{< include "security/rbac-intro.md" >}}
diff --git a/content/nginx-one/rbac/rbac-api.md b/content/nginx-one/rbac/rbac-api.md
index 11e90cfc3..4cf387018 100644
--- a/content/nginx-one/rbac/rbac-api.md
+++ b/content/nginx-one/rbac/rbac-api.md
@@ -4,13 +4,13 @@ weight: 500
 toc: true
 type: reference
 product: NGINX One
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 Beyond the [Default roles]({{< ref "/nginx-one/rbac/roles.md" >}}) for NGINX One Console access, you can create [custom roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles#custom-roles) with more precisely defined access permissions.
 You can assign custom roles to users or service accounts.
 
-You can associate these roles with specific [namespaces](https://docs.cloud.f5.com/docs-v2/multi-cloud-app-connect/how-to/app-security/service-policy), to help facilitate the principle of least privilege across your tenant. 
+You can associate these roles with specific [namespaces](https://docs.cloud.f5.com/docs-v2/multi-cloud-app-connect/how-to/app-security/service-policy), to help facilitate the principle of least privilege across your tenant.
 For this use-case, we include a list of API groups that you can use to specify permissions for custom roles with more granular access controls to NGINX One Console APIs.
 
 ## F5 API groups for NGINX One
diff --git a/content/nginx-one/rbac/roles.md b/content/nginx-one/rbac/roles.md
index e2d33a15b..521bd70c5 100644
--- a/content/nginx-one/rbac/roles.md
+++ b/content/nginx-one/rbac/roles.md
@@ -4,7 +4,7 @@ weight: 500
 toc: true
 type: reference
 product: NGINX One
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 ## Default roles
@@ -13,7 +13,7 @@ We provide three default **[roles](https://docs.cloud.f5.com/docs-v2/administrat
 
 ### Admin
 
-The Admin role, identified as `f5xc-nginx-one-standard-admin`, provides full read and write access to all endpoints and features within the NGINX One Console. 
+The Admin role, identified as `f5xc-nginx-one-standard-admin`, provides full read and write access to all endpoints and features within the NGINX One Console.
 It also supports Role-based access control for related XC services.<!--, as described in [Role-based Access Control Concepts](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/rbac).-->
 
 ### User
diff --git a/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md b/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md
index a4b4c123e..4b41b5b71 100644
--- a/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md
+++ b/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md
@@ -1,7 +1,7 @@
 ---
 description: Understand the basic elements in an NGINX or F5 NGINX Plus configuration
   file, including directives and contexts.
-docs: DOCS-378
+nd-docs: DOCS-378
 title: Create NGINX Plus and NGINX Configuration Files
 toc: true
 weight: 200
@@ -9,7 +9,7 @@ type:
 - how-to
 ---
 
-NGINX and NGINX Plus are similar to other services in using a text‑based configuration file with a precise format. By default the file is named **nginx.conf** and for NGINX Plus is placed in the `**/etc/nginx**` directory. 
+NGINX and NGINX Plus are similar to other services in using a text‑based configuration file with a precise format. By default the file is named **nginx.conf** and for NGINX Plus is placed in the `**/etc/nginx**` directory.
 
 For NGINX Open Source, the location depends on the package system used to install NGINX and the operating system. It is typically one of `**/usr/local/nginx/conf**`, `**/etc/nginx**`, or `**/usr/local/etc/nginx**`.
 
diff --git a/content/nginx/admin-guide/basic-functionality/runtime-control.md b/content/nginx/admin-guide/basic-functionality/runtime-control.md
index 65414ce62..f69773bf4 100644
--- a/content/nginx/admin-guide/basic-functionality/runtime-control.md
+++ b/content/nginx/admin-guide/basic-functionality/runtime-control.md
@@ -1,7 +1,7 @@
 ---
 description: Understand the NGINX processes that handle traffic, and how to control
   them at runtime.
-docs: DOCS-379
+nd-docs: DOCS-379
 title: Control NGINX Processes at Runtime
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/content-cache/content-caching.md b/content/nginx/admin-guide/content-cache/content-caching.md
index 07f00b3dd..7ebd880a9 100644
--- a/content/nginx/admin-guide/content-cache/content-caching.md
+++ b/content/nginx/admin-guide/content-cache/content-caching.md
@@ -1,7 +1,7 @@
 ---
 description: Cache both static and dynamic content from your proxied web and application
   servers, to speed delivery to clients and reduce the load on the servers.
-docs: DOCS-380
+nd-docs: DOCS-380
 title: NGINX Content Caching
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/brotli.md b/content/nginx/admin-guide/dynamic-modules/brotli.md
index 66935fac6..b0ebfd3f4 100644
--- a/content/nginx/admin-guide/dynamic-modules/brotli.md
+++ b/content/nginx/admin-guide/dynamic-modules/brotli.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to use the Brotli module with F5 NGINX Plus
-docs: DOCS-381
+nd-docs: DOCS-381
 title: Brotli
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/cookie-flag.md b/content/nginx/admin-guide/dynamic-modules/cookie-flag.md
index f83eb6c10..3a10f8f8c 100644
--- a/content/nginx/admin-guide/dynamic-modules/cookie-flag.md
+++ b/content/nginx/admin-guide/dynamic-modules/cookie-flag.md
@@ -2,7 +2,7 @@
 description: Set `HttpOnly`, `SameSite`, and `secure` flags on cookies in `Set-Cookie`
   upstream response headers with the **Cookie-Flag** dynamic module, community-authored
   and supported by NGINX, Inc.
-docs: DOCS-382
+nd-docs: DOCS-382
 title: Cookie-Flag
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md b/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md
index 2edfeb89d..4307452fb 100644
--- a/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md
+++ b/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md
@@ -1,7 +1,7 @@
 ---
 description: Load modules dynamically into F5 NGINX Plus at runtime to add specialized
   functionality, including features authored by third parties.
-docs: DOCS-383
+nd-docs: DOCS-383
 title: Dynamic Modules
 toc: true
 weight: 10
@@ -46,7 +46,7 @@ For module‑specific installation and usage instructions, select the correspond
 | [XSLT](https://nginx.org/en/docs/http/ngx_http_xslt_module.html) | Applies XSLT transformations to XML responses. | [`nginx-plus-module-xslt`]({{< ref "nginx/admin-guide/dynamic-modules/xslt.md" >}}) |
 {{< /bootstrap-table >}}
 
-### Community Dynamic Modules 
+### Community Dynamic Modules
 Besides the modules provided in the official repository, a wide range of third-party modules is available through community-driven projects such as [Awesome NGINX GitHub project](https://github.com/agile6v/awesome-nginx#third-party-modules). Many of these modules can be [compiled as dynamic modules](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/#install_modules_oss) and used with your NGINX Plus or NGINX Open Source deployments.
 
 ### NGINX Certified Partner Dynamic Modules
@@ -110,7 +110,7 @@ nginx-plus-module-njs/stable
 
 nginx-plus-module-opentracing/stable
   NGINX Plus 3rd-party OpenTracing dynamic module
-  
+
 nginx-plus-module-otel/stable
   NGINX Plus OpenTelemetry dynamic module
 
diff --git a/content/nginx/admin-guide/dynamic-modules/encrypted-session.md b/content/nginx/admin-guide/dynamic-modules/encrypted-session.md
index 47dece320..fe9d482d8 100644
--- a/content/nginx/admin-guide/dynamic-modules/encrypted-session.md
+++ b/content/nginx/admin-guide/dynamic-modules/encrypted-session.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-384
+nd-docs: DOCS-384
 title: Encrypted-Session
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/fips.md b/content/nginx/admin-guide/dynamic-modules/fips.md
index 831173191..41678e25f 100644
--- a/content/nginx/admin-guide/dynamic-modules/fips.md
+++ b/content/nginx/admin-guide/dynamic-modules/fips.md
@@ -1,7 +1,7 @@
 ---
 description: Verify compliance with [FIPS 140-2](https://csrc.nist.gov/publications/detail/fips/140/2/final)
   security requirements for cryptographic modules.
-docs: DOCS-385
+nd-docs: DOCS-385
 title: FIPS Status Check
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/geoip.md b/content/nginx/admin-guide/dynamic-modules/geoip.md
index 783b157aa..8aa3f53cc 100644
--- a/content/nginx/admin-guide/dynamic-modules/geoip.md
+++ b/content/nginx/admin-guide/dynamic-modules/geoip.md
@@ -1,7 +1,7 @@
 ---
 description: Capture information from the client IP address in variables, using the
   MaxMind GeoIP databases, with the GeoIP dynamic module supported by NGINX, Inc.
-docs: DOCS-386
+nd-docs: DOCS-386
 title: GeoIP
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/geoip2.md b/content/nginx/admin-guide/dynamic-modules/geoip2.md
index aa06f7274..de02e575d 100644
--- a/content/nginx/admin-guide/dynamic-modules/geoip2.md
+++ b/content/nginx/admin-guide/dynamic-modules/geoip2.md
@@ -2,7 +2,7 @@
 description: Capture information from the client IP address in variables, using the
   [MaxMind GeoIP2](https://www.maxmind.com/en/geoip2-databases) databases, with the
   GeoIP2 dynamic module supported by NGINX, Inc.
-docs: DOCS-387
+nd-docs: DOCS-387
 title: GeoIP2
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/headers-more.md b/content/nginx/admin-guide/dynamic-modules/headers-more.md
index 49df24db4..e9e55f980 100644
--- a/content/nginx/admin-guide/dynamic-modules/headers-more.md
+++ b/content/nginx/admin-guide/dynamic-modules/headers-more.md
@@ -1,7 +1,7 @@
 ---
 description: Set and clear input and output headers to extend the NGINX core [Headers](https://nginx.org/en/docs/http/ngx_http_headers_module.html)
   module, with the Headers-More dynamic module supported by NGINX, Inc.
-docs: DOCS-388
+nd-docs: DOCS-388
 title: Headers-More
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md b/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md
index 1707b63d1..c0f2f44a8 100644
--- a/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md
+++ b/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md
@@ -1,7 +1,7 @@
 ---
 description: Replace text in response bodies, using regular expressions and fixed
   strings, with the HTTP Substitutions Filter dynamic module supported by NGINX, Inc.
-docs: DOCS-389
+nd-docs: DOCS-389
 title: HTTP Substitutions Filter
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/image-filter.md b/content/nginx/admin-guide/dynamic-modules/image-filter.md
index 3d4a97f93..65e6b76df 100644
--- a/content/nginx/admin-guide/dynamic-modules/image-filter.md
+++ b/content/nginx/admin-guide/dynamic-modules/image-filter.md
@@ -1,7 +1,7 @@
 ---
 description: Crop, resize, rotate, and perform other transformations on GIF, JPEG,
   and PNG images, with the Image-Filter dynamic module supported by NGINX, Inc.
-docs: DOCS-390
+nd-docs: DOCS-390
 title: Image-Filter
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/lua.md b/content/nginx/admin-guide/dynamic-modules/lua.md
index 87db66b69..4b9073791 100644
--- a/content/nginx/admin-guide/dynamic-modules/lua.md
+++ b/content/nginx/admin-guide/dynamic-modules/lua.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-391
+nd-docs: DOCS-391
 title: Lua
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/ndk.md b/content/nginx/admin-guide/dynamic-modules/ndk.md
index 8f051f955..bde538b43 100644
--- a/content/nginx/admin-guide/dynamic-modules/ndk.md
+++ b/content/nginx/admin-guide/dynamic-modules/ndk.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-392
+nd-docs: DOCS-392
 title: NGINX Developer Kit
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/nginscript.md b/content/nginx/admin-guide/dynamic-modules/nginscript.md
index 36c526018..f5867c194 100644
--- a/content/nginx/admin-guide/dynamic-modules/nginscript.md
+++ b/content/nginx/admin-guide/dynamic-modules/nginscript.md
@@ -2,7 +2,7 @@
 description: Integrate [JavaScript-like](https://nginx.org/en/docs/njs/) code into
   the NGINX event-processing model for HTTP or TDP/UDP, with the NGINX njs module,
   supported by NGINX, Inc.
-docs: DOCS-393
+nd-docs: DOCS-393
 title: njs Scripting Language
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/nginx-waf.md b/content/nginx/admin-guide/dynamic-modules/nginx-waf.md
index b47873cd2..88bb4bcea 100644
--- a/content/nginx/admin-guide/dynamic-modules/nginx-waf.md
+++ b/content/nginx/admin-guide/dynamic-modules/nginx-waf.md
@@ -1,7 +1,7 @@
 ---
 description: Protect against Layer 7 attacks such as SQLi, XSS, CSRF, LFI, and RFI,
   with the F5 NGINX ModSecurity WAF dynamic module, supported by NGINX.
-docs: DOCS-394
+nd-docs: DOCS-394
 title: NGINX ModSecurity WAF
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/opentelemetry.md b/content/nginx/admin-guide/dynamic-modules/opentelemetry.md
index 0e3d6c3f5..23fec756a 100644
--- a/content/nginx/admin-guide/dynamic-modules/opentelemetry.md
+++ b/content/nginx/admin-guide/dynamic-modules/opentelemetry.md
@@ -1,7 +1,7 @@
 ---
 description: Analyze your software performance by instrumenting, generating, collecting,
   and exporting telemetry data.
-docs: DOCS-1207
+nd-docs: DOCS-1207
 title: OpenTelemetry
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/opentracing.md b/content/nginx/admin-guide/dynamic-modules/opentracing.md
index 81c64329d..f6b64b6db 100644
--- a/content/nginx/admin-guide/dynamic-modules/opentracing.md
+++ b/content/nginx/admin-guide/dynamic-modules/opentracing.md
@@ -4,7 +4,7 @@ description: Instrument NGINX with OpenTracing-compliant requests for a range of
   module provides the framework for recording traces; you will also need to install
   a service-specific tracing module.  This module (“tracer”) pushes traces to the
   collector and analyser provided by that service.
-docs: DOCS-395
+nd-docs: DOCS-395
 title: OpenTracing
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md b/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md
index bf1cc841f..469556ef4 100644
--- a/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md
+++ b/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md
@@ -2,7 +2,7 @@
 description: Deploy and administer applications written in Node.js, Python, and Ruby
   with the Passenger Open Source dynamic module from Phusion, supported by NGINX,
   Inc.
-docs: DOCS-396
+nd-docs: DOCS-396
 title: Phusion Passenger Open Source
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/perl.md b/content/nginx/admin-guide/dynamic-modules/perl.md
index bc932dfc8..7ff1b43a6 100644
--- a/content/nginx/admin-guide/dynamic-modules/perl.md
+++ b/content/nginx/admin-guide/dynamic-modules/perl.md
@@ -2,7 +2,7 @@
 description: Implement location and variable handlers in Perl and insert Perl calls
   into Server Side Includes (SSI), with the Perl dynamic module, supported by NGINX,
   Inc.
-docs: DOCS-397
+nd-docs: DOCS-397
 title: Perl
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md b/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md
index 297c115f0..ffdc9e209 100644
--- a/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md
+++ b/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md
@@ -1,6 +1,6 @@
 ---
 description: Expose Prometheus metrics endpoint directly from F5 NGINX Plus.
-docs: DOCS-398
+nd-docs: DOCS-398
 title: Prometheus-njs
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/rtmp.md b/content/nginx/admin-guide/dynamic-modules/rtmp.md
index 800753af3..4a6b7a6e8 100644
--- a/content/nginx/admin-guide/dynamic-modules/rtmp.md
+++ b/content/nginx/admin-guide/dynamic-modules/rtmp.md
@@ -1,7 +1,7 @@
 ---
 description: Stream video in multiple formats, including  Real-Time Messaging Protocol
   (RTMP), HLS, and DASH, with the RTMP dynamic module, supported by NGINX, Inc.
-docs: DOCS-399
+nd-docs: DOCS-399
 title: RTMP
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/set-misc.md b/content/nginx/admin-guide/dynamic-modules/set-misc.md
index 3ee03391e..c31c8e23a 100644
--- a/content/nginx/admin-guide/dynamic-modules/set-misc.md
+++ b/content/nginx/admin-guide/dynamic-modules/set-misc.md
@@ -2,7 +2,7 @@
 description: Implement numerous additional `set_*` directives to extend the NGINX
   core [Rewrite](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html) module,
   with the Set-Misc dynamic module supported by NGINX, Inc.
-docs: DOCS-400
+nd-docs: DOCS-400
 title: Set-Misc
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/spnego.md b/content/nginx/admin-guide/dynamic-modules/spnego.md
index 134113063..517ee123c 100644
--- a/content/nginx/admin-guide/dynamic-modules/spnego.md
+++ b/content/nginx/admin-guide/dynamic-modules/spnego.md
@@ -1,7 +1,7 @@
 ---
 description: This module adds [SPNEGO](https://tools.ietf.org/html/rfc4178) support
   to F5 NGINX Plus. Currently, only Kerberos authentication via GSSAPI is supported.
-docs: DOCS-401
+nd-docs: DOCS-401
 title: SPNEGO
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/dynamic-modules/uninstall.md b/content/nginx/admin-guide/dynamic-modules/uninstall.md
index ee504ae99..1bd838201 100644
--- a/content/nginx/admin-guide/dynamic-modules/uninstall.md
+++ b/content/nginx/admin-guide/dynamic-modules/uninstall.md
@@ -1,13 +1,13 @@
 ---
 description: This section describes how to uninstall an F5 NGINX Plus dynamic module.
-docs: DOCS-402
+nd-docs: DOCS-402
 title: Uninstalling a dynamic module
 toc: true
 weight: 100
 type:
 - how-to
 ---
-You may need to uninstall a dynamic module in NGINX Plus in several scenarios: 
+You may need to uninstall a dynamic module in NGINX Plus in several scenarios:
 
 - The module is being replaced with a newer or alternative version. For example, the [OpenTracing]({{< ref "opentracing.md" >}}) module has been replaced by the [OpenTelemetry]({{< ref "opentelemetry.md" >}}) module. The [Cookie-Flag]({{< ref "cookie-flag.md" >}}) dynamic module has been superseded by natively supported [`proxy_cookie_flags`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_flags) directive.
 
diff --git a/content/nginx/admin-guide/dynamic-modules/xslt.md b/content/nginx/admin-guide/dynamic-modules/xslt.md
index 0a2117ea4..9a1c2674e 100644
--- a/content/nginx/admin-guide/dynamic-modules/xslt.md
+++ b/content/nginx/admin-guide/dynamic-modules/xslt.md
@@ -1,7 +1,7 @@
 ---
 description: Modify XML code in response bodies using one or more XSLT stylesheets,
   with the XSLT dynamic module, supported by NGINX, Inc.
-docs: DOCS-403
+nd-docs: DOCS-403
 title: XSLT
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/high-availability/configuration-sharing.md b/content/nginx/admin-guide/high-availability/configuration-sharing.md
index 1f89b6967..a6a9e73ed 100644
--- a/content/nginx/admin-guide/high-availability/configuration-sharing.md
+++ b/content/nginx/admin-guide/high-availability/configuration-sharing.md
@@ -1,7 +1,7 @@
 ---
 description: Sychronize configuration across a cluster of F5 NGINX Plus instances.
   Though designed for high-availability deployments, the solution works for any cluster.
-docs: DOCS-404
+nd-docs: DOCS-404
 title: Synchronizing NGINX Configuration in a Cluster
 toc: true
 weight: 300
diff --git a/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md b/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md
index 52465ece9..9b88cafeb 100644
--- a/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md
+++ b/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md
@@ -1,7 +1,7 @@
 ---
 description: Enable high availability of F5 NGINX Plus instances in on-premises deployments,
   with active-active pairs and multiple passive instances.
-docs: DOCS-405
+nd-docs: DOCS-405
 title: Configuring Active-Active High Availability and Additional Passive Nodes with
   keepalived
 toc: true
diff --git a/content/nginx/admin-guide/high-availability/ha-keepalived.md b/content/nginx/admin-guide/high-availability/ha-keepalived.md
index 23aae7e4b..df12a2379 100644
--- a/content/nginx/admin-guide/high-availability/ha-keepalived.md
+++ b/content/nginx/admin-guide/high-availability/ha-keepalived.md
@@ -1,7 +1,7 @@
 ---
 description: Enable high availability of F5 NGINX Plus instances in on-premises deployments,
   configuring an active-passive pair in a solution based on keepalived and VRRP.
-docs: DOCS-406
+nd-docs: DOCS-406
 title: High Availability Support for NGINX Plus in On-Premises Deployments
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/high-availability/zone_sync.md b/content/nginx/admin-guide/high-availability/zone_sync.md
index 5baeb4224..c7e0191b5 100644
--- a/content/nginx/admin-guide/high-availability/zone_sync.md
+++ b/content/nginx/admin-guide/high-availability/zone_sync.md
@@ -2,7 +2,7 @@
 description: This article describes how to use F5 NGINX Plus to synchronize shared
   memory zones across NGINX cluster nodes including sticky learn session persistence,
   requests limiting, and key-value store data.
-docs: DOCS-407
+nd-docs: DOCS-407
 title: Runtime State Sharing in a Cluster
 toc: true
 weight: 400
diff --git a/content/nginx/admin-guide/high-availability/zone_sync_details.md b/content/nginx/admin-guide/high-availability/zone_sync_details.md
index 8b46c0568..dfd91b2f0 100644
--- a/content/nginx/admin-guide/high-availability/zone_sync_details.md
+++ b/content/nginx/admin-guide/high-availability/zone_sync_details.md
@@ -1,7 +1,7 @@
 ---
 description: Design and limitations of the zone synchronization feature that allows
   synchronizing data in an nginx cluster.
-docs: DOCS-408
+nd-docs: DOCS-408
 title: How NGINX Plus Performs Zone Synchronization
 toc: true
 weight: 500
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
index 2c9f4ce58..31c02eebe 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
@@ -1,6 +1,6 @@
 ---
 description: Deploy NGINX and F5 NGINX Plus as the Docker container.
-docs: DOCS-409
+nd-docs: DOCS-409
 title: Deploying NGINX and NGINX Plus with Docker
 toc: true
 weight: 600
@@ -28,7 +28,7 @@ type:
 
 Since NGINX Plus NGINX Plus [Release 31]({{< ref "nginx/releases.md#r31" >}}) you can get an NGINX Plus image from the official NGINX Plus Docker registry and upload it to your private registry.
 
-The NGINX Plus Docker registry is available at `https://private-registry.nginx.com/v2/`. 
+The NGINX Plus Docker registry is available at `https://private-registry.nginx.com/v2/`.
 
 The registry contains the following image types:
 
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-open-source.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-open-source.md
index 0394b8053..a56510b8f 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-open-source.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-open-source.md
@@ -1,7 +1,7 @@
 ---
 description: Install NGINX Open Source either as a prebuilt package or from source,
   following step-by-step instructions for all supported Linux distributions.
-docs: DOCS-410
+nd-docs: DOCS-410
 title: Installing NGINX Open Source
 toc: true
 weight: 200
@@ -106,7 +106,7 @@ The installation steps include updating the package repository and installing th
   amazon-linux-extras list | grep nginx # get package name, e.g. nginx1
   sudo amazon-linux-extras install nginx1
   ```
-  
+
 Check the version installed:
 
 ```shell
@@ -437,7 +437,7 @@ Before installing, check if your operating system and architecture are supported
        | sudo tee /etc/apt/preferences.d/99nginx
     ```
 
-6. Install the `nginx` package: 
+6. Install the `nginx` package:
 
    ```shell
    sudo apt update && \
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md
index 66a814d97..497ab477d 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md
@@ -1,7 +1,7 @@
 ---
 description: Install F5 NGINX Plus on Amazon Web Services (AWS), to provide sophisticated
   Layer 7 load balancing for your apps running on Amazon Linux, RHEL, and Ubuntu.
-docs: DOCS-411
+nd-docs: DOCS-411
 title: Installing NGINX Plus AMIs on Amazon EC2
 toc: true
 weight: 300
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md
index 02e88fbd8..0be740d50 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md
@@ -1,7 +1,7 @@
 ---
 description: Install F5 NGINX Plus on the Google Cloud Platform, to provide sophisticated
   Layer 7 load balancing for your apps running on Google Compute Engine.
-docs: DOCS-412
+nd-docs: DOCS-412
 title: Install NGINX Plus on the Google Cloud Platform
 toc: true
 weight: 400
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md
index bae0f2be2..15be48b73 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md
@@ -1,7 +1,7 @@
 ---
 description: Install F5 NGINX Plus as a virtual machine image on Microsoft Azure,
   to provide sophisticated Layer 7 load balancing for your apps.
-docs: DOCS-413
+nd-docs: DOCS-413
 title: Installing NGINX Plus on Microsoft Azure
 toc: true
 weight: 500
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md
index aed4c97fe..bf36ca1fb 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md
@@ -1,7 +1,7 @@
 ---
 description: Install and upgrade F5 NGINX Plus with step-by-step instructions for
   the base package and dynamic modules on all supported Linux distributions.
-docs: DOCS-414
+nd-docs: DOCS-414
 title: Installing NGINX Plus
 toc: true
 weight: 100
@@ -452,7 +452,7 @@ NGINX-certified community dynamic modules are popular third‑party modules test
 | [SPNEGO for Kerberos](https://github.com/stnoonan/spnego-http-auth-nginx-module) | Adds support for [GSS‑API based](https://www.rfc-editor.org/rfc/rfc2743) SPNEGO/Kerberos authentication. | [`nginx-plus-module-auth-spnego`]({{< ref "nginx/admin-guide/dynamic-modules/spnego.md" >}}) |
 {{< /bootstrap-table >}}
 
-### Install from official repository 
+### Install from official repository
 [NGINX‑authored](#nginx-authored-dynamic-modules) and [NGINX‑certified community](#nginx-certified-community-dynamic-modules) dynamic modules can be installed as packaged binaries directly from the official `nginx-plus` repository.
 
 To install a binary package, run the command in a terminal that corresponds to your operating system, replacing `<MODULE-NAME>` with the actual binary package name, for example, `nginx-plus-module-njs`.
@@ -679,7 +679,7 @@ For a community dynamic module to work with NGINX Plus, it must be compiled alo
    cp objs/ngx_http_hello_world_module.so ./ngx_http_hello_world_module_1.27.4.so
    ```
 
-1. Transfer the resulting `.so` file from your build environment to the production environment. 
+1. Transfer the resulting `.so` file from your build environment to the production environment.
 
 1. In your production environment, copy the resulting `.so` file to the dynamic modules directory. The path to the directory depends on your operating system:
 
diff --git a/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md b/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md
index 742d40381..7e68e92b3 100644
--- a/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md
+++ b/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md
@@ -1,7 +1,7 @@
 ---
 description: Dynamically reconfigure the servers in an F5 NGINX Plus upstream group
   using the NGINX Plus API, without reloading configuration or restarting processes.
-docs: DOCS-415
+nd-docs: DOCS-415
 title: Dynamic Configuration of Upstreams with the NGINX Plus API
 toc: true
 weight: 700
diff --git a/content/nginx/admin-guide/load-balancer/grpc-health-check.md b/content/nginx/admin-guide/load-balancer/grpc-health-check.md
index cc63388bc..c345e84b6 100644
--- a/content/nginx/admin-guide/load-balancer/grpc-health-check.md
+++ b/content/nginx/admin-guide/load-balancer/grpc-health-check.md
@@ -1,7 +1,7 @@
 ---
 description: Monitor the health of gRPC servers in an upstream group by sending periodic
   health checks.
-docs: DOCS-416
+nd-docs: DOCS-416
 title: gRPC Health Checks
 toc: true
 weight: 600
diff --git a/content/nginx/admin-guide/load-balancer/http-health-check.md b/content/nginx/admin-guide/load-balancer/http-health-check.md
index 49dbb1b4d..468fd2989 100644
--- a/content/nginx/admin-guide/load-balancer/http-health-check.md
+++ b/content/nginx/admin-guide/load-balancer/http-health-check.md
@@ -1,7 +1,7 @@
 ---
 description: Monitor the health of HTTP servers in an upstream group by sending periodic
   health checks, including customizable active health checks in F5 NGINX Plus.
-docs: DOCS-417
+nd-docs: DOCS-417
 title: HTTP Health Checks
 toc: true
 weight: 300
diff --git a/content/nginx/admin-guide/load-balancer/http-load-balancer.md b/content/nginx/admin-guide/load-balancer/http-load-balancer.md
index b76578a60..4bdfa62f3 100644
--- a/content/nginx/admin-guide/load-balancer/http-load-balancer.md
+++ b/content/nginx/admin-guide/load-balancer/http-load-balancer.md
@@ -1,7 +1,7 @@
 ---
 description: Load balance HTTP traffic across web or application server groups, with
   several algorithms and advanced features like slow-start and session persistence.
-docs: DOCS-418
+nd-docs: DOCS-418
 title: HTTP Load Balancing
 toc: true
 weight: 100
@@ -217,7 +217,7 @@ NGINX Plus supports three session persistence methods. The methods are set with
 
     In the example above, the `srv_id` parameter sets the name of the cookie. The optional `expires` parameter sets the time for the browser to keep the cookie (here, `1` hour). The optional `domain` parameter defines the domain for which the cookie is set, and the optional `path` parameter defines the path for which the cookie is set.
 
-- [Sticky route](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_route) – Use the [`route`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#route) parameter to the `server` directive to assign a route identifier to each server. NGINX Plus assigns one of the route identifiers to the client when it receives the client's first request. Subsequent requests then compare these route identifiers, which are either stored in a cookie or passed in the request URI. 
+- [Sticky route](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_route) – Use the [`route`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#route) parameter to the `server` directive to assign a route identifier to each server. NGINX Plus assigns one of the route identifiers to the client when it receives the client's first request. Subsequent requests then compare these route identifiers, which are either stored in a cookie or passed in the request URI.
 
     ```nginx
     upstream backend {
@@ -227,7 +227,7 @@ NGINX Plus supports three session persistence methods. The methods are set with
     }
     ```
     In the example above, the session cookie is checked first for the route identifier. If there is none, then the URI is checked second.
-  
+
 - [Sticky learn](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky_learn) – NGINX Plus first finds session identifiers by inspecting requests and responses. Then NGINX Plus “learns” which upstream server corresponds to which session identifier. Generally, these identifiers are passed in a HTTP cookie. If a request contains a session identifier already “learned”, NGINX Plus forwards the request to the corresponding server:
 
     ```nginx
@@ -279,7 +279,7 @@ The [`max_conns`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#m
 
 The [`queue`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#queue) directive allows excess connections to be held in a queue. It requires a maxmum number for the queue and a timeout.
 
-If the `max_conns` limit has been reached, the request is placed in a queue for further processing. If the queue limit has been reached, if no queue directive is specified, or if a client reaches the `timeout` time in queue, the client will receive an error. 
+If the `max_conns` limit has been reached, the request is placed in a queue for further processing. If the queue limit has been reached, if no queue directive is specified, or if a client reaches the `timeout` time in queue, the client will receive an error.
 
 ```nginx
 upstream backend {
diff --git a/content/nginx/admin-guide/load-balancer/tcp-health-check.md b/content/nginx/admin-guide/load-balancer/tcp-health-check.md
index 585cdf7da..65dff60c3 100644
--- a/content/nginx/admin-guide/load-balancer/tcp-health-check.md
+++ b/content/nginx/admin-guide/load-balancer/tcp-health-check.md
@@ -1,7 +1,7 @@
 ---
 description: Monitor the health of TCP servers in an upstream group by sending periodic
   health checks, including customizable active health checks in F5 NGINX Plus.
-docs: DOCS-419
+nd-docs: DOCS-419
 title: TCP Health Checks
 toc: true
 weight: 400
diff --git a/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md b/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md
index bf40c20be..a6ef398f0 100644
--- a/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md
+++ b/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md
@@ -1,7 +1,7 @@
 ---
 description: This chapter describes how to use F5 NGINX Plus and NGINX Open Source
   to proxy and load balance TCP and UDP traffic.
-docs: DOCS-420
+nd-docs: DOCS-420
 title: TCP and UDP Load Balancing
 toc: true
 weight: 200
diff --git a/content/nginx/admin-guide/load-balancer/udp-health-check.md b/content/nginx/admin-guide/load-balancer/udp-health-check.md
index 7885d032a..3be757218 100644
--- a/content/nginx/admin-guide/load-balancer/udp-health-check.md
+++ b/content/nginx/admin-guide/load-balancer/udp-health-check.md
@@ -1,7 +1,7 @@
 ---
 description: This chapter describes how to configure different types of health checks
   for UDP servers in a load‑balanced upstream server group.
-docs: DOCS-421
+nd-docs: DOCS-421
 title: UDP Health Checks
 toc: true
 weight: 500
@@ -240,7 +240,7 @@ This is the raw DNS query of `healthcheck.example.com`, represented as one line
 where:
 
 {{<bootstrap-table "table table-striped table-bordered">}}
-| HEX              | Description            | 
+| HEX              | Description            |
 |------------------|------------------------|
 | \x00\x01         | Transaction ID: 0x0001 |
 | \x01\x00         | Flags: Standard query, recursion desired |
diff --git a/content/nginx/admin-guide/load-balancer/using-proxy-protocol.md b/content/nginx/admin-guide/load-balancer/using-proxy-protocol.md
index 3ed8000be..4e42c2ce6 100644
--- a/content/nginx/admin-guide/load-balancer/using-proxy-protocol.md
+++ b/content/nginx/admin-guide/load-balancer/using-proxy-protocol.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-422
+nd-docs: DOCS-422
 title: Accepting the PROXY Protocol
 toc: true
 weight: 800
diff --git a/content/nginx/admin-guide/mail-proxy/mail-proxy.md b/content/nginx/admin-guide/mail-proxy/mail-proxy.md
index a2f29c46d..8d081c6f1 100644
--- a/content/nginx/admin-guide/mail-proxy/mail-proxy.md
+++ b/content/nginx/admin-guide/mail-proxy/mail-proxy.md
@@ -1,7 +1,7 @@
 ---
 description: Simplify your email service and improve its performance with NGINX or
   F5 NGINX Plus as a proxy for the IMAP, POP3, and SMTP protocols
-docs: DOCS-423
+nd-docs: DOCS-423
 title: Configure NGINX as a Mail Proxy Server
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/monitoring/debugging.md b/content/nginx/admin-guide/monitoring/debugging.md
index 91125e718..2aaf0f352 100644
--- a/content/nginx/admin-guide/monitoring/debugging.md
+++ b/content/nginx/admin-guide/monitoring/debugging.md
@@ -1,7 +1,7 @@
 ---
 description: Troubleshoot problems and track down bugs in an NGINX or F5 NGINX Plus
   deployment, with the debugging binary, debug logging, and core dumps.
-docs: DOCS-424
+nd-docs: DOCS-424
 title: Debugging NGINX
 toc: true
 weight: 300
diff --git a/content/nginx/admin-guide/monitoring/diagnostic-package.md b/content/nginx/admin-guide/monitoring/diagnostic-package.md
index 1960889db..a58e77b3c 100644
--- a/content/nginx/admin-guide/monitoring/diagnostic-package.md
+++ b/content/nginx/admin-guide/monitoring/diagnostic-package.md
@@ -1,7 +1,7 @@
 ---
 description: This page describes how to trigger the automatic collection of data required
   to troubleshoot issues in a NGINX or F5 NGINX Plus deployment.
-docs: DOCS-1357
+nd-docs: DOCS-1357
 title: NGINX Diagnostic Package
 toc: true
 weight: 400
diff --git a/content/nginx/admin-guide/monitoring/live-activity-monitoring.md b/content/nginx/admin-guide/monitoring/live-activity-monitoring.md
index cd6e9e4f5..55474230f 100644
--- a/content/nginx/admin-guide/monitoring/live-activity-monitoring.md
+++ b/content/nginx/admin-guide/monitoring/live-activity-monitoring.md
@@ -2,7 +2,7 @@
 description: Track the performance of F5 NGINX Plus and your apps in real time, on
   the built-in live activity monitoring dashboard or by feeding the JSON to other
   tools.
-docs: DOCS-425
+nd-docs: DOCS-425
 title: Live Activity Monitoring
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/monitoring/logging.md b/content/nginx/admin-guide/monitoring/logging.md
index 2f075d9e7..6f1c8a048 100644
--- a/content/nginx/admin-guide/monitoring/logging.md
+++ b/content/nginx/admin-guide/monitoring/logging.md
@@ -1,7 +1,7 @@
 ---
 description: Capture detailed information about errors and request processing in log
   files, either locally or via syslog.
-docs: DOCS-426
+nd-docs: DOCS-426
 title: Configuring Logging
 toc: true
 weight: 200
@@ -14,7 +14,7 @@ This article describes how to log errors and requests in NGINX Open Source and
 <span id="error_log"></span>
 ## Set Up the Error Log
 
-NGINX writes an error log that records encountered issues of different severity levels. The [error_log](https://nginx.org/en/docs/ngx_core_module.html#error_log) directive sets up the log location and severity level. The log location can be a particular file, `stderr`, or `syslog`. By default, the error log is located at **logs/error.log**, but the absolute path depends on the operating system and installation. The error severity level follows the `syslog` classification system. The log includes messages from all severity levels above the specified level. 
+NGINX writes an error log that records encountered issues of different severity levels. The [error_log](https://nginx.org/en/docs/ngx_core_module.html#error_log) directive sets up the log location and severity level. The log location can be a particular file, `stderr`, or `syslog`. By default, the error log is located at **logs/error.log**, but the absolute path depends on the operating system and installation. The error severity level follows the `syslog` classification system. The log includes messages from all severity levels above the specified level.
 
 
 The configuration below changes the minimal severity level of error messages to log from `error` to `warn`:
@@ -81,7 +81,7 @@ When reading the resulting time values, keep the following in mind:
 - When a request is unable to reach an upstream server or a full header cannot be received, the variable contains `0` (zero)
 - In case of internal error while connecting to an upstream or when a reply is taken from the cache, the variable contains `-` (hyphen)
 
-The log can be optimized by enabling the `buffer` and the `cache`. With the [buffer](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log) parameter enabled, messages will be stored in the buffer first. When the buffer is full (or in some other [cases](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log)), the messages will be written to the log. 
+The log can be optimized by enabling the `buffer` and the `cache`. With the [buffer](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log) parameter enabled, messages will be stored in the buffer first. When the buffer is full (or in some other [cases](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log)), the messages will be written to the log.
 To enable caching of log file descriptors, use the [open_log_file_cache](https://nginx.org/en/docs/http/ngx_http_log_module.html#open_log_file_cache) directive.
 
 Similar to the `error_log` directive, the [access_log](https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log) directive defined on a particular configuration level overrides the settings from the previous levels. When processing of a request is completed, the message is written to the log that is configured on the current level, or inherited from the previous levels. If one level has multiple access log definitions, the message is written to all of them.
diff --git a/content/nginx/admin-guide/monitoring/new-relic-plugin.md b/content/nginx/admin-guide/monitoring/new-relic-plugin.md
index e22e19f44..5f4106696 100644
--- a/content/nginx/admin-guide/monitoring/new-relic-plugin.md
+++ b/content/nginx/admin-guide/monitoring/new-relic-plugin.md
@@ -1,7 +1,7 @@
 ---
 description: Find what's new in version 2 of the NGINX and F5 NGINX Plus plug‑in for
   New Relic – more convenience, more metrics, richer visualization.
-docs: DOCS-427
+nd-docs: DOCS-427
 title: Monitoring NGINX and NGINX Plus with the New Relic Plug-In
 toc: true
 weight: 500
diff --git a/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md b/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md
index 7474c6281..b55e58db1 100644
--- a/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md
+++ b/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md
@@ -1,7 +1,7 @@
 ---
 description: Control access using HTTP Basic authentication, and optionally in combination
   with IP address-based access control.
-docs: DOCS-428
+nd-docs: DOCS-428
 title: Restricting Access with HTTP Basic Authentication
 toc: true
 weight: 300
diff --git a/content/nginx/admin-guide/security-controls/configuring-jwt-authentication.md b/content/nginx/admin-guide/security-controls/configuring-jwt-authentication.md
index bde080030..f13bad756 100644
--- a/content/nginx/admin-guide/security-controls/configuring-jwt-authentication.md
+++ b/content/nginx/admin-guide/security-controls/configuring-jwt-authentication.md
@@ -1,7 +1,7 @@
 ---
 description: This article explains how to control authentication of your web resources
   using JWT authentication.
-docs: DOCS-429
+nd-docs: DOCS-429
 title: Setting up JWT Authentication
 toc: true
 weight: 500
diff --git a/content/nginx/admin-guide/security-controls/configuring-oidc.md b/content/nginx/admin-guide/security-controls/configuring-oidc.md
index 1d35bbbdc..b9281f3e7 100644
--- a/content/nginx/admin-guide/security-controls/configuring-oidc.md
+++ b/content/nginx/admin-guide/security-controls/configuring-oidc.md
@@ -6,10 +6,10 @@ title: Single Sign-On with OpenID Connect and Identity Providers
 toc: true
 weight: 550
 product: NGINX-PLUS
-docs: DOCS-1690
+nd-docs: DOCS-1690
 ---
 
-This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus using: 
+This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus using:
 - OpenID Connect as the authentication mechanism.
 - An external Identity Provider (IdP) such as AD FS, Auth0, Cognito, Entra ID, Keycloak, OneLogin, Okta, Ping Identity and others.
 - NGINX Plus as an OIDC client application that verifies user identity (Relying Party).
@@ -35,7 +35,7 @@ For the target client application, OIDC authentication can be enabled with great
 
 6. NGINX Plus validates the `id_token` and retrieves profile data for the user using the `UserInfo` endpoint. The retrieved profile data is validated and the content of the `id_token` and the profile data is used for providing access control to the client application.
 
-7. Upon successful validation, the resource access request is sent to the client application along with the access token. 
+7. Upon successful validation, the resource access request is sent to the client application along with the access token.
 
 8. The client application validates the access token and based on the token validation, the resource access request is allowed or denied.
 
@@ -66,7 +66,7 @@ For the target client application, OIDC authentication can be enabled with great
 
 - An identity provider (IdP) set up on your network or in the cloud. You need admin access to the IdP.
 
-- An [NGINX Plus subscription](https://www.f5.com/products/nginx/nginx-plus) and NGINX Plus [Release 34]({{< ref "nginx/releases.md#r34" >}}) or later.  
+- An [NGINX Plus subscription](https://www.f5.com/products/nginx/nginx-plus) and NGINX Plus [Release 34]({{< ref "nginx/releases.md#r34" >}}) or later.
   To install NGINX Plus, follow the steps in [Installing NGINX Plus](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/).
 
 - A domain name that points to your NGINX Plus instance (for example, `demo.example.com`).
@@ -83,7 +83,7 @@ The setup steps are similar for most identity providers, but some details may di
    - Give the app a name.
    - Add the users or groups who need access.
 
-3. Find the **Client ID** and **Client Secret** for your app.  
+3. Find the **Client ID** and **Client Secret** for your app.
    You'll need these later when you [set up NGINX Plus as the relying party](#setup-oidc-provider2).
 
 4. Find the **issuer** value.
diff --git a/content/nginx/admin-guide/security-controls/configuring-subrequest-authentication.md b/content/nginx/admin-guide/security-controls/configuring-subrequest-authentication.md
index c023fee65..2ca4cb6e7 100644
--- a/content/nginx/admin-guide/security-controls/configuring-subrequest-authentication.md
+++ b/content/nginx/admin-guide/security-controls/configuring-subrequest-authentication.md
@@ -1,7 +1,7 @@
 ---
 description: Authenticate clients during request processing by making a subrequest
   to an external authentication service, such as LDAP or OAuth.
-docs: DOCS-430
+nd-docs: DOCS-430
 title: Authentication Based on Subrequest Result
 toc: true
 weight: 400
diff --git a/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md b/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md
index 5432bbb9e..7b8846695 100644
--- a/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md
+++ b/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md
@@ -1,7 +1,7 @@
 ---
 description: Control access or forward traffic to different upstream servers based
   on the client's geographical location, using the GeoIP2 dynamic module.
-docs: DOCS-431
+nd-docs: DOCS-431
 title: Restricting Access by Geographical Location
 toc: true
 weight: 800
diff --git a/content/nginx/admin-guide/security-controls/controlling-access-proxied-http.md b/content/nginx/admin-guide/security-controls/controlling-access-proxied-http.md
index a135c60cf..14ce72737 100644
--- a/content/nginx/admin-guide/security-controls/controlling-access-proxied-http.md
+++ b/content/nginx/admin-guide/security-controls/controlling-access-proxied-http.md
@@ -1,7 +1,7 @@
 ---
 description: Protect your upstream web and application servers by limiting connections,
   rate of requests, or bandwidth, based on client IP address or other variables.
-docs: DOCS-432
+nd-docs: DOCS-432
 title: Limiting Access to Proxied HTTP Resources
 toc: true
 weight: 600
diff --git a/content/nginx/admin-guide/security-controls/controlling-access-proxied-tcp.md b/content/nginx/admin-guide/security-controls/controlling-access-proxied-tcp.md
index bb1f2a268..714d3266d 100644
--- a/content/nginx/admin-guide/security-controls/controlling-access-proxied-tcp.md
+++ b/content/nginx/admin-guide/security-controls/controlling-access-proxied-tcp.md
@@ -1,7 +1,7 @@
 ---
 description: Protect your upstream TCP application servers by limiting connections
   or bandwidth, based on client IP address or other variables.
-docs: DOCS-433
+nd-docs: DOCS-433
 title: Restricting Access to Proxied TCP Resources
 toc: true
 weight: 700
diff --git a/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md b/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md
index d7e68d231..26c9d0475 100644
--- a/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md
+++ b/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md
@@ -1,7 +1,7 @@
 ---
 description: Control access to your site or apps from specific client IP addresses,
   using dynamic denylists built with the F5 NGINX Plus key-value store and API.
-docs: DOCS-434
+nd-docs: DOCS-434
 title: Dynamic Denylisting of IP Addresses
 toc: true
 weight: 1100
diff --git a/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md b/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md
index 978bab7c5..1ac632735 100644
--- a/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md
+++ b/content/nginx/admin-guide/security-controls/securing-http-traffic-upstream.md
@@ -1,7 +1,7 @@
 ---
 description: Secure HTTP traffic between NGINX or F5 NGINX Plus and upstream servers,
   using SSL/TLS encryption.
-docs: DOCS-435
+nd-docs: DOCS-435
 title: Securing HTTP Traffic to Upstream Servers
 toc: true
 weight: 900
@@ -185,5 +185,5 @@ When a secure connection is passed from NGINX to the upstream server for the fir
 The next time NGINX passes a connection to the upstream server, session parameters will be reused because of the [proxy_ssl_session_reuse](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_session_reuse) directive, and the secured connection is established faster.
 
 The trusted CA certificates in the file named by the [proxy_ssl_trusted_certificate](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate) directive are used to verify the certificate on the upstream.
-The [proxy_ssl_verify_depth](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify_depth) directive specifies that two certificates in the certificates chain are checked. 
+The [proxy_ssl_verify_depth](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify_depth) directive specifies that two certificates in the certificates chain are checked.
 The [proxy_ssl_verify](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify) directive verifies the validity of certificates.
diff --git a/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md b/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md
index d40ccac1b..4ac9038ee 100644
--- a/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md
+++ b/content/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream.md
@@ -1,7 +1,7 @@
 ---
 description: Secure TCP traffic between NGINX or F5 F5 NGINX Plus and upstream servers,
   using SSL/TLS encryption.
-docs: DOCS-436
+nd-docs: DOCS-436
 title: Securing TCP Traffic to Upstream Servers
 toc: true
 weight: 1000
@@ -19,7 +19,7 @@ This article explains how to secure TCP traffic between NGINX and an upstream TC
 
 ## Obtaining SSL Server Certificates
 
-First, obtain SSL server certificates and a private key. Obtain an SSL server certificate from a trusted certificate authority (CA). Alternatively, generate one using an SSL library such as [OpenSSL](http://www.openssl.org/). Place the server certificates and private key on each of the upstream servers. 
+First, obtain SSL server certificates and a private key. Obtain an SSL server certificate from a trusted certificate authority (CA). Alternatively, generate one using an SSL library such as [OpenSSL](http://www.openssl.org/). Place the server certificates and private key on each of the upstream servers.
 
 Self-signed server certificates encrypt the connection between NGINX and the upstream server. However, these connections are vulnerable to a man-in-the-middle attack. (If an imposter impersonates the upstream server, NGINX will not know it is talking to a fake server.) To lessen the risk, obtain server certificates signed by a trusted CA. (You can create your own internal CA using OpenSSL.) Afterward, configure NGINX to only trust certificates signed by that CA. This makes it much more difficult for an attacker to impersonate an upstream server.
 
diff --git a/content/nginx/admin-guide/security-controls/terminating-ssl-http.md b/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
index 455e36ea6..89a89db93 100644
--- a/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
+++ b/content/nginx/admin-guide/security-controls/terminating-ssl-http.md
@@ -1,7 +1,7 @@
 ---
 description: Terminate HTTPS traffic from clients, relieving your upstream web and
   application servers of the computational load of SSL/TLS encryption.
-docs: DOCS-437
+nd-docs: DOCS-437
 title: NGINX SSL Termination
 toc: true
 weight: 100
diff --git a/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md b/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md
index af416b053..a1f0cbf57 100644
--- a/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md
+++ b/content/nginx/admin-guide/security-controls/terminating-ssl-tcp.md
@@ -1,7 +1,7 @@
 ---
 description: Terminate SSL/TLS-encrypted traffic from clients, relieving your upstream
   TCP servers of the computational load.
-docs: DOCS-438
+nd-docs: DOCS-438
 title: SSL Termination for TCP Upstream Servers
 toc: true
 weight: 200
diff --git a/content/nginx/admin-guide/web-server/app-gateway-uwsgi-django.md b/content/nginx/admin-guide/web-server/app-gateway-uwsgi-django.md
index d65bd8a5d..dc46f512e 100644
--- a/content/nginx/admin-guide/web-server/app-gateway-uwsgi-django.md
+++ b/content/nginx/admin-guide/web-server/app-gateway-uwsgi-django.md
@@ -1,6 +1,6 @@
 ---
 description: Configure NGINX and F5 NGINX Plus as an application gateway for uWSGI and Django
-docs: DOCS-439
+nd-docs: DOCS-439
 title: Using NGINX and NGINX Plus as an Application Gateway with uWSGI and Django
 toc: true
 weight: 500
diff --git a/content/nginx/admin-guide/web-server/compression.md b/content/nginx/admin-guide/web-server/compression.md
index 3f2c685bd..52bdf677f 100644
--- a/content/nginx/admin-guide/web-server/compression.md
+++ b/content/nginx/admin-guide/web-server/compression.md
@@ -1,7 +1,7 @@
 ---
 description: Compress server responses, or decompress them for clients that don't
   support compression, to improve delivery speed and reduce overhead on the server.
-docs: DOCS-440
+nd-docs: DOCS-440
 title: Compression and Decompression
 toc: true
 weight: 400
diff --git a/content/nginx/admin-guide/web-server/reverse-proxy.md b/content/nginx/admin-guide/web-server/reverse-proxy.md
index b00d5531e..144f9e82c 100644
--- a/content/nginx/admin-guide/web-server/reverse-proxy.md
+++ b/content/nginx/admin-guide/web-server/reverse-proxy.md
@@ -1,7 +1,7 @@
 ---
 description: Configure NGINX as a reverse proxy for HTTP and other protocols, with
   support for modifying request headers and fine-tuned buffering of responses.
-docs: DOCS-441
+nd-docs: DOCS-441
 title: NGINX Reverse Proxy
 toc: true
 weight: 300
@@ -21,7 +21,7 @@ When NGINX proxies a request, it:
 
 1. Sends the request to a specified proxy server
 1. Fetches the response
-1. Sends the response back to the client. 
+1. Sends the response back to the client.
 
 It is possible to proxy requests to an HTTP server (another NGINX server or any other server) or a non-HTTP server (which can run an application developed with a specific framework, such as PHP or Python) using a specified protocol. Supported protocols include [FastCGI](https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html), [uwsgi](https://nginx.org/en/docs/http/ngx_http_uwsgi_module.html), [SCGI](https://nginx.org/en/docs/http/ngx_http_scgi_module.html), and [memcached](https://nginx.org/en/docs/http/ngx_http_memcached_module.html).
 
@@ -41,7 +41,7 @@ location ~ \.php {
 }
 ```
 
-Note that in the first example above, the address of the proxied server is followed by a URI, `/link/`. If the URI is specified along with the address, it replaces the part of the request URI that matches the location parameter. 
+Note that in the first example above, the address of the proxied server is followed by a URI, `/link/`. If the URI is specified along with the address, it replaces the part of the request URI that matches the location parameter.
 
 For example, the request with the `/some/path/page.html` URI will be proxied to `http://www.example.com/link/page.html`. However, if the address is specified without a URI, or it is not possible to determine the part of URI to be replaced, the full request URI is passed (possibly, modified).
 
diff --git a/content/nginx/admin-guide/web-server/serving-static-content.md b/content/nginx/admin-guide/web-server/serving-static-content.md
index 3bf089c49..b2ad7eb5f 100644
--- a/content/nginx/admin-guide/web-server/serving-static-content.md
+++ b/content/nginx/admin-guide/web-server/serving-static-content.md
@@ -1,7 +1,7 @@
 ---
 description: Configure NGINX and F5 NGINX Plus to serve static content, with type-specific
   root directories, checks for file existence, and performance optimizations.
-docs: DOCS-442
+nd-docs: DOCS-442
 title: Serve Static Content
 toc: true
 weight: 200
diff --git a/content/nginx/admin-guide/web-server/web-server.md b/content/nginx/admin-guide/web-server/web-server.md
index 772f17302..c92863549 100644
--- a/content/nginx/admin-guide/web-server/web-server.md
+++ b/content/nginx/admin-guide/web-server/web-server.md
@@ -1,7 +1,7 @@
 ---
 description: Configure NGINX and F5 NGINX Plus as a web server, with support for virtual
   server multi-tenancy, URI and response rewriting, variables, and error handling.
-docs: DOCS-443
+nd-docs: DOCS-443
 title: Configuring NGINX and NGINX Plus as a Web Server
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md b/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md
index 0b1b05f2b..d20aa3c6a 100644
--- a/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md
+++ b/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md
@@ -6,7 +6,7 @@ description: Create Amazon Elastic Compute Cloud (EC2) instances for running NGI
 toc: true
 type: how-to
 product: NGINX+
-docs: DOCS-444
+nd-docs: DOCS-444
 ---
 
 This guide explains how to create instances in the Amazon Elastic Compute Cloud (EC2) that can run NGINX Open Source and F5 NGINX Plus.
diff --git a/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md b/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md
index 8df51d9ae..87ff7efcb 100644
--- a/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md
+++ b/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md
@@ -1,7 +1,7 @@
 ---
 description: Create a highly available active-passive deployment of F5 NGINX Plus
   on AWS with a solution combining keepalived and the AWS Elastic IP address feature.
-docs: DOCS-445
+nd-docs: DOCS-445
 title: Active-Passive HA for NGINX Plus on AWS Using Elastic IP Addresses
 toc: true
 weight: 200
diff --git a/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md b/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md
index c37434906..9929a6858 100644
--- a/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md
+++ b/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md
@@ -1,7 +1,7 @@
 ---
 description: Create a highly available active-active deployment of F5 NGINX Plus on
   AWS in combination with AWS Network Load Balancer (NLB).
-docs: DOCS-446
+nd-docs: DOCS-446
 title: Active-Active HA for NGINX Plus on AWS Using AWS Network Load Balancer
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/amazon-web-services/ingress-controller-elastic-kubernetes-services.md b/content/nginx/deployment-guides/amazon-web-services/ingress-controller-elastic-kubernetes-services.md
index 09f4df0a0..8f710bad2 100644
--- a/content/nginx/deployment-guides/amazon-web-services/ingress-controller-elastic-kubernetes-services.md
+++ b/content/nginx/deployment-guides/amazon-web-services/ingress-controller-elastic-kubernetes-services.md
@@ -1,7 +1,7 @@
 ---
 description: Use NGINX or F5 NGINX Plus as the Ingress Controller for Amazon Elastic
   Kubernetes Services.
-docs: DOCS-447
+nd-docs: DOCS-447
 title: Using NGINX or NGINX Plus as the Ingress Controller for Amazon Elastic Kubernetes
   Services
 toc: true
@@ -19,7 +19,7 @@ This guide explains how to use NGINX Open Source or F5 NGINX Plus with NGINX Ing
 ## Prerequisites
 
 - [An AWS account](https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/AboutAWSAccounts.html).
-- A prebuilt image of the NGINX or NGINX Plus Ingress Controller for Kubernetes. 
+- A prebuilt image of the NGINX or NGINX Plus Ingress Controller for Kubernetes.
   - For NGINX Open Source you can use the pre-built image [on DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/). You can also build your own image.
   - For NGINX Plus, you must [build an image](https://docs.nginx.com/nginx-ingress-controller/installation/build-nginx-ingress-controller/).
 
@@ -30,16 +30,16 @@ make container DOCKERFILE=DockerfileForPlus PREFIX=nginx/nginx-plus-ingress
 ```
 
 The `PREFIX` argument specifies the repo name in your private container registry. In this example, we set it to `nginx/nginx-plus-ingress`. You can later use that name to reference the image instead of its numerical ID.
-   
+
 
 <span id="amazon-eks"></span>
 ## Create an Amazon EKS Cluster
 You can create an Amazon EKS cluster with:
 - the AWS Management Console
 - the AWS CLI
-- the `eksctl` command line utility. 
+- the `eksctl` command line utility.
 
-This guide covers the `eksctl` command as it is the simplest option. 
+This guide covers the `eksctl` command as it is the simplest option.
 
 1. Follow the instructions in the [eksctl.io documentation](https://eksctl.io/installation/) to install or update the `eksctl` command.
 
@@ -50,7 +50,7 @@ This guide covers the `eksctl` command as it is the simplest option.
 
 This step is only required if you do not plan to use the prebuilt NGINX Open Source image.
 
-1. Use the [AWS documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-create.html) to create a repository in the Amazon Elastic Container Registry (ECR). In Step 4 of the AWS instructions, name the repository {{<nb>}}**nginx-plus-ic**{{</nb>}} as that is what we use in this guide. 
+1. Use the [AWS documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-create.html) to create a repository in the Amazon Elastic Container Registry (ECR). In Step 4 of the AWS instructions, name the repository {{<nb>}}**nginx-plus-ic**{{</nb>}} as that is what we use in this guide.
 
 2. Run the following AWS CLI command. It generates an auth token for your AWS ECR registry, then pipes it into the `docker login` command. This lets AWS ECR authenticate and authorize the upcoming Docker requests. For details about the command, see the [AWS documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html).
 
@@ -93,7 +93,7 @@ Complete the steps up to and including [Confirm NGINX Ingress Controller is runn
 
 These steps assume you've cloned the [kubernetes-ingress](https://github.com/nginx/kubernetes-ingress) repository in the previous step.
 
-You need a Kubernetes `LoadBalancer` service to route traffic to the NGINX Ingress Controller. By default, Amazon EKS will create a [Classic Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/introduction.html) for Kubernetes services of type `LoadBalancer`. However, we recommend that you create a [Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) (NLB). It operates at the transport layer and is optimized for high performance and low latency. 
+You need a Kubernetes `LoadBalancer` service to route traffic to the NGINX Ingress Controller. By default, Amazon EKS will create a [Classic Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/introduction.html) for Kubernetes services of type `LoadBalancer`. However, we recommend that you create a [Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) (NLB). It operates at the transport layer and is optimized for high performance and low latency.
 
 We also recommend enabling the PROXY Protocol for both the NGINX Plus Ingress Controller and your NLB target groups. This is used to forward client connection information. If you choose not to enable the PROXY protocol, see the [Appendix](#appendix).
 
@@ -144,7 +144,7 @@ Apply the manifest `deployments/service/loadbalancer-aws-elb.yaml` to create a `
    * The `kubectl` commands are relative to the `deployment/examples/ingress-resources/complete-example` directory of the [kubernetes-ingress](https://github.com/nginx/kubernetes-ingress) repository.
    * Run the `curl` command listed in the instructions. It will access the demo app and populate the NGINX Plus Ingress Controller logs.
 
-4. Run the following commands to check if the PROXY Protocol is enabled: 
+4. Run the following commands to check if the PROXY Protocol is enabled:
    1. Display the pod of NGINX Ingress Controller:
 
       ```shell
diff --git a/content/nginx/deployment-guides/amazon-web-services/route-53-global-server-load-balancing.md b/content/nginx/deployment-guides/amazon-web-services/route-53-global-server-load-balancing.md
index 3cf5c6530..be9d7369a 100644
--- a/content/nginx/deployment-guides/amazon-web-services/route-53-global-server-load-balancing.md
+++ b/content/nginx/deployment-guides/amazon-web-services/route-53-global-server-load-balancing.md
@@ -1,7 +1,7 @@
 ---
 description: Deploy global server load balancing (GSLB) for domains hosted in multiple
   AWS regions, with Amazon Route 53 and F5 NGINX Plus in an HA configuration.
-docs: DOCS-448
+nd-docs: DOCS-448
 title: Global Server Load Balancing with Amazon Route 53 and NGINX Plus
 toc: true
 weight: 300
diff --git a/content/nginx/deployment-guides/global-server-load-balancing/ns1-global-server-load-balancing.md b/content/nginx/deployment-guides/global-server-load-balancing/ns1-global-server-load-balancing.md
index 8e14e22e7..414687c03 100644
--- a/content/nginx/deployment-guides/global-server-load-balancing/ns1-global-server-load-balancing.md
+++ b/content/nginx/deployment-guides/global-server-load-balancing/ns1-global-server-load-balancing.md
@@ -1,7 +1,7 @@
 ---
 description: Deploy global server load balancing (GSLB) for domains registered with
   DNS services provider NS1 and proxied by F5 NGINX Plus.
-docs: DOCS-449
+nd-docs: DOCS-449
 title: Global Server Load Balancing with NS1 and NGINX Plus
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md b/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md
index f44b95e75..d2b076277 100644
--- a/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md
+++ b/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md
@@ -1,7 +1,7 @@
 ---
 description: Configure highly available F5 NGINX Plus load balancing of application
   instances, in an all-active deployment on the Google Cloud Platform.
-docs: DOCS-450
+nd-docs: DOCS-450
 title: All-Active HA for NGINX Plus on the Google Cloud Platform
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md b/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md
index 0cc3af9b2..44dae6f63 100644
--- a/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md
+++ b/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md
@@ -1,7 +1,7 @@
 ---
 description: Load balance Apache Tomcat application servers with NGINX Open Source
   or the advanced features in F5 NGINX Plus, following our step-by-step setup instructions.
-docs: DOCS-451
+nd-docs: DOCS-451
 title: Load Balancing Apache Tomcat Servers with NGINX Open Source and NGINX Plus
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md b/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md
index 1c1a48769..31cbd5e53 100644
--- a/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md
+++ b/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md
@@ -1,7 +1,7 @@
 ---
 description: Load balance Microsoft Exchange servers with the advanced features in
   F5 NGINX Plus, following our step-by-step setup instructions.
-docs: DOCS-452
+nd-docs: DOCS-452
 title: Load Balancing Microsoft Exchange Servers with NGINX Plus
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/load-balance-third-party/node-js.md b/content/nginx/deployment-guides/load-balance-third-party/node-js.md
index 93c8b64da..3bef20cac 100644
--- a/content/nginx/deployment-guides/load-balance-third-party/node-js.md
+++ b/content/nginx/deployment-guides/load-balance-third-party/node-js.md
@@ -1,7 +1,7 @@
 ---
 description: Load balance Node.js application servers with NGINX Open Source or the
   advanced features in F5 NGINX Plus, following our step-by-step setup instructions.
-docs: DOCS-453
+nd-docs: DOCS-453
 title: Load Balancing Node.js Application Servers with NGINX Open Source and NGINX
   Plus
 toc: true
diff --git a/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md b/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md
index 47466094e..bf04cf29b 100644
--- a/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md
+++ b/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md
@@ -1,7 +1,7 @@
 ---
 description: Load balance Oracle E-Business Suite applications with the advanced features
   in F5 NGINX Plus, following our step-by-step setup instructions.
-docs: DOCS-454
+nd-docs: DOCS-454
 title: Load Balancing Oracle E-Business Suite with NGINX Plus
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md b/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md
index 872e44ebf..f8dfa6d88 100644
--- a/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md
+++ b/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md
@@ -1,7 +1,7 @@
 ---
 description: Load balance Oracle WebLogic Servers with NGINX Open Source and the advanced
   features in F5 NGINX Plus, following our step-by-step setup instructions.
-docs: DOCS-455
+nd-docs: DOCS-455
 title: Load Balancing Oracle WebLogic Server with NGINX Open Source and NGINX Plus
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/load-balance-third-party/wildfly.md b/content/nginx/deployment-guides/load-balance-third-party/wildfly.md
index 92c0d72b4..d7e92f7c1 100644
--- a/content/nginx/deployment-guides/load-balance-third-party/wildfly.md
+++ b/content/nginx/deployment-guides/load-balance-third-party/wildfly.md
@@ -1,7 +1,7 @@
 ---
 description: Load balance Wildfly (JBoss) application servers with NGINX Open Source
   or the advanced features in F5 NGINX Plus, following our step-by-step setup instructions.
-docs: DOCS-456
+nd-docs: DOCS-456
 title: Load Balancing Wildfly and JBoss Application Servers with NGINX Open Source
   and NGINX Plus
 toc: true
diff --git a/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md b/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md
index e804a2ca2..5503b26aa 100644
--- a/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md
+++ b/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md
@@ -1,7 +1,7 @@
 ---
 description: Create a highly available active-active deployment of F5 NGINX Plus on
   Microsoft Azure in combination with the Azure Standard Load Balancer.
-docs: DOCS-457
+nd-docs: DOCS-457
 title: Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard
   Load Balancer
 toc: true
diff --git a/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md b/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md
index ebbc17c53..f507efbb6 100644
--- a/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md
+++ b/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md
@@ -1,7 +1,7 @@
 ---
 description: Create Microsoft Azure virtual machines for running NGINX Open Source
   and F5 NGINX Plus.
-docs: DOCS-458
+nd-docs: DOCS-458
 title: Creating Microsoft Azure Virtual Machines for NGINX Open Source and F5 NGINX
   Plus
 toc: true
diff --git a/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md b/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md
index de397e3b0..026d4db9c 100644
--- a/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md
+++ b/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md
@@ -1,7 +1,7 @@
 ---
 description: Migrate load-balancing configuration from Citrix ADC to F5 NGINX Plus
   for equal performance at lower cost, using our syntax conversion examples.
-docs: DOCS-459
+nd-docs: DOCS-459
 title: Migrating Load Balancer Configuration from Citrix ADC to NGINX Plus
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md b/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md
index f5e2a4dec..b5f1f8adf 100644
--- a/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md
+++ b/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md
@@ -1,7 +1,7 @@
     ---
 description: Migrate load-balancing configuration from F5 BIG-IP LTM to NGINX Plus,
   using our syntax conversion examples.
-docs: DOCS-460
+nd-docs: DOCS-460
 title: Migrating Load Balancer Configuration from F5 BIG-IP LTM to F5 NGINX Plus
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/nginx-plus-high-availability-chef.md b/content/nginx/deployment-guides/nginx-plus-high-availability-chef.md
index 3e709cab9..5f0b65a19 100644
--- a/content/nginx/deployment-guides/nginx-plus-high-availability-chef.md
+++ b/content/nginx/deployment-guides/nginx-plus-high-availability-chef.md
@@ -1,7 +1,7 @@
 ---
 description: Step-by-step instructions for using Chef to automate the setup and maintenance
   of an active-passive high availability cluster of F5 NGINX Plus instances.
-docs: DOCS-461
+nd-docs: DOCS-461
 draft: true
 title: NGINX Plus High Availability Chef
 toc: true
diff --git a/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md b/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md
index a14367e24..8d68e7241 100644
--- a/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md
+++ b/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md
@@ -1,7 +1,7 @@
 ---
 description: Configure NGINX Open Source as a web server and F5 NGINX Plus as a load
   balancer, as required for the sample deployments in NGINX deployment guides.
-docs: DOCS-462
+nd-docs: DOCS-462
 title: Setting up an NGINX demo environment
 toc: true
 weight: 100
diff --git a/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md b/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md
index 3c1ed62f2..efa454958 100644
--- a/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md
+++ b/content/nginx/deployment-guides/single-sign-on/active-directory-federation-services.md
@@ -6,7 +6,7 @@ title: Single Sign-On with Microsoft Active Directory FS
 toc: true
 weight: 300
 product: NGINX-PLUS
-docs: DOCS-1683
+nd-docs: DOCS-1683
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Microsoft Active Directory Federation Services](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) (AD FS) as the Identity Provider (IdP) and NGINX Plus as the Relying Party (RP), or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/auth0.md b/content/nginx/deployment-guides/single-sign-on/auth0.md
index 26eb60921..316596ed5 100644
--- a/content/nginx/deployment-guides/single-sign-on/auth0.md
+++ b/content/nginx/deployment-guides/single-sign-on/auth0.md
@@ -6,7 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On With Auth0
 toc: true
 weight: 100
-docs: DOCS-1686
+nd-docs: DOCS-1686
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Auth0](https://auth0.com/features/single-sign-on) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
@@ -31,7 +31,7 @@ This guide explains how to enable single sign-on (SSO) for applications being pr
 
 3. On the **Applications** screen, select **Create Application**.
 
-4. On the **Create application** screen: 
+4. On the **Create application** screen:
 
    - Enter the **Name** for the application, for example, **NGINX Demo App**.
 
diff --git a/content/nginx/deployment-guides/single-sign-on/cognito.md b/content/nginx/deployment-guides/single-sign-on/cognito.md
index f3dbfaf51..1ea0a7994 100644
--- a/content/nginx/deployment-guides/single-sign-on/cognito.md
+++ b/content/nginx/deployment-guides/single-sign-on/cognito.md
@@ -6,7 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Amazon Cognito
 toc: true
 weight: 200
-docs: DOCS-1685
+nd-docs: DOCS-1685
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Amazon Cognito](https://aws.amazon.com/cognito/) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
@@ -16,10 +16,10 @@ This guide explains how to enable single sign-on (SSO) for applications being pr
 
 ## Prerequisites
 
-- An [AWS account](https://aws.amazon.com/premiumsupport/knowledge-center/create-and-activate-aws-account/)  
+- An [AWS account](https://aws.amazon.com/premiumsupport/knowledge-center/create-and-activate-aws-account/)
 
 - A Cognito **User Pool**
- 
+
 - An NGINX Plus [subscription](https://www.f5.com/products/nginx/nginx-plus) and NGINX Plus [Release 34](({{< ref "nginx/releases.md#r34" >}})) or later. For installation instructions, see [Installing NGINX Plus](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/).
 
 - A domain name pointing to your NGINX Plus instance, for example, `demo.example.com`.
diff --git a/content/nginx/deployment-guides/single-sign-on/entra-id.md b/content/nginx/deployment-guides/single-sign-on/entra-id.md
index 10637062f..3b360f1d7 100644
--- a/content/nginx/deployment-guides/single-sign-on/entra-id.md
+++ b/content/nginx/deployment-guides/single-sign-on/entra-id.md
@@ -6,7 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Microsoft Entra ID
 toc: true
 weight: 400
-docs: DOCS-1688
+nd-docs: DOCS-1688
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
@@ -40,7 +40,7 @@ Register a new application in Microsoft Entra ID that will represent NGINX Plus
 
 2. Register a New Application.
 
-   - Create a new application, for example, "Nginx Demo App", with NGINX callback URI `/oidc_callback`: 
+   - Create a new application, for example, "Nginx Demo App", with NGINX callback URI `/oidc_callback`:
 
      ```bash
      az ad app create --display-name "Nginx Demo App" --web-redirect-uris "https://demo.example.com/oidc_callback"
@@ -58,7 +58,7 @@ Register a new application in Microsoft Entra ID that will represent NGINX Plus
 
     - Replace the `<appId>` with the value obtained in the previous step.
 
-    - From the command output, copy the the `password` value which represents your **Client Secret**. You will need it later when configuring NGINX Plus. Make sure to securely save the generated client secret, as it will not be displayed again. 
+    - From the command output, copy the the `password` value which represents your **Client Secret**. You will need it later when configuring NGINX Plus. Make sure to securely save the generated client secret, as it will not be displayed again.
 
     - From the same command output, copy the the `tenant` value which represents your **Tenant ID**. You will need it later when configuring NGINX Plus.
 
diff --git a/content/nginx/deployment-guides/single-sign-on/keycloak.md b/content/nginx/deployment-guides/single-sign-on/keycloak.md
index 3d9e7153c..b44ce3f6b 100644
--- a/content/nginx/deployment-guides/single-sign-on/keycloak.md
+++ b/content/nginx/deployment-guides/single-sign-on/keycloak.md
@@ -6,7 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Keycloak
 toc: true
 weight: 500
-docs: DOCS-1682
+nd-docs: DOCS-1682
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Keycloak](https://www.keycloak.org/) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
@@ -44,7 +44,7 @@ This guide explains how to enable single sign-on (SSO) for applications being pr
 4. In the **Capability Config** section:
 
     - Set **Client Authentication** to **On**. This sets the client type to **confidential**.
-   
+
     - Select **Next**.
 
 5. In the **Login Settings** section:
@@ -125,7 +125,7 @@ With Keycloak configured, you can enable OIDC on NGINX Plus. NGINX Plus serves a
     nginx version: nginx/1.27.4 (nginx-plus-r34)
     ```
 
-2.  Ensure that you have the values of the **Client ID**, **Client Secret**, and **Issuer** obtained during 
+2.  Ensure that you have the values of the **Client ID**, **Client Secret**, and **Issuer** obtained during
     [Keycloak Configuration](#keycloak-setup) if applicable. PKCE will not have a **Client Secret**.
 
 3.  In your preferred text editor, open the NGINX configuration file (`/etc/nginx/nginx.conf` for Linux or `/usr/local/etc/nginx/nginx.conf` for FreeBSD).
@@ -160,7 +160,7 @@ With Keycloak configured, you can enable OIDC on NGINX Plus. NGINX Plus serves a
 
     - your actual Keycloak **Client ID** obtained in [Keycloak Configuration](#keycloak-setup) with the [`client_id`](https://nginx.org/en/docs/http/ngx_http_oidc_module.html#client_id) directive
 
-    - (if not using PKCE) your **Client Secret** obtained in [Keycloak Configuration](#keycloak-setup) with the 
+    - (if not using PKCE) your **Client Secret** obtained in [Keycloak Configuration](#keycloak-setup) with the
       [`client_secret`](https://nginx.org/en/docs/http/ngx_http_oidc_module.html#client_secret) directive
 
     - the **Issuer** URL obtained in [Keycloak Configuration](#keycloak-setup) with the [`issuer`](https://nginx.org/en/docs/http/ngx_http_oidc_module.html#client_secret) directive
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/active-directory-federation-services.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/active-directory-federation-services.md
index 6d0173780..d014bc302 100644
--- a/content/nginx/deployment-guides/single-sign-on/oidc-njs/active-directory-federation-services.md
+++ b/content/nginx/deployment-guides/single-sign-on/oidc-njs/active-directory-federation-services.md
@@ -1,7 +1,7 @@
 ---
 description: Enable OpenID Connect-based single-sign for applications proxied by NGINX
   Plus, using Microsoft AD FS as the identity provider (IdP).
-docs: DOCS-463
+nd-docs: DOCS-463
 type:
 - how-to
 title: Single Sign-On with Microsoft AD FS and njs
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/auth0.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/auth0.md
index 71d7f6f26..b789fb2f8 100644
--- a/content/nginx/deployment-guides/single-sign-on/oidc-njs/auth0.md
+++ b/content/nginx/deployment-guides/single-sign-on/oidc-njs/auth0.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to enable single sign-on (SSO) with [Auth0](https://auth0.com/)
   for applications proxied by F5 NGINX Plus.
-docs: DOCS-884
+nd-docs: DOCS-884
 type:
 - tutorial
 title: Single Sign-On With Auth0 and njs
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/cognito.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/cognito.md
index 94e62f0f8..6a1d3fa91 100644
--- a/content/nginx/deployment-guides/single-sign-on/oidc-njs/cognito.md
+++ b/content/nginx/deployment-guides/single-sign-on/oidc-njs/cognito.md
@@ -1,7 +1,7 @@
 ---
 description: Enable OpenID Connect-based single-sign for applications proxied by NGINX
   Plus, using Amazon Cognito as the identity provider (IdP).
-docs: DOCS-464
+nd-docs: DOCS-464
 type:
 - how-to
 title: Single Sign-On with Amazon Cognito and njs
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/keycloak.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/keycloak.md
index 25c8af487..9bfd26e66 100644
--- a/content/nginx/deployment-guides/single-sign-on/oidc-njs/keycloak.md
+++ b/content/nginx/deployment-guides/single-sign-on/oidc-njs/keycloak.md
@@ -1,7 +1,7 @@
 ---
 description: Enable OpenID Connect-based single-sign for applications proxied by NGINX
   Plus, using Keycloak as the identity provider (IdP).
-docs: DOCS-465
+nd-docs: DOCS-465
 type:
 - how-to
 title: Single Sign-On with Keycloak and njs
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/okta.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/okta.md
index 4d1c81094..6b83eb437 100644
--- a/content/nginx/deployment-guides/single-sign-on/oidc-njs/okta.md
+++ b/content/nginx/deployment-guides/single-sign-on/oidc-njs/okta.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to enable single sign-on (SSO) with Okta for applications proxied
   by F5 NGINX Plus.
-docs: DOCS-466
+nd-docs: DOCS-466
 type:
 - how-to
 title: Single Sign-On with Okta and njs
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/onelogin.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/onelogin.md
index b6c8fde9a..e5560f8d5 100644
--- a/content/nginx/deployment-guides/single-sign-on/oidc-njs/onelogin.md
+++ b/content/nginx/deployment-guides/single-sign-on/oidc-njs/onelogin.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to enable single sign-on (SSO) with [OneLogin](https://www.onelogin.com/)
   for applications proxied by F5 NGINX Plus.
-docs: DOCS-467
+nd-docs: DOCS-467
 type:
 - tutorial
 title: Single Sign-On with OneLogin and njs
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/ping-identity.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/ping-identity.md
index 495b2ebad..3332bb3fb 100644
--- a/content/nginx/deployment-guides/single-sign-on/oidc-njs/ping-identity.md
+++ b/content/nginx/deployment-guides/single-sign-on/oidc-njs/ping-identity.md
@@ -1,7 +1,7 @@
 ---
 description: Enable OpenID Connect-based single-sign for applications proxied by NGINX
   Plus, using Ping Identity as the identity provider (IdP).
-docs: DOCS-468
+nd-docs: DOCS-468
 type:
 - how-to
 product: NGINX-PLUS
diff --git a/content/nginx/deployment-guides/single-sign-on/okta.md b/content/nginx/deployment-guides/single-sign-on/okta.md
index 2dc975726..933c60a16 100644
--- a/content/nginx/deployment-guides/single-sign-on/okta.md
+++ b/content/nginx/deployment-guides/single-sign-on/okta.md
@@ -6,7 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Okta
 toc: true
 weight: 700
-docs: DOCS-1689
+nd-docs: DOCS-1689
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Okta](https://www.okta.com/) as the Identity Provider (IdP), and NGINX Plus as the Relying Party, or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/onelogin.md b/content/nginx/deployment-guides/single-sign-on/onelogin.md
index 1171890dc..c241a8fea 100644
--- a/content/nginx/deployment-guides/single-sign-on/onelogin.md
+++ b/content/nginx/deployment-guides/single-sign-on/onelogin.md
@@ -6,7 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with OneLogin
 toc: true
 weight: 600
-docs: DOCS-1687
+nd-docs: DOCS-1687
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [OneLogin](https://www.onelogin.com/) as the Identity Provider (IdP) and NGINX Plus as the Relying Party (RP), or OIDC client application that verifies user identity.
diff --git a/content/nginx/deployment-guides/single-sign-on/ping-identity.md b/content/nginx/deployment-guides/single-sign-on/ping-identity.md
index c1bec1101..733847966 100644
--- a/content/nginx/deployment-guides/single-sign-on/ping-identity.md
+++ b/content/nginx/deployment-guides/single-sign-on/ping-identity.md
@@ -6,7 +6,7 @@ product: NGINX-PLUS
 title: Single Sign-On with Ping Identity
 toc: true
 weight: 800
-docs: DOCS-1684
+nd-docs: DOCS-1684
 ---
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Ping Identity](https://www.pingidentity.com/en.html) (PingFederate or PingOne) as the Identity Provider (IdP), and NGINX Plus as the Relying Party.
@@ -30,7 +30,7 @@ This guide explains how to enable single sign-on (SSO) for applications being pr
 Create a new application for NGINX Plus:
 
 1. Log in to your Ping Identity admin console.
- 
+
 2. Go to **Applications** > **Applications**.
 
 3. Click the **+** (plus) symbol to create a new OIDC Application.
diff --git a/content/nginx/directives.md b/content/nginx/directives.md
index e321d8207..20c3cb556 100644
--- a/content/nginx/directives.md
+++ b/content/nginx/directives.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-469
+nd-docs: DOCS-469
 title: NGINX Directives Index
 url: /nginx/directives
 weight: 700
diff --git a/content/nginx/fips-compliance-nginx-plus.md b/content/nginx/fips-compliance-nginx-plus.md
index 52a378a44..eb11c2b91 100644
--- a/content/nginx/fips-compliance-nginx-plus.md
+++ b/content/nginx/fips-compliance-nginx-plus.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-470
+nd-docs: DOCS-470
 title: NGINX Plus FIPS Compliance
 toc: true
 weight: 600
diff --git a/content/nginx/open-source-components.md b/content/nginx/open-source-components.md
index 6ecd01ee2..7b80cb289 100644
--- a/content/nginx/open-source-components.md
+++ b/content/nginx/open-source-components.md
@@ -1,7 +1,7 @@
 ---
 description: License information for open source components included in the NGINX
   Plus software.
-docs: DOCS-471
+nd-docs: DOCS-471
 title: Open Source Components
 toc: true
 weight: 500
diff --git a/content/nginx/releases.md b/content/nginx/releases.md
index 6533b24dd..764728ff0 100644
--- a/content/nginx/releases.md
+++ b/content/nginx/releases.md
@@ -1,7 +1,7 @@
 ---
 description: Release information for F5 NGINX Plus, a complete application delivery
   platform, including new features and a list of supported platforms.
-docs: DOCS-472
+nd-docs: DOCS-472
 title: Releases
 toc: true
 weight: 300
diff --git a/content/nginx/technical-specs.md b/content/nginx/technical-specs.md
index 5405859c6..d46a85875 100644
--- a/content/nginx/technical-specs.md
+++ b/content/nginx/technical-specs.md
@@ -2,7 +2,7 @@
 description: Platforms supported by F5 NGINX Plus and dynamically loaded modules,
   supported SSL/TLS versions, supported deployment environments, and list of modules
   built into NGINX Plus.
-docs: DOCS-473
+nd-docs: DOCS-473
 title: Technical Specs
 toc: true
 weight: 400
diff --git a/content/nginx/variables.md b/content/nginx/variables.md
index 3c68dd448..07de70141 100644
--- a/content/nginx/variables.md
+++ b/content/nginx/variables.md
@@ -2,7 +2,7 @@
 title: NGINX Variables Index
 url: /nginx/variables
 weight: 800
-docs: DOCS-1681
+nd-docs: DOCS-1681
 ---
 
 <!-- this is dummy doc is used to create a list page entry that redirects users to the variables index in the .org docs. The redirect is configured in azure-redirects-base -->
\ No newline at end of file
diff --git a/content/nginxaas-azure/billing/overview.md b/content/nginxaas-azure/billing/overview.md
index c0f5df504..a1e26f75a 100644
--- a/content/nginxaas-azure/billing/overview.md
+++ b/content/nginxaas-azure/billing/overview.md
@@ -2,7 +2,7 @@
 title: Billing overview
 weight: 100
 toc: true
-docs: DOCS-885
+nd-docs: DOCS-885
 url: /nginxaas/azure/billing/overview/
 type:
 - concept
diff --git a/content/nginxaas-azure/billing/usage-and-cost-estimator.md b/content/nginxaas-azure/billing/usage-and-cost-estimator.md
index 3e813c6c3..28f2ef7a8 100644
--- a/content/nginxaas-azure/billing/usage-and-cost-estimator.md
+++ b/content/nginxaas-azure/billing/usage-and-cost-estimator.md
@@ -2,7 +2,7 @@
 title: Usage and cost estimator
 weight: 200
 toc: true
-docs: DOCS-1474
+nd-docs: DOCS-1474
 url: /nginxaas/azure/billing/usage-and-cost-estimator/
 type:
 - concept
diff --git a/content/nginxaas-azure/changelog.md b/content/nginxaas-azure/changelog.md
index 131c0b2b3..e001d3128 100644
--- a/content/nginxaas-azure/changelog.md
+++ b/content/nginxaas-azure/changelog.md
@@ -2,7 +2,7 @@
 title: "Changelog"
 weight: 900
 toc: true
-docs: "DOCS-870"
+nd-docs: "DOCS-870"
 url: /nginxaas/azure/changelog/
 
 ---
diff --git a/content/nginxaas-azure/client-tools/cli.md b/content/nginxaas-azure/client-tools/cli.md
index 7b3adb8c8..1731e17ec 100644
--- a/content/nginxaas-azure/client-tools/cli.md
+++ b/content/nginxaas-azure/client-tools/cli.md
@@ -3,7 +3,7 @@ title: Azure CLI
 weight: 900
 description: Learn how to setup the Azure CLI to manage NGINXaaS for Azure.
 toc: true
-docs: DOCS-1234
+nd-docs: DOCS-1234
 url: /nginxaas/azure/client-tools/cli/
 type:
 - task
diff --git a/content/nginxaas-azure/client-tools/sdk.md b/content/nginxaas-azure/client-tools/sdk.md
index 50305b9e7..55e41e647 100644
--- a/content/nginxaas-azure/client-tools/sdk.md
+++ b/content/nginxaas-azure/client-tools/sdk.md
@@ -4,7 +4,7 @@ weight: 300
 description: Learn how to use the Python Azure Management SDK to manage NGINXaaS for
   Azure deployments.
 toc: true
-docs: DOCS-1095
+nd-docs: DOCS-1095
 url: /nginxaas/azure/client-tools/sdk/
 type:
 - task
diff --git a/content/nginxaas-azure/client-tools/templates.md b/content/nginxaas-azure/client-tools/templates.md
index e9cdeb468..aae949498 100644
--- a/content/nginxaas-azure/client-tools/templates.md
+++ b/content/nginxaas-azure/client-tools/templates.md
@@ -4,7 +4,7 @@ weight: 100
 description: Learn how to use Azure Resource Manager (ARM) JSON and Bicep templates
   to manage NGINXaaS for Azure.
 toc: true
-docs: DOCS-1097
+nd-docs: DOCS-1097
 url: /nginxaas/azure/client-tools/templates/
 type:
 - task
diff --git a/content/nginxaas-azure/client-tools/terraform.md b/content/nginxaas-azure/client-tools/terraform.md
index 7a0ea91b2..e9baec4f1 100644
--- a/content/nginxaas-azure/client-tools/terraform.md
+++ b/content/nginxaas-azure/client-tools/terraform.md
@@ -3,7 +3,7 @@ title: Terraform
 weight: 400
 description: Learn how to use the Terraform to manage NGINXaaS for Azure.
 toc: true
-docs: DOCS-1472
+nd-docs: DOCS-1472
 draft: true
 url: /nginxaas/azure/client-tools/terraform/
 type:
diff --git a/content/nginxaas-azure/get-help.md b/content/nginxaas-azure/get-help.md
index ff1ffc96b..b418b008f 100644
--- a/content/nginxaas-azure/get-help.md
+++ b/content/nginxaas-azure/get-help.md
@@ -2,7 +2,7 @@
 title: Get help
 weight: 750
 toc: true
-docs: DOCS-882
+nd-docs: DOCS-882
 url: /nginxaas/azure/get-help/
 type:
 - how-to
diff --git a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md
index 3d58d49fb..44448cddd 100644
--- a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md
+++ b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md
@@ -2,7 +2,7 @@
 title: Deploy using the Azure portal
 weight: 100
 toc: true
-docs: DOCS-878
+nd-docs: DOCS-878
 url: /nginxaas/azure/getting-started/create-deployment/deploy-azure-portal/
 type:
 - how-to
diff --git a/content/nginxaas-azure/getting-started/managed-identity-portal.md b/content/nginxaas-azure/getting-started/managed-identity-portal.md
index 802fa37ce..4051d36dc 100644
--- a/content/nginxaas-azure/getting-started/managed-identity-portal.md
+++ b/content/nginxaas-azure/getting-started/managed-identity-portal.md
@@ -2,7 +2,7 @@
 title: Assign Managed Identities
 weight: 300
 toc: true
-docs: DOCS-872
+nd-docs: DOCS-872
 url: /nginxaas/azure/getting-started/managed-identity-portal/
 type:
 - how-to
diff --git a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md
index 498f81133..77a0b75ba 100644
--- a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md
+++ b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md
@@ -2,7 +2,7 @@
 title: Upload using the Azure portal
 weight: 100
 toc: true
-docs: DOCS-873
+nd-docs: DOCS-873
 url: /nginxaas/azure/getting-started/nginx-configuration/nginx-configuration-portal/
 type:
 - how-to
diff --git a/content/nginxaas-azure/getting-started/prerequisites.md b/content/nginxaas-azure/getting-started/prerequisites.md
index aefcdbf6d..a535f1d7f 100644
--- a/content/nginxaas-azure/getting-started/prerequisites.md
+++ b/content/nginxaas-azure/getting-started/prerequisites.md
@@ -2,7 +2,7 @@
 title: Overview and prerequisites
 weight: 100
 toc: true
-docs: DOCS-880
+nd-docs: DOCS-880
 url: /nginxaas/azure/getting-started/prerequisites/
 type:
 - how-to
diff --git a/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md b/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md
index fd593de98..0c27e8ff3 100644
--- a/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md
+++ b/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md
@@ -2,7 +2,7 @@
 title: Add certificates using the Azure portal
 weight: 100
 toc: true
-docs: DOCS-875
+nd-docs: DOCS-875
 url: /nginxaas/azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal/
 type:
 - how-to
diff --git a/content/nginxaas-azure/known-issues.md b/content/nginxaas-azure/known-issues.md
index b7fe218d5..aecea3291 100644
--- a/content/nginxaas-azure/known-issues.md
+++ b/content/nginxaas-azure/known-issues.md
@@ -2,18 +2,18 @@
 title: "Known issues"
 weight: 1000
 toc: true
-docs: "DOCS-871"
+nd-docs: "DOCS-871"
 url: /nginxaas/azure/known-issues/
 
 ---
 
 List of known issues in the latest release of F5 NGINX as a Service for Azure (NGINXaaS).
 
-### {{% icon-bug %}} Custom and precompiled security policies cannot both be referenced in an NGINX configuration 
+### {{% icon-bug %}} Custom and precompiled security policies cannot both be referenced in an NGINX configuration
 
 When using NGINX App Protect WAF, you can only reference default or custom security policies in your NGINX configuration, not both.
 
-**Workaround**: Make a copy of the default policy you want to use, then add it as a custom policy with a different name.  
+**Workaround**: Make a copy of the default policy you want to use, then add it as a custom policy with a different name.
 
 ### {{% icon-bug %}} Terraform fails to apply due to validation errors, but creates "Failed" resources in Azure (ID-4424)
 
diff --git a/content/nginxaas-azure/monitoring/configure-alerts.md b/content/nginxaas-azure/monitoring/configure-alerts.md
index 78dd3e9de..10a7d0a9f 100644
--- a/content/nginxaas-azure/monitoring/configure-alerts.md
+++ b/content/nginxaas-azure/monitoring/configure-alerts.md
@@ -3,7 +3,7 @@ title: Configure alerts
 weight: 300
 toc: true
 draft: false
-docs: DOCS-985
+nd-docs: DOCS-985
 url: /nginxaas/azure/monitoring/configure-alerts/
 type:
 - how-to
diff --git a/content/nginxaas-azure/monitoring/enable-logging/logging-using-cli.md b/content/nginxaas-azure/monitoring/enable-logging/logging-using-cli.md
index f2e9c9081..4344f69bc 100644
--- a/content/nginxaas-azure/monitoring/enable-logging/logging-using-cli.md
+++ b/content/nginxaas-azure/monitoring/enable-logging/logging-using-cli.md
@@ -2,7 +2,7 @@
 title: Enable NGINX logs using CLI
 weight: 100
 toc: true
-docs: DOCS-1369
+nd-docs: DOCS-1369
 url: /nginxaas/azure/monitoring/enable-logging/logging-using-cli/
 type:
 - how-to
diff --git a/content/nginxaas-azure/monitoring/enable-logging/logging-using-portal.md b/content/nginxaas-azure/monitoring/enable-logging/logging-using-portal.md
index 59be2a8b3..70da26047 100644
--- a/content/nginxaas-azure/monitoring/enable-logging/logging-using-portal.md
+++ b/content/nginxaas-azure/monitoring/enable-logging/logging-using-portal.md
@@ -2,7 +2,7 @@
 title: Enable NGINX logs using Azure Portal
 weight: 100
 toc: true
-docs: DOCS-1369
+nd-docs: DOCS-1369
 url: /nginxaas/azure/monitoring/enable-logging/logging-using-portal/
 type:
 - how-to
diff --git a/content/nginxaas-azure/monitoring/enable-logging/logging-using-terraform.md b/content/nginxaas-azure/monitoring/enable-logging/logging-using-terraform.md
index 059e1c642..af167f562 100644
--- a/content/nginxaas-azure/monitoring/enable-logging/logging-using-terraform.md
+++ b/content/nginxaas-azure/monitoring/enable-logging/logging-using-terraform.md
@@ -2,7 +2,7 @@
 title: Enable NGINX logs using Terraform
 weight: 100
 toc: true
-docs: DOCS-1369
+nd-docs: DOCS-1369
 url: /nginxaas/azure/monitoring/enable-logging/logging-using-terraform/
 type:
 - how-to
diff --git a/content/nginxaas-azure/monitoring/enable-monitoring.md b/content/nginxaas-azure/monitoring/enable-monitoring.md
index 7185e3320..ebb97ce62 100644
--- a/content/nginxaas-azure/monitoring/enable-monitoring.md
+++ b/content/nginxaas-azure/monitoring/enable-monitoring.md
@@ -2,7 +2,7 @@
 title: Enable monitoring
 weight: 200
 toc: true
-docs: DOCS-876
+nd-docs: DOCS-876
 url: /nginxaas/azure/monitoring/enable-monitoring/
 type:
 - how-to
diff --git a/content/nginxaas-azure/monitoring/metrics-catalog.md b/content/nginxaas-azure/monitoring/metrics-catalog.md
index f81686f7e..b31d887c9 100644
--- a/content/nginxaas-azure/monitoring/metrics-catalog.md
+++ b/content/nginxaas-azure/monitoring/metrics-catalog.md
@@ -2,7 +2,7 @@
 title: Metrics catalog
 weight: 400
 toc: false
-docs: DOCS-877
+nd-docs: DOCS-877
 url: /nginxaas/azure/monitoring/metrics-catalog/
 type:
 - concept
diff --git a/content/nginxaas-azure/overview/feature-comparison.md b/content/nginxaas-azure/overview/feature-comparison.md
index 4bc1f8ed6..f30da905f 100644
--- a/content/nginxaas-azure/overview/feature-comparison.md
+++ b/content/nginxaas-azure/overview/feature-comparison.md
@@ -3,7 +3,7 @@ title: Feature comparison
 weight: 300
 description: Compare NGINXaaS for Azure with other NGINX offerings.
 toc: false
-docs: DOCS-1473
+nd-docs: DOCS-1473
 url: /nginxaas/azure/overview/feature-comparison/
 type:
 - concept
diff --git a/content/nginxaas-azure/overview/overview.md b/content/nginxaas-azure/overview/overview.md
index 336bee241..ae6d4b9c0 100644
--- a/content/nginxaas-azure/overview/overview.md
+++ b/content/nginxaas-azure/overview/overview.md
@@ -2,7 +2,7 @@
 title: Overview and architecture
 weight: 100
 toc: true
-docs: DOCS-879
+nd-docs: DOCS-879
 url: /nginxaas/azure/overview/overview/
 type:
 - concept
diff --git a/content/nginxaas-azure/quickstart/basic-caching.md b/content/nginxaas-azure/quickstart/basic-caching.md
index ce7ad0bee..40b16402d 100644
--- a/content/nginxaas-azure/quickstart/basic-caching.md
+++ b/content/nginxaas-azure/quickstart/basic-caching.md
@@ -2,7 +2,7 @@
 title: Enable content caching
 weight: 200
 toc: true
-docs: DOCS-897
+nd-docs: DOCS-897
 url: /nginxaas/azure/quickstart/basic-caching/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/hosting-static-content.md b/content/nginxaas-azure/quickstart/hosting-static-content.md
index 3495ea824..05706b3b9 100644
--- a/content/nginxaas-azure/quickstart/hosting-static-content.md
+++ b/content/nginxaas-azure/quickstart/hosting-static-content.md
@@ -2,7 +2,7 @@
 title: Hosting static content
 weight: 200
 toc: true
-docs: DOCS-1344
+nd-docs: DOCS-1344
 url: /nginxaas/azure/quickstart/hosting-static-content/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/njs-support.md b/content/nginxaas-azure/quickstart/njs-support.md
index b64f26927..344bafc2e 100644
--- a/content/nginxaas-azure/quickstart/njs-support.md
+++ b/content/nginxaas-azure/quickstart/njs-support.md
@@ -2,7 +2,7 @@
 title: Use the njs Scripting language
 weight: 400
 toc: true
-docs: DOCS-874
+nd-docs: DOCS-874
 url: /nginxaas/azure/quickstart/njs-support/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/rate-limiting.md b/content/nginxaas-azure/quickstart/rate-limiting.md
index 61662c2bf..8dff3c692 100644
--- a/content/nginxaas-azure/quickstart/rate-limiting.md
+++ b/content/nginxaas-azure/quickstart/rate-limiting.md
@@ -2,7 +2,7 @@
 title: Enable rate limiting
 weight: 300
 toc: true
-docs: DOCS-899
+nd-docs: DOCS-899
 url: /nginxaas/azure/quickstart/rate-limiting/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/recreate.md b/content/nginxaas-azure/quickstart/recreate.md
index 4ba08ec0a..06b515b5a 100644
--- a/content/nginxaas-azure/quickstart/recreate.md
+++ b/content/nginxaas-azure/quickstart/recreate.md
@@ -2,7 +2,7 @@
 title: Recreating a deployment
 weight: 500
 toc: true
-docs: DOCS-1378
+nd-docs: DOCS-1378
 url: /nginxaas/azure/quickstart/recreate/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/runtime-state-sharing.md b/content/nginxaas-azure/quickstart/runtime-state-sharing.md
index 072932f92..0f86569b4 100644
--- a/content/nginxaas-azure/quickstart/runtime-state-sharing.md
+++ b/content/nginxaas-azure/quickstart/runtime-state-sharing.md
@@ -2,7 +2,7 @@
 title: Runtime State Sharing
 weight: 100
 toc: true
-docs: DOCS-1499
+nd-docs: DOCS-1499
 url: /nginxaas/azure/quickstart/runtime-state-sharing/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/scaling.md b/content/nginxaas-azure/quickstart/scaling.md
index 05f9d1608..7fb1777ea 100644
--- a/content/nginxaas-azure/quickstart/scaling.md
+++ b/content/nginxaas-azure/quickstart/scaling.md
@@ -2,7 +2,7 @@
 title: Scaling guidance
 weight: 100
 toc: true
-docs: DOCS-989
+nd-docs: DOCS-989
 url: /nginxaas/azure/quickstart/scaling/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/security-controls/auth-basic.md b/content/nginxaas-azure/quickstart/security-controls/auth-basic.md
index 4470cf1aa..9e147ec1a 100644
--- a/content/nginxaas-azure/quickstart/security-controls/auth-basic.md
+++ b/content/nginxaas-azure/quickstart/security-controls/auth-basic.md
@@ -2,7 +2,7 @@
 title: Restricting access with HTTP basic authentication
 weight: 100
 toc: true
-docs: DOCS-990
+nd-docs: DOCS-990
 url: /nginxaas/azure/security-controls/auth-basic/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/security-controls/jwt.md b/content/nginxaas-azure/quickstart/security-controls/jwt.md
index e3a4441dc..f403eef0e 100644
--- a/content/nginxaas-azure/quickstart/security-controls/jwt.md
+++ b/content/nginxaas-azure/quickstart/security-controls/jwt.md
@@ -2,7 +2,7 @@
 title: Setting up JWT authentication
 weight: 200
 toc: true
-docs: DOCS-1101
+nd-docs: DOCS-1101
 url: /nginxaas/azure/quickstart/security-controls/jwt/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/security-controls/oidc.md b/content/nginxaas-azure/quickstart/security-controls/oidc.md
index ea0aa9875..e67db825a 100644
--- a/content/nginxaas-azure/quickstart/security-controls/oidc.md
+++ b/content/nginxaas-azure/quickstart/security-controls/oidc.md
@@ -2,7 +2,7 @@
 title: Set up OIDC authentication
 weight: 300
 toc: true
-docs: DOCS-1646
+nd-docs: DOCS-1646
 url: /nginxaas/azure/quickstart/security-controls/oidc/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md b/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md
index c9b54ce8d..a3c4fcedd 100644
--- a/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md
+++ b/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md
@@ -2,7 +2,7 @@
 title: Securing upstream traffic
 weight: 300
 toc: true
-docs: DOCS-1475
+nd-docs: DOCS-1475
 url: /nginxaas/azure/quickstart/security-controls/securing-upstream-traffic/
 type:
 - how-to
diff --git a/content/nginxaas-azure/quickstart/upgrade-channels.md b/content/nginxaas-azure/quickstart/upgrade-channels.md
index 9abd6486f..5c5360047 100644
--- a/content/nginxaas-azure/quickstart/upgrade-channels.md
+++ b/content/nginxaas-azure/quickstart/upgrade-channels.md
@@ -2,7 +2,7 @@
 title: Upgrade channels
 weight: 150
 toc: true
-docs: DOCS-1480
+nd-docs: DOCS-1480
 url: /nginxaas/azure/quickstart/upgrade-channels/
 type:
 - how-to
diff --git a/content/nim/admin-guide/add-license.md b/content/nim/admin-guide/add-license.md
index 7d9aa0f2a..3c5b7afa8 100644
--- a/content/nim/admin-guide/add-license.md
+++ b/content/nim/admin-guide/add-license.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-789
+nd-docs: DOCS-789
 title: Add a license (connected)
 toc: true
 weight: 10
diff --git a/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md b/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md
index f118da1c5..bbe22d82f 100644
--- a/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md
+++ b/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md
@@ -5,7 +5,7 @@ toc: true
 weight: 10
 type: how-to
 product: NIM
-docs: DOCS-792
+nd-docs: DOCS-792
 ---
 
 <style>
diff --git a/content/nim/admin-guide/authentication/oidc/getting-started.md b/content/nim/admin-guide/authentication/oidc/getting-started.md
index fc3dc9901..537553bbc 100644
--- a/content/nim/admin-guide/authentication/oidc/getting-started.md
+++ b/content/nim/admin-guide/authentication/oidc/getting-started.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1267
+nd-docs: DOCS-1267
 title: Get started with OIDC
 toc: true
 weight: 1
diff --git a/content/nim/admin-guide/authentication/oidc/keycloak-setup.md b/content/nim/admin-guide/authentication/oidc/keycloak-setup.md
index 24ace8bc0..2a1e971d6 100644
--- a/content/nim/admin-guide/authentication/oidc/keycloak-setup.md
+++ b/content/nim/admin-guide/authentication/oidc/keycloak-setup.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1268
+nd-docs: DOCS-1268
 title: 'Keycloak: Set up OIDC authentication'
 toc: true
 weight: 400
diff --git a/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md b/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md
index cb77e112b..3328f75a2 100644
--- a/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md
+++ b/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1197
+nd-docs: DOCS-1197
 title: Automate OIDC with Microsoft Entra
 toc: true
 weight: 300
diff --git a/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md b/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md
index 68a41e454..b6c0ccb14 100644
--- a/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md
+++ b/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-795
+nd-docs: DOCS-795
 title: 'Microsoft Entra: Set up OIDC authentication'
 toc: true
 weight: 100
diff --git a/content/nim/admin-guide/authentication/oidc/scim-provisioning.md b/content/nim/admin-guide/authentication/oidc/scim-provisioning.md
index ff51b27e7..0bcbe1d84 100644
--- a/content/nim/admin-guide/authentication/oidc/scim-provisioning.md
+++ b/content/nim/admin-guide/authentication/oidc/scim-provisioning.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-918
+nd-docs: DOCS-918
 title: Provision users and groups using SCIM
 toc: true
 weight: 500
diff --git a/content/nim/admin-guide/maintenance/backup-and-recovery.md b/content/nim/admin-guide/maintenance/backup-and-recovery.md
index 3757ef5fe..279b65634 100644
--- a/content/nim/admin-guide/maintenance/backup-and-recovery.md
+++ b/content/nim/admin-guide/maintenance/backup-and-recovery.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1098
+nd-docs: DOCS-1098
 title: Back up and restore
 toc: true
 weight: 1
diff --git a/content/nim/admin-guide/maintenance/sqlite-installation.md b/content/nim/admin-guide/maintenance/sqlite-installation.md
index 391db1caa..683ab4ffe 100644
--- a/content/nim/admin-guide/maintenance/sqlite-installation.md
+++ b/content/nim/admin-guide/maintenance/sqlite-installation.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1270
+nd-docs: DOCS-1270
 title: Install SQLite (for NGINX Instance Manager 2.14.1 and earlier)
 toc: true
 weight: 10
diff --git a/content/nim/admin-guide/rbac/assign-roles.md b/content/nim/admin-guide/rbac/assign-roles.md
index 549295ed7..b5971df57 100644
--- a/content/nim/admin-guide/rbac/assign-roles.md
+++ b/content/nim/admin-guide/rbac/assign-roles.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1273
+nd-docs: DOCS-1273
 title: Assign roles to users or user groups
 toc: true
 weight: 210
diff --git a/content/nim/admin-guide/rbac/create-roles.md b/content/nim/admin-guide/rbac/create-roles.md
index c982bb3b5..60927c7e2 100644
--- a/content/nim/admin-guide/rbac/create-roles.md
+++ b/content/nim/admin-guide/rbac/create-roles.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1272
+nd-docs: DOCS-1272
 title: Create and manage roles
 toc: true
 weight: 200
diff --git a/content/nim/admin-guide/rbac/manage-resource-groups.md b/content/nim/admin-guide/rbac/manage-resource-groups.md
index c85e4787a..99dfed1ea 100644
--- a/content/nim/admin-guide/rbac/manage-resource-groups.md
+++ b/content/nim/admin-guide/rbac/manage-resource-groups.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1271
+nd-docs: DOCS-1271
 title: Manage resource groups
 toc: true
 weight: 300
diff --git a/content/nim/admin-guide/rbac/overview-rbac.md b/content/nim/admin-guide/rbac/overview-rbac.md
index be72b3013..95d47e1a6 100644
--- a/content/nim/admin-guide/rbac/overview-rbac.md
+++ b/content/nim/admin-guide/rbac/overview-rbac.md
@@ -4,7 +4,7 @@ weight: 1
 toc: true
 type: concept
 product: nim
-docs: DOCS-919
+nd-docs: DOCS-919
 ---
 
 ## Overview
diff --git a/content/nim/admin-guide/report-usage-connected-deployment.md b/content/nim/admin-guide/report-usage-connected-deployment.md
index 6ce813807..3fdfbc24c 100644
--- a/content/nim/admin-guide/report-usage-connected-deployment.md
+++ b/content/nim/admin-guide/report-usage-connected-deployment.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 20
 toc: true
-docs: DOCS-1650
+nd-docs: DOCS-1650
 personas:
 - devops
 - netops
diff --git a/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md b/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md
index 8e8a3fe99..1e451340b 100644
--- a/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md
+++ b/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md
@@ -3,7 +3,7 @@ description: ''
 title: Deploy using Docker Compose
 toc: true
 weight: 100
-docs: DOCS-1653
+nd-docs: DOCS-1653
 type:
 - task
 ---
@@ -30,9 +30,9 @@ Before you begin, make sure you have the following:
 - [Docker](https://docs.docker.com/get-docker/) installed on your system.
 - A JSON Web Token (JWT) from your [MyF5 subscriptions page](https://my.f5.com/manage/s/subscriptions). This is the same token used for NGINX Plus.
 - The right `docker-compose.yaml` file for your setup:
-  - For **standard mode** (with metrics and dashboards):  
+  - For **standard mode** (with metrics and dashboards):
     {{<fa "download">}} {{<link "/scripts/docker-compose/docker-compose.yaml" "Download the standard docker-compose.yaml file">}}
-  - For **lightweight mode** (no ClickHouse, no metrics):  
+  - For **lightweight mode** (no ClickHouse, no metrics):
     {{<fa "download">}} {{<link "/scripts/docker-compose/docker-compose-lightweight.yaml" "Download the lightweight docker-compose.yaml file">}}
 
 {{< note >}} If you're not sure which one to use, start with lightweight mode. You can always switch later by changing the Compose file and setting `ENABLE_METRICS: "true"`.{{< /note >}}
diff --git a/content/nim/deploy/docker/deploy-nginx-plus-and-agent-docker.md b/content/nim/deploy/docker/deploy-nginx-plus-and-agent-docker.md
index 2b7b654e0..3052e20bb 100644
--- a/content/nim/deploy/docker/deploy-nginx-plus-and-agent-docker.md
+++ b/content/nim/deploy/docker/deploy-nginx-plus-and-agent-docker.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1654
+nd-docs: DOCS-1654
 title: Deploy NGINX Plus in a container (data plane)
 toc: true
 weight: 200
diff --git a/content/nim/deploy/infrastructure-as-code/build-and-deploy.md b/content/nim/deploy/infrastructure-as-code/build-and-deploy.md
index 1a954b2ef..f54fc9dbd 100644
--- a/content/nim/deploy/infrastructure-as-code/build-and-deploy.md
+++ b/content/nim/deploy/infrastructure-as-code/build-and-deploy.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1247
+nd-docs: DOCS-1247
 title: Build and deploy images
 toc: true
 weight: 300
diff --git a/content/nim/deploy/infrastructure-as-code/configuration.md b/content/nim/deploy/infrastructure-as-code/configuration.md
index e08878763..51c43dee3 100644
--- a/content/nim/deploy/infrastructure-as-code/configuration.md
+++ b/content/nim/deploy/infrastructure-as-code/configuration.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1248
+nd-docs: DOCS-1248
 title: Install with Ansible
 toc: true
 weight: 200
diff --git a/content/nim/deploy/infrastructure-as-code/overview.md b/content/nim/deploy/infrastructure-as-code/overview.md
index b02761dcb..8c20eb32a 100644
--- a/content/nim/deploy/infrastructure-as-code/overview.md
+++ b/content/nim/deploy/infrastructure-as-code/overview.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1249
+nd-docs: DOCS-1249
 title: Overview
 toc: true
 weight: 100
diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md
index dab74919c..4a0b53a8b 100644
--- a/content/nim/deploy/kubernetes/deploy-using-helm.md
+++ b/content/nim/deploy/kubernetes/deploy-using-helm.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1651
+nd-docs: DOCS-1651
 title: Deploy using Helm
 toc: true
 weight: 100
@@ -18,7 +18,7 @@ Starting with version 2.20.0, NGINX Instance Manager supports **lightweight mode
 - Lightweight mode requires NGINX Agent v2.41.1 or later.
 
 {{< call-out "note" "Chart renamed in NIM 2.20.0" >}}
-The Helm chart has been renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`.  
+The Helm chart has been renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`.
 Make sure to update your chart references if you’re using version 2.20.0 or later.
 {{< /call-out >}}
 
@@ -187,7 +187,7 @@ These values are required when pulling images from the NGINX private registry. T
 Use the file with the `-f values.yaml` flag when installing the chart.
 
 {{< call-out "note" "OpenShift support" >}}
-OpenShift support was added in NGINX Instance Manager 2.19. To enable it, add the setting `openshift.enabled: true` to your `values.yaml` file.  
+OpenShift support was added in NGINX Instance Manager 2.19. To enable it, add the setting `openshift.enabled: true` to your `values.yaml` file.
 For more details, see [Appendix: OpenShift security constraints](#appendix-openshift-security-constraints).
 {{< /call-out >}}
 
diff --git a/content/nim/deploy/kubernetes/frequently-used-helm-configs.md b/content/nim/deploy/kubernetes/frequently-used-helm-configs.md
index 05d450a93..6b14a83cb 100644
--- a/content/nim/deploy/kubernetes/frequently-used-helm-configs.md
+++ b/content/nim/deploy/kubernetes/frequently-used-helm-configs.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1275
+nd-docs: DOCS-1275
 title: Frequently used Helm configurations
 toc: true
 weight: 400
diff --git a/content/nim/deploy/kubernetes/helm-config-settings.md b/content/nim/deploy/kubernetes/helm-config-settings.md
index dd6a66d7e..784c8df62 100644
--- a/content/nim/deploy/kubernetes/helm-config-settings.md
+++ b/content/nim/deploy/kubernetes/helm-config-settings.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1112
+nd-docs: DOCS-1112
 title: Configurable helm settings
 toc: true
 weight: 300
@@ -77,7 +77,7 @@ To update an existing release, run `helm upgrade` with the `-f <my-values-file>`
 | `nim.dpm.name`                              | Name for `dpm` resources.                                                                                                                                                                                                                                                | `dpm`      |
 | `nim.dpm.image.repository`                  | Repository path for the `dpm` image.                                                                                                                                                                                                                                      | `dpm`      |
 | `nim.dpm.image.tag`                         | Tag used for pulling `dpm` images.                                                                                                                                                                                                                                        | `latest`   |
-| `nim.dpm.image.pullPolicy`                  | Image pull policy.                                                                                                                                                                                                                                                                                                     | `IfNotPresent`|   
+| `nim.dpm.image.pullPolicy`                  | Image pull policy.                                                                                                                                                                                                                                                                                                     | `IfNotPresent`|
 | `nim.dpm.container.port.http`               | Container HTTP port.                                                                                                                                                                                                                                                      | `8034`     |
 | `nim.dpm.container.port.nats`               | Container NATS port.                                                                                                                                                                                                                                                      | `9100`     |
 | `nim.dpm.container.port.db`                 | Container database port.                                                                                                                                                                                                                                                  | `7890`     |
diff --git a/content/nim/deploy/vm-bare-metal/install-nim-manual.md b/content/nim/deploy/vm-bare-metal/install-nim-manual.md
index 3c8e956c0..f486ee71b 100644
--- a/content/nim/deploy/vm-bare-metal/install-nim-manual.md
+++ b/content/nim/deploy/vm-bare-metal/install-nim-manual.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1211
+nd-docs: DOCS-1211
 title: Manually install any version of NGINX Instance Manager
 toc: true
 weight: 10
diff --git a/content/nim/disconnected/add-license-disconnected-deployment.md b/content/nim/disconnected/add-license-disconnected-deployment.md
index 1039852aa..4072d3608 100644
--- a/content/nim/disconnected/add-license-disconnected-deployment.md
+++ b/content/nim/disconnected/add-license-disconnected-deployment.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 200
 toc: true
-docs: DOCS-1657
+nd-docs: DOCS-1657
 personas:
 - devops
 - netops
@@ -107,7 +107,7 @@ Run these `curl` commands on a system that can access NGINX Instance Manager and
     ```
 
 1. **Poll the license status on NGINX Instance Manager**:
-   
+
    Use this command to check the current license status. Look for `INITIALIZE_ACTIVATION_COMPLETE` or `CONFIG_REPORT_READY` in the status field. Poll periodically if necessary.
 
     ```bash
@@ -217,7 +217,7 @@ To add a license:
 
 Download the initial usage report to send to F5:
 
-- On the **License > Overview** page, select **Download License Report**. 
+- On the **License > Overview** page, select **Download License Report**.
 
 
 #### Submit usage report to F5
@@ -230,7 +230,7 @@ To upload the the usage acknowledgement:
 
 1. On the **License > Overview** page, select **Upload Usage Acknowledgement**.
 2. Upload the acknowledgement by selecting **Browse** or dragging the file into the form.
-3. Select **Add**. 
+3. Select **Add**.
 
 {{%/tab%}}
 
diff --git a/content/nim/disconnected/offline-install-guide-manual.md b/content/nim/disconnected/offline-install-guide-manual.md
index 13456b043..f86873880 100644
--- a/content/nim/disconnected/offline-install-guide-manual.md
+++ b/content/nim/disconnected/offline-install-guide-manual.md
@@ -5,7 +5,7 @@ toc: true
 noindex: true
 type: how-to
 product: NIM
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 ## Overview
diff --git a/content/nim/disconnected/offline-install-guide.md b/content/nim/disconnected/offline-install-guide.md
index 6dda33a5d..c8dedfee6 100644
--- a/content/nim/disconnected/offline-install-guide.md
+++ b/content/nim/disconnected/offline-install-guide.md
@@ -4,7 +4,7 @@ toc: true
 weight: 100
 type: how-to
 product: NIM
-docs: DOCS-803
+nd-docs: DOCS-803
 ---
 
 {{< include "/nim/decoupling/note-legacy-nms-references.md" >}}
diff --git a/content/nim/disconnected/report-usage-disconnected-deployment.md b/content/nim/disconnected/report-usage-disconnected-deployment.md
index afe228b1a..9fecb335b 100644
--- a/content/nim/disconnected/report-usage-disconnected-deployment.md
+++ b/content/nim/disconnected/report-usage-disconnected-deployment.md
@@ -3,7 +3,7 @@ title: Report usage data to F5 (disconnected)
 draft: false
 weight: 300
 toc: true
-docs: DOCS-1658
+nd-docs: DOCS-1658
 personas:
 - devops
 - netops
@@ -89,11 +89,11 @@ Run these `curl` commands on a system that can access NGINX Instance Manager and
     --header 'accept: application/json' \
     --header 'authorization: Basic <base64-encoded-credentials>' \
     --header 'referer: https://<NIM-FQDN>/ui/settings/license'
-    ``` 
+    ```
 
 1. **Download the usage report from NGINX Instance Manager**:
 
-    ```bash  
+    ```bash
     curl -k --location 'https://<NIM-FQDN>/api/platform/v1/report/download?format=zip&reportType=telemetry&telemetryAction=download' \
     --header 'accept: */*' \
     --header 'authorization: Basic <base64-encoded-credentials>' \
@@ -153,7 +153,7 @@ Run these `curl` commands on a system that can access NGINX Instance Manager and
 
 Download the usage report to send to F5:
 
-- On the **License > Overview** page, select **Download License Report**. 
+- On the **License > Overview** page, select **Download License Report**.
 
 #### Submit usage report to F5
 
@@ -165,7 +165,7 @@ To upload the the usage acknowledgement:
 
 1. On the **License > Overview** page, select **Upload Usage Acknowledgement**.
 2. Upload the acknowledgement by selecting **Browse** or dragging the file into the form.
-3. Select **Add**. 
+3. Select **Add**.
 
 {{%/tab%}}
 
diff --git a/content/nim/fundamentals/api-overview.md b/content/nim/fundamentals/api-overview.md
index e462b57ee..9cd349c38 100644
--- a/content/nim/fundamentals/api-overview.md
+++ b/content/nim/fundamentals/api-overview.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-798
+nd-docs: DOCS-798
 title: 'Overview: NGINX Instance Manager REST API'
 toc: true
 weight: 400
diff --git a/content/nim/fundamentals/dashboard-overview.md b/content/nim/fundamentals/dashboard-overview.md
index 9bb4f28bc..79c518fc6 100644
--- a/content/nim/fundamentals/dashboard-overview.md
+++ b/content/nim/fundamentals/dashboard-overview.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1387
+nd-docs: DOCS-1387
 title: NGINX Instance Manager dashboard
 toc: true
 weight: 300
diff --git a/content/nim/fundamentals/tech-specs.md b/content/nim/fundamentals/tech-specs.md
index 685794aec..02110e4b3 100644
--- a/content/nim/fundamentals/tech-specs.md
+++ b/content/nim/fundamentals/tech-specs.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-805
+nd-docs: DOCS-805
 title: Technical Specifications
 toc: true
 weight: 20
diff --git a/content/nim/monitoring/catalogs/dimensions.md b/content/nim/monitoring/catalogs/dimensions.md
index 2f1a98970..b10ddbf83 100644
--- a/content/nim/monitoring/catalogs/dimensions.md
+++ b/content/nim/monitoring/catalogs/dimensions.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the Dimensions collected by NGINX Agent
-docs: DOCS-812
+nd-docs: DOCS-812
 title: Dimensions Catalog
 toc: true
 weight: 20
diff --git a/content/nim/monitoring/catalogs/events.md b/content/nim/monitoring/catalogs/events.md
index e6e5e8b62..35369f963 100644
--- a/content/nim/monitoring/catalogs/events.md
+++ b/content/nim/monitoring/catalogs/events.md
@@ -1,6 +1,6 @@
 ---
 description: Information about all of the Events collected by NGINX Controller Agent
-docs: DOCS-1132
+nd-docs: DOCS-1132
 title: Events Catalog
 toc: true
 weight: 20
diff --git a/content/nim/monitoring/catalogs/metrics.md b/content/nim/monitoring/catalogs/metrics.md
index 4e0bbd895..e4bf50997 100644
--- a/content/nim/monitoring/catalogs/metrics.md
+++ b/content/nim/monitoring/catalogs/metrics.md
@@ -1,6 +1,6 @@
 ---
 description: Information about all of the Metrics collected by NGINX Agent
-docs: DOCS-813
+nd-docs: DOCS-813
 title: Metrics Catalog
 toc: true
 weight: 20
diff --git a/content/nim/monitoring/metrics-api.md b/content/nim/monitoring/metrics-api.md
index 50f214b27..11a77201c 100644
--- a/content/nim/monitoring/metrics-api.md
+++ b/content/nim/monitoring/metrics-api.md
@@ -1,7 +1,7 @@
 ---
 description: Tips and tricks for using the Metrics API query parameters to refine
   your data.
-docs: DOCS-825
+nd-docs: DOCS-825
 title: Query the Metrics API
 toc: true
 weight: 200
diff --git a/content/nim/monitoring/overview-metrics.md b/content/nim/monitoring/overview-metrics.md
index 3697df3c2..71a974ed3 100644
--- a/content/nim/monitoring/overview-metrics.md
+++ b/content/nim/monitoring/overview-metrics.md
@@ -1,6 +1,6 @@
 ---
 description: Understanding how the NGINX Agent collects and reports metrics
-docs: DOCS-826
+nd-docs: DOCS-826
 title: 'Overview: NGINX instance metrics'
 toc: true
 weight: 100
diff --git a/content/nim/monitoring/view-events-metrics.md b/content/nim/monitoring/view-events-metrics.md
index 1c1a970c7..07eb41400 100644
--- a/content/nim/monitoring/view-events-metrics.md
+++ b/content/nim/monitoring/view-events-metrics.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to view events and metrics in F5 NGINX Instance Manager.
-docs: DOCS-847
+nd-docs: DOCS-847
 title: View events and metrics
 toc: true
 weight: 300
diff --git a/content/nim/nginx-app-protect/manage-waf-security-policies.md b/content/nim/nginx-app-protect/manage-waf-security-policies.md
index 5c0e5ebf3..e61e57280 100644
--- a/content/nim/nginx-app-protect/manage-waf-security-policies.md
+++ b/content/nim/nginx-app-protect/manage-waf-security-policies.md
@@ -5,7 +5,7 @@ weight: 300
 toc: true
 type: how-to
 product: NIM
-docs: DOCS-1105
+nd-docs: DOCS-1105
 ---
 
 ## Overview
@@ -32,14 +32,14 @@ Before continuing, complete the following steps:
 - [Set up App Protect WAF configuration management]({{< ref "setup-waf-config-management" >}})
 - Make sure your user account has the [required permissions]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}) to access the REST API:
 
-  - **Module**: Instance Manager  
-  - **Feature**: Instance Management → `READ`  
+  - **Module**: Instance Manager
+  - **Feature**: Instance Management → `READ`
   - **Feature**: Security Policies → `READ`, `CREATE`, `UPDATE`, `DELETE`
 
 To use policy bundles, you also need to:
 
-- Have `UPDATE` permissions for each referenced security policy  
-- [Install the correct `nms-nap-compiler` package]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}) for your App Protect WAF version  
+- Have `UPDATE` permissions for each referenced security policy
+- [Install the correct `nms-nap-compiler` package]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}) for your App Protect WAF version
 - [Install the required attack signatures and threat campaigns]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#set-up-attack-signatures-and-threat-campaigns" >}})
 
 ### Access the web interface
@@ -60,13 +60,13 @@ To access the web interface, open a browser and go to the fully qualified domain
 
 To create a security policy using the NGINX Instance Manager web interface:
 
-1. In your browser, go to the FQDN for your NGINX Instance Manager host and log in.  
-2. From the Launchpad menu, select **Instance Manager**.  
-3. In the left menu, select **App Protect**.  
-4. On the *Security Policies* page, select **Create**.  
+1. In your browser, go to the FQDN for your NGINX Instance Manager host and log in.
+2. From the Launchpad menu, select **Instance Manager**.
+3. In the left menu, select **App Protect**.
+4. On the *Security Policies* page, select **Create**.
 5. On the *Create Policy* page, enter the required information:
-   - **Name**: Enter a name for the policy.  
-   - **Description**: (Optional) Add a brief description.  
+   - **Name**: Enter a name for the policy.
+   - **Description**: (Optional) Add a brief description.
    - **Enter Policy**: Paste or type the JSON-formatted policy into the editor. The interface automatically validates the JSON.
 
     For help writing custom policies, see the [NGINX App Protect WAF Declarative Policy guide](https://docs.nginx.com/nginx-app-protect/declarative-policy/policy/) and the [Policy Authoring and Tuning section](https://docs.nginx.com/nginx-app-protect/configuration-guide/configuration/#policy-authoring-and-tuning) in the configuration guide.
@@ -197,9 +197,9 @@ After updating the policy, you can [publish it](#publish-policy) to selected ins
 
 To delete a security policy using the NGINX Instance Manager web interface:
 
-1. In your browser, go to the FQDN for your NGINX Instance Manager host and log in.  
-2. From the Launchpad menu, select **Instance Manager**.  
-3. In the left menu, select **App Protect**.  
+1. In your browser, go to the FQDN for your NGINX Instance Manager host and log in.
+2. From the Launchpad menu, select **Instance Manager**.
+3. In the left menu, select **App Protect**.
 4. On the *Security Policies* page, find the policy you want to delete.
 5. Select the **Actions** menu (**...**) and choose **Delete**.
 
@@ -615,7 +615,7 @@ To overwrite an existing security log profile:
     ```
 
 2. Use the UID in your PUT request:
-   
+
     ```shell
     curl -X PUT https://{{NIM_FQDN}}/api/platform/v1/security/logprofiles/<log-profile-uid> \
       -H "Authorization: Bearer <access token>" \
diff --git a/content/nim/nginx-app-protect/overview-nap-waf-config-management.md b/content/nim/nginx-app-protect/overview-nap-waf-config-management.md
index b0d31319f..d9367f8f3 100644
--- a/content/nim/nginx-app-protect/overview-nap-waf-config-management.md
+++ b/content/nim/nginx-app-protect/overview-nap-waf-config-management.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to use F5 NGINX Instance Manager to set up and manage NGINX App Protect WAF security policies.
-docs: DOCS-992
+nd-docs: DOCS-992
 title: "How WAF policy management works"
 toc: true
 weight: 100
@@ -16,9 +16,9 @@ Use NGINX Instance Manager with NGINX App Protect WAF to inspect incoming traffi
 
 ### Key features
 
-- Manage WAF policies using the NGINX Instance Manager web interface or REST API  
-- Update attack signature and threat campaign packages  
-- Compile WAF configurations into a binary bundle for deployment  
+- Manage WAF policies using the NGINX Instance Manager web interface or REST API
+- Update attack signature and threat campaign packages
+- Compile WAF configurations into a binary bundle for deployment
 
 ## Architecture
 
@@ -34,8 +34,8 @@ NGINX Instance Manager includes a compiler that packages your complete WAF confi
 
 **Why precompile with NGINX Instance Manager?**
 
-- Saves system resources on WAF instances  
-- Lets you reuse the same bundle across multiple instances  
+- Saves system resources on WAF instances
+- Lets you reuse the same bundle across multiple instances
 
 If you choose to compile policies on the WAF instance instead, that works too—but with this limitation:
 
@@ -62,10 +62,10 @@ NGINX Instance Manager and Security Monitoring both use log profiles, but their
 
 Use the NGINX Instance Manager REST API to automate updates across your NGINX App Protect WAF instances. You can use the API to manage:
 
-- Security policies  
-- Log profiles  
-- Attack signatures  
-- Threat campaigns  
+- Security policies
+- Log profiles
+- Attack signatures
+- Threat campaigns
 
 Just like with the web interface, the compiler creates a binary bundle with your updates that you can push to your WAF instances.
 
diff --git a/content/nim/nginx-app-protect/security-monitoring/give-access-to-security-monitoring-dashboards.md b/content/nim/nginx-app-protect/security-monitoring/give-access-to-security-monitoring-dashboards.md
index ffb2a1cfe..6d29edf1a 100644
--- a/content/nim/nginx-app-protect/security-monitoring/give-access-to-security-monitoring-dashboards.md
+++ b/content/nim/nginx-app-protect/security-monitoring/give-access-to-security-monitoring-dashboards.md
@@ -4,7 +4,7 @@ weight: 200
 toc: true
 type: how-to
 product: NIM
-docs: DOCS-1026
+nd-docs: DOCS-1026
 ---
 
 ## Overview
diff --git a/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md b/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md
index 2a70c574d..2c8408899 100644
--- a/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md
+++ b/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: how-to
 product: NIM
-docs: DOCS-1107
+nd-docs: DOCS-1107
 ---
 
 ## Overview
diff --git a/content/nim/nginx-app-protect/security-monitoring/troubleshooting.md b/content/nim/nginx-app-protect/security-monitoring/troubleshooting.md
index e4dbabbfc..53ea1dc75 100644
--- a/content/nim/nginx-app-protect/security-monitoring/troubleshooting.md
+++ b/content/nim/nginx-app-protect/security-monitoring/troubleshooting.md
@@ -4,7 +4,7 @@ weight: 500
 toc: true
 type: how-to
 product: NIM
-docs: DOCS-1226
+nd-docs: DOCS-1226
 ---
 
 ## Security event log backup with Security Monitoring
diff --git a/content/nim/nginx-app-protect/security-monitoring/update-geo-db.md b/content/nim/nginx-app-protect/security-monitoring/update-geo-db.md
index 72bee1780..e69adae06 100644
--- a/content/nim/nginx-app-protect/security-monitoring/update-geo-db.md
+++ b/content/nim/nginx-app-protect/security-monitoring/update-geo-db.md
@@ -4,7 +4,7 @@ weight: 400
 toc: true
 type: how-to
 product: NIM
-docs: DOCS-1108
+nd-docs: DOCS-1108
 ---
 
 ## Overview
diff --git a/content/nim/nginx-app-protect/security-monitoring/update-signatures.md b/content/nim/nginx-app-protect/security-monitoring/update-signatures.md
index a5f2abf96..38fd42b74 100644
--- a/content/nim/nginx-app-protect/security-monitoring/update-signatures.md
+++ b/content/nim/nginx-app-protect/security-monitoring/update-signatures.md
@@ -4,7 +4,7 @@ weight: 300
 toc: true
 type: how-to
 product: NIM
-docs: DOCS-1109
+nd-docs: DOCS-1109
 ---
 
 ## Overview
diff --git a/content/nim/nginx-app-protect/setup-waf-config-management.md b/content/nim/nginx-app-protect/setup-waf-config-management.md
index 3fab29ebe..e8d2fb671 100644
--- a/content/nim/nginx-app-protect/setup-waf-config-management.md
+++ b/content/nim/nginx-app-protect/setup-waf-config-management.md
@@ -5,7 +5,7 @@ toc: true
 description: Learn how to set up F5 NGINX Instance Manager to manage NGINX App Protect WAF configurations, including compiler installation, security policy onboarding, and threat update management.
 type: how-to
 product: NIM
-docs: DOCS-996
+nd-docs: DOCS-996
 ---
 
 ## Overview
@@ -114,7 +114,7 @@ To install the WAF compiler on RHEL 8.1 or later:
    ```
 
 3. Install the WAF compiler:
-   
+
    ```shell
    sudo yum install nms-nap-compiler-v5.342.0
    ```
@@ -184,7 +184,7 @@ To install the WAF compiler on Oracle Linux 7.4 or later:
    ```
 
 2. Enable the `ol8_codeready_builder` repository:
-   
+
    ```shell
    sudo yum-config-manager --enable ol8_codeready_builder
    ```
@@ -751,7 +751,7 @@ To upload a policy, follow these steps:
    ```
 
 2. Create a JSON request that includes the base64-encoded policy from step 1 as the value for the `content` field.
-   
+
    Replace the example string below with the actual base64-encoded output you generated.
 
     ```json
@@ -898,7 +898,7 @@ You can use the NGINX Instance Manager REST API to deploy your NGINX App Protect
         ```nginx
         app_protect_enable on;
         ```
-    
+
     - If precompiled publication is enabled, change any `.json` policy references to `.tgz`.
     - If you want to apply a default policy, you can use:
 
diff --git a/content/nim/nginx-configs/config-templates/concepts/augment-templates.md b/content/nim/nginx-configs/config-templates/concepts/augment-templates.md
index c829b410b..c57504ec8 100644
--- a/content/nim/nginx-configs/config-templates/concepts/augment-templates.md
+++ b/content/nim/nginx-configs/config-templates/concepts/augment-templates.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 120
 toc: true
-docs: DOCS-1656
+nd-docs: DOCS-1656
 personas:
 - devops
 - netops
diff --git a/content/nim/nginx-configs/config-templates/concepts/config-templates.md b/content/nim/nginx-configs/config-templates/concepts/config-templates.md
index 1e0f48fa6..3f68f874e 100644
--- a/content/nim/nginx-configs/config-templates/concepts/config-templates.md
+++ b/content/nim/nginx-configs/config-templates/concepts/config-templates.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 100
 toc: true
-docs: DOCS-1502
+nd-docs: DOCS-1502
 personas:
 - devops
 - netops
diff --git a/content/nim/nginx-configs/config-templates/concepts/default-base-template.md b/content/nim/nginx-configs/config-templates/concepts/default-base-template.md
index d05fe83c6..df483f03b 100644
--- a/content/nim/nginx-configs/config-templates/concepts/default-base-template.md
+++ b/content/nim/nginx-configs/config-templates/concepts/default-base-template.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 110
 toc: true
-docs: DOCS-1503
+nd-docs: DOCS-1503
 personas:
 - devops
 - netops
diff --git a/content/nim/nginx-configs/config-templates/concepts/template-resources.md b/content/nim/nginx-configs/config-templates/concepts/template-resources.md
index 71e9eee82..e9b9c0cd9 100644
--- a/content/nim/nginx-configs/config-templates/concepts/template-resources.md
+++ b/content/nim/nginx-configs/config-templates/concepts/template-resources.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 200
 toc: true
-docs: DOCS-1501
+nd-docs: DOCS-1501
 personas:
 - devops
 - netops
diff --git a/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md b/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md
index fc850509c..82e1d4e4b 100644
--- a/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md
+++ b/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 200
 toc: true
-docs: DOCS-1506
+nd-docs: DOCS-1506
 personas:
 - devops
 - netops
diff --git a/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md b/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md
index 91ede35ae..f39d78bed 100644
--- a/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md
+++ b/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 300
 toc: true
-docs: DOCS-1505
+nd-docs: DOCS-1505
 personas:
 - devops
 - netops
diff --git a/content/nim/nginx-configs/config-templates/reference/json-schema-reference.md b/content/nim/nginx-configs/config-templates/reference/json-schema-reference.md
index 79993f8f6..60ecf04d6 100644
--- a/content/nim/nginx-configs/config-templates/reference/json-schema-reference.md
+++ b/content/nim/nginx-configs/config-templates/reference/json-schema-reference.md
@@ -4,7 +4,7 @@ draft: false
 description: ''
 weight: 300
 toc: true
-docs: DOCS-1504
+nd-docs: DOCS-1504
 personas:
 - devops
 - netops
diff --git a/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md b/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md
index 4f8a3412c..a0c4dd1c9 100644
--- a/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md
+++ b/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md
@@ -5,7 +5,7 @@ description: Learn how to set up a round-robin reverse proxy using NGINX Instanc
   Manager with base and augment templates.
 weight: 100
 toc: true
-docs: DOCS-1655
+nd-docs: DOCS-1655
 type:
 - tutorial
 ---
diff --git a/content/nim/nginx-configs/publish-configs-version-control.md b/content/nim/nginx-configs/publish-configs-version-control.md
index 062bd3479..d093490fa 100644
--- a/content/nim/nginx-configs/publish-configs-version-control.md
+++ b/content/nim/nginx-configs/publish-configs-version-control.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1348
+nd-docs: DOCS-1348
 title: Publish NGINX configs with version control
 toc: true
 weight: 3
diff --git a/content/nim/nginx-configs/publish-configs.md b/content/nim/nginx-configs/publish-configs.md
index 4bf6e6b37..8bae0b153 100644
--- a/content/nim/nginx-configs/publish-configs.md
+++ b/content/nim/nginx-configs/publish-configs.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-822
+nd-docs: DOCS-822
 title: Publish NGINX configs
 toc: true
 weight: 2
diff --git a/content/nim/nginx-configs/stage-configs.md b/content/nim/nginx-configs/stage-configs.md
index 9ef7d9e3d..04d1805e4 100644
--- a/content/nim/nginx-configs/stage-configs.md
+++ b/content/nim/nginx-configs/stage-configs.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1277
+nd-docs: DOCS-1277
 title: Stage NGINX configs
 toc: true
 weight: 1
diff --git a/content/nim/nginx-instances/add-tags.md b/content/nim/nginx-instances/add-tags.md
index 4d67afe16..db7f69286 100644
--- a/content/nim/nginx-instances/add-tags.md
+++ b/content/nim/nginx-instances/add-tags.md
@@ -1,6 +1,6 @@
 ---
 description: Follow the steps in this guide to create tags for organizing your instances.
-docs: DOCS-829
+nd-docs: DOCS-829
 title: Organize instances with tags
 toc: true
 weight: 650
diff --git a/content/nim/nginx-instances/manage-certificates.md b/content/nim/nginx-instances/manage-certificates.md
index d09f6ba36..6ade72cdb 100644
--- a/content/nim/nginx-instances/manage-certificates.md
+++ b/content/nim/nginx-instances/manage-certificates.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-821
+nd-docs: DOCS-821
 title: Manage SSL certificates
 toc: true
 weight: 650
diff --git a/content/nim/nginx-instances/manage-instance-groups.md b/content/nim/nginx-instances/manage-instance-groups.md
index 9f9fd8d39..955fb8d74 100644
--- a/content/nim/nginx-instances/manage-instance-groups.md
+++ b/content/nim/nginx-instances/manage-instance-groups.md
@@ -2,7 +2,7 @@
 description: Learn how to use F5 NGINX Management Suite Instance Manager to create
   instance groups, which you can use to manage multiple NGINX instances as a single
   entity.
-docs: DOCS-935
+nd-docs: DOCS-935
 title: Create and manage instance groups
 toc: true
 weight: 600
diff --git a/content/nim/nginx-instances/scan-instances.md b/content/nim/nginx-instances/scan-instances.md
index 79d65505e..6a2b996ab 100644
--- a/content/nim/nginx-instances/scan-instances.md
+++ b/content/nim/nginx-instances/scan-instances.md
@@ -1,6 +1,6 @@
 ---
 description: Follow the steps in this guide to scan for and discover NGINX instances.
-docs: DOCS-828
+nd-docs: DOCS-828
 title: Scan and discover NGINX instances
 toc: true
 weight: 110
diff --git a/content/nim/releases/known-issues.md b/content/nim/releases/known-issues.md
index b45a829c8..38f2f929a 100644
--- a/content/nim/releases/known-issues.md
+++ b/content/nim/releases/known-issues.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-937
+nd-docs: DOCS-937
 type: reference
 title: Known issues
 toc: true
diff --git a/content/nim/releases/release-notes.md b/content/nim/releases/release-notes.md
index 0b0cbd200..04c0e8983 100644
--- a/content/nim/releases/release-notes.md
+++ b/content/nim/releases/release-notes.md
@@ -4,7 +4,7 @@ weight: 100
 toc: true
 type: reference
 product: NIM
-docs: DOCS-938
+nd-docs: DOCS-938
 ---
 
 The release notes for F5 NGINX Instance Manager highlight the latest features, improvements, and bug fixes in each release. This document helps you stay up to date with the changes and enhancements introduced to improve stability, performance, and usability. For each version, you’ll find details about new features, known issues, and resolved problems, ensuring you get the most out of your NGINX instance management experience.
diff --git a/content/nim/support/contact-support.md b/content/nim/support/contact-support.md
index 9b3517c8b..b31dcb1bd 100644
--- a/content/nim/support/contact-support.md
+++ b/content/nim/support/contact-support.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-817
+nd-docs: DOCS-817
 title: Where to go for support
 toc: true
 weight: 300
diff --git a/content/nim/support/k8s-support-package.md b/content/nim/support/k8s-support-package.md
index 3f4aee827..d5d163e2a 100644
--- a/content/nim/support/k8s-support-package.md
+++ b/content/nim/support/k8s-support-package.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1123
+nd-docs: DOCS-1123
 title: Create a support package from a Helm installation
 toc: true
 weight: 200
diff --git a/content/nim/support/support-package.md b/content/nim/support/support-package.md
index eeeda2e74..3d1472a66 100644
--- a/content/nim/support/support-package.md
+++ b/content/nim/support/support-package.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-818
+nd-docs: DOCS-818
 title: Create a support package
 toc: true
 weight: 200
diff --git a/content/nim/system-configuration/configure-clickhouse.md b/content/nim/system-configuration/configure-clickhouse.md
index 2e2990d21..5f46af1a9 100644
--- a/content/nim/system-configuration/configure-clickhouse.md
+++ b/content/nim/system-configuration/configure-clickhouse.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-998
+nd-docs: DOCS-998
 title: Configure ClickHouse
 toc: true
 weight: 100
@@ -12,7 +12,7 @@ type:
 
 ## Overview
 
-NGINX Instance Manager uses ClickHouse to store metrics, events, alerts, and configuration data.  
+NGINX Instance Manager uses ClickHouse to store metrics, events, alerts, and configuration data.
 If your setup differs from the default configuration — for example, if you use a custom address, enable TLS, set a password, or turn off metrics — you need to update the `/etc/nms/nms.conf` file.
 
 This guide explains how to update those settings so that NGINX Instance Manager can connect to ClickHouse correctly.
@@ -43,7 +43,7 @@ Starting in version 2.20, NGINX Instance Manager can run without ClickHouse. Thi
 To disable metrics collection after installing NGINX Instance Manager:
 
 1. Open the config file at `/etc/nms/nms.conf`.
-   
+
 2. In the `[clickhouse]` section, set the following value:
 
    ```yaml
diff --git a/content/nim/system-configuration/configure-gateway.md b/content/nim/system-configuration/configure-gateway.md
index d3a5feb10..186ad6c73 100644
--- a/content/nim/system-configuration/configure-gateway.md
+++ b/content/nim/system-configuration/configure-gateway.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1131
+nd-docs: DOCS-1131
 title: Optimize NGINX proxy gateway for large data planes
 toc: true
 weight: 400
@@ -17,7 +17,7 @@ If the NGINX proxy gateway for F5 NGINX Instance Manager alerts you that there a
 
 ## Configure worker connections
 
-By default, the NGINX Instance Manager's NGINX configuration allows 1,024 worker connections (`worker_connections`). However, this default may not be sufficient for large data planes with numerous NGINX Agents. 
+By default, the NGINX Instance Manager's NGINX configuration allows 1,024 worker connections (`worker_connections`). However, this default may not be sufficient for large data planes with numerous NGINX Agents.
 
 We recommend allowing **twice as many worker connections as the number of NGINX Agents** you need to support. Each NGINX Agent requires two persistent gRPC connections to the NGINX Instance Manager host. For example, if you have 1,000 NGINX Agents, configure approximately 2,000 worker connections.
 
diff --git a/content/nim/system-configuration/configure-selinux.md b/content/nim/system-configuration/configure-selinux.md
index b9aa07184..533059eab 100644
--- a/content/nim/system-configuration/configure-selinux.md
+++ b/content/nim/system-configuration/configure-selinux.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-796
+nd-docs: DOCS-796
 title: Configure SELinux
 toc: true
 weight: 250
diff --git a/content/nim/system-configuration/configure-telemetry.md b/content/nim/system-configuration/configure-telemetry.md
index afdf834b8..7ae48867e 100644
--- a/content/nim/system-configuration/configure-telemetry.md
+++ b/content/nim/system-configuration/configure-telemetry.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1269
+nd-docs: DOCS-1269
 title: Configure telemetry and web analytics
 toc: true
 weight: 260
diff --git a/content/nim/system-configuration/configure-vault.md b/content/nim/system-configuration/configure-vault.md
index 5f61cd308..4c3c1dc5c 100644
--- a/content/nim/system-configuration/configure-vault.md
+++ b/content/nim/system-configuration/configure-vault.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-999
+nd-docs: DOCS-999
 title: Use Vault for storing secrets
 toc: true
 weight: 200
diff --git a/content/nim/system-configuration/configure-with-config.md b/content/nim/system-configuration/configure-with-config.md
index 18db798ca..063078d95 100644
--- a/content/nim/system-configuration/configure-with-config.md
+++ b/content/nim/system-configuration/configure-with-config.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-1100
+nd-docs: DOCS-1100
 title: Configure settings with nms.conf
 toc: true
 weight: 1
diff --git a/content/nim/system-configuration/secure-traffic.md b/content/nim/system-configuration/secure-traffic.md
index a4d03c4bf..3e361c605 100644
--- a/content/nim/system-configuration/secure-traffic.md
+++ b/content/nim/system-configuration/secure-traffic.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-794
+nd-docs: DOCS-794
 title: Secure client access and network traffic
 toc: true
 weight: 600
diff --git a/content/nim/troubleshooting.md b/content/nim/troubleshooting.md
index 74aa9cf5a..79a5c0882 100644
--- a/content/nim/troubleshooting.md
+++ b/content/nim/troubleshooting.md
@@ -1,7 +1,7 @@
 ---
 description: This topic describes possible issues users might encounter when using
   Instance Manager. When possible, suggested workarounds are provided.
-docs: DOCS-1224
+nd-docs: DOCS-1224
 title: Troubleshooting
 toc: true
 weight: 1000
diff --git a/content/nms/about.md b/content/nms/about.md
index 544c18e96..2ac836d2f 100644
--- a/content/nms/about.md
+++ b/content/nms/about.md
@@ -7,7 +7,7 @@ description: F5 NGINX Management Suite brings together advanced features into a
 weight: 10
 toc: true
 type: concept
-docs: DOCS-905
+nd-docs: DOCS-905
 ---
 
 Explore the topics below to find out what the F5 NGINX Management Suite modules have to offer.
diff --git a/content/nms/acm/about/api-overview.md b/content/nms/acm/about/api-overview.md
index d3089ebce..6b89733bf 100644
--- a/content/nms/acm/about/api-overview.md
+++ b/content/nms/acm/about/api-overview.md
@@ -1,7 +1,7 @@
 ---
 description: This topic gives an overview of the F5 NGINX Management Suite API Connectivity
   Manager API.
-docs: DOCS-929
+nd-docs: DOCS-929
 title: API Overview
 toc: true
 weight: 300
diff --git a/content/nms/acm/about/architecture.md b/content/nms/acm/about/architecture.md
index 9a8ac68ac..d1d6a0e24 100644
--- a/content/nms/acm/about/architecture.md
+++ b/content/nms/acm/about/architecture.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the F5 NGINX Management Suite API Connectivity Manager architecture.
-docs: DOCS-892
+nd-docs: DOCS-892
 title: Architecture Overview
 toc: true
 weight: 400
diff --git a/content/nms/acm/about/introduction.md b/content/nms/acm/about/introduction.md
index fab861c3d..519fc340d 100644
--- a/content/nms/acm/about/introduction.md
+++ b/content/nms/acm/about/introduction.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1385
+nd-docs: DOCS-1385
 title: Introduction
 weight: 100
 ---
diff --git a/content/nms/acm/about/policies-overview.md b/content/nms/acm/about/policies-overview.md
index 04dbc0c88..6ee79a117 100644
--- a/content/nms/acm/about/policies-overview.md
+++ b/content/nms/acm/about/policies-overview.md
@@ -1,7 +1,7 @@
 ---
 description: Learn about the policies available for use in F5 NGINX Management Suite
   API Connectivity Manager.
-docs: DOCS-932
+nd-docs: DOCS-932
 title: Available Policies
 toc: true
 weight: 500
diff --git a/content/nms/acm/about/rbac-roles.md b/content/nms/acm/about/rbac-roles.md
index c42a585fa..93c3935a7 100644
--- a/content/nms/acm/about/rbac-roles.md
+++ b/content/nms/acm/about/rbac-roles.md
@@ -1,7 +1,7 @@
 ---
 title: "RBAC roles"
 weight: 600
-docs: "DOCS-1667"
+nd-docs: "DOCS-1667"
 ---
 
 ## Built-In Roles
diff --git a/content/nms/acm/about/technical-specifications.md b/content/nms/acm/about/technical-specifications.md
index 6dc89dd94..412bb7715 100644
--- a/content/nms/acm/about/technical-specifications.md
+++ b/content/nms/acm/about/technical-specifications.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1470
+nd-docs: DOCS-1470
 title: Technical Specifications
 weight: 200
 ---
diff --git a/content/nms/acm/getting-started/add-api-gateway.md b/content/nms/acm/getting-started/add-api-gateway.md
index 05c2c2cce..d04a0aec8 100644
--- a/content/nms/acm/getting-started/add-api-gateway.md
+++ b/content/nms/acm/getting-started/add-api-gateway.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   configure an API Gateway.
-docs: DOCS-921
+nd-docs: DOCS-921
 title: Set Up an API Gateway Environment
 toc: true
 weight: 100
diff --git a/content/nms/acm/getting-started/add-devportal.md b/content/nms/acm/getting-started/add-devportal.md
index e209f982c..ffee41ea3 100644
--- a/content/nms/acm/getting-started/add-devportal.md
+++ b/content/nms/acm/getting-started/add-devportal.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   configure a Developer Portal.
-docs: DOCS-922
+nd-docs: DOCS-922
 title: Set Up a Developer Portal Environment
 toc: true
 weight: 200
diff --git a/content/nms/acm/getting-started/overview.md b/content/nms/acm/getting-started/overview.md
index 49e8ccb3d..f33ab2840 100644
--- a/content/nms/acm/getting-started/overview.md
+++ b/content/nms/acm/getting-started/overview.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to get up and running with F5 NGINX Management Suite API Connectivity
   Manager.
-docs: DOCS-939
+nd-docs: DOCS-939
 title: Get Started
 toc: true
 weight: 10
diff --git a/content/nms/acm/getting-started/publish-api-proxy.md b/content/nms/acm/getting-started/publish-api-proxy.md
index 77b9eda10..065325158 100644
--- a/content/nms/acm/getting-started/publish-api-proxy.md
+++ b/content/nms/acm/getting-started/publish-api-proxy.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   publish an API Proxy.
-docs: DOCS-923
+nd-docs: DOCS-923
 title: Publish an API Proxy
 toc: true
 weight: 300
diff --git a/content/nms/acm/how-to/backup-recovery.md b/content/nms/acm/how-to/backup-recovery.md
index 77452a614..98ae2f239 100644
--- a/content/nms/acm/how-to/backup-recovery.md
+++ b/content/nms/acm/how-to/backup-recovery.md
@@ -1,7 +1,7 @@
 ---
 title: "Back up and recovery"
 toc: true
-docs: "DOCS-1668"
+nd-docs: "DOCS-1668"
 ---
 
 ## Overview
diff --git a/content/nms/acm/how-to/deploy-api-connectivity-manager.md b/content/nms/acm/how-to/deploy-api-connectivity-manager.md
index 70e2dd054..d0b54903e 100644
--- a/content/nms/acm/how-to/deploy-api-connectivity-manager.md
+++ b/content/nms/acm/how-to/deploy-api-connectivity-manager.md
@@ -1,7 +1,7 @@
 ---
 description: The guide provides step-by-step instructions to deploy F5 NGINX API Connectivity
   Manager on Kubernetes using a Helm chart.
-docs: DOCS-1276
+nd-docs: DOCS-1276
 title: Deploy API Connectivity Manager on Kubernetes
 toc: true
 weight: 20
diff --git a/content/nms/acm/how-to/devportals/devportal-support-package.md b/content/nms/acm/how-to/devportals/devportal-support-package.md
index 96bc5f35a..a155cc0e9 100644
--- a/content/nms/acm/how-to/devportals/devportal-support-package.md
+++ b/content/nms/acm/how-to/devportals/devportal-support-package.md
@@ -1,7 +1,7 @@
 ---
 description: This guide explains how to generate a support package for troubleshooting
   error scenarios.
-docs: DOCS-1259
+nd-docs: DOCS-1259
 title: Create an NGINX Developer Portal Support Package
 toc: true
 weight: 300
diff --git a/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md b/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md
index 8a0056786..0fde20a0e 100644
--- a/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md
+++ b/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md
@@ -1,7 +1,7 @@
 ---
 description: 'This guide lists and describes the parameters you can set when deploying
   the Developer Portal from a Helm chart. '
-docs: DOCS-1171
+nd-docs: DOCS-1171
 title: Deployment Options for Developer Portal Helm
 toc: true
 weight: 25
diff --git a/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md b/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md
index 4ac539659..1ad7e99db 100644
--- a/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md
+++ b/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md
@@ -1,7 +1,7 @@
 ---
 description: Follow the steps in the guide to deploy the API Connectivity Manager
   Developer Portal to Kubernetes using a Helm chart.
-docs: DOCS-1110
+nd-docs: DOCS-1110
 title: Deploy the Developer Portal from a Helm chart
 toc: true
 weight: 20
diff --git a/content/nms/acm/how-to/devportals/installation/install-dev-portal.md b/content/nms/acm/how-to/devportals/installation/install-dev-portal.md
index aee4305b4..25262a947 100644
--- a/content/nms/acm/how-to/devportals/installation/install-dev-portal.md
+++ b/content/nms/acm/how-to/devportals/installation/install-dev-portal.md
@@ -1,7 +1,7 @@
 ---
 description: Follow the steps in this guide to install or upgrade the Developer Portal
   for F5 NGINX Management Suite API Connectivity Manager.
-docs: DOCS-1214
+nd-docs: DOCS-1214
 title: Install or Upgrade the Developer Portal
 toc: true
 weight: 10
diff --git a/content/nms/acm/how-to/devportals/installation/install-devportal-offline.md b/content/nms/acm/how-to/devportals/installation/install-devportal-offline.md
index f5d4f8a12..2d3f58eeb 100644
--- a/content/nms/acm/how-to/devportals/installation/install-devportal-offline.md
+++ b/content/nms/acm/how-to/devportals/installation/install-devportal-offline.md
@@ -1,7 +1,7 @@
 ---
 description: Complete the steps in this guide to install the Developer Portal directly
   from package files in environments without Internet access.
-docs: DOCS-1215
+nd-docs: DOCS-1215
 title: Install the Developer Portal in an Offline Environment
 toc: true
 weight: 30
diff --git a/content/nms/acm/how-to/devportals/publish-to-devportal.md b/content/nms/acm/how-to/devportals/publish-to-devportal.md
index 8e81b40e2..639cb8c99 100644
--- a/content/nms/acm/how-to/devportals/publish-to-devportal.md
+++ b/content/nms/acm/how-to/devportals/publish-to-devportal.md
@@ -2,7 +2,7 @@
 description: This document provides instructions on how to publish API documentation
   and API proxies to a Developer Portal in order to make them available at a designated
   hostname.
-docs: DOCS-1082
+nd-docs: DOCS-1082
 title: Publish Docs to a Developer Portal
 toc: true
 weight: 200
diff --git a/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md b/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md
index 47b90144b..f45986532 100644
--- a/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md
+++ b/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to support various deployment patterns for Developer Portal.
-docs: DOCS-955
+nd-docs: DOCS-955
 title: Deployment Patterns for Developer Portal
 toc: true
 weight: 200
diff --git a/content/nms/acm/how-to/infrastructure/customize-devportal.md b/content/nms/acm/how-to/infrastructure/customize-devportal.md
index 342c753d1..b7c9a31e7 100644
--- a/content/nms/acm/how-to/infrastructure/customize-devportal.md
+++ b/content/nms/acm/how-to/infrastructure/customize-devportal.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to customize a Developer Portal and publish documentation using
   F5 NGINX Management Suite API Connectivity Manager.
-docs: DOCS-900
+nd-docs: DOCS-900
 title: Customize a Developer Portal
 toc: true
 weight: 300
diff --git a/content/nms/acm/how-to/infrastructure/enable-create-credentials.md b/content/nms/acm/how-to/infrastructure/enable-create-credentials.md
index 1afcaa341..c94f8d883 100644
--- a/content/nms/acm/how-to/infrastructure/enable-create-credentials.md
+++ b/content/nms/acm/how-to/infrastructure/enable-create-credentials.md
@@ -1,7 +1,7 @@
 ---
 description: Follow the steps in this guide to allow users to create credentials as
   a self-service workflow on the Developer Portal.
-docs: DOCS-947
+nd-docs: DOCS-947
 title: Enable Creating Credentials on the Developer Portal
 toc: true
 weight: 400
diff --git a/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md b/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md
index 4d1595d06..2160a0367 100644
--- a/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md
+++ b/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md
@@ -1,6 +1,6 @@
 ---
 description: Learn how to enable Single Sign-On for Developer Portal.
-docs: DOCS-928
+nd-docs: DOCS-928
 title: Enable Single Sign-On for Developer Portal
 toc: true
 weight: 400
diff --git a/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md b/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md
index 2b6c2d5a9..a8f01d8aa 100644
--- a/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md
+++ b/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   manage your API infrastructure.
-docs: DOCS-924
+nd-docs: DOCS-924
 title: Manage API Infrastructure
 toc: true
 weight: 100
diff --git a/content/nms/acm/how-to/infrastructure/publish-developer-portal.md b/content/nms/acm/how-to/infrastructure/publish-developer-portal.md
index 34dc99020..21e6516ba 100644
--- a/content/nms/acm/how-to/infrastructure/publish-developer-portal.md
+++ b/content/nms/acm/how-to/infrastructure/publish-developer-portal.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use the F5 NGINX Management Suite API Connectivity Manager
   web interface to create, update, or delete a Developer Portal.
-docs: DOCS-901
+nd-docs: DOCS-901
 title: Publish a Developer Portal
 toc: true
 weight: 300
diff --git a/content/nms/acm/how-to/install-acm-offline.md b/content/nms/acm/how-to/install-acm-offline.md
index 690520ea9..962a4efeb 100644
--- a/content/nms/acm/how-to/install-acm-offline.md
+++ b/content/nms/acm/how-to/install-acm-offline.md
@@ -1,6 +1,6 @@
 ---
 title: "Offline Installation Guide"
-docs: "DOCS-1669"
+nd-docs: "DOCS-1669"
 ---
 
 ## Install or Upgrade API Connectivity Manager {#install-or-upgrade-acm-offline}
diff --git a/content/nms/acm/how-to/install-acm.md b/content/nms/acm/how-to/install-acm.md
index 264143d9a..ab8aaffae 100644
--- a/content/nms/acm/how-to/install-acm.md
+++ b/content/nms/acm/how-to/install-acm.md
@@ -1,7 +1,7 @@
 ---
 description: Follow the steps in this guide to install or upgrade F5 NGINX Management
   Suite API Connectivity Manager.
-docs: DOCS-1213
+nd-docs: DOCS-1213
 layout: acm-eos
 title: Install or Upgrade API Connectivity Manager
 toc: true
diff --git a/content/nms/acm/how-to/policies/access-control-routing.md b/content/nms/acm/how-to/policies/access-control-routing.md
index dbac16e74..b454b074e 100644
--- a/content/nms/acm/how-to/policies/access-control-routing.md
+++ b/content/nms/acm/how-to/policies/access-control-routing.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to restrict access to your application servers based on JWT
   claims or header values.
-docs: DOCS-1265
+nd-docs: DOCS-1265
 title: Access Control Routing
 toc: true
 weight: 300
diff --git a/content/nms/acm/how-to/policies/advanced-security.md b/content/nms/acm/how-to/policies/advanced-security.md
index a9c5b2b0f..6c859b0c9 100644
--- a/content/nms/acm/how-to/policies/advanced-security.md
+++ b/content/nms/acm/how-to/policies/advanced-security.md
@@ -2,7 +2,7 @@
 description: Learn how to add an F5 NGINX App Protect WAF policy to your environment
   by using the Advanced Security policy in NGINX Management Suite API Connectivity
   Manager.
-docs: DOCS-1264
+nd-docs: DOCS-1264
 title: Advanced Security
 toc: true
 weight: 350
diff --git a/content/nms/acm/how-to/policies/allowed-http-methods.md b/content/nms/acm/how-to/policies/allowed-http-methods.md
index 7107e1582..a760a454f 100644
--- a/content/nms/acm/how-to/policies/allowed-http-methods.md
+++ b/content/nms/acm/how-to/policies/allowed-http-methods.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to block unwelcome requests to an endpoint by using the Allowed
   HTTP Methods policy in F5 NGINX Management Suite API Connectivity Manager.
-docs: DOCS-1121
+nd-docs: DOCS-1121
 title: Allowed HTTP Methods
 toc: true
 weight: 350
diff --git a/content/nms/acm/how-to/policies/api-access-control-lists.md b/content/nms/acm/how-to/policies/api-access-control-lists.md
index d8f995ab5..77129cf08 100644
--- a/content/nms/acm/how-to/policies/api-access-control-lists.md
+++ b/content/nms/acm/how-to/policies/api-access-control-lists.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to protect your upstream TCP application servers by denying/allowing
   access from certain client IP addresses, CIDR blocks, client IDs or JWT Claims.
-docs: DOCS-950
+nd-docs: DOCS-950
 toc: true
 weight: 200
 title: API Access Control Lists
diff --git a/content/nms/acm/how-to/policies/apikey-authn.md b/content/nms/acm/how-to/policies/apikey-authn.md
index 629ad56b1..9ae35586b 100644
--- a/content/nms/acm/how-to/policies/apikey-authn.md
+++ b/content/nms/acm/how-to/policies/apikey-authn.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   secure API Gateways by applying an API key authentication policy.
-docs: DOCS-1117
+nd-docs: DOCS-1117
 toc: true
 weight: 400
 title: API Key Authentication
diff --git a/content/nms/acm/how-to/policies/basic-authn.md b/content/nms/acm/how-to/policies/basic-authn.md
index f14e04dc1..b546f5936 100644
--- a/content/nms/acm/how-to/policies/basic-authn.md
+++ b/content/nms/acm/how-to/policies/basic-authn.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   secure API Gateways by applying a basic authentication policy.
-docs: DOCS-1118
+nd-docs: DOCS-1118
 toc: true
 weight: 450
 title: Basic Authentication
diff --git a/content/nms/acm/how-to/policies/cluster-wide-config.md b/content/nms/acm/how-to/policies/cluster-wide-config.md
index 62235a1c1..1e0063fc3 100644
--- a/content/nms/acm/how-to/policies/cluster-wide-config.md
+++ b/content/nms/acm/how-to/policies/cluster-wide-config.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to configure the Cluster-Wide Config settings to fine tune
   and control proxy cluster's behavior with performance enhancing configurations.
-docs: DOCS-1160
+nd-docs: DOCS-1160
 title: Cluster-Wide Config
 toc: true
 weight: 498
diff --git a/content/nms/acm/how-to/policies/cluster-zone-sync.md b/content/nms/acm/how-to/policies/cluster-zone-sync.md
index 25b2eadc8..f8bbf6050 100644
--- a/content/nms/acm/how-to/policies/cluster-zone-sync.md
+++ b/content/nms/acm/how-to/policies/cluster-zone-sync.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to configure the Cluster Zone Sync policy to enable runtime
   state sharing between the instances belonging to a proxy cluster.
-docs: DOCS-1159
+nd-docs: DOCS-1159
 title: Cluster Zone Sync
 toc: true
 weight: 499
diff --git a/content/nms/acm/how-to/policies/cors.md b/content/nms/acm/how-to/policies/cors.md
index a06a60c09..8a4cdd88d 100644
--- a/content/nms/acm/how-to/policies/cors.md
+++ b/content/nms/acm/how-to/policies/cors.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   handle Cross-Origin Resource Sharing for your backend services.
-docs: DOCS-1130
+nd-docs: DOCS-1130
 title: CORS
 toc: true
 weight: 500
diff --git a/content/nms/acm/how-to/policies/error-response-format.md b/content/nms/acm/how-to/policies/error-response-format.md
index 5351886d7..01be8d2e5 100644
--- a/content/nms/acm/how-to/policies/error-response-format.md
+++ b/content/nms/acm/how-to/policies/error-response-format.md
@@ -2,7 +2,7 @@
 description: Learn how to use the F5 NGINX Management Suite API Connectivity Manager
   to configure the Error Response Format policy that customizes HTTP error codes and
   messages.
-docs: DOCS-1345
+nd-docs: DOCS-1345
 title: Error Response Format
 toc: true
 weight: 550
diff --git a/content/nms/acm/how-to/policies/grpc-policies.md b/content/nms/acm/how-to/policies/grpc-policies.md
index 67f130e5c..7dd107e2d 100644
--- a/content/nms/acm/how-to/policies/grpc-policies.md
+++ b/content/nms/acm/how-to/policies/grpc-policies.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   configure policies for your gRPC API Gateway.
-docs: DOCS-1084
+nd-docs: DOCS-1084
 toc: true
 weight: 600
 title: gRPC
diff --git a/content/nms/acm/how-to/policies/health-check.md b/content/nms/acm/how-to/policies/health-check.md
index eff95cb71..75dff9b6f 100644
--- a/content/nms/acm/how-to/policies/health-check.md
+++ b/content/nms/acm/how-to/policies/health-check.md
@@ -2,7 +2,7 @@
 description: Learn how to create, configure, and implement health check policies for
   your HTTP and gRPC API Proxies using F5 NGINX Management Suite API Connectivity
   Manager.
-docs: DOCS-1125
+nd-docs: DOCS-1125
 title: Health Check
 toc: true
 weight: 610
diff --git a/content/nms/acm/how-to/policies/http-backend-configuration.md b/content/nms/acm/how-to/policies/http-backend-configuration.md
index fdf1100b4..2215b035d 100644
--- a/content/nms/acm/how-to/policies/http-backend-configuration.md
+++ b/content/nms/acm/how-to/policies/http-backend-configuration.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use the F5 NGINX Management Suite API Connectivity Manager
   to manage HTTP API Gateways by applying a backend configuration policy.
-docs: DOCS-1141
+nd-docs: DOCS-1141
 toc: true
 weight: 650
 title: HTTP Backend Configuration
diff --git a/content/nms/acm/how-to/policies/introspection.md b/content/nms/acm/how-to/policies/introspection.md
index 6f37b7972..e958c2b0a 100644
--- a/content/nms/acm/how-to/policies/introspection.md
+++ b/content/nms/acm/how-to/policies/introspection.md
@@ -1,7 +1,7 @@
 ---
 description: API Owners can restrict access to their APIs with OAuth2 tokens. The
   policy is configured to grant access to APIs after having tokens introspected.
-docs: DOCS-953
+nd-docs: DOCS-953
 toc: true
 weight: 800
 Title: Introspection
diff --git a/content/nms/acm/how-to/policies/jwt-assertion.md b/content/nms/acm/how-to/policies/jwt-assertion.md
index ab3ec974d..b09eb8f8e 100644
--- a/content/nms/acm/how-to/policies/jwt-assertion.md
+++ b/content/nms/acm/how-to/policies/jwt-assertion.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   secure API Gateways by applying an OAuth2 JSON Web Token (JWT) Assertion policy.
-docs: DOCS-1119
+nd-docs: DOCS-1119
 toc: true
 weight: 900
 title: JWT Assertion
diff --git a/content/nms/acm/how-to/policies/log-format.md b/content/nms/acm/how-to/policies/log-format.md
index 76c9be6fe..b279027e1 100644
--- a/content/nms/acm/how-to/policies/log-format.md
+++ b/content/nms/acm/how-to/policies/log-format.md
@@ -1,7 +1,7 @@
 ---
 description: As an Infrastructure Administrator, use this guide to implement a standard
   log format for all environments hosting APIs.
-docs: DOCS-1127
+nd-docs: DOCS-1127
 toc: true
 weight: 700
 title: Log Format
diff --git a/content/nms/acm/how-to/policies/manage-policies.md b/content/nms/acm/how-to/policies/manage-policies.md
index ddfb9b6e0..55406ed95 100644
--- a/content/nms/acm/how-to/policies/manage-policies.md
+++ b/content/nms/acm/how-to/policies/manage-policies.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   set up policies.
-docs: DOCS-925
+nd-docs: DOCS-925
 toc: true
 weight: 100
 title: How to Set Up Policies
diff --git a/content/nms/acm/how-to/policies/openID-connect.md b/content/nms/acm/how-to/policies/openID-connect.md
index 478215f6b..de4e128d9 100644
--- a/content/nms/acm/how-to/policies/openID-connect.md
+++ b/content/nms/acm/how-to/policies/openID-connect.md
@@ -1,7 +1,7 @@
 ---
 description: As an Infrastructure Administrator, use this guide to configure OpenID
   Connect policy to enable Single Sign On for the gateways.
-docs: DOCS-1134
+nd-docs: DOCS-1134
 title: OpenID Connect
 toc: true
 weight: 910
diff --git a/content/nms/acm/how-to/policies/proxy-cache.md b/content/nms/acm/how-to/policies/proxy-cache.md
index 8ec171a1b..0d900a97a 100644
--- a/content/nms/acm/how-to/policies/proxy-cache.md
+++ b/content/nms/acm/how-to/policies/proxy-cache.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   enable and configure caching to improve the performance of your API gateway proxy.
-docs: DOCS-1190
+nd-docs: DOCS-1190
 title: Proxy Cache
 toc: true
 weight: null
diff --git a/content/nms/acm/how-to/policies/proxy-request-headers.md b/content/nms/acm/how-to/policies/proxy-request-headers.md
index 40667eefd..7a6a55273 100644
--- a/content/nms/acm/how-to/policies/proxy-request-headers.md
+++ b/content/nms/acm/how-to/policies/proxy-request-headers.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   set request headers to send to your backend services.
-docs: DOCS-1129
+nd-docs: DOCS-1129
 toc: true
 weight: 1100
 title: Proxy Request Headers
diff --git a/content/nms/acm/how-to/policies/proxy-response-headers.md b/content/nms/acm/how-to/policies/proxy-response-headers.md
index 3c097a214..3bc216546 100644
--- a/content/nms/acm/how-to/policies/proxy-response-headers.md
+++ b/content/nms/acm/how-to/policies/proxy-response-headers.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   set response headers to send to your clients.
-docs: DOCS-1135
+nd-docs: DOCS-1135
 title: Proxy Response Headers
 toc: true
 weight: 1150
diff --git a/content/nms/acm/how-to/policies/rate-limit.md b/content/nms/acm/how-to/policies/rate-limit.md
index 46a7c87f6..35b740997 100644
--- a/content/nms/acm/how-to/policies/rate-limit.md
+++ b/content/nms/acm/how-to/policies/rate-limit.md
@@ -3,7 +3,7 @@ description: Learn how to use the F5 NGINX Management Suite API Connectivity Man
   Rate Limiting policy to protect backend servers. The Rate Limiting policy lets you
   limit connections and the rate of requests based on request URI, client IP address,
   or authenticated clients.
-docs: DOCS-1251
+nd-docs: DOCS-1251
 title: Rate Limiting
 toc: true
 weight: 1300
diff --git a/content/nms/acm/how-to/policies/request-body-size-limit.md b/content/nms/acm/how-to/policies/request-body-size-limit.md
index 8b62e00b0..fa55e4ee0 100644
--- a/content/nms/acm/how-to/policies/request-body-size-limit.md
+++ b/content/nms/acm/how-to/policies/request-body-size-limit.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to configure the Request Policy Size Limit policy to prevent
   Denial of Service (DoS) and other types of attacks.
-docs: DOCS-1122
+nd-docs: DOCS-1122
 title: Request Body Size Limit
 toc: true
 weight: 1200
diff --git a/content/nms/acm/how-to/policies/request-correlation-id.md b/content/nms/acm/how-to/policies/request-correlation-id.md
index cf88aa86b..a99b787b3 100644
--- a/content/nms/acm/how-to/policies/request-correlation-id.md
+++ b/content/nms/acm/how-to/policies/request-correlation-id.md
@@ -2,7 +2,7 @@
 description: Learn how to use API Connectivity Manager's Request Correlation ID policy
   to add a unique identifier to each request entering your app, which you can use
   to trace end-to-end transactions in a distributed system.
-docs: DOCS-1120
+nd-docs: DOCS-1120
 title: Request Correlation ID
 toc: true
 weight: 1300
diff --git a/content/nms/acm/how-to/policies/request-header-specification.md b/content/nms/acm/how-to/policies/request-header-specification.md
index 7c60fba7f..d87ca260c 100644
--- a/content/nms/acm/how-to/policies/request-header-specification.md
+++ b/content/nms/acm/how-to/policies/request-header-specification.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to set up the Request Header Specification policy in API Connectivity
   Manager to process headers with invalid characters.
-docs: DOCS-1263
+nd-docs: DOCS-1263
 title: Request Header Specification
 toc: true
 weight: 1300
diff --git a/content/nms/acm/how-to/policies/tls-policies.md b/content/nms/acm/how-to/policies/tls-policies.md
index a70c82ae5..eb69cb412 100644
--- a/content/nms/acm/how-to/policies/tls-policies.md
+++ b/content/nms/acm/how-to/policies/tls-policies.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   secure communications by applying TLS policies.
-docs: DOCS-926
+nd-docs: DOCS-926
 toc: true
 weight: 1400
 title: TLS
diff --git a/content/nms/acm/how-to/services/publish-api.md b/content/nms/acm/how-to/services/publish-api.md
index f7b57e439..9ee1bdfbd 100644
--- a/content/nms/acm/how-to/services/publish-api.md
+++ b/content/nms/acm/how-to/services/publish-api.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   publish APIs to your API Gateway.
-docs: DOCS-927
+nd-docs: DOCS-927
 title: Publish an HTTP API
 toc: true
 weight: 100
diff --git a/content/nms/acm/how-to/services/publish-gRPC-proxy.md b/content/nms/acm/how-to/services/publish-gRPC-proxy.md
index 458100693..0ca95cd7e 100644
--- a/content/nms/acm/how-to/services/publish-gRPC-proxy.md
+++ b/content/nms/acm/how-to/services/publish-gRPC-proxy.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite API Connectivity Manager to
   publish a gRPC Proxy and manage traffic to gRPC services.
-docs: DOCS-997
+nd-docs: DOCS-997
 title: Publish a gRPC API Proxy
 toc: true
 weight: 300
diff --git a/content/nms/acm/releases/known-issues.md b/content/nms/acm/releases/known-issues.md
index 84de38c97..fae32ff21 100644
--- a/content/nms/acm/releases/known-issues.md
+++ b/content/nms/acm/releases/known-issues.md
@@ -3,7 +3,7 @@ description: This document is a summary of the known issues in F5 NGINX Manageme
   Suite API Connectivity Manager. Fixed issues are removed after **45 days**. <p>We
   recommend upgrading to the latest version of API Connectivity Manager to take advantage
   of new features, improvements, and bug fixes.</p>
-docs: DOCS-930
+nd-docs: DOCS-930
 title: Known Issues
 toc: true
 weight: 200
diff --git a/content/nms/acm/releases/release-notes.md b/content/nms/acm/releases/release-notes.md
index d66dc5893..91e531892 100644
--- a/content/nms/acm/releases/release-notes.md
+++ b/content/nms/acm/releases/release-notes.md
@@ -1,7 +1,7 @@
 ---
 description: These release notes list and describe the new features, enhancements,
   and resolved issues in NGINX Management Suite API Connectivity Manager.
-docs: DOCS-931
+nd-docs: DOCS-931
 title: Release Notes
 toc: true
 weight: 100
diff --git a/content/nms/acm/troubleshooting.md b/content/nms/acm/troubleshooting.md
index aae8ffc4a..9567d6694 100644
--- a/content/nms/acm/troubleshooting.md
+++ b/content/nms/acm/troubleshooting.md
@@ -1,7 +1,7 @@
 ---
 description: This topic describes possible issues users might encounter when using
   API Connectivity Manager. When possible, suggested workarounds are provided.
-docs: DOCS-1222
+nd-docs: DOCS-1222
 title: Troubleshooting
 toc: true
 weight: 1000
diff --git a/content/nms/acm/tutorials/advanced-routing.md b/content/nms/acm/tutorials/advanced-routing.md
index 8977fbe40..18de629cf 100644
--- a/content/nms/acm/tutorials/advanced-routing.md
+++ b/content/nms/acm/tutorials/advanced-routing.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to create dynamic routes for your deployments using F5 NGINX
   Management Suite API Connectivity Manager.
-docs: DOCS-1218
+nd-docs: DOCS-1218
 title: Set Up Advanced Routing
 toc: true
 weight: 110
diff --git a/content/nms/acm/tutorials/aws-deploy.md b/content/nms/acm/tutorials/aws-deploy.md
index 1ed5fb65f..b21e8ac3c 100644
--- a/content/nms/acm/tutorials/aws-deploy.md
+++ b/content/nms/acm/tutorials/aws-deploy.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to set up the base infrastructure required to deploy NGINX
   Management Suite API Connectivity Manager in Amazon Web Services (AWS).
-docs: DOCS-896
+nd-docs: DOCS-896
 title: Amazon Web Services Deployment Guide
 toc: true
 weight: 300
diff --git a/content/nms/acm/tutorials/enable-metrics.md b/content/nms/acm/tutorials/enable-metrics.md
index 35d83348e..9466dbc7e 100644
--- a/content/nms/acm/tutorials/enable-metrics.md
+++ b/content/nms/acm/tutorials/enable-metrics.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to enable and use metrics for F5 NGINX Management Suite API
   Connectivity Manager.
-docs: DOCS-1055
+nd-docs: DOCS-1055
 title: Enable Metrics
 toc: true
 weight: 100
diff --git a/content/nms/acm/tutorials/introspection-keycloak.md b/content/nms/acm/tutorials/introspection-keycloak.md
index 7cccaa006..5173b61e1 100644
--- a/content/nms/acm/tutorials/introspection-keycloak.md
+++ b/content/nms/acm/tutorials/introspection-keycloak.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to set up an F5 NGINX Management Suite API Connectivity Manager
   OAuth2 Introspection policy with Keycloak as the authorization server.
-docs: DOCS-954
+nd-docs: DOCS-954
 title: OAuth2 Introspection with Keycloak
 toc: true
 weight: 400
diff --git a/content/nms/acm/tutorials/oas-security-schemes.md b/content/nms/acm/tutorials/oas-security-schemes.md
index 6a996c15d..1e8605327 100644
--- a/content/nms/acm/tutorials/oas-security-schemes.md
+++ b/content/nms/acm/tutorials/oas-security-schemes.md
@@ -3,7 +3,7 @@ description: F5 NGINX Management Suite API Connectivity Manager lets you secure
   with OpenAPI Spec (OAS) security schemes. This tutorial provides step-by-step instructions
   for setting up basic authentication and API key authentication security schemes
   to secure your APIs and control access to authorized users or applications.
-docs: DOCS-1246
+nd-docs: DOCS-1246
 title: OAS Security Schemes
 toc: true
 weight: 200
diff --git a/content/nms/acm/tutorials/rbac-api-owners.md b/content/nms/acm/tutorials/rbac-api-owners.md
index c9604d295..82213607b 100644
--- a/content/nms/acm/tutorials/rbac-api-owners.md
+++ b/content/nms/acm/tutorials/rbac-api-owners.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use both built-in and custom roles to configure role-based
   access control for F5 NGINX Management Suite API Connectivity Manager.
-docs: DOCS-1173
+nd-docs: DOCS-1173
 title: Set Up RBAC for API Owners
 toc: true
 weight: 110
diff --git a/content/nms/acm/tutorials/rbac-infra-admins.md b/content/nms/acm/tutorials/rbac-infra-admins.md
index 4a70c2a7e..f545c5dc8 100644
--- a/content/nms/acm/tutorials/rbac-infra-admins.md
+++ b/content/nms/acm/tutorials/rbac-infra-admins.md
@@ -2,7 +2,7 @@
 description: Learn how to set up role-based access control (RBAC) for Infra Admins
   using the built-in and custom roles available in the F5 NGINX Management Suite API
   Connectivity Manager.
-docs: DOCS-1174
+nd-docs: DOCS-1174
 title: Set Up RBAC for Infra Admins
 toc: true
 weight: 115
diff --git a/content/nms/nginx-agent/install-nginx-agent.md b/content/nms/nginx-agent/install-nginx-agent.md
index 0660ed391..3157569ef 100644
--- a/content/nms/nginx-agent/install-nginx-agent.md
+++ b/content/nms/nginx-agent/install-nginx-agent.md
@@ -1,7 +1,7 @@
 ---
 description: Follow the instructions in this guide to install and configure the NGINX
   Agent on your data plane systems.
-docs: DOCS-800
+nd-docs: DOCS-800
 title: Install and Configure NGINX Agent
 toc: true
 weight: 100
diff --git a/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md b/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md
index 68ed6465a..08fe599ce 100644
--- a/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md
+++ b/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md
@@ -5,7 +5,7 @@ description: Follow the steps in this guide to install the F5 NGINX Plus dynamic
 weight: 110
 toc: true
 type: how-to
-docs: DOCS-1099
+nd-docs: DOCS-1099
 ---
 
 {{< eol-call-out "warning" "End of Sale Notice:" >}} F5 NGINX is announcing the End of Sale (EoS) for NGINX Instance Manager API Connectivity Manager Module, effective January 1, 2024.
diff --git a/content/nms/nim/getting-started/waf-config-management.md b/content/nms/nim/getting-started/waf-config-management.md
index 28119e9e8..e6f30cb55 100644
--- a/content/nms/nim/getting-started/waf-config-management.md
+++ b/content/nms/nim/getting-started/waf-config-management.md
@@ -1,7 +1,7 @@
 ---
 description: Learn how to use F5 NGINX Management Suite Instance Manager to publish
   NGINX App Protect WAF configurations.
-docs: DOCS-1114
+nd-docs: DOCS-1114
 title: WAF Configuration Management
 toc: true
 weight: 100
diff --git a/content/nms/nms-resilience.md b/content/nms/nms-resilience.md
index 251860c3c..551407f79 100644
--- a/content/nms/nms-resilience.md
+++ b/content/nms/nms-resilience.md
@@ -1,7 +1,7 @@
 ---
 description: F5 NGINX Management Suite installed on Kubernetes provides control plane
   resilience through fault tolerance and automated recovery.
-docs: DOCS-1161
+nd-docs: DOCS-1161
 title: NGINX Management Suite Resiliency
 toc: true
 weight: 30
diff --git a/content/nms/oss-attribution-notice.md b/content/nms/oss-attribution-notice.md
index f25c538c9..01345ebde 100644
--- a/content/nms/oss-attribution-notice.md
+++ b/content/nms/oss-attribution-notice.md
@@ -1,7 +1,7 @@
 ---
 description: F5 NGINX Management Suite relies on and benefits from open-source software
   projects. Credits are given to these projects.
-docs: DOCS-1201
+nd-docs: DOCS-1201
 title: Open-Source Software Attributions
 toc: true
 weight: 5000
diff --git a/content/nms/reference/catalogs/dimensions.md b/content/nms/reference/catalogs/dimensions.md
index 2f1a98970..b10ddbf83 100644
--- a/content/nms/reference/catalogs/dimensions.md
+++ b/content/nms/reference/catalogs/dimensions.md
@@ -1,6 +1,6 @@
 ---
 description: Learn about the Dimensions collected by NGINX Agent
-docs: DOCS-812
+nd-docs: DOCS-812
 title: Dimensions Catalog
 toc: true
 weight: 20
diff --git a/content/nms/reference/catalogs/events.md b/content/nms/reference/catalogs/events.md
index e6e5e8b62..35369f963 100644
--- a/content/nms/reference/catalogs/events.md
+++ b/content/nms/reference/catalogs/events.md
@@ -1,6 +1,6 @@
 ---
 description: Information about all of the Events collected by NGINX Controller Agent
-docs: DOCS-1132
+nd-docs: DOCS-1132
 title: Events Catalog
 toc: true
 weight: 20
diff --git a/content/nms/reference/catalogs/metrics.md b/content/nms/reference/catalogs/metrics.md
index 4e0bbd895..e4bf50997 100644
--- a/content/nms/reference/catalogs/metrics.md
+++ b/content/nms/reference/catalogs/metrics.md
@@ -1,6 +1,6 @@
 ---
 description: Information about all of the Metrics collected by NGINX Agent
-docs: DOCS-813
+nd-docs: DOCS-813
 title: Metrics Catalog
 toc: true
 weight: 20
diff --git a/content/nms/support/contact-support.md b/content/nms/support/contact-support.md
index ee875a343..8810e47c2 100644
--- a/content/nms/support/contact-support.md
+++ b/content/nms/support/contact-support.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: DOCS-817
+nd-docs: DOCS-817
 title: Where to Go for Support
 toc: true
 weight: 300
diff --git a/content/nms/support/k8s-support-package.md b/content/nms/support/k8s-support-package.md
index 2b47c38ad..b9f87d4a4 100644
--- a/content/nms/support/k8s-support-package.md
+++ b/content/nms/support/k8s-support-package.md
@@ -1,7 +1,7 @@
 ---
 description: This guide outlines the steps for creating a support package from a Helm
   installation to aid in troubleshooting error scenarios.
-docs: DOCS-1123
+nd-docs: DOCS-1123
 title: Create a Support Package from a Helm Installation
 toc: true
 weight: 200
diff --git a/content/nms/support/support-package.md b/content/nms/support/support-package.md
index 93405f0b3..d41cdaa5d 100644
--- a/content/nms/support/support-package.md
+++ b/content/nms/support/support-package.md
@@ -1,7 +1,7 @@
 ---
 description: This guide explains how to generate a support package for troubleshooting
   error scenarios.
-docs: DOCS-818
+nd-docs: DOCS-818
 title: Create a Support Package
 toc: true
 weight: 200
diff --git a/content/ossc.md b/content/ossc.md
index 7d4f55a82..85b433ed6 100644
--- a/content/ossc.md
+++ b/content/ossc.md
@@ -1,5 +1,5 @@
 ---
-docs: DOCS-1343
+nd-docs: DOCS-1343
 title: Open Source Components
 ---
 
diff --git a/content/solutions/_index.md b/content/solutions/_index.md
index 43f0db2d9..23b40bf53 100644
--- a/content/solutions/_index.md
+++ b/content/solutions/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Subscription Licensing & Solutions
-docs: null
+nd-docs: null
 toc: true
 weight: 1
 ---
diff --git a/content/solutions/about-subscription-licenses.md b/content/solutions/about-subscription-licenses.md
index 057f5f43c..a1c8177c1 100644
--- a/content/solutions/about-subscription-licenses.md
+++ b/content/solutions/about-subscription-licenses.md
@@ -5,7 +5,7 @@ weight: 2
 type:
 - reference
 product: Solutions
-docs: DOCS-1780
+nd-docs: DOCS-1780
 ---
 
 ## Overview
diff --git a/content/solutions/nginx-one-subscription.md b/content/solutions/nginx-one-subscription.md
index 67358116b..9b52dd809 100644
--- a/content/solutions/nginx-one-subscription.md
+++ b/content/solutions/nginx-one-subscription.md
@@ -1,6 +1,6 @@
 ---
 description: ''
-docs: null
+nd-docs: null
 title: NGINX One subscription
 toc: true
 weight: 100
diff --git a/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md b/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md
index 9df56014b..6d43d96bf 100644
--- a/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md
+++ b/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md
@@ -8,7 +8,7 @@ type:
 draft: true
 type: concept
 product: Solutions
-docs: DOCS-000
+nd-docs: DOCS-000
 ---
 
 {{<call-out "caution" "NGINX R33: Immediate action required for automatic upgrades" "fa-solid fa-triangle-exclamation" >}}
diff --git a/content/unit/about.md b/content/unit/about.md
index 06d5c17aa..24d0ebd06 100644
--- a/content/unit/about.md
+++ b/content/unit/about.md
@@ -2,7 +2,7 @@
 title: About NGINX Unit
 weight: 100
 toc: true
-docs: DOCS-1694
+nd-docs: DOCS-1694
 ---
 
 # Universal web app server
diff --git a/content/unit/certificates.md b/content/unit/certificates.md
index 8d78c3209..743d4e0fb 100644
--- a/content/unit/certificates.md
+++ b/content/unit/certificates.md
@@ -2,7 +2,7 @@
 title: SSL/TLS certificates
 weight: 800
 toc: true
-docs: DOCS-1698
+nd-docs: DOCS-1698
 ---
 
 The **/certificates** section of the [control API]({{< relref "/unit/controlapi.md" >}})
diff --git a/content/unit/changes.md b/content/unit/changes.md
index 5ace5255d..b3ab0be89 100644
--- a/content/unit/changes.md
+++ b/content/unit/changes.md
@@ -2,7 +2,7 @@
 title: Changelog
 weight: 90000
 toc: true
-docs: DOCS-1695
+nd-docs: DOCS-1695
 ---
 
 ```text
diff --git a/content/unit/community.md b/content/unit/community.md
index 3c3b3e256..c76f2244f 100644
--- a/content/unit/community.md
+++ b/content/unit/community.md
@@ -2,7 +2,7 @@
 title: Community
 weight: 1200
 toc: true
-docs: DOCS-1701
+nd-docs: DOCS-1701
 ---
 
 <a name="community"></a>
diff --git a/content/unit/configuration.md b/content/unit/configuration.md
index 1281aeea0..6336866ab 100644
--- a/content/unit/configuration.md
+++ b/content/unit/configuration.md
@@ -2,7 +2,7 @@
 title: Configuration
 weight: 600
 toc: true
-docs: DOCS-1700
+nd-docs: DOCS-1700
 ---
 
 {{<note>}}
diff --git a/content/unit/controlapi.md b/content/unit/controlapi.md
index cea7c263c..14806b9d4 100644
--- a/content/unit/controlapi.md
+++ b/content/unit/controlapi.md
@@ -2,7 +2,7 @@
 title: Control API
 weight: 500
 toc: true
-docs: DOCS-1693
+nd-docs: DOCS-1693
 ---
 
 Unit's configuration is JSON-based, accessible via a RESTful control API,
diff --git a/content/unit/howto/ansible.md b/content/unit/howto/ansible.md
index 0071973c1..7299d85b1 100644
--- a/content/unit/howto/ansible.md
+++ b/content/unit/howto/ansible.md
@@ -2,7 +2,7 @@
 title: Unit in Ansible
 weight: 400
 toc: true
-docs: DOCS-1708
+nd-docs: DOCS-1708
 ---
 
 The [Ansible collection](https://galaxy.ansible.com/steampunk/unit) by [XLAB
diff --git a/content/unit/howto/apps/apollo.md b/content/unit/howto/apps/apollo.md
index 0365f5e7b..6e63e91d4 100644
--- a/content/unit/howto/apps/apollo.md
+++ b/content/unit/howto/apps/apollo.md
@@ -2,7 +2,7 @@
 title: Apollo
 weight: 100
 toc: true
-docs: DOCS-1730
+nd-docs: DOCS-1730
 ---
 
 To run the [Apollo](https://www.apollographql.com) GraphQL server
diff --git a/content/unit/howto/apps/bugzilla.md b/content/unit/howto/apps/bugzilla.md
index 43172fc11..e74ef0b9e 100644
--- a/content/unit/howto/apps/bugzilla.md
+++ b/content/unit/howto/apps/bugzilla.md
@@ -2,7 +2,7 @@
 title: Bugzilla
 weight: 200
 toc: true
-docs: DOCS-1779
+nd-docs: DOCS-1779
 ---
 
 To run the [Bugzilla](https://www.bugzilla.org) bug tracking system using
diff --git a/content/unit/howto/apps/datasette.md b/content/unit/howto/apps/datasette.md
index b6fab14a2..b8de037f7 100644
--- a/content/unit/howto/apps/datasette.md
+++ b/content/unit/howto/apps/datasette.md
@@ -2,7 +2,7 @@
 title: Datasette
 weight: 300
 toc: true
-docs: DOCS-1718
+nd-docs: DOCS-1718
 ---
 
 To run the [Datasette](https://docs.datasette.io/en/stable/) data exploration tool using Unit:
diff --git a/content/unit/howto/apps/dokuwiki.md b/content/unit/howto/apps/dokuwiki.md
index 3d82b1716..d78a50b57 100644
--- a/content/unit/howto/apps/dokuwiki.md
+++ b/content/unit/howto/apps/dokuwiki.md
@@ -2,7 +2,7 @@
 title: DokuWiki
 toc: true
 weight: 400
-docs: DOCS-1716
+nd-docs: DOCS-1716
 ---
 
 To run the [DokuWiki](https://www.dokuwiki.org) content management system
diff --git a/content/unit/howto/apps/drupal.md b/content/unit/howto/apps/drupal.md
index b84a68f1d..95e3bcf33 100644
--- a/content/unit/howto/apps/drupal.md
+++ b/content/unit/howto/apps/drupal.md
@@ -2,7 +2,7 @@
 title: Drupal
 weight: 500
 toc: true
-docs: DOCS-1719
+nd-docs: DOCS-1719
 ---
 
 To run the [Drupal](https://www.drupal.org) content management system using
diff --git a/content/unit/howto/apps/grafana.md b/content/unit/howto/apps/grafana.md
index 22848b516..2566314f5 100644
--- a/content/unit/howto/apps/grafana.md
+++ b/content/unit/howto/apps/grafana.md
@@ -2,7 +2,7 @@
 title: Grafana
 toc: true
 weight: 600
-docs: DOCS-1715
+nd-docs: DOCS-1715
 ---
 
 Here, we install Grafana from [sources](https://github.com/grafana/grafana/blob/main/contribute/developer-guide.md)
diff --git a/content/unit/howto/apps/jira.md b/content/unit/howto/apps/jira.md
index 181a54270..dea7e1284 100644
--- a/content/unit/howto/apps/jira.md
+++ b/content/unit/howto/apps/jira.md
@@ -2,7 +2,7 @@
 title: Jira
 toc: true
 weight: 700
-docs: DOCS-1725
+nd-docs: DOCS-1725
 ---
 
 {{< note >}}
diff --git a/content/unit/howto/apps/joomla.md b/content/unit/howto/apps/joomla.md
index 8e0859c06..47992f798 100644
--- a/content/unit/howto/apps/joomla.md
+++ b/content/unit/howto/apps/joomla.md
@@ -2,7 +2,7 @@
 title: Joomla
 toc: true
 weight: 800
-docs: DOCS-1734
+nd-docs: DOCS-1734
 ---
 
 To run the [Joomla](https://www.joomla.org) content management system using
diff --git a/content/unit/howto/apps/mailman.md b/content/unit/howto/apps/mailman.md
index 37911f768..29c81a255 100644
--- a/content/unit/howto/apps/mailman.md
+++ b/content/unit/howto/apps/mailman.md
@@ -2,7 +2,7 @@
 title: Mailman Web
 toc: true
 weight: 800
-docs: DOCS-1721
+nd-docs: DOCS-1721
 ---
 
 To install and run the web UI for the [Mailman 3](https://docs.list.org/en/latest/index.html) suite using Unit:
diff --git a/content/unit/howto/apps/matomo.md b/content/unit/howto/apps/matomo.md
index 2cdcd95d1..0eabd3329 100644
--- a/content/unit/howto/apps/matomo.md
+++ b/content/unit/howto/apps/matomo.md
@@ -2,7 +2,7 @@
 title: Matomo
 toc: true
 weight: 900
-docs: DOCS-1722
+nd-docs: DOCS-1722
 ---
 
 To run the [Matomo](https://matomo.org) web analytics platform using Unit:
diff --git a/content/unit/howto/apps/mediawiki.md b/content/unit/howto/apps/mediawiki.md
index 42c94d7fd..539a97e82 100644
--- a/content/unit/howto/apps/mediawiki.md
+++ b/content/unit/howto/apps/mediawiki.md
@@ -2,7 +2,7 @@
 title: MediaWiki
 weight: 1000
 toc: true
-docs: DOCS-1720
+nd-docs: DOCS-1720
 ---
 
 To run the [MediaWiki](https://www.mediawiki.org) collaboration and
diff --git a/content/unit/howto/apps/mercurial.md b/content/unit/howto/apps/mercurial.md
index a6570d0a8..e8cf86749 100644
--- a/content/unit/howto/apps/mercurial.md
+++ b/content/unit/howto/apps/mercurial.md
@@ -2,7 +2,7 @@
 title: Mercurial
 weight: 1100
 toc: true
-docs: DOCS-1728
+nd-docs: DOCS-1728
 ---
 
 To install and run the [Mercurial](https://www.mercurial-scm.org) source
diff --git a/content/unit/howto/apps/modx.md b/content/unit/howto/apps/modx.md
index 071ae0f84..d4e6c53ea 100644
--- a/content/unit/howto/apps/modx.md
+++ b/content/unit/howto/apps/modx.md
@@ -2,7 +2,7 @@
 title: MODX
 weight: 1200
 toc: true
-docs: DOCS-1726
+nd-docs: DOCS-1726
 ---
 
 To run the [MODX](https://modx.com) content application platform using Unit:
diff --git a/content/unit/howto/apps/moin.md b/content/unit/howto/apps/moin.md
index 4408cde21..44e43359e 100644
--- a/content/unit/howto/apps/moin.md
+++ b/content/unit/howto/apps/moin.md
@@ -2,7 +2,7 @@
 title: MoinMoin
 toc: true
 weight: 1300
-docs: DOCS-1732
+nd-docs: DOCS-1732
 ---
 
 {{< warning >}}
diff --git a/content/unit/howto/apps/nextcloud.md b/content/unit/howto/apps/nextcloud.md
index 699399901..03287a00e 100644
--- a/content/unit/howto/apps/nextcloud.md
+++ b/content/unit/howto/apps/nextcloud.md
@@ -2,7 +2,7 @@
 title: NextCloud
 weight: 1400
 toc: true
-docs: DOCS-1724
+nd-docs: DOCS-1724
 ---
 
 To run the [NextCloud](https://nextcloud.com) share and collaboration
diff --git a/content/unit/howto/apps/opengrok.md b/content/unit/howto/apps/opengrok.md
index 6d641c3d2..e88462be8 100644
--- a/content/unit/howto/apps/opengrok.md
+++ b/content/unit/howto/apps/opengrok.md
@@ -2,7 +2,7 @@
 title: OpenGrok
 toc: true
 weight: 1500
-docs: DOCS-1735
+nd-docs: DOCS-1735
 ---
 
 To run the [OpenGrok](https://github.com/oracle/opengrok) code search engine using Unit:
diff --git a/content/unit/howto/apps/phpbb.md b/content/unit/howto/apps/phpbb.md
index d61673705..42171bbf2 100644
--- a/content/unit/howto/apps/phpbb.md
+++ b/content/unit/howto/apps/phpbb.md
@@ -2,7 +2,7 @@
 title: phpBB
 toc: true
 weight: 1600
-docs: DOCS-1723
+nd-docs: DOCS-1723
 ---
 
 To run the [phpBB](https://www.phpbb.com) bulletin board using Unit:
diff --git a/content/unit/howto/apps/phpmyadmin.md b/content/unit/howto/apps/phpmyadmin.md
index 5cac022cb..cebf258fe 100644
--- a/content/unit/howto/apps/phpmyadmin.md
+++ b/content/unit/howto/apps/phpmyadmin.md
@@ -2,7 +2,7 @@
 title: phpMyAdmin
 toc: true
 weight: 1700
-docs: DOCS-1736
+nd-docs: DOCS-1736
 ---
 
 To run the [phpMyAdmin](https://www.phpmyadmin.net) web tool using Unit:
diff --git a/content/unit/howto/apps/plone.md b/content/unit/howto/apps/plone.md
index f3536db1b..b4da7d9df 100644
--- a/content/unit/howto/apps/plone.md
+++ b/content/unit/howto/apps/plone.md
@@ -2,7 +2,7 @@
 title: Plone
 toc: true
 weight: 1800
-docs: DOCS-1733
+nd-docs: DOCS-1733
 ---
 
 To run the [Plone](https://plone.org) content management system using Unit:
diff --git a/content/unit/howto/apps/redmine.md b/content/unit/howto/apps/redmine.md
index 475751616..7d70bcce9 100644
--- a/content/unit/howto/apps/redmine.md
+++ b/content/unit/howto/apps/redmine.md
@@ -2,7 +2,7 @@
 title: Redmine
 toc: true
 weight: 1900
-docs: DOCS-1717
+nd-docs: DOCS-1717
 ---
 
 To run the [Redmine](https://www.redmine.org) project management system using
diff --git a/content/unit/howto/apps/reviewboard.md b/content/unit/howto/apps/reviewboard.md
index 2c49f1fd2..e4240bb56 100644
--- a/content/unit/howto/apps/reviewboard.md
+++ b/content/unit/howto/apps/reviewboard.md
@@ -2,7 +2,7 @@
 title: Review Board
 toc: true
 weight: 2000
-docs: DOCS-1727
+nd-docs: DOCS-1727
 ---
 
 To run the [Review Board](https://www.reviewboard.org) code review tool using Unit:
diff --git a/content/unit/howto/apps/roundcube.md b/content/unit/howto/apps/roundcube.md
index 61dadbdb7..712ec28cf 100644
--- a/content/unit/howto/apps/roundcube.md
+++ b/content/unit/howto/apps/roundcube.md
@@ -2,7 +2,7 @@
 title: Roundcube
 toc: true
 weight: 2100
-docs: DOCS-1731
+nd-docs: DOCS-1731
 ---
 
 To run the [Roundcube](https://roundcube.net) webmail platform using Unit:
diff --git a/content/unit/howto/apps/trac.md b/content/unit/howto/apps/trac.md
index 0a9e972fa..60ad67498 100644
--- a/content/unit/howto/apps/trac.md
+++ b/content/unit/howto/apps/trac.md
@@ -2,7 +2,7 @@
 title: Trac
 toc: true
 weight: 2200
-docs: DOCS-1729
+nd-docs: DOCS-1729
 ---
 
 {{< warning >}}
diff --git a/content/unit/howto/apps/wordpress.md b/content/unit/howto/apps/wordpress.md
index bdbd8afb9..15278f44f 100644
--- a/content/unit/howto/apps/wordpress.md
+++ b/content/unit/howto/apps/wordpress.md
@@ -2,7 +2,7 @@
 title: WordPress
 toc: true
 weight: 2300
-docs: DOCS-1737
+nd-docs: DOCS-1737
 ---
 
 {{< note >}}
diff --git a/content/unit/howto/certbot.md b/content/unit/howto/certbot.md
index ba115fc16..97cc0d3be 100644
--- a/content/unit/howto/certbot.md
+++ b/content/unit/howto/certbot.md
@@ -2,7 +2,7 @@
 title: TLS with Certbot
 toc: true
 weight: 600
-docs: DOCS-1706
+nd-docs: DOCS-1706
 ---
 
 To set up
diff --git a/content/unit/howto/docker.md b/content/unit/howto/docker.md
index 63c42c73b..8bd6da4cd 100644
--- a/content/unit/howto/docker.md
+++ b/content/unit/howto/docker.md
@@ -2,7 +2,7 @@
 title: Unit in Docker
 weight: 200
 toc: true
-docs: DOCS-1712
+nd-docs: DOCS-1712
 ---
 
 To run your apps in a containerized Unit using the
diff --git a/content/unit/howto/frameworks/bottle.md b/content/unit/howto/frameworks/bottle.md
index aac3a94db..bc1c65d1b 100644
--- a/content/unit/howto/frameworks/bottle.md
+++ b/content/unit/howto/frameworks/bottle.md
@@ -2,7 +2,7 @@
 title: Bottle
 weight: 100
 toc: true
-docs: DOCS-1747
+nd-docs: DOCS-1747
 ---
 
 To run apps built with the [Bottle](https://bottlepy.org/docs/dev/) web
diff --git a/content/unit/howto/frameworks/cakephp.md b/content/unit/howto/frameworks/cakephp.md
index a33159f9b..aa06ecf87 100644
--- a/content/unit/howto/frameworks/cakephp.md
+++ b/content/unit/howto/frameworks/cakephp.md
@@ -2,7 +2,7 @@
 title: CakePHP
 weight: 200
 toc: true
-docs: DOCS-1745
+nd-docs: DOCS-1745
 ---
 
 To run apps based on the [CakePHP](https://cakephp.org) framework using Unit:
diff --git a/content/unit/howto/frameworks/catalyst.md b/content/unit/howto/frameworks/catalyst.md
index 189a794a0..afbfbb4f6 100644
--- a/content/unit/howto/frameworks/catalyst.md
+++ b/content/unit/howto/frameworks/catalyst.md
@@ -2,7 +2,7 @@
 title: Catalyst
 weight: 300
 toc: true
-docs: DOCS-1753
+nd-docs: DOCS-1753
 ---
 
 To run apps based on the [Catalyst](https://metacpan.org/dist/Catalyst-Manual) 5.9+ framework using Unit:
diff --git a/content/unit/howto/frameworks/codeigniter.md b/content/unit/howto/frameworks/codeigniter.md
index e038eecf9..b723091f0 100644
--- a/content/unit/howto/frameworks/codeigniter.md
+++ b/content/unit/howto/frameworks/codeigniter.md
@@ -2,7 +2,7 @@
 title: CodeIgniter
 weight: 400
 toc: true
-docs: DOCS-1739
+nd-docs: DOCS-1739
 ---
 
 To run apps built with the [CodeIgniter](https://codeigniter.com) web
diff --git a/content/unit/howto/frameworks/django.md b/content/unit/howto/frameworks/django.md
index d952d2834..8fb569612 100644
--- a/content/unit/howto/frameworks/django.md
+++ b/content/unit/howto/frameworks/django.md
@@ -2,7 +2,7 @@
 title: Django
 toc: true
 weight: 500
-docs: DOCS-1746
+nd-docs: DOCS-1746
 ---
 
 To run apps based on the Django [framework](https://www.djangoproject.com)
diff --git a/content/unit/howto/frameworks/djangochannels.md b/content/unit/howto/frameworks/djangochannels.md
index cf248af47..c6451ac7e 100644
--- a/content/unit/howto/frameworks/djangochannels.md
+++ b/content/unit/howto/frameworks/djangochannels.md
@@ -2,7 +2,7 @@
 title: Django Channels
 toc: true
 weight: 600
-docs: DOCS-1742
+nd-docs: DOCS-1742
 ---
 
 To run Django apps using the Django Channels [framework](https://channels.readthedocs.io/en/stable/) with Unit:
diff --git a/content/unit/howto/frameworks/express.md b/content/unit/howto/frameworks/express.md
index 4684d2c14..b5b79c395 100644
--- a/content/unit/howto/frameworks/express.md
+++ b/content/unit/howto/frameworks/express.md
@@ -2,7 +2,7 @@
 title: Express
 toc: true
 weight: 700
-docs: DOCS-1741
+nd-docs: DOCS-1741
 ---
 
 To run apps built with the [Express](https://expressjs.com) web framework
diff --git a/content/unit/howto/frameworks/falcon.md b/content/unit/howto/frameworks/falcon.md
index e96658c29..620a2c684 100644
--- a/content/unit/howto/frameworks/falcon.md
+++ b/content/unit/howto/frameworks/falcon.md
@@ -2,7 +2,7 @@
 title: Falcon
 weight: 800
 toc: true
-docs: DOCS-1750
+nd-docs: DOCS-1750
 ---
 
 To run apps built with the [Falcon](https://falcon.readthedocs.io/en/stable/)
diff --git a/content/unit/howto/frameworks/fastapi.md b/content/unit/howto/frameworks/fastapi.md
index 85ad09384..6d7c41cb0 100644
--- a/content/unit/howto/frameworks/fastapi.md
+++ b/content/unit/howto/frameworks/fastapi.md
@@ -2,7 +2,7 @@
 title: FastAPI
 toc: true
 weight: 900
-docs: DOCS-1738
+nd-docs: DOCS-1738
 ---
 
 To run apps built with the [FastAPI](https://fastapi.tiangolo.com) web framework using Unit:
diff --git a/content/unit/howto/frameworks/flask.md b/content/unit/howto/frameworks/flask.md
index e8e56bcf0..567005083 100644
--- a/content/unit/howto/frameworks/flask.md
+++ b/content/unit/howto/frameworks/flask.md
@@ -2,7 +2,7 @@
 title: Flask
 toc: true
 weight: 1000
-docs: DOCS-1761
+nd-docs: DOCS-1761
 ---
 
 To run apps built with the [Flask](https://flask.palletsprojects.com/en/1.1.x/) web framework using Unit:
diff --git a/content/unit/howto/frameworks/guillotina.md b/content/unit/howto/frameworks/guillotina.md
index 93c908421..58b00e2fc 100644
--- a/content/unit/howto/frameworks/guillotina.md
+++ b/content/unit/howto/frameworks/guillotina.md
@@ -2,7 +2,7 @@
 title: Gillotina
 toc: true
 weight: 1000
-docs: DOCS-1760
+nd-docs: DOCS-1760
 ---
 
 To run apps built with the [Guillotina](https://guillotina.readthedocs.io/en/latest/) web framework using Unit:
diff --git a/content/unit/howto/frameworks/koa.md b/content/unit/howto/frameworks/koa.md
index 84a62df3c..214d4d7c7 100644
--- a/content/unit/howto/frameworks/koa.md
+++ b/content/unit/howto/frameworks/koa.md
@@ -2,7 +2,7 @@
 title: Koa
 weight: 1100
 toc: true
-docs: DOCS-1743
+nd-docs: DOCS-1743
 ---
 
 To run apps built with the [Koa](https://koajs.com) web framework using Unit:
diff --git a/content/unit/howto/frameworks/laravel.md b/content/unit/howto/frameworks/laravel.md
index 23c165199..1f98e8681 100644
--- a/content/unit/howto/frameworks/laravel.md
+++ b/content/unit/howto/frameworks/laravel.md
@@ -2,7 +2,7 @@
 title: Laravel
 weight: 1200
 toc: true
-docs: DOCS-1754
+nd-docs: DOCS-1754
 ---
 
 To run apps based on the [Laravel](https://laravel.com) framework using Unit:
diff --git a/content/unit/howto/frameworks/lumen.md b/content/unit/howto/frameworks/lumen.md
index f9fb64a45..742fb9086 100644
--- a/content/unit/howto/frameworks/lumen.md
+++ b/content/unit/howto/frameworks/lumen.md
@@ -2,7 +2,7 @@
 title: Lumen
 weight: 1300
 toc: true
-docs: DOCS-1751
+nd-docs: DOCS-1751
 ---
 
 To run apps based on the [Lumen](https://lumen.laravel.com) framework using
diff --git a/content/unit/howto/frameworks/pyramid.md b/content/unit/howto/frameworks/pyramid.md
index 09370718f..1d7c00908 100644
--- a/content/unit/howto/frameworks/pyramid.md
+++ b/content/unit/howto/frameworks/pyramid.md
@@ -2,7 +2,7 @@
 title: Pyramid
 weight: 1300
 toc: true
-docs: DOCS-1757
+nd-docs: DOCS-1757
 ---
 
 To run apps built with the [Pyramid](https://trypyramid.com) web framework
diff --git a/content/unit/howto/frameworks/quart.md b/content/unit/howto/frameworks/quart.md
index c195c49ca..61c1a84b9 100644
--- a/content/unit/howto/frameworks/quart.md
+++ b/content/unit/howto/frameworks/quart.md
@@ -2,7 +2,7 @@
 title: Quart
 weight: 1400
 toc: true
-docs: DOCS-1744
+nd-docs: DOCS-1744
 ---
 
 
diff --git a/content/unit/howto/frameworks/rails.md b/content/unit/howto/frameworks/rails.md
index 4527f3c1d..5b2dbbe19 100644
--- a/content/unit/howto/frameworks/rails.md
+++ b/content/unit/howto/frameworks/rails.md
@@ -2,7 +2,7 @@
 title: Ruby on Rails
 weight: 1600
 toc: true
-docs: DOCS-1759
+nd-docs: DOCS-1759
 ---
 
 To run apps based on the [Ruby on Rails](https://rubyonrails.org) framework
diff --git a/content/unit/howto/frameworks/responder.md b/content/unit/howto/frameworks/responder.md
index 3a5d21410..490521d55 100644
--- a/content/unit/howto/frameworks/responder.md
+++ b/content/unit/howto/frameworks/responder.md
@@ -2,7 +2,7 @@
 title: Responder
 weight: 1500
 toc: true
-docs: DOCS-1740
+nd-docs: DOCS-1740
 ---
 
 # Responder
diff --git a/content/unit/howto/frameworks/sanic.md b/content/unit/howto/frameworks/sanic.md
index 44c1ec928..1e8cce187 100644
--- a/content/unit/howto/frameworks/sanic.md
+++ b/content/unit/howto/frameworks/sanic.md
@@ -2,7 +2,7 @@
 title: Sanic
 weight: 1700
 toc: true
-docs: DOCS-1756
+nd-docs: DOCS-1756
 ---
 
 To run apps built with the [Sanic](https://sanic.dev/) web framework
diff --git a/content/unit/howto/frameworks/springboot.md b/content/unit/howto/frameworks/springboot.md
index c0b221e36..40239e937 100644
--- a/content/unit/howto/frameworks/springboot.md
+++ b/content/unit/howto/frameworks/springboot.md
@@ -2,7 +2,7 @@
 title: Spring Boot
 weight: 1800
 toc: true
-docs: DOCS-1758
+nd-docs: DOCS-1758
 ---
 
 To run apps based on the [Spring Boot](https://spring.io/projects/spring-boot) frameworks using Unit:
diff --git a/content/unit/howto/frameworks/starlette.md b/content/unit/howto/frameworks/starlette.md
index ddecc242c..e73d99a49 100644
--- a/content/unit/howto/frameworks/starlette.md
+++ b/content/unit/howto/frameworks/starlette.md
@@ -2,7 +2,7 @@
 title: Starlette
 toc: true
 weight: 1900
-docs: DOCS-1755
+nd-docs: DOCS-1755
 ---
 
 # Starlette
diff --git a/content/unit/howto/frameworks/symfony.md b/content/unit/howto/frameworks/symfony.md
index 7c6d5c342..8e8c7569c 100644
--- a/content/unit/howto/frameworks/symfony.md
+++ b/content/unit/howto/frameworks/symfony.md
@@ -2,7 +2,7 @@
 title: Symfony
 toc: true
 weight: 1900
-docs: DOCS-1749
+nd-docs: DOCS-1749
 ---
 
 To run apps built with the [Symfony](https://symfony.com) framework using Unit:
diff --git a/content/unit/howto/frameworks/yii.md b/content/unit/howto/frameworks/yii.md
index 8e5419e3c..21191982f 100644
--- a/content/unit/howto/frameworks/yii.md
+++ b/content/unit/howto/frameworks/yii.md
@@ -2,7 +2,7 @@
 title: Yii
 weight: 2000
 toc: true
-docs: DOCS-1752
+nd-docs: DOCS-1752
 ---
 
 
diff --git a/content/unit/howto/frameworks/zope.md b/content/unit/howto/frameworks/zope.md
index 349aa5183..ad36dee53 100644
--- a/content/unit/howto/frameworks/zope.md
+++ b/content/unit/howto/frameworks/zope.md
@@ -2,7 +2,7 @@
 title: Zope
 weight: 2100
 toc: true
-docs: DOCS-1748
+nd-docs: DOCS-1748
 ---
 
 To run apps built with the [Zope](https://www.zope.dev/) web framework using
diff --git a/content/unit/howto/integration.md b/content/unit/howto/integration.md
index 7183e4d0c..88871eb36 100644
--- a/content/unit/howto/integration.md
+++ b/content/unit/howto/integration.md
@@ -2,7 +2,7 @@
 title: NGINX integration
 toc: true
 weight: 500
-docs: DOCS-1705
+nd-docs: DOCS-1705
 ---
 
 Unit is a potent and versatile server in its own right. However, if you're
diff --git a/content/unit/howto/modules.md b/content/unit/howto/modules.md
index b986ca03d..addd8cb69 100644
--- a/content/unit/howto/modules.md
+++ b/content/unit/howto/modules.md
@@ -2,7 +2,7 @@
 title: Working with language modules
 weight: 700
 toc: true
-docs: DOCS-1707
+nd-docs: DOCS-1707
 ---
 
 Languages supported by Unit fall into these two categories:
diff --git a/content/unit/howto/overview.md b/content/unit/howto/overview.md
index 8bdda425d..3e3d51b7c 100644
--- a/content/unit/howto/overview.md
+++ b/content/unit/howto/overview.md
@@ -2,7 +2,7 @@
 title: Overview
 weight: 100
 toc: true
-docs: DOCS-1709
+nd-docs: DOCS-1709
 ---
 
 This section describes various real-life situations and issues that you may
diff --git a/content/unit/howto/samples.md b/content/unit/howto/samples.md
index 452ac6917..cabac4c07 100644
--- a/content/unit/howto/samples.md
+++ b/content/unit/howto/samples.md
@@ -2,7 +2,7 @@
 title: App samples
 toc: true
 weight: 800
-docs: DOCS-1714
+nd-docs: DOCS-1714
 ---
 
 
diff --git a/content/unit/howto/security.md b/content/unit/howto/security.md
index 9ba857bb0..d16c50c28 100644
--- a/content/unit/howto/security.md
+++ b/content/unit/howto/security.md
@@ -2,7 +2,7 @@
 title: Security checklist
 weight: 800
 toc: true
-docs: DOCS-1710
+nd-docs: DOCS-1710
 ---
 
 At its core, Unit has security as one of its top priorities; our development
diff --git a/content/unit/howto/source.md b/content/unit/howto/source.md
index d2c676913..b923eb5aa 100644
--- a/content/unit/howto/source.md
+++ b/content/unit/howto/source.md
@@ -2,7 +2,7 @@
 title: Building from source
 weight: 300
 toc: true
-docs: DOCS-1713
+nd-docs: DOCS-1713
 ---
 
 After you've obtained Unit's
diff --git a/content/unit/howto/walkthrough.md b/content/unit/howto/walkthrough.md
index c8b4bab24..080fdb990 100644
--- a/content/unit/howto/walkthrough.md
+++ b/content/unit/howto/walkthrough.md
@@ -2,7 +2,7 @@
 title: Walkthrough
 weight: 900
 toc: true
-docs: DOCS-1711
+nd-docs: DOCS-1711
 ---
 
 OK, so you've decided to give Unit a try with your web app of choice. You may
diff --git a/content/unit/installation.md b/content/unit/installation.md
index bffa94997..dda25f2d8 100644
--- a/content/unit/installation.md
+++ b/content/unit/installation.md
@@ -2,7 +2,7 @@
 title: Installation
 weight: 400
 toc: true
-docs: DOCS-1697
+nd-docs: DOCS-1697
 ---
 
 You can install NGINX Unit in four alternative ways:
diff --git a/content/unit/keyfeatures.md b/content/unit/keyfeatures.md
index 29d83137b..0f80e045a 100644
--- a/content/unit/keyfeatures.md
+++ b/content/unit/keyfeatures.md
@@ -2,7 +2,7 @@
 title: Key features
 weight: 200
 toc: true
-docs: DOCS-1704
+nd-docs: DOCS-1704
 ---
 
 From the start, our vision for Unit was versatility, speed, and reliability. Here's how we tackle these goals.
diff --git a/content/unit/news/2023/unit-1.30.0-released.md b/content/unit/news/2023/unit-1.30.0-released.md
index 3a9888013..a65aab27f 100644
--- a/content/unit/news/2023/unit-1.30.0-released.md
+++ b/content/unit/news/2023/unit-1.30.0-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.30.0 Released
 weight: 300
-docs: DOCS-1777
+nd-docs: DOCS-1777
 ---
 
 We are happy to announce Unit 1.30.0! This release brings a new level of
diff --git a/content/unit/news/2023/unit-1.31.0-released.md b/content/unit/news/2023/unit-1.31.0-released.md
index b3c1aa6dd..74b8a6f6f 100644
--- a/content/unit/news/2023/unit-1.31.0-released.md
+++ b/content/unit/news/2023/unit-1.31.0-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.31.0 Released
 weight: 200
-docs: DOCS-1778
+nd-docs: DOCS-1778
 ---
 
 We are delighted to announce Unit 1.31.0, which marks a significant milestone
diff --git a/content/unit/news/2023/unit-1.31.1-released.md b/content/unit/news/2023/unit-1.31.1-released.md
index 0c1976693..d5eea3e81 100644
--- a/content/unit/news/2023/unit-1.31.1-released.md
+++ b/content/unit/news/2023/unit-1.31.1-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.31.1 Released
 weight: 100
-docs: DOCS-1776
+nd-docs: DOCS-1776
 ---
 
 We are delighted to announce Unit 1.31.1, a maintenance release that fixes
diff --git a/content/unit/news/2024/fermyon-spin-rust-sdk.md b/content/unit/news/2024/fermyon-spin-rust-sdk.md
index f3db56899..ef8a96daa 100644
--- a/content/unit/news/2024/fermyon-spin-rust-sdk.md
+++ b/content/unit/news/2024/fermyon-spin-rust-sdk.md
@@ -1,7 +1,7 @@
 ---
 title: Wasm Components - Working with the Spin SDK for Rust
 weight: 500
-docs: DOCS-1765
+nd-docs: DOCS-1765
 ---
 
 In our blog series [Part 1]({{< relref "/unit/news/2024/wasm-component-model-part-1.md" >}}) and [Part 2]({{< relref "/unit/news/2024/wasm-component-model-part-2.md" >}}) , we have covered the core mechanism of the WebAssembly Component Model and showcased how to create a Wasm Component using WASI 0.2 APIs and the **wasi/http:proxy** world.
diff --git a/content/unit/news/2024/unit-1.32.0-released.md b/content/unit/news/2024/unit-1.32.0-released.md
index badcef567..ea83a3bd0 100644
--- a/content/unit/news/2024/unit-1.32.0-released.md
+++ b/content/unit/news/2024/unit-1.32.0-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.32.0 Released
 weight: 700
-docs: DOCS-1762
+nd-docs: DOCS-1762
 ---
 
 Unit 1.32.0 comes with a new language module for WebAssembly that supports
diff --git a/content/unit/news/2024/unit-1.32.1-released.md b/content/unit/news/2024/unit-1.32.1-released.md
index 4a014c16f..c31c66b38 100644
--- a/content/unit/news/2024/unit-1.32.1-released.md
+++ b/content/unit/news/2024/unit-1.32.1-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.32.1 Released
 weight: 300
-docs: DOCS-1767
+nd-docs: DOCS-1767
 ---
 
 NGINX Unit 1.32.1 is a maintenance release that fixes bugs in the new WebAssembly Language Module and in our njs implementation.
diff --git a/content/unit/news/2024/unit-1.33.0-released.md b/content/unit/news/2024/unit-1.33.0-released.md
index 40667b498..5d19d1beb 100644
--- a/content/unit/news/2024/unit-1.33.0-released.md
+++ b/content/unit/news/2024/unit-1.33.0-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.33.0 Released
 weight: 200
-docs: DOCS-1763
+nd-docs: DOCS-1763
 ---
 
 We are pleased to announce the release of NGINX Unit 1.33.0. This release includes
diff --git a/content/unit/news/2024/unit-1.34.0-released.md b/content/unit/news/2024/unit-1.34.0-released.md
index e8ea04d08..0da60801e 100644
--- a/content/unit/news/2024/unit-1.34.0-released.md
+++ b/content/unit/news/2024/unit-1.34.0-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.34.0 Released
 weight: 100
-docs: DOCS-1768
+nd-docs: DOCS-1768
 ---
 
 We are pleased to announce the release of NGINX Unit 1.34.0. This release
diff --git a/content/unit/news/2024/wasm-component-model-part-1.md b/content/unit/news/2024/wasm-component-model-part-1.md
index 0ebc92488..56fcea8b6 100644
--- a/content/unit/news/2024/wasm-component-model-part-1.md
+++ b/content/unit/news/2024/wasm-component-model-part-1.md
@@ -1,7 +1,7 @@
 ---
 title: The WebAssembly Component Model - Part 1
 weight: 500
-docs: DOCS-1764
+nd-docs: DOCS-1764
 ---
 
 Are you interested in getting started with the WebAssembly Component Model but feel overwhelmed by the ecosystem and unsure where to begin? If so, this blog post is for you!
diff --git a/content/unit/news/2024/wasm-component-model-part-2.md b/content/unit/news/2024/wasm-component-model-part-2.md
index a487c4914..313591e35 100644
--- a/content/unit/news/2024/wasm-component-model-part-2.md
+++ b/content/unit/news/2024/wasm-component-model-part-2.md
@@ -1,7 +1,7 @@
 ---
 title: The WebAssembly Component Model - Part 2
 weight: 600
-docs: DOCS-1766
+nd-docs: DOCS-1766
 ---
 
 This is Part 2 of our blog series about the Wasm Component Model, it's ecosytem and how to use Wasm Components with NGINX Unit.
diff --git a/content/unit/news/2025/unit-1.34.1-released.md b/content/unit/news/2025/unit-1.34.1-released.md
index 476c7d6aa..d7d7c7580 100644
--- a/content/unit/news/2025/unit-1.34.1-released.md
+++ b/content/unit/news/2025/unit-1.34.1-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.34.1 Released
 weight: 1000
-docs: DOCS-1775
+nd-docs: DOCS-1775
 ---
 
 We are pleased to announce the release of NGINX Unit 1.34.1. This is a
diff --git a/content/unit/news/2025/unit-1.34.2-released.md b/content/unit/news/2025/unit-1.34.2-released.md
index d298c4e39..35c56ea63 100644
--- a/content/unit/news/2025/unit-1.34.2-released.md
+++ b/content/unit/news/2025/unit-1.34.2-released.md
@@ -1,7 +1,7 @@
 ---
 title: Unit 1.34.2 Released
 weight: 900
-docs: DOCS-1774
+nd-docs: DOCS-1774
 ---
 
 We are pleased to announce the release of NGINX Unit 1.34.2. This is a maintenance release that fixes a couple of issues in the Java WebSocket code within the Java language module.
diff --git a/content/unit/news/archived-news/2018.md b/content/unit/news/archived-news/2018.md
index 01f76680e..7f44fe506 100644
--- a/content/unit/news/archived-news/2018.md
+++ b/content/unit/news/archived-news/2018.md
@@ -2,7 +2,7 @@
 title: 2018
 weight: 500
 toc: true
-docs: DOCS-1770
+nd-docs: DOCS-1770
 ---
 
 ## Unit 1.7 Released
diff --git a/content/unit/news/archived-news/2019.md b/content/unit/news/archived-news/2019.md
index 3e783f740..713cf30fc 100644
--- a/content/unit/news/archived-news/2019.md
+++ b/content/unit/news/archived-news/2019.md
@@ -2,7 +2,7 @@
 title: 2019
 weight: 400
 toc: true
-docs: DOCS-1772
+nd-docs: DOCS-1772
 ---
 
 ## Unit 1.14.0 Released
diff --git a/content/unit/news/archived-news/2020.md b/content/unit/news/archived-news/2020.md
index e39965671..029ac9a55 100644
--- a/content/unit/news/archived-news/2020.md
+++ b/content/unit/news/archived-news/2020.md
@@ -2,7 +2,7 @@
 title: 2020
 weight: 300
 toc: true
-docs: DOCS-1771
+nd-docs: DOCS-1771
 ----
 
 ## Unit 1.21.0 Released
diff --git a/content/unit/news/archived-news/2021.md b/content/unit/news/archived-news/2021.md
index cb16f00d5..45488db44 100644
--- a/content/unit/news/archived-news/2021.md
+++ b/content/unit/news/archived-news/2021.md
@@ -2,7 +2,7 @@
 title: 2021
 weight: 200
 toc: true
-docs: DOCS-1773
+nd-docs: DOCS-1773
 ---
 
 ## Unit 1.26.1 Released
diff --git a/content/unit/news/archived-news/2022.md b/content/unit/news/archived-news/2022.md
index e9541e3ac..72b28c883 100644
--- a/content/unit/news/archived-news/2022.md
+++ b/content/unit/news/archived-news/2022.md
@@ -2,7 +2,7 @@
 title: 2022
 weight: 100
 toc: true
-docs: DOCS-1769
+nd-docs: DOCS-1769
 ---
 
 ## Unit 1.29.0 Released
diff --git a/content/unit/scripting.md b/content/unit/scripting.md
index 6be0f49b3..4ae97d76d 100644
--- a/content/unit/scripting.md
+++ b/content/unit/scripting.md
@@ -2,7 +2,7 @@
 title: Scripting
 weight: 700
 toc: true
-docs: DOCS-1699
+nd-docs: DOCS-1699
 ---
 
 NGINX Unit's [control API]({{< relref "/unit/controlapi.md" >}}) supports
diff --git a/content/unit/statusapi.md b/content/unit/statusapi.md
index d3b1a7cff..e4548cd8d 100644
--- a/content/unit/statusapi.md
+++ b/content/unit/statusapi.md
@@ -2,7 +2,7 @@
 title: Status API
 weight: 900
 toc: true
-docs: DOCS-1702
+nd-docs: DOCS-1702
 ---
 
 <a name="configuration-stats"></a>
diff --git a/content/unit/troubleshooting.md b/content/unit/troubleshooting.md
index 4af08246b..c4a6d86fc 100644
--- a/content/unit/troubleshooting.md
+++ b/content/unit/troubleshooting.md
@@ -2,7 +2,7 @@
 title: Troubleshooting
 weight: 1100
 toc: true
-docs: DOCS-1703
+nd-docs: DOCS-1703
 ---
 
 {{< note >}}
diff --git a/content/unit/unitctl.md b/content/unit/unitctl.md
index 18a8cffdc..02dda382f 100644
--- a/content/unit/unitctl.md
+++ b/content/unit/unitctl.md
@@ -2,7 +2,7 @@
 title: CLI (unitctl)
 weight: 1000
 toc: true
-docs: DOCS-1696
+nd-docs: DOCS-1696
 ---
 
 {{< note >}}

From 0226757041657ec5ee58cea6a01a527900183954 Mon Sep 17 00:00:00 2001
From: yar <y82@users.noreply.github.com>
Date: Tue, 1 Jul 2025 09:52:19 +0100
Subject: [PATCH 070/117] Dynamic modules: intros, mentioning repo,
 sentence-case, no html. (#746)

---
 .../admin-guide/dynamic-modules/brotli.md     | 21 ++--
 .../dynamic-modules/cookie-flag.md            | 16 +--
 .../dynamic-modules/dynamic-modules.md        | 73 +++++++-------
 .../dynamic-modules/encrypted-session.md      | 20 ++--
 .../nginx/admin-guide/dynamic-modules/fips.md | 18 ++--
 .../admin-guide/dynamic-modules/geoip.md      | 28 ++++--
 .../admin-guide/dynamic-modules/geoip2.md     | 28 +++---
 .../dynamic-modules/headers-more.md           | 18 ++--
 .../http-substitutions-filter.md              | 18 ++--
 .../dynamic-modules/image-filter.md           | 17 ++--
 .../nginx/admin-guide/dynamic-modules/lua.md  | 24 +++--
 .../nginx/admin-guide/dynamic-modules/ndk.md  | 18 ++--
 .../admin-guide/dynamic-modules/nginscript.md | 22 +++--
 .../admin-guide/dynamic-modules/nginx-waf.md  | 12 +--
 .../dynamic-modules/opentelemetry.md          | 24 +++--
 .../dynamic-modules/opentracing.md            | 16 +--
 .../dynamic-modules/passenger-open-source.md  | 22 ++---
 .../nginx/admin-guide/dynamic-modules/perl.md | 24 +++--
 .../dynamic-modules/prometheus-njs.md         | 98 ++++++++-----------
 .../nginx/admin-guide/dynamic-modules/rtmp.md | 26 +++--
 .../admin-guide/dynamic-modules/set-misc.md   | 25 ++---
 .../admin-guide/dynamic-modules/spnego.md     | 20 ++--
 .../admin-guide/dynamic-modules/uninstall.md  | 10 +-
 .../nginx/admin-guide/dynamic-modules/xslt.md | 17 ++--
 24 files changed, 313 insertions(+), 302 deletions(-)

diff --git a/content/nginx/admin-guide/dynamic-modules/brotli.md b/content/nginx/admin-guide/dynamic-modules/brotli.md
index b0ebfd3f4..d885b0fb3 100644
--- a/content/nginx/admin-guide/dynamic-modules/brotli.md
+++ b/content/nginx/admin-guide/dynamic-modules/brotli.md
@@ -19,7 +19,7 @@ The [ngx_brotli](https://github.com/google/ngx_brotli) module enables Brotli com
 
 ## Prerequisites
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
 2. If required, install the **epel-release** dependency
 
@@ -35,12 +35,11 @@ The [ngx_brotli](https://github.com/google/ngx_brotli) module enables Brotli com
    sudo yum update && \
    sudo yum install epel-release -y
    ```
-
-
+3. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
 ## Installation
 
-Install the Brotli module package `nginx-plus-module-brotli`.
+Install the Brotli module package `nginx-plus-module-brotli` from the official NGINX Plus repository.
 
 - for Amazon Linux 2 LTS, CentOS, Oracle Linux, and RHEL:
 
@@ -77,8 +76,6 @@ Install the Brotli module package `nginx-plus-module-brotli`.
    sudo pkg install nginx-plus-module-brotli
    ```
 
-
-
 ## Configuration
 
 After installation you will need to enable and configure Brotli modules in NGINX Plus configuration file **nginx.conf**.
@@ -125,14 +122,12 @@ After installation you will need to enable and configure Brotli modules in NGINX
     nginx -s reload
     ```
 
+## More info
 
+- [The `ngx_brotli` module GitHub project](https://github.com/google/ngx_brotli)
 
-## More Info
-
-- [NGINX Module for Brotli Compression Reference](https://github.com/google/ngx_brotli)
-
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/cookie-flag.md b/content/nginx/admin-guide/dynamic-modules/cookie-flag.md
index 3a10f8f8c..7068d1449 100644
--- a/content/nginx/admin-guide/dynamic-modules/cookie-flag.md
+++ b/content/nginx/admin-guide/dynamic-modules/cookie-flag.md
@@ -10,21 +10,21 @@ type:
 - how-to
 ---
 
-{{< note >}} The `nginx-plus-module-cookie-flag` package is no longer available.{{< /note >}}
+{{< note >}} The `nginx-plus-module-cookie-flag` package is no longer available in the NGINX Plus repository.{{< /note >}}
 
-The module was deprecated in [NGINX Plus Release 23]({{< ref "nginx/releases.md#r23" >}}) and removed in [NGINX Plus Release 26]({{< ref "nginx/releases.md#r26" >}}). Its functionality has been replaced with natively supported [`proxy_cookie_flags`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_flags) directive.
+The module was deprecated in [NGINX Plus Release 23]({{< ref "/nginx/releases.md#r23" >}}) and removed in [NGINX Plus Release 26]({{< ref "/nginx/releases.md#r26" >}}). Its functionality has been replaced with natively supported [`proxy_cookie_flags`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_flags) directive.
 
-To remove the module, follow the [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}}) instructions.
+To remove the module, follow the [Uninstalling a dynamic module]({{< ref "uninstall.md" >}}) instructions.
 
 To learn how to replace the module with the native solution, see [Native Method for Setting Cookie Flags](https://www.nginx.com/blog/nginx-plus-r23-released#cookie-flags) and the [`proxy_cookie_flags`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_flags) directive.
 
 
-## More Info
+## More info
 
-- [NGINX Module Reference for Adding Cookie Flag](https://github.com/AirisX/nginx_cookie_flag_module)
+- [NGINX module reference for adding Cookie flag](https://github.com/AirisX/nginx_cookie_flag_module)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md b/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md
index 4307452fb..aa75944a8 100644
--- a/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md
+++ b/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md
@@ -11,13 +11,13 @@ type:
 
 ## Overview
 
-F5 NGINX Plus uses a modular architecture. New features and functionality can be added with software modules, which can be plugged into a running NGINX Plus instance on demand. Dynamic modules add functionality to NGINX Plus such as [geolocating users by IP address]({{< ref "geoip2.md" >}}), [resizing images]({{< ref "image-filter.md" >}}), and embedding [NGINX JavaScript njs]({{< ref "nginscript.md" >}}) or [Lua]({{< ref "nginx/admin-guide/dynamic-modules/lua.md" >}}) scripts into the NGINX Plus event‑processing model. Modules are created both by NGINX and third‑party developers.
+F5 NGINX Plus uses a modular architecture. New features and functionality can be added with software modules, which can be plugged into a running NGINX Plus instance on demand. Dynamic modules add functionality to NGINX Plus such as [geolocating users by IP address]({{< ref "/nginx/admin-guide/dynamic-modules/geoip2.md" >}}), [resizing images]({{< ref "/nginx/admin-guide/dynamic-modules/image-filter.md" >}}), and embedding [NGINX JavaScript njs]({{< ref "/nginx/admin-guide/dynamic-modules/nginscript.md" >}}) or [Lua]({{< ref "/nginx/admin-guide/dynamic-modules/lua.md" >}}) scripts into the NGINX Plus event‑processing model. Modules are created both by NGINX and third‑party developers.
 
 <img src="/nginx/images/nginx-plus-dynamic-module-plug-ins.png" alt="NGINX Plus allows features to be plugged in on demand" width="500" height="500" style="border:2px solid #666666; padding:2px; margin:2px;" />
 
 Dynamic modules are shared object files (`.so`) that can be loaded at runtime using the [`load_module`](https://nginx.org/en/docs/ngx_core_module.html#load_module) directive in the NGINX configuration.
 
-NGINX maintains the official NGINX Plus repository, which also provides packaged binaries for both [NGINX‑authored](#nginx-authored-dynamic-modules) and [NGINX‑certified community](#nginx-certified-community-dynamic-modules) dynamic modules. All modules in this repository are fully tested to ensure full compatibility with NGINX Plus.
+NGINX maintains the official NGINX Plus repository, which also provides packaged binaries for both [NGINX‑authored]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md#nginx-authored-dynamic-modules" >}}) and [NGINX‑certified community]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md#nginx-certified-community-dynamic-modules" >}}) dynamic modules. All modules in this repository are fully tested to ensure full compatibility with NGINX Plus.
 
 For module‑specific installation and usage instructions, select the corresponding package name in the table.
 
@@ -25,45 +25,44 @@ For module‑specific installation and usage instructions, select the correspond
 {{< bootstrap-table "table table-striped table-bordered" >}}
 | Name                            | Description                       | Package name     |
 |---------------------------------|-----------------------------------|--------------------|
-| [Brotli](https://github.com/google/ngx_brotli) | Brotli compression support with modules for dynamic compression and for serving pre-compressed `.br` files. | [`nginx-plus-module-brotli`]({{< ref "nginx/admin-guide/dynamic-modules/brotli.md" >}}) |
-| [Encrypted-Session](https://github.com/openresty/encrypted-session-nginx-module) | AES-256 based encryption/decryption of NGINX variables. | [`nginx-plus-module-encrypted-session`]({{< ref "nginx/admin-guide/dynamic-modules/encrypted-session.md" >}}) |
-| [FIPS Status Check](https://github.com/ogarrett/nginx-fips-check-module) | Verifies if OpenSSL is operating in FIPS mode. | [`nginx-plus-module-fips-check`]({{< ref "nginx/admin-guide/dynamic-modules/fips.md" >}})|
-| [GeoIP](https://nginx.org/en/docs/http/ngx_http_geoip_module.html) | Enables IP-based geolocation using the precompiled MaxMind databases. | [`nginx-plus-module-geoip`]({{< ref "nginx/admin-guide/dynamic-modules/geoip.md" >}}) |
-| [GeoIP2](https://github.com/leev/ngx_http_geoip2_module)  | Uses MaxMind GeoIP2 for enhanced geolocation. | [`nginx-plus-module-geoip2`]({{< ref "nginx/admin-guide/dynamic-modules/geoip2.md" >}})|
-| [Headers-More](https://github.com/openresty/headers-more-nginx-module) | Extends the NGINX [Headers](https://nginx.org/en/docs/http/ngx_http_headers_module.html) module to modify request and response headers. | [`nginx-plus-module-headers-more`]({{< ref "nginx/admin-guide/dynamic-modules/headers-more.md" >}}) |
-| [HTTP Substitutions Filter](https://github.com/yaoweibin/ngx_http_substitutions_filter_module) | Enables regex and string-based substitutions in response bodies. | [`nginx-plus-module-subs-filter`]({{< ref "nginx/admin-guide/dynamic-modules/http-substitutions-filter.md" >}}) |
-| [Image-Filter](https://nginx.org/en/docs/http/ngx_http_image_filter_module.html) | Adds on-the-fly support for JPEG, GIF, PNG, and WebP image resizing and cropping. | [`nginx-plus-module-image-filter`]({{< ref "nginx/admin-guide/dynamic-modules/image-filter.md" >}}) |
-| [Lua](https://github.com/openresty/lua-nginx-module) | Embeds Lua programming language. | [`nginx-plus-module-lua`]({{< ref "nginx/admin-guide/dynamic-modules/lua.md" >}})|
-| [NGINX Developer Kit](https://github.com/vision5/ngx_devel_kit) | Provides helper macros for module development. | [`nginx-plus-module-ndk`]({{< ref "nginx/admin-guide/dynamic-modules/ndk.md" >}}) |
-| [njs Scripting Language](https://nginx.org/en/docs/njs/) | Adds JavaScript-like scripting for advanced server-side logic in NGINX configuration file. | [`nginx-plus-module-njs`]({{< ref "nginx/admin-guide/dynamic-modules/nginscript.md" >}}) |
-| [OpenTelemetry](https://nginx.org/en/docs/ngx_otel_module.html#directives) | Adds distributed tracing support via OpenTelemetry. | [`nginx-plus-module-otel`]({{< ref "nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) |
-| [Perl](https://nginx.org/en/docs/http/ngx_http_perl_module.html)| Integrates Perl scripting for advanced customization. | [`nginx-plus-module-perl`]({{< ref "nginx/admin-guide/dynamic-modules/perl.md" >}}) |
-| [Phusion Passenger](https://www.phusionpassenger.com/library/install/nginx/) | Application server for Node.js, Python, Ruby. | [`nginx-plus-module-passenger`]({{< ref "nginx/admin-guide/dynamic-modules/passenger-open-source.md" >}}) |
-| [Prometheus-njs](https://github.com/nginx/nginx-prometheus-exporter) | Converts [NGINX Plus metrics](https://demo.nginx.com/swagger-ui/) into Prometheus format. | [`nginx-plus-module-prometheus`]({{< ref "nginx/admin-guide/dynamic-modules/prometheus-njs.md" >}}) |
-| [RTMP](https://github.com/arut/nginx-rtmp-module) | Adds streaming capabilities (RTMP, HLS, MPEG-DASH, FFmpeg support).| [`nginx-plus-module-rtmp`]({{< ref "nginx/admin-guide/dynamic-modules/rtmp.md" >}}) |
-| [Set-Misc](https://github.com/openresty/set-misc-nginx-module) | Adds `set_*` directives for scripting (extend NGINX [Rewrite](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html) module). | [`nginx-plus-module-set-misc`]({{< ref "nginx/admin-guide/dynamic-modules/set-misc.md" >}}) |
-| [SPNEGO for Kerberos](https://github.com/stnoonan/spnego-http-auth-nginx-module) | Adds support for [GSS‑API based](https://www.rfc-editor.org/rfc/rfc2743) SPNEGO/Kerberos authentication. | [`nginx-plus-module-auth-spnego`]({{< ref "nginx/admin-guide/dynamic-modules/spnego.md" >}}) |
-| [XSLT](https://nginx.org/en/docs/http/ngx_http_xslt_module.html) | Applies XSLT transformations to XML responses. | [`nginx-plus-module-xslt`]({{< ref "nginx/admin-guide/dynamic-modules/xslt.md" >}}) |
+| [Brotli](https://github.com/google/ngx_brotli) | Brotli compression support with modules for dynamic compression and for serving pre-compressed `.br` files. | [`nginx-plus-module-brotli`]({{< ref "/nginx/admin-guide/dynamic-modules/brotli.md" >}}) |
+| [Encrypted-Session](https://github.com/openresty/encrypted-session-nginx-module) | AES-256 based encryption/decryption of NGINX variables. | [`nginx-plus-module-encrypted-session`]({{< ref "/nginx/admin-guide/dynamic-modules/encrypted-session.md" >}}) |
+| [FIPS Status Check](https://github.com/ogarrett/nginx-fips-check-module) | Verifies if OpenSSL is operating in FIPS mode. | [`nginx-plus-module-fips-check`]({{< ref "/nginx/admin-guide/dynamic-modules/fips.md" >}})|
+| [GeoIP](https://nginx.org/en/docs/http/ngx_http_geoip_module.html) | Enables IP-based geolocation using the precompiled MaxMind databases. | [`nginx-plus-module-geoip`]({{< ref "/nginx/admin-guide/dynamic-modules/geoip.md" >}}) |
+| [GeoIP2](https://github.com/leev/ngx_http_geoip2_module)  | Uses MaxMind GeoIP2 for enhanced geolocation. | [`nginx-plus-module-geoip2`]({{< ref "/nginx/admin-guide/dynamic-modules/geoip2.md" >}})|
+| [Headers-More](https://github.com/openresty/headers-more-nginx-module) | Extends the NGINX [Headers](https://nginx.org/en/docs/http/ngx_http_headers_module.html) module to modify request and response headers. | [`nginx-plus-module-headers-more`]({{< ref "/nginx/admin-guide/dynamic-modules/headers-more.md" >}}) |
+| [HTTP Substitutions Filter](https://github.com/yaoweibin/ngx_http_substitutions_filter_module) | Enables regex and string-based substitutions in response bodies. | [`nginx-plus-module-subs-filter`]({{< ref "/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md" >}}) |
+| [Image-Filter](https://nginx.org/en/docs/http/ngx_http_image_filter_module.html) | Adds on-the-fly support for JPEG, GIF, PNG, and WebP image resizing and cropping. | [`nginx-plus-module-image-filter`]({{< ref "/nginx/admin-guide/dynamic-modules/image-filter.md" >}}) |
+| [Lua](https://github.com/openresty/lua-nginx-module) | Embeds Lua programming language. | [`nginx-plus-module-lua`]({{< ref "/nginx/admin-guide/dynamic-modules/lua.md" >}})|
+| [NGINX Developer Kit](https://github.com/vision5/ngx_devel_kit) | Provides helper macros for module development. | [`nginx-plus-module-ndk`]({{< ref "/nginx/admin-guide/dynamic-modules/ndk.md" >}}) |
+| [njs Scripting Language](https://nginx.org/en/docs/njs/) | Adds JavaScript-like scripting for advanced server-side logic in NGINX configuration file. | [`nginx-plus-module-njs`]({{< ref "/nginx/admin-guide/dynamic-modules/nginscript.md" >}}) |
+| [OpenTelemetry](https://nginx.org/en/docs/ngx_otel_module.html#directives) | Adds distributed tracing support via OpenTelemetry. | [`nginx-plus-module-otel`]({{< ref "/nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) |
+| [Perl](https://nginx.org/en/docs/http/ngx_http_perl_module.html)| Integrates Perl scripting for advanced customization. | [`nginx-plus-module-perl`]({{< ref "/nginx/admin-guide/dynamic-modules/perl.md" >}}) |
+| [Phusion Passenger](https://www.phusionpassenger.com/library/install/nginx/) | Application server for Node.js, Python, Ruby. | [`nginx-plus-module-passenger`]({{< ref "/nginx/admin-guide/dynamic-modules/passenger-open-source.md" >}}) |
+| [Prometheus-njs](https://github.com/nginx/nginx-prometheus-exporter) | Converts [NGINX Plus metrics](https://demo.nginx.com/swagger-ui/) into Prometheus format. | [`nginx-plus-module-prometheus`]({{< ref "/nginx/admin-guide/dynamic-modules/prometheus-njs.md" >}}) |
+| [RTMP](https://github.com/arut/nginx-rtmp-module) | Adds streaming capabilities (RTMP, HLS, MPEG-DASH, FFmpeg support).| [`nginx-plus-module-rtmp`]({{< ref "/nginx/admin-guide/dynamic-modules/rtmp.md" >}}) |
+| [Set-Misc](https://github.com/openresty/set-misc-nginx-module) | Adds `set_*` directives for scripting (extend NGINX [Rewrite](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html) module). | [`nginx-plus-module-set-misc`]({{< ref "/nginx/admin-guide/dynamic-modules/set-misc.md" >}}) |
+| [SPNEGO for Kerberos](https://github.com/stnoonan/spnego-http-auth-nginx-module) | Adds support for [GSS‑API based](https://www.rfc-editor.org/rfc/rfc2743) SPNEGO/Kerberos authentication. | [`nginx-plus-module-auth-spnego`]({{< ref "/nginx/admin-guide/dynamic-modules/spnego.md" >}}) |
+| [XSLT](https://nginx.org/en/docs/http/ngx_http_xslt_module.html) | Applies XSLT transformations to XML responses. | [`nginx-plus-module-xslt`]({{< ref "/nginx/admin-guide/dynamic-modules/xslt.md" >}}) |
 {{< /bootstrap-table >}}
 
-### Community Dynamic Modules
-Besides the modules provided in the official repository, a wide range of third-party modules is available through community-driven projects such as [Awesome NGINX GitHub project](https://github.com/agile6v/awesome-nginx#third-party-modules). Many of these modules can be [compiled as dynamic modules](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/#install_modules_oss) and used with your NGINX Plus or NGINX Open Source deployments.
+### Community dynamic modules 
+Besides the modules provided in the official repository, a wide range of third-party modules is available through community-driven projects such as [Awesome NGINX GitHub project](https://github.com/agile6v/awesome-nginx#third-party-modules). Many of these modules can be [compiled as dynamic modules]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md#install_modules_oss" >}}) and used with your NGINX Plus or NGINX Open Source deployments.
 
-### NGINX Certified Partner Dynamic Modules
+### NGINX Certified Partner dynamic modules
  In addition to the modules authored by NGINX and community third‑party developers, NGINX Certified Partner Modules are available for purchase from commercial third parties. Certified Modules are distributed and supported by their authors. NGINX has tested the modules extensively and [certifies](https://www.f5.com/go/partner/nginx-certified-module-program-documentation) that they do not interfere with standard NGINX Plus functionality.
 
-NGINX Certified Partner Modules can be found on the [F5 Dynamic Modules page](https://www.f5.com/go/product/nginx-modules?filter=module-author%3Anginx-certified-partner).
+NGINX Certified Partner modules can be found on the [F5 Dynamic Modules page](https://www.f5.com/go/product/nginx-modules?filter=module-author%3Anginx-certified-partner).
 
 ### Prerequisites
 
-To get started using dynamic modules, first install the [latest NGINX Plus release]({{< ref "nginx/releases.md" >}}), following the [installation instructions]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). Dynamic modules are supported since [NGINX Plus Release 9]({{< ref "/nginx/releases.md#r9" >}}).
+To get started using dynamic modules, first install the [latest NGINX Plus release]({{< ref "/nginx/releases.md" >}}), following the [installation instructions]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). Dynamic modules are supported since [NGINX Plus Release 9]({{< ref "/nginx/releases.md#r9" >}}).
 
-## Getting Started with the Dynamic Modules Repository
+## Getting started with the dynamic modules repository
 
 You can access and install the modules from the NGINX Plus repository using standard package management tools such as `apt`, `dnf`, `pkg`, `yum`, or `zypper`.
 
-
-### Displaying the List of Available Modules
+### Displaying the list of available modules
 
 To see the list of available modules, run this command (for Debian and Ubuntu):
 
@@ -137,7 +136,7 @@ nginx-plus-module-xslt/stable
 
 ```
 
-The command output also includes an optional debugging symbols package available for each module, for example, `nginx-plus-module-njs-dbg`. These packages are intended for troubleshooting and diagnostics and should be installed only in debugging or development environments. For more information, see [Debugging NGINX]({{< ref "nginx/admin-guide/monitoring/debugging.md" >}}).
+The command output also includes an optional debugging symbols package available for each module, for example, `nginx-plus-module-njs-dbg`. These packages are intended for troubleshooting and diagnostics and should be installed only in debugging or development environments. For more information, see [Debugging NGINX]({{< ref "/nginx/admin-guide/monitoring/debugging.md" >}}).
 
 ### Installing and loading the module
 
@@ -177,24 +176,24 @@ For example, to enable the `njs` dynamic modules after the installation of the `
 
 ### Caveats
 
-Certain dynamic modules may be unavailable on specific operating system versions due to platform limitations. For detailed compatibility information, see the [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md#dynamic-modules" >}}).
+Certain dynamic modules may be unavailable on specific operating system versions due to platform limitations. For detailed compatibility information, see the [NGINX Plus Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}).
 
 
-## Compiling Your Own Dynamic Modules
+## Compiling your own dynamic modules
 
 To compile your own dynamic modules, see the [Compiling Third-Party Dynamic Modules for NGINX Plus](https://www.f5.com/company/blog/nginx/compiling-dynamic-modules-nginx-plus) blogpost.
 
 
-## Uninstalling a Dynamic Module
+## Uninstalling a dynamic module
 
 To uninstall a dynamic module, see the [Uninstalling a dynamic module]({{< ref "uninstall.md" >}}) article.
 
 ## See Also
 
-- [Installing NGINX Plus]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}})
+- [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Compiling Third-Party Dynamic Modules blogpost](https://www.f5.com/company/blog/nginx/compiling-dynamic-modules-nginx-plus)
+- [Compiling third-party dynamic modules](https://www.f5.com/company/blog/nginx/compiling-dynamic-modules-nginx-plus)
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/encrypted-session.md b/content/nginx/admin-guide/dynamic-modules/encrypted-session.md
index fe9d482d8..a3a90e94a 100644
--- a/content/nginx/admin-guide/dynamic-modules/encrypted-session.md
+++ b/content/nginx/admin-guide/dynamic-modules/encrypted-session.md
@@ -8,17 +8,19 @@ type:
 - how-to
 ---
 
-The Encrypted Session dynamic module provides encryption and decryption support for NGINX variables based on AES-256 with MAC. It is usually used with the [Set-Misc](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/set-misc/) dynamic module and the NGINX [`rewrite`](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html) module.
+The Encrypted Session dynamic module provides encryption and decryption support for NGINX variables based on AES-256 with MAC. It is usually used with the [Set-Misc]({{< ref "/nginx/admin-guide/dynamic-modules/set-misc.md" >}}) dynamic module and the NGINX [`rewrite`](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html) module.
 
 ## Prerequisites
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
-2. Prior to installing the module, verify that the [NDK]({{< ref "ndk.md" >}}) module is already installed.
+2.  Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
+
+3. Prior to installing the module, verify that the [NDK]({{< ref "ndk.md" >}}) module is already installed.
 
 ## Installation
 
-1. Install the Encrypted Session module package `nginx-plus-module-encrypted-session`.
+1. Install the Encrypted Session module package `nginx-plus-module-encrypted-session` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -99,12 +101,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [NGINX encrypted-session-nginx-module Module Reference](https://github.com/openresty/encrypted-session-nginx-module)
+- [The `encrypted-session-nginx-module` module GitHub project](https://github.com/openresty/encrypted-session-nginx-module)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/fips.md b/content/nginx/admin-guide/dynamic-modules/fips.md
index 41678e25f..bc7942a33 100644
--- a/content/nginx/admin-guide/dynamic-modules/fips.md
+++ b/content/nginx/admin-guide/dynamic-modules/fips.md
@@ -13,9 +13,11 @@ For F5 NGINX Plus, the cryptographic boundary includes all functionality that is
 
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
-2. Install the FIPS module package `nginx-plus-module-fips-check`.
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
+
+3. Install the FIPS module package `nginx-plus-module-fips-check` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -93,14 +95,14 @@ After installation you will need to enable and configure the module in NGINX Plu
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [FIPS Compliance for NGINX Plus](https://docs.nginx.com/nginx/fips-compliance-nginx-plus/)
+- [FIPS compliance for NGINX Plus]({{< ref "/nginx/fips-compliance-nginx-plus.md" >}})
 
-- [NGINX FIPS Status Check Module Reference](https://github.com/ogarrett/nginx-fips-check-module)
+- [NGINX FIPS Status Check module GitHub project](https://github.com/ogarrett/nginx-fips-check-module)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/geoip.md b/content/nginx/admin-guide/dynamic-modules/geoip.md
index 8aa3f53cc..ea44055a9 100644
--- a/content/nginx/admin-guide/dynamic-modules/geoip.md
+++ b/content/nginx/admin-guide/dynamic-modules/geoip.md
@@ -9,13 +9,17 @@ type:
 - how-to
 ---
 
+The GeoIP dynamic module captures information from the client IP address in variables using the MaxMind GeoLite databases.
+
 {{< note >}} MaxMind GeoLite Legacy databases are currently [discontinued](https://blog.maxmind.com/2018/01/discontinuation-of-the-geolite-legacy-databases), MaxMind GeoIP2 or Geolite2 databases and F5 NGINX Plus [GeoIP2 module]({{< ref "geoip2.md" >}}) should be used instead. {{< /note >}}
 
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the GeoIP module package `nginx-plus-module-geoip`.
+3. Install the GeoIP module package `nginx-plus-module-geoip` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -60,6 +64,10 @@ After installation you will need to enable and configure the module in NGINX Plu
    http {
        # ...
    }
+
+   stream {
+       # ...
+   }
    ```
 
 2. Perform additional configuration as required by the module ([HTTP](https://nginx.org/en/docs/http/ngx_http_geoip_module.html) or [TCP/UDP](https://nginx.org/en/docs/stream/ngx_stream_geoip_module.html)).
@@ -83,18 +91,18 @@ After installation you will need to enable and configure the module in NGINX Plu
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [GeoIP2 Dynamic Module Installation Instructions]({{< ref "geoip2.md" >}})
+- [GeoIP2 dynamic module]({{< ref "geoip2.md" >}})
 
-- [Restricting Access by Geographical Location]({{< ref "nginx/admin-guide/security-controls/controlling-access-by-geoip.md" >}})
+- [Restricting access by geographical location]({{< ref "/nginx/admin-guide/security-controls/controlling-access-by-geoip.md" >}})
 
-- [ngx_http_geoip_module Module Reference](https://nginx.org/en/docs/http/ngx_http_geoip_module.html)
+- [NGINX `ngx_http_geoip_module` module reference](https://nginx.org/en/docs/http/ngx_http_geoip_module.html)
 
-- [ngx_stream_geoip_module Module Reference](https://nginx.org/en/docs/stream/ngx_stream_geoip_module.html)
+- [NGINX `ngx_stream_geoip_module` module reference](https://nginx.org/en/docs/stream/ngx_stream_geoip_module.html)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/geoip2.md b/content/nginx/admin-guide/dynamic-modules/geoip2.md
index de02e575d..500527fd8 100644
--- a/content/nginx/admin-guide/dynamic-modules/geoip2.md
+++ b/content/nginx/admin-guide/dynamic-modules/geoip2.md
@@ -10,18 +10,16 @@ type:
 - how-to
 ---
 
-
-## Module Info
-
 [MaxMind GeoIP2](https://www.maxmind.com/en/geoip2-databases) databases provide contextual data for a comprehensive profile of IP addresses, including geolocation data (region, state, city, postal code) and extra data (ISP, domain, connection type). Basing on these data, F5 NGINX Plus will be able to perform different user differentiation strategies, for example, provide different type of content depending on a country.
 
 
-
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the GeoIP2 module package `nginx-plus-module-geoip2`.
+3. Install the GeoIP2 module package `nginx-plus-module-geoip2` from the official NGINX Plus repository.
 
    For CentOS, Oracle Linux, and RHEL:
 
@@ -74,6 +72,10 @@ After installation you will need to enable and configure the module in NGINX Plu
    http {
        # ...
    }
+
+   stream {
+       # ...
+   }
    ```
 
 2. Perform additional configuration as required by the [module](https://github.com/leev/ngx_http_geoip2_module#user-content-download-maxmind-geolite2-database-optional).
@@ -98,16 +100,16 @@ After installation you will need to enable and configure the module in NGINX Plu
     ```
 
 
-## More Info
+## More info
 
-- [Restricting Access by Geographical Location]({{< ref "nginx/admin-guide/security-controls/controlling-access-by-geoip.md" >}})
+- [Restricting Access by Geographical Location]({{< ref "/nginx/admin-guide/security-controls/controlling-access-by-geoip.md" >}})
 
-- [MaxMind GeoIP2 Databases](https://www.maxmind.com/en/geoip2-databases)
+- [MaxMind GeoIP2 databases](https://www.maxmind.com/en/geoip2-databases)
 
-- [MaxMind Geolite2 Free Downloadable Databases](https://dev.maxmind.com/geoip/geoip2/geolite2/)
+- [MaxMind Geolite2 free downloadable databases](https://dev.maxmind.com/geoip/geoip2/geolite2/)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/headers-more.md b/content/nginx/admin-guide/dynamic-modules/headers-more.md
index e9e55f980..9c404544e 100644
--- a/content/nginx/admin-guide/dynamic-modules/headers-more.md
+++ b/content/nginx/admin-guide/dynamic-modules/headers-more.md
@@ -9,12 +9,15 @@ type:
 - how-to
 ---
 
+The Headers-More dynamic module extends the NGINX core [Headers](https://nginx.org/en/docs/http/ngx_http_headers_module.html) module by enabling the functionality of setting or clearing input and output headers.
 
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
-2. Install the Headers-More module package `nginx-plus-module-headers-more`.
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
+
+3. Install the Headers-More module package `nginx-plus-module-headers-more` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -94,13 +97,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
+## More info
 
-## More Info
-
-- [NGINX ngx_headers_more Module Reference](https://github.com/openresty/headers-more-nginx-module)
+- [NGINX `ngx_headers_more` GitHub project](https://github.com/openresty/headers-more-nginx-module)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md b/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md
index c0f2f44a8..ccd7277a5 100644
--- a/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md
+++ b/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md
@@ -9,11 +9,15 @@ type:
 - how-to
 ---
 
+The HTTP Substitutions Filter dynamic module replaces text in response bodies, using regular expressions and fixed strings.
+
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the HTTP Substitutions Filter module package `nginx-plus-module-subs-filter`.
+3. Install the HTTP Substitutions Filter module package `nginx-plus-module-subs-filter` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -85,12 +89,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [NGINX Substitution Filter Module Reference](https://github.com/yaoweibin/ngx_http_substitutions_filter_module)
+- [NGINX Substitution Filter GitHub project](https://github.com/yaoweibin/ngx_http_substitutions_filter_module)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/image-filter.md b/content/nginx/admin-guide/dynamic-modules/image-filter.md
index 65e6b76df..827556bc2 100644
--- a/content/nginx/admin-guide/dynamic-modules/image-filter.md
+++ b/content/nginx/admin-guide/dynamic-modules/image-filter.md
@@ -8,12 +8,15 @@ weight: 100
 type:
 - how-to
 ---
+The Image-Filter dynamic module enables you to crop, resize, rotate, and apply various transformations to GIF, JPEG, and PNG images.
 
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
-2. Install the Image-Filter module package `nginx-plus-module-image-filter`.
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
+
+3. Install the Image-Filter module package `nginx-plus-module-image-filter` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -91,12 +94,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [NGINX Image Filter Module Reference](https://nginx.org/en/docs/http/ngx_http_image_filter_module.html)
+- [NGINX Image Filter module reference](https://nginx.org/en/docs/http/ngx_http_image_filter_module.html)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/lua.md b/content/nginx/admin-guide/dynamic-modules/lua.md
index 4b9073791..8f0b237f1 100644
--- a/content/nginx/admin-guide/dynamic-modules/lua.md
+++ b/content/nginx/admin-guide/dynamic-modules/lua.md
@@ -12,13 +12,15 @@ Integrate Lua co-routines into the NGINX event-processing model with the communi
 
 ## Prerequisites
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
-2. Prior to installing the module, verify that the [NGINX Developer Kit (NDK)]({{< ref "nginx/admin-guide/dynamic-modules/ndk.md" >}}) module is already installed.
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
+
+3. Prior to installing the module, verify that the [NGINX Developer Kit (NDK)]({{< ref "/nginx/admin-guide/dynamic-modules/ndk.md" >}}) module is already installed.
 
 ## Installation
 
-   Install the Lua module package `nginx-plus-module-lua`.
+   Install the Lua module package `nginx-plus-module-lua` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -75,6 +77,10 @@ After installation, enable and configure the modules in NGINX Plus configuration
    http {
        # ...
    }
+
+   stream {
+       # ...
+   }
    ```
 
    {{< note >}} The `ndk_http_module.so` module must be placed first. {{< /note >}}
@@ -100,16 +106,16 @@ After installation, enable and configure the modules in NGINX Plus configuration
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [The `lua-nginx-module` Module Reference](https://github.com/openresty/lua-nginx-module)
+- [The `lua-nginx-module` GitHub Project](https://github.com/openresty/lua-nginx-module)
 
 - [The `stream-lua-nginx-module` Module Reference](https://github.com/openresty/stream-lua-nginx-module)
 
-- [The NDK Module Reference](https://github.com/vision5/ngx_devel_kit)
+- [The NDK Module GitHub project](https://github.com/vision5/ngx_devel_kit)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/ndk.md b/content/nginx/admin-guide/dynamic-modules/ndk.md
index bde538b43..a3476f8eb 100644
--- a/content/nginx/admin-guide/dynamic-modules/ndk.md
+++ b/content/nginx/admin-guide/dynamic-modules/ndk.md
@@ -10,13 +10,15 @@ type:
 
 The NGINX Developer Kit (NDK) module makes it easier for module developers to develop NGINX modules.
 
-The NDK module is also a prerequisite for [Encrypted Session]({{< ref "encrypted-session.md" >}}), [Lua]({{< ref "nginx/admin-guide/dynamic-modules/lua.md" >}}), and [Set-Misc]({{< ref "nginx/admin-guide/dynamic-modules/set-misc.md" >}}) modules.
+The NDK module is also a prerequisite for [Encrypted Session]({{< ref "encrypted-session.md" >}}), [Lua]({{< ref "/nginx/admin-guide/dynamic-modules/lua.md" >}}), and [Set-Misc]({{< ref "/nginx/admin-guide/dynamic-modules/set-misc.md" >}}) modules.
 
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
-2. Install the NDK module package `nginx-plus-module-ndk`.
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
+
+3. Install the NDK module package `nginx-plus-module-ndk` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -94,12 +96,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [NDK Module Reference](https://github.com/vision5/ngx_devel_kit)
+- [The NDK Module GitHub project](https://github.com/vision5/ngx_devel_kit)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/nginscript.md b/content/nginx/admin-guide/dynamic-modules/nginscript.md
index f5867c194..3a6cc2492 100644
--- a/content/nginx/admin-guide/dynamic-modules/nginscript.md
+++ b/content/nginx/admin-guide/dynamic-modules/nginscript.md
@@ -10,11 +10,15 @@ type:
 - how-to
 ---
 
+njs is an NGINX module that extends the server's functionality through JavaScript scripting, enabling the creation of custom server-side logic and [more](https://nginx.org/en/docs/njs/#usecases).
+
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the njs module package `nginx-plus-module-njs`.
+3. Install the njs module package `nginx-plus-module-njs` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -70,6 +74,10 @@ After installation you will need to enable and configure the module in F5 NGINX
    http {
        # ...
    }
+
+   stream {
+       # ...
+   }
    ```
 
 2. Perform additional configuration as required by the [module](https://www.nginx.com/blog/introduction-nginscript/).
@@ -93,12 +101,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [njs Scripting Language Reference and Examples](https://nginx.org/en/docs/njs/)
+- [njs Scripting Language reference and examples](https://nginx.org/en/docs/njs/)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/nginx-waf.md b/content/nginx/admin-guide/dynamic-modules/nginx-waf.md
index 88bb4bcea..4564ebfb6 100644
--- a/content/nginx/admin-guide/dynamic-modules/nginx-waf.md
+++ b/content/nginx/admin-guide/dynamic-modules/nginx-waf.md
@@ -9,22 +9,22 @@ type:
 - how-to
 ---
 
-{{< note >}} The `nginx-plus-module-modsecurity` package is no longer available.{{< /note >}}
+{{< note >}} The `nginx-plus-module-modsecurity` package is no longer available in the NGINX Plus repository.{{< /note >}}
 
-The ModSecurity WAF module was deprecated since [NGINX Plus Release 29]({{< ref "nginx/releases.md#r29" >}}), and is no longer available since [NGINX Plus Release 32]({{< ref "nginx/releases.md#r32" >}}).
+The ModSecurity WAF module was deprecated since [NGINX Plus Release 29]({{< ref "/nginx/releases.md#r29" >}}), and is no longer available since [NGINX Plus Release 32]({{< ref "/nginx/releases.md#r32" >}}).
 
 To remove the module, follow the [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}}) instructions.
 
 ## More Info
 
-- [ModSecurity Documentation](https://github.com/SpiderLabs/ModSecurity/wiki)
+- [ModSecurity documentation](https://github.com/SpiderLabs/ModSecurity/wiki)
 
-- [NGINX ModSecurity WAF Technical Specifications](https://docs.nginx.com/nginx-waf/technical-specs/)
+- [NGINX ModSecurity WAF technical specifications](https://docs.nginx.com/nginx-waf/technical-specs/)
 
-- [Installing and Configuring NGINX ModSecurity WAF](https://docs.nginx.com/nginx-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging/)
+- [Installing and configuring NGINX ModSecurity WAF](https://docs.nginx.com/nginx-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging/)
 
 - [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF](https://docs.nginx.com/nginx-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules/)
 
 - [Using the OWASP CRS with the NGINX ModSecurity WAF](https://docs.nginx.com/nginx-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs/)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/opentelemetry.md b/content/nginx/admin-guide/dynamic-modules/opentelemetry.md
index 23fec756a..e3adfbf0f 100644
--- a/content/nginx/admin-guide/dynamic-modules/opentelemetry.md
+++ b/content/nginx/admin-guide/dynamic-modules/opentelemetry.md
@@ -9,11 +9,9 @@ type:
 - how-to
 ---
 
-## Overview
-
 [OpenTelemetry](https://opentelemetry.io/) (OTel) is an observability framework for monitoring, tracing, troubleshooting, and optimizing applications. OTel enables the collection of telemetry data from a deployed application stack.
 
-The `nginx-plus-module-otel` module is an [NGINX-authored]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md#nginx-authored-dynamic-modules" >}}) dynamic module that enables NGINX Plus to send telemetry data to an OTel collector. The module supports [W3C](https://w3c.github.io/trace-context/) trace context propagation, OpenTelemetry Protocol (OTLP)/gRPC trace exports, and offers several advantages over existing OTel modules including:
+The `nginx-plus-module-otel` module is an [NGINX-authored]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md#nginx-authored-dynamic-modules" >}}) dynamic module that enables NGINX Plus to send telemetry data to an OTel collector. The module supports [W3C](https://w3c.github.io/trace-context/) trace context propagation, OpenTelemetry Protocol (OTLP)/gRPC trace exports, and offers several advantages over existing OTel modules including:
 
 - Enhanced performance: with the module enabled, request processing overhead is limited to 10-15%, compared to other OpenTelemetry implementations, which can introduce performance degradation of up to 50%.
 
@@ -25,14 +23,14 @@ The `nginx-plus-module-otel` module is an [NGINX-authored]({{< ref "nginx/admin-
 
 The source code for the module is available in the official [GitHub repository](https://github.com/nginxinc/nginx-otel). The official documentation, including module reference and usage examples, is available on the [nginx.org](https://nginx.org/en/docs/ngx_otel_module.html) website.
 
-The OpenTelemetry module supersedes the deprecated [OpenTracing]({{< ref "opentracing.md" >}}) module which was available until NGINX Plus [Release 34]({{< ref "nginx/releases.md#r34" >}}).
+The OpenTelemetry module supersedes the deprecated [OpenTracing]({{< ref "opentracing.md" >}}) module which was available until NGINX Plus [Release 34]({{< ref "/nginx/releases.md#r34" >}}).
 
 
 ## Installation
 
 The installation process closely follows the [NGINX Plus installation procedure]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). The module is available as the prebuilt `nginx-plus-module-otel` package for various Linux distributions and can be installed directly from the official NGINX Plus repository. Prior to installation, you need to add the NGINX Plus package repository for your distribution and update the repository metadata.
 
-1.  Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1.  Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
 
     {{< note >}} The OpenTelemetry module cannot be installed on Amazon Linux 2 LTS and SLES 15 SP5+. {{< /note >}}
 
@@ -211,9 +209,9 @@ The installation process closely follows the [NGINX Plus installation procedure]
 
 ## Configuration
 
- In a text editor, open the NGINX Plus configuration file:
-   - `/etc/nginx/nginx.conf` for Linux
-   - `/usr/local/etc/nginx/nginx.conf` for FreeBSD
+In a text editor, open the NGINX Plus configuration file:
+  - `/etc/nginx/nginx.conf` for Linux
+  - `/usr/local/etc/nginx/nginx.conf` for FreeBSD
 
 For a complete list of directives, embedded variables, default span attributes, refer to the `ngx_otel_module` official documentation.
 
@@ -295,12 +293,12 @@ http {
 
 ## More info
 
-- [GitHub Repository for the NGINX Native OpenTelemetry Module](https://github.com/nginxinc/nginx-otel)
+- [NGINX Native OpenTelemetry module GitHub project](https://github.com/nginxinc/nginx-otel)
 
-- [Official Documentation for the NGINX Native OpenTelemetry Module](https://nginx.org/en/docs/ngx_otel_module.html)
+- [Official documentation for the NGINX Native OpenTelemetry module](https://nginx.org/en/docs/ngx_otel_module.html)
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/opentracing.md b/content/nginx/admin-guide/dynamic-modules/opentracing.md
index f6b64b6db..967086de3 100644
--- a/content/nginx/admin-guide/dynamic-modules/opentracing.md
+++ b/content/nginx/admin-guide/dynamic-modules/opentracing.md
@@ -12,19 +12,19 @@ type:
 - how-to
 ---
 
-{{< note >}} The `nginx-plus-module-opentracing` package is no longer available.{{< /note >}}
+{{< note >}} The `nginx-plus-module-opentracing` package is no longer available in the NGINX Plus repository.{{< /note >}}
 
-The module was deprecated in [NGINX Plus Release 31]({{< ref "nginx/releases.md#r31" >}}) and removed in [NGINX Plus Release 34]({{< ref "nginx/releases.md#r34" >}}). Its functionality has been replaced with the [OpenTelemetry]({{< ref "nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) module.
+The module was deprecated in [NGINX Plus Release 31]({{< ref "/nginx/releases.md#r31" >}}) and removed in [NGINX Plus Release 34]({{< ref "/nginx/releases.md#r34" >}}). Its functionality has been replaced with the [OpenTelemetry]({{< ref "/nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) module.
 
-To remove the module, follow the [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}}) instructions.
+To remove the module, follow the [Uninstalling a dynamic module]({{< ref "uninstall.md" >}}) instructions.
 
 
-## More Info
+## More info
 
-- [NGINX plugin for OpenTracing Reference](https://github.com/opentracing-contrib/nginx-opentracing)
+- [NGINX plugin for OpenTracing GitHub project](https://github.com/opentracing-contrib/nginx-opentracing)
 
-- [NGINX Dynamic Modules]({{< ref "nginx/admin-guide/dynamic-modules/dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "/nginx/admin-guide/dynamic-modules/dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md b/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md
index 469556ef4..b65c82689 100644
--- a/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md
+++ b/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md
@@ -10,12 +10,15 @@ type:
 - how-to
 ---
 
-<span id="install"></span>
+The Passenger Open Source dynamic module from Phusion enables deployment and administration of applications written in Node.js, Python, and Ruby.
+
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the Phusion Passenger Open Source module package `nginx-plus-module-passenger`.
+3. Install the Phusion Passenger Open Source module package `nginx-plus-module-passenger` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -58,9 +61,6 @@ type:
    sudo pkg install nginx-plus-module-passenger
    ```
 
-
-<span id="configure"></span>
-
 ## Configuration
 
 After installation you will need to enable and configure the module in F5 NGINX Plus configuration file `nginx.conf`.
@@ -96,14 +96,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-
-<span id="info"></span>
 ## More Info
 
-- [Passenger Documentation](https://www.phusionpassenger.com/library/install/nginx/)
+- [Passenger documentation](https://www.phusionpassenger.com/library/install/nginx/)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/perl.md b/content/nginx/admin-guide/dynamic-modules/perl.md
index 7ff1b43a6..0ea7d52b3 100644
--- a/content/nginx/admin-guide/dynamic-modules/perl.md
+++ b/content/nginx/admin-guide/dynamic-modules/perl.md
@@ -10,12 +10,15 @@ type:
 - how-to
 ---
 
-<span id="install"></span>
+The Perl dynamic module allows implementing location and variable handlers in Perl and insert Perl calls into Server Side Includes (SSI).
+
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the Perl module package `nginx-plus-module-perl`.
+3. Install the Perl module package `nginx-plus-module-perl` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -58,9 +61,6 @@ type:
    sudo pkg install nginx-plus-module-perl
    ```
 
-
-<span id="configure"></span>
-
 ## Configuration
 
 After installation you will need to enable and configure the module in F5 NGINX Plus configuration file `nginx.conf`.
@@ -96,14 +96,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
+## More info
 
-<span id="info"></span>
-## More Info
-
-- [NGINX Perl Module Reference](https://nginx.org/en/docs/http/ngx_http_perl_module.html)
+- [NGINX Perl module reference](https://nginx.org/en/docs/http/ngx_http_perl_module.html)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md b/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md
index ffdc9e209..2dd3a26de 100644
--- a/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md
+++ b/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md
@@ -8,15 +8,11 @@ type:
 - how-to
 ---
 
-<span id="info"></span>
-## Module Info
-
 The `nginx-plus-module-prometheus` module is an [njs](https://nginx.org/en/docs/njs/) module that converts miscellaneous F5 NGINX Plus status metrics exposed by the [API](https://nginx.org/en/docs/http/ngx_http_api_module.html) module to a Prometheus compliant format. The module uses subrequests to the `/api` endpoint to access the metrics.
 In case you have configured [dynamic upstream routing](#prom_keyval) with generic names for upstream groups, the module can understand replacements for these names and display the correct statistics.
 
 
-<span id="data"></span>
-## Exported Metrics
+## Exported metrics {#data}
 
 The following NGINX Plus status metrics are exported to Prometheus:
 
@@ -57,52 +53,54 @@ The following NGINX Plus status metrics are exported to Prometheus:
 {{</bootstrap-table>}}
 {{< /note >}}
 
-<span id="install"></span>
-## Installation
+## Installation {#install}
+
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-Install the `nginx-plus-module-prometheus` module.
+3. Install the `nginx-plus-module-prometheus` module from the official NGINX Plus repository.
 
-- For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
+   - For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
-  ```shell
-  sudo yum install nginx-plus-module-prometheus
-  ```
+     ```shell
+     sudo yum install nginx-plus-module-prometheus
+     ```
 
-- For Amazon Linux 2023, AlmaLinux, Rocky Linux:
+   - For Amazon Linux 2023, AlmaLinux, Rocky Linux:
 
-  ```shell
-  sudo dnf install nginx-plus-module-prometheus
-  ```
+     ```shell
+     sudo dnf install nginx-plus-module-prometheus
+     ```
 
-- For Debian and Ubuntu:
+   - For Debian and Ubuntu:
 
-  ```shell
-  sudo apt install nginx-plus-module-prometheus
-  ```
+     ```shell
+     sudo apt install nginx-plus-module-prometheus
+     ```
 
-- For SLES:
+   - For SLES:
 
-  ```shell
-  sudo zypper install nginx-plus-module-prometheus
-  ```
+     ```shell
+     sudo zypper install nginx-plus-module-prometheus
+     ```
 
-- For Alpine:
+   - For Alpine:
 
-  ```shell
-  apk add nginx-plus-module-prometheus
-  ```
+     ```shell
+     apk add nginx-plus-module-prometheus
+     ```
 
-  For FreeBSD:
+     For FreeBSD:
 
-  ```shell
-  sudo pkg install nginx-plus-module-prometheus
-  ```
+     ```shell
+     sudo pkg install nginx-plus-module-prometheus
+     ```
 
-{{< note >}} The [`nginx-plus-module-njs`]({{< ref "nginscript.md" >}}) module will also be installed together with the module. {{< /note >}}
+   {{< note >}} The [`nginx-plus-module-njs`]({{< ref "nginscript.md" >}}) module will also be installed together with the module. {{< /note >}}
 
 
-<span id="conf"></span>
-## Configuration
+## Configuration {#conf}
 
 After module installation, perform the following steps in NGINX Plus configuration file (**nginx.conf**):
 
@@ -154,8 +152,7 @@ After module installation, perform the following steps in NGINX Plus configurati
 6. Configure Prometheus to obtain metrics from NGINX Plus by specifying the network address of the NGINX Plus instance in a [scrape_config](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config) section of the Prometheus configuration file.
 
 
-<span id="upgrade"></span>
-## Upgrade Instructions
+## Upgrade
 
 When upgrading Prometheus-njs version to version 1.3.1 and later, it is important to update NGINX Plus configuration file with the changes introduced in NGINX Plus [R22](https://www.nginx.com/blog/nginx-plus-r22-released/) and [njs 0.4.0](https://www.nginx.com/blog/nginx-plus-r22-released#njs):
 
@@ -166,8 +163,7 @@ When upgrading Prometheus-njs version to version 1.3.1 and later, it is importan
 See [Configuration](#conf) for the example of Prometheus-njs configuration in NGINX Plus configuration file.
 
 
-<span id="vars"></span>
-## Module Variables
+## Module variables {#vars}
 
 The module supports several embedded variables:
 
@@ -178,8 +174,7 @@ The module supports several embedded variables:
 The variables can be set in NGINX Plus configuration file with the [`set`](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#set) directive.
 
 
-<span id="prom_keyval"></span>
-### Using the $prom_keyval Variable
+### Using the $prom_keyval variable {#prom_keyval}
 
 The `$prom_keyval` variable has been created to correctly show statistics for dynamic configuration of upstream routing: when names of upstreams are generic and these names are dynamically replaced by real names from the [key-value](https://nginx.org/en/docs/http/ngx_http_keyval_module.html) storage.
 
@@ -226,9 +221,7 @@ http {
 }
 ```
 
-
-<span id="prom_keyval_stream"></span>
-### Using the $prom_keyval_stream Variable
+### Using the $prom_keyval_stream variable {#prom_keyval_stream}
 
 In order to perform dynamic replacements in the [`stream {}`](https://nginx.org/en/docs/stream/ngx_stream_core_module.html#stream) context, you will need to specify a new key-value storage in the stream block and set the name of the key-value storage in the `$prom_keyval_stream` variable:
 
@@ -267,9 +260,7 @@ stream {
 }
 ```
 
-
-<span id="prom_metrics_disabled"></span>
-### Using the $prom_metrics_disabled Variable
+### Using the $prom_metrics_disabled variable {#prom_metrics_disabled}
 
 The `$prom_metrics_disabled` variable disables exporting particular NGINX Plus status metrics to Prometheus. If you are concerned about the amount of storage NGINX Plus metrics are taking in Prometheus, you can disable particular endpoints via this variable. The variable value must be a comma separated list of NGINX Plus endpoints:
 
@@ -306,8 +297,7 @@ You can disable exporting the following NGINX Plus status metrics to Prometheus:
 - `stream/limit_conns`
 
 
-<span id="example"></span>
-## Example
+## Example 
 
 ```nginx
 load_module modules/ngx_http_js_module.so;
@@ -366,12 +356,10 @@ stream {
 }
 ```
 
+## More info {#info}
 
-<span id="info"></span>
-## More Info
-
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/rtmp.md b/content/nginx/admin-guide/dynamic-modules/rtmp.md
index 4a6b7a6e8..7220fe1d6 100644
--- a/content/nginx/admin-guide/dynamic-modules/rtmp.md
+++ b/content/nginx/admin-guide/dynamic-modules/rtmp.md
@@ -9,12 +9,15 @@ type:
 - how-to
 ---
 
-<span id="install"></span>
+The RTMP dynamic module enables video streaming in multiple formats, including  Real-Time Messaging Protocol (RTMP), HLS, and DASH.
+
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the RTMP Media Streaming module package `nginx-plus-module-rtmp`.
+3. Install the RTMP Media Streaming module package `nginx-plus-module-rtmp` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -57,9 +60,6 @@ type:
    sudo pkg install nginx-plus-module-rtmp
    ```
 
-
-<span id="configure"></span>
-
 ## Configuration
 
 After installation you will need to enable and configure the module in F5 NGINX Plus configuration file `nginx.conf`.
@@ -95,16 +95,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
+## More info {#info}
 
-<span id="info"></span>
-## More Info
-
-- [NGINX RTMP Module Reference](https://github.com/arut/nginx-rtmp-module)
-
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX RTMP GitHub project](https://github.com/arut/nginx-rtmp-module)
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/set-misc.md b/content/nginx/admin-guide/dynamic-modules/set-misc.md
index c31c8e23a..6d681f1d3 100644
--- a/content/nginx/admin-guide/dynamic-modules/set-misc.md
+++ b/content/nginx/admin-guide/dynamic-modules/set-misc.md
@@ -9,19 +9,19 @@ weight: 100
 type:
 - how-to
 ---
-
+The Set-Misc dynamic module extends the NGINX core [Rewrite](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html) by implementing numerous additional `set_*` directives. 
 
 ## Prerequisites
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
-
-2. Prior to installing the module, verify that the [NDK]({{< ref "ndk.md" >}}) module is already installed.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
+3. Prior to installing the module, verify that the [NDK]({{< ref "ndk.md" >}}) module is already installed.
 
 ## Installation
 
-Install the Set-Misc module package `nginx-plus-module-set-misc`.
+Install the Set-Misc module package `nginx-plus-module-set-misc` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -64,9 +64,6 @@ Install the Set-Misc module package `nginx-plus-module-set-misc`.
    sudo pkg install nginx-plus-module-set-misc
    ```
 
-
-
-
 ## Configuration
 
 After installation you will need to enable and configure the module in F5 NGINX Plus configuration file `nginx.conf`.
@@ -105,14 +102,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
+## More info
 
+- [The `ngx_set_misc` module GitHub project](https://github.com/openresty/set-misc-nginx-module)
 
-## More Info
-
-- [NGINX `ngx_set_misc` Module Reference](https://github.com/openresty/set-misc-nginx-module)
-
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/spnego.md b/content/nginx/admin-guide/dynamic-modules/spnego.md
index 517ee123c..003e4a2eb 100644
--- a/content/nginx/admin-guide/dynamic-modules/spnego.md
+++ b/content/nginx/admin-guide/dynamic-modules/spnego.md
@@ -9,11 +9,15 @@ type:
 - how-to
 ---
 
+The SPNEGO Auth module adds [SPNEGO](https://tools.ietf.org/html/rfc4178) support to F5 NGINX Plus. Currently, only Kerberos authentication via GSSAPI is supported.
+
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
+
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
 
-2. Install the SPNEGO Auth module package `nginx-plus-module-auth-spnego`.
+3. Install the SPNEGO Auth module package `nginx-plus-module-auth-spnego` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -91,14 +95,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-## More Info
-
-- [NGINX Module for HTTP SPNEGO Auth Reference](https://github.com/stnoonan/spnego-http-auth-nginx-module)
+## More info
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX module for HTTP SPNEGO auth GitHub poject](https://github.com/stnoonan/spnego-http-auth-nginx-module)
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/uninstall.md b/content/nginx/admin-guide/dynamic-modules/uninstall.md
index 1bd838201..66656fff7 100644
--- a/content/nginx/admin-guide/dynamic-modules/uninstall.md
+++ b/content/nginx/admin-guide/dynamic-modules/uninstall.md
@@ -13,7 +13,7 @@ You may need to uninstall a dynamic module in NGINX Plus in several scenarios:
 
 - The module is no longer supported, for example, the [NGINX ModSecurity WAF]({{< ref "nginx-waf.md" >}}) module.
 
-- The operating system is not supported by the module. See the the [Dynamic Modules]({{< ref "nginx/technical-specs.md#dynamic-modules" >}}) section of the [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md#dynamic-modules" >}}).
+- The operating system is not supported by the module. See the the [Dynamic Modules]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) section of the [NGINX Plus Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}).
 
 - The module it is no longer required, uninstalling it helps optimize resource usage and reduce maintenance overhead.
 
@@ -88,10 +88,10 @@ After uninstalling the package, you will need to disable the module in the NGINX
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [NGINX Module Reference](https://nginx.org/en/docs/)
+- [NGINX modules reference](https://nginx.org/en/docs/)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
diff --git a/content/nginx/admin-guide/dynamic-modules/xslt.md b/content/nginx/admin-guide/dynamic-modules/xslt.md
index 9a1c2674e..3eccd0f4e 100644
--- a/content/nginx/admin-guide/dynamic-modules/xslt.md
+++ b/content/nginx/admin-guide/dynamic-modules/xslt.md
@@ -8,12 +8,15 @@ weight: 100
 type:
 - how-to
 ---
+With the XSLT dynamic module, you can modify XML code in response bodies using one or more XSLT stylesheets.
 
 ## Installation
 
-1. Check the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}) page to verify that the module is supported by your operating system.
+1. Check the [Technical Specifications]({{< ref "/nginx/technical-specs.md#dynamic-modules" >}}) page to verify that the module is supported by your operating system.
 
-2. Install the XSLT module package `nginx-plus-module-xslt`.
+2. Make sure that your operating system is configured to retrieve binary packages from the official NGINX Plus repository. See installation instructions for your operating system on the [Installing NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) page.
+
+3. Install the XSLT module package `nginx-plus-module-xslt` from the official NGINX Plus repository.
 
    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:
 
@@ -91,12 +94,12 @@ After installation you will need to enable and configure the module in F5 NGINX
     nginx -s reload
     ```
 
-## More Info
+## More info
 
-- [NGINX ngx_http_xslt_module Reference](https://nginx.org/en/docs/http/ngx_http_xslt_module.html)
+- [NGINX `ngx_http_xslt_module` module reference](https://nginx.org/en/docs/http/ngx_http_xslt_module.html)
 
-- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}})
+- [NGINX dynamic modules]({{< ref "dynamic-modules.md" >}})
 
-- [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}})
+- [NGINX Plus technical specifications]({{< ref "/nginx/technical-specs.md" >}})
 
-- [Uninstalling a Dynamic Module]({{< ref "uninstall.md" >}})
+- [Uninstalling a dynamic module]({{< ref "uninstall.md" >}})

From f28a7367be389b43814347daf045d25fe41a830b Mon Sep 17 00:00:00 2001
From: yar <y82@users.noreply.github.com>
Date: Tue, 1 Jul 2025 12:12:31 +0100
Subject: [PATCH 071/117] feat: Add URLs to dynamic modules in NGINX Plus
 technical specifications (#769)

---
 content/nginx/technical-specs.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/content/nginx/technical-specs.md b/content/nginx/technical-specs.md
index d46a85875..01d774c67 100644
--- a/content/nginx/technical-specs.md
+++ b/content/nginx/technical-specs.md
@@ -39,12 +39,12 @@ Dynamic modules are supported on the [same distributions as NGINX Plus](#support
 {{<bootstrap-table "table table-striped table-bordered">}}
 | Module           | Distribution and details                                                                                   |
 |-------------------|-----------------------------------------------------------------------------------------------------------|
-| AppProtect        | AlmaLinux/Rocky Linux: **Not supported**<br>Alpine Linux: **Not supported**<br>Amazon Linux 2: **x86_64 only**<br>Amazon Linux 2023: **Not supported**<br>Debian 11: **x86_64 only**<br>FreeBSD: **Not supported**<br>Oracle Linux 8: **x86_64 only**<br>RHEL 8: **x86_64 only**<br>SLES: **Not supported**<br>Ubuntu 20.04: **x86_64 only** |
-| GeoIP             | Amazon Linux 2023  **Not supported**<br>RHEL/Oracle Linux/AlmaLinux/Rocky Linux 8.0+, 9: **Not supported**<br>FreeBSD: **Not supported**           |
-| GeoIP2            | Amazon Linux 2: **Not supported**                                            |
-| HA-Keepalived     | FreeBSD: **Not supported**<br>Alpine Linux: **Not supported**<br>Amazon Linux 2: **Not supported**<br>Amazon Linux 2023: **Not supported** |
-| NGINX sync        | FreeBSD: **Not supported**<br>Alpine Linux: **Not supported**                                              |
-| OpenTelemetry     | Amazon Linux 2: **Not supported**<br>SLES: **Not supported**                                               |                                                                                |
+| [AppProtect]({{< ref "/nap-waf/v5/admin-guide/install.md" >}}) | AlmaLinux/Rocky Linux: **Not supported**<br>Alpine Linux: **Not supported**<br>Amazon Linux 2: **x86_64 only**<br>Amazon Linux 2023: **Not supported**<br>Debian 11: **x86_64 only**<br>FreeBSD: **Not supported**<br>Oracle Linux 8: **x86_64 only**<br>RHEL 8: **x86_64 only**<br>SLES: **Not supported**<br>Ubuntu 20.04: **x86_64 only** |
+| [GeoIP]({{< ref "/nginx/admin-guide/dynamic-modules/geoip.md" >}}) | Amazon Linux 2023  **Not supported**<br>RHEL/Oracle Linux/AlmaLinux/Rocky Linux 8.0+, 9: **Not supported**<br>FreeBSD: **Not supported**           |
+| [GeoIP2]({{< ref "/nginx/admin-guide/dynamic-modules/geoip2.md" >}}) | Amazon Linux 2: **Not supported**                                            |
+| [HA-Keepalived]({{< ref "/nginx/admin-guide/high-availability/ha-keepalived-nodes.md#configuring-keepalived-for-an-additional-passive-node" >}}) | FreeBSD: **Not supported**<br>Alpine Linux: **Not supported**<br>Amazon Linux 2: **Not supported**<br>Amazon Linux 2023: **Not supported** |
+| [NGINX sync]({{< ref "/nginx/admin-guide/high-availability/configuration-sharing.md#installing-nginx-sync-on-the-primary-machine" >}}) | FreeBSD: **Not supported**<br>Alpine Linux: **Not supported**                                              |
+| [OpenTelemetry]({{< ref "/nginx/admin-guide/dynamic-modules/opentelemetry.md" >}})| Amazon Linux 2: **Not supported**<br>SLES: **Not supported**                                               |                                                                                |
 {{</bootstrap-table>}}
 
 ---

From 02b0041c198570ccd8e1f6899ac47ad75c0e3e0a Mon Sep 17 00:00:00 2001
From: Balakoteswara Panchakshari <b.panchakshari@f5.com>
Date: Tue, 1 Jul 2025 16:54:47 +0530
Subject: [PATCH 072/117] docs: update the NAP and NIM versions for new NIM NAP
 compiler (#767)

* docs: update the NAP and NIM versions for new NIM NAP compiler

* fix: Update content/includes/nim/tech-specs/security-data-plane-dependencies.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* fix: Update content/includes/nim/tech-specs/security-management-plane-dependencies.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

---------

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 .../nim/tech-specs/nim-app-protect-support.md |  2 +-
 .../security-data-plane-dependencies.md       |  5 ++++
 .../security-management-plane-dependencies.md |  4 ++-
 .../setup-waf-config-management.md            | 28 ++++++++++---------
 4 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/content/includes/nim/tech-specs/nim-app-protect-support.md b/content/includes/nim/tech-specs/nim-app-protect-support.md
index fda626499..203e7c2ef 100644
--- a/content/includes/nim/tech-specs/nim-app-protect-support.md
+++ b/content/includes/nim/tech-specs/nim-app-protect-support.md
@@ -8,7 +8,7 @@ NGINX Instance Manager supports the following versions of [NGINX App Protect WAF
 
 | NGINX Instance Manager | NGINX App Protect WAF              |
 |------------------------|------------------------------------|
-| 2.17.0–2.19.2          | Release 4.8.0–4.14.0, 5.1.0–5.6.0 |
+| 2.17.0–2.20.0          | Release 4.8.0–4.15.0, 5.1.0–5.7.0 |
 | 2.15.1–2.16.0          | Release 4.8.0–4.10.0              |
 | 2.14.1–2.15.0          | Release 4.4.0–4.7.0               |
 | 2.13.0–2.14.0          | Release 4.3.0–4.5.0               |
diff --git a/content/includes/nim/tech-specs/security-data-plane-dependencies.md b/content/includes/nim/tech-specs/security-data-plane-dependencies.md
index 9b841627a..010ad835b 100644
--- a/content/includes/nim/tech-specs/security-data-plane-dependencies.md
+++ b/content/includes/nim/tech-specs/security-data-plane-dependencies.md
@@ -1,5 +1,10 @@
 The Security Monitoring module requires the following versions of [NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect/) and [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) for the **data plane**:
 
+{{< note >}}
+In NGINX Instance Manager 2.18.0 and under, the Security Monitoring module was a separate package that was installed manually.
+From NGINX Instance Manager 2.19.0 onward, Security Monitoring is part of the NGINX Instance Manager feature-set and is packaged by default; no manual installation or upgrade is needed.
+{{< /note >}}
+
 {{<bootstrap-table "table table-striped table-bordered">}}
 
 | Security Monitoring | NGINX App Protect WAF                  |
diff --git a/content/includes/nim/tech-specs/security-management-plane-dependencies.md b/content/includes/nim/tech-specs/security-management-plane-dependencies.md
index e135ae6dc..25eb8f0fc 100644
--- a/content/includes/nim/tech-specs/security-management-plane-dependencies.md
+++ b/content/includes/nim/tech-specs/security-management-plane-dependencies.md
@@ -1,6 +1,8 @@
 The Security Monitoring module requires the following versions of NGINX Instance Manager to be installed on the **management plane**.
 
-{{< note >}}The Security Monitoring module doesn’t automatically install or upgrade NGINX Instance Manager. You’ll need to manually install or upgrade NGINX Instance Manager to a supported version.
+{{< note >}}
+In NGINX Instance Manager 2.18.0 and under, the Security Monitoring module was a separate package that was installed manually.
+From NGINX Instance Manager 2.19.0 onward, Security Monitoring is part of the NGINX Instance Manager feature-set and is packaged by default; no manual installation or upgrade is needed.
 {{< /note >}}
 
 {{<bootstrap-table "table table-striped table-bordered">}}
diff --git a/content/nim/nginx-app-protect/setup-waf-config-management.md b/content/nim/nginx-app-protect/setup-waf-config-management.md
index e8d2fb671..529c3f5ea 100644
--- a/content/nim/nginx-app-protect/setup-waf-config-management.md
+++ b/content/nim/nginx-app-protect/setup-waf-config-management.md
@@ -55,12 +55,14 @@ The table below shows which WAF compiler version to use for each version of NGIN
 
 | NGINX App Protect WAF version | WAF compiler version       |
 |-------------------------------|----------------------------|
+| 5.7.0                         | nms-nap-compiler-v5.442.0  |
 | 5.6.0                         | nms-nap-compiler-v5.342.0  |
 | 5.5.0                         | nms-nap-compiler-v5.264.0  |
 | 5.4.0                         | nms-nap-compiler-v5.210.0  |
 | 5.3.0                         | nms-nap-compiler-v5.144.0  |
 | 5.2.0                         | nms-nap-compiler-v5.48.0   |
 | 5.1.0                         | nms-nap-compiler-v5.17.0   |
+| 4.15.0                        | nms-nap-compiler-v5.442.0  |
 | 4.14.0                        | nms-nap-compiler-v5.342.0  |
 | 4.13.0                        | nms-nap-compiler-v5.264.0  |
 | 4.12.0                        | nms-nap-compiler-v5.210.0  |
@@ -86,13 +88,13 @@ The table below shows which WAF compiler version to use for each version of NGIN
 To install the WAF compiler on Debian or Ubuntu, run the following command:
 
 ```shell
-sudo apt-get install nms-nap-compiler-v5.342.0
+sudo apt-get install nms-nap-compiler-v5.442.0
 ```
 
 If you want to install more than one version of the WAF compiler on the same system, append the `--force-overwrite` option to the install command after the first installation:
 
 ```shell
-sudo apt-get install nms-nap-compiler-v5.342.0 -o Dpkg::Options::="--force-overwrite"
+sudo apt-get install nms-nap-compiler-v5.442.0 -o Dpkg::Options::="--force-overwrite"
 ```
 
 {{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -116,7 +118,7 @@ To install the WAF compiler on RHEL 8.1 or later:
 3. Install the WAF compiler:
 
    ```shell
-   sudo yum install nms-nap-compiler-v5.342.0
+   sudo yum install nms-nap-compiler-v5.442.0
    ```
 
 4. {{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -140,7 +142,7 @@ To install the WAF compiler on RHEL 7.4 or later or CentOS:
 3. Install the WAF compiler:
 
     ```shell
-    sudo yum install nms-nap-compiler-v5.342.0
+    sudo yum install nms-nap-compiler-v5.442.0
     ```
 
 4.	{{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -167,7 +169,7 @@ To install the WAF compiler on Amazon Linux 2 LTS:
 3. Install the WAF compiler:
 
     ```shell
-    sudo yum install nms-nap-compiler-v5.342.0
+    sudo yum install nms-nap-compiler-v5.442.0
     ```
 
 4. {{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -192,7 +194,7 @@ To install the WAF compiler on Oracle Linux 7.4 or later:
 3. Install the WAF compiler:
 
     ```shell
-    sudo yum install nms-nap-compiler-v5.342.0
+    sudo yum install nms-nap-compiler-v5.442.0
     ```
 
 4. {{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -1004,21 +1006,21 @@ sudo /opt/nms-nap-compiler/app_protect-<version>/bin/apcompile -h
 **Example:**
 
 ```shell
-sudo /opt/nms-nap-compiler/app_protect-5.342.0/bin/apcompile -h
+sudo /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -h
 ```
 
 **Expected output:**
 
 ```text
 USAGE:
-    /opt/nms-nap-compiler/app_protect-5.342.0/bin/apcompile <options>
+    /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile <options>
 
 Examples:
-    /opt/nms-nap-compiler/app_protect-5.342.0/bin/apcompile -p /path/to/policy.json -o mypolicy.tgz
-    /opt/nms-nap-compiler/app_protect-5.342.0/bin/apcompile -p policyA.json -g myglobal.json -o /path/to/policyA_bundle.tgz
-    /opt/nms-nap-compiler/app_protect-5.342.0/bin/apcompile -g myglobalsettings.json --global-state-outfile /path/to/myglobalstate.tgz
-    /opt/nms-nap-compiler/app_protect-5.342.0/bin/apcompile -b /path/to/policy_bundle.tgz --dump
-    /opt/nms-nap-compiler/app_protect-5.342.0/bin/apcompile -l logprofA.json -o /path/to/logprofA_bundle.tgz
+    /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -p /path/to/policy.json -o mypolicy.tgz
+    /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -p policyA.json -g myglobal.json -o /path/to/policyA_bundle.tgz
+    /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -g myglobalsettings.json --global-state-outfile /path/to/myglobalstate.tgz
+    /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -b /path/to/policy_bundle.tgz --dump
+    /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -l logprofA.json -o /path/to/logprofA_bundle.tgz
 ```
 
 ### Confirm NGINX Agent configuration on the NGINX App Protect WAF instance

From c8af3ad3c248f6e124a5d77547504c9a8554be92 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 1 Jul 2025 08:41:34 -0700
Subject: [PATCH 073/117] Update the NGINX One landing page for mainframe
 (#742)

* feat: Update the NGINX One landing page for mainframe

* feat: Small grammar fixes
---
 content/nginx-one/_index.md | 58 +++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 32 deletions(-)

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index 85e0d0596..be4b512c5 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -1,6 +1,6 @@
 ---
 title: F5 NGINX One Console
-nd-subtitle: The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
+nd-subtitle: Optimize, secure, and scale your modern apps 
 url: /nginx-one/
 nd-landing-page: true
 cascade:
@@ -8,41 +8,35 @@ cascade:
 nd-content-type: landing-page
 nd-product: NGINX One
 ---
+
+## About
+[//]: # "These are Markdown comments to guide you through document structure. Remove them as you go, as well as any unnecessary sections."
+[//]: # "Use underscores for _italics_, and double asterisks for **bold**."
+[//]: # "Backticks are for `monospace`, used sparingly and reserved mostly for executable names - they can cause formatting problems. Avoid them in tables: use italics instead."
+The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
+
+## Featured content
+[//]: # "You can add a maximum of three cards: any extra will not display."
+[//]: # "One card will take full width page: two will take half width each. Three will stack like an inverse pyramid."
+[//]: # "Some examples of content could be the latest release note, the most common install path, and a popular new feature."
 {{<card-layout>}}
-  {{<card-section>}}
-    {{<card title="Manage your NGINX fleet" titleUrl="/nginx-one/about/" >}}
-      Simplify, scale, secure, and collaborate with your NGINX fleet 
-    {{</card >}}
-    {{<card title="Get started" titleUrl="/nginx-one/getting-started/">}}
+  {{<card-section showAsCards="true" isFeaturedSection="true">}}
+    {{<card title="Get started" titleUrl="getting-started/" isFeatured="true" icon="unplug">}}
       See benefits from the NGINX One Console
     {{</card >}}
-    {{<card title="Connect your instances" titleUrl="/nginx-one/connect-instances/" >}}
-      Work with data plane keys, containers, and proxy servers
-    {{</card >}}
-    {{<card title="Manage your NGINX instances" titleUrl="/nginx-one/nginx-configs/">}}
-      Monitor and maintain your deployments
-    {{</card >}}
-    {{<card title="Draft new configurations" titleUrl="/nginx-one/staged-configs">}}
-      Work with Staged Configurations
-    {{</ card >}}
-    {{<card title="Set up metrics" titleUrl="/nginx-one/metrics/">}}
-      Review your deployments in a dashboard 
-    {{</card >}}
-    {{<card title="Organize users with RBAC" titleUrl="/nginx-one/rbac/">}}
-      Assign responsibilities with role-based access control 
-    {{</card >}}
-    {{<card title="Automate with the NGINX One API" titleUrl="/nginx-one/api/">}}
-      Manage your NGINX fleet over REST 
-    {{</card >}}
-    {{<card title="Glossary" titleUrl="/nginx-one/glossary/">}}
-      Learn terms unique to NGINX One Console 
-    {{</card >}}
-    {{<card title="Changelog" titleUrl="/nginx-one/changelog/" >}}{{< changelog-dates >}}{{</card >}}
-  {{</card-section >}}
-{{</card-layout >}}
+    {{<card title="Changelog" titleUrl="changelog/" icon="clock-alert">}}
+      See latest updates: New features, improvements, and bug fixes
+    {{</card>}}
+    {{<card title="Add an NGINX instance" titleUrl="connect-instances/add-instance/" icon="copy-plus">}}
+      Connect your instances to NGINX One
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
 
-# Other Components
-{{<card-layout>}}
+## Other Components  
+[//]: # "You can add any extra content for the page here, such as additional cards, diagrams or text."
+
+{{< card-layout >}}
   {{< card-section title="Kubernetes Solutions">}}
     {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" brandIcon="NGINX-Ingress-Controller-product-icon">}}
       Kubernetes traffic management with API gateway, identity, and observability features. 

From 168f8b46466a9328ec010c952f959963c183d18c Mon Sep 17 00:00:00 2001
From: apgordon312 <ashleypgordon1@gmail.com>
Date: Tue, 1 Jul 2025 11:09:24 -0500
Subject: [PATCH 074/117] feat: Add guidance for article usage to style guide
 (#510)

This commit adds guidance on article usage when referring to
product names, which was notably absent. The section as a whole
will likely be rewritten in the future for conciseness.

---------

Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 documentation/style-guide.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/documentation/style-guide.md b/documentation/style-guide.md
index 0b229717c..560ec05cf 100644
--- a/documentation/style-guide.md
+++ b/documentation/style-guide.md
@@ -20,7 +20,6 @@ This document provides guidelines specific to documenting F5 NGINX products and
 
 When writing documentation for our project, align with the default guide's voice and tone.
 
-
 ## F5 brand trademarks and product names
 
 - On the first mention of an enterprise NGINX product in a document, use the full product name. For example:
@@ -48,8 +47,11 @@ When writing documentation for our project, align with the default guide's voice
 
   - Using NGINX Plus Docker images with NGINX Instance Manager
 
-- Don't use articles ("the", "a") in front of product names. For example, use
+- Don't use articles ("the", "a") in front of product names. For example, use:
   - NGINX Agent (not "the NGINX Agent").
+- An article can be used if the product name is qualifying another noun. For example, use:
+  - Edit the NGINX Agent configuration file (not "Edit NGINX Agent configuration file"): In this case, "NGINX Agent" is a descriptor for the term "configuration file". 
+  - Expose NGINX Agent's REST API: In this case, NGINX Agent is a standalone noun phrase, and it "possesses" the REST API.
 - Always use the full brand name in the meta description. The meta description does not count as first mention of the product in the document.
 
 
@@ -343,7 +345,6 @@ The table provides guidelines about the terms you should and should not use for
 | Wizard and wizard | When documenting the GUI, you can capitalize Wizard if appropriate, such as for the Network Access Setup Wizard. When writing about wizards in general, or when a page title of a dialog box or GUI does not show Wizard in uppercase format, you can leave wizard in lowercase format. | |
 | WWW or www | Do not include www. in web addresses In text, do not use WWW, but use Internet instead. Of course, you can use www as part of a URL. Although we're moving away from that, too. | |
 
----
 
 ## Topic types and templates
 
@@ -466,7 +467,6 @@ Before reloading or restarting NGINX, always check the syntax of the NGINX confi
 sudo nginx -t
 ```
 
-
 - **sudo systemctl nginx reload**
   Use `reload` to apply configuration changes without stopping active connections. This keeps the NGINX service running while updating the configuration. It’s the preferred option for most changes because it avoids downtime and doesn’t interrupt users.
 

From 49b1a0f54a8d1b3eacddbb20632cf90b9232d951 Mon Sep 17 00:00:00 2001
From: Nicole Huang <42621884+xynicole@users.noreply.github.com>
Date: Tue, 1 Jul 2025 09:28:30 -0700
Subject: [PATCH 075/117] NLB-6564: Updated NIGNXaaS dataplane change log with
 version information (#632)

* NLB-6564: add a new changelog page for nginx versions

* nlb-6564: add os and fix version

* nlb-6564: reorder

---------

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
---
 content/nginxaas-azure/module-changelog.md | 57 ++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 content/nginxaas-azure/module-changelog.md

diff --git a/content/nginxaas-azure/module-changelog.md b/content/nginxaas-azure/module-changelog.md
new file mode 100644
index 000000000..efc14c51c
--- /dev/null
+++ b/content/nginxaas-azure/module-changelog.md
@@ -0,0 +1,57 @@
+---
+title: "Module Changelog"
+weight: 950
+toc: true
+url: /nginxaas/azure/module-changelog/
+---
+
+Learn about the modules supported by the latest versions of F5 NGINX as a Service for Azure.
+
+
+## July 03, 2025 
+
+### Stable
+
+ {{<bootstrap-table "table table-bordered table-striped table-responsive table-sm">}}
+
+| Name                                     | Version                  | Description                                                            |
+|------------------------------------------|--------------------------|------------------------------------------------------------------------|
+| nginx-plus                               | 1.27.2 (nginx-plus-r33-p2)    | NGINX Plus, provided by Nginx, Inc.                          |
+| nginx-agent                              | 1.19.15-1795423089  | NGINX Agent - Management for NGINXaaS                                  |
+| Operating System                         | Ubuntu 22.04.5      | Jammy Jellyfish, provided by Canonical Ltd.                            |
+| nginx-plus-module-geoip2                 | 33+3.4-1            | NGINX Plus 3rd-party GeoIP2 dynamic modules                            |
+| nginx-plus-module-headers-more           | 33+0.37-1           | NGINX Plus 3rd-party headers-more dynamic module                       |
+| nginx-plus-module-image-filter           | 33-1                | NGINX Plus image filter dynamic module                                 |
+| nginx-plus-module-lua                    | 33+0.10.27-1        | NGINX Plus 3rd-party Lua dynamic modules                               |
+| nginx-plus-module-ndk                    | 33+0.3.3-1          | NGINX Plus 3rd-party NDK dynamic module                                |
+| nginx-plus-module-njs                    | 33+0.8.9-1          | NGINX Plus njs dynamic modules                                         |
+| nginx-plus-module-otel                   | 33+0.1.0-1          | NGINX Plus OpenTelemetry dynamic module                                |
+| nginx-plus-module-xslt                   | 33-1                | NGINX Plus xslt dynamic module                                         |
+| nginx-plus-module-appprotect             | 33+5.264.0-1        | NGINX Plus app protect dynamic module version 5.264.0                  |
+| app-protect-module-plus                  | 33+5.264.0-1        | App-Protect package for Nginx Plus, includes all of the default files and examples. NGINX App Protect provides web application firewall (WAF) security protection for your web applications, including OWASP Top 10 attacks. |
+| app-protect-plugin                       | 6.9.0-1             | NGINX App Protect plugin |
+{{</bootstrap-table>}}
+
+
+
+### Preview
+
+ {{<bootstrap-table "table table-bordered table-striped table-responsive table-sm">}}
+
+| Name                                     | Version                  | Description                                                            |
+|------------------------------------------|--------------------------|------------------------------------------------------------------------|
+| nginx-plus                               | 1.27.2 (nginx-plus-r33-p2)    | NGINX Plus, provided by Nginx, Inc.                          |
+| nginx-agent                              | 1.19.15-1795423089  | NGINX Agent - Management for NGINXaaS                                  |
+| Operating System                         | Ubuntu 22.04.5      | Jammy Jellyfish, provided by Canonical Ltd.                            |
+| nginx-plus-module-geoip2                 | 33+3.4-1            | NGINX Plus 3rd-party GeoIP2 dynamic modules                            |
+| nginx-plus-module-headers-more           | 33+0.37-1           | NGINX Plus 3rd-party headers-more dynamic module                       |
+| nginx-plus-module-image-filter           | 33-1                | NGINX Plus image filter dynamic module                                 |
+| nginx-plus-module-lua                    | 33+0.10.27-1        | NGINX Plus 3rd-party Lua dynamic modules                               |
+| nginx-plus-module-ndk                    | 33+0.3.3-1          | NGINX Plus 3rd-party NDK dynamic module                                |
+| nginx-plus-module-njs                    | 33+0.8.9-1          | NGINX Plus njs dynamic modules                                         |
+| nginx-plus-module-otel                   | 33+0.1.0-1          | NGINX Plus OpenTelemetry dynamic module                                |
+| nginx-plus-module-xslt                   | 33-1                | NGINX Plus xslt dynamic module                                         |
+| nginx-plus-module-appprotect             | 33+5.264.0-1        | NGINX Plus app protect dynamic module version 5.264.0                  |
+| app-protect-module-plus                  | 33+5.264.0-1        | App-Protect package for Nginx Plus, includes all of the default files and examples. NGINX App Protect provides web application firewall (WAF) security protection for your web applications, including OWASP Top 10 attacks. |
+| app-protect-plugin                       | 6.9.0-1             | NGINX App Protect plugin |
+{{</bootstrap-table>}}

From ba6b6f72c046b1611d72ee0cc8b280597e868be8 Mon Sep 17 00:00:00 2001
From: yluf5 <111309812+yluf5@users.noreply.github.com>
Date: Tue, 1 Jul 2025 11:22:12 -0700
Subject: [PATCH 076/117] chore: update change log for Agent V3 N1C support.
 (#749)

* chore: update change log for Agent V3 N1C support.

* chore: updated the release date.

---------

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
---
 content/nginx-one/changelog.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/content/nginx-one/changelog.md b/content/nginx-one/changelog.md
index 33da1c9d9..a39a608ff 100644
--- a/content/nginx-one/changelog.md
+++ b/content/nginx-one/changelog.md
@@ -30,6 +30,14 @@ h2 {
 
 Stay up-to-date with what's new and improved in the F5 NGINX One Console.
 
+## June 30, 2025
+
+### NGINX Agent version 3 support
+
+We have added support for NGINX Agent 3.x in NGINX One Console. You can now:
+
+- Manage data plane instances with NGINX Agent version 3.
+
 ## May 19, 2025
 
 ### Import and export your Staged Configs

From 0954a25905b3dfab471566ce4e7a160226d541a2 Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Tue, 1 Jul 2025 11:29:51 -0700
Subject: [PATCH 077/117] fix: update changelog date for agent v3 (#771)

---
 content/nginx-one/changelog.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/nginx-one/changelog.md b/content/nginx-one/changelog.md
index a39a608ff..45f27fc4c 100644
--- a/content/nginx-one/changelog.md
+++ b/content/nginx-one/changelog.md
@@ -30,7 +30,7 @@ h2 {
 
 Stay up-to-date with what's new and improved in the F5 NGINX One Console.
 
-## June 30, 2025
+## July 1, 2025
 
 ### NGINX Agent version 3 support
 

From a90d940a81bf26f0907773abedb30cd9bcd1f817 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Tue, 1 Jul 2025 13:04:46 -0700
Subject: [PATCH 078/117] Fixed N1 landing page featured links (#772)

fix: Fixed N1 landing page featured links
---
 content/nginx-one/_index.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index be4b512c5..bceb86e76 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -21,13 +21,13 @@ The F5 NGINX One Console makes it easy to manage NGINX instances across location
 [//]: # "Some examples of content could be the latest release note, the most common install path, and a popular new feature."
 {{<card-layout>}}
   {{<card-section showAsCards="true" isFeaturedSection="true">}}
-    {{<card title="Get started" titleUrl="getting-started/" isFeatured="true" icon="unplug">}}
+    {{<card title="Get started" titleUrl="nginx-one/getting-started/" isFeatured="true" icon="unplug">}}
       See benefits from the NGINX One Console
     {{</card >}}
-    {{<card title="Changelog" titleUrl="changelog/" icon="clock-alert">}}
+    {{<card title="Changelog" titleUrl="nginx-one/changelog/" icon="clock-alert">}}
       See latest updates: New features, improvements, and bug fixes
     {{</card>}}
-    {{<card title="Add an NGINX instance" titleUrl="connect-instances/add-instance/" icon="copy-plus">}}
+    {{<card title="Add an NGINX instance" titleUrl="nginx-one/connect-instances/add-instance/" icon="copy-plus">}}
       Connect your instances to NGINX One
     {{</card>}}
   {{</card-section>}}

From c005b500d68942ece52cb684a375ef93cce8c13a Mon Sep 17 00:00:00 2001
From: Chetan Jain <46200286+Chetan-99@users.noreply.github.com>
Date: Wed, 2 Jul 2025 14:51:56 +0530
Subject: [PATCH 079/117] fix: Added instruction to install NIM 2.19.0 (#747)

* fix: Added instruction to install NIM 2.19.0

* fix: minor fixes

* fix: call out about the new helm chart versioning

* fix: added openshift details in nim k8s docs

* fix: minor changes

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>

* fix: Update deploy-using-helm.md

* fix: Update deploy-using-helm.md

* fix: combined call-out of renaming and versioning

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* Update content/nim/deploy/kubernetes/deploy-using-helm.md

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

* fix: minor yaml fixes

* fix: minor changes

---------

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>
---
 .../deploy/kubernetes/deploy-using-helm.md    | 154 +++++++++++++++---
 1 file changed, 130 insertions(+), 24 deletions(-)

diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md
index 4a0b53a8b..cbf7fa4ef 100644
--- a/content/nim/deploy/kubernetes/deploy-using-helm.md
+++ b/content/nim/deploy/kubernetes/deploy-using-helm.md
@@ -17,9 +17,9 @@ Starting with version 2.20.0, NGINX Instance Manager supports **lightweight mode
 
 - Lightweight mode requires NGINX Agent v2.41.1 or later.
 
-{{< call-out "note" "Chart renamed in NIM 2.20.0" >}}
-The Helm chart has been renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`.
-Make sure to update your chart references if you’re using version 2.20.0 or later.
+
+{{< call-out "note" "Chart renamed with new versioning from NGINX Instance Manager 2.20.0" >}}
+Starting with version 2.20.0, the Helm chart was renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`. Chart versioning was also reset; `v2.0.0` is the first release under the new name. Be sure to update your chart references if you’re using version `2.20.0` or later.
 {{< /call-out >}}
 
 
@@ -149,40 +149,34 @@ imagePullSecrets:
 apigw:
   image:
     repository: private-registry.nginx.com/nms/apigw
-    tag: 2.20.0
-
+    tag: <version>
 core:
   image:
     repository: private-registry.nginx.com/nms/core
-    tag: 2.20.0
-
+    tag: <version>
 dpm:
   image:
     repository: private-registry.nginx.com/nms/dpm
-    tag: 2.20.0
-
+    tag: <version>
 ingestion:
   image:
     repository: private-registry.nginx.com/nms/ingestion
-    tag: 2.20.0
-
+    tag: <version>
 integrations:
   image:
     repository: private-registry.nginx.com/nms/integrations
-    tag: 2.20.0
-
+    tag: <version>
 secmon:
   image:
     repository: private-registry.nginx.com/nms/secmon
-    tag: 2.20.0
-
+    tag: <version>
 utility:
   image:
     repository: private-registry.nginx.com/nms/utility
-    tag: 2.20.0
+    tag: <version>
 ```
 
-These values are required when pulling images from the NGINX private registry. The chart does not auto-resolve image tags. Update the tag: fields to match the NGINX Instance Manager version you want to install.
+These values are required when pulling images from the NGINX private registry. The chart doesn't auto-resolve image tags. Set each `tag:` value to match the NGINX Instance Manager version you want to install. Refer to the Helm chart table for version details.
 
 Use the file with the `-f values.yaml` flag when installing the chart.
 
@@ -236,6 +230,11 @@ helm status nim -n nim
 
 You should see `STATUS: deployed` in the output.
 
+
+To find the right NGINX Instance Manager chart version, see the following table:
+
+{{< include "nim/kubernetes/nms-chart-supported-module-versions.md" >}}
+
 ---
 
 ## Access the web interface
@@ -346,6 +345,112 @@ networkPolicies:
 
 ---
 
+## Helm deployment for NGINX Instance Manager 2.19
+
+### Create a Helm deployment values.yaml file
+
+The `values.yaml` file customizes the Helm chart installation without changing the chart itself. You can use it to set image repositories, environment variables, resource requests, and other options.
+
+1. Create a `values.yaml` file like this example:
+
+   - In the `imagePullSecrets` section, add your private Docker registry credentials.
+   - Set the `tag:` field to the version of NGINX Instance Manager you want to install. You can find supported versions in the Helm chart table.
+
+For details on creating a secret, see the Kubernetes [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) guide.
+
+```yaml
+imagePullSecrets:
+  - name: regcred
+
+apigw:
+  image:
+    repository: private-registry.nginx.com/nms/apigw
+    tag: <version>
+core:
+  image:
+    repository: private-registry.nginx.com/nms/core
+    tag: <version>
+dpm:
+  image:
+    repository: private-registry.nginx.com/nms/dpm
+    tag: <version>
+ingestion:
+  image:
+    repository: private-registry.nginx.com/nms/ingestion
+    tag: <version>
+integrations:
+  image:
+    repository: private-registry.nginx.com/nms/integrations
+    tag: <version>
+secmon:
+  image:
+    repository: private-registry.nginx.com/nms/secmon
+    tag: <version>
+utility:
+  image:
+    repository: private-registry.nginx.com/nms/utility
+    tag: <version>
+```
+
+
+2. Save and close the `values.yaml` file.
+
+---
+
+### Install the chart
+
+Run the `helm install` command to deploy NGINX Instance Manager:
+
+1. Replace `<path-to-your-values.yaml>` with the path to your `values.yaml` file.
+2. Replace `<your-password>` with a secure password (containing a mix of uppercase, lowercase letters, numbers, and special characters).
+
+   {{< important >}} Remember to save the password for future use. Only the encrypted password is stored, and there's no way to recover or reset it if lost. {{< /important >}}
+
+
+```shell
+helm install -n nms-hybrid \
+--set adminPasswordHash=$(openssl passwd -6 '<your-password>') \
+nms nginx-stable/nms-hybrid \
+--create-namespace \
+-f <path-to-your-values.yaml> \
+--version <chart-version> \
+--wait
+```
+
+---
+
+### Upgrade NGINX Instance Manager
+
+To upgrade:
+
+1. [Update the Helm repository list](#add-repository).
+2. [Adjust your `values.yaml` file](#create-a-helm-deployment-values.yaml-file) if needed.
+3. To upgrade the NGINX Instance Manager deployment, run the following command. This command updates the `nms` deployment with a new version from the `nginx-stable/nms-hybrid` repository. It also hashes the provided password and uses the `values.yaml` file at the path you specify.
+4. Replace `<chart-version>` with the desired chart version of NGINX Instance Manager 2.19.x referring the Helm chart table. 
+
+   ```shell
+    helm upgrade -n nms \
+    --set nms-hybrid.adminPasswordHash=$(openssl passwd -6 '<your-password>') \
+    nms nginx-stable/nms-hybrid \
+    -f <path-to-your-values.yaml> \
+    --version <chart-version> \
+    --wait
+   ```
+
+   - Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}).
+   - Replace `<your-password>` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
+
+      {{<call-out "important" "Save the password!" "" >}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
+
+{{< call-out "note" "Upgrading from 2.18.0 or earlier to 2.19.x" >}}
+If you're upgrading from version 2.18.0 or earlier to 2.19.x, note the following changes:
+
+- If you used the legacy `nms` chart or release name, update the chart reference and adjust the release name if needed.
+- The structure of the `values.yaml` file has changed in this release.
+{{< /call-out >}}
+
+---
+
 ## Helm Deployment for NGINX Instance Manager 2.18 or lower
 
 ### Create a Helm deployment values.yaml file
@@ -414,10 +519,6 @@ nms nginx-stable/nms \
 --wait
 ```
 
-To help you choose the right NGINX Instance Manager chart version, see the table in:
-
-{{< include "nim/kubernetes/nms-chart-supported-module-versions.md" >}}
-
 ---
 
 ### Upgrade NGINX Instance Manager
@@ -462,9 +563,14 @@ openshift:
 
 This ensures pods can run with the user IDs required by NGINX Instance Manager services.
 
-{{< call-out "note" "Note" >}}
-If you see permission errors during deployment, your user account might not have access to manage SCCs. Contact a cluster administrator to request access.
-{{< /call-out >}}
+
+When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a custom [Security Context Constraints (SCC)](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) object and links it to the Service Account used by all pods.
+
+By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The deployment needs specific user IDs (UIDs) for certain services—**1000** for `nms`, and **101** for `nginx` and `clickhouse`. Since the default SCCs don’t allow these UIDs, the deployment creates a custom SCC. This SCC sets the `runAsUser` field to allow the necessary UIDs while still complying with OpenShift’s security standards.
+
+This deployment has been tested with OpenShift v4.13.0 Server.
+
+If you see permission errors during deployment, your account might not have access to manage SCCs. Ask a cluster administrator for access.
 
 To verify that the SCC was created after installing the Helm chart, run:
 

From 5475a1192097213b443a4c1b77c4e184be67a890 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 2 Jul 2025 11:18:55 +0100
Subject: [PATCH 080/117] build(deps): bump github/codeql-action from 3.29.0 to
 3.29.1 (#757)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.0 to 3.29.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/ce28f5bb42b7a9f2c824e633a3f6ee835bab6858...39edc492dbe16b1465b0cafca41432d857bdb31a)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ossf_scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml
index 63944f691..fa55428c4 100644
--- a/.github/workflows/ossf_scorecard.yml
+++ b/.github/workflows/ossf_scorecard.yml
@@ -56,6 +56,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload SARIF results to code scanning
-        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+        uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1
         with:
           sarif_file: results.sarif

From 59bf3084d0d70aa0ff33463555007e6c5f28d144 Mon Sep 17 00:00:00 2001
From: Roshan Shyamsunder <102305551+rshyamsu@users.noreply.github.com>
Date: Wed, 2 Jul 2025 03:22:20 -0700
Subject: [PATCH 081/117] Update docs to call out IPv6 support (#620)

---
 content/nginxaas-azure/changelog.md           |  7 +++++
 .../create-deployment/deploy-azure-cli.md     | 27 +++++++++++++++++++
 .../create-deployment/deploy-azure-portal.md  |  1 +
 content/nginxaas-azure/known-issues.md        |  2 --
 content/nginxaas-azure/overview/overview.md   |  4 +--
 5 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/content/nginxaas-azure/changelog.md b/content/nginxaas-azure/changelog.md
index e001d3128..65f50437f 100644
--- a/content/nginxaas-azure/changelog.md
+++ b/content/nginxaas-azure/changelog.md
@@ -16,6 +16,13 @@ To review older entries, visit the [Changelog archive]({{< ref "/nginxaas-azure/
 
 ## May 22, 2025
 
+- {{% icon-feature %}} **NGINXaaS for Azure now supports IPv6**
+
+  Users can now configure their NGINXaaS deployments with just a single IPv6 frontend IP or in dual-stack (IPv4 + IPv6) mode.
+
+  If you plan to use an IPv6 IP address whether standalone or in dual-stack mode, ensure that the subnet used by NGINXaaS has both IPv4 and IPv6 address spaces included. For more information on creating a vnets and subnets with IPv6 address spaces, refer to [Add IPv6 to virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/add-dual-stack-ipv6-vm-portal?tabs=azureportal#add-ipv6-to-virtual-network)
+
+
 - {{% icon-feature %}} **NGINXaaS is now running NGINX Plus Release 33 (R33) in the Stable Upgrade Channel**
 
   NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) have now been automatically upgraded to  [NGINX Plus Release 33 (R33)]({{< ref "/nginx/releases.md#nginxplusrelease-33-r33" >}}). This upgrade also includes updates to the following NGINX Plus modules:
diff --git a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md
index df65d9f66..786649422 100644
--- a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md
+++ b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md
@@ -64,6 +64,25 @@ az nginx deployment create --deployment-name
       network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
    ```
 
+- Create a dual-stack (IPv4 + IPv6) NGINXaaS deployment with public IPs:
+
+   ```bash
+   az nginx deployment create --name myDeployment --resource-group \
+      myResourceGroup --location eastus2 --sku name="standardv2_Monthly" \
+      --network-profile front-end-ip-configuration="{public-ip-addresses:[{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv4},{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv6}]}" \
+      network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
+   ```
+
+- Create a dual-stack (IPv4 + IPv6) NGINXaaS deployment with private IPs:
+
+   ```bash
+   az nginx deployment create --name myDeployment --resource-group \
+      myResourceGroup --location eastus2 --sku \
+      name="standardv2_Monthly" --network-profile \
+      front-end-ip-configuration="{private-ip-addresses:[{private-ip-allocation-method:Static,subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet,private-ip-address:10.0.0.2},{private-ip-allocation-method:Static,subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet,private-ip-address:2001:0db8:85a3:0000:0000:8a2e:0370:7334}]}" \
+      network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
+   ```
+
 - Create a deployment with managed identity, storage account and scaling:
 
    ```bash
@@ -115,6 +134,14 @@ az nginx deployment update [--add]
    tag2="value2" --enable-diagnostics
    ```
 
+Update an NGINXaaS deployment to a dual-stack (IPv4 + IPv6) network configuration with public IPs:
+
+   ```bash
+   az nginx deployment update --name myDeployment --resource-group myResourceGroup \
+      --network-profile front-end-ip-configuration="{public-ip-addresses:[{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv4},{id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/pubIPv6}]}" \
+      network-interface-configuration="{subnet-id:/subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet}"
+   ```
+
 See the [Azure CLI Deployment Update Documentation](https://learn.microsoft.com/en-us/cli/azure/nginx/deployment#az-nginx-deployment-update) for more details on the required and optional parameters.
 
 
diff --git a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md
index 44448cddd..964a5ce8b 100644
--- a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md
+++ b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md
@@ -63,6 +63,7 @@ You can start the NGINXaaS deployment process by visiting the [Create NGINXaaS](
    - The minimum subnet size for NGINXaaS is `/27` and is enough for a single NGINXaaS deployment even at large scales.
    - You can use an existing subnet; make sure that the subnet is delegated to `NGINX.NGINXPLUS/nginxDeployments` before creating a deployment in it. The subnet can contain other resources.
    - You can deploy more than one NGINXaaS in the same subnet. Every deployment in the subnet will share the subnet IP address space. A larger subnet, for example, a `/24` is recommended.
+   - If you plan on using an IPv6 address on the frontend, make sure the subnet is dual-stack, i.e., the subnet has both IPv4 and IPv6 address spaces. Attempting to use a subnet that is not dual-stack will cause deployment creation to fail.
    - Changes to a virtual network's DNS settings will not be applied automatically to your NGINXaaS deployment. To ensure DNS settings are applied, you must add any custom DNS servers to the VNET's DNS settings before creating an NGINXaaS deployment. As a workaround for existing deployments, we recommend using the [`resolver` directive](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver) to explicitly specify your name server(s) and the [`resolve` parameter](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#resolve) to automatically re-resolve the domain name of the server without restarting NGINX.
 
       <details>
diff --git a/content/nginxaas-azure/known-issues.md b/content/nginxaas-azure/known-issues.md
index aecea3291..29cd3214f 100644
--- a/content/nginxaas-azure/known-issues.md
+++ b/content/nginxaas-azure/known-issues.md
@@ -103,8 +103,6 @@ If a configuration update request uses a certificate that is in failed `provisio
 - NGINXaaS deployments cannot access [Private Endpoints](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview) behind network security groups for private links. Attempts to do so will fail silently.
 - NGINXaaS deployments cannot access [Private Endpoints](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview) in a globally peered VNET. Attempts to do so will fail silently.
 - The resource group which contains the public IP resource attached to NGINXaaS deployment cannot be moved across subscriptions. Attempts to do so will result in a validation error.
-- Creating an NGINXaaS deployment in a dual-stack subnet is not supported. Attempts to do so will result in a validation error.
-- NGINXaaS deployments cannot be created with an IPv6 Public IP address. Attempts to do so will result in a validation error.
 - [Network security group](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview) (NSG) flow logs will not be available for IP traffic flowing through an NGINXaaS deployment attached to a customer delegated subnet. Flow logs for other resources on the same subnet will be available as normal.
 
 ### {{% icon-bug %}} Deployment locked when updating mutliple certificates at once. (ID-767)
diff --git a/content/nginxaas-azure/overview/overview.md b/content/nginxaas-azure/overview/overview.md
index ae6d4b9c0..3126bdad2 100644
--- a/content/nginxaas-azure/overview/overview.md
+++ b/content/nginxaas-azure/overview/overview.md
@@ -36,8 +36,8 @@ The key capabilities of NGINXaaS for Azure are:
 
 ## Limitations
 
-- NGINXaaS does not support IPv6 yet.
-- NGINXaaS supports one public or private IP per deployment. NGINXaaS doesn't support a mix of public and private IPs at this time.
+- NGINXaaS supports at most one IPv4 and one IPv6 IP address at any given time.
+- NGINXaaS doesn't support a mix of public and private IPs at this time.
 - The IP address associated with an NGINXaaS deployment can't be changed from public to private, or from private to public.
 
 ## Supported regions

From 528efddf3d11a675b428e90cf36ac79b6dff623d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 2 Jul 2025 11:28:12 +0100
Subject: [PATCH 082/117] build(deps): bump fossas/fossa-action from 1.6.0 to
 1.7.0 (#561)

Bumps [fossas/fossa-action](https://github.com/fossas/fossa-action) from 1.6.0 to 1.7.0.
- [Release notes](https://github.com/fossas/fossa-action/releases)
- [Commits](https://github.com/fossas/fossa-action/compare/c0a7d013f84c8ee5e910593186598625513cc1e4...3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac)

---
updated-dependencies:
- dependency-name: fossas/fossa-action
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/fossa.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 1fb78fab3..7d94f92bb 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -25,6 +25,6 @@ jobs:
         uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2 # v4.2.2
 
       - name: Scan
-        uses: fossas/fossa-action@c0a7d013f84c8ee5e910593186598625513cc1e4 # v1.6.0
+        uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
         with:
           api-key: ${{ secrets.FOSSA_TOKEN }}
\ No newline at end of file

From a780db42ac16ec6dd46c6bdc311e152bf3465194 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Wed, 2 Jul 2025 11:36:53 +0100
Subject: [PATCH 083/117] Agent release 3.0 (#567)

- Adds the Agent 3.x documentation under the NGINX One docset
- Updates the Agent 2.x documentation
---
 content/agent/{overview.md => about.md}       |  10 +-
 content/agent/changelog.md                    | 284 +-----------------
 content/agent/community.md                    |  20 ++
 content/agent/configuration/_index.md         |  10 +-
 .../configuration/configuration-overview.md   |   3 +-
 .../configure-nginx-agent-features.md         |  95 ------
 .../configure-nginx-agent-group.md            |   5 +-
 content/agent/configuration/health-checks.md  |   3 +-
 content/agent/contribute/_index.md            |   6 -
 content/agent/contribute/community.md         |  23 --
 .../agent/contribute/dev-environment-setup.md |  53 ++--
 .../agent/contribute/start-mock-interface.md  |  91 ++++++
 content/agent/installation-upgrade/_index.md  |   5 +-
 .../container-environments/_index.md          |   5 +-
 .../container-environments/docker-images.md   |   3 +-
 .../container-environments/docker-support.md  |   4 +-
 .../installation-upgrade/getting-started.md   |   3 +-
 .../installation-github.md                    |   3 +-
 .../installation-upgrade/installation-oss.md  |   3 +-
 .../installation-upgrade/installation-plus.md |   3 +-
 .../installation-unprivileged.md              |   3 +-
 .../agent/installation-upgrade/uninstall.md   |   3 +-
 content/agent/installation-upgrade/upgrade.md |   3 +-
 content/agent/support.md                      |  21 ++
 content/agent/technical-specifications.md     |  28 +-
 content/includes/agent/about.md               |  43 +++
 content/includes/agent/architecture.md        |  22 ++
 .../manually-connect-to-console.md            |  42 +++
 .../agent/installation/oss/oss-alpine.md      |  73 +++++
 .../installation/oss/oss-amazon-linux.md      |  34 +++
 .../agent/installation/oss/oss-debian.md      |  52 ++++
 .../agent/installation/oss/oss-freebsd.md     |  23 ++
 .../agent/installation/oss/oss-rhel.md        |  33 ++
 .../agent/installation/oss/oss-sles.md        |  52 ++++
 .../agent/installation/oss/oss-ubuntu.md      |  50 +++
 .../agent/installation/plus/plus-alpine.md    |  83 +++++
 .../installation/plus/plus-amazon-linux.md    |  50 +++
 .../agent/installation/plus/plus-debian.md    |  50 +++
 .../agent/installation/plus/plus-freebsd.md   |  52 ++++
 .../agent/installation/plus/plus-rhel.md      |  55 ++++
 .../agent/installation/plus/plus-sles.md      |  75 +++++
 .../agent/installation/plus/plus-ubuntu.md    |  55 ++++
 .../agent/installation/prerequisites.md       |  13 +
 .../agent/installation/start-stop-agent.md    |  27 ++
 .../uninstall/uninstall-alpine.md             |  20 ++
 .../uninstall/uninstall-amazon-linux.md       |  20 ++
 .../uninstall/uninstall-debian.md             |  22 ++
 .../uninstall/uninstall-freebsd.md            |  20 ++
 .../installation/uninstall/uninstall-rhel.md  |  20 ++
 .../installation/uninstall/uninstall-sles.md  |  20 ++
 .../uninstall/uninstall-ubuntu.md             |  22 ++
 .../agent/installation/update-container.md    |  24 ++
 content/includes/agent/installation/update.md |  43 +++
 .../agent/installation/verify-agent.md        |  21 ++
 content/includes/agent/tech-specs.md          |  23 ++
 content/includes/agent/v3-available.md        |  12 +
 .../installation/add-ports-agent-selinux.md   |  17 ++
 .../includes/installation/agent-selinux.md    |  11 -
 .../installation/enable-agent-selinux.md      |  23 ++
 .../nginx-one/add-file/new-ssl-bundle.md      |   2 +-
 .../nginx-one/conf/nginx-agent-conf.md        |  22 ++
 .../nginx-plus/supported-distributions.md     |  20 ++
 content/nginx-one/_index.md                   |  18 +-
 content/nginx-one/agent/_index.md             |   6 +
 content/nginx-one/agent/changelog.md          |   9 +
 content/nginx-one/agent/community/_index.md   |   5 +
 .../nginx-one/agent/community/community.md    |  21 ++
 .../configure-instance-reporting/_index.md    |   5 +
 .../configuration-overview.md                 |  87 ++++++
 .../configure-agent-group.md                  |  88 ++++++
 .../configure-selinux.md                      |  44 +++
 content/nginx-one/agent/containers/_index.md  |   5 +
 .../agent/containers/run-agent-container.md   |  93 ++++++
 .../nginx-one/agent/install-upgrade/_index.md |   5 +
 .../install-upgrade/install-from-github.md    |  73 +++++
 .../install-upgrade/install-from-oss-repo.md  | 104 +++++++
 .../install-upgrade/install-from-plus-repo.md | 105 +++++++
 .../agent/install-upgrade/uninstall.md        |  82 +++++
 .../nginx-one/agent/install-upgrade/update.md |  15 +
 content/nginx-one/agent/metrics/_index.md     |   5 +
 .../agent/metrics/configure-otel-metrics.md   |  41 +++
 content/nginx-one/agent/overview/_index.md    |   5 +
 content/nginx-one/agent/overview/about.md     |  54 ++++
 .../nginx-one/agent/overview/tech-specs.md    |   9 +
 content/nginx-one/agent/support/_index.md     |   5 +
 .../agent/support/troubleshooting.md          |  31 ++
 .../connect-instances/add-instance.md         |   2 +-
 content/nginx-one/getting-started.md          |  13 +-
 content/nginx-one/glossary.md                 |   2 +
 content/nginx-one/nginx-configs/add-file.md   |   4 +-
 .../certificates/manage-certificates.md       |   2 +-
 .../clean-up-unavailable-instances.md         |   2 +-
 .../config-sync-groups/add-file-csg.md        |   2 +-
 .../manage-config-sync-groups.md              |   2 +-
 .../staged-configs/add-staged-config.md       |  10 +-
 content/nginx/technical-specs.md              |  16 +-
 .../system-configuration/configure-selinux.md |  20 +-
 .../nms/nginx-agent/install-nginx-agent.md    |  26 +-
 layouts/shortcodes/v2-metrics.html            |  56 ++++
 99 files changed, 2425 insertions(+), 583 deletions(-)
 rename content/agent/{overview.md => about.md} (94%)
 create mode 100644 content/agent/community.md
 delete mode 100644 content/agent/configuration/configure-nginx-agent-features.md
 delete mode 100644 content/agent/contribute/_index.md
 delete mode 100644 content/agent/contribute/community.md
 create mode 100644 content/agent/contribute/start-mock-interface.md
 create mode 100644 content/agent/support.md
 create mode 100644 content/includes/agent/about.md
 create mode 100644 content/includes/agent/architecture.md
 create mode 100644 content/includes/agent/installation/manually-connect-to-console.md
 create mode 100644 content/includes/agent/installation/oss/oss-alpine.md
 create mode 100644 content/includes/agent/installation/oss/oss-amazon-linux.md
 create mode 100644 content/includes/agent/installation/oss/oss-debian.md
 create mode 100644 content/includes/agent/installation/oss/oss-freebsd.md
 create mode 100644 content/includes/agent/installation/oss/oss-rhel.md
 create mode 100644 content/includes/agent/installation/oss/oss-sles.md
 create mode 100644 content/includes/agent/installation/oss/oss-ubuntu.md
 create mode 100644 content/includes/agent/installation/plus/plus-alpine.md
 create mode 100644 content/includes/agent/installation/plus/plus-amazon-linux.md
 create mode 100644 content/includes/agent/installation/plus/plus-debian.md
 create mode 100644 content/includes/agent/installation/plus/plus-freebsd.md
 create mode 100644 content/includes/agent/installation/plus/plus-rhel.md
 create mode 100644 content/includes/agent/installation/plus/plus-sles.md
 create mode 100644 content/includes/agent/installation/plus/plus-ubuntu.md
 create mode 100644 content/includes/agent/installation/prerequisites.md
 create mode 100644 content/includes/agent/installation/start-stop-agent.md
 create mode 100644 content/includes/agent/installation/uninstall/uninstall-alpine.md
 create mode 100644 content/includes/agent/installation/uninstall/uninstall-amazon-linux.md
 create mode 100644 content/includes/agent/installation/uninstall/uninstall-debian.md
 create mode 100644 content/includes/agent/installation/uninstall/uninstall-freebsd.md
 create mode 100644 content/includes/agent/installation/uninstall/uninstall-rhel.md
 create mode 100644 content/includes/agent/installation/uninstall/uninstall-sles.md
 create mode 100644 content/includes/agent/installation/uninstall/uninstall-ubuntu.md
 create mode 100644 content/includes/agent/installation/update-container.md
 create mode 100644 content/includes/agent/installation/update.md
 create mode 100644 content/includes/agent/installation/verify-agent.md
 create mode 100644 content/includes/agent/tech-specs.md
 create mode 100644 content/includes/agent/v3-available.md
 create mode 100644 content/includes/installation/add-ports-agent-selinux.md
 delete mode 100644 content/includes/installation/agent-selinux.md
 create mode 100644 content/includes/installation/enable-agent-selinux.md
 create mode 100644 content/includes/nginx-one/conf/nginx-agent-conf.md
 create mode 100644 content/includes/nginx-plus/supported-distributions.md
 create mode 100644 content/nginx-one/agent/_index.md
 create mode 100644 content/nginx-one/agent/changelog.md
 create mode 100644 content/nginx-one/agent/community/_index.md
 create mode 100644 content/nginx-one/agent/community/community.md
 create mode 100644 content/nginx-one/agent/configure-instance-reporting/_index.md
 create mode 100644 content/nginx-one/agent/configure-instance-reporting/configuration-overview.md
 create mode 100644 content/nginx-one/agent/configure-instance-reporting/configure-agent-group.md
 create mode 100644 content/nginx-one/agent/configure-instance-reporting/configure-selinux.md
 create mode 100644 content/nginx-one/agent/containers/_index.md
 create mode 100644 content/nginx-one/agent/containers/run-agent-container.md
 create mode 100644 content/nginx-one/agent/install-upgrade/_index.md
 create mode 100644 content/nginx-one/agent/install-upgrade/install-from-github.md
 create mode 100644 content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
 create mode 100644 content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
 create mode 100644 content/nginx-one/agent/install-upgrade/uninstall.md
 create mode 100644 content/nginx-one/agent/install-upgrade/update.md
 create mode 100644 content/nginx-one/agent/metrics/_index.md
 create mode 100644 content/nginx-one/agent/metrics/configure-otel-metrics.md
 create mode 100644 content/nginx-one/agent/overview/_index.md
 create mode 100644 content/nginx-one/agent/overview/about.md
 create mode 100644 content/nginx-one/agent/overview/tech-specs.md
 create mode 100644 content/nginx-one/agent/support/_index.md
 create mode 100644 content/nginx-one/agent/support/troubleshooting.md
 create mode 100644 layouts/shortcodes/v2-metrics.html

diff --git a/content/agent/overview.md b/content/agent/about.md
similarity index 94%
rename from content/agent/overview.md
rename to content/agent/about.md
index c6103489c..19434fbb2 100644
--- a/content/agent/overview.md
+++ b/content/agent/about.md
@@ -1,16 +1,15 @@
 ---
-title: Overview
+title: About
 draft: false
 weight: 100
 toc: true
 nd-docs: DOCS-1091
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
 
-NGINX Agent is a companion daemon for your NGINX Open Source or NGINX Plus instance. It enables:
+NGINX Agent version 2 is a companion daemon for your NGINX Open Source or NGINX Plus instance. It enables:
 
 - Remote management of NGINX configurations
 - Collection and reporting of real-time NGINX performance and operating system metrics
@@ -47,7 +46,6 @@ For NGINX Agent to work properly with an NGINX Plus instance, the API needs to b
 NGINX Agent allows a gRPC connected control system to register a listener for a specific event. The control mechanism is then invoked when NGINX Agent sends an associated system signal. The source of a notification can be either the NGINX instance or NGINX Agent itself. Here's a list of currently supported events:
 
 
-{{< raw-html>}}<div class="table-responsive">{{</raw-html>}}
 {{<bootstrap-table "table table-striped table-bordered">}}
 | Event                            | Description                                  |
 | -------------------------------- | -------------------------------------------- |
@@ -64,6 +62,6 @@ NGINX Agent allows a gRPC connected control system to register a listener for a
 | CONFIG_ROLLBACK_SUCCESS_MESSAGE  | Successfully rolled back NGINX configuration |
 | CONFIG_ROLLBACK_FAILURE_MESSAGE  | Failed to roll back NGINX configuration      |
 {{</bootstrap-table>}}
-{{< raw-html>}}</div>{{</raw-html>}}
+
 
 
diff --git a/content/agent/changelog.md b/content/agent/changelog.md
index 607f5a25f..666c29286 100644
--- a/content/agent/changelog.md
+++ b/content/agent/changelog.md
@@ -1,286 +1,10 @@
 ---
-title: "Changelog"
+title: Changelog
+toc: false
+url: /agent/changelog
 weight: 1200
 toc: true
 nd-docs: "DOCS-1093"
 ---
 
-{{< note >}}You can find the full changelog, contributor list and assets for NGINX Agent in the [GitHub repository](https://github.com/nginx/agent/releases).{{< /note >}}
-
-See the list of supported Operating Systems and architectures in the [Technical Specifications]({{< relref "./technical-specifications.md" >}}).
-
----
-## Release [v2.40.0](https://github.com/nginx/agent/releases/tag/v2.40.0)
-
-### 🌟 Highlights
-
-- The source code for the [NGINX Agent documentation](https://docs.nginx.com/nginx-agent/) has moved to the [NGINX Documentation](https://github.com/nginx/documentation/) repository. We invite you to [contribute](https://github.com/nginx/documentation/blob/main/CONTRIBUTING.md), improve the Agent docs and report any issues you find in the documentation repository.
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- Lua config apply by [@oliveromahony](https://github.com/oliveromahony) in [#963](https://github.com/nginx/agent/pull/963)
-- Fix release workflow by [@dhurley](https://github.com/dhurley) in [#991](https://github.com/nginx/agent/pull/991)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- Docs: updating links from /nginx-management-suite/nim to /nginx-instance-manager by [@nginx-aoife](https://github.com/nginx-aoife) in [#927](https://github.com/nginx/agent/pull/927)
-- Autodeploy main docs to production by [@nginx-jack](https://github.com/nginx-jack) in [#924](https://github.com/nginx/agent/pull/924)
-- docs: remove docs by [@JTorreG](https://github.com/JTorreG) in [#976](https://github.com/nginx/agent/pull/976)
-- Add a docs page to explain NGINX Agent features by [@nginx-seanmoloney](https://github.com/nginx-seanmoloney) in [#941](https://github.com/nginx/agent/pull/941)
-- docs: Fix NGINX install link and dockerfile section by [@JTorreG](https://github.com/JTorreG) in [#928](https://github.com/nginx/agent/pull/928)
-
-### 🔨 Maintenance
-
-We have made the following maintenance-related minor changes:
-
-- Fail release job if packages fail to publish by [@dhurley](https://github.com/dhurley) in [#923](https://github.com/nginx/agent/pull/923)
-- Update performance test Dockerfile to use NGINX R32 by [@dhurley](https://github.com/dhurley) in [#937](https://github.com/nginx/agent/pull/937)
-- Updated golang.org/x/net version by [@oliveromahony](https://github.com/oliveromahony) in [#954](https://github.com/nginx/agent/pull/954)
-- Update performance test dependencies by [@dhurley](https://github.com/dhurley) in [#984](https://github.com/nginx/agent/pull/984)
-- Refactor integration tests by [@dhurley](https://github.com/dhurley) in [#985](https://github.com/nginx/agent/pull/985)
-- Update dependencies by [@dhurley](https://github.com/dhurley) in [#98](https://github.com/nginx/agent/pull/98)
-- Updated the crypto library version by [@oliveromahony](https://github.com/oliveromahony) in [#947](https://github.com/nginx/agent/pull/947)
-
----
-## Release [v2.39.0](https://github.com/nginx/agent/releases/tag/v2.39.0)
-
-### 🌟 Highlights
-
-- Remove official docker images & move testing images to test folder by [@aphralG](https://github.com/aphralG) in [#838](https://github.com/nginx/agent/pull/838)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- Race conditions fixes by [@oliveromahony](https://github.com/oliveromahony) in [#810](https://github.com/nginx/agent/pull/810)
-- fix r30 pipeline failures by [@oliveromahony](https://github.com/oliveromahony) in [#844](https://github.com/nginx/agent/pull/844)
-- Fixed make target pointing at wrong Dockerfile and renamed others to be consistent by [@oliveromahony](https://github.com/oliveromahony) in [#857](https://github.com/nginx/agent/pull/857)
-- Fix broken links causing deployment failures by [@ADubhlaoich](https://github.com/ADubhlaoich) in [#863](https://github.com/nginx/agent/pull/863)
-- Fix NGINX OSS integration tests by [@dhurley](https://github.com/dhurley) in [#888](https://github.com/nginx/agent/pull/888)
-- Fix docs docker failing without git context by [@nginx-jack](https://github.com/nginx-jack) in [#892](https://github.com/nginx/agent/pull/892)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- Add automatic changelog generation in release workflow by [@spencerugbo](https://github.com/spencerugbo) in [#784](https://github.com/nginx/agent/pull/784)
-- Add CLA bot workflow by [@lucacome](https://github.com/lucacome) in [#828](https://github.com/nginx/agent/pull/828)
-- Refactor docker images by [@nginx-seanmoloney](https://github.com/nginx-seanmoloney) in [#841](https://github.com/nginx/agent/pull/841)
-- Docs: Add hugo version check and theme update to Makefile by [@nginx-jack](https://github.com/nginx-jack) in [#869](https://github.com/nginx/agent/pull/869)
-- Change casing of docs makefile to Makefile by [@nginx-jack](https://github.com/nginx-jack) in [#884](https://github.com/nginx/agent/pull/884)
-- docs: enableGitInfo config and docs-action bump by [@nginx-jack](https://github.com/nginx-jack) in [#886](https://github.com/nginx/agent/pull/886)
-- Change go version to latest go 1.23.2 by [@oliveromahony](https://github.com/oliveromahony) in [#889](https://github.com/nginx/agent/pull/889)
-- Remove link to github dockerfiles by [@nginx-seanmoloney](https://github.com/nginx-seanmoloney) in [#897](https://github.com/nginx/agent/pull/897)
-- Docs: Update link to 3rd party site by [@nginx-aoife](https://github.com/nginx-aoife) in [#898](https://github.com/nginx/agent/pull/898)
-- Update the changelog for v2.38 by [@ADubhlaoich](https://github.com/ADubhlaoich) in [#901](https://github.com/nginx/agent/pull/901)
-
-### 🔨 Maintenance
-
-We have made the following maintenance-related minor changes:
-
-- Set log level to debug for inetegration tests by [@aphralG](https://github.com/aphralG) in [#826](https://github.com/nginx/agent/pull/826)
-- updated runc dependency highlighted in security scan scan by [@oliveromahony](https://github.com/oliveromahony) in [#842](https://github.com/nginx/agent/pull/842)
-- Update CODEOWNERS by [@oCHRISo](https://github.com/oCHRISo) in [#851](https://github.com/nginx/agent/pull/851)
-- Check version command output by [@aphralG](https://github.com/aphralG) in [#853](https://github.com/nginx/agent/pull/853)
-- Bump NGINX plus go client version from v1 to v2 by [@dhurley](https://github.com/dhurley) in [#879](https://github.com/nginx/agent/pull/879)
-- Allowlist Error Messages by [@aphralG](https://github.com/aphralG) in [#907](https://github.com/nginx/agent/pull/907)
-
----
-## Release [v2.38.0](https://github.com/nginx/agent/releases/tag/v2.38.0)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- Fix broken URLS in docs by [@nginx-aoife](https://github.com/nginx-aoife) in [#796](https://github.com/nginx/agent/pull/796)
-- fix name of deprecated flag by [@aphralG](https://github.com/aphralG) in [#811](https://github.com/nginx/agent/pull/811)
-- Fix make image targets by [@dhurley](https://github.com/dhurley) in [#812](https://github.com/nginx/agent/pull/812)
-- Fix debian oss image by [@dhurley](https://github.com/dhurley) in [#819](https://github.com/nginx/agent/pull/819)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- docs: update GPG keys by [@Jcahilltorre](https://github.com/Jcahilltorre) in [#776](https://github.com/nginx/agent/pull/776)
-- Add new docker images to v2 pipeline for integration testing by [@oliveromahony](https://github.com/oliveromahony) in [#756](https://github.com/nginx/agent/pull/756)
-- Update website changelog for v2.37.0 by [@ADubhlaoich](https://github.com/ADubhlaoich) in [#790](https://github.com/nginx/agent/pull/790)
-- Pass on custom error log path at the time of validating config by [@achawla2012](https://github.com/achawla2012) in [#774](https://github.com/nginx/agent/pull/774)
-- Remove blocking calls in metrics framework by [@oliveromahony](https://github.com/oliveromahony) in [#788](https://github.com/nginx/agent/pull/788)
-- Update broken URL in installation-plus.md by [@nginx-aoife](https://github.com/nginx-aoife) in [#808](https://github.com/nginx/agent/pull/808)
-
-### 🔨 Maintenance
-
-We have made the following maintenance-related minor changes:
-
-- add new plus docker images to v2 pipeline by [@aphralG](https://github.com/aphralG) in [#779](https://github.com/nginx/agent/pull/779)
-- Add MaxRecvMsgSize and MaxSendMsgSize to client and server options by [@oliveromahony](https://github.com/oliveromahony) in [#795](https://github.com/nginx/agent/pull/795)
-- added leak tests for agent v2 by [@oliveromahony](https://github.com/oliveromahony) in [#807](https://github.com/nginx/agent/pull/807)
-
----
-## Release [v2.37.0](https://github.com/nginx/agent/releases/tag/v2.37.0)
-
-### 🚀 Features
-
-This release introduces the following new features:
-
-- feat: Update the changelog by [@ADubhlaoich](https://github.com/ADubhlaoich) in [#753](https://github.com/nginx/agent/pull/753)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- Prevent writing outside allowed directories list from a config payload with actions by [@oliveromahony](https://github.com/oliveromahony) in [#766](https://github.com/nginx/agent/pull/766)
-- The letter v is now always prepended to output of -v by [@olli-holmala](https://github.com/olli-holmala) in [#751](https://github.com/nginx/agent/pull/751)
-- Fix backoff to drop Metrics Reports from buffer after max_elapsed_time has been reached by [@oliveromahony](https://github.com/oliveromahony) in [#752](https://github.com/nginx/agent/pull/752)
-- Fix Post Install Script Issues by [@spencerugbo](https://github.com/spencerugbo) in [#739](https://github.com/nginx/agent/pull/739)
-- docs: fix github links in changelog by [@Jcahilltorre](https://github.com/Jcahilltorre) in [#770](https://github.com/nginx/agent/pull/770)
-- Fix post install script for when no nginx instance is installed by [@dhurley](https://github.com/dhurley) in [#773](https://github.com/nginx/agent/pull/773)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- Upgrade prometheus exporter version to latest by [@oliveromahony](https://github.com/oliveromahony) in [#749](https://github.com/nginx/agent/pull/749)
-- Add badges for Go version, release, license, contributions, and Slack… by [@oCHRISo](https://github.com/oCHRISo) in [#763](https://github.com/nginx/agent/pull/763)
-- Add instructions for Amazon Linux 2023 by [@nginx-seanmoloney](https://github.com/nginx-seanmoloney) in [#759](https://github.com/nginx/agent/pull/759)
-- Add docs-build-push github workflow by [@nginx-jack](https://github.com/nginx-jack) in [#765](https://github.com/nginx/agent/pull/765)
-
-### 🔨 Maintenance
-
-We have made the following maintenance-related minor changes:
-
-- Increase timeout period for collecting metrics by [@oliveromahony](https://github.com/oliveromahony) in [#755](https://github.com/nginx/agent/pull/755)
-
----
-## Release [v2.36.1](https://github.com/nginx/agent/releases/tag/v2.36.1)
-
-### 🌟 Highlights
-
-- Upgrade crossplane version to prevent Agent from rolling back in the case of valid NGINX configurations by [@oliveromahony](https://github.com/oliveromahony) in [#746](https://github.com/nginx/agent/pull/746)
-
-### 🔨 Maintenance
-
-We have made the following maintenance-related minor changes:
-
-- Added version regex to parse the logs to see if matches vsemvar format by [@oliveromahony](https://github.com/oliveromahony) in [#747](https://github.com/nginx/agent/pull/747)
-
----
-## Release [v2.36.0](https://github.com/nginx/agent/releases/tag/v2.36.0)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- Fix incorrect bold tag in heading by [@nginx-seanmoloney](https://github.com/nginx-seanmoloney) in [#715](https://github.com/nginx/agent/pull/715)
-- URL fix for building docker image in README.md by [@y82](https://github.com/y82) in [#720](https://github.com/nginx/agent/pull/720)
-- Fix for version by [@oliveromahony](https://github.com/oliveromahony) in [#732](https://github.com/nginx/agent/pull/732)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- More flexible container images for the official images by [@oliveromahony](https://github.com/oliveromahony) in [#729](https://github.com/nginx/agent/pull/729)
-- Update configuration examples by [@nginx-seanmoloney](https://github.com/nginx-seanmoloney) in [#731](https://github.com/nginx/agent/pull/731)
-- updated github.com/rs/cors version by [@oliveromahony](https://github.com/oliveromahony) in [#735](https://github.com/nginx/agent/pull/735)
-- docs: update changelog by [@Jcahilltorre](https://github.com/Jcahilltorre) in [#736](https://github.com/nginx/agent/pull/736)
-- Upgrade crossplane by [@oliveromahony](https://github.com/oliveromahony) in [#737](https://github.com/nginx/agent/pull/737)
-
----
-## Release [v2.35.1](https://github.com/nginx/agent/releases/tag/v2.35.1)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- fix: add deduplication for the same ssl cert metadata by [@mattdesmarais](https://github.com/mattdesmarais) [@oliveromahony](https://github.com/oliveromahony) in [#716](https://github.com/nginx/agent/pull/716)
-- Fix release workflow by [@dhurley](https://github.com/dhurley) in [#724](https://github.com/nginx/agent/pull/724)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- Update environment variables from NMS to NGINX_AGENT by [@spencerugbo](https://github.com/spencerugbo) in [#710](https://github.com/nginx/agent/pull/710)
-- Update the flag & environment table callouts by [@ADubhlaoich](https://github.com/ADubhlaoich) in [#712](https://github.com/nginx/agent/pull/712)
-- updated golang version to 1.22 by [@oliveromahony](https://github.com/oliveromahony) in [#717](https://github.com/nginx/agent/pull/717)
-
-### 🔨 Maintenance
-
-We have made the following maintenance-related minor changes:
-
-- More detailed test for env variables migration by [@oliveromahony](https://github.com/oliveromahony) in [#709](https://github.com/nginx/agent/pull/709)
-
----
-## Release [v2.35.0](https://github.com/nginx/agent/releases/tag/v2.35.0)
-
-### 🌟 Highlights
-
-- R32 operating system support parity by [@oliveromahony](https://github.com/oliveromahony) in [#708](https://github.com/nginx/agent/pull/708)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- Change environment prefix from nms to nginx_agent by [@spencerugbo](https://github.com/spencerugbo) in [#706](https://github.com/nginx/agent/pull/706)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- Consolidated CLI flag and Env Var sections by [@travisamartin](https://github.com/travisamartin) in [#701](https://github.com/nginx/agent/pull/701)
-- Add Ubuntu Noble 24.04 LTS support by [@Dean-Coakley](https://github.com/Dean-Coakley) in [#682](https://github.com/nginx/agent/pull/682)
-
----
-## Release [v2.34.1](https://github.com/nginx/agent/releases/tag/v2.34.1)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- Fix metrics reporter retry logic by [@dhurley](https://github.com/dhurley) in [#700](https://github.com/nginx/agent/pull/700)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- Update changelog for release 2.34 by [@ADubhlaoich](https://github.com/ADubhlaoich) in [#693](https://github.com/nginx/agent/pull/693)
-
----
-## Release [v2.34.0](https://github.com/nginx/agent/releases/tag/v2.34.0)
-
-### 🌟 Highlights
-
-- Bump the version of net package in golang by [@oliveromahony](https://github.com/oliveromahony) in [#645](https://github.com/nginx/agent/pull/645)
-
-- Add health check endpoint by [@dhurley](https://github.com/dhurley) in [#665](https://github.com/nginx/agent/pull/665)
-
-- Add pending health status by [@dhurley](https://github.com/dhurley) in [#672](https://github.com/nginx/agent/pull/672)
-
-### 🐛 Bug Fixes
-
-In this release we have resolved the following issues:
-
-- fix: fix titles case by [@Jcahilltorre](https://github.com/Jcahilltorre) in [#674](https://github.com/nginx/agent/pull/674)
-- Fix oracle linux integration test by [@dhurley](https://github.com/dhurley) in [#676](https://github.com/nginx/agent/pull/676)
-
-### 📝 Documentation
-
-We have made the following updates to the documentation:
-
-- chore: add 2.33.0 changelog by [@Jcahilltorre](https://github.com/Jcahilltorre) in [#622](https://github.com/nginx/agent/pull/622)
-- Change environment variable list to table with CLI references by [@ADubhlaoich](https://github.com/ADubhlaoich) in [#689](https://github.com/nginx/agent/pull/689)
-- Add health checks documentation by [@dhurley](https://github.com/dhurley) in [#673](https://github.com/nginx/agent/pull/673)
-
-### 🔨 Maintenance
-
-We have made the following maintenance-related minor changes:
-
-- Keep looking for master process by [@spencerugbo](https://github.com/spencerugbo) in [#617](https://github.com/nginx/agent/pull/617)
-- Bump docker dependency to version v24.0.9 by [@dhurley](https://github.com/dhurley) in [#626](https://github.com/nginx/agent/pull/626)
-- Bump the version of github.com/opencontainers/runc dependency by [@dhurley](https://github.com/dhurley) in [#657](https://github.com/nginx/agent/pull/657)
-- Remove unnecessary freebsd logic for finding process executable by [@dhurley](https://github.com/dhurley) in [#668](https://github.com/nginx/agent/pull/668)
-- Add additional checks in chunking functionality by [@dhurley](https://github.com/dhurley) in [#671](https://github.com/nginx/agent/pull/671)
-
+<!-- this dummy doc is used to create a list page entry that redirects users to the NGINX Agent repository changelog. The redirect is configured in azure-redirects-base -->
\ No newline at end of file
diff --git a/content/agent/community.md b/content/agent/community.md
new file mode 100644
index 000000000..932fb492b
--- /dev/null
+++ b/content/agent/community.md
@@ -0,0 +1,20 @@
+---
+title: Community and contribution
+toc: true
+weight: 600
+nd-docs: DOCS-1884
+---
+
+Discover the various ways you can participate in the F5 NGINX Agent project:
+
+## Community
+
+- Have questions or ideas to discuss? Join the conversation about NGINX Agent in the [NGINX Community Forum](https://community.nginx.org/).
+
+## Contribute
+
+Get involved with the project by contributing! Please see our [contributing guide](https://github.com/nginx/agent/blob/main/CONTRIBUTING.md) for details.
+
+## License
+
+[Apache License, Version 2.0](https://github.com/nginx/agent/blob/main/LICENSE)
diff --git a/content/agent/configuration/_index.md b/content/agent/configuration/_index.md
index 1c0c90128..ca784b6eb 100644
--- a/content/agent/configuration/_index.md
+++ b/content/agent/configuration/_index.md
@@ -1,6 +1,10 @@
 ---
-title: Configuration
-description: Learn how to configure NGINX Agent.
-weight: 400
+title: "Configuration"
+weight: "400"
 url: /nginx-agent/configuration/
+cascade:
+  logo: NGINX-product-icon.png
+  layout: agent-v2-migration
 ---
+
+Learn how to configure NGINX Agent.
\ No newline at end of file
diff --git a/content/agent/configuration/configuration-overview.md b/content/agent/configuration/configuration-overview.md
index d82ffec91..41086bd8a 100644
--- a/content/agent/configuration/configuration-overview.md
+++ b/content/agent/configuration/configuration-overview.md
@@ -4,8 +4,7 @@ draft: false
 weight: 100
 toc: true
 nd-docs: DOCS-1229
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 The following sections explain how to configure NGINX Agent using configuration files, CLI flags, and environment variables.
diff --git a/content/agent/configuration/configure-nginx-agent-features.md b/content/agent/configuration/configure-nginx-agent-features.md
deleted file mode 100644
index 4bf5b1b24..000000000
--- a/content/agent/configuration/configure-nginx-agent-features.md
+++ /dev/null
@@ -1,95 +0,0 @@
----
-title: Features configuration
-draft: false
-weight: 150
-toc: true
-type:
-- how-to
-nd-docs: DOCS-1678
----
-
-## Overview
-
-This guide describes the F5 NGINX Agent features, and how to enable and disable features using the NGINX Agent configuration file.
-
-## Before you begin
-
-Before you start, make sure that you have:
-
-- NGINX Agent installed in your system.
-- Access to the NGINX Agent configuration file.
-
-
-## Features
-
-The following table lists the NGINX Agent features.
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-| **Feature Name**      | **Description**      | **Default/Non-default**      |
-| ------------- | ------------- | ------------- |
-| registration | Registering the NGINX Agent with the management plane.| Default |
-| nginx-config-async | Enable the publishing and uploading of NGINX configurations from the management plane.| Default |
-| metrics | Enable collecting of NGINX metrics.| Default |
-| metrics-throttle | Batch metrics before sending.| Non-default |
-| metrics-sender | Reports metrics over the gRPC connection.| Non-default |
-| dataplane-status | Report the health of the NGINX Instance.| Default |
-| process-watcher | Observe changes to the NGINX process.| Default |
-| file-watcher | Observe changes to the NGINX configuration or any changes to files on disk.| Default |
-| activity-events | Send NGINX or NGINX Agent related events to the management plane.| Default |
-| agent-api | Enable the NGINX Agent REST API.| Default |
-{{</bootstrap-table>}}
-
-## Use Cases
-
-### Enable metrics only
-1. **Access the NGINX Instance:** SSH to the virtual machine/server where NGINX Agent is running.
-
-```
-    ssh user@your-nginx-instance
-```
-
-2. **Edit NGINX Agent configuration:**
-
-```
-    sudo vim /etc/nginx-agent/nginx-agent.conf
-```
-
-3. **Add Features section:** Add the following yaml to the end of the file:
-
-```
-    features:
-      - metrics
-      - metrics-throttle
-      - dataplane-status
-```
-
-4. **Restart the NGINX Agent service:** Restart the NGINX Agent service to enable changes.
-
-Once the steps have been completed, users will be able to view metrics data being sent but will not have the capability to push NGINX configuration changes.
-
-### Enable the publishing of NGINX configurations and disable the collection of metrics.
-1. **Access the NGINX Instance:** SSH to the virtual machine/server where NGINX Agent is running.
-
-```
-    ssh user@your-nginx-instance
-```
-
-2. **Edit NGINX Agent configuration:**
-
-```
-    sudo vim /etc/nginx-agent/nginx-agent.conf
-```
-
-3. **Add Features section:** Add the following yaml to the end of the file:
-
-```
-    features:
-      - nginx-config-async
-      - dataplane-status
-      - file-watcher
-```
-
-4. **Restart the NGINX Agent service:** Restart the NGINX Agent service to enable changes.
-
-Once the steps have been completed, users will be able to publish NGINX configurations but metrics data will not be collected by the NGINX Agent.
-
diff --git a/content/agent/configuration/configure-nginx-agent-group.md b/content/agent/configuration/configure-nginx-agent-group.md
index 772922178..bf3f1d0f7 100644
--- a/content/agent/configuration/configure-nginx-agent-group.md
+++ b/content/agent/configuration/configure-nginx-agent-group.md
@@ -1,11 +1,10 @@
 ---
-title: Add NGINX users to nginx-agent Group
+title: "Add NGINX users to nginx-agent group"
 draft: false
 weight: 300
 toc: true
 nd-docs: DOCS-933
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/configuration/health-checks.md b/content/agent/configuration/health-checks.md
index 104311a9e..ef087c9d5 100644
--- a/content/agent/configuration/health-checks.md
+++ b/content/agent/configuration/health-checks.md
@@ -3,8 +3,7 @@ title: Health checks
 draft: false
 weight: 400
 toc: true
-type:
-- how-to
+nd-content-type: how-to
 nd-docs: DOCS-1677
 ---
 
diff --git a/content/agent/contribute/_index.md b/content/agent/contribute/_index.md
deleted file mode 100644
index a11203387..000000000
--- a/content/agent/contribute/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Contribute
-description: Learn about the NGINX Agent community and contribute to the project.
-weight: 500
-url: /nginx-agent/contribute/
----
diff --git a/content/agent/contribute/community.md b/content/agent/contribute/community.md
deleted file mode 100644
index 80af280bf..000000000
--- a/content/agent/contribute/community.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-title: Community and contribution
-draft: false
-weight: 100
-toc: true
-nd-docs: DOCS-1087
-type:
-- how-to
----
-
-# Community
-
-- Our [Slack channel #nginx-agent](https://nginxcommunity.slack.com/), is the go-to place to start asking questions and sharing your thoughts.
-
-- Our [GitHub issues page](https://github.com/nginx/agent/issues) offers space for a more technical discussion at your own pace.
-
-# Contribute
-
-Get involved with the project by contributing! Please see our [contributing guide](https://github.com/nginx/agent/blob/main/CONTRIBUTING.md) for details.
-
-# License
-
-[Apache License, Version 2.0](https://github.com/nginx/agent/blob/main/LICENSE)
diff --git a/content/agent/contribute/dev-environment-setup.md b/content/agent/contribute/dev-environment-setup.md
index b854af4c5..72827ceba 100644
--- a/content/agent/contribute/dev-environment-setup.md
+++ b/content/agent/contribute/dev-environment-setup.md
@@ -1,64 +1,61 @@
 ---
-title: Development environment setup
-draft: false
-weight: 200
+title: "Development environment setup"
 toc: true
 nd-docs: DOCS-1088
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
 
-Learn how to setup a Development Environment for NGINX Agent.
+This page describes how to configure a development environment for F5 NGINX Agent.
 
-## Select an Operating System
+While most Linux or FreeBSD operating systems can be used to contribute to the NGINX Agent project, the following steps have been designed for Ubuntu.
 
-While most Linux or FreeBSD operating systems can be used to contribute to the NGINX Agent project, the following steps have been designed for Ubuntu. Ubuntu is packaged with most libraries required to build and run NGINX Agent, and is the recommended platform for NGINX Agent development.
+Ubuntu is the recommended operating system for development, as it comes with most packages requires to build and run NGINX Agent.
 
-## Install NGINX
+## Before you begin
 
-Follow the steps in the [Installation]({{< ref "/agent/installation-upgrade/" >}}) section to download, install, and run NGINX and NGINX Agent.
+To begin this task, you will require the following:
 
-## Clone the NGINX Agent Repository
+- A [working NGINX Agent instance]({{< ref "/nginx-one/agent/install-upgrade/" >}}).
+- A [Go installation](https://go.dev/dl/) of version 1.22.2 or newer.
+- A [Protocol Buffer Compiler](https://grpc.io/docs/protoc-installation/) installation.
 
-Using your preferred method, clone the NGINX Agent repository into your development directory. See [Cloning a GitHub Repository](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository) for additional help.
+You will also need a copy of the NGINX Agent repository, which you can clone using `git`:
 
-## Installing Prerequisite Packages
+```shell
+git clone git@github.com:nginx/agent.git
+```
+
+Read [Cloning a repository](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository) for more information
+
+Follow the steps in the [Installation]({{< ref "/nginx-one/agent/install-upgrade/" >}}) topic to install NGINX Agent.
+
+## Install prerequisite packages
 Depending on the operating system distribution, it may be necessary to install the following packages in order to build NGINX Agent.
 
 Change to the NGINX Agent source directory:
-```bash
+```shell
 cd <path_to_development_directory>/agent
 ```
 
 Install Make:
-```bash
+```shell
 sudo apt install make
 ```
 
-NGINX Agent is written in Go. You may [download Go](https://go.dev/doc/install) and follow installation instructions on the same page or run:
-```bash
-sudo apt install golang-go
-```
-
-Install Protoc:
-```bash
-sudo apt install -y protobuf-compiler
-```
-
 Install NGINX Agent tools and dependencies:
 
 Before starting development on NGINX Agent, it is important to download and install the necessary tool and dependencies required by NGINX Agent. You can do this by running the following `make` command:
-```bash
+```shell
 make install-tools deps
 ```
 
-## Building NGINX Agent from Source Code
+## Build NGINX Agent from source code
 
 Run the following commands to build and run NGINX Agent:
 
-```bash
+```shell
 make build
 sudo make run
 ```
diff --git a/content/agent/contribute/start-mock-interface.md b/content/agent/contribute/start-mock-interface.md
new file mode 100644
index 000000000..9b338d09f
--- /dev/null
+++ b/content/agent/contribute/start-mock-interface.md
@@ -0,0 +1,91 @@
+---
+title: Start mock control plane interface
+toc: true
+weight: 300
+nd-docs: DOCS-000
+draft: true
+---
+
+This document describes how to configure and run F5 NGINX Agent using a mock interface ("control plane") for NGINX Agent to report to.
+
+The mock interface is useful when developing NGINX Agent, as it allows you to view what metrics are being reported.
+
+## Before you begin
+
+To begin this task, you will require the following:
+
+- A [working NGINX Agent instance]({{< ref "/nginx-one/agent/install-upgrade/" >}}).
+- A [Go installation](https://go.dev/dl/) of version 1.22.2 or newer.
+- A [go-swagger](https://goswagger.io/go-swagger/install/) installation.
+
+You will also need a copy of the NGINX Agent repository, which you can clone using `git`:
+
+```shell
+git clone git@github.com:nginx/agent.git
+```
+
+Read [Cloning a repository](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository) for more information.
+
+## Start the gRPC mock control plane
+
+Start the mock control plane by running the following command from the `agent` source code root directory:
+
+```shell
+go run sdk/examples/server.go
+```
+```text
+INFO[0000] http listening at 54790 # mock control plane port
+INFO[0000] grpc listening at 54789 # grpc control plane port which NGINX Agent will report to
+```
+
+The mock control plane can use either gRPC or REST protocols to communicate with NGINX Agent.
+
+To enable them, view the [Enable gRPC and REST interfaces]({{< ref "/agent/how-to/enable-interfaces.md" >}}) topic.
+
+## Launch Swagger UI
+
+To launch the Swagger UI for the REST interface run the following command:
+
+```shell
+make launch-swagger-ui
+```
+
+## Start NGINX Agent
+
+Open another terminal window and start NGINX Agent. Issue the following command from the `agent` source code root directory.
+
+```shell
+sudo make run
+```
+```text
+WARN[0000] Log level is info
+INFO[0000] setting displayName to XXX
+INFO[0000] NGINX Agent at with pid 12345, clientID=XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX name=XXX
+INFO[0000] NginxBinary initializing
+INFO[0000] Commander initializing
+INFO[0000] Comms initializing
+INFO[0000] OneTimeRegistration initializing
+INFO[0000] Registering XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX
+INFO[0000] Metrics initializing
+INFO[0000] MetricsThrottle initializing
+INFO[0000] DataPlaneStatus initializing
+INFO[0000] MetricsThrottle waiting for report ready
+INFO[0000] Metrics waiting for handshake to be completed
+INFO[0000] ProcessWatcher initializing
+INFO[0000] Extensions initializing
+INFO[0000] FileWatcher initializing
+INFO[0000] FileWatchThrottle initializing
+INFO[0001] Events initializing
+INFO[0001] OneTimeRegistration completed
+```
+
+Open a web browser to view the mock control plane at [http://localhost:54790](http://localhost:54790). The following links will be shown in the web interface:
+
+- **registered** - shows registration information of the data plane
+- **nginxes** - lists the nginx instances on the data plane
+- **configs** - shows the protobuf payload for NGINX configuration sent to the management plane
+- **configs/chunked** - shows the split-up payloads sent to the management plane
+- **configs/raw** - shows the actual configuration as it would live on the data plane
+- **metrics** - shows a buffer of metrics sent to the management plane (similar to what will be sent back in the REST API)
+
+For more NGINX Agent use cases, refer to the [NGINX Agent SDK examples](https://github.com/nginx/agent/tree/main/sdk/examples).
\ No newline at end of file
diff --git a/content/agent/installation-upgrade/_index.md b/content/agent/installation-upgrade/_index.md
index 1d84d3ebc..d17ef4d5d 100644
--- a/content/agent/installation-upgrade/_index.md
+++ b/content/agent/installation-upgrade/_index.md
@@ -2,5 +2,8 @@
 title: Installation and upgrade
 description: Learn how to install, upgrade, and uninstall NGINX Agent.
 weight: 300
-url: /nginx-agent/installation-upgrade/
+url: /nginx-agent/v2/installation-upgrade/
+cascade:
+  logo: NGINX-product-icon.png
+  type: agent-v2-migration
 ---
diff --git a/content/agent/installation-upgrade/container-environments/_index.md b/content/agent/installation-upgrade/container-environments/_index.md
index 35c6aa73f..bc1eeddd7 100644
--- a/content/agent/installation-upgrade/container-environments/_index.md
+++ b/content/agent/installation-upgrade/container-environments/_index.md
@@ -2,5 +2,8 @@
 title: Container environments
 description: Learn how to build and run NGINX Agent docker images.
 weight: 800
-ur: /nginx-agent/installation-upgrade/container-environments/
+url: /nginx-agent/v2/installation-upgrade/container-environments/
+cascade:
+  logo: NGINX-product-icon.png
+  type: agent-v2-migration
 ---
diff --git a/content/agent/installation-upgrade/container-environments/docker-images.md b/content/agent/installation-upgrade/container-environments/docker-images.md
index 2302bed3c..f21c23929 100644
--- a/content/agent/installation-upgrade/container-environments/docker-images.md
+++ b/content/agent/installation-upgrade/container-environments/docker-images.md
@@ -4,8 +4,7 @@ draft: false
 weight: 100
 toc: true
 nd-docs: DOCS-1410
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/installation-upgrade/container-environments/docker-support.md b/content/agent/installation-upgrade/container-environments/docker-support.md
index d1d624799..1a57cafab 100644
--- a/content/agent/installation-upgrade/container-environments/docker-support.md
+++ b/content/agent/installation-upgrade/container-environments/docker-support.md
@@ -4,7 +4,7 @@ draft: false
 toc: true
 weight: 200
 nd-docs: DOCS-909
-type:
+nd-content-type:
 - task
 ---
 
@@ -12,7 +12,7 @@ type:
 
 The NGINX Agent repository includes [Dockerfiles](https://github.com/nginx/agent/tree/main/scripts/docker) that can be used to [build custom container images]({{< ref "/agent/installation-upgrade/container-environments/docker-images.md" >}}). Images are created with an NGINX Open Source or NGINX Plus instance and are available for various operating systems.
 
-See the [Technical Specifications]({{< ref "/agent/technical-specifications.md#container-support" >}}) for a list of supported operationg systems.
+See the [Technical Specifications]({{< ref "/agent/technical-specifications.md" >}}) for a list of supported operationg systems.
 
 NGINX Agent running in a container has some limitations that need to be considered, and are listed below.
 
diff --git a/content/agent/installation-upgrade/getting-started.md b/content/agent/installation-upgrade/getting-started.md
index b8cbdb783..c7ee427af 100644
--- a/content/agent/installation-upgrade/getting-started.md
+++ b/content/agent/installation-upgrade/getting-started.md
@@ -4,8 +4,7 @@ draft: false
 weight: 100
 toc: true
 nd-docs: DOCS-1089
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/installation-upgrade/installation-github.md b/content/agent/installation-upgrade/installation-github.md
index f2452d56c..d1cbbb2d6 100644
--- a/content/agent/installation-upgrade/installation-github.md
+++ b/content/agent/installation-upgrade/installation-github.md
@@ -4,8 +4,7 @@ draft: false
 weight: 200
 toc: true
 nd-docs: DOCS-1090
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/installation-upgrade/installation-oss.md b/content/agent/installation-upgrade/installation-oss.md
index 251627629..ab4016d08 100644
--- a/content/agent/installation-upgrade/installation-oss.md
+++ b/content/agent/installation-upgrade/installation-oss.md
@@ -4,8 +4,7 @@ draft: false
 weight: 300
 toc: true
 nd-docs: DOCS-1216
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/installation-upgrade/installation-plus.md b/content/agent/installation-upgrade/installation-plus.md
index c0d5fdf9f..add1272dc 100644
--- a/content/agent/installation-upgrade/installation-plus.md
+++ b/content/agent/installation-upgrade/installation-plus.md
@@ -4,8 +4,7 @@ draft: false
 weight: 400
 toc: true
 nd-docs: DOCS-1217
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/installation-upgrade/installation-unprivileged.md b/content/agent/installation-upgrade/installation-unprivileged.md
index 1324bc27c..4bf90c9f1 100644
--- a/content/agent/installation-upgrade/installation-unprivileged.md
+++ b/content/agent/installation-upgrade/installation-unprivileged.md
@@ -2,7 +2,8 @@
 title: Run without root privileges
 weight: 450
 toc: true
-type: how-to
+nd-content-type:
+  - how-to
 product: Agent
 nd-docs: DOCS-1781
 ---
diff --git a/content/agent/installation-upgrade/uninstall.md b/content/agent/installation-upgrade/uninstall.md
index dc356c2f5..56db538f0 100644
--- a/content/agent/installation-upgrade/uninstall.md
+++ b/content/agent/installation-upgrade/uninstall.md
@@ -4,8 +4,7 @@ draft: false
 weight: 700
 toc: true
 nd-docs: DOCS-1230
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/installation-upgrade/upgrade.md b/content/agent/installation-upgrade/upgrade.md
index e62fe59e4..f942db01f 100644
--- a/content/agent/installation-upgrade/upgrade.md
+++ b/content/agent/installation-upgrade/upgrade.md
@@ -4,8 +4,7 @@ draft: false
 weight: 600
 toc: true
 nd-docs: DOCS-1227
-type:
-- how-to
+nd-content-type: how-to
 ---
 
 ## Overview
diff --git a/content/agent/support.md b/content/agent/support.md
new file mode 100644
index 000000000..363925c75
--- /dev/null
+++ b/content/agent/support.md
@@ -0,0 +1,21 @@
+---
+title: Support
+weight: 800
+toc: false
+nd-content-type: reference
+product: Agent
+nd-docs: DOCS-1883
+---
+
+## Support policy
+F5 NGINX Agent adheres to the support policy detailed in the following knowledge base article: [K000140156](https://my.f5.com/manage/s/article/K000140156).
+
+
+## Contact F5 Support
+
+For questions and/or assistance with installing, troubleshooting, or using NGINX Agent, contact support via the [MyF5 Customer Portal](https://account.f5.com/myf5).
+
+## Community support
+
+- If you experience issues with NGINX Agent, please [open an issue in GitHub](https://github.com/nginx/agent/issues/new).
+- If you have any suggestions or feature requests, please [open an idea in GitHub discussions](https://github.com/nginx/agent/discussions).
diff --git a/content/agent/technical-specifications.md b/content/agent/technical-specifications.md
index 63561ed94..b4273c922 100644
--- a/content/agent/technical-specifications.md
+++ b/content/agent/technical-specifications.md
@@ -1,18 +1,16 @@
 ---
-title: Technical specifications
-draft: false
-weight: 200
+title: "Technical specifications"
+weight: 100
 toc: true
 nd-docs: DOCS-1092
-type:
-- how-to
+nd-content-type: how-to
 ---
 
-## Overview
+This document describes the requirements for NGINX Agent version 2.
 
 This document provides technical specifications for NGINX Agent. It includes information on supported distributions, deployment environments, NGINX versions, sizing recommendations, and logging.
 
-## NGINX Agent v3.0 Compatibility
+## NGINX Agent 3.0 Compatibility
 {{< bootstrap-table "table table-striped table-bordered" >}}
 | NGINX Product                | Agent Version  |
 |------------------------------|----------------|
@@ -28,21 +26,21 @@ This document provides technical specifications for NGINX Agent. It includes inf
 NGINX Agent can run in most environments. We support the following distributions:
 
 {{< bootstrap-table "table table-striped table-bordered" >}}
-| | AlmaLinux | Alpine Linux | Amazon Linux | Amazon Linux 2 | Debian |
-|-|-----------|--------------|--------------|----------------|--------|
-|**Version**|8 <br><hr>9 | 3.18<br><hr> 3.19<br><hr> 3.20 <br><hr> 3.21|  2023|  LTS|  11<br><hr> 12|
-|**Architecture**| x86_84<br><hr>aarch64| x86_64<br><hr>aarch64 | x86_64<br><hr>aarch64 | x86_64<br><hr>aarch64 | x86_64<br><hr>aarch64 |
+| | AlmaLinux | Alpine Linux | Amazon Linux | Amazon Linux 2 | CentOS | Debian |
+|-|-----------|--------------|--------------|----------------|--------|--------|
+|**Version**|8 <br><hr>9 |  3.16<br><hr>3.17<br><hr> 3.18<br><hr> 3.19|  2023|  LTS|  7.4+|  11<br><hr> 12|
+|**Architecture**| x86_84<br><hr>aarch64| x86_64<br><hr>aarch64 | x86_64<br><hr>aarch64 | x86_64<br><hr>aarch64 | x86_64<br><hr>aarch64 | x86_64<br><hr>aarch64 |
 {{< /bootstrap-table >}}
 
 {{< bootstrap-table "table table-striped table-bordered" >}}
 | |FreeBSD | Oracle Linux | Red Hat <br>Enterprise Linux <br>(RHEL) | Rocky Linux | SUSE Linux <br>Enterprise Server <br>(SLES) | Ubuntu |
 |-|--------|--------------|---------------------------------|-------------|-------------------------------------|--------|
-|**Version**|13<br><hr>14|8.1+<br><hr>9|8.1+<br><hr>9.0+|8<br><hr>9|15 SP2|20.04 LTS<br><hr>22.04 LTS<br><hr>24.04 LTS|
+|**Version**|13<br><hr>14|7.4+<br><hr>8.1+<br><hr>9|7.4+<br><hr>8.1+<br><hr>9.0+|8<br><hr>9|12 SP5<br><hr>15 SP2|20.04 LTS<br><hr>22.04 LTS|
 |**Architecture**|amd64|x86_64|x86_64<br><hr>aarch64|x86_64<br><hr>aarch64|x86_64|x86_64<br><hr>aarch64|
 {{< /bootstrap-table >}}
 
 
-## Supported Deployment Environments
+## Supported deployment environments
 
 NGINX Agent can be deployed in the following environments:
 
@@ -51,12 +49,12 @@ NGINX Agent can be deployed in the following environments:
 - Public Cloud: AWS, Google Cloud Platform, and Microsoft Azure
 - Virtual Machine
 
-## Supported NGINX Versions
+## Supported NGINX versions
 
 NGINX Agent works with all supported versions of NGINX Open Source and NGINX Plus.
 
 
-## Sizing Recommendations
+## Sizing recommendations
 
 Minimum system sizing recommendations for NGINX Agent:
 {{< bootstrap-table "table table-striped table-bordered" >}}
diff --git a/content/includes/agent/about.md b/content/includes/agent/about.md
new file mode 100644
index 000000000..e23de8922
--- /dev/null
+++ b/content/includes/agent/about.md
@@ -0,0 +1,43 @@
+---
+docs:
+files:
+   - content/agent/about.md
+   - content/nginx-one/agent/overview/about.md
+---
+
+F5 NGINX Agent is a lightweight companion daemon designed to work with NGINX One and enable remote management of NGINX instances. It also gathers performance metrics from NGINX and transmits them to the NGINX One Console for enhanced monitoring and control.
+
+## Key features
+
+Enable Access to key NGINX One use cases:
+
+   - Seamlessly integrates with essential NGINX One functionality, simplifying access to its core use cases and
+     enhancing operational workflows.
+   - [Connects NGINX instances to NGINX One Console]({{< ref "/nginx-one/agent/install-upgrade/install-from-oss-repo.md#connect-an-instance-to-nginx-one-console" >}})
+
+Real-time observability into NGINX One data plane instances:
+
+   - Provides live monitoring and actionable insights into the performance, status, and health of NGINX One data plane
+     instances, improving decision-making and operational efficiency.
+   - NGINX Agent supports [OpenTelemetry](https://opentelemetry.io/) and the ability to
+     [export the metrics data]({{< ref "/nginx-one/agent/metrics/configure-otel-metrics.md" >}}) for use in other applications.
+
+
+
+### Configuration management
+
+- NGINX Agent provides an interface that enables users to deploy configuration changes to NGINX instances from a
+  centralized management plane.
+- Additionally, NGINX Agent verifies that the configuration changes are successfully applied to NGINX instances.
+
+### Metrics collection
+
+NGINX Agent comes pre-packaged with an embedded OpenTelemetry Collector. This embedded collector gathers vital performance
+and health metrics for both NGINX and the underlying instance it operates on.
+
+For example, it tracks key metrics such as active connections, requests per second, HTTP status codes, and response times.
+Additionally, it collects system-level data, including CPU usage, memory consumption, and disk I/O. These insights provide
+deep observability into NGINX's behavior, enabling teams to troubleshoot issues effectively, optimize performance, and
+maintain high availability.
+
+Collected metrics can be seamlessly exported to NGINX One Console or integrated with third-party data aggregators.
diff --git a/content/includes/agent/architecture.md b/content/includes/agent/architecture.md
new file mode 100644
index 000000000..d09a138be
--- /dev/null
+++ b/content/includes/agent/architecture.md
@@ -0,0 +1,22 @@
+---
+docs:
+files:
+   - content/agent/about.md
+   - content/nginx-one/agent/overview/about.md
+---
+
+The figure shows:
+
+- An NGINX instance running on bare metal, virtual machine or container
+- NGINX One Cloud Console includes:
+
+  - Command Server to manage NGINX configurations, push new/updated configuration files remotely, and perform integrity tests.
+  - OpenTelemetry (OTel) Receiver that receives observability data from connected Agent instances.
+
+- An NGINX Agent process running on the NGINX instance. NGINX Agent is responsible for:
+
+  - Watching, applying, validating, automatically roll back to last good configuration if issues are detected.
+  - Embedding an OpenTelemetry Collector, collecting metrics from NGINX processes, host system performance data, then securely passing metric data to NGINX One Cloud Console.
+
+- Collection and monitoring of host metrics (CPU usage, Memory utilization, Disk I/O) by the Agent OTel collector.
+- Collected data is made available on NGINX One Cloud Console for monitoring, alerting, troubleshooting, and capacity planning purposes.
diff --git a/content/includes/agent/installation/manually-connect-to-console.md b/content/includes/agent/installation/manually-connect-to-console.md
new file mode 100644
index 000000000..dc00015bd
--- /dev/null
+++ b/content/includes/agent/installation/manually-connect-to-console.md
@@ -0,0 +1,42 @@
+---
+docs:
+files:
+   - content/nginx-one/agent/install-upgrade/install-from-github.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+If you have installed NGINX Agent manually, you will need to connect it to the
+NGINX One Console to manage your NGINX instances.
+
+1. Ensure NGINX Agent is installed
+
+   ```shell
+   nginx-agent -v
+   ```
+
+1. Locate the NGINX Agent Configuration File:
+
+   ```shell
+   /etc/nginx-agent/nginx-agent.conf
+   ```
+
+1. Open the NGINX Agent configuration file in a text editor like vim:
+
+   ```shell
+   sudo vim /etc/nginx-agent/nginx-agent.conf
+   ```
+
+1. Uncomment the command block, and set the token to your data plane key
+1. Save the changes and close the editor
+1. Restart the NGINX Agent service:
+
+   ```shell
+   sudo systemctl restart nginx-agent
+   ```
+
+1. Check the Agent log for `"Agent Connected"`
+
+   ```shell
+   sudo cat /var/log/nginx-agent/agent.log | grep "Agent connected"
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/oss/oss-alpine.md b/content/includes/agent/installation/oss/oss-alpine.md
new file mode 100644
index 000000000..41f4d734a
--- /dev/null
+++ b/content/includes/agent/installation/oss/oss-alpine.md
@@ -0,0 +1,73 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+---
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo apk add openssl curl ca-certificates
+   ```
+
+1. To set up the apk repository for `nginx-agent` packages, run the following command:
+
+   ```shell
+   printf "%s%s%s\n" \
+      "http://packages.nginx.org/nginx-agent/alpine/v" \
+      `grep -o -E '^[0-9]+\.[0-9]+' /etc/alpine-release` \
+      "/main" \
+      | sudo tee -a /etc/apk/repositories
+   ```
+
+1. Next, import an official NGINX signing key so apk can verify the package's
+authenticity. Fetch the key:
+
+   ```shell
+   curl -o /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub
+   ```
+
+1. Verify that downloaded file contains the proper key:
+
+   ```shell
+   openssl rsa -pubin -in /tmp/nginx_signing.rsa.pub -text -noout
+   ```
+
+   The output should contain the following modulus:
+
+   ```
+   Public-Key: (2048 bit)
+   Modulus:
+      00:fe:14:f6:0a:1a:b8:86:19:fe:cd:ab:02:9f:58:
+      2f:37:70:15:74:d6:06:9b:81:55:90:99:96:cc:70:
+      5c:de:5b:e8:4c:b2:0c:47:5b:a8:a2:98:3d:11:b1:
+      f6:7d:a0:46:df:24:23:c6:d0:24:52:67:ba:69:ab:
+      9a:4a:6a:66:2c:db:e1:09:f1:0d:b2:b0:e1:47:1f:
+      0a:46:ac:0d:82:f3:3c:8d:02:ce:08:43:19:d9:64:
+      86:c4:4e:07:12:c0:5b:43:ba:7d:17:8a:a3:f0:3d:
+      98:32:b9:75:66:f4:f0:1b:2d:94:5b:7c:1c:e6:f3:
+      04:7f:dd:25:b2:82:a6:41:04:b7:50:93:94:c4:7c:
+      34:7e:12:7c:bf:33:54:55:47:8c:42:94:40:8e:34:
+      5f:54:04:1d:9e:8c:57:48:d4:b0:f8:e4:03:db:3f:
+      68:6c:37:fa:62:14:1c:94:d6:de:f2:2b:68:29:17:
+      24:6d:f7:b5:b3:18:79:fd:31:5e:7f:4c:be:c0:99:
+      13:cc:e2:97:2b:dc:96:9c:9a:d0:a7:c5:77:82:67:
+      c9:cb:a9:e7:68:4a:e1:c5:ba:1c:32:0e:79:40:6e:
+      ef:08:d7:a3:b9:5d:1a:df:ce:1a:c7:44:91:4c:d4:
+      99:c8:88:69:b3:66:2e:b3:06:f1:f4:22:d7:f2:5f:
+      ab:6d
+   Exponent: 65537 (0x10001)
+   ```
+
+1. Finally, move the key to apk trusted keys storage:
+
+   ```shell
+   sudo mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo apk add nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/oss/oss-amazon-linux.md b/content/includes/agent/installation/oss/oss-amazon-linux.md
new file mode 100644
index 000000000..3a3f326b8
--- /dev/null
+++ b/content/includes/agent/installation/oss/oss-amazon-linux.md
@@ -0,0 +1,34 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+---
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo yum install yum-utils procps
+   ```
+
+1. To set up the yum repository for Amazon Linux 2, create a file with name
+`/etc/yum.repos.d/nginx-agent.repo` with the following contents:
+
+   ```ini
+   [nginx-agent]
+   name=nginx agent repo
+   baseurl=http://packages.nginx.org/nginx-agent/amzn2/$releasever/$basearch/
+   gpgcheck=1
+   enabled=1
+   gpgkey=https://nginx.org/keys/nginx_signing.key
+   module_hotfixes=true
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo yum install nginx-agent
+   ```
+
+1. When prompted to accept the GPG key, verify that the fingerprint matches
+`573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62`, and if so, accept it.
\ No newline at end of file
diff --git a/content/includes/agent/installation/oss/oss-debian.md b/content/includes/agent/installation/oss/oss-debian.md
new file mode 100644
index 000000000..1d8913352
--- /dev/null
+++ b/content/includes/agent/installation/oss/oss-debian.md
@@ -0,0 +1,52 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+---
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring
+   ```
+
+1. Import an official nginx signing key so apt can verify the packages authenticity.
+   Fetch the key:
+
+   ```shell
+   curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
+      | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
+   ```
+
+1. Verify that the downloaded file contains the proper key:
+
+   ```shell
+   gpg --dry-run --quiet --no-keyring \
+   --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg
+   ```
+
+   The output should contain the full fingerprint `573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62`
+   as follows:
+
+   ```
+   pub   rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
+         573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
+   uid                      nginx signing key <signing-key@nginx.com>
+   ```
+
+   {{< important >}}If the fingerprint is different, remove the file.{{< /important >}}
+
+1. Add the `nginx-agent` repository:
+
+   ```shell
+   echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
+   http://packages.nginx.org/nginx-agent/debian/ `lsb_release -cs` agent" \ | sudo tee /etc/apt/sources.list.d/nginx-agent.list
+   ```
+
+1. To install `nginx-agent`, run the following commands:
+
+   ```shell
+   sudo apt update
+   sudo apt install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/oss/oss-freebsd.md b/content/includes/agent/installation/oss/oss-freebsd.md
new file mode 100644
index 000000000..31014d5e1
--- /dev/null
+++ b/content/includes/agent/installation/oss/oss-freebsd.md
@@ -0,0 +1,23 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+---
+
+1. To setup the pkg repository create a file with name `/etc/pkg/nginx-agent.conf`
+with the following content:
+
+   ```none
+   nginx-agent: {
+   URL: pkg+http://packages.nginx.org/nginx-agent/freebsd/${ABI}/latest
+   ENABLED: true
+   MIRROR_TYPE: SRV
+   }
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo pkg install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/oss/oss-rhel.md b/content/includes/agent/installation/oss/oss-rhel.md
new file mode 100644
index 000000000..50ae65222
--- /dev/null
+++ b/content/includes/agent/installation/oss/oss-rhel.md
@@ -0,0 +1,33 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+---
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo yum install yum-utils
+   ```
+
+1. To set up the yum repository, create a file with name `/etc/yum.repos.d/nginx-agent.repo`
+with the following contents:
+
+    ```ini
+    [nginx-agent]
+    name=nginx agent repo
+    baseurl=http://packages.nginx.org/nginx-agent/centos/$releasever/$basearch/
+    gpgcheck=1
+    enabled=1
+    gpgkey=https://nginx.org/keys/nginx_signing.key
+    module_hotfixes=true
+    ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo yum install nginx-agent
+   ```
+
+   When prompted to accept the GPG key, verify that the fingerprint matches `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62`, and if so, accept it.
\ No newline at end of file
diff --git a/content/includes/agent/installation/oss/oss-sles.md b/content/includes/agent/installation/oss/oss-sles.md
new file mode 100644
index 000000000..d6e41c15d
--- /dev/null
+++ b/content/includes/agent/installation/oss/oss-sles.md
@@ -0,0 +1,52 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+---
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo zypper install curl ca-certificates gpg2 gawk
+   ```
+
+1. To set up the zypper repository for `nginx-agent` packages, run the following command:
+
+   ```shell
+   sudo zypper addrepo --gpgcheck --refresh --check \
+      'http://packages.nginx.org/nginx-agent/sles/$releasever_major' nginx-agent
+   ```
+
+1. Next, import an official NGINX signing key so `zypper`/`rpm` can verify the
+package's authenticity. Fetch the key:
+
+   ```shell
+   curl -o /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key
+   ```
+
+1. Verify that the downloaded file contains the proper key:
+
+   ```shell
+   gpg --with-fingerprint --dry-run --quiet --no-keyring --import --import-options import-show /tmp/nginx_signing.key
+   ```
+
+1. The output should contain the full fingerprint `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62` as follows:
+
+   ```
+   pub   rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
+      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
+   uid                      nginx signing key <signing-key@nginx.com>
+   ```
+
+1. Finally, import the key to the rpm database:
+
+   ```shell
+   sudo rpmkeys --import /tmp/nginx_signing.key
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo zypper install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/oss/oss-ubuntu.md b/content/includes/agent/installation/oss/oss-ubuntu.md
new file mode 100644
index 000000000..b1f5127c9
--- /dev/null
+++ b/content/includes/agent/installation/oss/oss-ubuntu.md
@@ -0,0 +1,50 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+---
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring
+   ```
+
+1. Import an official nginx signing key so apt can verify the packages authenticity. Fetch the key:
+
+   ```shell
+   curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
+      | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
+   ```
+
+1. Verify that the downloaded file contains the proper key:
+
+   ```shell
+   gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg
+   ```
+
+   The output should contain the full fingerprint `573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62` as follows:
+
+   ```
+   pub   rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
+         573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
+   uid                      nginx signing key <signing-key@nginx.com>
+   ```
+
+   {{< important >}}If the fingerprint is different, remove the file.{{< /important >}}
+
+1. Add the nginx agent repository:
+
+   ```shell
+   echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
+   http://packages.nginx.org/nginx-agent/ubuntu/ `lsb_release -cs` agent" \
+   | sudo tee /etc/apt/sources.list.d/nginx-agent.list
+   ```
+
+1. To install `nginx-agent`, run the following commands:
+
+   ```shell
+   sudo apt update
+   sudo apt install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/plus/plus-alpine.md b/content/includes/agent/installation/plus/plus-alpine.md
new file mode 100644
index 000000000..6b07cae37
--- /dev/null
+++ b/content/includes/agent/installation/plus/plus-alpine.md
@@ -0,0 +1,83 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+1. Log in to [MyF5 Customer Portal](https://account.f5.com/myf5/) and download
+   your `nginx-repo.crt` and `nginx-repo.key` files.
+
+1. Copy the files to the `/etc/apk/` directory:
+
+   ```shell
+   sudo cp nginx-repo.key /etc/apk/cert.key
+   sudo cp nginx-repo.crt /etc/apk/cert.pem
+   ```
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo apk add openssl curl ca-certificates
+   ```
+
+1. To set up the apk repository for `nginx-agent` packages, run the following
+   command:
+
+   ```shell
+   printf "%s%s%s\n" \
+      "https://pkgs.nginx.com/nginx-agent/alpine/v" \
+      `grep -o -E '^[0-9]+\.[0-9]+' /etc/alpine-release` \
+      "/main" \
+      | sudo tee -a /etc/apk/repositories
+   ```
+
+1. Next, import an official NGINX signing key so apk can verify the package's authenticity. Fetch the key:
+
+   ```shell
+   curl -o /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub
+   ```
+
+1. Verify that downloaded file contains the proper key:
+
+   ```shell
+   openssl rsa -pubin -in /tmp/nginx_signing.rsa.pub -text -noout
+   ```
+
+   The output should contain the following modulus:
+
+   ```none
+   Public-Key: (2048 bit)
+   Modulus:
+      00:fe:14:f6:0a:1a:b8:86:19:fe:cd:ab:02:9f:58:
+      2f:37:70:15:74:d6:06:9b:81:55:90:99:96:cc:70:
+      5c:de:5b:e8:4c:b2:0c:47:5b:a8:a2:98:3d:11:b1:
+      f6:7d:a0:46:df:24:23:c6:d0:24:52:67:ba:69:ab:
+      9a:4a:6a:66:2c:db:e1:09:f1:0d:b2:b0:e1:47:1f:
+      0a:46:ac:0d:82:f3:3c:8d:02:ce:08:43:19:d9:64:
+      86:c4:4e:07:12:c0:5b:43:ba:7d:17:8a:a3:f0:3d:
+      98:32:b9:75:66:f4:f0:1b:2d:94:5b:7c:1c:e6:f3:
+      04:7f:dd:25:b2:82:a6:41:04:b7:50:93:94:c4:7c:
+      34:7e:12:7c:bf:33:54:55:47:8c:42:94:40:8e:34:
+      5f:54:04:1d:9e:8c:57:48:d4:b0:f8:e4:03:db:3f:
+      68:6c:37:fa:62:14:1c:94:d6:de:f2:2b:68:29:17:
+      24:6d:f7:b5:b3:18:79:fd:31:5e:7f:4c:be:c0:99:
+      13:cc:e2:97:2b:dc:96:9c:9a:d0:a7:c5:77:82:67:
+      c9:cb:a9:e7:68:4a:e1:c5:ba:1c:32:0e:79:40:6e:
+      ef:08:d7:a3:b9:5d:1a:df:ce:1a:c7:44:91:4c:d4:
+      99:c8:88:69:b3:66:2e:b3:06:f1:f4:22:d7:f2:5f:
+      ab:6d
+   Exponent: 65537 (0x10001)
+   ```
+
+1. Finally, move the key to apk trusted keys storage:
+
+   ```shell
+   sudo mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo apk add nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/plus/plus-amazon-linux.md b/content/includes/agent/installation/plus/plus-amazon-linux.md
new file mode 100644
index 000000000..505c5c910
--- /dev/null
+++ b/content/includes/agent/installation/plus/plus-amazon-linux.md
@@ -0,0 +1,50 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+1. Create the `/etc/ssl/nginx` directory:
+
+   ```shell
+   sudo mkdir -p /etc/ssl/nginx
+   ```
+
+1. Log in to [MyF5 Customer Portal](https://account.f5.com/myf5/) and download
+   your `nginx-repo.crt` and `nginx-repo.key` files.
+
+1. Copy the `nginx-repo.crt` and `nginx-repo.key` files to the `/etc/ssl/nginx/`
+   directory:
+
+   ```shell
+   sudo cp nginx-repo.crt nginx-repo.key /etc/ssl/nginx/
+   ```
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo yum install yum-utils procps ca-certificates
+   ```
+
+1. To set up the yum repository for Amazon Linux 2, create a file with name
+   `/etc/yum.repos.d/nginx-agent.repo` with the following contents:
+
+   ```ini
+   [nginx-agent]
+   name=nginx-agent repo
+   baseurl=https://pkgs.nginx.com/nginx-agent/amzn2/$releasever/$basearch
+   sslclientcert=/etc/ssl/nginx/nginx-repo.crt
+   sslclientkey=/etc/ssl/nginx/nginx-repo.key
+   gpgcheck=0
+   enabled=1
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo yum install nginx-agent
+   ```
+
+1. When prompted to accept the GPG key, verify that the fingerprint matches
+   `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62`, and if so, accept it.
\ No newline at end of file
diff --git a/content/includes/agent/installation/plus/plus-debian.md b/content/includes/agent/installation/plus/plus-debian.md
new file mode 100644
index 000000000..81e453656
--- /dev/null
+++ b/content/includes/agent/installation/plus/plus-debian.md
@@ -0,0 +1,50 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+1. Create the `/etc/ssl/nginx` directory:
+
+   ```shell
+   sudo mkdir -p /etc/ssl/nginx
+   ```
+
+1. Log in to [MyF5 Customer Portal](https://account.f5.com/myf5/) and download
+   your `nginx-repo.crt` and `nginx-repo.key` files.
+
+1. Copy the files to the `/etc/ssl/nginx/` directory:
+
+   ```shell
+   sudo cp nginx-repo.crt nginx-repo.key /etc/ssl/nginx/
+   ```
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring
+   ```
+
+1. Add the `nginx-agent` repository:
+
+   ```shell
+   echo "deb https://pkgs.nginx.com/nginx-agent/debian/ `lsb_release -cs` agent" \
+   | sudo tee /etc/apt/sources.list.d/nginx-agent.list
+   ```
+
+1. Create apt configuration `/etc/apt/apt.conf.d/90pkgs-nginx`:
+
+   ```conf
+   Acquire::https::pkgs.nginx.com::Verify-Peer "true";
+   Acquire::https::pkgs.nginx.com::Verify-Host "true";
+   Acquire::https::pkgs.nginx.com::SslCert     "/etc/ssl/nginx/nginx-repo.crt";
+   Acquire::https::pkgs.nginx.com::SslKey      "/etc/ssl/nginx/nginx-repo.key";
+   ```
+
+1. To install `nginx-agent`, run the following commands:
+
+   ```shell
+   sudo apt update
+   sudo apt install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/plus/plus-freebsd.md b/content/includes/agent/installation/plus/plus-freebsd.md
new file mode 100644
index 000000000..3cb6442e8
--- /dev/null
+++ b/content/includes/agent/installation/plus/plus-freebsd.md
@@ -0,0 +1,52 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+1. Create the `/etc/ssl/nginx` directory:
+
+   ```shell
+   sudo mkdir -p /etc/ssl/nginx
+   ```
+
+1. Log in to [MyF5 Customer Portal](https://account.f5.com/myf5/) and download
+   your `nginx-repo.crt` and `nginx-repo.key` files.
+
+1. Copy the files to the `/etc/ssl/nginx/` directory:
+
+   ```shell
+   sudo cp nginx-repo.crt nginx-repo.key /etc/ssl/nginx/
+   ```
+
+1. Install the prerequisite `ca_root_nss` package:
+
+   ```shell
+   sudo pkg install ca_root_nss
+   ```
+
+1. To setup the pkg repository create a file with name `/etc/pkg/nginx-agent.conf`
+with the following content:
+
+   ```none
+   nginx-agent: {
+   URL: pkg+https://pkgs.nginx.com/nginx-agent/freebsd/${ABI}/latest
+   ENABLED: yes
+   MIRROR_TYPE: SRV
+   }
+   ```
+
+1. Add the following lines to the `/usr/local/etc/pkg.conf` file:
+
+   ```conf
+   PKG_ENV: { SSL_NO_VERIFY_PEER: "1",
+   SSL_CLIENT_CERT_FILE: "/etc/ssl/nginx/nginx-repo.crt",
+   SSL_CLIENT_KEY_FILE: "/etc/ssl/nginx/nginx-repo.key" }
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo pkg install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/plus/plus-rhel.md b/content/includes/agent/installation/plus/plus-rhel.md
new file mode 100644
index 000000000..8db68e5aa
--- /dev/null
+++ b/content/includes/agent/installation/plus/plus-rhel.md
@@ -0,0 +1,55 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+1. Create the `/etc/ssl/nginx` directory:
+
+   ```shell
+   sudo mkdir -p /etc/ssl/nginx
+   ```
+
+1. Log in to [MyF5 Customer Portal](https://account.f5.com/myf5/) and download
+   your `nginx-repo.crt` and `nginx-repo.key` files.
+
+1. Copy the files to the `/etc/ssl/nginx/` directory:
+
+   ```shell
+   sudo cp nginx-repo.crt nginx-repo.key /etc/ssl/nginx/
+   ```
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo yum install yum-utils procps
+   ```
+
+1. Set up the yum repository by creating the file `nginx-agent.repo` in
+   `/etc/yum.repos.d`, for example using `vi`:
+
+   ```shell
+   sudo vi /etc/yum.repos.d/nginx-agent.repo
+   ```
+
+1. Add the following lines to `nginx-agent.repo`:
+
+   ```ini
+   [nginx-agent]
+   name=nginx agent repo
+   baseurl=https://pkgs.nginx.com/nginx-agent/centos/$releasever/$basearch/
+   sslclientcert=/etc/ssl/nginx/nginx-repo.crt
+   sslclientkey=/etc/ssl/nginx/nginx-repo.key
+   gpgcheck=0
+   enabled=1
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo yum install nginx-agent
+   ```
+
+   When prompted to accept the GPG key, verify that the fingerprint matches
+   `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62`, and if so, accept it.
\ No newline at end of file
diff --git a/content/includes/agent/installation/plus/plus-sles.md b/content/includes/agent/installation/plus/plus-sles.md
new file mode 100644
index 000000000..d9e1cd3f0
--- /dev/null
+++ b/content/includes/agent/installation/plus/plus-sles.md
@@ -0,0 +1,75 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+1. Create the `/etc/ssl/nginx` directory:
+
+   ```shell
+   sudo mkdir -p /etc/ssl/nginx
+   ```
+
+1. Log in to [MyF5 Customer Portal](https://account.f5.com/myf5/) and download
+   your `nginx-repo.crt` and `nginx-repo.key` files.
+
+1. Copy the files to the `/etc/ssl/nginx/` directory:
+
+   ```shell
+   sudo cp nginx-repo.crt nginx-repo.key /etc/ssl/nginx/
+   ```
+
+1. Create a file bundle of the certificate and key:
+
+   ```shell
+   cat /etc/ssl/nginx/nginx-repo.crt /etc/ssl/nginx/nginx-repo.key > /etc/ssl/nginx/nginx-repo-bundle.crt
+   ```
+
+1. Install the prerequisites:
+
+   ```shell
+   sudo zypper install curl ca-certificates gpg2 gawk
+   ```
+
+1. To set up the zypper repository for `nginx-agent` packages, run the following
+   command:
+
+   ```shell
+   sudo zypper addrepo --refresh --check \
+      'https://pkgs.nginx.com/nginx-agent/sles/$releasever_major?ssl_clientcert=/etc/ssl/nginx/nginx-repo-bundle.crt&ssl_verify=peer' nginx-agent
+   ```
+
+1. Next, import an official NGINX signing key so `zypper`/`rpm` can verify the
+   package's authenticity. Fetch the key:
+
+   ```shell
+   curl -o /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key
+   ```
+
+1. Verify that the downloaded file contains the proper key:
+
+   ```shell
+   gpg --with-fingerprint --dry-run --quiet --no-keyring --import --import-options import-show /tmp/nginx_signing.key
+   ```
+
+1. The output should contain the full fingerprint
+   `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62` as follows:
+
+   ```none
+   pub   rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
+      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
+   uid                      nginx signing key <signing-key@nginx.com>
+   ```
+
+1. Finally, import the key to the rpm database:
+
+   ```shell
+   sudo rpmkeys --import /tmp/nginx_signing.key
+   ```
+
+1. To install `nginx-agent`, run the following command:
+
+   ```shell
+   sudo zypper install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/plus/plus-ubuntu.md b/content/includes/agent/installation/plus/plus-ubuntu.md
new file mode 100644
index 000000000..e14f84ee7
--- /dev/null
+++ b/content/includes/agent/installation/plus/plus-ubuntu.md
@@ -0,0 +1,55 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+1. Create the `/etc/ssl/nginx` directory:
+
+   ```shell
+   sudo mkdir -p /etc/ssl/nginx
+   ```
+
+1. Log in to [MyF5 Customer Portal](https://account.f5.com/myf5/) and download your `nginx-repo.crt` and `nginx-repo.key` files.
+
+1. Copy the files to the `/etc/ssl/nginx/` directory:
+
+   ```shell
+   sudo cp nginx-repo.crt nginx-repo.key /etc/ssl/nginx/
+   ```
+
+1. Install the prerequisites:
+
+    ```shell
+   sudo apt-get install apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring
+   ```
+
+1. Download and add [NGINX signing key](https://cs.nginx.com/static/keys/nginx_signing.key):
+
+   ```shell
+   wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
+   ```
+
+1. Create `apt` configuration `/etc/apt/apt.conf.d/90pkgs-nginx`:
+
+    ```conf
+    Acquire::https::pkgs.nginx.com::Verify-Peer "true";
+    Acquire::https::pkgs.nginx.com::Verify-Host "true";
+    Acquire::https::pkgs.nginx.com::SslCert     "/etc/ssl/nginx/nginx-repo.crt";
+    Acquire::https::pkgs.nginx.com::SslKey      "/etc/ssl/nginx/nginx-repo.key";
+    ```
+
+1. Add the `nginx-agent` repository:
+
+   ```shell
+   echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/nginx-agent/ubuntu/ `lsb_release -cs` agent" \
+   | sudo tee /etc/apt/sources.list.d/nginx-agent.list
+   ```
+
+1. To install `nginx-agent`, run the following commands:
+
+   ```shell
+   sudo apt update
+   sudo apt install nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/prerequisites.md b/content/includes/agent/installation/prerequisites.md
new file mode 100644
index 000000000..9a91bf9cb
--- /dev/null
+++ b/content/includes/agent/installation/prerequisites.md
@@ -0,0 +1,13 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-github.md
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+- You must use one of the [supported operating system and architectures]({{< ref "/nginx-one/agent/overview/tech-specs.md#supported-distributions" >}})
+- The user running the NGINX Agent installation must have the same privileges as
+the main NGINX process. We recommend **not** running NGINX or NGINX Agent as the root user.
\ No newline at end of file
diff --git a/content/includes/agent/installation/start-stop-agent.md b/content/includes/agent/installation/start-stop-agent.md
new file mode 100644
index 000000000..fdbbbce62
--- /dev/null
+++ b/content/includes/agent/installation/start-stop-agent.md
@@ -0,0 +1,27 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-github.md
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+To start NGINX Agent on `systemd` systems, run the following command:
+
+```shell
+sudo systemctl start nginx-agent
+```
+
+To enable NGINX Agent to start on boot, run the following command:
+
+```shell
+sudo systemctl enable nginx-agent
+```
+
+To stop NGINX Agent, run the following command:
+
+```shell
+sudo systemctl stop nginx-agent
+```
\ No newline at end of file
diff --git a/content/includes/agent/installation/uninstall/uninstall-alpine.md b/content/includes/agent/installation/uninstall/uninstall-alpine.md
new file mode 100644
index 000000000..47e6e8d7c
--- /dev/null
+++ b/content/includes/agent/installation/uninstall/uninstall-alpine.md
@@ -0,0 +1,20 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/uninstall.md
+   - content/nginx-one/agent/install-upgrade/uninstall.md
+---
+
+Complete the following steps on each host where you've installed NGINX agent:
+
+1. Stop NGINX agent:
+
+   ```shell
+   sudo rc-service nginx-agent stop
+   ```
+
+1. To uninstall NGINX agent, run the following command:
+
+   ```shell
+   sudo apk del nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/uninstall/uninstall-amazon-linux.md b/content/includes/agent/installation/uninstall/uninstall-amazon-linux.md
new file mode 100644
index 000000000..8fc2c7eab
--- /dev/null
+++ b/content/includes/agent/installation/uninstall/uninstall-amazon-linux.md
@@ -0,0 +1,20 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/uninstall.md
+   - content/nginx-one/agent/install-upgrade/uninstall.md
+---
+
+Complete the following steps on each host where you've installed NGINX agent:
+
+1. Stop NGINX agent:
+
+   ```shell
+   sudo systemctl stop nginx-agent
+   ```
+
+1. To uninstall NGINX agent, run the following command:
+
+   ```shell
+   sudo yum remove nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/uninstall/uninstall-debian.md b/content/includes/agent/installation/uninstall/uninstall-debian.md
new file mode 100644
index 000000000..5a25674d5
--- /dev/null
+++ b/content/includes/agent/installation/uninstall/uninstall-debian.md
@@ -0,0 +1,22 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/uninstall.md
+   - content/nginx-one/agent/install-upgrade/uninstall.md
+---
+
+Complete the following steps on each host where you've installed NGINX Agent:
+
+1. Stop NGINX Agent:
+
+   ```shell
+   sudo systemctl stop nginx-agent
+   ```
+
+1. To uninstall NGINX Agent, run the following command:
+
+   ```shell
+   sudo apt-get remove nginx-agent
+   ```
+
+   {{< note >}} The `apt-get remove <package>` command will remove the package from your system, while keeping the associated configuration files for possible future use. If you want to completely remove the package and all of its configuration files, you should use `apt-get purge <package>`. {{< /note >}}
\ No newline at end of file
diff --git a/content/includes/agent/installation/uninstall/uninstall-freebsd.md b/content/includes/agent/installation/uninstall/uninstall-freebsd.md
new file mode 100644
index 000000000..ef18d978b
--- /dev/null
+++ b/content/includes/agent/installation/uninstall/uninstall-freebsd.md
@@ -0,0 +1,20 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/uninstall.md
+   - content/nginx-one/agent/install-upgrade/uninstall.md
+---
+
+Complete the following steps on each host where you've installed NGINX agent:
+
+1. Stop NGINX agent:
+
+   ```shell
+   sudo service nginx-agent stop
+   ```
+
+1. To uninstall NGINX agent, run the following command:
+
+   ```shell
+   sudo pkg delete nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/uninstall/uninstall-rhel.md b/content/includes/agent/installation/uninstall/uninstall-rhel.md
new file mode 100644
index 000000000..4d0a01405
--- /dev/null
+++ b/content/includes/agent/installation/uninstall/uninstall-rhel.md
@@ -0,0 +1,20 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/uninstall.md
+   - content/nginx-one/agent/install-upgrade/uninstall.md
+---
+
+Complete the following steps on each host where you've installed NGINX Agent:
+
+1. Stop NGINX Agent:
+
+   ```shell
+   sudo systemctl stop nginx-agent
+   ```
+
+1. To uninstall NGINX Agent, run the following command:
+
+   ```shell
+   sudo yum remove nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/uninstall/uninstall-sles.md b/content/includes/agent/installation/uninstall/uninstall-sles.md
new file mode 100644
index 000000000..c46fef3d9
--- /dev/null
+++ b/content/includes/agent/installation/uninstall/uninstall-sles.md
@@ -0,0 +1,20 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/uninstall.md
+   - content/nginx-one/agent/install-upgrade/uninstall.md
+---
+
+Complete the following steps on each host where you've installed NGINX Agent:
+
+1. Stop NGINX agent:
+
+   ```shell
+   sudo systemctl stop nginx-agent
+   ```
+
+1. To uninstall NGINX agent, run the following command:
+
+   ```shell
+   sudo zypper remove nginx-agent
+   ```
\ No newline at end of file
diff --git a/content/includes/agent/installation/uninstall/uninstall-ubuntu.md b/content/includes/agent/installation/uninstall/uninstall-ubuntu.md
new file mode 100644
index 000000000..5a25674d5
--- /dev/null
+++ b/content/includes/agent/installation/uninstall/uninstall-ubuntu.md
@@ -0,0 +1,22 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/uninstall.md
+   - content/nginx-one/agent/install-upgrade/uninstall.md
+---
+
+Complete the following steps on each host where you've installed NGINX Agent:
+
+1. Stop NGINX Agent:
+
+   ```shell
+   sudo systemctl stop nginx-agent
+   ```
+
+1. To uninstall NGINX Agent, run the following command:
+
+   ```shell
+   sudo apt-get remove nginx-agent
+   ```
+
+   {{< note >}} The `apt-get remove <package>` command will remove the package from your system, while keeping the associated configuration files for possible future use. If you want to completely remove the package and all of its configuration files, you should use `apt-get purge <package>`. {{< /note >}}
\ No newline at end of file
diff --git a/content/includes/agent/installation/update-container.md b/content/includes/agent/installation/update-container.md
new file mode 100644
index 000000000..a974cfbce
--- /dev/null
+++ b/content/includes/agent/installation/update-container.md
@@ -0,0 +1,24 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/update.md
+   - content/nginx-one/agent/install-upgrade/update.md
+---
+
+To migrate NGINX Agent containers, we provide a script to convert NGINX Agent v2 config files to NGINX Agent v3 config files: [NGINX Agent Config Upgrade Script](https://github.com/nginx/agent/blob/v3/scripts/packages/upgrade-agent-config.sh)
+
+To upgrade the configuration, you can follow this example:
+
+```shell
+wget https://raw.githubusercontent.com/nginx/agent/refs/heads/v3/scripts/packages/upgrade-agent-config.sh
+./upgrade-agent-config.sh --v2-config-file=./nginx-agent-v2.conf --v3-config-file=nginx-agent-v3.conf
+```
+
+If your NGINX Agent container was previously a member of a config sync group, then your NGINX Agent config must be manually updated to add the config sync group label.
+See [Add Config Sync Group]({{< ref "/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md" >}}) for more information.
+
+### Rolling back from NGINX Agent v3 to v2
+
+If you need to roll back your environment to NGINX Agent v2, the upgrade process creates a backup of the NGINX Agent v2 config in the file `/etc/nginx-agent/nginx-agent-v2-backup.conf`.
+
+Replace the contents of `/etc/nginx-agent/nginx-agent.conf` with the contents of `/etc/nginx-agent/nginx-agent-v2-backup.conf` and then reinstall an older version of NGINX Agent.
\ No newline at end of file
diff --git a/content/includes/agent/installation/update.md b/content/includes/agent/installation/update.md
new file mode 100644
index 000000000..6b6834ae7
--- /dev/null
+++ b/content/includes/agent/installation/update.md
@@ -0,0 +1,43 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/update.md
+   - content/nginx-one/agent/install-upgrade/update.md
+---
+
+
+{{< note >}} If you are using a version **older than NGINX Agent v2.31.0**, you must stop NGINX Agent before updating:
+
+   - `sudo systemctl stop nginx-agent`
+
+And start it again after the update:
+
+   - `sudo systemctl start nginx-agent`
+{{< /note >}}
+
+Follow the steps below to update NGINX Agent to the latest version.
+The same steps apply if you are **upgrading from NGINX Agent v2 to NGINX Agent v3**.
+
+1. Open an SSH connection to the server where you've installed NGINX Agent.
+
+1. Make a backup copy of the following locations to ensure that you can successfully recover if the upgrade does not complete
+   successfully:
+
+    - `/etc/nginx-agent`
+    - Every configuration directory specfied in `/etc/nginx-agent/nginx-agent.conf` as a `config_dirs` value
+
+1. Install the updated version of NGINX Agent:
+
+    - CentOS, RHEL, RPM-Based
+
+        ```shell
+        sudo yum -y makecache
+        sudo yum update -y nginx-agent
+        ```
+
+    - Debian, Ubuntu, Deb-Based
+
+        ```shell
+        sudo apt-get update
+        sudo apt-get install -y --only-upgrade nginx-agent -o Dpkg::Options::="--force-confold"
+        ```
diff --git a/content/includes/agent/installation/verify-agent.md b/content/includes/agent/installation/verify-agent.md
new file mode 100644
index 000000000..77facea04
--- /dev/null
+++ b/content/includes/agent/installation/verify-agent.md
@@ -0,0 +1,21 @@
+---
+docs:
+files:
+   - content/agent/install-upgrade/install-from-github.md
+   - content/agent/install-upgrade/install-from-oss-repo.md
+   - content/agent/install-upgrade/install-from-plus-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
+   - content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
+---
+
+Once you have installed NGINX Agent, you can verify that it is running with the
+following command:
+
+```shell
+sudo systemctl status nginx-agent
+```
+
+To check the version installed, run the following command:
+```shell
+sudo nginx-agent -v
+```
\ No newline at end of file
diff --git a/content/includes/agent/tech-specs.md b/content/includes/agent/tech-specs.md
new file mode 100644
index 000000000..129745c66
--- /dev/null
+++ b/content/includes/agent/tech-specs.md
@@ -0,0 +1,23 @@
+---
+docs:
+files:
+   - content/agent/tech-specs.md
+   - content/nginx-one/agent/overview/tech-specs.md
+---
+
+NGINX Agent is designed to operate efficiently on any system that meets the standard
+hardware requirements for running NGINX Plus itself. This ensures compatibility, stability,
+and performance aligned with the NGINX core platform:
+
+### Supported distributions
+
+{{< include "nginx-plus/supported-distributions.md" >}}
+
+To see the detailed technical specifications for NGINX Plus, refer to the official
+[NGINX Plus documentation]({{< ref "/nginx/technical-specs.md" >}}).
+
+
+### Recommended hardware
+
+For recommended hardware, see the
+[Sizing guide for deploying NGINX Plus on bare metal servers](https://www.f5.com/pdf/deployment-guide/Sizing-Guide-for-Deploying-NGINX-Plus-on-Bare-Metal-Servers-2019-11-09.pdf).
\ No newline at end of file
diff --git a/content/includes/agent/v3-available.md b/content/includes/agent/v3-available.md
new file mode 100644
index 000000000..66e5baff6
--- /dev/null
+++ b/content/includes/agent/v3-available.md
@@ -0,0 +1,12 @@
+---
+docs:
+files:
+   - content/nginx-one/agent/overview/about.md
+   - content/nginx-one/agent/changelog.md
+---
+
+{{<call-out "note" "F5 NGINX Agent v3.0 is available now">}}
+NGINX Agent v3.0 is a major release that introduces new features and enhancements.
+
+Visit our [Update]({{< ref "/nginx-one/agent/install-upgrade/update.md" >}}) guide to install the latest version in your environment.
+{{</call-out>}}
\ No newline at end of file
diff --git a/content/includes/installation/add-ports-agent-selinux.md b/content/includes/installation/add-ports-agent-selinux.md
new file mode 100644
index 000000000..27c8e3429
--- /dev/null
+++ b/content/includes/installation/add-ports-agent-selinux.md
@@ -0,0 +1,17 @@
+---
+docs:
+files:
+  - content/nginx-one/agent/configure-instance-reporting/configure-selinux.md
+  - content/nim/system-configuration/configure-selinux.md
+  - content/nms/nginx-agent/install-nginx-agent.md
+---
+
+Make sure to add external ports to the firewall exception list.
+
+To allow external ports outside the HTTPD context, run:
+
+```bash
+sudo setsebool -P httpd_can_network_connect 1
+```
+
+{{<see-also>}}For more information, see [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/).{{</see-also>}}
\ No newline at end of file
diff --git a/content/includes/installation/agent-selinux.md b/content/includes/installation/agent-selinux.md
deleted file mode 100644
index f8bdfe4d0..000000000
--- a/content/includes/installation/agent-selinux.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-nd-docs: DOCS-1403
----
-
-```bash
-sudo semodule -n -i /usr/share/selinux/packages/nginx_agent.pp
-sudo /usr/sbin/load_policy
-sudo restorecon -R /usr/bin/nginx-agent
-sudo restorecon -R /var/log/nginx-agent
-sudo restorecon -R /etc/nginx-agent
-```
diff --git a/content/includes/installation/enable-agent-selinux.md b/content/includes/installation/enable-agent-selinux.md
new file mode 100644
index 000000000..482ee61c1
--- /dev/null
+++ b/content/includes/installation/enable-agent-selinux.md
@@ -0,0 +1,23 @@
+---
+docs:
+files:
+   - content/nginx-one/agent/configure-instance-reporting/configure-selinux.md
+   - content/nim/system-configuration/configure-selinux.md
+   - content/nms/nginx-agent/install-nginx-agent.md
+---
+
+The following SELinux files are added when you install the NGINX Agent package:
+
+- `/usr/share/selinux/packages/nginx_agent.pp` - loadable binary policy module
+- `/usr/share/selinux/devel/include/contrib/nginx_agent.if` - interface definitions file
+- `/usr/share/man/man8/nginx_agent_selinux.8.gz` - policy man page
+
+To load the NGINX Agent policy, run the following commands as root:
+
+```bash
+sudo semodule -n -i /usr/share/selinux/packages/nginx_agent.pp
+sudo /usr/sbin/load_policy
+sudo restorecon -R /usr/bin/nginx-agent
+sudo restorecon -R /var/log/nginx-agent
+sudo restorecon -R /etc/nginx-agent
+```
diff --git a/content/includes/nginx-one/add-file/new-ssl-bundle.md b/content/includes/nginx-one/add-file/new-ssl-bundle.md
index 4ba76c690..c078213e5 100644
--- a/content/includes/nginx-one/add-file/new-ssl-bundle.md
+++ b/content/includes/nginx-one/add-file/new-ssl-bundle.md
@@ -2,7 +2,7 @@
 docs:
 ---
 
-First you can select the toggle to allow NGINX One Console to manaage the new certificate or bundle.
+First you can select the toggle to allow NGINX One Console to manage the new certificate or bundle.
 
 In the screen that appears, you can add a certificate name. If you don't add a name, NGINX One will add a name for you, based on the expiration date for the certificate.
 
diff --git a/content/includes/nginx-one/conf/nginx-agent-conf.md b/content/includes/nginx-one/conf/nginx-agent-conf.md
new file mode 100644
index 000000000..0fcbc57ea
--- /dev/null
+++ b/content/includes/nginx-one/conf/nginx-agent-conf.md
@@ -0,0 +1,22 @@
+---
+docs: DOCS-000
+files:
+  - content/nginx-one/getting-started.md
+  - content/nginx-one/agent/containers/run-agent-container.md
+---
+
+```yaml
+command:
+  server:
+    host: "<NGINX-One-Console-URL>" # Command server host
+    port: 443                       # Command server port
+  auth:
+    token: "<your-data-plane-key-here>" # Authentication token for the command server
+  tls:
+    skip_verify: false
+```
+
+Replace the placeholder values:
+
+- `<NGINX-One-Console-URL>`: The URL of your NGINX One Console instance, typically https://INSERT_YOUR_TENANT_NAME.console.ves.volterra.io/ .
+- `<your-data-plane-key-here>`: Your Data Plane key.
diff --git a/content/includes/nginx-plus/supported-distributions.md b/content/includes/nginx-plus/supported-distributions.md
new file mode 100644
index 000000000..86439439b
--- /dev/null
+++ b/content/includes/nginx-plus/supported-distributions.md
@@ -0,0 +1,20 @@
+---
+docs:
+---
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+| Distribution                        | Supported on R33                                   | Supported on R32                                   |
+|-------------------------------------|-----------------------------------------------|-----------------------------------------------|
+| AlmaLinux                           | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)    | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)    |
+| Alpine Linux                        | 3.17 (x86_64, aarch64) **(deprecated)** <br> 3.18 (x86_64, aarch64) <br> 3.19 (x86_64, aarch64) <br> 3.20 (x86_64, aarch64) **(new)** | 3.16 (x86_64, aarch64) **(deprecated)** <br> 3.17 (x86_64, aarch64) <br> 3.18 (x86_64, aarch64) <br> 3.19 (x86_64, aarch64) |
+| Amazon Linux                        | 2023 (x86_64, aarch64)                        | 2023 (x86_64, aarch64)                        |
+| Amazon Linux 2                      | LTS (x86_64, aarch64)                         | LTS (x86_64, aarch64)                         |
+| CentOS                              | **Not supported**                                 | 7.4+ (x86_64) **(deprecated)**                                 |
+| Debian                              | 11 (x86_64, aarch64) <br> 12 (x86_64, aarch64)  | 11 (x86_64, aarch64) <br> 12 (x86_64, aarch64)  |
+| FreeBSD                             | 13 (amd64) <br> 14 (amd64)                      | 13 (amd64) <br> 14 (amd64)                      |
+| Oracle Linux                        | 8.1+ (x86_64, aarch64) <br> 9 (x86_64)          | 7.4+ (x86_64) **(deprecated)** <br> 8.1+ (x86_64, aarch64) <br> 9 (x86_64) |
+| Red Hat Enterprise Linux (RHEL)     | 8.1+ (x86_64, aarch64) <br> 9.0+ (x86_64, aarch64) | 7.4+ (x86_64) **(deprecated)** <br> 8.1+ (x86_64, aarch64) <br> 9.0+ (x86_64, aarch64) |
+| Rocky Linux                         | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)    | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)    |
+| SUSE Linux Enterprise Server (SLES) | 12 SP5 (x86_64) **(deprecated)** <br> 15 SP2+ (x86_64) | 12 SP5 (x86_64) <br> 15 SP2+ (x86_64)           |
+| Ubuntu                              | 20.04 LTS (x86_64, aarch64) <br> 22.04 LTS (x86_64, aarch64) <br> 24.04 LTS (x86_64, aarch64) | 20.04 LTS (x86_64, aarch64) <br> 22.04 LTS (x86_64, aarch64) <br> 24.04 LTS (x86_64, aarch64 **(new)** |
+{{</bootstrap-table>}}
\ No newline at end of file
diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index bceb86e76..adb7407b4 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -1,6 +1,6 @@
 ---
 title: F5 NGINX One Console
-nd-subtitle: Optimize, secure, and scale your modern apps 
+nd-subtitle: Optimize, secure, and scale your modern apps
 url: /nginx-one/
 nd-landing-page: true
 cascade:
@@ -33,37 +33,37 @@ The F5 NGINX One Console makes it easy to manage NGINX instances across location
   {{</card-section>}}
 {{</card-layout>}}
 
-## Other Components  
+## Other Components
 [//]: # "You can add any extra content for the page here, such as additional cards, diagrams or text."
 
 {{< card-layout >}}
   {{< card-section title="Kubernetes Solutions">}}
     {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" brandIcon="NGINX-Ingress-Controller-product-icon">}}
-      Kubernetes traffic management with API gateway, identity, and observability features. 
+      Kubernetes traffic management with API gateway, identity, and observability features.
     {{</ card >}}
     {{< card title="NGINX Gateway Fabric" titleUrl="/nginx-gateway-fabric" brandIcon="NGINX-product-icon">}}
-      Next generation Kubernetes connectivity using the Gateway API. 
+      Next generation Kubernetes connectivity using the Gateway API.
     {{</ card >}}
   {{</ card-section >}}
   {{< card-section title="Local Console Option">}}
     {{< card title="NGINX Instance Manager" titleUrl="/nginx-instance-manager" brandIcon="NGINX-Instance-Manager-product-icon">}}
-      Track and control NGINX Open Source and NGINX Plus instances. 
+      Track and control NGINX Open Source and NGINX Plus instances.
     {{</ card >}}
   {{</ card-section >}}
   {{< card-section title="Modern App Delivery">}}
     {{< card title="NGINX Plus" titleUrl="/nginx" brandIcon="NGINX-Plus-product-icon-RGB">}}
-      The all-in-one load balancer, reverse proxy, web server, content cache, and API gateway. 
+      The all-in-one load balancer, reverse proxy, web server, content cache, and API gateway.
     {{</ card >}}
     {{< card title="NGINX Open Source" titleUrl="https://nginx.org" brandIcon="NGINX-product-icon">}}
-      The open source all-in-one load balancer, content cache, and web server 
+      The open source all-in-one load balancer, content cache, and web server
     {{</ card >}}
   {{</ card-section >}}
   {{< card-section title="Security">}}
     {{< card title="NGINX App Protect WAF" titleUrl="/nginx-app-protect-waf" brandIcon="NGINX-App-Protect-WAF-product-icon">}}
-      Lightweight, high-performance, advanced protection against Layer 7 attacks on your apps and APIs. 
+      Lightweight, high-performance, advanced protection against Layer 7 attacks on your apps and APIs.
     {{</ card >}}
     {{< card title="NGINX App Protect DoS" titleUrl="/nginx-app-protect-dos" brandIcon="NGINX-App-Protect-DoS-product-icon">}}
-      Defend, adapt, and mitigate against Layer 7 denial-of-service attacks on your apps and APIs. 
+      Defend, adapt, and mitigate against Layer 7 denial-of-service attacks on your apps and APIs.
     {{</ card >}}
   {{</ card-section >}}
 {{</card-layout>}}
\ No newline at end of file
diff --git a/content/nginx-one/agent/_index.md b/content/nginx-one/agent/_index.md
new file mode 100644
index 000000000..159229def
--- /dev/null
+++ b/content/nginx-one/agent/_index.md
@@ -0,0 +1,6 @@
+---
+title: NGINX Agent
+description: Learn about NGINX Agent, its features, and how to install it.
+weight: 750
+url: /nginx-one/agent/
+---
diff --git a/content/nginx-one/agent/changelog.md b/content/nginx-one/agent/changelog.md
new file mode 100644
index 000000000..dc603dd71
--- /dev/null
+++ b/content/nginx-one/agent/changelog.md
@@ -0,0 +1,9 @@
+---
+title: Agent changelog
+toc: false
+url: /nginx-one/agent/changelog
+weight: 1200
+nd-docs: DOCS-1868
+---
+
+<!-- this dummy doc is used to create a list page entry that redirects users to the NGINX Agent repository changelog. The redirect is configured in azure-redirects-base -->
\ No newline at end of file
diff --git a/content/nginx-one/agent/community/_index.md b/content/nginx-one/agent/community/_index.md
new file mode 100644
index 000000000..aa967306e
--- /dev/null
+++ b/content/nginx-one/agent/community/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Community"
+weight: 600
+url: /nginx-one/agent/community/
+---
\ No newline at end of file
diff --git a/content/nginx-one/agent/community/community.md b/content/nginx-one/agent/community/community.md
new file mode 100644
index 000000000..5b4f29ded
--- /dev/null
+++ b/content/nginx-one/agent/community/community.md
@@ -0,0 +1,21 @@
+---
+title: Community and contribution
+toc: true
+weight: 600
+docs: DOCS-000
+nd-docs: DOCS-1869
+---
+
+Discover the various ways you can participate in the F5 NGINX Agent project:
+
+## Community
+
+- Have questions or ideas to discuss? Join the conversation about NGINX Agent in the [NGINX Community Forum](https://community.nginx.org/).
+
+## Contribute
+
+Get involved with the project by contributing! See our [contributing guide](https://github.com/nginx/agent/blob/main/CONTRIBUTING.md) for details.
+
+## License
+
+[Apache License, Version 2.0](https://github.com/nginx/agent/blob/main/LICENSE)
diff --git a/content/nginx-one/agent/configure-instance-reporting/_index.md b/content/nginx-one/agent/configure-instance-reporting/_index.md
new file mode 100644
index 000000000..daac817e1
--- /dev/null
+++ b/content/nginx-one/agent/configure-instance-reporting/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Configure instance reporting"
+weight: 400
+url: /nginx-one/agent/configure-instance-reporting/
+---
\ No newline at end of file
diff --git a/content/nginx-one/agent/configure-instance-reporting/configuration-overview.md b/content/nginx-one/agent/configure-instance-reporting/configuration-overview.md
new file mode 100644
index 000000000..5bfb8e7f9
--- /dev/null
+++ b/content/nginx-one/agent/configure-instance-reporting/configuration-overview.md
@@ -0,0 +1,87 @@
+---
+title: Configuration overview
+toc: true
+weight: 300
+docs: DOCS-1229
+nd-docs: DOCS-1879
+---
+
+This page describes how to configure F5 NGINX Agent using configuration files, CLI (Command line interface) flags, and environment variables.
+
+{{<note>}}
+
+- NGINX Agent interprets configuration values set by configuration files, CLI flags, and environment variables in the following priorities:
+
+  1. CLI flags overwrite configuration files and environment variable values.
+  2. Environment variables overwrite configuration file values.
+  3. Config files are the lowest priority and config settings are superseded if either of the other options is used.
+
+- You must open any required firewall ports or add SELinux/AppArmor rules for the ports and IPs you want to use.
+
+{{</note>}}
+
+## Configuration via Configuration Files 
+
+The NGINX Agent configuration file is created using a YAML structure and can be found in `/etc/nginx-agent/nginx-agent.conf`
+
+1. Edit the configuration file `sudo vim /etc/nginx-agent/nginx-agent.conf`
+2. Add the log property 
+```bash
+log:
+  level: debug 
+```
+3. Save and exit 
+4. `sudo systemctl restart nginx-agent`
+
+## Configuration via CLI Parameters
+
+From a command line terminal: 
+```bash
+sudo nginx-agent \
+      --log-level=debug
+```
+
+## Configuration via Environment Variables
+Environment variables are another way to set configuration values, especially in containerized deployments or CI/CD pipelines. 
+
+```bash
+sudo docker run \
+  --env=NGINX_AGENT_LOG_LEVEL=debug \
+  -d agent
+```
+<details>
+<summary>NGINX Agent configuration options</summary>
+
+{{< bootstrap-table "table table-striped table-bordered" >}}
+| **Environment Variable**                         | **Command-Line Option**                             | **Description**                                                                                              | **Default Value**                                      |
+|--------------------------------------------------|---------------------------------------------------|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------------|
+| NGINX_AGENT_LOG_LEVEL                          | --log-level                                      | The desired verbosity level for logging messages from nginx-agent. Available options: panic, fatal, error, info, and debug.       | info                                                |
+| NGINX_AGENT_LOG_PATH                           | --log-path                                       | The path to output log messages to. If the default path doesn't exist, logs are output to stdout/stderr.     | /var/log/nginx-agent/nginx-agent.log                |
+| NGINX_AGENT_DATA_PLANE_NGINX_RELOAD_MONITORING_PERIOD | --data-plane-config-nginx-reload-monitoring-period                                           | The amount of time used to monitor NGINX after a configuration reload (units in seconds).                     | N/A                                                    |
+| NGINX_AGENT_DATA_PLANE_NGINX_TREAT_WARNINGS_AS_ERRORS | --data-plane-config-nginx-treat-warnings-as-errors | Warning messages in the NGINX error logs are treated as errors after a configuration reload.                  | N/A                                                    |
+| NGINX_AGENT_DATA_PLANE_NGINX_EXCLUDE_LOGS      | --data-plane-config-nginx-exclude-logs          | Specify one or more log paths to exclude from metrics collection and error monitoring (Unix PATH format).      | N/A                                                    |
+| NGINX_AGENT_ALLOWED_DIRECTORIES               | --allowed-directories                           | A comma-separated list of paths granting read/write permissions for the agent.                                | N/A                                                    |
+| NGINX_AGENT_FEATURES                          | --features                                      | Comma-separated list of features enabled for the agent.                                                      | N/A                                                    |
+| NGINX_AGENT_LABELS                            | --labels                                        | A comma-separated list of key-value pairs defining agent labels (e.g., grouping).                            | N/A                                                    |
+| NGINX_AGENT_COMMAND_SERVER_HOST               | --command-server-host                           | Specifies target hostname for the command and control server.                                                | N/A                                                    |
+| NGINX_AGENT_COMMAND_SERVER_PORT               | --command-server-port                           | Specifies the port of the command and control server.                                                        | N/A                                                    |
+| NGINX_AGENT_COMMAND_AUTH_TOKEN                | --command-auth-token                            | Authentication token used to establish communication with the command server.                                | N/A                                                    |
+| NGINX_AGENT_COMMAND_AUTH_TOKENPATH            | --command-auth-tokenpath                        | File path for the authentication token used with the server.                                                 | N/A                                                    |
+| NGINX_AGENT_COMMAND_TLS_CERT                  | --command-tls-cert                              | Certificate file path required for TLS communication.                                                        | N/A                                                    |
+| NGINX_AGENT_COMMAND_TLS_KEY                   | --command-tls-key                               | Certificate key file path required for TLS communication.                                                    | N/A                                                    |
+| NGINX_AGENT_COMMAND_TLS_CA                    | --command-tls-ca                                | CA certificate file path for TLS communication.                                                              | N/A                                                    |
+| NGINX_AGENT_COMMAND_TLS_SKIP_VERIFY           | --command-tls-skip-verify                       | **For Testing Only:** Disables client-side verification of the server's certificate chain and hostname.       | N/A                                                    |
+| NGINX_AGENT_COMMAND_TLS_SERVER_NAME           | --command-tls-server-name                       | Specifies server name sent in the TLS handshake configuration.                                               | N/A                                                    |
+| NGINX_AGENT_INSTANCE_WATCHER_MONITORING_FREQUENCY | --instance-watcher-monitoring-frequency         | Frequency (in seconds) for instance monitoring.                                                              | N/A                                                    |
+| NGINX_AGENT_HEALTH_WATCHER_MONITORING_FREQUENCY   | --health-watcher-monitoring-frequency           | Frequency (in seconds) for monitoring NGINX health changes.                                                  | N/A                                                    |
+| NGINX_AGENT_FILE_WATCHER_MONITORING_FREQUENCY     | --file-watcher-monitoring-frequency             | Frequency (in seconds) for monitoring file changes.                                                          | N/A                                                    |
+| NGINX_AGENT_COLLECTOR_CONFIG_PATH             | --collector-config-path                         | Path to OpenTelemetry (OTel) Collector configuration file.                                                   | /etc/nginx-agent/opentelemetry-collector-agent.yaml  |
+| NGINX_AGENT_COLLECTOR_EXTENSIONS_HEALTH_PATH  | --collector-extensions-health-path              | Path configured for health check server communication with OTel Collector.                                   | /                                                    |
+| NGINX_AGENT_COLLECTOR_EXTENSIONS_SERVER_HOST  | --collector-extensions-health-server-host       | Hostname for publishing health check statuses of OTel Collector.                                             | localhost                                            |
+| NGINX_AGENT_COLLECTOR_EXTENSIONS_SERVER_PORT  | --collector-extensions-health-server-port       | Port for publishing health check statuses of OTel Collector.                                                 | 13133                                                |
+| NGINX_AGENT_COLLECTOR_EXTENSIONS_TLS_CA       | --collector-extensions-health-tls-ca            | CA certificate file path for TLS communication with OTel health server.                                      | N/A                                                    |
+| NGINX_AGENT_COLLECTOR_EXTENSIONS_TLS_CERT     | --collector-extensions-health-tls-cert          | TLS Certificate file path for communication with OTel health server.                                         | N/A                                                    |
+| NGINX_AGENT_COLLECTOR_EXTENSIONS_TLS_KEY      | --collector-extensions-health-tls-key           | File path for TLS key used when connecting with OTel health server.                                           | N/A                                                    |
+| NGINX_AGENT_COLLECTOR_PROCESSORS_BATCH_SEND_BATCH_TIMEOUT    | --collector-processors-batch-send-batch-timeout                                               | Maximum time duration for sending batch data metrics regardless of size.                                      | 200ms
+{{< /bootstrap-table >}}                             |%
+</details>
\ No newline at end of file
diff --git a/content/nginx-one/agent/configure-instance-reporting/configure-agent-group.md b/content/nginx-one/agent/configure-instance-reporting/configure-agent-group.md
new file mode 100644
index 000000000..cd1f2a8ef
--- /dev/null
+++ b/content/nginx-one/agent/configure-instance-reporting/configure-agent-group.md
@@ -0,0 +1,88 @@
+---
+title: Add users to nginx-agent group
+toc: true
+weight: 400
+docs: DOCS-000
+nd-docs: DOCS-1881
+---
+
+This page describes how the F5 NGINX Agent process interacts with the NGINX user on a system, and how to add users to the NGINX Agent group.
+
+## Overview
+
+During installation, NGINX Agent detects the NGINX user (typically `nginx`) for the master and worker processes and adds this user to a group called `nginx-agent`.
+
+If you change the NGINX username after installing the NGINX Agent, you'll need to add the new username to the `nginx-agent` group so that the NGINX socket has the proper permissions.
+
+A failure to update the `nginx-agent` group when the NGINX username changes may result in non-compliance errors for NGINX Plus.
+
+---
+
+## NGINX socket
+
+NGINX Agent creates a socket in the default location `/var/run/nginx-agent/nginx.sock`. You can customize this location by editing the `nginx-agent.conf` file and setting the path similar to the following example:
+
+```nginx configuration
+nginx:
+ ...
+ socket: "unix:/var/run/nginx-agent/nginx.sock"
+```
+
+The socket server starts when the NGINX socket configuration is enabled; the socket configuration is enabled by default.
+
+---
+
+## Add NGINX Users to nginx-agent group
+
+To manually add NGINX users to the `nginx-agent` group, take the following steps:
+
+1. Verify the `nginx-agent` group exists:
+
+    ```shell
+    sudo getent group | grep nginx-agent
+    ```
+
+    The output looks similar to the following example:
+
+    ```shell
+    nginx-agent:x:1001:root,nginx
+    ```
+
+    If the group doesn't exist, create it by running the following command:
+
+    ```shell
+    sudo groupadd nginx-agent
+    ```
+
+2. Verify the ownership of `/var/run/nginx-agent` directory:
+
+    ```shell
+    ls -l /var/run/nginx-agent
+    ```
+
+    The output looks similar to the following:
+
+    ```shell
+    total 0
+    srwxrwxr-x 1 root nginx-agent 0 Jun 13 10:51 nginx.sockvv
+    ```
+
+    If the group ownership is not `nginx-agent`, change the ownership by running the following command:
+
+    ```shell
+    sudo chown :nginx-agent /var/run/nginx-agent
+    ```
+
+3. To add NGINX user(s) to the `nginx-agent` group, run the following command:
+
+    ```shell
+    sudo usermod -a -G nginx-agent <username>
+    ```
+
+    For example to add the `nginx` user, take the following step:
+
+    ```shell
+    sudo usermod -a -G nginx-agent nginx
+    ```
+
+    Repeat for all NGINX users.
diff --git a/content/nginx-one/agent/configure-instance-reporting/configure-selinux.md b/content/nginx-one/agent/configure-instance-reporting/configure-selinux.md
new file mode 100644
index 000000000..03e98bb7b
--- /dev/null
+++ b/content/nginx-one/agent/configure-instance-reporting/configure-selinux.md
@@ -0,0 +1,44 @@
+---
+title: Configure SELinux
+weight: 600
+toc: true
+nd-docs: DOCS-1880
+---
+
+## Overview
+
+You can use the optional SELinux policy module included in the package to secure F5 NGINX Agent operations with flexible, mandatory access control that follows the principle of least privilege.
+
+{{< important >}}The SELinux policy module is optional. It is not loaded automatically during installation, even on SELinux-enabled systems. You must manually load the policy module using the steps below.{{< /important >}}
+
+## Before you begin
+
+Take these preparatory steps before configuring SELinux:
+
+1. Enable SELinux on your system.
+2. Install the tools `load_policy`, `semodule`, and `restorecon`.
+3. [Install NGINX Agent]({{< ref "/nginx-one/agent/install-upgrade/_index.md" >}}) with SELinux module files in place.
+
+{{< important >}}SELinux can use `permissive` mode, where policy violations are logged instead of enforced. Verify which mode your configuration uses.{{< /important >}}
+
+---
+
+## Enable SELinux for NGINX Agent {#selinux-agent}
+
+{{< include "/installation/enable-agent-selinux.md" >}}
+
+### Add ports to NGINX Agent SELinux context
+
+{{< include "/installation/add-ports-agent-selinux.md" >}}
+
+---
+
+## Recommended Resources
+
+- <https://man7.org/linux/man-pages/man8/selinux.8.html>
+- <https://www.redhat.com/en/topics/linux/what-is-selinux>
+- <https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux>
+- <https://wiki.centos.org/HowTos/SELinux>
+- <https://wiki.gentoo.org/wiki/SELinux>
+- <https://opensource.com/business/13/11/selinux-policy-guide>
+- <https://www.nginx.com/blog/using-nginx-plus-with-selinux/>
\ No newline at end of file
diff --git a/content/nginx-one/agent/containers/_index.md b/content/nginx-one/agent/containers/_index.md
new file mode 100644
index 000000000..d74d0a2c4
--- /dev/null
+++ b/content/nginx-one/agent/containers/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Containers"
+weight: 300
+url: /nginx-one/agent/containers/
+---
\ No newline at end of file
diff --git a/content/nginx-one/agent/containers/run-agent-container.md b/content/nginx-one/agent/containers/run-agent-container.md
new file mode 100644
index 000000000..6a79f2d03
--- /dev/null
+++ b/content/nginx-one/agent/containers/run-agent-container.md
@@ -0,0 +1,93 @@
+---
+title: Run the NGINX Agent in a container
+weight: 100
+toc: true
+nd-content-type: how-to
+product: Agent
+nd-docs: DOCS-1872
+---
+
+## Overview
+
+This guide serves as a step-by-step guide to run NGINX Agent in a container. It covers the basic setup needed to get the NGINX Agent up and running efficiently and securely.
+
+## Before you begin
+
+Before you begin this guide ensure:
+
+{{< note >}}
+This guide uses Docker but NGINX Agent also works with other container applications.
+{{< /note >}}
+
+- **Docker:** Ensure Docker is installed and configured on your system. [Download Docker from the official site](https://www.docker.com/products/docker-desktop/).
+- **Credentials:** Acquire any necessary authentication tokens or credentials required for the NGINX Agent.
+
+## Prepare the environment
+
+To run NGINX Agent in a container you will need to download the NGINX Agent
+container image and create a configuration file.
+
+### Pull the NGINX Agent container image
+
+The NGINX Agent container image must be downloaded from a trusted source such as Docker Hub or a private container registry.
+
+Run the following command to pull the official image:
+
+```bash
+<!-- Registry HERE -->
+docker pull <Registry HERE>:latest
+```
+
+Ensure you are using the correct image version. Replace `latest` with the desired version tag if necessary.
+
+
+### Create a configuration file
+
+Create a configuration file named `nginx-agent.conf` in your current directory
+and populate the file with the following structure:
+
+
+{{< include "/nginx-one/conf/nginx-agent-conf.md" >}}
+
+
+## Run the container
+
+Run the NGINX Agent container with the configuration file mounted.
+
+Use the following command:
+
+```bash
+docker run -d \
+  --name nginx-agent \
+  -v $(pwd)/nginx-agent.conf:/etc/nginx-agent/nginx-agent.conf \
+  nginx/agent:latest
+```
+
+Key options explained:
+
+- `-d`: Runs the container in detached mode.
+- `--name nginx-agent`: Assigns a name to the container for easy identification.
+- `-v $(pwd)/nginx-agent.conf:/etc/nginx-agent/nginx-agent.conf`: Mounts the configuration file into the container.
+
+
+### Verify the container is running
+
+Check the running status of the container:
+
+```bash
+docker ps
+```
+
+You should see an entry for `nginx-agent`. The `STATUS` field indicates that the container is running.
+
+### Monitor logs
+
+To ensure the container is functioning properly and communicating with NGINX One Console, monitor the container logs.
+
+Run the following command:
+
+```bash
+docker logs -f nginx-agent
+```
+
+Look for log entries indicating successful connection to the NGINX One Console and periodic metric transmission.
diff --git a/content/nginx-one/agent/install-upgrade/_index.md b/content/nginx-one/agent/install-upgrade/_index.md
new file mode 100644
index 000000000..0224aada9
--- /dev/null
+++ b/content/nginx-one/agent/install-upgrade/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Install and update"
+weight: 200
+url: /nginx-one/agent/install-upgrade/
+---
\ No newline at end of file
diff --git a/content/nginx-one/agent/install-upgrade/install-from-github.md b/content/nginx-one/agent/install-upgrade/install-from-github.md
new file mode 100644
index 000000000..30795537f
--- /dev/null
+++ b/content/nginx-one/agent/install-upgrade/install-from-github.md
@@ -0,0 +1,73 @@
+---
+title: Install from GitHub package files
+toc: true
+weight: 300
+docs: DOCS-000
+nd-docs: DOCS-1876
+---
+
+{{< note >}}
+If you are using [NGINX One Console]({{< ref "/nginx-one/getting-started.md" >}})
+to manage your NGINX instances, NGINX Agent is installed automatically when you
+add an NGINX instance to NGINX One Console.
+
+For a quick guide on how to connect your instance to NGINX One Console see: [Connect to NGINX One Console]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
+{{< /note >}}
+
+Follow the steps in this guide to install NGINX Agent in your NGINX instance using
+GitHub package files.
+
+## Before you begin
+
+{{< include "/agent/installation/prerequisites.md" >}}
+
+## GitHub package files
+
+To install NGINX Agent on your system using GitHub package files, go to the
+[GitHub releases page](https://github.com/nginx/agent/releases) and download the
+latest package supported by your operating system distribution and CPU architecture.
+
+Use your system's package manager to install the package. Some examples:
+
+- Debian, Ubuntu, and other distributions using the `dpkg` package manager.
+
+   ```shell
+   sudo dpkg -i nginx-agent-<agent-version>.deb
+   ```
+
+- RHEL, CentOS RHEL, Amazon Linux, Oracle Linux, and other distributions using
+   the `yum` package manager
+
+  ```shell
+  sudo yum localinstall nginx-agent-<agent-version>.rpm
+  ```
+
+- RHEL and other distributions using the `rpm` package manager
+
+  ```shell
+  sudo rpm -i nginx-agent-<agent-version>.rpm
+  ```
+
+- Alpine Linux
+
+  ```shell
+  sudo apk add nginx-agent-<agent-version>.apk
+  ```
+
+- FreeBSD
+
+  ```shell
+  sudo pkg add nginx-agent-<agent-version>.pkg
+  ```
+
+### Manually connect NGINX Agent to NGINX One Console
+
+{{< include "agent/installation/manually-connect-to-console" >}}
+
+## Start, stop, and enable NGINX Agent
+
+{{< include "/agent/installation/start-stop-agent.md" >}}
+
+## Verify that NGINX Agent is running
+
+{{< include "/agent/installation/verify-agent.md" >}}
\ No newline at end of file
diff --git a/content/nginx-one/agent/install-upgrade/install-from-oss-repo.md b/content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
new file mode 100644
index 000000000..f362ec8d5
--- /dev/null
+++ b/content/nginx-one/agent/install-upgrade/install-from-oss-repo.md
@@ -0,0 +1,104 @@
+---
+title: Install from Open Source repo
+toc: true
+weight: 100
+docs: DOCS-000
+nd-docs: DOCS-1873
+---
+
+{{< note>}}
+If you are using [NGINX One Console]({{< ref "/nginx-one/getting-started.md" >}})
+to manage your NGINX instances, NGINX Agent is installed automatically when you
+add an NGINX instance to NGINX One Console.
+
+For a quick guide on how to connect your instance to NGINX One Console see: [Connect to NGINX One Console]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
+{{< /note >}}
+
+## Overview
+
+Follow the steps in this guide to install NGINX Agent in your NGINX instance using
+the NGINX Open Source repository.
+
+## Before you begin
+
+{{< include "/agent/installation/prerequisites.md" >}}
+
+## Manual installation using the NGINX Open Source repository
+
+Before you install NGINX Agent for the first time on your system, you need to set
+up the `nginx-agent` packages repository. Afterward, you can install and update
+NGINX Agent from the repository.
+
+<details>
+<summary>{{< fa "brands fa-centos" >}} Install NGINX Agent on RHEL, CentOS, Rocky Linux, AlmaLinux, and Oracle Linux</summary>
+
+### Install NGINX Agent on RHEL, CentOS, Rocky Linux, AlmaLinux, and Oracle Linux
+
+{{< include "/agent/installation/oss/oss-rhel.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-ubuntu" >}} Install NGINX Agent on Ubuntu</summary>
+
+### Install NGINX Agent on Ubuntu
+
+{{< include "/agent/installation/oss/oss-ubuntu.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-debian" >}} Install NGINX Agent on Debian</summary>
+
+### Install NGINX Agent on Debian
+
+{{< include "/agent/installation/oss/oss-debian.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-suse" >}} Install NGINX Agent on SLES</summary>
+
+### Install NGINX Agent on SLES
+
+{{< include "/agent/installation/oss/oss-sles.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "solid fa-mountain-sun" >}} Install NGINX Agent on Alpine Linux</summary>
+
+### Install NGINX Agent on Alpine Linux
+
+{{< include "/agent/installation/oss/oss-alpine.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-aws" >}} Install NGINX Agent on Amazon Linux</summary>
+
+### Install NGINX Agent on Amazon Linux
+
+{{< include "/agent/installation/oss/oss-amazon-linux.md" >}}
+
+</details>
+<details>
+<summary>{{< fa "brands fa-freebsd" >}} Install NGINX Agent on FreeBSD</summary>
+
+### Install NGINX Agent on FreeBSD
+
+{{< include "/agent/installation/oss/oss-freebsd.md" >}}
+
+</details>
+
+### Manually connect NGINX Agent to NGINX One Console
+
+{{< include "agent/installation/manually-connect-to-console" >}}
+
+## Start, stop, and enable NGINX Agent
+
+{{< include "/agent/installation/start-stop-agent.md" >}}
+
+## Verify that NGINX Agent is running
+
+{{< include "/agent/installation/verify-agent.md" >}}
diff --git a/content/nginx-one/agent/install-upgrade/install-from-plus-repo.md b/content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
new file mode 100644
index 000000000..eb20efab1
--- /dev/null
+++ b/content/nginx-one/agent/install-upgrade/install-from-plus-repo.md
@@ -0,0 +1,105 @@
+---
+title: Install from NGINX Plus repo
+toc: true
+weight: 200
+docs: DOCS-000
+nd-docs: DOCS-1877
+---
+
+{{< note>}}
+If you are using [NGINX One Console]({{< ref "/nginx-one/getting-started.md" >}})
+to manage your NGINX instances, NGINX Agent is installed automatically when you
+add an NGINX instance to NGINX One Console.
+
+For a quick guide on how to connect your instance to NGINX One Console see: [Connect to NGINX One Console]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
+{{< /note >}}
+
+## Overview
+
+Follow the steps in this guide to install NGINX Agent in your NGINX instance using
+the NGINX Plus repository.
+
+## Before you begin
+
+{{< include "/agent/installation/prerequisites.md" >}}
+
+## Manual installation using the NGINX Plus repository
+
+Before you install NGINX Agent for the first time on your system, you need to
+set up the `nginx-agent` packages repository. Afterward, you can install and update
+NGINX Agent from the repository.
+
+
+<details>
+<summary>{{< fa "brands fa-centos" >}} Install NGINX Agent on RHEL, CentOS, Rocky Linux, AlmaLinux, and Oracle Linux</summary>
+
+### Install NGINX Agent on RHEL, CentOS, Rocky Linux, AlmaLinux, and Oracle Linux<a name="install-nginx-agent-on-rhel-centos-rocky-linux-almalinux-and-oracle-linux-plus"></a>
+
+{{< include "/agent/installation/plus/plus-rhel.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-ubuntu" >}} Install NGINX Agent on Ubuntu</summary>
+
+### Install NGINX Agent on Ubuntu<a name="install-nginx-agent-on-ubuntu-plus"></a>
+
+{{< include "/agent/installation/plus/plus-ubuntu.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-debian" >}} Install NGINX Agent on Debian</summary>
+
+### Install NGINX Agent on Debian<a name="install-nginx-agent-on-debian-plus"></a>
+
+{{< include "/agent/installation/plus/plus-debian.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-suse" >}} Install NGINX Agent on SLES</summary>
+
+### Install NGINX Agent on SLES<a name="install-nginx-agent-on-sles-plus"></a>
+
+{{< include "/agent/installation/plus/plus-sles.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "solid fa-mountain-sun" >}} Install NGINX Agent on Alpine Linux</summary>
+
+### Install NGINX Agent on Alpine Linux<a name="install-nginx-agent-on-alpine-linux-plus"></a>
+
+{{< include "/agent/installation/plus/plus-alpine.md" >}}
+
+</details>
+<details>
+<summary>{{< fa "brands fa-aws" >}} Install NGINX Agent on Amazon Linux</summary>
+
+### Install NGINX Agent on Amazon Linux<a name="install-nginx-agent-on-amazon-linux-plus"></a>
+
+{{< include "/agent/installation/plus/plus-amazon-linux.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-freebsd" >}} Install NGINX Agent on FreeBSD</summary>
+
+### Install NGINX Agent on FreeBSD<a name="install-nginx-agent-on-freebsd-plus"></a>
+
+{{< include "/agent/installation/plus/plus-freebsd.md" >}}
+
+</details>
+
+### Manually connect NGINX Agent to NGINX One Console
+
+{{< include "agent/installation/manually-connect-to-console" >}}
+
+## Start, stop, and enable NGINX Agent
+
+{{< include "/agent/installation/start-stop-agent.md" >}}
+
+## Verify that NGINX Agent is running
+
+{{< include "/agent/installation/verify-agent.md" >}}
diff --git a/content/nginx-one/agent/install-upgrade/uninstall.md b/content/nginx-one/agent/install-upgrade/uninstall.md
new file mode 100644
index 000000000..3a7c95aef
--- /dev/null
+++ b/content/nginx-one/agent/install-upgrade/uninstall.md
@@ -0,0 +1,82 @@
+---
+title: Uninstall NGINX Agent
+toc: true
+weight: 500
+docs: DOCS-000
+nd-docs: DOCS-1874
+---
+
+## Overview
+
+Follow the steps in this guide to remove F5 NGINX Agent from your NGINX instances.
+
+## Before you begin
+
+The user following performing the uninstall steps needs to have `root` privilege.
+
+## Uninstall NGINX Agent
+
+Complete the following steps on each host where you've installed NGINX Agent
+
+<details>
+<summary>{{< fa "brands fa-centos" >}} Uninstall NGINX Agent on RHEL, CentOS, Rocky Linux, AlmaLinux, and Oracle Linux</summary>
+
+### Uninstall NGINX Agent on RHEL, CentOS, Rocky Linux, AlmaLinux, and Oracle Linux
+
+{{< include "/agent/installation/uninstall/uninstall-rhel.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-ubuntu" >}} Uninstall NGINX Agent on Ubuntu</summary>
+
+### Uninstall NGINX Agent on Ubuntu
+
+{{< include "/agent/installation/uninstall/uninstall-ubuntu.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-debian" >}} Uninstall NGINX Agent on Debian</summary>
+
+### Uninstall NGINX Agent on Debian
+
+{{< include "/agent/installation/uninstall/uninstall-debian.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-suse" >}} Uninstall NGINX Agent on SLES</summary>
+
+### Uninstall NGINX Agent on SLES
+
+{{< include "/agent/installation/uninstall/uninstall-sles.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "solid fa-mountain-sun" >}} Uninstall NGINX Agent on Alpine Linux</summary>
+
+### Uninstall NGINX Agent on Alpine Linux
+
+{{< include "/agent/installation/uninstall/uninstall-alpine.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-aws" >}} Uninstall NGINX Agent on Amazon Linux</summary>
+
+### Uninstall NGINX Agent on Amazon Linux
+
+{{< include "/agent/installation/uninstall/uninstall-amazon-linux.md" >}}
+
+</details>
+
+<details>
+<summary>{{< fa "brands fa-freebsd" >}} Uninstall NGINX Agent on FreeBSD</summary>
+
+### Uninstall NGINX Agent on FreeBSD
+
+{{< include "/agent/installation/uninstall/uninstall-freebsd.md" >}}
+
+</details>
diff --git a/content/nginx-one/agent/install-upgrade/update.md b/content/nginx-one/agent/install-upgrade/update.md
new file mode 100644
index 000000000..a6f5cfd10
--- /dev/null
+++ b/content/nginx-one/agent/install-upgrade/update.md
@@ -0,0 +1,15 @@
+---
+title: Update NGINX Agent
+toc: true
+weight: 400
+docs: DOCS-000
+nd-docs: DOCS-1875
+---
+
+## Overview
+
+{{< include "/agent/installation/update.md" >}}
+
+## Migrate NGINX Agent running in containers
+
+{{< include "/agent/installation/update-container.md" >}}
diff --git a/content/nginx-one/agent/metrics/_index.md b/content/nginx-one/agent/metrics/_index.md
new file mode 100644
index 000000000..e089288c1
--- /dev/null
+++ b/content/nginx-one/agent/metrics/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Metrics"
+weight: 500
+url: /nginx-one/agent/metrics/
+---
\ No newline at end of file
diff --git a/content/nginx-one/agent/metrics/configure-otel-metrics.md b/content/nginx-one/agent/metrics/configure-otel-metrics.md
new file mode 100644
index 000000000..78824f3bc
--- /dev/null
+++ b/content/nginx-one/agent/metrics/configure-otel-metrics.md
@@ -0,0 +1,41 @@
+---
+title: Export NGINX instance metrics
+weight: 450
+toc: true
+nd-docs: DOCS-1882
+---
+
+## Overview
+
+F5 NGINX Agent now includes an embedded [OpenTelemetry](https://opentelemetry.io/) collector, streamlining observability and metric collection for NGINX instances. With this feature, you can collect:
+
+* Metrics from NGINX Plus and NGINX Open Source
+* Host metrics (CPU, memory, disk, and network activity) from VMs or Containers
+
+{{< note >}}
+The OpenTelemetry exporter is enabled by default. Once a valid connection to the management plane is established, the Agent will automatically begin exporting metrics.
+{{< /note >}}
+
+### Key benefits
+
+* Seamless Integration: No need to deploy an external OpenTelemetry Collector. All components are embedded within the Agent for streamlined observability.
+* Standardized Protocol: Support for OpenTelemetry standards ensures interoperability with a wide range of observability backends, including Jaeger, Prometheus, Splunk, and more.
+
+### Verify that metrics are exported
+
+You can validate that metrics are successfully exported by using the methods below:
+
+- **NGINX One dashboard**
+
+   - When an instance has connected to NGINX One Console [See: Connect to NGINX One Console]({{< ref "/nginx-one/connect-instances/add-instance.md" >}}), you should see metrics showing on the NGINX One Dashboard.
+
+- **Agent logs**
+
+   Check the OpenTelemetry Collector logs for confirmation of successful metric processing:
+
+   1. Open the file: `/var/log/nginx-agent/opentelemetry-collector-agent.log`
+   2. Look for the following logs:
+
+      ```text
+      Everything is ready. Begin running and processing data.
+      ```
diff --git a/content/nginx-one/agent/overview/_index.md b/content/nginx-one/agent/overview/_index.md
new file mode 100644
index 000000000..25d1de757
--- /dev/null
+++ b/content/nginx-one/agent/overview/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Overview"
+weight: 100
+url: /nginx-one/agent/install-upgrade/
+---
\ No newline at end of file
diff --git a/content/nginx-one/agent/overview/about.md b/content/nginx-one/agent/overview/about.md
new file mode 100644
index 000000000..14bed57b4
--- /dev/null
+++ b/content/nginx-one/agent/overview/about.md
@@ -0,0 +1,54 @@
+---
+title: About
+weight: 100
+toc: true
+nd-docs: DOCS-1870
+---
+
+{{< include "agent/v3-available.md" >}}
+
+{{< include "agent/about.md" >}}
+
+## Architecture
+
+```mermaid
+graph BT
+
+    %% Define colors for the subgraphs
+    style ManagementPlane fill:#d0eac4,stroke:#228B22,stroke-width:2px,color:#000000
+    style CommandControl fill:#cfe2f1,stroke:#1E90FF,stroke-width:2px,color:#000000
+    style OTelManagementPlane fill:#cfe2f1,stroke:#1E90FF,stroke-width:2px,color:#000000
+    style Compute fill:#cfe2f1,stroke:#1E90FF,stroke-width:2px,color:#000000
+    style NGINX fill:#b5e0b6,stroke:#008000,stroke-width:2px,color:#000000
+    style NGINXConfig fill:#b5e0b6,stroke:#008000,stroke-width:2px,color:#000000
+    style ErrorLogs fill:#b5e0b6,stroke:#008000,stroke-width:2px,color:#000000
+    style Agent fill:#b5e0b6,stroke:#008000,stroke-width:2px,color:#000000
+
+    subgraph ManagementPlane["NGINX One"]
+        CommandControl["Command Server"]
+        OTelManagementPlane["OTel Receiver"]
+    end
+
+    subgraph Compute["NGINX Instance"]
+        subgraph Agent["Agent Process"]
+            OTelDataPlane["OTel Collector"]
+        end
+
+        subgraph NGINX["NGINX Process"]
+            NGINXMetrics["Metrics"]
+        end
+        NGINXConfig["NGINX Configuration Files"]
+        ErrorLogs["NGINX Error Logs"]
+
+        Metrics["Host Metrics"] --> |Collects| OTelDataPlane
+        NGINXMetrics --> |Reads| OTelDataPlane["OTel Collector"]
+        Agent --> |Watch/Reload| NGINX
+        Agent --> |Reads| ErrorLogs
+        OTelDataPlane --> |Reads| AccessLogs["NGINX Access Logs"]
+        Agent <--> |Reads/Writes| NGINXConfig
+    end
+
+    Compute <--> |gRPC| ManagementPlane
+```
+
+{{< include "agent/architecture.md" >}}
diff --git a/content/nginx-one/agent/overview/tech-specs.md b/content/nginx-one/agent/overview/tech-specs.md
new file mode 100644
index 000000000..025723595
--- /dev/null
+++ b/content/nginx-one/agent/overview/tech-specs.md
@@ -0,0 +1,9 @@
+---
+title: Technical Specifications
+toc: false
+weight: 200
+docs: DOCS-000
+nd-docs: DOCS-1871
+---
+
+{{< include "/agent/tech-specs.md" >}}
diff --git a/content/nginx-one/agent/support/_index.md b/content/nginx-one/agent/support/_index.md
new file mode 100644
index 000000000..253093e5e
--- /dev/null
+++ b/content/nginx-one/agent/support/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Support"
+weight: 700
+url: /nginx-one/agent/support/
+---
\ No newline at end of file
diff --git a/content/nginx-one/agent/support/troubleshooting.md b/content/nginx-one/agent/support/troubleshooting.md
new file mode 100644
index 000000000..180099616
--- /dev/null
+++ b/content/nginx-one/agent/support/troubleshooting.md
@@ -0,0 +1,31 @@
+---
+title: Troubleshooting
+toc: true
+weight: 700
+docs: DOCS-000
+nd-docs: DOCS-1878
+---
+
+## F5 NGINX Agent Troubleshooting 
+
+**1. Container running but Agent is not connected to NGINX One Console?**
+- Check Agent logs ```bash
+        docker logs <container-id-or-name>
+        ```
+- If you are using NGINX Plus, a valid license will need to be passed into the container run command. 
+- Ensure that the values sent with the container run command are correct.
+
+**2. Container running but instance is showing offline on NGINX One Console?**
+- Check Agent logs ```bash
+        docker logs  c5e1e3234900 | grep "nginx"
+        ```
+- Verify the following log message is shown: ```2025/02/17 19:02:58 [notice] 32#32: nginx/1.27.2 (nginx-plus-r33-p2 ```
+- If not found, it could mean the container image is missing the NGINX service
+- Make sure NGINX is running ```ps -ef | grep "nginx"```
+- Make sure NGINX is part of the image file.
+
+
+**3. NGINX Agent is installed on my Virtual Machine, but not showing up on NGINX One Console?**
+- Verify the agent is running ```sudo systemctl status nginx-agent```
+- Check for any errors in the logs ```sudo tail -f /var/log/nginx-agent/agent.log```
+- Check ```/etc/nginx-agent/nginx-agent.conf``` for any misconfigurations.
diff --git a/content/nginx-one/connect-instances/add-instance.md b/content/nginx-one/connect-instances/add-instance.md
index 328d93724..6bc8b768f 100644
--- a/content/nginx-one/connect-instances/add-instance.md
+++ b/content/nginx-one/connect-instances/add-instance.md
@@ -54,4 +54,4 @@ Once you've completed the process, NGINX One reassigns this as a managed certifi
 ## Add an instance to a Config Sync Group
 
 When you [Manage Config Sync Group membership]({{< ref "nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups#manage-config-sync-group-membership" >}}), you can add an existing or new instance to the group of your choice.
-That instance inherits the setup of that Config Sync Group.
+That instance inherits the setup of that Config Sync Group.
\ No newline at end of file
diff --git a/content/nginx-one/getting-started.md b/content/nginx-one/getting-started.md
index 72e9756b5..113fb1725 100644
--- a/content/nginx-one/getting-started.md
+++ b/content/nginx-one/getting-started.md
@@ -95,18 +95,7 @@ To install NGINX Agent on an NGINX instance:
 
 The `install` script writes an `nginx-agent.conf` file to the `/etc/nginx-agent/` directory, with the [data plane key](#generate-data-plane-key) that you generated. You can find this information in the `nginx-agent.conf` file:
 
-```yaml
-server:
-  token: "<YOUR_DATA_PLANE_KEY>"
-  host: agent.connect.nginx.com
-  grpcPort: 443
-
-tls:
-  enable: True
-  skip_verify: False
-```
-
-If you followed the [Installation and upgrade](https://docs.nginx.com/nginx-agent/installation-upgrade/) guides for installing NGINX Agent, you may need to add this information manually to `nginx-agent.conf`.
+{{< include "/nginx-one/conf/nginx-agent-conf.md" >}}
 
 <span style="display: inline-block; margin-top: 20px;" >
 
diff --git a/content/nginx-one/glossary.md b/content/nginx-one/glossary.md
index 4c07b2185..69c264c63 100644
--- a/content/nginx-one/glossary.md
+++ b/content/nginx-one/glossary.md
@@ -15,9 +15,11 @@ This glossary defines terms used in the F5 NGINX One Console and F5 Distributed
 | Term        | Definition |
 |-------------|-------------|
 | **Config Sync Group** | A group of NGINX systems (or instances) with identical configurations. They may also share the same certificates. However, the instances in a Config Sync Group could belong to different systems and even different clusters. For more information, see this explanation of [Important considerations]({{< ref "/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md#important-considerations" >}}) |
+| **Control Plane** | The control plane is the part of a network architecture that manages and controls the flow or data or traffic (the Data Plane). It is responsible for system-level tasks such as routing and traffic management. |
 | **Data Plane** | The data plane is the part of a network architecture that carries user traffic. It handles tasks like forwarding data packets between devices and managing network communication. In the context of NGINX, the data plane is responsible for tasks such as load balancing, caching, and serving web content. |
 | **Instance** | An instance is an individual system with NGINX installed. You can group the instances of your choice in a Config Sync Group. When you add an instance to NGINX One, you need to use a data plane key. |
 | **Namespace** | In F5 Distributed Cloud, a namespace groups a tenant’s configuration objects, similar to administrative domains. Every object in a namespace must have a unique name, and each namespace must be unique to its tenant. This setup ensures isolation, preventing cross-referencing of objects between namespaces. You'll see the namespace in the NGINX One Console URL as `/namespaces/<namespace name>/` |
+| **NGINX Agent**                      | A lightweight software component installed on NGINX instances to enable communication with the NGINX One console.                                      |
 | **Staged Configurations** | Also known as **Staged Configs**. Allows you to save "work in progress." You can create it from scratch, an Instance, another Staged Config, or a Config Sync Group. It does _not_ have to be a working configuration until you publish it to an instance or a Config Sync Group. You can even manage your **Staged Configurations** through our [API]({{< ref "/nginx-one/api/api-reference-guide/#tag/StagedConfigs" >}}). |
 | **Tenant** | A tenant in F5 Distributed Cloud is an entity that owns a specific set of configuration and infrastructure. It is fundamental for isolation, meaning a tenant cannot access objects or infrastructure of other tenants. Tenants can be either individual or enterprise, with the latter allowing multiple users with role-based access control (RBAC). |
 {{</bootstrap-table>}}
diff --git a/content/nginx-one/nginx-configs/add-file.md b/content/nginx-one/nginx-configs/add-file.md
index 4a25f64ee..72b1d7d45 100644
--- a/content/nginx-one/nginx-configs/add-file.md
+++ b/content/nginx-one/nginx-configs/add-file.md
@@ -15,8 +15,8 @@ type:
 
 Before you add files in your configuration, ensure:
 
-- You have access to the NGINX One Console.
-- NGINX instances are properly registered with NGINX One Console
+- You have [access to the NGINX One Console]({{< ref "/nginx-one/rbac/roles.md" >}}).
+- NGINX instances are [properly registered]({{< ref "/nginx-one/getting-started.md#add-your-nginx-instances-to-nginx-one" >}}) with NGINX One Console.
 
 ## Important considerations
 
diff --git a/content/nginx-one/nginx-configs/certificates/manage-certificates.md b/content/nginx-one/nginx-configs/certificates/manage-certificates.md
index 5fff39b2f..c842e9677 100644
--- a/content/nginx-one/nginx-configs/certificates/manage-certificates.md
+++ b/content/nginx-one/nginx-configs/certificates/manage-certificates.md
@@ -195,4 +195,4 @@ To convert these cerificates to managed, start with the Certificates menu, and s
 
 - [Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
 - [Add an instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
-- [Add a file in a configuration]({{< ref "/nginx-one/nginx-configs/add-file.md" >}})
+- [Add a file in a configuration]({{< ref "/nginx-one/nginx-configs/add-file.md" >}})
\ No newline at end of file
diff --git a/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md b/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md
index aec1d3b1c..94166a18d 100644
--- a/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md
+++ b/content/nginx-one/nginx-configs/clean-up-unavailable-instances.md
@@ -16,7 +16,7 @@ This guide explains how to set up automatic cleanup for NGINX instances in NGINX
 
 Before you set up automatic cleanup for NGINX instances, ensure:
 
-- You have administrator access to NGINX One.
+- You have [administrator access]({{< ref "/nginx-one/rbac/roles.md" >}}) to NGINX One Console.
 - You understand that this action will delete instances permanently after they are unavailable for the specified duration.
 
 ## Configure instance cleanup
diff --git a/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md b/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md
index 1b1f279b8..823c4d7f2 100644
--- a/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md
+++ b/content/nginx-one/nginx-configs/config-sync-groups/add-file-csg.md
@@ -64,4 +64,4 @@ With this option, you can incorporate [Managed certificates]({{< ref "/nginx-one
 
 - [Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
 - [Add an NGINX instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
-- [Manage certificates]({{< ref "/nginx-one/nginx-configs/certificates/manage-certificates.md" >}})
+- [Manage certificates]({{< ref "/nginx-one/nginx-configs/certificates/manage-certificates.md" >}})
\ No newline at end of file
diff --git a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
index 418612d7d..220b7c289 100644
--- a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
+++ b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
@@ -258,4 +258,4 @@ Monitor the **Config Sync Status** column. It can help you ensure that your conf
 ## See also
 
 - [Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
-- [Add an NGINX instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
+- [Add an NGINX instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
\ No newline at end of file
diff --git a/content/nginx-one/staged-configs/add-staged-config.md b/content/nginx-one/staged-configs/add-staged-config.md
index 042779b8b..196d6c34a 100644
--- a/content/nginx-one/staged-configs/add-staged-config.md
+++ b/content/nginx-one/staged-configs/add-staged-config.md
@@ -14,7 +14,7 @@ product: NGINX-One
 
 ## Overview
 
-This guide explains how to add a Staged Configuration to your NGINX One Console. 
+This guide explains how to add a Staged Configuration to your NGINX One Console.
 
 {{< include "nginx-one/staged-config-overview.md" >}}
 
@@ -47,7 +47,7 @@ To start a new Staged Configuration:
 
    You will see a new Staged Configuration with the default NGINX configuration file, `/etc/nginx/nginx.conf`, in edit mode.
 1. Type or paste content for `/etc/nginx/nginx.conf`.
-1. Select **Add File** to add the configuration, certificate, or other file(s) of your choice. 
+1. Select **Add File** to add the configuration, certificate, or other file(s) of your choice.
 1. When you're done, select **Save**.
 
 ### Start from an existing Instance
@@ -58,7 +58,7 @@ To start from an existing Instance:
 1. Enter a name for your new Staged Configuration.
 1. Select **Instance**.
 1. In the Choose Instance menu that appears, select an existing Instance.
-1. Select **Next**. 
+1. Select **Next**.
 
 NGINX One Console imports the configuration from the existing Instance. You can now edit the configuration. When you're ready to stop and save your work, select Save.
 
@@ -70,7 +70,7 @@ To start from an existing Config Sync Group:
 1. Select **Config Sync Group**.
 1. In the Choose Config Sync Group menu that appears, select an existing Config Sync Group.
 1. Enter a name for your new Staged Configuration.
-1. Select **Next**. 
+1. Select **Next**.
 
 NGINX One Console imports the configuration from the existing Config Sync Group. You can now edit the configuration. When you're ready to stop and save your work, select Save.
 
@@ -82,7 +82,7 @@ To start from an existing Staged Config:
 1. Select **Staged Configuration**.
 1. In the Choose Staged Configuration menu that appears, select an existing Staged Configuration.
 1. Enter a name for your new Staged Configuration.
-1. Select **Next**. 
+1. Select **Next**.
 
 NGINX One Console imports the configuration from the existing Staged Configuration. You can now edit the configuration. When you're ready to stop and save your work, select Save.
 
diff --git a/content/nginx/technical-specs.md b/content/nginx/technical-specs.md
index 01d774c67..852bbad50 100644
--- a/content/nginx/technical-specs.md
+++ b/content/nginx/technical-specs.md
@@ -14,21 +14,7 @@ NGINX Plus is available only as a binary; it is not distributed as source code.
 
 ## Supported Distributions {#supported-distributions}
 
-{{<bootstrap-table "table table-striped table-bordered">}}
-| Distribution                        | Supported on R34                                   | Supported on R33                                       |
-|-------------------------------------|----------------------------------------------------|--------------------------------------------------------|
-| AlmaLinux                           | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)       | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)           |
-| Alpine Linux                        | 3.18 (x86_64, aarch64) **(deprecated)** <br> 3.19 (x86_64, aarch64) <br> 3.20 (x86_64, aarch64) <br> 3.21 (x86_64, aarch64) **(new)** | 3.17 (x86_64, aarch64) **(deprecated)** <br> 3.18 (x86_64, aarch64) <br> 3.19 (x86_64, aarch64) <br> 3.20 (x86_64, aarch64) **(new)** |
-| Amazon Linux                        | 2023 (x86_64, aarch64)                             | 2023 (x86_64, aarch64)                                 |
-| Amazon Linux 2                      | LTS (x86_64, aarch64)                              | LTS (x86_64, aarch64)                                  |
-| Debian                              | 11 (x86_64, aarch64) <br> 12 (x86_64, aarch64)     | 11 (x86_64, aarch64) <br> 12 (x86_64, aarch64)         |
-| FreeBSD                             | 13 (amd64) <br> 14 (amd64)                         | 13 (amd64) <br> 14 (amd64)                             |
-| Oracle Linux                        | 8.1+ (x86_64, aarch64) <br> 9 (x86_64)             | 8.1+ (x86_64, aarch64) <br> 9 (x86_64)                 |
-| Red Hat Enterprise Linux (RHEL)     | 8.1+ (x86_64, aarch64) <br> 9.0+ (x86_64, aarch64) | 8.1+ (x86_64, aarch64) <br> 9.0+ (x86_64, aarch64)     |
-| Rocky Linux                         | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)       | 8 (x86_64, aarch64) <br> 9 (x86_64, aarch64)           |
-| SUSE Linux Enterprise Server (SLES) | 15 SP2+ (x86_64)                                   | 12 SP5 (x86_64) **(deprecated)** <br> 15 SP2+ (x86_64) |
-| Ubuntu                              | 20.04 LTS (x86_64, aarch64) **(deprecated)** <br> 22.04 LTS (x86_64, aarch64) <br> 24.04 LTS (x86_64, aarch64) | 20.04 LTS (x86_64, aarch64) <br> 22.04 LTS (x86_64, aarch64) <br> 24.04 LTS (x86_64, aarch64) |
-{{</bootstrap-table>}}
+{{< include "nginx-plus/supported-distributions.md" >}}
 
 ---
 
diff --git a/content/nim/system-configuration/configure-selinux.md b/content/nim/system-configuration/configure-selinux.md
index 533059eab..6d6f6ae75 100644
--- a/content/nim/system-configuration/configure-selinux.md
+++ b/content/nim/system-configuration/configure-selinux.md
@@ -118,27 +118,11 @@ sudo semanage port -d -t nms_t 11000
 
 ## Enable SELinux for NGINX Agent {#selinux-agent}
 
-The following SELinux files are added when you install the NGINX Agent package:
-
-- `/usr/share/selinux/packages/nginx_agent.pp` - loadable binary policy module
-- `/usr/share/selinux/devel/include/contrib/nginx_agent.if` - interface definitions file
-- `/usr/share/man/man8/nginx_agent_selinux.8.gz` - policy man page
-
-To load the NGINX Agent policy, run:
-
-{{< include "installation/agent-selinux.md" >}}
+{{< include "/installation/enable-agent-selinux.md" >}}
 
 ### Add ports to NGINX Agent SELinux context
 
-Make sure to add external ports to the firewall exception list.
-
-To allow external ports outside the HTTPD context, run:
-
-```bash
-sudo setsebool -P httpd_can_network_connect 1
-```
-
-{{<see-also>}}For more information, see [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/).{{</see-also>}}
+{{< include "/installation/add-ports-agent-selinux.md" >}}
 
 ---
 
diff --git a/content/nms/nginx-agent/install-nginx-agent.md b/content/nms/nginx-agent/install-nginx-agent.md
index 3157569ef..1f2bb13cf 100644
--- a/content/nms/nginx-agent/install-nginx-agent.md
+++ b/content/nms/nginx-agent/install-nginx-agent.md
@@ -400,31 +400,11 @@ Additionally, you can use the agent installation script to add these fields:
 
 ## SELinux for NGINX Agent
 
-This section explains how to install and configure the SELinux policy for NGINX Agent.
+{{< include "/installation/enable-agent-selinux.md" >}}
 
-### Installing NGINX Agent SELinux Policy Module
+### Add ports to NGINX Agent SELinux context
 
-The NGINX Agent package includes the following SELinux files:
-
-- `/usr/share/man/man8/nginx_agent_selinux.8.gz`
-- `/usr/share/selinux/devel/include/contrib/nginx_agent.if`
-- `/usr/share/selinux/packages/nginx_agent.pp`
-
-To load the NGINX Agent policy, run the following commands:
-
-{{< include "installation/agent-selinux.md" >}}
-
-### Adding Ports for NGINX Agent SELinux Context
-
-You can configure NGINX Agent to work with SELinux. Make sure you add external ports to the firewall exception list.
-
-The following example shows how to allow external ports outside the HTTPD context. You may need to enable NGINX to connect to these ports.
-
-```bash
-sudo setsebool -P httpd_can_network_connect 1
-```
-
-For additional information on using NGINX with SELinux, refer to the guide [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/).
+{{< include "/installation/add-ports-agent-selinux.md" >}}
 
 ---
 
diff --git a/layouts/shortcodes/v2-metrics.html b/layouts/shortcodes/v2-metrics.html
new file mode 100644
index 000000000..dc14d9a35
--- /dev/null
+++ b/layouts/shortcodes/v2-metrics.html
@@ -0,0 +1,56 @@
+<main class="content col-xl-6 d-block align-top" role="main">
+    {{ range .Site.Data.v2metrics }}
+    <a name="{{.name}}"></a>
+    <h2 id={{.name}}>{{.name}}
+        <a class="headerlink float-right" href="#{{.name}}" title="{{.name}}"><i class="fas fa-link fa-xs"
+            aria-hidden="true"></i></a>
+      </h2>
+      <table>
+        <tbody>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">description</td>
+            <td>{{.description}}</td>
+          </tr>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">type</td>
+            <td>{{.type}}</td>
+          </tr>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">categories</td>
+            <td>{{.categories}}</td>
+          </tr>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">source</td>
+            <td>{{.source}}</td>
+          </tr>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">rollup_aggregate</td>
+            <td>{{.rollup_aggregate}}</td>
+          </tr>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">unit</td>
+            <td>{{.unit}}</td>
+          </tr>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">aggregations</td>
+            <td>
+              {{ range .aggregations }}
+              {{ . }};
+              {{end}}
+            </td>
+          </tr>
+          <tr>
+            <td style="width: 200px; padding-bottom:5px">dimensions</td>
+            <td>
+              {{ range sort .dimensions }}
+              <li>
+                {{ . }}
+              </li>
+              {{end}}
+            </td>
+          </tr>
+        </tbody>
+      </table>
+      <hr>
+      {{ end }}
+    </main>
\ No newline at end of file

From 0fbe7fcaccb6c260d6917d9b420151ac747ceef9 Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Wed, 2 Jul 2025 06:53:52 -0700
Subject: [PATCH 084/117] Fix broken links (#773)

---
 .../connect-nginx-plus-container-images-to-nginx-one.md     | 2 +-
 .../config-sync-groups/manage-config-sync-groups.md         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md b/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
index 15eb1985b..ffac51180 100644
--- a/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
+++ b/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
@@ -48,7 +48,7 @@ Pull the NGINX Plus image from the private registry. Replace `VERSION_TAG` with
 sudo docker pull private-registry.nginx.com/nginx-plus/agent:VERSION_TAG
 ```
 
-You must specify a version tag. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}) guide.
+You must specify a version tag. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}) guide.
 
 <br>
 
diff --git a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
index 220b7c289..47cd6a28e 100644
--- a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
+++ b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
@@ -162,13 +162,13 @@ When adding a new NGINX instance that is not yet registered with NGINX One, you
    - From the **OS Type** list, choose the appropriate operating system for your Docker image.
    - After selecting the OS, run the provided command to pull the Docker image.
 
-   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}).
+   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
 
 
    - From the **OS Type** list, choose the appropriate operating system for your Docker image.
    - After selecting the OS, run the provided command to pull the Docker image.
 
-   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}).
+   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
 
 10. Run the provided command, which includes the data plane key, in your NGINX instance terminal to start the Docker container.
 
@@ -258,4 +258,4 @@ Monitor the **Config Sync Status** column. It can help you ensure that your conf
 ## See also
 
 - [Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
-- [Add an NGINX instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
\ No newline at end of file
+- [Add an NGINX instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})

From a48b31a6ab3b6f1729e3620f22abeec095866877 Mon Sep 17 00:00:00 2001
From: Rajesh Bejjanki <r.bejjanki@f5.com>
Date: Wed, 2 Jul 2025 21:33:30 +0530
Subject: [PATCH 085/117] fix: Update the command to print supported OS list
 (#774)

* fix: updating command to print supported OS list

* fix: removing -o report.zip option from license. It's needed only when reporting the usage.

---------

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>
---
 .../nim/installation/install-script-flags/distribution.md      | 2 +-
 content/nim/deploy/vm-bare-metal/install.md                    | 2 +-
 .../nim/disconnected/add-license-disconnected-deployment.md    | 3 +--
 static/scripts/install-nim-bundle.sh                           | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/content/includes/nim/installation/install-script-flags/distribution.md b/content/includes/nim/installation/install-script-flags/distribution.md
index 2d6c65cd3..7132ad0e0 100644
--- a/content/includes/nim/installation/install-script-flags/distribution.md
+++ b/content/includes/nim/installation/install-script-flags/distribution.md
@@ -10,5 +10,5 @@ files:
 To see the list of supported distributions, run:
 
 ```shell
-grep '\-d distribution' install-nim-bundle.sh
+install-nim-bundle.sh -l
 ```
\ No newline at end of file
diff --git a/content/nim/deploy/vm-bare-metal/install.md b/content/nim/deploy/vm-bare-metal/install.md
index af1cae1ab..bd104a3ac 100644
--- a/content/nim/deploy/vm-bare-metal/install.md
+++ b/content/nim/deploy/vm-bare-metal/install.md
@@ -54,7 +54,7 @@ The installation script installs the latest version of [NGINX Open Source](https
 To see the list of supported distributions, run:
 
 ```shell
-grep '\-d distribution' install-nim-bundle.sh
+install-nim-bundle.sh -l
 ```
 
 ### Security considerations
diff --git a/content/nim/disconnected/add-license-disconnected-deployment.md b/content/nim/disconnected/add-license-disconnected-deployment.md
index 4072d3608..61926dc6e 100644
--- a/content/nim/disconnected/add-license-disconnected-deployment.md
+++ b/content/nim/disconnected/add-license-disconnected-deployment.md
@@ -65,8 +65,7 @@ To add a license and submit the initial usage report in a disconnected environme
       -j <license-filename>.jwt \
       -i <NIM-IP-address> \
       -u admin \
-      -p <password> \
-      -o report.zip \
+      -p <password> \      
       -s initial
     ```
 
diff --git a/static/scripts/install-nim-bundle.sh b/static/scripts/install-nim-bundle.sh
index fb60d615a..7bd6dd4e5 100644
--- a/static/scripts/install-nim-bundle.sh
+++ b/static/scripts/install-nim-bundle.sh
@@ -811,7 +811,7 @@ printSupportedOS(){
   printf "\n  6. centos8(CentOS 8)"
   printf "\n  7. rhel8(Redhat Enterprise Linux Version 8)"
   printf "\n  8. rhel9( Redhat Enterprise Linux Version 9)"
-  printf "\n  9. oracle8(Oracle Linux Version 8)\n"
+  printf "\n  9. oracle8(Oracle Linux Version 8)"
   printf "\n  10. oracle9(Oracle Linux Version 9)\n"
   exit 0
 }

From 7d206bb522bde36be5e29f81102585bb555275ef Mon Sep 17 00:00:00 2001
From: AlexFenlon <a.fenlon@f5.com>
Date: Wed, 2 Jul 2025 17:18:56 +0100
Subject: [PATCH 086/117] feat: Add end of support column to NIC releases
 (#768)

* Add end of support column to NIC releases

* Update technical-specifications.md

---------
---
 content/nic/technical-specifications.md | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/content/nic/technical-specifications.md b/content/nic/technical-specifications.md
index 524cbd358..7b690fd2f 100644
--- a/content/nic/technical-specifications.md
+++ b/content/nic/technical-specifications.md
@@ -17,17 +17,16 @@ We recommend using the latest release of NGINX Ingress Controller. We provide so
 We test NGINX Ingress Controller on a range of Kubernetes platforms for each release, and list them in the [release notes]({{< ref "/nic/releases.md" >}}). We provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider, and that passes the [Kubernetes conformance tests](https://www.cncf.io/certification/software-conformance/).
 
 {{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
-| NIC version | Kubernetes versions tested  | NIC Helm Chart version | NIC Operator version | NGINX / NGINX Plus version |
-| --- | --- | --- | --- | --- |
-| {{< nic-version >}} | 1.25 - 1.32 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.4 / R34 |
-| 4.0.1 | 1.25 - 1.32 | 2.0.1 | 3.0.1 | 1.27.4 / R33 P2 |
-| 3.7.2 | 1.25 - 1.31 | 1.4.2 | 2.4.2 | 1.27.2 / R32 P1 |
-| 3.6.2 | 1.25 - 1.31 | 1.3.2 | 2.3.2 | 1.27.1 / R32 P1 |
-| 3.5.2 | 1.23 - 1.30 | 1.2.2 | 2.2.2 | 1.27.0 / R32 |
-| 3.4.3 | 1.23 - 1.29 | 1.1.3 | 2.1.2 | 1.25.4 / R31 P1 |
-| 3.3.2 | 1.22 - 1.28 | 1.0.2 | 2.0.2 | 1.25.3 / R30 |
-| 3.2.1 | 1.22 - 1.27 | 0.18.1 | 1.5.1 | 1.25.2 / R30 |
-| 3.1.1 | 1.22 - 1.26 | 0.17.1 | 1.4.2 | 1.23.4 / R29 |
+| NIC version | Kubernetes versions tested  | NIC Helm Chart version | NIC Operator version | NGINX / NGINX Plus version | End of Technical Support |
+| --- | --- | --- | --- | --- | --- |
+| {{< nic-version >}} | 1.25 - 1.32 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.4 / R34 | - |
+| 4.0.1 | 1.25 - 1.32 | 2.0.1 | 3.0.1 | 1.27.4 / R33 P2 | Feb 7, 2027 |
+| 3.7.2 | 1.25 - 1.31 | 1.4.2 | 2.4.2 | 1.27.2 / R32 P1 | Nov 25, 2026 |
+| 3.6.2 | 1.25 - 1.31 | 1.3.2 | 2.3.2 | 1.27.1 / R32 P1 | Aug 19, 2026 |
+| 3.5.2 | 1.23 - 1.30 | 1.2.2 | 2.2.2 | 1.27.0 / R32 | May 31, 2026 |
+| 3.4.3 | 1.23 - 1.29 | 1.1.3 | 2.1.2 | 1.25.4 / R31 P1 | Feb 19, 2026 |
+| 3.3.2 | 1.22 - 1.28 | 1.0.2 | 2.0.2 | 1.25.3 / R30 | Nov 1, 2025 |
+| 3.2.1 | 1.22 - 1.27 | 0.18.1 | 1.5.1 | 1.25.2 / R30 | Aug 18, 2025 |
 {{% /bootstrap-table %}}
 
 ---

From d3c925b2e3a655aad73bb6e1e8512363e3a968bd Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 2 Jul 2025 09:47:32 -0700
Subject: [PATCH 087/117] Bump theme version (#777)

chore: Bump theme version
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 733791f0f..c1e7a06d4 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/nginxinc/docs
 
 go 1.19
 
-require github.com/nginxinc/nginx-hugo-theme v0.43.3 // indirect
+require github.com/nginxinc/nginx-hugo-theme v0.43.4 // indirect
diff --git a/go.sum b/go.sum
index e6be901b5..25b6ee5e3 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,2 @@
-github.com/nginxinc/nginx-hugo-theme v0.43.3 h1:EpNIHtvxiqf2Xb0g9IuWvqqaF8w2i/NHDgtQzzPNPP0=
-github.com/nginxinc/nginx-hugo-theme v0.43.3/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
\ No newline at end of file
+github.com/nginxinc/nginx-hugo-theme v0.43.4 h1:fnUGTcpR/pwwgBIy2dv0fOkeT++cqv1T6G1LKqQRAFg=
+github.com/nginxinc/nginx-hugo-theme v0.43.4/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=

From 23d5cb6dfe90ae70813ec650f6d0c13abb56097a Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 2 Jul 2025 09:53:28 -0700
Subject: [PATCH 088/117] Remove changelog-date from partial and move to theme
 (#754)

chore: Remove changelog-date from partial and move to theme
---
 layouts/partials/changelog-date.html | 10 ----------
 1 file changed, 10 deletions(-)
 delete mode 100644 layouts/partials/changelog-date.html

diff --git a/layouts/partials/changelog-date.html b/layouts/partials/changelog-date.html
deleted file mode 100644
index 68c64d62f..000000000
--- a/layouts/partials/changelog-date.html
+++ /dev/null
@@ -1,10 +0,0 @@
-{{ $changelogContent := readFile "content/nginx-one/changelog.md" }}
-{{ $maxNumLogs := 3 }}
-{{ $headings := first $maxNumLogs (findRE `(?m)^##\s(.+)$` $changelogContent) }}
-<ul>
-  {{ range $headings }}
-  {{ $title := replaceRE "^##\\s" "" . }}
-  <li><a href="{{ absURL "nginx-one/changelog/" }}#{{urlize $title}}">{{ $title }}</a></li>
-  {{ end }}  
-  <li><a href="{{ absURL "nginx-one/changelog/" }}">Older...</a></li>
-</ul>
\ No newline at end of file

From a09ca09155f6e2901fd53e89b7e918ed920bc0cc Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Wed, 2 Jul 2025 10:12:58 -0700
Subject: [PATCH 089/117] Update the docs push action image version (#776)

chore: Update the docs push action image version
---
 .github/workflows/build-push.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index 5b833cfca..aedf4214e 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -58,7 +58,7 @@ jobs:
 
   call-docs-build-push:
     needs: prod-check-branch
-    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@285440f02d9967b62aeb1b7e0b5c2c70d4f950cf # v1.0.10
+    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@04ed2db338ee08cc560a327f412684d0c8260de2 # v1.0.11
     with:
       production_url_path: ""
       preview_url_path: "${{ vars.PREVIEW_URL_PATH }}"

From 664c1ab92250e27dac97e09c6eeccc103de7c46e Mon Sep 17 00:00:00 2001
From: nginx-aoife <50101789+nginx-aoife@users.noreply.github.com>
Date: Thu, 3 Jul 2025 10:02:01 +0100
Subject: [PATCH 090/117] Update linkchecker.yml (#782)

---
 .github/workflows/linkchecker.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linkchecker.yml b/.github/workflows/linkchecker.yml
index e82efb09b..bf148bda9 100644
--- a/.github/workflows/linkchecker.yml
+++ b/.github/workflows/linkchecker.yml
@@ -31,7 +31,7 @@ env:
     --ignore-url ^https://lightstep.com --ignore-url ^https://www.owasp.org/ --ignore-url ^https://www.maxmind.com --ignore-url ^https://www.splunk.com/
     --ignore-url ^https://oauth2.googleapis.com --ignore-url ^https://openidconnect.googleapis.com --ignore-url ^https://www.base64url.com/
     --ignore-url ^https://go.googlesource.com/ --ignore-url ^https://go.googlesource.com/sync --ignore-url ^https://linkerd.io/2.13/
-    --ignore-url ^http://www.redirectpage.com/ --ignore-url ^https://www.gnu.org/
+    --ignore-url ^http://www.redirectpage.com/ --ignore-url ^https://www.gnu.org/ --ignore-url ^https://insert_your_tenant_name.console.ves.volterra.io/
     --ignore-url ^https://\([a-zA-Z0-9-]+\).nginx.com/nginx-ingress-controller/css
     --ignore-url ^https://\([a-zA-Z0-9-]+\).nginx.com/nginxaas/azure/css
     --ignore-url ^https://\([a-zA-Z0-9-]+\).nginx.com/nginx-gateway-fabric/css

From 4b57030186ec6f9d7b783793baa3cf85b6c1f42d Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Thu, 3 Jul 2025 11:07:36 +0100
Subject: [PATCH 091/117] feat: Add precommit and git conventions (#775)

This commit moves our git conventions to their own
discrete page, and adds information that was previously
not written down anywhere, such as our general
branch management strategy.

Beyond documenting these conventions, an initial pre-commit
configuration has been added, which can be used as a guardrail
to enforce some of the conventions, such as requirements
around commit message length. A hook provided by the
pre-commit maintainers is also configured to prevent
commits directly to the main branch.

These configurations may be adjusted in the future based
on feedback, and there is additional follow-up work to
add a template for the git commit message. I had a working
implementation but decided to scrap it in favour of
minimising the number of dependencies.
---
 .gitlint                         | 15 ++++++
 .pre-commit-config.yaml          | 13 +++++
 CONTRIBUTING.md                  | 45 ++++-------------
 documentation/README.md          |  4 +-
 documentation/git-conventions.md | 83 ++++++++++++++++++++++++++++++++
 documentation/pre-commit.md      | 33 +++++++++++++
 6 files changed, 156 insertions(+), 37 deletions(-)
 create mode 100644 .gitlint
 create mode 100644 .pre-commit-config.yaml
 create mode 100644 documentation/git-conventions.md
 create mode 100644 documentation/pre-commit.md

diff --git a/.gitlint b/.gitlint
new file mode 100644
index 000000000..c776e9dbb
--- /dev/null
+++ b/.gitlint
@@ -0,0 +1,15 @@
+[general]
+ignore = body-is-missing
+contrib = contrib-title-conventional-commits
+
+[title-max-length] 
+line-length = 50
+
+[title-min-length]
+min-length = 5
+
+[body-max-line-length]
+line-length= 72
+
+[body-min-length]
+min-length = 5
\ No newline at end of file
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..d48d49e18
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,13 @@
+default_install_hook_types:
+    - pre-commit
+    - commit-msg
+
+repos:
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0 
+    hooks:
+    -   id: no-commit-to-branch
+-   repo: https://github.com/jorisroovers/gitlint
+    rev:  v0.19.1
+    hooks:
+    -   id: gitlint
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 01c0637ec..dfd79c0d4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 # Contributing guidelines
 
-The following is a set of guidelines for community contributions to this project. 
+The following is a set of guidelines for community contributions to this project.
 
 We really appreciate your desire to contribute!
 
@@ -11,10 +11,7 @@ If you are an F5 employee, see the following additional guidance on [Maintainers
 - [Report a Bug](#report-a-bug)
 - [Suggest a Feature or Enhancement](#suggest-a-feature-or-enhancement)
 - [Open a Discussion](#open-a-discussion)
-- [Submit a Pull Request](#submit-a-pull-request)
-  - Review our [Git style guide](#git-style-guide)
-  - Review the [Writing style guide](/documentation/style-guide.md)
-  - Review [Managing content with Hugo](/documentation/writing-hugo.md)
+- [Submit a pull request](#submit-a-pull-request)
 - [Issue Lifecycle](#issue-lifecycle)
 - [Additional NGINX documentation](#additional-nginx-documentation)
 - [F5 Contributor License Agreement (CLA)](#f5-contributor-license-agreement)
@@ -37,44 +34,20 @@ If you want to start a conversation with the community and maintainers,
 we encourage you to use
 [GitHub Discussions](https://github.com/nginx/documentation/discussions).
 
-## Submit a Pull Request
+## Submit a pull request
 
-To contribute to F5 NGINX documentation, follow these steps:
+Before making documentation changes, you should view the [documentation style guide](/documentation/style-guide.md) and [Managing content with Hugo](/documentation/writing-hugo.md).
+
+To understand how we use Git in this repository, read our [Git conventions](/documentation/git-conventions.md) documentation.
+
+The broad workflow is as follows:
 
 - Fork the NGINX repository
 - Create a branch
 - Implement your changes in your branch
 - Submit a pull request (PR) when your changes are ready for review
 
-Alternatively, you're welcome to suggest improvements to highlight problems with
-our documentation as described in our [support](./SUPPORT.md) page.
-
-### Git style guide
-
-- Keep a clean, concise and meaningful Git commit history on your branch, rebasing locally and squashing before you submit a PR
-- We use [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) formatting.
-- Follow the guidelines of writing a good commit message as described here <https://chris.beams.io/posts/git-commit/>
-  and summarized in the next few points:
-
-  - In the subject line, use the present tense ("Add feature" not "Added feature")
-  - In the subject line, use the imperative mood ("Move cursor to..." not "Moves cursor to...")
-  - Limit the subject line to 72 characters or less
-  - Reference issues and pull requests liberally after the subject line
-  - Add more detailed description in the body of the git message (`git commit -a` to give you more space and time in
-    your text editor to write a good message instead of `git commit -am`)
-
-#### Branch protection rules
-
-This repository has the following branch protection rules in place:
-
-- **Pushing branches that contain the "internal/" prefix is not allowed.** This ensures internal development branches are not accidentally or purposefully pushed to this repo.
-- **Two approvers are required for all merges to main and release branches.** This ensures all code that is approved for release to production is appropriately reviewed. This rule applies to all branches with `*release*` in the branch name.
-- **Only NGINX DocOps Team members can create release branches.** This ensures the docs team is aware of all branches supporting specific product releases. This rule applies to all branches with `*release*` in the branch name.
-- **Pushes (force or otherwise) directly to main or release branches is not allowed.** Release branches serve as "main" for the release they are associated with. Restricting pushes directly to main and release branches ensures all content changes are reviewed and approved. This rule applies to all branches with `*release*` in the branch name and to "main".
-
-### Documentation style guide
-
-For detailed guidance, see our documentation [style guide](./templates/style-guide.md).
+Alternatively, you're welcome to suggest improvements to highlight problems with our documentation as described in our [support](./SUPPORT.md) page.
 
 ## Issue lifecycle
 
diff --git a/documentation/README.md b/documentation/README.md
index 565129184..6cae42e2e 100644
--- a/documentation/README.md
+++ b/documentation/README.md
@@ -1,4 +1,4 @@
-# NGINX Documentation repository 
+# NGINX Documentation repository
 
 This directory contains the documentation for the NGINX Documentation repository.
 
@@ -13,8 +13,10 @@ If you're interested in contributing to the [NGINX documentation website](https:
 ## Topics
 
 - [Contributing closed content](/documentation/closed-contributions.md)
+- [Git conventions](/documentation/git-conventions.md)
 - [Information architecture heuristics](/documentation/ia-heuristics.md)
 - [Maintainers etiquette](/documentation/maintainers-etiquette.md)
 - [Managing content with Hugo](/documentation/writing-hugo.md)
 - [Proposals](/documentation/proposals/README.md)
+- [Set up pre-commit](/documentation/pre-commit.md)
 - [Writing style guide](/documentation/style-guide.md)
diff --git a/documentation/git-conventions.md b/documentation/git-conventions.md
new file mode 100644
index 000000000..186f50db3
--- /dev/null
+++ b/documentation/git-conventions.md
@@ -0,0 +1,83 @@
+# Git conventions
+
+For consistency, we have a handful of git conventions:
+
+- We follow a [GitHub flow model](https://githubflow.github.io/) for branch management
+- We follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) formatting
+- We write [good commit messages](https://cbea.ms/git-commit/), treating them as a source of truth
+
+Many of these conventions are suggested or enforced in tooling: for local development, [set up pre-commit](/documentation/pre-commit.md).
+
+We encourage small, tightly-scoped pull requests: this makes managing reviews simpler, allowing us to iterate on documentation quickly.
+
+## Branch management
+
+We continuously deploy from the [`main`](https://github.com/nginx/documentation/tree/main) branch.
+
+To make changes, [fork the repository](https://github.com/nginx/documentation/fork) then branch from `main`, giving your branch a prefix and descriptive name.
+
+Prefixes are typically a three letter acronym for the product it affects:
+- `nic/`, `ngf/`, `nim`/, `waf/`, and so forth
+-  Use `docs/` if the change is related to the repository or not product-specific
+
+A descriptive name usually concerns what the branch actually updates:
+- `nic/update-helm-links` Tells someone at a glance that the branch relates to NGINX Ingress Controller and links related to Helm
+- `patch-27` Tells someone almost nothing at a glance: it does not include a prefix or any details about a possible topic
+
+The exception to this branch naming convention is release branches for products. These are named `<product>-<release>-<version>`:
+- `agent-release-2.2`
+- `n1c-release-1.5`
+- `dos-release-5.1`
+
+Typically, the technical writer for a given product will ensure that branches are kept in sync with `main`, to minimize the risk of merge conflicts.
+
+If you need to rename a branch, here's the syntax:
+
+```shell
+git branch -m <current-branch-name> <new-branch-name>
+```
+
+## Commit messages
+
+When opening a pull request on GitHub, the very first commit from a branch is automatically pulled to populate the description.
+
+This provides an opportunity to re-use a good commit message to provide context to reviewers for the changes in a branch.
+
+The first line of a git commit message becomes the subject line, with the contents after a line break becoming the body.
+
+A subject line begins with a [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) prefix, and should be written in present imperative.
+- _feat: Update ConfigMap reference page_
+- _fix: Remove links to missing website_
+
+Keep the subject line around 50 characters or less: imagine the reader is using `git reflog` or `git log --oneline` to review changes.
+
+The body of the git message should have its lines kept around 72 characters or less, and can be structured as follows:
+
+- What was changed and why
+- How the changes were implemented
+- What else the changes might affect, and what may change in the future
+
+This provides enough context for a reader to get a strong impression of what the commit accomplishes, which in turn makes reviewing pull requests easier
+
+An example of a full commit message following the above conventions is as follows:
+
+```
+feat: Move and update process documentation
+
+This commit moves and updates some of the process documentation for the
+repository. This is an iterative process, which will continue to improve
+as time goes on. Some of the changes include:
+
+- Moving the closed contributions document into the documentation folder
+- Moving and reframing the F5/NGINX document as "Maintainers etiquette"
+- Moving and renaming the "Managing content with Hugo" document
+- Moving the style guide from the templates folder
+
+These files will likely be updated in a subsequent PR as we clarify the
+contribution process and user flow of other process artefacts, such as
+the pull request and issue templates.
+
+Although we do not draw attention to it, the templates folder is being
+retained for reference until the style guide and Hugo archetypes contain
+the relevant, useful information.
+```
diff --git a/documentation/pre-commit.md b/documentation/pre-commit.md
new file mode 100644
index 000000000..af490a726
--- /dev/null
+++ b/documentation/pre-commit.md
@@ -0,0 +1,33 @@
+# Set up pre-commit
+
+[pre-commit](https://pre-commit.com/) is a command-line tool used for automatic linting.
+
+It is currently *optional*, and used for consistent [Git conventions](/documentation/git-conventions.md), but will be used for more in the future.
+
+The configuration file is located at the root of the repository, [pre-commit-config.yaml](/.pre-commit-config.yaml).
+
+## Install pre-commit
+
+To install pre-commit, you need [pip](https://pypi.org/project/pip/), which is bundled with most contemporary Python installations.
+
+After ensuring you have pip installed, follow the [Installation steps](https://pre-commit.com/#install):
+
+```shell
+pip install pre-commit
+```
+
+Then install the git hook scripts with the following command:
+
+```shell
+pre-commit install
+```
+
+It will then run every time you use `git commit`.
+
+If you encounter an error about a missing configuration file, you are likely working in a branch that has not synced changes from `main`.
+
+You will need to sync changes from `main` or temporarily uninstall pre-commit to address the error.
+
+```shell
+pre-commit uninstall
+```

From a9282b02f080a64d83c77bda7dd0d64a2085a382 Mon Sep 17 00:00:00 2001
From: szmxctl <szapata91@yahoo.com.mx>
Date: Thu, 3 Jul 2025 05:16:52 -0600
Subject: [PATCH 092/117] chore: Update distro table in N+to align with NAP
 tech specs (#780)

---
 content/nginx/technical-specs.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/nginx/technical-specs.md b/content/nginx/technical-specs.md
index 852bbad50..41ba20307 100644
--- a/content/nginx/technical-specs.md
+++ b/content/nginx/technical-specs.md
@@ -25,7 +25,7 @@ Dynamic modules are supported on the [same distributions as NGINX Plus](#support
 {{<bootstrap-table "table table-striped table-bordered">}}
 | Module           | Distribution and details                                                                                   |
 |-------------------|-----------------------------------------------------------------------------------------------------------|
-| [AppProtect]({{< ref "/nap-waf/v5/admin-guide/install.md" >}}) | AlmaLinux/Rocky Linux: **Not supported**<br>Alpine Linux: **Not supported**<br>Amazon Linux 2: **x86_64 only**<br>Amazon Linux 2023: **Not supported**<br>Debian 11: **x86_64 only**<br>FreeBSD: **Not supported**<br>Oracle Linux 8: **x86_64 only**<br>RHEL 8: **x86_64 only**<br>SLES: **Not supported**<br>Ubuntu 20.04: **x86_64 only** |
+| [AppProtect]({{< ref "/nap-waf/v5/admin-guide/install.md" >}}) | AlmaLinux: **Not supported**<br>Alpine Linux 3.17 & 3.18: **Not supported**<br>Alpine Linux 3.19: **x86_64 only**<br>Amazon Linux 2: **Not supported**<br>Amazon Linux 2023: **x86_64 only**<br>Debian 11 & 12: **x86_64 only**<br>FreeBSD: **Not supported**<br>Oracle Linux 8: **x86_64 only**<br>RHEL 8 & 9: **x86_64 only**<br>Rocky Linux 8: **Not supported**<br>Rocky Linux 9: **x86_64 only**<br>SLES: **Not supported**<br>Ubuntu 20.04: **Not supported**<br>Ubuntu 22.04 & 24.04: **x86_64 only** |
 | [GeoIP]({{< ref "/nginx/admin-guide/dynamic-modules/geoip.md" >}}) | Amazon Linux 2023  **Not supported**<br>RHEL/Oracle Linux/AlmaLinux/Rocky Linux 8.0+, 9: **Not supported**<br>FreeBSD: **Not supported**           |
 | [GeoIP2]({{< ref "/nginx/admin-guide/dynamic-modules/geoip2.md" >}}) | Amazon Linux 2: **Not supported**                                            |
 | [HA-Keepalived]({{< ref "/nginx/admin-guide/high-availability/ha-keepalived-nodes.md#configuring-keepalived-for-an-additional-passive-node" >}}) | FreeBSD: **Not supported**<br>Alpine Linux: **Not supported**<br>Amazon Linux 2: **Not supported**<br>Amazon Linux 2023: **Not supported** |

From be0a1e767a0befb6c33871fe0edd772ba056712f Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Thu, 3 Jul 2025 13:11:38 -0700
Subject: [PATCH 093/117] feat: update per implied customer feedback (#779)

* feat: update per implied customer feedback
---
 .../includes/nginx-one/cloud-access-nginx.md  |  11 ++
 content/includes/nginx-one/cloud-access.md    |  11 ++
 content/includes/nginx-one/install-nginx.md   |  10 ++
 content/nginx-one/_index.md                   |  41 ++++-
 content/nginx-one/about.md                    |  21 ---
 content/nginx-one/changelog.md                |   4 +-
 content/nginx-one/connect-instances/_index.md |   2 +-
 .../connect-instances/add-instance.md         |   4 +-
 .../create-manage-data-plane-keys.md          |   4 +
 .../set-up-nginx-proxy-for-nginx-one.md       |   4 +-
 content/nginx-one/getting-started.md          | 153 ++++++++++--------
 .../certificates/manage-certificates.md       |   4 +-
 .../{ => nginx-configs}/metrics/_index.md     |   0
 .../metrics/enable-metrics.md                 |   0
 .../metrics/review-metrics.md                 |   0
 .../nginx-configs/one-instance/_index.md      |   6 +
 .../{ => one-instance}/add-file.md            |   0
 .../view-edit-nginx-configurations.md         |   2 +-
 .../staged-configs/_index.md                  |   0
 .../staged-configs/add-staged-config.md       |   0
 .../staged-configs/api-staged-config.md       |   0
 .../staged-configs/edit-staged-config.md      |   0
 .../import-export-staged-config.md            |   2 +-
 go.mod                                        |   2 +-
 go.sum                                        |   2 +
 25 files changed, 178 insertions(+), 105 deletions(-)
 create mode 100644 content/includes/nginx-one/cloud-access-nginx.md
 create mode 100644 content/includes/nginx-one/cloud-access.md
 create mode 100644 content/includes/nginx-one/install-nginx.md
 delete mode 100644 content/nginx-one/about.md
 rename content/nginx-one/{ => nginx-configs}/metrics/_index.md (100%)
 rename content/nginx-one/{ => nginx-configs}/metrics/enable-metrics.md (100%)
 rename content/nginx-one/{ => nginx-configs}/metrics/review-metrics.md (100%)
 create mode 100644 content/nginx-one/nginx-configs/one-instance/_index.md
 rename content/nginx-one/nginx-configs/{ => one-instance}/add-file.md (100%)
 rename content/nginx-one/nginx-configs/{ => one-instance}/view-edit-nginx-configurations.md (95%)
 rename content/nginx-one/{ => nginx-configs}/staged-configs/_index.md (100%)
 rename content/nginx-one/{ => nginx-configs}/staged-configs/add-staged-config.md (100%)
 rename content/nginx-one/{ => nginx-configs}/staged-configs/api-staged-config.md (100%)
 rename content/nginx-one/{ => nginx-configs}/staged-configs/edit-staged-config.md (100%)
 rename content/nginx-one/{ => nginx-configs}/staged-configs/import-export-staged-config.md (97%)

diff --git a/content/includes/nginx-one/cloud-access-nginx.md b/content/includes/nginx-one/cloud-access-nginx.md
new file mode 100644
index 000000000..7756edc80
--- /dev/null
+++ b/content/includes/nginx-one/cloud-access-nginx.md
@@ -0,0 +1,11 @@
+---
+files:
+  - content/nginx-one/secure-your-fleet/secure.md
+  - content/nginx-one/getting-started.md
+---
+
+Once you've logged in with your password, you should be able to see and select the NGINX One tile. 
+
+1. Select the **NGINX One** tile
+1. If needed, select **Enable Service**
+1. After the service has been enables, select **Visit Service** to load NGINX One Console
diff --git a/content/includes/nginx-one/cloud-access.md b/content/includes/nginx-one/cloud-access.md
new file mode 100644
index 000000000..c50a1289b
--- /dev/null
+++ b/content/includes/nginx-one/cloud-access.md
@@ -0,0 +1,11 @@
+---
+files:
+  - content/nginx-one/secure-your-fleet/secure.md
+  - content/nginx-one/getting-started.md
+---
+
+Confirm an F5 Distributed Cloud tenant has been provisioned for you. Log in to MyF5 and review your subscriptions. You should see within one of your subscriptions "Distributed Cloud". This could be in either an NGINX subscription or a Distributed Cloud. If the above does not appear in any of your subscriptions, reach out to either your F5 Account Team or Customer Success Manager.
+
+With access, you or someone in your organization should have an email from no-reply@cloud.f5.com asking you to update your password when the tenant was created. The account name referenced in the E-Mail in bold is the tenant name.
+
+Navigate to https://INSERT_YOUR_TENANT_NAME.console.ves.volterra.io/ to access F5 Distributed Cloud. If you have never logged in, select the **Forgot Password?** option in the log in screen. Alternatively, if someone within your organization has access, ask them to add you as a user within your tenant with a role providing permissions for NGINX One.
diff --git a/content/includes/nginx-one/install-nginx.md b/content/includes/nginx-one/install-nginx.md
new file mode 100644
index 000000000..cfc3863bf
--- /dev/null
+++ b/content/includes/nginx-one/install-nginx.md
@@ -0,0 +1,10 @@
+---
+files:
+  - content/nginx-one/secure-your-fleet/secure.md
+  - content/nginx-one/getting-started.md
+---
+
+If you need to set up an instance of NGINX, you can do so in one of the following ways:
+
+- Install [NGINX Open Source or NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/" >}}). You can use the linked guide to install NGINX in a Linux environment, in a VM or on bare-metal hardware.
+- [Deploy NGINX and NGINX Plus with Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md" >}}) with NGINX and the NGINX Agent installed.
diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index adb7407b4..3cfd13708 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -13,7 +13,7 @@ nd-product: NGINX One
 [//]: # "These are Markdown comments to guide you through document structure. Remove them as you go, as well as any unnecessary sections."
 [//]: # "Use underscores for _italics_, and double asterisks for **bold**."
 [//]: # "Backticks are for `monospace`, used sparingly and reserved mostly for executable names - they can cause formatting problems. Avoid them in tables: use italics instead."
-The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
+F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more. NGINX One Console is part of NGINX One, which includes [NGINX One components](#nginx-one-components).
 
 ## Featured content
 [//]: # "You can add a maximum of three cards: any extra will not display."
@@ -21,19 +21,44 @@ The F5 NGINX One Console makes it easy to manage NGINX instances across location
 [//]: # "Some examples of content could be the latest release note, the most common install path, and a popular new feature."
 {{<card-layout>}}
   {{<card-section showAsCards="true" isFeaturedSection="true">}}
-    {{<card title="Get started" titleUrl="nginx-one/getting-started/" isFeatured="true" icon="unplug">}}
-      See benefits from the NGINX One Console
+    {{<card title="Get started" titleUrl="/nginx-one/getting-started/" isFeatured="true" icon="unplug">}}
+      Get up and running with NGINX One Console
     {{</card >}}
-    {{<card title="Changelog" titleUrl="nginx-one/changelog/" icon="clock-alert">}}
+  {{</card-section>}}
+{{</card-layout>}}
+
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" >}}
+    {{<card title="Connect more NGINX instances" titleUrl="/nginx-one/connect-instances/" >}}
+      Work with data plane keys, containers, and proxy servers
+    {{</card>}}
+    {{<card title="Manage your NGINX instances" titleUrl="/nginx-one/nginx-configs/" >}}
+      Manage one instance or groups of instances. Monitor certificates. Set up metrics.
+    {{</card>}}
+    {{<card title="Organize users with RBAC" titleUrl="/nginx-one/rbac/" >}}
+      Assign responsibilities with role-based access control 
+    {{</card>}}
+    {{<card title="Automate with the NGINX One API" titleUrl="/nginx-one/api/" >}}
+      Manage your NGINX fleet over REST
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
+
+### More information
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" >}}
+    {{<card title="Glossary" titleUrl="/nginx-one/glossary/" >}}
       See latest updates: New features, improvements, and bug fixes
     {{</card>}}
-    {{<card title="Add an NGINX instance" titleUrl="nginx-one/connect-instances/add-instance/" icon="copy-plus">}}
-      Connect your instances to NGINX One
+    {{<card title="Changelog" titleUrl="/nginx-one/changelog/" icon="clock-alert">}}
+      See latest updates: New features, improvements, and bug fixes
     {{</card>}}
   {{</card-section>}}
 {{</card-layout>}}
 
-## Other Components
+## NGINX One components
 [//]: # "You can add any extra content for the page here, such as additional cards, diagrams or text."
 
 {{< card-layout >}}
@@ -66,4 +91,4 @@ The F5 NGINX One Console makes it easy to manage NGINX instances across location
       Defend, adapt, and mitigate against Layer 7 denial-of-service attacks on your apps and APIs.
     {{</ card >}}
   {{</ card-section >}}
-{{</card-layout>}}
\ No newline at end of file
+{{</card-layout>}}
diff --git a/content/nginx-one/about.md b/content/nginx-one/about.md
deleted file mode 100644
index 1811cba97..000000000
--- a/content/nginx-one/about.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-description: ''
-nd-docs: DOCS-1392
-title: Manage your NGINX fleet
-toc: true
-weight: 10
-type:
-- reference
----
-
-The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
-
-## Benefits and key features
-
-NGINX One offers the following key benefits:
-
-- **Centralized control**: Manage all your NGINX instances from a single console.
-- **Enhanced monitoring and risk detection**: Automatically detect critical vulnerabilities (CVEs), verify SSL certificate statuses, and identify security issues in NGINX configurations.
-- **Performance optimization**: Track your NGINX versions and receive recommendations for tuning your configurations for better performance.
-- **Graphical Metrics Display**: Access a dashboard that shows key metrics for your NGINX instances, including instance availability, version distribution, system health, and utilization trends.
-- **Real-time alerts**: Receive alerts about critical issues.
diff --git a/content/nginx-one/changelog.md b/content/nginx-one/changelog.md
index 45f27fc4c..dd9cf1216 100644
--- a/content/nginx-one/changelog.md
+++ b/content/nginx-one/changelog.md
@@ -91,7 +91,7 @@ You can:
 - Remove a deployed certificate from a Config Sync Group
 
 For more information, including warnings about risks, see our documentation on how you can:
-- [Add a file]({{< ref "/nginx-one/nginx-configs/add-file.md" >}})
+- [Add a file]({{< ref "/nginx-one/nginx-configs/one-instance/add-file.md" >}})
 - [Manage certificates]({{< ref "/nginx-one/nginx-configs/certificates/manage-certificates.md" >}})
 
 ### Revert a configuration
@@ -144,7 +144,7 @@ Select the link for each CVE to see the details, including the CVE's publish dat
 
 ### Edit NGINX configurations
 
-You can now make configuration changes to your NGINX instances. For more details, see [View and edit NGINX configurations]({{< ref "/nginx-one/nginx-configs/view-edit-nginx-configurations.md" >}}).
+You can now make configuration changes to your NGINX instances. For more details, see [View and edit NGINX configurations]({{< ref "/nginx-one/nginx-configs/one-instance/view-edit-nginx-configurations.md" >}}).
 
 ## May 28, 2024
 
diff --git a/content/nginx-one/connect-instances/_index.md b/content/nginx-one/connect-instances/_index.md
index ea3ed0292..686d7efc8 100644
--- a/content/nginx-one/connect-instances/_index.md
+++ b/content/nginx-one/connect-instances/_index.md
@@ -1,6 +1,6 @@
 ---
 description:
-title: Connect your instances
+title: Connect more instances
 weight: 200
 url: /nginx-one/connect-instances/
 ---
diff --git a/content/nginx-one/connect-instances/add-instance.md b/content/nginx-one/connect-instances/add-instance.md
index 6bc8b768f..db4af6a8f 100644
--- a/content/nginx-one/connect-instances/add-instance.md
+++ b/content/nginx-one/connect-instances/add-instance.md
@@ -2,7 +2,7 @@
 description: ''
 title: Add an NGINX instance
 toc: true
-weight: 100
+weight: 300
 type:
 - how-to
 ---
@@ -54,4 +54,4 @@ Once you've completed the process, NGINX One reassigns this as a managed certifi
 ## Add an instance to a Config Sync Group
 
 When you [Manage Config Sync Group membership]({{< ref "nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups#manage-config-sync-group-membership" >}}), you can add an existing or new instance to the group of your choice.
-That instance inherits the setup of that Config Sync Group.
\ No newline at end of file
+That instance inherits the setup of that Config Sync Group.
diff --git a/content/nginx-one/connect-instances/create-manage-data-plane-keys.md b/content/nginx-one/connect-instances/create-manage-data-plane-keys.md
index 243edd970..0052e684c 100644
--- a/content/nginx-one/connect-instances/create-manage-data-plane-keys.md
+++ b/content/nginx-one/connect-instances/create-manage-data-plane-keys.md
@@ -66,3 +66,7 @@ Before you can delete a key, it must be expired or revoked. You can revoke a key
 2. Find the key you want to revoke in the list of expired or revoked keys.
 3. Next to the key name, select the check box. You can select multiple keys at the same time.
 4. Select **Delete selected**.
+
+## Use the API
+
+You can use our [API to manage your data plane keys]({{< ref "/nginx-one/api/api-reference-guide/#tag/Data-Plane/Key" >}}) in all of these ways (and more).
diff --git a/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md b/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md
index 11ea0c245..c29aec28b 100644
--- a/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md
+++ b/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md
@@ -1,9 +1,9 @@
 ---
 description: ''
 nd-docs: null
-title: Minimize connections - Set up NGINX as a proxy
+title: Prepare - Set up NGINX as a proxy
 toc: true
-weight: 300
+weight: 200
 type:
 - how-to
 ---
diff --git a/content/nginx-one/getting-started.md b/content/nginx-one/getting-started.md
index 113fb1725..8f5605201 100644
--- a/content/nginx-one/getting-started.md
+++ b/content/nginx-one/getting-started.md
@@ -4,30 +4,109 @@ toc: true
 weight: 100
 type: how-to
 product: NGINX One
-nd-docs: DOCS-1393
 ---
 
-This guide provides step-by-step instructions on how to activate and start using F5 NGINX One Console. NGINX One is a management console for monitoring and managing NGINX data plane instances.
+The F5 NGINX One Console makes it easy to manage NGINX instances across locations and environments. The console lets you monitor and control your NGINX fleet from one place—you can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more. 
 
-## Enable the NGINX One service {#enable-nginx-one}
+This guide provides step-by-step instructions to activate and use F5 NGINX One Console. For a list of the latest changes, see our [changelog]({{< ref "/nginx-one/changelog.md" >}})
 
-To get started using NGINX One, enable the service on F5 Distributed Cloud.
+## Benefits and key features
 
-1. Log in to [F5 Distributed Console](https://www.f5.com/cloud/products/distributed-cloud-console).
-1. Select **NGINX One** from the list of services.
-1. Select **Enable Service**.
-1. After the service has been enabled, select **Visit Service** to load NGINX One Console.
+NGINX One offers the following key benefits:
+
+- **Centralized control**: Manage all your NGINX instances from a single console.
+- **Enhanced monitoring and risk detection**: Automatically detect critical vulnerabilities (CVEs), verify SSL certificate statuses, and identify security issues in NGINX configurations.
+- **Performance optimization**: Track your NGINX versions and receive recommendations for tuning your configurations for better performance.
+- **Graphical Metrics Display**: Access a dashboard that shows key metrics for your NGINX instances, including instance availability, version distribution, system health, and utilization trends.
+- **Real-time alerts**: Receive alerts about critical issues.
+
+## Before you begin 
+
+**You need access to F5 Distributed Cloud**.
+
+If you already have accessed F5 Distributed Cloud and have NGINX instances available, you can skip these sections and start to [Add your NGINX instances to NGINX One](#add-your-nginx-instances-to-nginx-one). Otherwise, take these steps to "onboard" yourself to NGINX One Console.
+
+<details>
+<summary>If you want to register for a trial</summary>
+
+### Register for a trial subscription
+
+<!-- Make sure to check with sales enablement -->
+If you want to register for a trial, navigate to https://account.f5.com/myf5. If needed, select **Sign up** to get an account. Then follow these steps:
+
+1. Navigate to https://account.f5.com/myf5 and log in.
+1. Select trials
+1. Find **F5 NGINX**. Sign up for the trial. 
+1. The trial may require approval. 
+
+</details>
+
+<details>
+<summary>Confirm access to the F5 Distributed Cloud</summary>
+
+### Confirm access to the F5 Distributed Cloud
+
+{{< include "/nginx-one/cloud-access.md" >}}
+
+</details>
+
+<details>
+<summary>Confirm access to NGINX One Console</summary>
+
+### Confirm access to NGINX One Console
+
+{{< include "/nginx-one/cloud-access-nginx.md" >}}
+
+</details>
+
+<details>
+<summary>Install an instance of NGINX</summary>
+
+### Install an instance of NGINX
+
+{{< include "/nginx-one/install-nginx.md" >}}
+
+</details>
+
+<details>
+<summary>Make sure you're running a supported Linux distribution</summary>
+
+NGINX Agent sets up communication between your NGINX Instance and NGINX One Console. Make sure your Linux operating system is listed below. The installation script for NGINX Agent is compatible with these distributions and versions.
+
+### NGINX Agent installation script: supported distributions
+
+{{<bootstrap-table "table table-striped table-bordered">}}
+
+| Distribution                 | Version              | Architecture    |
+|------------------------------|----------------------|-----------------|
+| AlmaLinux                    | 8, 9                 | x86_64, aarch64 |
+| Alpine Linux                 | 3.16 - 3.18          | x86_64, aarch64 |
+| Amazon Linux                 | 2023                 | x86_64, aarch64 |
+| Amazon Linux 2               | LTS                  | x86_64, aarch64 |
+| CentOS                       | 7.4+                 | x86_64, aarch64 |
+| Debian                       | 11, 12               | x86_64, aarch64 |
+| Oracle Linux                 | 7.4+, 8.1+, 9        | x86_64          |
+| Red Hat Enterprise Linux     | 7.4+, 8.1+, 9        | x86_64, aarch64 |
+| Rocky Linux                  | 8, 9                 | x86_64, aarch64 |
+| Ubuntu                       | 20.04 LTS, 22.04 LTS | x86_64, aarch64 |
+
+{{</bootstrap-table>}}
+
+</span>
+
+</details>
 
 ---
 
 ## Add your NGINX instances to NGINX One
 
-Next, add your NGINX instances to NGINX One. You'll need to create a data plane key and then install NGINX Agent on each instance you want to monitor.
+Add your NGINX instances to NGINX One. You'll need to create a data plane key and then install NGINX Agent on each instance you want to monitor.
 
 The following instructions include minimal information, sufficient to "get started." See the following links for detailed instructions:
 
-- [Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
+- [Prepare - Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
 - [Add an NGINX instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
+- [Connect NGINX Plus container images]({{< ref "/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md" >}})
 
 ### Generate a data plane key {#generate-data-plane-key}
 
@@ -103,29 +182,6 @@ The `install` script writes an `nginx-agent.conf` file to the `/etc/nginx-agent/
 
 <br>
 
-<i class="fa fa-check-circle" aria-hidden="true"></i> Make sure your Linux operating system is listed below. The installation script for NGINX Agent is compatible with these distributions and versions.
-
-#### NGINX Agent installation script: supported distributions
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-
-| Distribution                 | Version              | Architecture    |
-|------------------------------|----------------------|-----------------|
-| AlmaLinux                    | 8, 9                 | x86_64, aarch64 |
-| Alpine Linux                 | 3.16 - 3.18          | x86_64, aarch64 |
-| Amazon Linux                 | 2023                 | x86_64, aarch64 |
-| Amazon Linux 2               | LTS                  | x86_64, aarch64 |
-| CentOS                       | 7.4+                 | x86_64, aarch64 |
-| Debian                       | 11, 12               | x86_64, aarch64 |
-| Oracle Linux                 | 7.4+, 8.1+, 9        | x86_64          |
-| Red Hat Enterprise Linux     | 7.4+, 8.1+, 9        | x86_64, aarch64 |
-| Rocky Linux                  | 8, 9                 | x86_64, aarch64 |
-| Ubuntu                       | 20.04 LTS, 22.04 LTS | x86_64, aarch64 |
-
-{{</bootstrap-table>}}
-
-</span>
-
 ---
 
 The NGINX One Console dashboard relies on APIs for NGINX Plus and NGINX Open Source Stub Status to report traffic and system metrics. The following sections show you how to enable those metrics.
@@ -153,37 +209,6 @@ After connecting your NGINX instances to NGINX One, you can monitor their perfor
 
 {{< include "/use-cases/monitoring/n1c-dashboard-overview.md" >}}
 
-Navigating the dashboard:
-
-- **Drill down into specifics**: For in-depth information on a specific metric, like expiring certificates, click on the relevant link in the metric's card to go to a detailed overview page.
-- **Refine metric timeframe**: Metrics show the last hour's data by default. To view data from a different period, select the time interval you want from the drop-down menu.
-
-<span style="display: inline-block; margin-top: 20px; margin-bottom: 50px;">
-{{< img src="nginx-one/images/nginx-one-dashboard.png">}}
-</span>
-
-{{<bootstrap-table "table table-striped table-bordered">}}
-**NGINX One dashboard metrics**
-| Metric | Description | Details |
-|---|---|---|
-| <i class="fas fa-heartbeat"></i> **Instance availability** | Understand the operational status of your NGINX instances. | - **Online**: The NGINX instance is actively connected and functioning properly. <br> - **Offline**: NGINX Agent is connected but the NGINX instance isn't running, isn't installed, or can't communicate with NGINX Agent. <br> - **Unavailable**: The connection between NGINX Agent and NGINX One has been lost or the instance has been decommissioned. <br> - **Unknown**: The current state can't be determined at the moment. |
-| <i class="fas fa-code-branch"></i> **NGINX versions by instance** | See which NGINX versions are in use across your instances. | |
-| <i class="fas fa-desktop"></i> **Operating systems** | Find out which operating systems your instances are running on. | |
-| <i class="fas fa-certificate"></i> **Certificates** | Monitor the status of your SSL certificates to know which are expiring soon and which are still valid. | |
-| <i class="fas fa-cogs"></i> **Config recommendations** | Get configuration recommendations to optimize your instances' settings. | |
-| <i class="fas fa-shield-alt"></i> **CVEs (Common Vulnerabilities and Exposures)** | Evaluate the severity and number of potential security threats in your instances. | - **Major**: Indicates a high-severity threat that needs immediate attention. <br> - **Medium**: Implies a moderate threat level. <br> - **Minor** and **Low**: Represent less critical issues that still require monitoring. <br> - **Other**: Encompasses any threats that don't fit the standard categories. |
-| <i class="fas fa-microchip"></i> **CPU utilization** | Track CPU usage trends and pinpoint instances with high CPU demand. | |
-| <i class="fas fa-memory"></i> **Memory utilization** | Watch memory usage patterns to identify instances using significant memory. | |
-| <i class="fas fa-hdd"></i> **Disk space utilization** | Monitor how much disk space your instances are using and identify those nearing capacity. | |
-| <i class="fas fa-exclamation-triangle"></i> **Unsuccessful response codes** | Look for instances with a high number of HTTP server errors and investigate their error codes. | |
-| <i class="fas fa-tachometer-alt"></i> **Top network usage** | Review the network usage and bandwidth consumption of your instances. | |
-
-{{</bootstrap-table>}}
-
-
-
-
-
 
 
 
diff --git a/content/nginx-one/nginx-configs/certificates/manage-certificates.md b/content/nginx-one/nginx-configs/certificates/manage-certificates.md
index c842e9677..cf6409c8b 100644
--- a/content/nginx-one/nginx-configs/certificates/manage-certificates.md
+++ b/content/nginx-one/nginx-configs/certificates/manage-certificates.md
@@ -34,7 +34,7 @@ From the NGINX One Console you can:
 
 You can manage the certificates for:
 
-- [Unique instances]({{< ref "/nginx-one/nginx-configs/add-file.md#new-ssl-certificate-or-ca-bundle" >}})
+- [Unique instances]({{< ref "/nginx-one/nginx-configs/one-instance/add-file.md#new-ssl-certificate-or-ca-bundle" >}})
 - For all instances that are members of a [Config Sync Group]({{< ref "/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups/#configuration-management" >}})
 
 
@@ -195,4 +195,4 @@ To convert these cerificates to managed, start with the Certificates menu, and s
 
 - [Create and manage data plane keys]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
 - [Add an instance]({{< ref "/nginx-one/connect-instances/add-instance.md" >}})
-- [Add a file in a configuration]({{< ref "/nginx-one/nginx-configs/add-file.md" >}})
\ No newline at end of file
+- [Add a file in a configuration]({{< ref "/nginx-one/nginx-configs/one-instance/add-file.md" >}})
diff --git a/content/nginx-one/metrics/_index.md b/content/nginx-one/nginx-configs/metrics/_index.md
similarity index 100%
rename from content/nginx-one/metrics/_index.md
rename to content/nginx-one/nginx-configs/metrics/_index.md
diff --git a/content/nginx-one/metrics/enable-metrics.md b/content/nginx-one/nginx-configs/metrics/enable-metrics.md
similarity index 100%
rename from content/nginx-one/metrics/enable-metrics.md
rename to content/nginx-one/nginx-configs/metrics/enable-metrics.md
diff --git a/content/nginx-one/metrics/review-metrics.md b/content/nginx-one/nginx-configs/metrics/review-metrics.md
similarity index 100%
rename from content/nginx-one/metrics/review-metrics.md
rename to content/nginx-one/nginx-configs/metrics/review-metrics.md
diff --git a/content/nginx-one/nginx-configs/one-instance/_index.md b/content/nginx-one/nginx-configs/one-instance/_index.md
new file mode 100644
index 000000000..6577c95a0
--- /dev/null
+++ b/content/nginx-one/nginx-configs/one-instance/_index.md
@@ -0,0 +1,6 @@
+---
+description:
+title: Manage a single NGINX instance
+weight: 300
+url: /nginx-one/nginx-configs/one-instance
+---
diff --git a/content/nginx-one/nginx-configs/add-file.md b/content/nginx-one/nginx-configs/one-instance/add-file.md
similarity index 100%
rename from content/nginx-one/nginx-configs/add-file.md
rename to content/nginx-one/nginx-configs/one-instance/add-file.md
diff --git a/content/nginx-one/nginx-configs/view-edit-nginx-configurations.md b/content/nginx-one/nginx-configs/one-instance/view-edit-nginx-configurations.md
similarity index 95%
rename from content/nginx-one/nginx-configs/view-edit-nginx-configurations.md
rename to content/nginx-one/nginx-configs/one-instance/view-edit-nginx-configurations.md
index f775520f8..5ad4ab137 100644
--- a/content/nginx-one/nginx-configs/view-edit-nginx-configurations.md
+++ b/content/nginx-one/nginx-configs/one-instance/view-edit-nginx-configurations.md
@@ -24,7 +24,7 @@ To view and edit an NGINX configuration, follow these steps:
 6. When you are satisfied with the changes, select **Next**.
 7. Compare and verify your changes before selecting **Save and Publish** to publish the edited configuration.
 
-Alternatively, you can select **Save Changes As**. In the window that appears, you can set up this instance as a [**Staged Configuration**]({{< ref "/nginx-one/staged-configs/_index.md" >}}).
+Alternatively, you can select **Save Changes As**. In the window that appears, you can set up this instance as a [**Staged Configuration**]({{< ref "/nginx-one/nginx-configs/staged-configs/_index.md" >}}).
 
 ## See also
 
diff --git a/content/nginx-one/staged-configs/_index.md b/content/nginx-one/nginx-configs/staged-configs/_index.md
similarity index 100%
rename from content/nginx-one/staged-configs/_index.md
rename to content/nginx-one/nginx-configs/staged-configs/_index.md
diff --git a/content/nginx-one/staged-configs/add-staged-config.md b/content/nginx-one/nginx-configs/staged-configs/add-staged-config.md
similarity index 100%
rename from content/nginx-one/staged-configs/add-staged-config.md
rename to content/nginx-one/nginx-configs/staged-configs/add-staged-config.md
diff --git a/content/nginx-one/staged-configs/api-staged-config.md b/content/nginx-one/nginx-configs/staged-configs/api-staged-config.md
similarity index 100%
rename from content/nginx-one/staged-configs/api-staged-config.md
rename to content/nginx-one/nginx-configs/staged-configs/api-staged-config.md
diff --git a/content/nginx-one/staged-configs/edit-staged-config.md b/content/nginx-one/nginx-configs/staged-configs/edit-staged-config.md
similarity index 100%
rename from content/nginx-one/staged-configs/edit-staged-config.md
rename to content/nginx-one/nginx-configs/staged-configs/edit-staged-config.md
diff --git a/content/nginx-one/staged-configs/import-export-staged-config.md b/content/nginx-one/nginx-configs/staged-configs/import-export-staged-config.md
similarity index 97%
rename from content/nginx-one/staged-configs/import-export-staged-config.md
rename to content/nginx-one/nginx-configs/staged-configs/import-export-staged-config.md
index 68993ee99..7dee6a257 100644
--- a/content/nginx-one/staged-configs/import-export-staged-config.md
+++ b/content/nginx-one/nginx-configs/staged-configs/import-export-staged-config.md
@@ -26,7 +26,7 @@ Before you import or export a Staged Configuration to NGINX One Console, ensure:
 
 - You have an NGINX One Console account with staged configuration permissions.
 
-You can also import, export, and manage multiple Staged Configurations through [the API]({{< ref "/nginx-one/staged-configs/api-staged-config.md" >}}).
+You can also import, export, and manage multiple Staged Configurations through [the API]({{< ref "/nginx-one/nginx-configs/staged-configs/api-staged-config.md" >}}).
 
 ## Considerations
 
diff --git a/go.mod b/go.mod
index c1e7a06d4..a026366c2 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/nginxinc/docs
 
 go 1.19
 
-require github.com/nginxinc/nginx-hugo-theme v0.43.4 // indirect
+require github.com/nginxinc/nginx-hugo-theme v0.43.5 // indirect
diff --git a/go.sum b/go.sum
index 25b6ee5e3..22a5ad0ff 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,4 @@
 github.com/nginxinc/nginx-hugo-theme v0.43.4 h1:fnUGTcpR/pwwgBIy2dv0fOkeT++cqv1T6G1LKqQRAFg=
 github.com/nginxinc/nginx-hugo-theme v0.43.4/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
+github.com/nginxinc/nginx-hugo-theme v0.43.5 h1:OCsB4Y5mWN0fDzev+rie62zVXciR89vgsQ5Ss8mxUn8=
+github.com/nginxinc/nginx-hugo-theme v0.43.5/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=

From 469dd7efb6e53a9dc0e2f061e8e09c7845b161b0 Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Fri, 4 Jul 2025 10:12:31 +0100
Subject: [PATCH 094/117] feat: Update repo READMEs and affected files (#783)

This commit removes the CHANGELOG file from the repository, as it was
not being used. The README and CONTRIBUTING files have been streamlined,
and now more accurately reflect the user flow when contributing.

Some GitHub templates have been updated to reflect these changes, and
also include relative links instead of axiomatic blobs, which will make
finding and updating links easier in the future.
---
 .github/ISSUE_TEMPLATE/1-feature_request.md |  2 +-
 .github/ISSUE_TEMPLATE/2-bug_report.md      |  2 +-
 .github/pull_request_template.md            |  6 +--
 CHANGELOG.md                                |  5 ---
 CONTRIBUTING.md                             | 37 ++++++++--------
 README.md                                   | 15 +++----
 documentation/writing-hugo.md               | 48 ++++++++-------------
 7 files changed, 44 insertions(+), 71 deletions(-)
 delete mode 100644 CHANGELOG.md

diff --git a/.github/ISSUE_TEMPLATE/1-feature_request.md b/.github/ISSUE_TEMPLATE/1-feature_request.md
index a0b4c03f7..8b2820beb 100644
--- a/.github/ISSUE_TEMPLATE/1-feature_request.md
+++ b/.github/ISSUE_TEMPLATE/1-feature_request.md
@@ -2,7 +2,7 @@
 name: Feature request
 about: Suggest an idea for this project
 title: ""
-labels: ""
+labels: "enhancement"
 assignees: ""
 ---
 
diff --git a/.github/ISSUE_TEMPLATE/2-bug_report.md b/.github/ISSUE_TEMPLATE/2-bug_report.md
index 1d3d925c4..12a6c787b 100644
--- a/.github/ISSUE_TEMPLATE/2-bug_report.md
+++ b/.github/ISSUE_TEMPLATE/2-bug_report.md
@@ -2,7 +2,7 @@
 name: Bug report
 about: Create a report to help us improve
 title: ""
-labels: ""
+labels: "bug"
 assignees: ""
 ---
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 113d884bf..47978539f 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -26,10 +26,10 @@ Before merging a pull request, run through this checklist and mark each as compl
 - [ ] I have rebased my branch onto main
 - [ ] I have ensured my PR is targeting the main branch and pulling from my branch from my own fork
 - [ ] I have ensured that the commit messages adhere to [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary)
-- [ ] I have ensured that documentation content adheres to [the style guide](https://github.com/nginx/documentation/blob/main/templates/style-guide.md)
+- [ ] I have ensured that documentation content adheres to [the style guide](/documentation/style-guide.md)
 - [ ] If the change involves potentially sensitive changes[^1], I have assessed the possible impact
 - [ ] If applicable, I have added tests that prove my fix is effective or that my feature works
 - [ ] I have ensured that existing tests pass after adding my changes
-- [ ] If applicable, I have updated [`README.md`](https://github.com/nginx/documentation/blob/main/README.md) and [`CHANGELOG.md`](https://github.com/nginx/documentation/blob/main/CHANGELOG.md)
+- [ ] If applicable, I have updated [`README.md`](/README.md)
 
-[^1]: Potentially sensitive changes include anything involving code, personally identify information (PII), live URLs or significant amounts of new or revised documentation. Please refer to [our style guide](https://github.com/nginx/documentation/blob/main/templates/style-guide.md) for guidance about placeholder content.
\ No newline at end of file
+[^1]: Potentially sensitive changes include anything involving code, personally identify information (PII), live URLs or significant amounts of new or revised documentation. Please refer to [our style guide](/documentation/style-guide.md) for guidance about placeholder content.
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
deleted file mode 100644
index b65b17fe4..000000000
--- a/CHANGELOG.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Changelog
-
-## 1.0.0 (January 13, 2025)
-
-Initial open source release of the documentation repository for enterprise NGINX products. This is a filtered mirror of an internal repository.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dfd79c0d4..7a0af1f48 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,38 +1,36 @@
 # Contributing guidelines
 
-The following is a set of guidelines for community contributions to this project.
-
-We really appreciate your desire to contribute!
+The following are a set of guidelines for contributing to this project. We appreciate your desire to get involved!
 
 If you are an F5 employee, see the following additional guidance on [Maintainers etiquette](/documentation/maintainers-etiquette.md).
 
 ## Table of contents
 
-- [Report a Bug](#report-a-bug)
-- [Suggest a Feature or Enhancement](#suggest-a-feature-or-enhancement)
-- [Open a Discussion](#open-a-discussion)
+- [Create an issue](#create-an-issue)
+- [Start a discussion](#start-a-discussion)
 - [Submit a pull request](#submit-a-pull-request)
-- [Issue Lifecycle](#issue-lifecycle)
+- [Issue lifecycle](#issue-lifecycle)
 - [Additional NGINX documentation](#additional-nginx-documentation)
 - [F5 Contributor License Agreement (CLA)](#f5-contributor-license-agreement)
 
-## Report a bug
+## Create an issue
+
+One way to contribute to the project is by [creating an issue](https://github.com/nginx/documentation/issues/new/choose).
+
+The two most common are enhancements and bug reports. When using the issue templates, they will be automatically labelled.
+
+- An enhancement is an improvement of some kind, such as a new document or additional detail for a product feature
+- A bug report draws attention to an issue in documentation, such as an incorrect command or outdated information
 
-To report a bug, open an issue on GitHub with the label `bug` using the
-available bug report issue template. Before reporting a bug, make sure the
-issue has not already been reported.
+Before creating an issue, please check there is [no existing issue](https://github.com/nginx/documentation/issues?q=is%3Aissue) for the topic.
 
-## Suggest a feature or enhancement
+We encourage discussions within issues, since they act as a source of contextual truth and are linked to pull requests.
 
-To suggest a feature or enhancement, open an issue on GitHub with the label
-`feature` or `enhancement` using the available feature request issue template.
-Please ensure the feature or enhancement has not already been suggested.
+## Start a discussion
 
-## Open a Discussion
+We encourage you to use [GitHub Discussions](https://github.com/nginx/documentation/discussions) for conversations with the community and maintainers.
 
-If you want to start a conversation with the community and maintainers,
-we encourage you to use
-[GitHub Discussions](https://github.com/nginx/documentation/discussions).
+If you'd like to discuss something NGINX-related that doesn't involve documentation, you should go to the [NGINX Community Forum](https://community.nginx.org/). 
 
 ## Submit a pull request
 
@@ -66,7 +64,6 @@ This repository does not include all of the source content for the NGINX documen
 - [NGINX Open Source](https://github.com/nginx/nginx) - source for [NGINX changelog](https://nginx.org/en/CHANGES)
 - [nginx.org](https://github.com/nginx/nginx.org) - source for https://nginx.org
 - [NGINX Unit](https://github.com/nginx/unit) - source for https://unit.nginx.org
-- [NGINX Ingress Controller](https://github.com/nginxinc/kubernetes-ingress/) - source for https://docs.nginx.com/nginx-ingress-controller
 
 In those repositories, you can find documentation source code in the `docs` or `site` subdirectories.
 
diff --git a/README.md b/README.md
index 6143086f8..32acb02de 100644
--- a/README.md
+++ b/README.md
@@ -4,25 +4,21 @@
 [![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](https://github.com/nginxinc/template-repository/main/CODE_OF_CONDUCT.md)
 ![Commercial Support](https://badgen.net/badge/support/commercial/green?icon=awesome)
 
-<!-- These are the "repo [status badge](https://www.repostatus.org/)s" and the community support badges -->
-
 # NGINX documentation
 
+This repository contains the user documentation for NGINX's products, as well as the requirements to build and publish the documentation website.
+
+Documentation is written in [Markdown](https://daringfireball.net/projects/markdown/basics), then transformed into HTML using the [Hugo](https://gohugo.io/) static site generator.
+
 If you want to contribute to [F5 NGINX documentation](https://docs.nginx.com), you've come to the right place. We've organized a series of README-type files to help you get started:
 
 - [Contributing](/CONTRIBUTING.md) describes how you can contribute to our documentation.
-  - [Contributing guidelines for experts](/CONTRIBUTING_DOCS.md) describes how you can contribute (and check your work) with Hugo, our static site generator
 - [Code of Conduct](/CODE_OF_CONDUCT.md) describes expectations in the NGINX open source community.
 - [License](/LICENSE) shows the license associated with work on this repository.
 - [Security](/SECURITY.md) describes the procedures we would like you to follow if you find a security issue.
 - [Support](/SUPPORT.md) lists how you can get support as a customer or a community member.
 
-## Explanation
-
-This repository contains user documentation for NGINX's products, as well as the requirements for linting, building, and publishing the documentation.
-
-Our documentation is written in Markdown, specifically the [Goldmark](https://github.com/yuin/goldmark) Markdown parser.
-We build our docs using [Hugo](https://gohugo.io) and host them in custom URLs on Azure.
+You may also find the [documentation folder](/documentation/) for the repository interesting: it's where we store our process information.
 
 ## License
 
@@ -30,7 +26,6 @@ We build our docs using [Hugo](https://gohugo.io) and host them in custom URLs o
 
 &copy; [F5, Inc.](https://www.f5.com/) 2025
 
-
 ## Credits
 
 - [The Good Docs Project](https://www.thegooddocsproject.dev/), whose templates we've adapted for our use.
diff --git a/documentation/writing-hugo.md b/documentation/writing-hugo.md
index 1997a3ad0..00f7d6448 100644
--- a/documentation/writing-hugo.md
+++ b/documentation/writing-hugo.md
@@ -4,50 +4,35 @@ This page describes our guidelines on using [Hugo](https://gohugo.io/) to write
 
 You will need [git](https://git-scm.com/) to interact with the repository and files: the content itself is written in Markdown.
 
-Our workflow is to develop content locally, then submit a pull request once we've done our initial draft and editing passes.
+Our workflow is to develop content locally, then [submit a pull request](/documentation/git-conventions.md) once we've done our initial draft and editing passes.
 
 For guidance around how to write content, please check [the style guide](/documentation/style-guide.md).
 
 ## Setup
 
-You will need to install Hugo _or_ Docker to build and preview docs in your local development environment.
+You will need to install Hugo _or_ Docker to build or preview documentation in your local development environment.
 
-Read the [Hugo installation instructions](https://gohugo.io/getting-started/installing/) for more information.
+Read the [Hugo installation instructions](https://gohugo.io/getting-started/installing/) for more information: we are currently running [Hugo v0.147.8](https://github.com/gohugoio/hugo/releases/tag/v0.147.8) in production.
 
 If you have [Docker](https://www.docker.com/get-started/) installed, there are fallbacks for all requirements in the [Makefile](Makefile), meaning you don't need to install them.
 
-- [Installing Hugo](https://gohugo.io/getting-started/installing/)
-  - **NOTE**: We are currently running [Hugo v0.147.8](https://github.com/gohugoio/hugo/releases/tag/v0.147.8) in production.
-- [Installing markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli?tab=readme-ov-file#installation)
-- [Installing markdown-link-check](https://github.com/tcort/markdown-link-check?tab=readme-ov-file#installation)
+## Build the documentation locally
 
-The configuration files are as follows:
-
-- *Hugo*: `config/default/config.toml`
-- *markdownlint-cli*: `.markdownlint.json`
-- *markdown-link-check* `md-linkcheck-config.json`
-
-## Develop documentation locally
-
-To build the documentation website locally, use the `make` command in the documentation folder. 
-
-First ensure you have the latest version of the Hugo theme with:
+To build the website locally, first ensure you have the latest version of the Hugo theme with:
 
 `make hugo-update`
 
-Once you've updated the theme, you can use these targets:
+You can then use the other `make` commands: *watch* is most commmon when working on documentation.
 
 | Target              | Description                                                                 |
 | ------------------- | --------------------------------------------------------------------------- |
 | _make watch_        | Runs a local Hugo server, allowing for changes to be previewed in a browser. |
 | _make drafts_       | Runs a local Hugo server, rendering documents marked with `draft: true` in their metadata.|
-| _make docs_          | Builds the documentation in the local `public/` directory. |
-| _make clean_         | Removes the local `public` directory |
-| _make hugo-get_      | Updates the go module file with the latest version of the theme. |
-| _make hugo-tidy_     | Removes unnecessary dependencies from the go module file. |
-| _make hugo-update_   | Runs the hugo-get and hugo-tidy targets in sequence. |
-| _make lint-markdown_ | Runs [markdownlint](https://github.com/DavidAnson/markdownlint) on the content folder. |
-| _make link-check_    | Runs [markdown-link-check](https://github.com/tcort/markdown-link-check) on all Markdown files. |
+| _make docs_         | Builds the documentation in the local `public/` directory. |
+| _make clean_        | Removes the local `public` directory |
+| _make hugo-get_     | Updates the go module file with the latest version of the theme. |
+| _make hugo-tidy_    | Removes unnecessary dependencies from the go module file. |
+| _make hugo-update_  | Runs the hugo-get and hugo-tidy targets in sequence. |
 
 ## Add new documentation
 
@@ -67,9 +52,10 @@ This new page will be created with the default how-to archetype. To use a specif
 
 Our archetypes [currently include](/archetypes/) the following:
 
-- `default` (How-to instructions, general use)
-- `concept`(An explanation of one implementation detail and some use cases)
-- `tutorial` (An in-depth set of how-to instructions, referencing concepts)
+- `default` - How-to instructions, general use
+- `concept` - An explanation of one implementation detail and some use cases
+- `tutorial` - An in-depth set of how-to instructions, referencing concepts
+- `landing-page` - A special archetype for the landing page of a documentation set, with a unique layout
 
 These archetypes are adapted from some existing [templates](/templates/): please [file an issue](https://github.com/nginx/documentation/issues/new?template=1-feature_request.md) if you would like a new archetype.
 
@@ -165,11 +151,11 @@ An example of this can be seen in [/content/ngf/get-started.md](https://github.c
 Use the `img` shortcode to add images to documentation pages. It has the same parameters as the Hugo [figure shortcode](https://gohugo.io/content-management/shortcodes/#figure).
 
 1. Add the image to the `/static/img` directory.
-1. Add the `img` shortcode:
+2. Add the `img` shortcode:
   - `{{< img src="<img-file.png>" alt="<Alternative text>">}}`
   - Do not include a forward slash at the beginning of the file path or it will [break the image](https://gohugo.io/functions/relurl/#input-begins-with-a-slash).
 
-> **Important**: We have strict guidelines for using images. Review them in our [style guide](/templates/style-guide.md#guidelines-for-screenshots).
+> **Important**: We have strict guidelines for using images. Review them in our [style guide](/documentation/style-guide.md#guidelines-for-screenshots).
 
 
 ### How to use Hugo includes

From b59028c48e4ab43823331ed3128d12df6bc6f8b1 Mon Sep 17 00:00:00 2001
From: Dani De Leo <d.deleo@f5.com>
Date: Mon, 7 Jul 2025 07:00:41 -0400
Subject: [PATCH 095/117] chore: config.toml deprecation fixes (#789)

Addresses deprecration notices that were introduced with recent
Hugo version updates
---
 config/_default/config.toml   | 26 +++++++++++++-------------
 config/production/config.toml |  2 +-
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/config/_default/config.toml b/config/_default/config.toml
index faf409f46..54c29d430 100644
--- a/config/_default/config.toml
+++ b/config/_default/config.toml
@@ -7,19 +7,19 @@ pygmentsUseClasses = true
 enableGitInfo = true
 
 [permalinks]
-  agent = '/nginx-agent/:sections[1:]/:filename'
-  amplify = '/nginx-amplify/:sections[1:]/:filename'
-  controller = '/nginx-controller/:sections[1:]/:filename'
-  mesh = '/nginx-service-mesh/:sections[1:]/:filename'
-  modsec-waf = '/nginx-waf/:sections[1:]/:filename'
-  nap-dos = '/nginx-app-protect-dos/:sections[1:]/:filename'
-  nap-waf = '/nginx-app-protect-waf/:sections[1:]/:filename'
-  nginxaas = '/nginxaas/azure/:sections[1:]/:filename'
-  ngf = '/nginx-gateway-fabric/:sections[1:]/:filename'
-  nic = '/nginx-ingress-controller/:sections[1:]/:filename'
-  nim = '/nginx-instance-manager/:sections[1:]/:filename'
-  nms = '/nginx-management-suite/:sections[1:]/:filename'
-  unit = '/nginx-unit/:sections[1:]/:filename'
+  agent = '/nginx-agent/:sections[1:]/:contentbasename'
+  amplify = '/nginx-amplify/:sections[1:]/:contentbasename'
+  controller = '/nginx-controller/:sections[1:]/:contentbasename'
+  mesh = '/nginx-service-mesh/:sections[1:]/:contentbasename'
+  modsec-waf = '/nginx-waf/:sections[1:]/:contentbasename'
+  nap-dos = '/nginx-app-protect-dos/:sections[1:]/:contentbasename'
+  nap-waf = '/nginx-app-protect-waf/:sections[1:]/:contentbasename'
+  nginxaas = '/nginxaas/azure/:sections[1:]/:contentbasename'
+  ngf = '/nginx-gateway-fabric/:sections[1:]/:contentbasename'
+  nic = '/nginx-ingress-controller/:sections[1:]/:contentbasename'
+  nim = '/nginx-instance-manager/:sections[1:]/:contentbasename'
+  nms = '/nginx-management-suite/:sections[1:]/:contentbasename'
+  unit = '/nginx-unit/:sections[1:]/:contentbasename'
 
 [caches]
   [caches.modules]
diff --git a/config/production/config.toml b/config/production/config.toml
index b367a4d63..f6b653af3 100644
--- a/config/production/config.toml
+++ b/config/production/config.toml
@@ -11,7 +11,7 @@ enableGitInfo = true
     useSessionStorage = false
   [privacy.instagram]
     disable = true
-  [privacy.twitter]
+  [privacy.x]
     disable = false
     enableDNT = true
     simple = false

From c2d0d232537d77cbc39e317ae33ed95425797501 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Jul 2025 12:01:21 +0100
Subject: [PATCH 096/117] build(deps): bump github/codeql-action from 3.29.1 to
 3.29.2 (#790)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.1 to 3.29.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/39edc492dbe16b1465b0cafca41432d857bdb31a...181d5eefc20863364f96762470ba6f862bdef56b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 .github/workflows/ossf_scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf_scorecard.yml b/.github/workflows/ossf_scorecard.yml
index fa55428c4..864924b3a 100644
--- a/.github/workflows/ossf_scorecard.yml
+++ b/.github/workflows/ossf_scorecard.yml
@@ -56,6 +56,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload SARIF results to code scanning
-        uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: results.sarif

From f5dc72ab47adb81b822c88fb37db2a34366790d8 Mon Sep 17 00:00:00 2001
From: Lam <150060045+lamATnginx@users.noreply.github.com>
Date: Mon, 7 Jul 2025 04:03:01 -0700
Subject: [PATCH 097/117] feat: Remove call-out shortcode from documentation
 (#781)

Remove call-out shortcode from documentation repository
---
 layouts/shortcodes/call-out.html | 3 ---
 1 file changed, 3 deletions(-)
 delete mode 100644 layouts/shortcodes/call-out.html

diff --git a/layouts/shortcodes/call-out.html b/layouts/shortcodes/call-out.html
deleted file mode 100644
index d8e591d83..000000000
--- a/layouts/shortcodes/call-out.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<blockquote class="{{ .Get 0 }}">
-  <div><strong>{{ .Get 1 }}</strong><br/>{{ .Inner | markdownify }}</div>
-</blockquote>

From bc55551602b78decd3d0a16fa75676461bd1dc19 Mon Sep 17 00:00:00 2001
From: bjee19 <139261241+bjee19@users.noreply.github.com>
Date: Mon, 7 Jul 2025 10:44:30 -0700
Subject: [PATCH 098/117] Update NGF docs to use kubectl server side apply
 (#787)

Switch to using kubectl server side apply for NGF CRDs and add a troubleshooting section addressing the problem and solution.

Problem: We were running into issues using the standard kubectl client side apply on our growing CRDs

Solution: Switched to using kubectl server side apply.

Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 content/ngf/install/manifests.md       |  4 ++--
 content/ngf/install/upgrade-version.md |  4 ++--
 content/ngf/troubleshooting.md         | 15 +++++++++++++++
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/content/ngf/install/manifests.md b/content/ngf/install/manifests.md
index 59ca928b5..af8324f4b 100644
--- a/content/ngf/install/manifests.md
+++ b/content/ngf/install/manifests.md
@@ -54,13 +54,13 @@ Deploying NGINX Gateway Fabric with Kubernetes manifests takes only a few steps.
 #### Stable release
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
+kubectl apply --server-side -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
 ```
 
 #### Edge version
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/main/deploy/crds.yaml
+kubectl apply --server-side -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/main/deploy/crds.yaml
 ```
 
 ### Deploy NGINX Gateway Fabric
diff --git a/content/ngf/install/upgrade-version.md b/content/ngf/install/upgrade-version.md
index fedadffe0..45b4fa3fd 100644
--- a/content/ngf/install/upgrade-version.md
+++ b/content/ngf/install/upgrade-version.md
@@ -53,7 +53,7 @@ kubectl kustomize "https://github.com/nginx/nginx-gateway-fabric/config/crd/gate
 Run the following command to upgrade the CRDs:
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
+kubectl apply --server-side -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
 ```
 
 {{< note >}}
@@ -157,7 +157,7 @@ For customization options during the Helm installation process, view the [Instal
 Apply the new CRDs with the following command:
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
+kubectl apply --server-side -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
 ```
 
 Next, install the latest stable release of NGINX Gateway Fabric in the `nginx-gateway` namespace with the following command:
diff --git a/content/ngf/troubleshooting.md b/content/ngf/troubleshooting.md
index 86705512c..90387ec6b 100644
--- a/content/ngf/troubleshooting.md
+++ b/content/ngf/troubleshooting.md
@@ -512,6 +512,21 @@ It indicates that `proxy_protocol` is enabled for the gateway listeners, but the
 
 - Send valid proxy information with requests being handled by your application.
 
+#### Custom Resource Definition is invalid due to being too large 
+
+If you apply the NGINX Gateway Fabric CRDs and see the following error:
+
+```text
+The CustomResourceDefinition "nginxproxies.gateway.nginx.org" is invalid: metadata.annotations: Too long: may not be more than 262144 bytes
+```
+
+This is a known issue with Kubernetes, more specifically the client-side-apply annotation limit with kubectl, and our recommended workaround 
+is to use kubectl's server-side apply when installing the NGINX Gateway Fabric CRDs. To do this, you can use the `--server-side` flag when applying the CRDs:
+
+```shell
+kubectl apply --server-side -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{{< version-ngf >}}/deploy/crds.yaml
+```
+
 ### See also
 
 You can view the [Kubernetes Troubleshooting Guide](https://kubernetes.io/docs/tasks/debug/debug-application/) for more debugging guidance.

From a9f506a1790ee2ef0c2a24cbf4f85f5971bb69f2 Mon Sep 17 00:00:00 2001
From: nginx-seanmoloney <133861979+nginx-seanmoloney@users.noreply.github.com>
Date: Tue, 8 Jul 2025 09:29:33 +0100
Subject: [PATCH 099/117] Update agent banner text (#791)

Update agent banner note
---
 _banners/agent-v3-release.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/_banners/agent-v3-release.md b/_banners/agent-v3-release.md
index 9c42a7e6a..cc5183ce1 100644
--- a/_banners/agent-v3-release.md
+++ b/_banners/agent-v3-release.md
@@ -1,7 +1,7 @@
 {{< banner "notice" "NGINX Agent 3.0 is now available" >}}
 
 
-F5 NGINX One Console and NGINX Instance Manager (NIM) do not currently support Agent 3.x. If you are using NGINX One Console or NGINX Instance Manager in your environment, upgrade to the latest Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
+F5 NGINX Instance Manager (NIM) does not currently support Agent 3.x. NGINX Instance Manager customers can upgrade to the latest Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
 
 Please see the [Technical specifications](/nginx-agent/technical-specifications/) for product compatibility.
 

From 770121529d709e8f20fd3404aef10076c0839d29 Mon Sep 17 00:00:00 2001
From: nginx-seanmoloney <133861979+nginx-seanmoloney@users.noreply.github.com>
Date: Tue, 8 Jul 2025 09:55:42 +0100
Subject: [PATCH 100/117] Update NGINX Agent container instructions (#793)

---
 content/nginx-one/agent/containers/run-agent-container.md | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/content/nginx-one/agent/containers/run-agent-container.md b/content/nginx-one/agent/containers/run-agent-container.md
index 6a79f2d03..e902de08b 100644
--- a/content/nginx-one/agent/containers/run-agent-container.md
+++ b/content/nginx-one/agent/containers/run-agent-container.md
@@ -29,13 +29,10 @@ container image and create a configuration file.
 
 ### Pull the NGINX Agent container image
 
-The NGINX Agent container image must be downloaded from a trusted source such as Docker Hub or a private container registry.
-
 Run the following command to pull the official image:
 
 ```bash
-<!-- Registry HERE -->
-docker pull <Registry HERE>:latest
+docker pull private-registry.nginx.com/nginx-plus/agentv3:latest
 ```
 
 Ensure you are using the correct image version. Replace `latest` with the desired version tag if necessary.

From 0349e44a2b75f1a32d46ada85d6f573a1232fdff Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Tue, 8 Jul 2025 12:01:13 +0100
Subject: [PATCH 101/117] fix: add v2 v3 docker pull steps (#786)

* fix: add v2 v3 docker pull steps

* fix: fix variable anme

* fix: clarification

---------

Co-authored-by: Alan Dooley <a.dooley@f5.com>
---
 ...t-nginx-plus-container-images-to-nginx-one.md | 10 +++++-----
 .../manage-config-sync-groups.md                 |  7 +------
 .../installing-nginx/installing-nginx-docker.md  | 16 ++++++++++++++--
 3 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md b/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
index ffac51180..5f4d251b5 100644
--- a/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
+++ b/content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md
@@ -42,13 +42,13 @@ sudo docker login private-registry.nginx.com --username=YOUR_JWT_HERE --password
 
 ### Pull the NGINX Plus image
 
-Pull the NGINX Plus image from the private registry. Replace `VERSION_TAG` with the desired version, such as `alpine`, `debian`, or `ubi`.
+Pull the NGINX Plus image from the private registry. Replace `<version-tag>` with the desired version, such as `alpine`, `debian`, or `ubi`.
 
 ```sh
-sudo docker pull private-registry.nginx.com/nginx-plus/agent:VERSION_TAG
+docker pull private-registry.nginx.com/nginx-plus/agentv3:<version-tag>
 ```
 
-You must specify a version tag. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}) guide.
+You must specify a version tag that matches your distribution. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}) guide.
 
 <br>
 
@@ -62,7 +62,7 @@ sudo docker pull private-registry.nginx.com/nginx-plus/agent:debian
 
 ### Start the NGINX Plus container
 
-Start the Docker container to connect it to NGINX One. Replace `YOUR_NGINX_ONE_DATA_PLANE_KEY_HERE` with your data plane key and `VERSION_TAG` with the version tag you pulled.
+Start the Docker container to connect it to NGINX One. Replace `YOUR_NGINX_ONE_DATA_PLANE_KEY_HERE` with your data plane key and `version-tag` with the version tag you pulled.
 
 **For NGINX Plus R33 or later**:
 
@@ -79,7 +79,7 @@ sudo docker run \
 --env=NGINX_AGENT_TLS_ENABLE=true \
 --restart=always \
 --runtime=runc \
--d private-registry.nginx.com/nginx-plus/agent:<VERSION_TAG>
+-d private-registry.nginx.com/nginx-plus/agent:<version-tag>
 ```
 
 <br>
diff --git a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
index 47cd6a28e..5db71008b 100644
--- a/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
+++ b/content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md
@@ -162,14 +162,9 @@ When adding a new NGINX instance that is not yet registered with NGINX One, you
    - From the **OS Type** list, choose the appropriate operating system for your Docker image.
    - After selecting the OS, run the provided command to pull the Docker image.
 
-   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
+   **Note**: Subject to availability, you can modify the `agentv3:<version-tag>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agentv3:r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
 
 
-   - From the **OS Type** list, choose the appropriate operating system for your Docker image.
-   - After selecting the OS, run the provided command to pull the Docker image.
-
-   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
-
 10. Run the provided command, which includes the data plane key, in your NGINX instance terminal to start the Docker container.
 
 11. Select **Done** to complete the process.
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
index 31c02eebe..b47f900e3 100644
--- a/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
+++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md
@@ -156,24 +156,36 @@ For NGINX Plus, run:
 docker pull private-registry.nginx.com/nginx-plus/base:<version-tag>
 ```
 
-For NGINX Plus with NGINX Agent, run:
+For NGINX Plus with NGINX Agent version 2, run:
 
 ```shell
 docker pull private-registry.nginx.com/nginx-plus/agent:<version-tag>
 ```
 
+For NGINX Plus with NGINX Agent version 3, run:
+
+```shell
+docker pull private-registry.nginx.com/nginx-plus/agentv3:<version-tag>
+```
+
 For NGINX Plus installed from `nginx` user (rootless installation), run:
 
 ```shell
 docker pull private-registry.nginx.com/nginx-plus/rootless-base:<version-tag>
 ```
 
-For NGINX Plus with NGINX Agent installed from `nginx` user (rootless installation), run:
+For NGINX Plus with NGINX Agent version 2 installed from `nginx` user (rootless installation), run:
 
 ```shell
 docker pull private-registry.nginx.com/nginx-plus/rootless-agent:<version-tag>
 ```
 
+For NGINX Plus with NGINX Agent version 3 installed from `nginx` user (rootless installation), run:
+
+```shell
+docker pull private-registry.nginx.com/nginx-plus/rootless-agentv3:<version-tag>
+```
+
 For NGINX modules, run:<!-- Is this enough info?-->
 
 ```shell

From d809970ff02cee17ddf870dd5d858e0cbcfebdff Mon Sep 17 00:00:00 2001
From: nginx-seanmoloney <133861979+nginx-seanmoloney@users.noreply.github.com>
Date: Tue, 8 Jul 2025 12:25:09 +0100
Subject: [PATCH 102/117] feat: Update Agent about page to reflect correct
 behaviour. (#794)

Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com>
---
 content/includes/agent/about.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/includes/agent/about.md b/content/includes/agent/about.md
index e23de8922..abca6d4bb 100644
--- a/content/includes/agent/about.md
+++ b/content/includes/agent/about.md
@@ -40,4 +40,4 @@ Additionally, it collects system-level data, including CPU usage, memory consump
 deep observability into NGINX's behavior, enabling teams to troubleshoot issues effectively, optimize performance, and
 maintain high availability.
 
-Collected metrics can be seamlessly exported to NGINX One Console or integrated with third-party data aggregators.
+By default, the OpenTelemetry Collector is configured to send metrics to NGINX One Console.
\ No newline at end of file

From 8f9152b6bdcd1fc23fcd828c4becc77ed8ed63a1 Mon Sep 17 00:00:00 2001
From: AlexFenlon <a.fenlon@f5.com>
Date: Tue, 8 Jul 2025 15:27:25 +0100
Subject: [PATCH 103/117] NGINX Ingress Controller Release 5.1.0 (#730)

* Add Rate Limit variable condition

* NIC 5.1.0 Release

* Apply suggestions from code review

Co-authored-by: Alan Dooley <a.dooley@f5.com>

* update tech specs

* Apply suggestions from code review

Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>

* Update content/nic/technical-specifications.md

---------

Co-authored-by: Paul Abel <p.abel@f5.com>
Co-authored-by: Alan Dooley <a.dooley@f5.com>
Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
---
 content/nic/configuration/policy-resource.md | 29 +++++++++++-
 content/nic/releases.md                      | 49 ++++++++++++++++++++
 content/nic/technical-specifications.md      |  9 ++--
 layouts/shortcodes/nic-helm-version.html     |  2 +-
 layouts/shortcodes/nic-operator-version.html |  2 +-
 layouts/shortcodes/nic-version.html          |  2 +-
 6 files changed, 85 insertions(+), 8 deletions(-)

diff --git a/content/nic/configuration/policy-resource.md b/content/nic/configuration/policy-resource.md
index 6b4fd7cde..00a928774 100644
--- a/content/nic/configuration/policy-resource.md
+++ b/content/nic/configuration/policy-resource.md
@@ -175,8 +175,14 @@ condition:
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 |``jwt`` | defines a JWT condition to rate limit against. | [ratelimit.condition.jwt](#ratelimitconditionjwt) | No |
-|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same JWT condition, only one policy can be the default. | ``bool`` | No |
+|``variables`` | defines a Variable condition to rate limit against. | [ratelimit.condition.variables](#ratelimitconditionvariables) | No |
+|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same condition, only one policy can be the default. | ``bool`` | No |
 {{% /table %}}
+{{< note >}}
+ 
+One condition of type `jwt` or `variables` is required. Each Policy supports only one condition.
+
+{{< /note >}}
 
 The rate limit policy with condition is designed to be used in combination with one or more rate limit policies. For example, multiple rate limit policies with [RateLimit.Condition.JWT](#ratelimitconditionjwt) can be used to apply different tiers of rate limit based on the value of a JWT claim. For a practical example of tiered rate limiting by the value of a JWT claim, see the example in our [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/rate-limit-tiered-jwt-claim/README.md).
 
@@ -213,6 +219,27 @@ The rate limit policy will only apply to requests that contain a JWT with the sp
 |``match`` | the value of the claim to match against. | ``string`` | Yes |
 {{% /table %}}
 
+### RateLimit.Condition.Variables
+
+RateLimit.Condition.Variables defines a condition for a rate limit by NGINX variable. The following example defines a condition for a rate limit policy that only applies to requests with the request method with a value `GET`:
+
+```yaml
+variables:
+  - name: $request_method
+    match: GET
+```
+
+{{< note >}}
+Only one variable at a time is supported at present.
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | the name of the NGINX variable to be rate limit by. | ``string`` | Yes |
+|``match`` | the value of the NGINX variable to match against.  Values prefixed with the `~` character denote the following is a [regular expression](https://nginx.org/en/docs/http/ngx_http_map_module.html#map).  | ``string`` | Yes |
+{{% /table %}}
+
 ### APIKey
 
 The API Key auth policy configures NGINX to authorize client requests based on the presence of a valid API Key in a header or query param specified in the policy.
diff --git a/content/nic/releases.md b/content/nic/releases.md
index cfed5b4ab..f3480f11a 100644
--- a/content/nic/releases.md
+++ b/content/nic/releases.md
@@ -5,6 +5,55 @@ toc: true
 nd-content-type: reference
 nd-product: NIC
 nd-docs: DOCS-616
+---
+## 5.1.0
+
+08 Jul 2025
+
+This release includes the ability to configure Rate Limiting for your APIs based on a specific NGINX variable and its value. This allows you more granular control over how frequently specific users access your resources.
+
+Lastly, in our previous v5.0.0 release, we removed support for Open Tracing. This release replaces that observability capability with native NGINX Open Telemetry traces, allowing you to monitor the internal traffic of your applications.
+
+### <i class="fa-solid fa-rocket"></i> Features
+- [7642](https://github.com/nginx/kubernetes-ingress/pull/7642) Add OpenTelemetry support
+- [7916](https://github.com/nginx/kubernetes-ingress/pull/7916) Add support for Agent V3
+- [7884](https://github.com/nginx/kubernetes-ingress/pull/7884) Tiered rate limits with variables
+- [7765](https://github.com/nginx/kubernetes-ingress/pull/7765) Add OIDC PKCE configuration through Policy
+- [7832](https://github.com/nginx/kubernetes-ingress/pull/7832) Add request_method to rate-limit Policy
+- [7695](https://github.com/nginx/kubernetes-ingress/pull/7695) Add ConfigMapKeys & MGMTConfigMapKeys to Telemetry
+- [7705](https://github.com/nginx/kubernetes-ingress/pull/7705) Add Context to logging for JSON and TEXT formats
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [7651](https://github.com/nginx/kubernetes-ingress/pull/7651) Use pod labels as headless selector labels
+- [7691](https://github.com/nginx/kubernetes-ingress/pull/7691) Avoid applying updates on Ingress Controller shutdown
+- [7748](https://github.com/nginx/kubernetes-ingress/pull/7748) Add ; in oidc files
+- [7786](https://github.com/nginx/kubernetes-ingress/pull/7786) Correct namespace for mgmt secrets
+- [7853](https://github.com/nginx/kubernetes-ingress/pull/7853) Update template for custom redirect URI
+- [7865](https://github.com/nginx/kubernetes-ingress/pull/7865) Maintain HeadlessService on upgrade
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [7647](https://github.com/nginx/kubernetes-ingress/pull/7647), [7666](https://github.com/nginx/kubernetes-ingress/pull/7666), [7711](https://github.com/nginx/kubernetes-ingress/pull/7711), [7767](https://github.com/nginx/kubernetes-ingress/pull/7767), [7798](https://github.com/nginx/kubernetes-ingress/pull/7798), [7824](https://github.com/nginx/kubernetes-ingress/pull/7824), [7854](https://github.com/nginx/kubernetes-ingress/pull/7854), [7900](https://github.com/nginx/kubernetes-ingress/pull/7900), [7918](https://github.com/nginx/kubernetes-ingress/pull/7918), [7926](https://github.com/nginx/kubernetes-ingress/pull/7926) Bump Go dependancies
+- [7714](https://github.com/nginx/kubernetes-ingress/pull/7714), [7788](https://github.com/nginx/kubernetes-ingress/pull/7788), [7825](https://github.com/nginx/kubernetes-ingress/pull/7825), [7855](https://github.com/nginx/kubernetes-ingress/pull/7855), [7890](https://github.com/nginx/kubernetes-ingress/pull/7890), [7888](https://github.com/nginx/kubernetes-ingress/pull/7888), [7893](https://github.com/nginx/kubernetes-ingress/pull/7893), [7903](https://github.com/nginx/kubernetes-ingress/pull/7903) Bump Docker dependencies
+- [7808](https://github.com/nginx/kubernetes-ingress/pull/7808) Update kubernetes version to v1.33.1 in helm schema
+- [7896](https://github.com/nginx/kubernetes-ingress/pull/7896) Update go version to 1.24.4
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 5.1.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=5.1.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 5.1.0 images from the F5 Container registry or build your own image using the 5.1.0 source code
+- For Helm, use version 2.2.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.33.
+
 ---
 ## 5.0.0
 
diff --git a/content/nic/technical-specifications.md b/content/nic/technical-specifications.md
index 7b690fd2f..794d5d818 100644
--- a/content/nic/technical-specifications.md
+++ b/content/nic/technical-specifications.md
@@ -19,7 +19,8 @@ We test NGINX Ingress Controller on a range of Kubernetes platforms for each rel
 {{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
 | NIC version | Kubernetes versions tested  | NIC Helm Chart version | NIC Operator version | NGINX / NGINX Plus version | End of Technical Support |
 | --- | --- | --- | --- | --- | --- |
-| {{< nic-version >}} | 1.25 - 1.32 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.4 / R34 | - |
+| {{< nic-version >}} | 1.25 - 1.33 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.5 / R34 P1 | - |
+| 5.0.0 | 1.25 - 1.32 | 2.1.0 | 3.1.0 | 1.27.4 / R34 | Apr 16, 2027 |
 | 4.0.1 | 1.25 - 1.32 | 2.0.1 | 3.0.1 | 1.27.4 / R33 P2 | Feb 7, 2027 |
 | 3.7.2 | 1.25 - 1.31 | 1.4.2 | 2.4.2 | 1.27.2 / R32 P1 | Nov 25, 2026 |
 | 3.6.2 | 1.25 - 1.31 | 1.3.2 | 2.3.2 | 1.27.1 / R32 P1 | Aug 19, 2026 |
@@ -41,13 +42,13 @@ We provide the following Docker images, which include NGINX or NGINX Plus bundle
 From release `v5.1.0` onwards, NGINX Ingress Controller will no longer provide binaries for the `armv7`, `s390x` & `ppc64le` architectures.
 {{< /important >}}
 
-_All images include NGINX 1.27.4._
+_All images include NGINX 1.27.5._
 
 {{< bootstrap-table "table table-bordered table-responsive" >}}
 |<div style="width:200px">Name</div> | <div style="width:100px">Base image</div> | DockerHub image | Architectures |
 | ---| --- | --- | --- |
-|Alpine-based image | ``nginx:1.27.4-alpine``,<br>based on on ``alpine:3.21`` | ``nginx/nginx-ingress:{{< nic-version >}}-alpine`` | arm64<br>amd64 |
-|Debian-based image | ``nginx:1.27.4``,<br>based on on ``debian:12-slim`` | ``nginx/nginx-ingress:{{< nic-version >}}`` | arm64<br>amd64 |
+|Alpine-based image | ``nginx:1.27.5-alpine``,<br>based on on ``alpine:3.21`` | ``nginx/nginx-ingress:{{< nic-version >}}-alpine`` | arm64<br>amd64 |
+|Debian-based image | ``nginx:1.27.5``,<br>based on on ``debian:12-slim`` | ``nginx/nginx-ingress:{{< nic-version >}}`` | arm64<br>amd64 |
 |Ubi-based image | ``redhat/ubi9-minimal`` | ``nginx/nginx-ingress:{{< nic-version >}}-ubi`` | arm64<br>amd64 |
 {{% /bootstrap-table %}}
 
diff --git a/layouts/shortcodes/nic-helm-version.html b/layouts/shortcodes/nic-helm-version.html
index 50aea0e7a..e3a4f1933 100644
--- a/layouts/shortcodes/nic-helm-version.html
+++ b/layouts/shortcodes/nic-helm-version.html
@@ -1 +1 @@
-2.1.0
\ No newline at end of file
+2.2.0
\ No newline at end of file
diff --git a/layouts/shortcodes/nic-operator-version.html b/layouts/shortcodes/nic-operator-version.html
index a0cd9f0cc..a4f52a5db 100644
--- a/layouts/shortcodes/nic-operator-version.html
+++ b/layouts/shortcodes/nic-operator-version.html
@@ -1 +1 @@
-3.1.0
\ No newline at end of file
+3.2.0
\ No newline at end of file
diff --git a/layouts/shortcodes/nic-version.html b/layouts/shortcodes/nic-version.html
index 28cbf7c0a..acf69b48b 100644
--- a/layouts/shortcodes/nic-version.html
+++ b/layouts/shortcodes/nic-version.html
@@ -1 +1 @@
-5.0.0
\ No newline at end of file
+5.1.0
\ No newline at end of file

From e877f361621131b6bd9644b18c590d89e4be8506 Mon Sep 17 00:00:00 2001
From: Saylor Berman <s.berman@f5.com>
Date: Tue, 8 Jul 2025 14:19:55 -0600
Subject: [PATCH 104/117] NGF: Release 2.0.2 (#798)

Update the release version for NGF to 2.0.2.
---
 layouts/shortcodes/version-ngf.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layouts/shortcodes/version-ngf.html b/layouts/shortcodes/version-ngf.html
index 10bf840ed..f93ea0ca3 100644
--- a/layouts/shortcodes/version-ngf.html
+++ b/layouts/shortcodes/version-ngf.html
@@ -1 +1 @@
-2.0.1
\ No newline at end of file
+2.0.2
\ No newline at end of file

From f0516e73a5603edf4ad2729c00058388a0b386f9 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Wed, 9 Jul 2025 10:07:52 +0100
Subject: [PATCH 105/117] fix: update Agent 2.x banner (#797)

Updates NGINX Agent 2.x docs banner to clarify the scope of the docs.
---
 _banners/agent-v3-release.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/_banners/agent-v3-release.md b/_banners/agent-v3-release.md
index cc5183ce1..87bd0021a 100644
--- a/_banners/agent-v3-release.md
+++ b/_banners/agent-v3-release.md
@@ -1,7 +1,8 @@
 {{< banner "notice" "NGINX Agent 3.0 is now available" >}}
 
+The documentation in this section is for **NGINX Agent version 2.x**. For NGINX Agent 3.x content visit the [NGINX One Console documentation]({{< ref "/nginx-one/agent/" >}})
 
-F5 NGINX Instance Manager (NIM) does not currently support Agent 3.x. NGINX Instance Manager customers can upgrade to the latest Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
+F5 NGINX Instance Manager (NIM) does not currently support NGINX Agent 3.x. NGINX Instance Manager customers can upgrade to the latest NGINX Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
 
 Please see the [Technical specifications](/nginx-agent/technical-specifications/) for product compatibility.
 

From 3988cd14b65d061fe96e19b9db87056668ce7d7f Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Wed, 9 Jul 2025 11:35:18 -0700
Subject: [PATCH 106/117] More

---
 cafe.yaml | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 cafe.yaml

diff --git a/cafe.yaml b/cafe.yaml
new file mode 100644
index 000000000..2d03ae59f
--- /dev/null
+++ b/cafe.yaml
@@ -0,0 +1,65 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coffee
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: coffee
+  template:
+    metadata:
+      labels:
+        app: coffee
+    spec:
+      containers:
+      - name: coffee
+        image: nginxdemos/nginx-hello:plain-text
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: coffee
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+    protocol: TCP
+    name: http
+  selector:
+    app: coffee
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tea
+  template:
+    metadata:
+      labels:
+        app: tea
+    spec:
+      containers:
+      - name: tea
+        image: nginxdemos/nginx-hello:plain-text
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tea
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+    protocol: TCP
+    name: http
+  selector:
+    app: tea

From a47b58030620f1ddf5abca445956eb7beae1fe43 Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Wed, 9 Jul 2025 11:35:31 -0700
Subject: [PATCH 107/117] More

---
 cafe.yaml | 65 -------------------------------------------------------
 1 file changed, 65 deletions(-)
 delete mode 100644 cafe.yaml

diff --git a/cafe.yaml b/cafe.yaml
deleted file mode 100644
index 2d03ae59f..000000000
--- a/cafe.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coffee
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: coffee
-  template:
-    metadata:
-      labels:
-        app: coffee
-    spec:
-      containers:
-      - name: coffee
-        image: nginxdemos/nginx-hello:plain-text
-        ports:
-        - containerPort: 8080
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: coffee
-spec:
-  ports:
-  - port: 80
-    targetPort: 8080
-    protocol: TCP
-    name: http
-  selector:
-    app: coffee
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tea
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tea
-  template:
-    metadata:
-      labels:
-        app: tea
-    spec:
-      containers:
-      - name: tea
-        image: nginxdemos/nginx-hello:plain-text
-        ports:
-        - containerPort: 8080
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: tea
-spec:
-  ports:
-  - port: 80
-    targetPort: 8080
-    protocol: TCP
-    name: http
-  selector:
-    app: tea

From e3e0bc0c6ea06a6aa801d26a31e5500dd0b0c6a0 Mon Sep 17 00:00:00 2001
From: Jon Torre <78599298+JTorreG@users.noreply.github.com>
Date: Thu, 10 Jul 2025 10:58:44 +0100
Subject: [PATCH 108/117] docs: add new Agent landing page (#800)

Updates the NGINX Agent v2 docs landing page to the new format with featured docs and cards
---
 content/agent/_index.md | 46 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/content/agent/_index.md b/content/agent/_index.md
index 35cc98e98..478ab4f4b 100644
--- a/content/agent/_index.md
+++ b/content/agent/_index.md
@@ -9,4 +9,50 @@ cascade:
     start-date: 2025-05-29
     end-date: 2025-09-09
     md: /_banners/agent-v3-release.md
+# The subtitle displays directly underneath the heading of a given page
+nd-subtitle:
+# Indicates that this is a custom landing page
+nd-landing-page: true
+# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
+nd-content-type: landing-page
+# Intended for internal catalogue and search, case sensitive:
+# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
+nd-product: Agent
 ---
+
+## About
+
+NGINX Agent is a companion daemon for your NGINX Open Source or NGINX Plus instance. It enables remote management of NGINX
+configurations, collection and reporting of real-time NGINX performance and operating system metrics, and notifications of NGINX events.
+
+[//]: # "This initial section introduces the product to a reader: give a short 1-2 sentence summary of what the product does and its value to the reader."
+[//]: # "Name specific functionality it provides: avoid ambiguous descriptions such as 'enables efficiency', focus on what makes it unique."
+
+## Featured content
+[//]: # "You can add a maximum of three cards: any extra will not display."
+[//]: # "One card will take full width page: two will take half width each. Three will stack like an inverse pyramid."
+[//]: # "Some examples of content could be the latest release note, the most common install path, and a popular new feature."
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" isFeaturedSection="true">}}
+    {{<card title="About" titleUrl="/nginx-agent/about" icon="info">}}
+      Learn everything you need to know about NGINX Agent
+    {{</card>}}
+    <!-- The titleURL and icon are both optional -->
+    <!-- Lucide icon names can be found at https://lucide.dev/icons/ -->
+    {{<card title="Getting started" titleUrl="/nginx-agent/installation-upgrade/getting-started" icon="unplug">}}
+      Install NGINX Agent and run a mock control plane
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" isFeaturedSection="true">}}
+    {{<card title="Upgrade" titleUrl="/nginx-agent/installation-upgrade/upgrade/" icon="circle-fading-arrow-up">}}
+    {{</card>}}
+    {{<card title="Configuration" titleUrl="/nginx-agent/configuration" icon="cog">}}
+    {{</card>}}
+    {{<card title="Support" titleUrl="/nginx-agent/support" icon="hand-helping">}}
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
\ No newline at end of file

From 50dbf0978e0eac936b7f98685339539569c9debe Mon Sep 17 00:00:00 2001
From: Jack Hickey <133868041+nginx-jack@users.noreply.github.com>
Date: Thu, 10 Jul 2025 14:47:01 +0100
Subject: [PATCH 109/117] fix: Add missing NGINX Ingress Controller site
 parameters #803)

---
 content/nic/installation/installing-nic/_index.md | 1 +
 content/nic/installation/integrations/_index.md   | 1 +
 content/nic/installation/nic-images/_index.md     | 1 +
 3 files changed, 3 insertions(+)

diff --git a/content/nic/installation/installing-nic/_index.md b/content/nic/installation/installing-nic/_index.md
index ad70f8f42..52e4300bf 100644
--- a/content/nic/installation/installing-nic/_index.md
+++ b/content/nic/installation/installing-nic/_index.md
@@ -2,4 +2,5 @@
 title: Install NGINX Ingress Controller
 description:
 weight: 100
+url: /nginx-ingress-controller/installation/installing-nic
 ---
diff --git a/content/nic/installation/integrations/_index.md b/content/nic/installation/integrations/_index.md
index e1c0b2f10..83943f248 100644
--- a/content/nic/installation/integrations/_index.md
+++ b/content/nic/installation/integrations/_index.md
@@ -2,4 +2,5 @@
 title: Integrations
 description:
 weight: 600
+url: /nginx-ingress-controller/installation/integrations
 ---
diff --git a/content/nic/installation/nic-images/_index.md b/content/nic/installation/nic-images/_index.md
index bcf9d1557..526b52588 100644
--- a/content/nic/installation/nic-images/_index.md
+++ b/content/nic/installation/nic-images/_index.md
@@ -1,4 +1,5 @@
 ---
 title: NGINX Ingress Controller images
 weight: 200
+url: /nginx-ingress-controller/installation/nic-images
 ---

From d1bb519ef661413c443a69337d7cdc91c3e09c85 Mon Sep 17 00:00:00 2001
From: Alan Dooley <a.dooley@f5.com>
Date: Thu, 10 Jul 2025 14:48:05 +0100
Subject: [PATCH 110/117] feat: Clarify 3.x to 4.x upgrade process for NGINX
 Ingress Controller (#802)

This commit renames the Upgrade to 3.x document for NGINX Ingress
Controller to clarify it is for 3.x to 4.0.00 only. It adds an explicit
warning call-out at the top of the page to reinforce this, and the Helm
installation document has also been updated with more generic phrasing.

At a certain point of maturity the note on the Helm instructions page
could likely be removed, unless we anticipate someone will be still be
running a 3.x instance years after the versions have moved on.
---
 .../installing-nic/installation-with-helm.md    | 17 +++++++----------
 .../installing-nic/upgrade-to-v4.md             | 16 ++++++++++++----
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/content/nic/installation/installing-nic/installation-with-helm.md b/content/nic/installation/installing-nic/installation-with-helm.md
index 3580dce67..4ad8e1377 100644
--- a/content/nic/installation/installing-nic/installation-with-helm.md
+++ b/content/nic/installation/installing-nic/installation-with-helm.md
@@ -11,7 +11,7 @@ This document explains how to install F5 NGINX Ingress Controller using [Helm](h
 
 ## Before you begin
 
-{{< note >}} All documentation should only be used with the latest stable release, indicated on [the releases page]({{< ref "/nic/releases.md" >}}) of the GitHub repository. {{< /note >}}
+{{< call-out "note" >}} All documentation should only be used with the latest stable release, indicated on [the releases page]({{< ref "/nic/releases.md" >}}) of the GitHub repository. {{< /call-out >}}
 
 - A [Kubernetes Version Supported by NGINX Ingress Controller]({{< ref "/nic/technical-specifications.md#supported-kubernetes-versions" >}})
 - Helm 3.0+.
@@ -30,8 +30,7 @@ If you do not use the custom resources that require those CRDs (which correspond
 
 ### Upgrade the CRDs
 
-{{< note >}} Please make sure to read the steps outlined in [Upgrade to V4]({{< ref "/nic/installation/installing-nic/upgrade-to-v4.md#update-custom-resource-apiversion" >}}) before running the CRD upgrade and perform the steps if applicable.
-{{< /note >}}
+{{< call-out "note" >}} If you are running NGINX Ingress Controller v3.x, you should read [Upgrade from NGINX Ingress Controller v3.x to v4.0.0]({{< ref "/nic/installation/installing-nic/upgrade-to-v4.md" >}}) before continuing. {{< /call-out >}}
 
 To upgrade the CRDs, pull the chart sources as described in [Pull the Chart](#pull-the-chart) and then run:
 
@@ -47,10 +46,10 @@ kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v{{<
 
 In the above command, `v{{< nic-version >}}` represents the version of NGINX Ingress Controller release rather than the Helm chart version.
 
-{{< note >}} The following warning is expected and can be ignored: `Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply`.
+{{< call-out "note" >}} The following warning is expected and can be ignored: `Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply`.
 
 Check the [release notes](https://www.github.com/nginx/kubernetes-ingress/releases) for a new release for any special upgrade procedures.
-{{< /note >}}
+{{< /call-out >}}
 
 ### Uninstall the CRDs
 
@@ -60,7 +59,7 @@ To remove the CRDs, pull the chart sources as described in [Pull the Chart](#pul
 kubectl delete -f crds/
 ```
 
-{{< warning >}} This command will delete all the corresponding custom resources in your cluster across all namespaces. Please ensure there are no custom resources that you want to keep and there are no other NGINX Ingress Controller instances running in the cluster. {{< /warning >}}
+{{< call-out "warning" >}} This command will delete all the corresponding custom resources in your cluster across all namespaces. Please ensure there are no custom resources that you want to keep and there are no other NGINX Ingress Controller instances running in the cluster. {{< /call-out >}}
 
 ## Manage the chart with OCI Registry
 
@@ -113,7 +112,7 @@ You can install the `edge` version by specifying the `--version` flag with the v
 helm install my-release oci://ghcr.io/nginx/charts/nginx-ingress --version 0.0.0-edge
 ```
 
-{{< warning >}} The `edge` version is not intended for production use. It is intended for testing and development purposes only. {{< /warning >}}
+{{< call-out "warning" >}} The `edge` version is not intended for production use. It is intended for testing and development purposes only. {{< /call-out >}}
 
 ## Manage the chart with Sources
 
@@ -184,7 +183,7 @@ Although the advisory is to update all resources in accordance with new naming c
 
 ### Upgrade steps
 
-{{< note >}} The following steps apply to both 2.x and 3.0.x releases.  {{</ note >}}
+{{< call-out "note" >}} The following steps apply to both 2.x and 3.0.x releases.  {{</ call-out >}}
 
 The steps you should follow depend on the Helm release name:
 
@@ -299,7 +298,6 @@ The [Run multiple NGINX Ingress Controllers]({{< ref "/nic/installation/run-mult
 
 The following tables lists the configurable parameters of the NGINX Ingress Controller chart and their default values.
 
-{{< table >}}
 {{<bootstrap-table "table table-striped table-bordered table-responsive">}}
 |Parameter | Description | Default |
 | --- | --- | --- |
@@ -490,4 +488,3 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |**nginxAgent.napMonitoring.processorBufferSize** | Buffer size for processor. Will contain log lines and parsed log lines. | 50000 |
 |**nginxAgent.customConfigMap** | The name of a custom ConfigMap to use instead of the one provided by default. | "" |
 {{</bootstrap-table>}}
-{{< /table >}}
diff --git a/content/nic/installation/installing-nic/upgrade-to-v4.md b/content/nic/installation/installing-nic/upgrade-to-v4.md
index 36b3e798d..f63d33fb2 100644
--- a/content/nic/installation/installing-nic/upgrade-to-v4.md
+++ b/content/nic/installation/installing-nic/upgrade-to-v4.md
@@ -1,18 +1,26 @@
 ---
-title: Upgrade to NGINX Ingress Controller 4.0.0
+title: Upgrade from NGINX Ingress Controller v3.x to v4.0.0
 toc: true
 weight: 400
-type: how-to
-product: NIC
+nd-content-type: how-to
+nd-product: NIC
 nd-docs: DOCS-1862
 ---
 
-This document explains how to upgrade F5 NGINX Ingress Controller to 4.0.0.
+This document explains how to upgrade F5 NGINX Ingress Controller from version v3.x to v4.0.0.
 
 There are two necessary steps required: updating the `apiVersion` value of custom resources and configuring structured logging.
 
 For NGINX Plus users, there is a third step to create a Secret for your license.
 
+{{< call-out "warning" "This upgrade path is intended for 3.x to 4.0.0 only" >}}
+
+The instructions in this document are intended only for users upgrading from NGINX Ingress Controller 3.x to 4.0.0. Internal changes meant that backwards compability was not possible, requiring extra steps to upgrade.
+
+From NGINX Ingress Controller v4.0.0 onwards, you can upgrade as normal, based on your installation method: [Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md">}}) or [Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md">}}).
+
+{{< /call-out >}}
+
 ---
 
 ## Update custom resource apiVersion

From a1bb1da511a194af936338cb6057315b8d02b212 Mon Sep 17 00:00:00 2001
From: Shaun <s.odonovan@f5.com>
Date: Fri, 11 Jul 2025 11:58:04 +0100
Subject: [PATCH 111/117] Improve user experience in Get Started guide for NGF
 (#799)

---
 content/ngf/get-started.md | 149 +++++++++++++++++++++++++++++++------
 1 file changed, 128 insertions(+), 21 deletions(-)

diff --git a/content/ngf/get-started.md b/content/ngf/get-started.md
index 83bd9029f..aead2c963 100644
--- a/content/ngf/get-started.md
+++ b/content/ngf/get-started.md
@@ -132,13 +132,76 @@ The YAML code in the following sections can be found in the [cafe-example folder
 
 ### Create the application resources
 
-Create the file _cafe.yaml_ with the following contents:
-
-{{< ghcode `https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/refs/heads/main/examples/cafe-example/cafe.yaml`>}}
-
-Apply it using `kubectl`:
-
-```shell
+Run the following command to create the file _cafe.yaml_, which is then used to deploy the *coffee* application to your cluster:
+
+```yaml
+cat <<EOF > cafe.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coffee
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: coffee
+  template:
+    metadata:
+      labels:
+        app: coffee
+    spec:
+      containers:
+      - name: coffee
+        image: nginxdemos/nginx-hello:plain-text
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: coffee
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+    protocol: TCP
+    name: http
+  selector:
+    app: coffee
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tea
+  template:
+    metadata:
+      labels:
+        app: tea
+    spec:
+      containers:
+      - name: tea
+        image: nginxdemos/nginx-hello:plain-text
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tea
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+    protocol: TCP
+    name: http
+  selector:
+    app: tea
+EOF
 kubectl apply -f cafe.yaml
 ```
 
@@ -163,13 +226,22 @@ tea-6fbfdcb95d-9lhbj      1/1     Running   0          9s
 
 ### Create Gateway and HTTPRoute resources
 
-Create the file _gateway.yaml_ with the following contents:
-
-{{< ghcode `https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/refs/heads/main/examples/cafe-example/gateway.yaml`>}}
-
-Apply it using `kubectl`:
-
-```shell
+Run the following command to create the file _gateway.yaml_, which is then used to deploy a Gateway to your cluster:
+
+```yaml
+cat <<EOF > gateway.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway
+spec:
+  gatewayClassName: nginx
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    hostname: "*.example.com"
+EOF
 kubectl apply -f gateway.yaml
 ```
 
@@ -190,13 +262,48 @@ gateway-nginx-66b5d78f8f-4fmtb   1/1     Running   0          13s
 tea-6fbfdcb95d-9lhbj             1/1     Running   0          31s
 ```
 
-Create the file _cafe-routes.yaml_ with the following contents:
-
-{{< ghcode `https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/refs/heads/main/examples/cafe-example/cafe-routes.yaml`>}}
-
-Apply it using `kubectl`:
-
-```shell
+Run the following command to create the file _cafe-routes.yaml_. It is then used to deploy two *HTTPRoute* resources in your cluster: one each for _/coffee_ and _/tea_.
+
+```yaml
+cat <<EOF > cafe-routes.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: coffee
+spec:
+  parentRefs:
+  - name: gateway
+    sectionName: http
+  hostnames:
+  - "cafe.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /coffee
+    backendRefs:
+    - name: coffee
+      port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: tea
+spec:
+  parentRefs:
+  - name: gateway
+    sectionName: http
+  hostnames:
+  - "cafe.example.com"
+  rules:
+  - matches:
+    - path:
+        type: Exact
+        value: /tea
+    backendRefs:
+    - name: tea
+      port: 80
+EOF
 kubectl apply -f cafe-routes.yaml
 ```
 

From d2f2216bc1f74d8b5d35a3836a0e6dacfdecc5a5 Mon Sep 17 00:00:00 2001
From: Travis Martin <33876974+travisamartin@users.noreply.github.com>
Date: Fri, 11 Jul 2025 09:21:12 -0700
Subject: [PATCH 112/117] fixed the Service Mesh and ACM EoS banners (#808)

* fixed the Service Mesh and ACM EoS banners

* bolded SM EoS date
---
 _banners/eos-acm.md       |  8 ++++++++
 _banners/eos-mesh.md      | 12 ++++++------
 content/nms/acm/_index.md |  6 +++++-
 3 files changed, 19 insertions(+), 7 deletions(-)
 create mode 100644 _banners/eos-acm.md

diff --git a/_banners/eos-acm.md b/_banners/eos-acm.md
new file mode 100644
index 000000000..e69f51b6b
--- /dev/null
+++ b/_banners/eos-acm.md
@@ -0,0 +1,8 @@
+{{< banner "warning" "End of Sale Notice:" >}}
+  <br>
+  F5 NGINX is announcing the <strong>End of Sale (EoS)</strong> for NGINX Management Suite API Connectivity Manager Module, <strong>effective January 1, 2024</strong>.
+  <br><br>
+  F5 maintains generous lifecycle policies that allow customers to continue support and receive product updates. Existing API Connectivity Manager Module customers can continue to use the product past the EoS date. <strong>License renewals are not available after September 30, 2024.</strong>
+  <br><br>
+  See our <a href="https://my.f5.com/manage/s/article/K000137989">End of Sale announcement</a> for more details.
+{{</ banner >}}
\ No newline at end of file
diff --git a/_banners/eos-mesh.md b/_banners/eos-mesh.md
index e69f51b6b..f2b11d535 100644
--- a/_banners/eos-mesh.md
+++ b/_banners/eos-mesh.md
@@ -1,8 +1,8 @@
 {{< banner "warning" "End of Sale Notice:" >}}
-  <br>
-  F5 NGINX is announcing the <strong>End of Sale (EoS)</strong> for NGINX Management Suite API Connectivity Manager Module, <strong>effective January 1, 2024</strong>.
-  <br><br>
-  F5 maintains generous lifecycle policies that allow customers to continue support and receive product updates. Existing API Connectivity Manager Module customers can continue to use the product past the EoS date. <strong>License renewals are not available after September 30, 2024.</strong>
-  <br><br>
-  See our <a href="https://my.f5.com/manage/s/article/K000137989">End of Sale announcement</a> for more details.
+  <p>
+    Commercial support for NGINX Service Mesh is available to customers who currently have active NGINX Microservices Bundle subscriptions. F5 NGINX announced the End of Sale (EoS) for the NGINX Microservices Bundles as of <strong>July 1, 2023</strong>.
+  </p>
+  <p>
+    See our <a href="https://my.f5.com/manage/s/article/K000135468">End of Sale announcement</a> for more details.
+  </p>
 {{</ banner >}}
\ No newline at end of file
diff --git a/content/nms/acm/_index.md b/content/nms/acm/_index.md
index c6dce5b75..2acb5eb31 100644
--- a/content/nms/acm/_index.md
+++ b/content/nms/acm/_index.md
@@ -3,6 +3,10 @@ title: API Connectivity Manager
 weight: 500
 url: /nginx-management-suite/acm/
 cascade:
-  type: acm-eos
+  noindex: true
+  nd-banner:
+    enabled: true
+    type: deprecation
+    md: _banners/eos-acm.md
 ---
 

From 854ea908ec8d16a71aa7005f3a8cc9f4a6016b8c Mon Sep 17 00:00:00 2001
From: Venktesh Shivam Patel <ve.patel@f5.com>
Date: Mon, 14 Jul 2025 13:24:22 +0100
Subject: [PATCH 113/117] update language for NIC opentracing doc (#809)

---
 content/nic/installation/integrations/opentracing.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/nic/installation/integrations/opentracing.md b/content/nic/installation/integrations/opentracing.md
index 9b131dc8c..2937594cb 100644
--- a/content/nic/installation/integrations/opentracing.md
+++ b/content/nic/installation/integrations/opentracing.md
@@ -2,11 +2,11 @@
 nd-docs: DOCS-618
 doctypes:
 - ''
-title: OpenTracing (Deprecated in v5.0.0)
+title: OpenTracing (Removed in v5.0.0)
 toc: true
 weight: 500
 ---
-OpenTracing support has been deprecated from v5.0.0 of F5 NGINX Ingress Controller.
+OpenTracing support has been removed from v5.0.0 of F5 NGINX Ingress Controller.
 
 
 Learn how to use OpenTracing with F5 NGINX Ingress Controller.

From a1a004bd5ef6d4251298c1e76ae6a7d0a82d5108 Mon Sep 17 00:00:00 2001
From: Sarthak Agrawal <68310924+sarthyparty@users.noreply.github.com>
Date: Tue, 15 Jul 2025 09:05:28 -0700
Subject: [PATCH 114/117] Add NGF permissions document (#810)

Add a NGF permissions document so that users can see what the security context of NGF is and what permissions it requires.

Problem: Users don't know about NGF security and permissions.

Solution: I added a permissions document that helps with that.
---
 content/ngf/reference/permissions.md | 110 +++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100644 content/ngf/reference/permissions.md

diff --git a/content/ngf/reference/permissions.md b/content/ngf/reference/permissions.md
new file mode 100644
index 000000000..ad95e3bef
--- /dev/null
+++ b/content/ngf/reference/permissions.md
@@ -0,0 +1,110 @@
+---
+title: Permissions
+description: NGINX Gateway Fabric permissions required by components.
+weight: 300
+toc: true
+type: reference
+product: NGF
+---
+
+## Overview
+
+NGINX Gateway Fabric uses a split-plane architecture with three components that require different permissions:
+
+- **Control Plane**: Manages Kubernetes APIs and data plane deployments. Needs broad API access but handles no user traffic.
+- **Data Plane**: Processes user traffic. Requires minimal permissions since configuration comes from control plane via secure gRPC.
+- **Certificate Generator**: One-time job that creates TLS certificates for inter-plane communication.
+
+## Security Context
+
+All components share these security settings:
+
+- **User ID**: 101 (non-root)
+- **Group ID**: 1001  
+- **Capabilities**: All dropped (`drop: ALL`)
+- **Root Filesystem**: Read-only except for specific writable volumes
+- **Seccomp**: Runtime default profile
+
+## Control Plane
+
+Runs as a single container in the `nginx-gateway` deployment.
+
+**Additional Security Settings:**
+- **Privilege Escalation**: Disabled
+
+**Volumes:**
+- Secret mounts for TLS certificates
+
+**RBAC Permissions:**
+- **Secrets, ConfigMaps, Services**: Create, update, delete, list, get, watch
+- **Deployments, DaemonSets**: Create, update, delete, list, get, watch
+- **ServiceAccounts**: Create, update, delete, list, get, watch
+- **Namespaces, Pods**: Get, list, watch
+- **Events**: Create, patch
+- **EndpointSlices**: List, watch
+- **Gateway API resources**: List, watch (read-only) + update status subresources only
+- **NGF Custom resources**: Get, list, watch (read-only) + update status subresources only
+- **Leases**: Create, get, update (for leader election)
+- **CustomResourceDefinitions**: List, watch
+- **TokenReviews**: Create (for authentication)
+
+## Data Plane
+
+NGINX containers managed by the control plane. No RBAC permissions needed since configuration comes via secure gRPC.
+
+**Additional Security Settings:**
+- **Privilege Escalation**: Disabled
+- **Sysctl**: `net.ipv4.ip_unprivileged_port_start=0` (enables binding to ports < 1024)
+
+**Volumes:**
+- EmptyDir volumes for NGINX configuration, runtime files, logs, and cache
+- Secret mounts for TLS certificates and the NGINX Plus JWT token 
+- Projected token mounts for service account authentication
+
+**Volume Permissions:**
+- **EmptyDir**: Read-write (required for NGINX operation)
+- **Secret/ConfigMap/Projected**: Read-only
+
+## Certificate Generator
+
+Kubernetes Job that creates initial TLS certificates.
+
+**RBAC Permissions:**
+- **Secrets**: Create, update, get (control plane namespace only)
+
+## Platform-Specific Considerations
+
+### OpenShift Compatibility
+
+NGINX Gateway Fabric includes Security Context Constraints (SCCs) for OpenShift:
+
+**Control Plane SCC:**
+- **Privilege Escalation**: Disabled
+- **Host Access**: Disabled (network, IPC, PID, ports)
+- **User ID Range**: 101-101 (fixed)
+- **Group ID Range**: 1001-1001 (fixed)
+- **Volumes**: Secret only
+
+**Data Plane SCC:**
+Same restrictions as control plane, plus additional volume types:
+- **Additional Volumes**: EmptyDir, ConfigMap, Projected
+
+### Linux Capabilities
+
+NGINX Gateway Fabric drops ALL Linux capabilities and adds none, following security best practices.
+
+**How It Works Without Capabilities:**
+- **Process Management**: Standard Unix signals (no elevated privileges needed)
+- **Port Binding**: Uses sysctl `net.ipv4.ip_unprivileged_port_start=0` for ports < 1024
+- **File Operations**: Volume mounts provide necessary write access
+
+
+## Security Features
+
+- **Separation of concerns**: Control plane (API access, no traffic) vs data plane (traffic, no API access)
+- **Non-root execution**: All components run as unprivileged user (UID 101)
+- **Zero capabilities**: All Linux capabilities dropped
+- **Read-only root filesystem**: Prevents runtime modifications
+- **Ephemeral storage**: Temporary volumes only, no persistent storage
+- **Least privilege RBAC**: Minimal required permissions per component
+- **Secure communication**: mTLS-encrypted gRPC (TLS 1.3+) between planes
\ No newline at end of file

From 166a2a0d139aa20b8b92baf0998159fd90095c69 Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Tue, 15 Jul 2025 10:08:34 -0700
Subject: [PATCH 115/117] Nap usecase stage1 (#817)

* feat: Integration steps: NAP-WAF into NGINX One Console

- Basic transparant v. blocking policies
- Strict policy
- Adjustments
- API info
- Changelog

Co-authored-by: yar <y82@users.noreply.github.com>

Apply suggestions from code review

Co-authored-by: Daniel Edgar <d.edgar@f5.com>

Apply suggestions from code review

* Update changelog release date
---
 .../nginx-app-protect-waf-terminology.md      |    5 +-
 content/nginx-one/_index.md                   |   19 +-
 content/nginx-one/changelog.md                |   11 +
 content/nginx-one/glossary.md                 |    5 +
 content/nginx-one/nap-integration/_index.md   |    6 +
 .../nap-integration/configure-policy.md       |   48 +
 .../nap-integration/deploy-policy.md          |   28 +
 content/nginx-one/nap-integration/overview.md |   56 +
 .../nap-integration/review-policy.md          |   40 +
 .../nap-integration/security-policy-api.md    |   26 +
 static/nginx-one/api/one.json                 | 2578 +++++++++++++----
 11 files changed, 2228 insertions(+), 594 deletions(-)
 create mode 100644 content/nginx-one/nap-integration/_index.md
 create mode 100644 content/nginx-one/nap-integration/configure-policy.md
 create mode 100644 content/nginx-one/nap-integration/deploy-policy.md
 create mode 100644 content/nginx-one/nap-integration/overview.md
 create mode 100644 content/nginx-one/nap-integration/review-policy.md
 create mode 100644 content/nginx-one/nap-integration/security-policy-api.md

diff --git a/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md b/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md
index f1f28bb0c..2630c54ec 100644
--- a/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md
+++ b/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md
@@ -1,5 +1,8 @@
 ---
 nd-docs: "DOCS-1605"
+files:
+  - content/nap-waf/v5/configuration-guide/configuration.md
+  - content/nginx-one/glossary.md
 ---
 
 This guide assumes that you have some familiarity with various Layer 7 (L7) Hypertext Transfer Protocol (HTTP) concepts, such as Uniform Resource Identifier (URI)/Uniform Resource Locator (URL), method, header, cookie, status code, request, response, and parameters.
@@ -26,4 +29,4 @@ This guide assumes that you have some familiarity with various Layer 7 (L7) Hype
 |Tuning | Making manual changes to an existing security policy to reduce false positives and increase the policy’s security level. |
 |URI/URL | The Uniform Resource Identifier (URI) specifies the name of a web object in a request. A Uniform Resource Locator (URL) specifies the location of an object on the Internet. For example, in the web address, `http://www.siterequest.com/index.html`, index.html is the URI, and the URL is `http://www.siterequest.com/index.html`. In NGINX App Protect WAF, the terms URI and URL are used interchangeably. |
 |Violation | Violations occur when some aspect of a request or response does not comply with the security policy. You can configure the blocking settings for any violation in a security policy. When a violation occurs, the system can Alarm or Block a request (blocking is only available when the enforcement mode is set to Blocking). |
-{{</bootstrap-table>}}
\ No newline at end of file
+{{</bootstrap-table>}}
diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index 3cfd13708..34a88e88e 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -19,6 +19,7 @@ F5 NGINX One Console makes it easy to manage NGINX instances across locations an
 [//]: # "You can add a maximum of three cards: any extra will not display."
 [//]: # "One card will take full width page: two will take half width each. Three will stack like an inverse pyramid."
 [//]: # "Some examples of content could be the latest release note, the most common install path, and a popular new feature."
+
 {{<card-layout>}}
   {{<card-section showAsCards="true" isFeaturedSection="true">}}
     {{<card title="Get started" titleUrl="/nginx-one/getting-started/" isFeatured="true" icon="unplug">}}
@@ -36,6 +37,9 @@ F5 NGINX One Console makes it easy to manage NGINX instances across locations an
     {{<card title="Manage your NGINX instances" titleUrl="/nginx-one/nginx-configs/" >}}
       Manage one instance or groups of instances. Monitor certificates. Set up metrics.
     {{</card>}}
+    {{<card title="Secure with NGINX App Protect" titleUrl="/nginx-one/nap-integration/" >}}
+      Manage one instance or groups of instances. Monitor certificates. Set up metrics.
+    {{</card>}}
     {{<card title="Organize users with RBAC" titleUrl="/nginx-one/rbac/" >}}
       Assign responsibilities with role-based access control 
     {{</card>}}
@@ -58,10 +62,23 @@ F5 NGINX One Console makes it easy to manage NGINX instances across locations an
   {{</card-section>}}
 {{</card-layout>}}
 
+### More information
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" >}}
+    {{<card title="Glossary" titleUrl="/nginx-one/glossary/" >}}
+      See latest updates: New features, improvements, and bug fixes
+    {{</card>}}
+    {{<card title="Changelog" titleUrl="/nginx-one/changelog/" icon="clock-alert">}}
+      See latest updates: New features, improvements, and bug fixes
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
+
 ## NGINX One components
 [//]: # "You can add any extra content for the page here, such as additional cards, diagrams or text."
 
-{{< card-layout >}}
+{{<card-layout>}}
   {{< card-section title="Kubernetes Solutions">}}
     {{< card title="NGINX Ingress Controller" titleUrl="/nginx-ingress-controller/" brandIcon="NGINX-Ingress-Controller-product-icon">}}
       Kubernetes traffic management with API gateway, identity, and observability features.
diff --git a/content/nginx-one/changelog.md b/content/nginx-one/changelog.md
index dd9cf1216..1c38199b4 100644
--- a/content/nginx-one/changelog.md
+++ b/content/nginx-one/changelog.md
@@ -30,6 +30,17 @@ h2 {
 
 Stay up-to-date with what's new and improved in the F5 NGINX One Console.
 
+## July 15, 2025
+
+### Set up F5 NGINX App Protect WAF security policies
+
+You can now incorporate [NGINX App Protect WAF]({{< ref "/nap-waf/" >}}) in NGINX One Console UI. For details, see [Secure with NGINX App Protect]({{< ref "/nginx-one/nap-integration/" >}}).
+
+In NGINX One Console, you can:
+
+- Toggle between [Default policy bundles]({{< ref "/nap-waf/v5/configuration-guide/configuration/#updating-default-policy-bundles" >}})
+- Set a blocking or transparant [Policy enforcement mode]({{< ref "/nap-waf/v5/configuration-guide/configuration/#policy-enforcement-modes" >}})
+
 ## July 1, 2025
 
 ### NGINX Agent version 3 support
diff --git a/content/nginx-one/glossary.md b/content/nginx-one/glossary.md
index 69c264c63..fe3608390 100644
--- a/content/nginx-one/glossary.md
+++ b/content/nginx-one/glossary.md
@@ -10,6 +10,7 @@ type:
 
 This glossary defines terms used in the F5 NGINX One Console and F5 Distributed Cloud.
 
+## General terms
 
 {{<bootstrap-table "table table-striped table-bordered">}}
 | Term        | Definition |
@@ -24,6 +25,10 @@ This glossary defines terms used in the F5 NGINX One Console and F5 Distributed
 | **Tenant** | A tenant in F5 Distributed Cloud is an entity that owns a specific set of configuration and infrastructure. It is fundamental for isolation, meaning a tenant cannot access objects or infrastructure of other tenants. Tenants can be either individual or enterprise, with the latter allowing multiple users with role-based access control (RBAC). |
 {{</bootstrap-table>}}
 
+## NGINX App Protect WAF terminology
+
+{{< include "nap-waf/config/common/nginx-app-protect-waf-terminology.md" >}}
+
 ## Legal notice: Licensing agreements for NGINX products
 
 Using NGINX One is subject to our End User Service Agreement (EUSA). For [NGINX Plus]({{< ref "/nginx" >}}), usage is governed by the End User License Agreement (EULA). Open source projects, including [NGINX Agent](https://github.com/nginx/agent) and [NGINX Open Source](https://github.com/nginx/nginx), are covered under their respective licenses. For more details on these licenses, follow the provided links.
diff --git a/content/nginx-one/nap-integration/_index.md b/content/nginx-one/nap-integration/_index.md
new file mode 100644
index 000000000..b21ffdf45
--- /dev/null
+++ b/content/nginx-one/nap-integration/_index.md
@@ -0,0 +1,6 @@
+---
+title: Secure with NGINX App Protect
+description:
+weight: 400
+url: /nginx-one/nap-integration
+---
diff --git a/content/nginx-one/nap-integration/configure-policy.md b/content/nginx-one/nap-integration/configure-policy.md
new file mode 100644
index 000000000..da58de0c8
--- /dev/null
+++ b/content/nginx-one/nap-integration/configure-policy.md
@@ -0,0 +1,48 @@
+---
+# We use sentence case and present imperative tone
+title: "Add and configure a policy"
+# Weights are assigned in increments of 100: determines sorting order
+weight: 200
+# Creates a table of contents and sidebar, useful for large documents
+toc: false
+# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
+nd-content-type: how-to
+# Intended for internal catalogue and search, case sensitive:
+# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
+nd-product: NGINX One
+---
+
+This document describes how you can configure a security policy in the F5 NGINX One Console. When you add a policy, NGINX One Console includes several UI-based options and presets, based on NGINX App Protect WAF.
+
+
+If you already know NGINX App Protect WAF, you can go beyond the options available in the UI. 
+
+## Add a policy
+
+From NGINX One Console, select App Protect > Policies. In the screen that appears, select **Add Policy**. That action opens a screen where you can:
+
+- In General Settings, name and describe the policy.
+  - You can also set one of the following enforcement modes:
+    - Transparent
+    - Blocking
+
+For details, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**. You'll see this in the associated configuration file,
+with the `enforcementMode` property.
+
+You can also set a character encoding. The default encoding is `Unicode (utf-8)`. To set a different character encoding, select **Show Advanced Fields** and select the **Application Language** of your choice.
+
+## Configure a policy
+
+With NGINX One Console User Interface, you get a default policy. You can also select **NGINX Strict** for a more rigorous policy:
+
+### Basic Configuration and the Default Policy
+
+{{< include "/nap-waf/concept/basic-config-default-policy.md" >}}
+
+## Save your policy
+
+NGINX One Console includes a Policy JSON section which displays your policy in JSON format. What you configure here is written to your instance of NGINX App Protect WAF. 
+
+With the **Edit** option, you can customize this policy. It opens the JSON file in a local editor. When you select **Save Policy**, it saves the latest version of what you've configured. You'll see your new policy under the name you used.
+
+From NGINX One Console, you can review the policies that you've saved, along with their versions. Select **App Protect** > **Policies**. Select the policy that you want to review or modify.
diff --git a/content/nginx-one/nap-integration/deploy-policy.md b/content/nginx-one/nap-integration/deploy-policy.md
new file mode 100644
index 000000000..884c1a86f
--- /dev/null
+++ b/content/nginx-one/nap-integration/deploy-policy.md
@@ -0,0 +1,28 @@
+---
+# We use sentence case and present imperative tone
+title: "Deploy policy"
+# Weights are assigned in increments of 100: determines sorting order
+weight: 400
+# Creates a table of contents and sidebar, useful for large documents
+toc: false
+# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
+nd-content-type: how-to
+# Intended for internal catalogue and search, case sensitive:
+# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
+nd-product: NGINX One
+---
+
+After you've set up a policy, it won't do anything, until you deploy it to one or more instances and Config Sync Groups.
+
+This page assumes you've created a policy in NGINX One Console that you're ready to deploy.
+
+## Deploy a policy
+
+To deploy a policy from NGINX One Console, take the following steps:
+
+1. Select **App Protect** > **Policies**.
+1. Select the policy that you're ready to deploy.
+1. Select the **Details** tab.
+1. In the **Deploy Policy** window that appears, you can confirm the name of the current policy and the version to deploy. NGINX One Console defaults to the selected policy and latest version.
+1. In the **Target** section, select Instance or Config Sync Group.
+1. In the drop-down menu that appears, select the instance or Config Sync Group available in the current NGINX One Console.
diff --git a/content/nginx-one/nap-integration/overview.md b/content/nginx-one/nap-integration/overview.md
new file mode 100644
index 000000000..f3c628333
--- /dev/null
+++ b/content/nginx-one/nap-integration/overview.md
@@ -0,0 +1,56 @@
+---
+# We use sentence case and present imperative tone
+title: "NGINX App Protect integration overview"
+# Weights are assigned in increments of 100: determines sorting order
+weight: 100
+# Creates a table of contents and sidebar, useful for large documents
+toc: false
+# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
+nd-content-type: concept
+# Intended for internal catalogue and search, case sensitive:
+# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
+nd-product: NGINX One
+---
+
+You can now integrate the features of F5 NGINX App Protect WAF v4 and v5 in F5 NGINX One Console. NGINX App Protect offers advanced Web Application Firewall (WAF) capabilities.
+Through the NGINX One Console UI, you can now set up the [NGINX App Protect WAF]({{< ref "/nap-waf/" >}}) firewall. This solution provides robust security and scalability.
+
+## Features
+
+Once you've connected to the NGINX One Console, select **App Protect > Policies**. You can add new policies or edit existing policies, as defined in the [NGINX App Protect WAF Administration Guide]({{< ref "/nap-waf/v5/admin-guide/overview.md" >}})
+
+Through the NGINX One Console UI, you can:
+
+- [Add and configure a policy]({{< ref "/nginx-one/nap-integration/configure-policy.md/" >}})
+- [Review existing policies]({{< ref "/nginx-one/nap-integration/review-policy.md/" >}})
+- [Deploy policies]({{< ref "/nginx-one/nap-integration/deploy-policy.md/" >}}) on instances and Config Sync Groups
+
+You can also set up policies through the [NGINX One Console API]({{< ref "/nginx-one/nap-integration/security-policy-api.md/" >}}).
+
+## Set up NGINX App Protect
+
+You can install and upgrade NGINX App Protect:
+
+Version 4:
+
+- [Install]({{< ref "/nap-waf/v4/admin-guide/install.md" >}})
+- [Upgrade]({{< ref "/nap-waf/v4/admin-guide/upgrade-nap-waf.md" >}})
+
+Version 5:
+
+- [Install]({{< ref "/nap-waf/v5/admin-guide/install.md" >}})
+- [Upgrade]({{< ref "/nap-waf/v5/admin-guide/upgrade-nap-waf.md" >}})
+
+### Container-related configuration requirements
+
+NGINX App Protect WAF Version 5 has specific requirements for the configuration with Docker containers:
+
+- Directory associated with the volume, which you may configure in a `docker-compose.yaml` file.
+  - You may set it up with the `volumes` directive with a directory like `/etc/nginx/app_protect_policies`.
+  - You need to set up the container volume. So when the policy bundle is referenced in the `nginx` directive, the file path is what the container sees.
+  - You need to also include an `app_protect_policy_file`, as described in [App Protect Specific Directives]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#app-protect-specific-directives" >}})
+
+  - You'll need to set a policy bundle (in compressed tar format) in a configured `volume`.
+  - Make sure the directory for [NGINX Agent]({{< ref "/agent/configuration/" >}}) includes `/etc/nginx/app_protect_policies`.
+
+When  you deploy NAP policy through NGINX One Console, do not also use plain JSON policy in the same NGINX instance.
diff --git a/content/nginx-one/nap-integration/review-policy.md b/content/nginx-one/nap-integration/review-policy.md
new file mode 100644
index 000000000..5ab824b2e
--- /dev/null
+++ b/content/nginx-one/nap-integration/review-policy.md
@@ -0,0 +1,40 @@
+---
+# We use sentence case and present imperative tone
+title: "Review policy"
+# Weights are assigned in increments of 100: determines sorting order
+weight: 300
+# Creates a table of contents and sidebar, useful for large documents
+toc: false
+# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
+nd-content-type: how-to
+# Intended for internal catalogue and search, case sensitive:
+# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
+nd-product: NGINX One
+---
+
+Before you implement a policy on an NGINX instance or Config Sync Group, you may want to review it. F5 NGINX One Console creates a policy for your NGINX App Protect WAF system.
+
+## Review NGINX App Protect policies
+
+From NGINX One Console, select **App Protect** > **Policies**. Select the name of the policy that you want to review. You'll see the following tabs:
+
+- Details, which includes:
+  - Policy Details: Descriptions, status, enforcement type, latest version, and last deployed time.
+  - Deployments: List of instances and Config Sync Groups where the NGINX App Protect policy is deployed.
+- Policy JSON: The policy, in JSON format. With the **Edit** button, you can modify this policy.
+- Versions: Policy versions that you've written. You can apply an older policy to your deployments.
+
+## Modify existing policies
+
+From the NGINX One Console, you can also manage existing policies. In the Policies screen, identify a policy, and select **Actions**. From the menu that appears, you can:
+
+- **Edit** an existing policy.
+- **Save As** to save an existing policy with a new name. You can use an existing policy as a baseline for further customization.
+- **Deploy Latest Version** to apply the latest revision of an existing policy to the configured instances and Config Sync Groups.
+- **Export** the policy in JSON format.
+- **Delete** the policy. Once confirmed, you'll lose all work you've done on that policy.
+
+{{< note >}}
+If you use **Save As** to create a new policy, include the `app_protect_cookie_seed` [directive]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#directives" >}}).
+{{< /note >}}
+
diff --git a/content/nginx-one/nap-integration/security-policy-api.md b/content/nginx-one/nap-integration/security-policy-api.md
new file mode 100644
index 000000000..3a9b91d36
--- /dev/null
+++ b/content/nginx-one/nap-integration/security-policy-api.md
@@ -0,0 +1,26 @@
+---
+title: "Set security policies through the API"
+weight: 700
+toc: true
+type: reference
+product: NGINX One
+docs: DOCS-000
+---
+
+You can use F5 NGINX One Console API to manage security policies. With our API, you can:
+
+- [List existing policies]({{< ref "/nginx-one/api/api-reference-guide/#operation/listNapPolicies" >}})
+  - You can set parameters to sort policies by type.
+- [Create a new policy]({{< ref "/nginx-one/api/api-reference-guide/#operation/createNapPolicy" >}})
+  - You need to translate the desired policy.json file to base64 format.
+- [Get policy details]({{< ref "/nginx-one/api/api-reference-guide/#operation/getNapPolicy" >}})
+  - Returns details of the policy you identified with the policy `object_id`.
+- [List NGINX App Protect Deployments]({{< ref "/nginx-one/api/api-reference-guide/#operation/listNapPolicyDeployments" >}})
+  - The output includes:
+    - Target of the deployment
+    - Time of deployment
+    - Enforcement mode
+    - Policy version
+    - Threat campaign
+    - Attack signature
+    - Bot signature
diff --git a/static/nginx-one/api/one.json b/static/nginx-one/api/one.json
index 3dcfbf8f4..00e9d81bb 100644
--- a/static/nginx-one/api/one.json
+++ b/static/nginx-one/api/one.json
@@ -53,8 +53,14 @@
     },
     {
       "name": "Staged Configs",
+      "description": "The `StagedConfigs` object represents a NGINX staged config which users can save to publish at a later time.\n",
       "x-displayName": "Staged Configs"
     },
+    {
+      "name": "Control Planes",
+      "description": "The `Control Planes` object represents an external control plane such as NGINX Ingress Controller.\nFrom this endpoint, you can get detailed information about each control plane, including its Nginx instances, configurations, security advisories, and operational status.\n",
+      "x-displayName": "Control Planes"
+    },
     {
       "name": "Metrics",
       "x-displayName": "Metrics"
@@ -63,6 +69,11 @@
       "name": "Settings",
       "description": "Configuration option for different aspect of NGINX One service.\nYou can set NGINX Instance cleanup preferences.\n",
       "x-displayName": "Settings"
+    },
+    {
+      "name": "NGINX App Protect",
+      "description": "Manage and publish security policies on your NGINX data plane instances.\n",
+      "x-displayName": "NGINX App Protect"
     }
   ],
   "paths": {
@@ -1197,6 +1208,11 @@
               "application/json": {
                 "schema": {
                   "$ref": "#/components/schemas/ConfigSyncGroupDetails"
+                },
+                "examples": {
+                  "ConfigSyncGroupDetails": {
+                    "$ref": "#/components/examples/ConfigSyncGroupDetails"
+                  }
                 }
               }
             }
@@ -1894,6 +1910,151 @@
         }
       ]
     },
+    "/control-planes": {
+      "get": {
+        "tags": [
+          "Control Planes"
+        ],
+        "x-feature-flag": "control_planes_m1",
+        "summary": "List control planes",
+        "operationId": "listControlPlanes",
+        "description": "Returns a paginated list of control planes.\n",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Paginated"
+          },
+          {
+            "$ref": "#/components/parameters/Limit"
+          },
+          {
+            "$ref": "#/components/parameters/Offset"
+          },
+          {
+            "$ref": "#/components/parameters/SortDirection"
+          },
+          {
+            "$ref": "#/components/parameters/SortNameControlPlanes"
+          },
+          {
+            "$ref": "#/components/parameters/FilterOperands"
+          },
+          {
+            "$ref": "#/components/parameters/FilterValues"
+          },
+          {
+            "$ref": "#/components/parameters/FilterFieldControlPlanes"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successfully retrieved the list of control planes.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ControlPlaneListResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerErr"
+          }
+        }
+      }
+    },
+    "/control-planes/{controlPlaneObjectID}": {
+      "delete": {
+        "x-nginx-one-action": "delete",
+        "x-nginx-one-entity": "Control Plane",
+        "tags": [
+          "Control Planes"
+        ],
+        "summary": "Delete a control plane",
+        "description": "Delete a control plane from the NGINX One Console. You can delete a control plane, only if it contains no NGINX instances.\n",
+        "operationId": "deleteControlPlane",
+        "responses": {
+          "204": {
+            "description": "Successfully deleted the control plane"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerErr"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Control Planes"
+        ],
+        "summary": "Retrieve a control plane",
+        "description": "Retrieve the details for a control plane, including:\n* Object ID\n* Product name and version\n* Cluster UUID\n* Kubernetes namespace\n* Deployment UUID\n* Data plane key\n* Certificate summary referenced by control plane instances\n* Instance status summary\n",
+        "operationId": "getControlPlane",
+        "responses": {
+          "200": {
+            "description": "Successfully retrieved the details of the control plane.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ControlPlaneDetails"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerErr"
+          }
+        }
+      },
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/ControlPlaneParamObjectID"
+        }
+      ],
+      "x-feature-flag": "control_planes_m1"
+    },
+    "/control-planes/summary": {
+      "get": {
+        "tags": [
+          "Control Planes"
+        ],
+        "summary": "Retrieve a summary for all Control Planes.",
+        "description": "Retrieves details for all control planes, including:\n  * Number of control planes for each product name/version\n",
+        "operationId": "getControlPlaneSummary",
+        "responses": {
+          "200": {
+            "description": "Successfully retrieved the summary of control planes.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ControlPlaneSummary"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerErr"
+          }
+        }
+      },
+      "x-feature-flag": "control_planes_m1"
+    },
     "/cves": {
       "get": {
         "tags": [
@@ -2377,7 +2538,7 @@
           "Instances"
         ],
         "summary": "Retrieve an instance",
-        "description": "Retrieves the details for an NGINX instance, including\n* Hostname\n* System status\n* Timestamps of key actions (registration, last reported, etc.)\n* NGINX build information\n* Certificate data\n* Operating system version\n* NGINX Agent version\n* Config Sync Group membership details\n",
+        "description": "Retrieves the details for an NGINX instance, including\n* Hostname\n* System status\n* Timestamps of key actions (registration, last reported, etc.)\n* NGINX build information\n* Certificate data\n* Operating system version\n* NGINX Agent version\n* Config Sync Group membership details\n* Control plane object ID, name, product and version\n",
         "operationId": "getInstance",
         "parameters": [
           {
@@ -3223,59 +3384,6 @@
           }
         }
       },
-      "patch": {
-        "x-nginx-one-action": "bulk",
-        "x-nginx-one-entity": "NGINX staged configs",
-        "x-feature-flag": "staged-configs-phase-2",
-        "tags": [
-          "Staged Configs"
-        ],
-        "summary": "Bulk operation on multiple staged configs",
-        "operationId": "bulkStagedConfigs",
-        "description": "Performs bulk operation on one or more staged configs, only delete is supported.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/StagedConfigBulkRequest"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Batch request completed.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/StagedConfigBulkResponse"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Access denied.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Error"
-                }
-              }
-            }
-          },
-          "500": {
-            "description": "An unexpected error occurred on the server. Please try the request again later.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Error"
-                }
-              }
-            }
-          }
-        }
-      },
       "post": {
         "x-feature-flag": "staged-configs",
         "x-nginx-one-action": "create",
@@ -3782,37 +3890,49 @@
         }
       }
     },
-    "/staged-configs/{stagedConfigObjectID}/export": {
-      "get": {
-        "parameters": [
-          {
-            "$ref": "#/components/parameters/StagedConfigParamObjectID"
-          }
-        ],
+    "/monitor/metrics_query_topx": {
+      "post": {
         "tags": [
-          "Staged Configs"
+          "Metrics"
         ],
-        "x-feature-flag": "staged-configs-phase-2",
-        "x-nginx-one-action": "export",
-        "x-nginx-one-entity": "NGINX staged config",
-        "summary": "Export staged configuration",
-        "description": "Exports staged configuration as a gzipped tar archive. Does not include sensitive data such as SSL certificates. [Learn more](https://docs.nginx.com/nginx-one/how-to/staged-configs/import-export-staged-config/).\n",
-        "operationId": "exportStagedConfig",
+        "summary": "Retrieve system metrics for instances with series limit",
+        "operationId": "queryMetricsInputTopX",
+        "description": "Returns (up to 10,000) system metrics for NGINX instances with series limit based on query parameters.\n\nYou can filter metrics by name and timestamp, aggregate metrics over a configurable period of time, and group metrics by dimension.\n",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MetricTopXQueryRequest"
+              },
+              "example": {
+                "start_time": "now-1h",
+                "end_time": "now",
+                "resolution": "1m",
+                "metrics": [
+                  {
+                    "aggregate": "sum",
+                    "name": "nginx.http.request.count"
+                  }
+                ],
+                "series_limit": 1,
+                "group_series_by": "instance_object_id"
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
-            "description": "Successfully exported the staged configuration.",
+            "description": "Successfully retrieved system metrics.",
             "content": {
-              "application/gzip": {
+              "application/json": {
                 "schema": {
-                  "type": "string",
-                  "format": "binary",
-                  "example": "my-staged-config-2025-01-01T20_25_03.tar.gz"
+                  "$ref": "#/components/schemas/MetricQueryResultEx"
                 }
               }
             }
           },
-          "401": {
-            "description": "Access denied",
+          "400": {
+            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
             "content": {
               "application/json": {
                 "schema": {
@@ -3822,7 +3942,7 @@
             }
           },
           "404": {
-            "description": "The NGINX staged config with the specified object_id was not found. Check that the object_id provided is correct and corresponds to an existing resource.",
+            "description": "The requested metric resource was not found. Check that the resource name provided is correct and corresponds to an existing resource.",
             "content": {
               "application/json": {
                 "schema": {
@@ -3844,54 +3964,660 @@
         }
       }
     },
-    "/staged-configs/import": {
-      "post": {
+    "/settings/instance-cleanup": {
+      "get": {
         "tags": [
-          "Staged Configs"
+          "Settings"
         ],
-        "x-feature-flag": "staged-configs-phase-2",
-        "x-nginx-one-action": "import",
-        "x-nginx-one-entity": "NGINX staged config",
-        "summary": "Import staged configuration\n",
-        "description": "Imports a gzipped tar archive (.tar.gz) containing configuration and aux files into NGINX One. \nOnly non-hidden files are included in the import.\n\nMaximum compressed archive size: **5 MB**\nMaximum uncompressed individual file size: **10 MB**\n\nIf `parse_only` is set to `true`, the configuration is only validated and not staged.\nBy default, validation is performed and a staged configuration is created upon success.\n",
-        "parameters": [
-          {
-            "$ref": "#/components/parameters/StagedConfigImportParseOnly"
+        "summary": "Retrieve settings",
+        "description": "Retrieves settings for NGINX Instance cleanup\n",
+        "operationId": "getSettingInstanceCleanup",
+        "responses": {
+          "200": {
+            "description": "Successfully retrieved the setting for NGINX Instance cleanup.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SettingsInstanceCleanup"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerErr"
           }
+        }
+      },
+      "put": {
+        "x-nginx-one-action": "update",
+        "x-nginx-one-entity": "NGINX Instance Cleanup Setting",
+        "tags": [
+          "Settings"
         ],
-        "operationId": "importStagedConfig",
+        "summary": "Update settings",
+        "description": "Update settings for NGINX Instance cleanup\n",
+        "operationId": "updateSettingInstanceCleanup",
         "requestBody": {
           "required": true,
           "content": {
-            "multipart/form-data": {
+            "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/StagedConfigImportRequest"
-              },
-              "encoding": {
-                "file": {
-                  "contentType": "application/gzip, application/x-gzip"
-                }
+                "$ref": "#/components/schemas/SettingsInstanceCleanup"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Return if `parse_only` is `true`: Returns data matching `StagedConfigCreateRequest` that can be used to create the staged config later.  \n",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/StagedConfigCreateRequest"
-                }
-              }
-            }
-          },
-          "201": {
-            "description": "Return if `parse_only` is `false` or omitted: Confirms the import parsed successfully and the staged config was created.\n",
+            "description": "Successfully updated settings for NGINX Instance cleanup.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/StagedConfigCreateResponse"
+                  "$ref": "#/components/schemas/SettingsInstanceCleanup"
+                }
+              }
+            }
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerErr"
+          }
+        }
+      }
+    },
+    "/app-protect/policies": {
+      "get": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "List NGINX App Protect policies",
+        "description": "Returns a list of NGINX App Protect policies along with deployment details.",
+        "operationId": "listNapPolicies",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Paginated"
+          },
+          {
+            "$ref": "#/components/parameters/Limit"
+          },
+          {
+            "$ref": "#/components/parameters/Offset"
+          },
+          {
+            "$ref": "#/components/parameters/SortDirection"
+          },
+          {
+            "$ref": "#/components/parameters/SortNameNapPolicies"
+          },
+          {
+            "$ref": "#/components/parameters/FilterOperands"
+          },
+          {
+            "$ref": "#/components/parameters/FilterValues"
+          },
+          {
+            "$ref": "#/components/parameters/FilterFieldNapPolicy"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successfully returned NGINX App Protect policies.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapPolicyListResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      },
+      "patch": {
+        "x-nginx-one-action": "bulk",
+        "x-nginx-one-entity": "NGINX Nap Policies",
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "Bulk operation on multiple Nap policy",
+        "operationId": "bulkNAPPolicy",
+        "description": "Performs bulk operation on one or more Nap policy, only delete is supported.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NapPolicyBulkRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Batch request completed.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapBulkResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "Create NGINX App Protect policy",
+        "description": "Creates NGINX App Protect policy.",
+        "operationId": "createNapPolicy",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NapPolicy"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Successfully created NGINX App Protect policy.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapPolicyMetadata"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/app-protect/policies/{nap_policy_object_id}": {
+      "delete": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "Delete NGINX App Protect policy",
+        "description": "Deletes NGINX App Protect policy.",
+        "operationId": "deleteNapPolicy",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successfully deleted NGINX App Protect policy."
+          },
+          "400": {
+            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The NGINX App Protect policy with the specified nap_policy_object_id was not found. Check that the nap_policy_object_id provided is correct and corresponds to an existing resource.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      },
+      "get": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "Get NGINX App Protect policy details",
+        "description": "Returns NGINX App Protect policy summary.",
+        "operationId": "getNapPolicy",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successfully returned NGINX App Protect policy details.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapPolicyObject"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The NGINX App Protect policy with the specified nap_policy_object_id was not found. Check that the nap_policy_object_id provided is correct and corresponds to an existing resource.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      },
+      "put": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "Update NGINX App Protect policy details",
+        "description": "Update NGINX App Protect policy details.",
+        "operationId": "updateNapPolicy",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NapPolicy"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Successfully created an NGINX App Protect policy version.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapPolicyMetadata"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The NGINX App Protect policy with the specified nap_policy_object_id was not found. Check that the nap_policy_object_id provided is correct and corresponds to an existing resource.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/app-protect/policies/{nap_policy_object_id}/deployments": {
+      "get": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "List NGINX App Protect deployments",
+        "description": "Returns NGINX App Protect deployments, providing details such as:\n  * Target of the deployment\n  * Time of deployment\n  * Enforcement mode\n  * Policy version\n  * Threat campaign\n  * Attack signature\n  * Bot signature\n",
+        "operationId": "listNapPolicyDeployments",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          },
+          {
+            "$ref": "#/components/parameters/Paginated"
+          },
+          {
+            "$ref": "#/components/parameters/Limit"
+          },
+          {
+            "$ref": "#/components/parameters/Offset"
+          },
+          {
+            "$ref": "#/components/parameters/SortDirection"
+          },
+          {
+            "$ref": "#/components/parameters/SortNameNapPolicyDeployments"
+          },
+          {
+            "$ref": "#/components/parameters/FilterOperands"
+          },
+          {
+            "$ref": "#/components/parameters/FilterValues"
+          },
+          {
+            "$ref": "#/components/parameters/FilterFieldNapPolicyDeployment"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successfully returned NGINX App Protect deployments.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapPolicyDeploymentsListResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The NGINX App Protect policy with the specified nap_policy_object_id was not found. Check that the nap_policy_object_id provided is correct and corresponds to an existing resource.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/app-protect/policies/{nap_policy_object_id}/version": {
+      "get": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "Get the latest NGINX App Protect policy version details",
+        "description": "Returns the latest NGINX App Protect policy version details.",
+        "operationId": "getLatestNapPolicyVersion",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successfully returned NGINX App Protect policy version details.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapPolicyVersionDetails"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The NGINX App Protect policy version with the specified nap_policy_object_id was not found. Check that the nap_policy_object_id provided is correct and corresponds to an existing resource.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/app-protect/policies/{nap_policy_object_id}/versions": {
+      "get": {
+        "x-feature-flag": "nap-waf",
+        "tags": [
+          "NGINX App Protect"
+        ],
+        "summary": "List NGINX App Protect policy versions",
+        "description": "Returns NGINX App Protect policy versions.",
+        "operationId": "listNapPolicyVersions",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          },
+          {
+            "$ref": "#/components/parameters/Paginated"
+          },
+          {
+            "$ref": "#/components/parameters/Limit"
+          },
+          {
+            "$ref": "#/components/parameters/Offset"
+          },
+          {
+            "$ref": "#/components/parameters/SortDirection"
+          },
+          {
+            "$ref": "#/components/parameters/SortNameNapPolicyVersions"
+          },
+          {
+            "$ref": "#/components/parameters/FilterOperands"
+          },
+          {
+            "$ref": "#/components/parameters/FilterValues"
+          },
+          {
+            "$ref": "#/components/parameters/FilterFieldNapPolicyVersion"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successfully returned the NGINX App Protect policy versions.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NapPolicyVersionsListResponse"
                 }
               }
             }
@@ -3907,7 +4633,17 @@
             }
           },
           "401": {
-            "description": "Access denied",
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The NGINX App Protect policy with the specified nap_policy_object_id was not found. Check that the nap_policy_object_id provided is correct and corresponds to an existing resource.",
             "content": {
               "application/json": {
                 "schema": {
@@ -3929,49 +4665,29 @@
         }
       }
     },
-    "/monitor/metrics_query_topx": {
-      "post": {
+    "/app-protect/policies/{nap_policy_object_id}/versions/{nap_policy_version_object_id}": {
+      "delete": {
+        "x-feature-flag": "nap-waf",
         "tags": [
-          "Metrics"
+          "NGINX App Protect"
         ],
-        "summary": "Retrieve system metrics for instances with series limit",
-        "operationId": "queryMetricsInputTopX",
-        "description": "Returns (up to 10,000) system metrics for NGINX instances with series limit based on query parameters.\n\nYou can filter metrics by name and timestamp, aggregate metrics over a configurable period of time, and group metrics by dimension.\n",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/MetricTopXQueryRequest"
-              },
-              "example": {
-                "start_time": "now-1h",
-                "end_time": "now",
-                "resolution": "1m",
-                "metrics": [
-                  {
-                    "aggregate": "sum",
-                    "name": "nginx.http.request.count"
-                  }
-                ],
-                "series_limit": 1,
-                "group_series_by": "instance_object_id"
-              }
-            }
+        "summary": "Delete NGINX App Protect policy version",
+        "description": "Deletes the NGINX App Protect policy version.",
+        "operationId": "deleteNapPolicyVersion",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          },
+          {
+            "$ref": "#/components/parameters/NapPolicyVersionParamObjectID"
           }
-        },
+        ],
         "responses": {
-          "200": {
-            "description": "Successfully retrieved system metrics.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/MetricQueryResultEx"
-                }
-              }
-            }
+          "204": {
+            "description": "Successfully deleted the NGINX App Protect policy version."
           },
-          "400": {
-            "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+          "401": {
+            "description": "Access denied.",
             "content": {
               "application/json": {
                 "schema": {
@@ -3981,7 +4697,7 @@
             }
           },
           "404": {
-            "description": "The requested metric resource was not found. Check that the resource name provided is correct and corresponds to an existing resource.",
+            "description": "The NGINX App Protect policy version with the specified nap_policy_version_object_id and nap_policy_version_object_id was not found. Check that the object IDs provided are correct and corresponds to existing resources.",
             "content": {
               "application/json": {
                 "schema": {
@@ -4001,67 +4717,63 @@
             }
           }
         }
-      }
-    },
-    "/settings/instance-cleanup": {
+      },
       "get": {
+        "x-feature-flag": "nap-waf",
         "tags": [
-          "Settings"
+          "NGINX App Protect"
+        ],
+        "summary": "Get the specified NGINX App Protect policy version details",
+        "description": "Returns the specified NGINX App Protect policy version details.",
+        "operationId": "getNapPolicyVersion",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/NapPolicyParamObjectID"
+          },
+          {
+            "$ref": "#/components/parameters/NapPolicyVersionParamObjectID"
+          }
         ],
-        "summary": "Retrieve settings",
-        "description": "Retrieves settings for NGINX Instance cleanup\n",
-        "operationId": "getSettingInstanceCleanup",
         "responses": {
           "200": {
-            "description": "Successfully retrieved the setting for NGINX Instance cleanup.",
+            "description": "Successfully returned NGINX App Protect policy version details.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SettingsInstanceCleanup"
+                  "$ref": "#/components/schemas/NapPolicyVersionDetails"
                 }
               }
             }
           },
-          "400": {
-            "$ref": "#/components/responses/InvalidRequest"
-          },
-          "500": {
-            "$ref": "#/components/responses/InternalServerErr"
-          }
-        }
-      },
-      "put": {
-        "x-nginx-one-action": "update",
-        "x-nginx-one-entity": "NGINX Instance Cleanup Setting",
-        "tags": [
-          "Settings"
-        ],
-        "summary": "Update settings",
-        "description": "Update settings for NGINX Instance cleanup\n",
-        "operationId": "updateSettingInstanceCleanup",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/SettingsInstanceCleanup"
+          "401": {
+            "description": "Access denied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
               }
             }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Successfully updated settings for NGINX Instance cleanup.",
+          },
+          "404": {
+            "description": "The NGINX App Protect policy version with the specified nap_policy_version_object_id and nap_policy_version_object_id was not found. Check that the object IDs provided are correct and corresponds to existing resources.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SettingsInstanceCleanup"
+                  "$ref": "#/components/schemas/Error"
                 }
               }
             }
           },
           "500": {
-            "$ref": "#/components/responses/InternalServerErr"
+            "description": "An unexpected error occurred on the server. Please try the request again later.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           }
         }
       }
@@ -4290,6 +5002,43 @@
         "description": "A globally unique identifier for a Publication.\n",
         "required": true
       },
+      "SortNameControlPlanes": {
+        "name": "sort_control_planes",
+        "in": "query",
+        "description": "Sort control planes by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
+        "schema": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "name"
+            ],
+            "x-enum-varnames": [
+              "sort_name_control_plane_name"
+            ]
+          }
+        }
+      },
+      "FilterFieldControlPlanes": {
+        "name": "filter_fields",
+        "in": "query",
+        "description": "An array of strings. Identifies the fields to filter by (for example, `name`, `product`). This parameter works in conjunction with `filter_values` and `filter_ops`.\n",
+        "schema": {
+          "type": "array",
+          "items": {
+            "$ref": "#/components/schemas/FilterNameControlPlanes"
+          }
+        }
+      },
+      "ControlPlaneParamObjectID": {
+        "name": "controlPlaneObjectID",
+        "in": "path",
+        "schema": {
+          "$ref": "#/components/schemas/ControlPlaneObjectID"
+        },
+        "description": "A globally unique identifier for the control plane.\n",
+        "required": true
+      },
       "SortNameCVEs": {
         "name": "sort_cves",
         "in": "query",
@@ -4362,102 +5111,220 @@
         "description": "A globally unique identifier for an event.\n",
         "required": true
       },
-      "FilterFieldInstances": {
+      "FilterFieldInstances": {
+        "name": "filter_fields",
+        "in": "query",
+        "description": "An array of strings indicating which fields to filter by (for example, `hostname`, `nginx_version`). This parameter works in conjunction with `filter_values` and `filter_ops`.\n",
+        "schema": {
+          "type": "array",
+          "items": {
+            "$ref": "#/components/schemas/FilterNameInstances"
+          }
+        }
+      },
+      "SortNameInstances": {
+        "name": "sort_instances",
+        "in": "query",
+        "description": "Sort instances by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
+        "schema": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "hostname",
+              "status",
+              "last_reported"
+            ],
+            "x-enum-varnames": [
+              "sort_name_instance_hostname",
+              "sort_name_instance_status",
+              "sort_name_instance_last_reported"
+            ]
+          }
+        }
+      },
+      "InstanceParamObjectID": {
+        "name": "instanceObjectID",
+        "in": "path",
+        "schema": {
+          "$ref": "#/components/schemas/InstanceObjectID"
+        },
+        "description": "A globally unique identifier for the NGINX instance.\n",
+        "required": true
+      },
+      "InstanceConfigurationParamObjectID": {
+        "name": "instanceConfigurationObjectID",
+        "in": "path",
+        "schema": {
+          "$ref": "#/components/schemas/NginxConfigObjectID"
+        },
+        "description": "A globally unique identifier for the NGINX instance configuration.\n",
+        "required": true
+      },
+      "FilterFieldStagedConfigs": {
+        "name": "filter_fields",
+        "in": "query",
+        "description": "An array of strings indicating which fields to filter by (for example, `name`). This parameter works in conjunction with `filter_values` and `filter_ops`.\n",
+        "schema": {
+          "type": "array",
+          "items": {
+            "$ref": "#/components/schemas/FilterStagedConfigs"
+          }
+        }
+      },
+      "SortNameStagedConfigs": {
+        "name": "sort_staged_configs",
+        "in": "query",
+        "description": "Sort staged configs by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
+        "schema": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "name"
+            ],
+            "x-enum-varnames": [
+              "sort_name_staged_config_name"
+            ]
+          }
+        }
+      },
+      "StagedConfigParamObjectID": {
+        "name": "stagedConfigObjectID",
+        "in": "path",
+        "schema": {
+          "$ref": "#/components/schemas/StagedConfigObjectID"
+        },
+        "description": "A globally unique identifier for the NGINX staged config.\n",
+        "required": true
+      },
+      "SortNameNapPolicies": {
+        "name": "sort_nap_policies",
+        "in": "query",
+        "description": "Sort NGINX App Protect policies by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
+        "schema": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "name",
+              "deployment_count",
+              "enforcement_mode",
+              "last_deployed"
+            ],
+            "x-enum-varnames": [
+              "sort_name_nap_policies_name",
+              "sort_name_nap_policies_deployment_count",
+              "sort_name_nap_policies_enforcement_mode",
+              "sort_name_nap_policies_last_deployed"
+            ]
+          }
+        }
+      },
+      "FilterFieldNapPolicy": {
         "name": "filter_fields",
         "in": "query",
-        "description": "An array of strings indicating which fields to filter by (for example, `hostname`, `nginx_version`). This parameter works in conjunction with `filter_values` and `filter_ops`.\n",
+        "description": "An array of strings indicating which fields to filter by (for example, `name`). This parameter works in conjunction with `filter_values` and `filter_ops`.\n",
         "schema": {
           "type": "array",
           "items": {
-            "$ref": "#/components/schemas/FilterNameInstances"
+            "$ref": "#/components/schemas/FilterNameNapPolicy"
           }
         }
       },
-      "SortNameInstances": {
-        "name": "sort_instances",
+      "NapPolicyParamObjectID": {
+        "name": "nap_policy_object_id",
+        "in": "path",
+        "schema": {
+          "$ref": "#/components/schemas/NapPolicyObjectID"
+        },
+        "description": "A globally unique identifier for the App Protect policy.\n",
+        "required": true
+      },
+      "SortNameNapPolicyDeployments": {
+        "name": "sort_nap_deployments",
         "in": "query",
-        "description": "Sort instances by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
+        "description": "Sort NGINX App Protect deployments by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
         "schema": {
           "type": "array",
           "items": {
             "type": "string",
             "enum": [
-              "hostname",
+              "name",
+              "type",
+              "policy_version",
               "status",
-              "last_reported"
+              "deployed_on",
+              "threat_campaign_version",
+              "attack_signature_version",
+              "bot_signature_version"
             ],
             "x-enum-varnames": [
-              "sort_name_instance_hostname",
-              "sort_name_instance_status",
-              "sort_name_instance_last_reported"
+              "sort_name_nap_policy_deployments_name",
+              "sort_name_nap_policy_deployments_type",
+              "sort_name_nap_policy_deployments_policy_version",
+              "sort_name_nap_policy_deployments_status",
+              "sort_name_nap_policy_deployments_deployed_on",
+              "sort_name_nap_policy_deployments_threat_campaign_version",
+              "sort_name_nap_policy_deployments_attack_signature_version",
+              "sort_name_nap_policy_deployments_bot_sigature_version"
             ]
           }
         }
       },
-      "InstanceParamObjectID": {
-        "name": "instanceObjectID",
-        "in": "path",
-        "schema": {
-          "$ref": "#/components/schemas/InstanceObjectID"
-        },
-        "description": "A globally unique identifier for the NGINX instance.\n",
-        "required": true
-      },
-      "InstanceConfigurationParamObjectID": {
-        "name": "instanceConfigurationObjectID",
-        "in": "path",
-        "schema": {
-          "$ref": "#/components/schemas/NginxConfigObjectID"
-        },
-        "description": "A globally unique identifier for the NGINX instance configuration.\n",
-        "required": true
-      },
-      "FilterFieldStagedConfigs": {
+      "FilterFieldNapPolicyDeployment": {
         "name": "filter_fields",
         "in": "query",
         "description": "An array of strings indicating which fields to filter by (for example, `name`). This parameter works in conjunction with `filter_values` and `filter_ops`.\n",
         "schema": {
           "type": "array",
           "items": {
-            "$ref": "#/components/schemas/FilterStagedConfigs"
+            "$ref": "#/components/schemas/FilterNameNapPolicyDeployment"
           }
         }
       },
-      "SortNameStagedConfigs": {
-        "name": "sort_staged_configs",
+      "SortNameNapPolicyVersions": {
+        "name": "sort_nap_policy_versions",
         "in": "query",
-        "description": "Sort staged configs by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
+        "description": "Sort NGINX App Protect policy versions by enumerate value(s). Ordinal position determines primary, secondary, etc.\n",
         "schema": {
           "type": "array",
           "items": {
             "type": "string",
             "enum": [
-              "name"
+              "created_at",
+              "deployment_status",
+              "deployment_count",
+              "enforcement_mode"
             ],
             "x-enum-varnames": [
-              "sort_name_staged_config_name"
+              "sort_name_nap_policy_versions_created_at",
+              "sort_name_nap_policy_versions_deployment_status",
+              "sort_name_nap_policy_versions_deployment_count",
+              "sort_name_nap_policy_versions_enforcement_mode"
             ]
           }
         }
       },
-      "StagedConfigParamObjectID": {
-        "name": "stagedConfigObjectID",
-        "in": "path",
+      "FilterFieldNapPolicyVersion": {
+        "name": "filter_fields",
+        "in": "query",
+        "description": "An array of strings indicating which fields to filter by (for example, `name`). This parameter works in conjunction with `filter_values` and `filter_ops`.\n",
         "schema": {
-          "$ref": "#/components/schemas/StagedConfigObjectID"
-        },
-        "description": "A globally unique identifier for the NGINX staged config.\n",
-        "required": true
+          "type": "array",
+          "items": {
+            "$ref": "#/components/schemas/FilterNameNapPolicyVersion"
+          }
+        }
       },
-      "StagedConfigImportParseOnly": {
-        "name": "parseOnly",
-        "in": "query",
+      "NapPolicyVersionParamObjectID": {
+        "name": "nap_policy_version_object_id",
+        "in": "path",
         "schema": {
-          "type": "boolean",
-          "default": false
+          "$ref": "#/components/schemas/NapPolicyVersionObjectID"
         },
-        "description": "Optional flag to control how the request is processed.\n  - When `false` or omitted (by default), the request creates a Staged Config directly. (`StagedConfigCreateResponse`)\n  - When `true`, the request parses the import and returns metadata you can use to create a Staged Config through a POST. ( `StagedConfigCreateRequest`)\n",
-        "required": false
+        "description": "A globally unique identifier for the App Protect policy version.\n",
+        "required": true
       }
     },
     "schemas": {
@@ -4579,6 +5446,10 @@
           "instances_count": {
             "type": "integer",
             "description": "The number of registered instances using this data plane key. If field not populated, user should see the key has `unknown` key count"
+          },
+          "control_planes_count": {
+            "type": "integer",
+            "description": "The number of observed control planes using this data plane key."
           }
         }
       },
@@ -5707,7 +6578,8 @@
         "description": "Meta information of the NGINX config sync group including:\n* NGINX config sync group object ID\n* unique name of the config sync group in the tenant namespace\n* last publication timestamp\n",
         "required": [
           "object_id",
-          "name"
+          "name",
+          "created_at"
         ],
         "properties": {
           "object_id": {
@@ -5721,6 +6593,11 @@
             "description": "The date and time of the most recent config sync group publication.",
             "type": "string",
             "format": "date-time"
+          },
+          "created_at": {
+            "description": "The date and time when the config sync group was created.",
+            "type": "string",
+            "format": "date-time"
           }
         },
         "example": {
@@ -5761,8 +6638,8 @@
           }
         }
       },
-      "NginxAppProtectDetails": {
-        "description": "Information regarding NGINX App Protect.\n",
+      "NginxAppProtectVersions": {
+        "description": "Version information regarding NGINX App Protect.\n",
         "type": "object",
         "required": [
           "engine_version"
@@ -5778,6 +6655,54 @@
           }
         }
       },
+      "NginxAppProtectDeploymentCounts": {
+        "type": "object",
+        "description": "Summary count of NAP policy version deployment statues.",
+        "required": [
+          "total",
+          "deployed",
+          "deploying",
+          "failed"
+        ],
+        "properties": {
+          "total": {
+            "description": "Total count of NAP policy versions across the NGINX data plane.",
+            "type": "integer"
+          },
+          "deployed": {
+            "description": "The number of NAP policy versions that have deployed.",
+            "type": "integer"
+          },
+          "deploying": {
+            "description": "The number of NAP policy versions that are deploying.",
+            "type": "integer"
+          },
+          "failed": {
+            "description": "The number of NAP policy versions that have failed deployment.",
+            "type": "integer"
+          }
+        }
+      },
+      "NginxAppProtectSummary": {
+        "description": "Summary information regarding NGINX App Protect.\n",
+        "type": "object",
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/NginxAppProtectVersions"
+          },
+          {
+            "type": "object",
+            "required": [
+              "deployments"
+            ],
+            "properties": {
+              "deployments": {
+                "$ref": "#/components/schemas/NginxAppProtectDeploymentCounts"
+              }
+            }
+          }
+        ]
+      },
       "CveSeverityType": {
         "type": "string",
         "description": "Severity ratings:\n  * `high` - High severity.\n  * `medium` - Moderate severity.\n  * `low` - Least severe.\n  * `none` - Not severe.\n  * `other`  - Severity that does not fit the other categories.\n",
@@ -5846,6 +6771,40 @@
           }
         }
       },
+      "ControlPlaneObjectID": {
+        "description": "A globally unique identifier for the control plane.",
+        "type": "string",
+        "format": "object_id",
+        "pattern": "^ecp_.*",
+        "x-go-type": "objects.ID"
+      },
+      "ControlPlaneBaseInfo": {
+        "type": "object",
+        "description": "Base information of a control plane, which includes name, product version and optionally an object ID.",
+        "required": [
+          "name",
+          "product_version",
+          "created_at"
+        ],
+        "properties": {
+          "object_id": {
+            "$ref": "#/components/schemas/ControlPlaneObjectID"
+          },
+          "name": {
+            "description": "Control plane name.",
+            "type": "string"
+          },
+          "product_version": {
+            "description": "Control plane product name and version.",
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "The date and time when the control plane was created."
+          }
+        }
+      },
       "Instance": {
         "type": "object",
         "description": "Summary information about a NGINX instance.",
@@ -5890,7 +6849,7 @@
             "example": "ubuntu_jammy"
           },
           "nginx_app_protect": {
-            "$ref": "#/components/schemas/NginxAppProtectDetails"
+            "$ref": "#/components/schemas/NginxAppProtectSummary"
           },
           "registered_at": {
             "description": "The date and time when the NGINX instance first registered with NGINX One.",
@@ -5928,6 +6887,9 @@
             "items": {
               "$ref": "#/components/schemas/IssueDetails"
             }
+          },
+          "control_plane": {
+            "$ref": "#/components/schemas/ControlPlaneBaseInfo"
           }
         }
       },
@@ -5964,79 +6926,209 @@
           "partially_succeeded"
         ],
         "x-enum-varnames": [
-          "publication_config_sync_group_status_pending",
-          "publication_config_sync_group_status_failed",
-          "publication_config_sync_group_status_succeeded",
-          "publication_config_sync_group_status_partially_succeeded"
+          "publication_config_sync_group_status_pending",
+          "publication_config_sync_group_status_failed",
+          "publication_config_sync_group_status_succeeded",
+          "publication_config_sync_group_status_partially_succeeded"
+        ]
+      },
+      "CertAssociation": {
+        "type": "object",
+        "description": "Details for a certificate that's associated with an instance or a config sync group.",
+        "required": [
+          "name",
+          "object_id",
+          "cert_type",
+          "subject_name",
+          "not_before",
+          "not_after",
+          "cert_status",
+          "deployment_status"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "A friendly name for the certificate."
+          },
+          "object_id": {
+            "$ref": "#/components/schemas/CertificateObjectID"
+          },
+          "cert_type": {
+            "$ref": "#/components/schemas/CertificateType"
+          },
+          "cert_paths": {
+            "type": "array",
+            "description": "The list of file system paths where the certificate file is installed. \nSince a single certificate file may be applied in multiple contexts, all relevant paths are included.\n",
+            "example": [
+              "/etc/ssl/cert.pem",
+              "/etc/ssl/cert.crt"
+            ],
+            "items": {
+              "type": "string"
+            }
+          },
+          "key_paths": {
+            "type": "array",
+            "description": "The list of file system paths where the private key file is installed.\nSince a single key file may be applied in multiple contexts, all relevant paths are included.\n",
+            "example": [
+              "/etc/nginx/key.pem",
+              "/etc/ssl/server.key"
+            ],
+            "items": {
+              "type": "string"
+            }
+          },
+          "deployment_status": {
+            "$ref": "#/components/schemas/CertificateDeploymentStatus"
+          },
+          "subject_name": {
+            "type": "string",
+            "description": "Hostname or domain for the certificate. Usually the subject-alt-name (SAN) value for the certificate.\nif SAN is not present, this will be the certificate subject's common name.\n",
+            "example": "nginx.com"
+          },
+          "cert_status": {
+            "$ref": "#/components/schemas/CertificateStatus"
+          },
+          "not_before": {
+            "type": "string",
+            "format": "date-time",
+            "description": "the effective date of the certificate."
+          },
+          "not_after": {
+            "type": "string",
+            "format": "date-time",
+            "description": "The expiration date for the certificate."
+          }
+        }
+      },
+      "NapPolicyObjectID": {
+        "description": "A globally unique identifier for the App Protect policy.",
+        "type": "string",
+        "format": "object_id",
+        "pattern": "^pol_.*",
+        "x-go-type": "objects.ID",
+        "x-go-type-import": {
+          "name": "objects",
+          "path": "gitlab.com/f5/nginx/one/saas/control-plane/pkg/collections/objects"
+        }
+      },
+      "NapPolicyVersionObjectID": {
+        "description": "A globally unique identifier for the App Protect policy version.",
+        "type": "string",
+        "format": "object_id",
+        "pattern": "^pv_.*",
+        "x-go-type": "objects.ID",
+        "x-go-type-import": {
+          "name": "objects",
+          "path": "gitlab.com/f5/nginx/one/saas/control-plane/pkg/collections/objects"
+        }
+      },
+      "PublicationObjectID": {
+        "description": "A globally unique identifier for the publication.",
+        "type": "string",
+        "format": "object_id",
+        "example": "pub_72pGHoGsSICL_THZrs964g",
+        "pattern": "^pub_.*",
+        "x-go-type": "objects.ID",
+        "x-go-type-import": {
+          "name": "objects",
+          "path": "gitlab.com/f5/nginx/one/saas/control-plane/pkg/collections/objects"
+        }
+      },
+      "NapPolicyEnforcementMode": {
+        "description": "The current enforcement mode of the NGINX App Protect policy, with the following possible values:\n* `blocking` - Any illegal or suspicious requests are logged and blocked.\n* `transparent` - Any illegal or suspicious requests are logged but not blocked.\n",
+        "type": "string",
+        "enum": [
+          "blocking",
+          "transparent"
+        ],
+        "x-enum-varnames": [
+          "nap_enforcement_mode_blocking",
+          "nap_enforcement_mode_transparent"
+        ]
+      },
+      "NapDeploymentStatus": {
+        "description": "The current enforcement mode of the NGINX App Protect policy, with the following possible values:\n* `deployed` - The NGINX App Protect policy has been deployed.\n* `not_deployed` - The NGINX App Protect policy has not been deployed.\n* `deploying` - The NGINX App Protect policy is currently being deployed.\n* `failed` - The NGINX App Protect policy failed deploying.\n",
+        "type": "string",
+        "enum": [
+          "deployed",
+          "not_deployed",
+          "deploying",
+          "failed"
+        ],
+        "x-enum-varnames": [
+          "nap_deployment_status_deployed",
+          "nap_deployment_status_not_deployed",
+          "nap_deployment_status_deploying",
+          "nap_deployment_status_failed"
         ]
       },
-      "CertAssociation": {
-        "type": "object",
-        "description": "Details for a certificate that's associated with an instance or a config sync group.",
+      "NapAssociation": {
+        "description": "Details for a NGINX App Protect policy version that's associated with an instance or a config sync group.",
         "required": [
           "name",
-          "object_id",
-          "cert_type",
-          "subject_name",
-          "not_before",
-          "not_after",
-          "cert_status",
-          "deployment_status"
+          "version",
+          "policy_object_id",
+          "policy_version_object_id",
+          "paths",
+          "deployment_status",
+          "publication_object_id",
+          "deployed_on",
+          "enforcement_mode"
         ],
         "properties": {
           "name": {
             "type": "string",
-            "description": "A friendly name for the certificate."
+            "description": "Name of the policy at the time of the deployment."
           },
-          "object_id": {
-            "$ref": "#/components/schemas/CertificateObjectID"
+          "version": {
+            "type": "string",
+            "description": "Version of the policy at the time of the deployment."
           },
-          "cert_type": {
-            "$ref": "#/components/schemas/CertificateType"
+          "policy_object_id": {
+            "$ref": "#/components/schemas/NapPolicyObjectID"
           },
-          "cert_paths": {
-            "type": "array",
-            "description": "The list of file system paths where the certificate file is installed. \nSince a single certificate file may be applied in multiple contexts, all relevant paths are included.\n",
-            "example": [
-              "/etc/ssl/cert.pem",
-              "/etc/ssl/cert.crt"
-            ],
-            "items": {
-              "type": "string"
-            }
+          "policy_version_object_id": {
+            "$ref": "#/components/schemas/NapPolicyVersionObjectID"
           },
-          "key_paths": {
+          "publication_object_id": {
+            "$ref": "#/components/schemas/PublicationObjectID"
+          },
+          "enforcement_mode": {
+            "$ref": "#/components/schemas/NapPolicyEnforcementMode"
+          },
+          "paths": {
             "type": "array",
-            "description": "The list of file system paths where the private key file is installed.\nSince a single key file may be applied in multiple contexts, all relevant paths are included.\n",
+            "description": "The list of file system paths where the compiled NAP policy version bundle file is installed. \nSince a single compiled NAP policy version bundle file may be applied in multiple contexts, all relevant paths are included.\n",
             "example": [
-              "/etc/nginx/key.pem",
-              "/etc/ssl/server.key"
+              "/etc/nginx/default_policy.tgz",
+              "/etc/nginx/default_policy_server_2.tgz"
             ],
             "items": {
               "type": "string"
             }
           },
           "deployment_status": {
-            "$ref": "#/components/schemas/CertificateDeploymentStatus"
-          },
-          "subject_name": {
-            "type": "string",
-            "description": "Hostname or domain for the certificate. Usually the subject-alt-name (SAN) value for the certificate.\nif SAN is not present, this will be the certificate subject's common name.\n",
-            "example": "nginx.com"
-          },
-          "cert_status": {
-            "$ref": "#/components/schemas/CertificateStatus"
-          },
-          "not_before": {
-            "type": "string",
-            "format": "date-time",
-            "description": "the effective date of the certificate."
+            "$ref": "#/components/schemas/NapDeploymentStatus"
           },
-          "not_after": {
+          "deployed_on": {
+            "description": "Date and time of the deployment.",
             "type": "string",
-            "format": "date-time",
-            "description": "The expiration date for the certificate."
+            "format": "date-time"
           }
+        },
+        "example": {
+          "name": "default_policy",
+          "version": "2025.05.01",
+          "policy_object_id": "pol_panEdeY-Sh2rWm365y7wsw",
+          "policy_version_object_id": "pv_kem7SCosTTOL9mMlNyY2GQ",
+          "publication_object_id": "pub_72pGHoGsSICL_THZrs964g",
+          "paths": [
+            "/etc/nginx/default_policy.tgz"
+          ],
+          "deployment_status": "deployed",
+          "enforcement_mode": "transparent",
+          "deployed_on": "2023-12-06T22:37:24.120114Z"
         }
       },
       "ConfigSyncGroup": {
@@ -6071,6 +7163,20 @@
                 "items": {
                   "$ref": "#/components/schemas/CertAssociation"
                 }
+              },
+              "nginx_app_protect": {
+                "type": "object",
+                "required": [
+                  "deployments"
+                ],
+                "properties": {
+                  "deployments": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/NapAssociation"
+                    }
+                  }
+                }
               }
             }
           }
@@ -6078,7 +7184,6 @@
         "example": {
           "object_id": "csg_-uvR3F2TQGm18jnl7bpaGw",
           "name": "test-config-sync-group",
-          "last_reported": "2023-12-06T22:37:24.120114Z",
           "config_status": "in_sync",
           "config_version": "uvR3F2TQGm18jnl7bpaGw",
           "instances": [
@@ -6476,18 +7581,6 @@
           }
         ]
       },
-      "PublicationObjectID": {
-        "description": "A globally unique identifier for the publication.",
-        "type": "string",
-        "format": "object_id",
-        "example": "pub_72pGHoGsSICL_THZrs964g",
-        "pattern": "^pub_.*",
-        "x-go-type": "objects.ID",
-        "x-go-type-import": {
-          "name": "objects",
-          "path": "gitlab.com/f5/nginx/one/saas/control-plane/pkg/collections/objects"
-        }
-      },
       "PublicationStatusCause": {
         "description": "Cause of the failure, provided only if the status is `failed`.",
         "type": "object",
@@ -6632,115 +7725,341 @@
           "status": "pending"
         }
       },
-      "NginxConfigProblem": {
+      "NginxConfigProblem": {
+        "type": "object",
+        "description": "Representation of a problem found during NGINX configuration analysis.",
+        "properties": {
+          "directive": {
+            "description": "Directive in the NGINX configuration where the issue is identified.",
+            "type": "string"
+          },
+          "file": {
+            "description": "File where the issue is detected.",
+            "type": "string"
+          },
+          "line": {
+            "description": "Line number in the configuration where the issue is found.",
+            "type": "integer"
+          }
+        }
+      },
+      "NginxConfigReport": {
+        "type": "object",
+        "description": "An analysis of the NGINX configuration, highlighting issues and their severity, and offering recommendations.",
+        "properties": {
+          "rule": {
+            "description": "The name of the configuration rule that was violated.",
+            "type": "string"
+          },
+          "info": {
+            "description": "A detailed description of the issue.",
+            "type": "string"
+          },
+          "severity": {
+            "description": "The severity level of the issue.",
+            "type": "string"
+          },
+          "category": {
+            "description": "Classification category of the issue.",
+            "type": "string"
+          },
+          "documentation": {
+            "description": "Links to documentation that can assist in resolving the identified issue.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "where": {
+            "description": "Specific locations in the configuration where issues were detected.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/NginxConfigProblem"
+            }
+          }
+        }
+      },
+      "NginxConfigReports": {
+        "type": "array",
+        "items": {
+          "$ref": "#/components/schemas/NginxConfigReport"
+        }
+      },
+      "NginxConfigMeta": {
+        "type": "object",
+        "description": "Meta data of an NGINX configuration, including its unique identifier, the config_version.\n",
+        "required": [
+          "object_id",
+          "config_version",
+          "created_at",
+          "modified_at",
+          "config_source"
+        ],
+        "properties": {
+          "object_id": {
+            "$ref": "#/components/schemas/NginxConfigObjectID"
+          },
+          "config_version": {
+            "type": "string",
+            "description": "A hash that uniquely identifies the contents of the config object.\n"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "The date and time when the NGINX configuration object was created for the instance."
+          },
+          "modified_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "The date and time when the NGINX configuration object was last modified for the instance."
+          },
+          "config_source": {
+            "type": "string",
+            "enum": [
+              "NGINX One",
+              "Other",
+              "Unspecified"
+            ],
+            "x-enum-varnames": [
+              "config_source_nginx_one",
+              "config_source_other",
+              "config_source_unspecified"
+            ],
+            "description": "The source from which the config was created:\n-  `NGINX One`: The config was created from NGINX One.\n-  `Other`: The config was created from data plane.\n-  `Unspecified`: The source of the config is unspecified.\n"
+          }
+        },
+        "example": {
+          "object_id": "nc_AamgWtYSSb6OWGljx3wNDA",
+          "config_version": "Cm1hcCAkdXJpICRtYXBwZWRfc2V",
+          "created_at": "2023-08-10T16:59:15Z",
+          "modified_at": "2023-08-10T16:59:15Z",
+          "config_source": "NGINX One"
+        }
+      },
+      "FilterNameControlPlanes": {
+        "type": "string",
+        "description": "Keywords for control plane filters.\nWhen filtering on `product`, only the following `filter_values` are supported:\n  * nic\n",
+        "enum": [
+          "name",
+          "product_version",
+          "object_id"
+        ],
+        "x-enum-varnames": [
+          "filter_name_control_plane_name",
+          "filter_name_control_plane_product_version",
+          "filter_name_control_plane_object_id"
+        ]
+      },
+      "ListControlPlaneObject": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/ControlPlaneBaseInfo"
+          },
+          {
+            "type": "object",
+            "description": "Summary information about a control plane.",
+            "required": [
+              "object_id",
+              "instances_count",
+              "online_instances_count"
+            ],
+            "properties": {
+              "object_id": {
+                "$ref": "#/components/schemas/ControlPlaneObjectID"
+              },
+              "instances_count": {
+                "description": "Total number of instances in the control plane.",
+                "type": "integer"
+              },
+              "online_instances_count": {
+                "description": "Total number of online instances in the control plane.",
+                "type": "integer"
+              }
+            }
+          }
+        ]
+      },
+      "ControlPlaneListResponse": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/PaginationResponse"
+          },
+          {
+            "type": "object",
+            "description": "List of control planes.",
+            "required": [
+              "items"
+            ],
+            "properties": {
+              "items": {
+                "description": "An array of control plane objects.",
+                "type": "array",
+                "items": {
+                  "$ref": "#/components/schemas/ListControlPlaneObject"
+                }
+              }
+            }
+          }
+        ],
+        "example": {
+          "total": 10,
+          "count": 1,
+          "start_index": 1,
+          "items_per_page": 100,
+          "items": [
+            {
+              "object_id": "ecp_tgfVM3KQTxCyiDXgV38G7A",
+              "name": "nginx-ingress-001",
+              "product_version": "nginx-ingress-controller-4.0.1",
+              "instances_count": 5,
+              "online_instances_count": 3
+            },
+            {
+              "object_id": "ecp_-bRQlhscTKmbUIdJaYhGJA",
+              "name": "nginx-ingress-002",
+              "product_version": "nginx-ingress-controller-4.0.1",
+              "instances_count": 3,
+              "online_instances_count": 1
+            }
+          ]
+        }
+      },
+      "StatusSummary": {
+        "description": "An overview of the status for each NGINX instance, indicating availability.",
         "type": "object",
-        "description": "Representation of a problem found during NGINX configuration analysis.",
+        "required": [
+          "online",
+          "offline",
+          "unavailable"
+        ],
         "properties": {
-          "directive": {
-            "description": "Directive in the NGINX configuration where the issue is identified.",
-            "type": "string"
+          "online": {
+            "description": "The number of NGINX instances reporting as `online`.\nThe NGINX Agent is connected to NGINX One, and the NGINX instance is online.\n",
+            "type": "integer"
           },
-          "file": {
-            "description": "File where the issue is detected.",
-            "type": "string"
+          "offline": {
+            "description": "The number of NGINX instances reporting as `offline`.\nThe NGINX Agent is connected to NGINX One, but the NGINX instance is offline.\n",
+            "type": "integer"
           },
-          "line": {
-            "description": "Line number in the configuration where the issue is found.",
+          "unavailable": {
+            "description": "The number of NGINX instances reporting as `unavailable`.\nThe NGINX Agent has lost connection to NGINX One, rendering the NGINX instance unavailable.\n",
             "type": "integer"
           }
         }
       },
-      "NginxConfigReport": {
+      "ControlPlane": {
         "type": "object",
-        "description": "An analysis of the NGINX configuration, highlighting issues and their severity, and offering recommendations.",
+        "description": "Information on control plane including:\n* Control plane object ID\n* Cluster UUID\n* Deployment UUID\n* Kubernetes namespace\n* Data plane key object ID\n* Certificate summary\n* Instance status summary\n",
+        "required": [
+          "object_id",
+          "cluster_uuid",
+          "deployment_uuid",
+          "kubernetes_namespace"
+        ],
         "properties": {
-          "rule": {
-            "description": "The name of the configuration rule that was violated.",
-            "type": "string"
+          "object_id": {
+            "$ref": "#/components/schemas/ControlPlaneObjectID"
           },
-          "info": {
-            "description": "A detailed description of the issue.",
+          "cluster_uuid": {
+            "description": "The Kubernetes UID assigned to the cluster that the product is running in.",
             "type": "string"
           },
-          "severity": {
-            "description": "The severity level of the issue.",
+          "deployment_uuid": {
+            "description": "The Kubernetes UID assigned to the control plane.",
             "type": "string"
           },
-          "category": {
-            "description": "Classification category of the issue.",
+          "key_object_id": {
+            "$ref": "#/components/schemas/DataPlaneKeyObjectID"
+          },
+          "kubernetes_namespace": {
+            "description": "The kubernetes namespace that the product is running in.",
             "type": "string"
           },
-          "documentation": {
-            "description": "Links to documentation that can assist in resolving the identified issue.",
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+          "cert_summary": {
+            "$ref": "#/components/schemas/CertificateInstanceSummary"
           },
-          "where": {
-            "description": "Specific locations in the configuration where issues were detected.",
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/NginxConfigProblem"
-            }
+          "statuses": {
+            "$ref": "#/components/schemas/StatusSummary"
           }
         }
       },
-      "NginxConfigReports": {
-        "type": "array",
-        "items": {
-          "$ref": "#/components/schemas/NginxConfigReport"
+      "ControlPlaneDetails": {
+        "type": "object",
+        "description": "Detailed information of control plane.",
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/ControlPlaneBaseInfo"
+          },
+          {
+            "$ref": "#/components/schemas/ControlPlane"
+          }
+        ],
+        "example": {
+          "name": "foo",
+          "object_id": "ecp_-uvR3F2TQGm18jnl7bpaGw",
+          "product_version": "nginx-ingress-controller-1.0.0",
+          "cluster_uuid": "d1ced6c7-8980-467e-a1db-dcdfec16b1f7",
+          "deployment_uuid": "b9b00e37-5ee4-4361-8c61-1329f3828dd3",
+          "key_object_id": "key_6AT9LXyUQHyhC8kF7bVMgg",
+          "kubernetes_namespace": "nginx-ingress-controller",
+          "cert_summary": {
+            "total": 9,
+            "valid": 1,
+            "expired": 5,
+            "expiring": 3,
+            "not_ready": 0
+          },
+          "statuses": {
+            "offline": 0,
+            "online": 3,
+            "unavailable": 0
+          }
         }
       },
-      "NginxConfigMeta": {
+      "SummaryDisplayCount": {
+        "description": "The name, the total count, and an optional user-friendly display name of the resource being summarized.",
         "type": "object",
-        "description": "Meta data of an NGINX configuration, including its unique identifier, the config_version.\n",
         "required": [
-          "object_id",
-          "config_version",
-          "created_at",
-          "modified_at",
-          "config_source"
+          "name",
+          "count"
         ],
         "properties": {
-          "object_id": {
-            "$ref": "#/components/schemas/NginxConfigObjectID"
-          },
-          "config_version": {
-            "type": "string",
-            "description": "A hash that uniquely identifies the contents of the config object.\n"
-          },
-          "created_at": {
-            "type": "string",
-            "format": "date-time",
-            "description": "The date and time when the NGINX configuration object was created for the instance."
+          "name": {
+            "description": "Identifies the category of data being reported, such as an operating system, NGINX version, or another type.",
+            "type": "string"
           },
-          "modified_at": {
-            "type": "string",
-            "format": "date-time",
-            "description": "The date and time when the NGINX configuration object was last modified for the instance."
+          "count": {
+            "description": "The number of resources matching the given type.",
+            "type": "integer"
           },
-          "config_source": {
-            "type": "string",
-            "enum": [
-              "NGINX One",
-              "Other",
-              "Unspecified"
-            ],
-            "x-enum-varnames": [
-              "config_source_nginx_one",
-              "config_source_other",
-              "config_source_unspecified"
-            ],
-            "description": "The source from which the config was created:\n-  `NGINX One`: The config was created from NGINX One.\n-  `Other`: The config was created from data plane.\n-  `Unspecified`: The source of the config is unspecified.\n"
+          "display": {
+            "description": "A user-friendly label for the category count, intended for display purposes where a more descriptive or readable format is preferred.",
+            "type": "string"
+          }
+        }
+      },
+      "ControlPlaneProductVersionSummary": {
+        "description": "An array of control plane product names/versions.",
+        "type": "array",
+        "items": {
+          "$ref": "#/components/schemas/SummaryDisplayCount"
+        }
+      },
+      "ControlPlaneSummary": {
+        "description": "A summary of control planes including their product names/version details.",
+        "type": "object",
+        "properties": {
+          "product_versions": {
+            "$ref": "#/components/schemas/ControlPlaneProductVersionSummary"
           }
         },
         "example": {
-          "object_id": "nc_AamgWtYSSb6OWGljx3wNDA",
-          "config_version": "Cm1hcCAkdXJpICRtYXBwZWRfc2V",
-          "created_at": "2023-08-10T16:59:15Z",
-          "modified_at": "2023-08-10T16:59:15Z",
-          "config_source": "NGINX One"
+          "product_versions": [
+            {
+              "count": 10,
+              "name": "nginx-ingress-controller-1.0.0"
+            }
+          ]
         }
       },
       "NginxCVEObject": {
@@ -7020,12 +8339,14 @@
             "enum": [
               "instance_cleanup",
               "certificates",
-              "publications"
+              "publications",
+              "nap_compilation_jobs"
             ],
             "x-enum-varnames": [
               "event_type_instance_cleanup",
               "event_type_certificates",
-              "event_type_publications"
+              "event_type_publications",
+              "event_type_nap_compilation_jobs"
             ]
           },
           "object_id": {
@@ -7248,6 +8569,77 @@
           }
         ]
       },
+      "NapSignatureVersion": {
+        "description": "The version of the NGINX App Protect resource.",
+        "type": "string",
+        "example": "2023.12.06"
+      },
+      "NapInstanceAssociation": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/NapAssociation"
+          },
+          {
+            "type": "object",
+            "required": [
+              "threat_campaign_version",
+              "attack_signature_version",
+              "bot_signature_version"
+            ],
+            "properties": {
+              "threat_campaign_version": {
+                "$ref": "#/components/schemas/NapSignatureVersion"
+              },
+              "attack_signature_version": {
+                "$ref": "#/components/schemas/NapSignatureVersion"
+              },
+              "bot_signature_version": {
+                "$ref": "#/components/schemas/NapSignatureVersion"
+              }
+            }
+          }
+        ],
+        "example": {
+          "name": "default_policy",
+          "version": "2025.05.01",
+          "policy_object_id": "pol_panEdeY-Sh2rWm365y7wsw",
+          "policy_version_object_id": "pv_kem7SCosTTOL9mMlNyY2GQ",
+          "publication_object_id": "pub_72pGHoGsSICL_THZrs964g",
+          "paths": [
+            "/etc/nginx/default_policy.tgz"
+          ],
+          "deployment_status": "deployed",
+          "enforcement_mode": "transparent",
+          "deployed_on": "2023-12-06T22:37:24.120114Z",
+          "threat_campaign_version": "2025.01.23",
+          "attack_signature_version": "2025.01.19",
+          "bot_signature_version": "2025.01.19"
+        }
+      },
+      "NginxAppProtectDetails": {
+        "description": "Information regarding NGINX App Protect. Includes version and deployments.\n",
+        "type": "object",
+        "required": [
+          "engine_version",
+          "deployments"
+        ],
+        "properties": {
+          "release_version": {
+            "description": "The release version of NGINX App Protect.",
+            "type": "string"
+          },
+          "engine_version": {
+            "description": "The version of the App Protect enforcement engine.",
+            "type": "string"
+          },
+          "deployments": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/NapInstanceAssociation"
+            }
+          }
+        }
+      },
       "InstanceDetails": {
         "type": "object",
         "description": "Detailed information about an NGINX instance.",
@@ -7270,6 +8662,12 @@
               },
               "config_sync_group": {
                 "$ref": "#/components/schemas/ConfigSyncGroupInstanceMeta"
+              },
+              "nginx_app_protect": {
+                "$ref": "#/components/schemas/NginxAppProtectDetails"
+              },
+              "control_plane": {
+                "$ref": "#/components/schemas/ControlPlaneBaseInfo"
               }
             }
           }
@@ -7293,6 +8691,11 @@
           ],
           "hostname": "4d116619f106",
           "key": "key_wN3IhLCmR3qmwybG_6ptEg",
+          "control_plane": {
+            "object_id": "ecp_CO1DdBxZToWmr3pTcaQ8QA",
+            "name": "nginx-ingress-001",
+            "product_version": "nginx-ingress-controller-4.0.1"
+          },
           "last_reported": "2023-12-06T22:37:24.120114Z",
           "nginx_build": {
             "conf_path": "/etc/nginx/nginx.conf",
@@ -7348,78 +8751,33 @@
           "affected_instances"
         ],
         "properties": {
-          "status": {
-            "$ref": "#/components/schemas/CertificateStatus"
-          },
-          "count": {
-            "description": "The total number of SSL certificates for each status category.",
-            "type": "integer"
-          },
-          "affected_instances": {
-            "description": "Indicates the total number of SSL/TLS certificates corresponding to the status provided.",
-            "type": "integer"
-          }
-        }
-      },
-      "SummaryDisplayCount": {
-        "description": "The name, the total count, and an optional user-friendly display name of the resource being summarized.",
-        "type": "object",
-        "required": [
-          "name",
-          "count"
-        ],
-        "properties": {
-          "name": {
-            "description": "Identifies the category of data being reported, such as an operating system, NGINX version, or another type.",
-            "type": "string"
-          },
-          "count": {
-            "description": "The number of resources matching the given type.",
-            "type": "integer"
-          },
-          "display": {
-            "description": "A user-friendly label for the category count, intended for display purposes where a more descriptive or readable format is preferred.",
-            "type": "string"
-          }
-        }
-      },
-      "OperatingSystemVersionSummary": {
-        "description": "An array summarizing the operating systems and their versions on the NGINX data plane.",
-        "type": "array",
-        "items": {
-          "$ref": "#/components/schemas/SummaryDisplayCount"
-        }
-      },
-      "NGINXVersionSummary": {
-        "description": "An array summarizing the versions of NGINX installed across the NGINX data plane.",
-        "type": "array",
-        "items": {
-          "$ref": "#/components/schemas/SummaryDisplayCount"
-        }
-      },
-      "StatusSummary": {
-        "description": "An overview of the status for each NGINX instance, indicating availability.",
-        "type": "object",
-        "required": [
-          "online",
-          "offline",
-          "unavailable"
-        ],
-        "properties": {
-          "online": {
-            "description": "The number of NGINX instances reporting as `online`.\nThe NGINX Agent is connected to NGINX One, and the NGINX instance is online.\n",
-            "type": "integer"
+          "status": {
+            "$ref": "#/components/schemas/CertificateStatus"
           },
-          "offline": {
-            "description": "The number of NGINX instances reporting as `offline`.\nThe NGINX Agent is connected to NGINX One, but the NGINX instance is offline.\n",
+          "count": {
+            "description": "The total number of SSL certificates for each status category.",
             "type": "integer"
           },
-          "unavailable": {
-            "description": "The number of NGINX instances reporting as `unavailable`.\nThe NGINX Agent has lost connection to NGINX One, rendering the NGINX instance unavailable.\n",
+          "affected_instances": {
+            "description": "Indicates the total number of SSL/TLS certificates corresponding to the status provided.",
             "type": "integer"
           }
         }
       },
+      "OperatingSystemVersionSummary": {
+        "description": "An array of operating systems and their versions on the NGINX data plane.",
+        "type": "array",
+        "items": {
+          "$ref": "#/components/schemas/SummaryDisplayCount"
+        }
+      },
+      "NGINXVersionSummary": {
+        "description": "An array of NGINX versions installed across the NGINX data plane.",
+        "type": "array",
+        "items": {
+          "$ref": "#/components/schemas/SummaryDisplayCount"
+        }
+      },
       "CveSummary": {
         "description": "A summary of Common Vulnerabilities and Exposures (CVEs) across the NGINX data plane.",
         "type": "object",
@@ -7689,51 +9047,6 @@
           "object_id": "sc_Tet21AeYTHCj7taOwVfzyw"
         }
       },
-      "StagedConfigBulkRequestData": {
-        "type": "object",
-        "description": "Part of bulk operation on a staged config, only `delete` is supported.",
-        "required": [
-          "action",
-          "object_id"
-        ],
-        "properties": {
-          "object_id": {
-            "$ref": "#/components/schemas/StagedConfigObjectID"
-          },
-          "action": {
-            "$ref": "#/components/schemas/BulkRequestAction"
-          }
-        },
-        "example": {
-          "object_id": "sc_-uvR3F2TQGm18jnl7bpaGw",
-          "action": "delete"
-        }
-      },
-      "StagedConfigBulkRequest": {
-        "type": "array",
-        "items": {
-          "$ref": "#/components/schemas/StagedConfigBulkRequestData"
-        },
-        "minItems": 1,
-        "maxItems": 50,
-        "example": [
-          {
-            "object_id": "sc_-uvR3F2TQGm18jnl7bpaGw",
-            "action": "delete"
-          },
-          {
-            "object_id": "sc_PL0c1XodRemmzVEjiXSsTg",
-            "action": "delete"
-          }
-        ]
-      },
-      "StagedConfigBulkResponse": {
-        "description": "The staged config bulk outcome.",
-        "type": "array",
-        "items": {
-          "$ref": "#/components/schemas/BulkRequestObjectStatus"
-        }
-      },
       "StagedConfigResponse": {
         "description": "Get an NGINX staged config.",
         "required": [
@@ -7812,35 +9125,6 @@
           }
         }
       },
-      "StagedConfigImportRequest": {
-        "type": "object",
-        "description": "Body to import a NGINX staged config",
-        "required": [
-          "name",
-          "file",
-          "conf_path"
-        ],
-        "properties": {
-          "name": {
-            "$ref": "#/components/schemas/StagedConfigName"
-          },
-          "file": {
-            "type": "string",
-            "format": "binary",
-            "example": "my-staged-config.tar.gz",
-            "maxLength": 5242880
-          },
-          "conf_path": {
-            "$ref": "#/components/schemas/ConfigPath"
-          }
-        },
-        "example": {
-          "name": "my-nginx-config",
-          "file": "my-staged-config.tar.gz",
-          "conf_path": "/etc/nginx/nginx.conf",
-          "parse_only": true
-        }
-      },
       "MetricQueryResultEx": {
         "type": "object",
         "required": [
@@ -8626,39 +9910,6 @@
           "k8s.cluster.nodes"
         ]
       },
-      "NapPolicyEnforcementMode": {
-        "description": "The current enforcement mode of the NGINX App Protect policy, with the following possible values:\n* `blocking` - Any illegal or suspicious requests are logged and blocked.\n* `transparent` - Any illegal or suspicious requests are logged but not blocked.\n",
-        "type": "string",
-        "enum": [
-          "blocking",
-          "transparent"
-        ],
-        "x-enum-varnames": [
-          "nap_enforcement_mode_blocking",
-          "nap_enforcement_mode_transparent"
-        ]
-      },
-      "NapDeploymentStatus": {
-        "description": "The current enforcement mode of the NGINX App Protect policy, with the following possible values:\n* `deployed` - The NGINX App Protect policy has been deployed.\n* `not_deployed` - The NGINX App Protect policy has not been deployed.\n* `deploying` - The NGINX App Protect policy is currently being deployed.\n* `failed` - The NGINX App Protect policy failed deploying.\n",
-        "type": "string",
-        "enum": [
-          "deployed",
-          "not_deployed",
-          "deploying",
-          "failed"
-        ],
-        "x-enum-varnames": [
-          "nap_deployment_status_deployed",
-          "nap_deployment_status_not_deployed",
-          "nap_deployment_status_deploying",
-          "nap_deployment_status_failed"
-        ]
-      },
-      "Version": {
-        "description": "The version of the NGINX App Protect resource.",
-        "type": "string",
-        "example": "2023.12.06"
-      },
       "VersionsList": {
         "type": "object",
         "required": [
@@ -8669,21 +9920,18 @@
             "description": "An array of versions.",
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/Version"
+              "$ref": "#/components/schemas/NapSignatureVersion"
             }
           }
         }
       },
       "ThreatCampaignVersionsListResponse": {
-        "description": "List of Threat Campaign versions.",
         "$ref": "#/components/schemas/VersionsList"
       },
       "AttackSignatureVersionsListResponse": {
-        "description": "List of Attack Signature versions.",
         "$ref": "#/components/schemas/VersionsList"
       },
       "BotSignatureVersionsListResponse": {
-        "description": "List of Bot Signature versions.",
         "$ref": "#/components/schemas/VersionsList"
       },
       "NapPolicy": {
@@ -8778,7 +10026,7 @@
                   "latest": {
                     "object_id": "pv_-uvR3F2TQGm18jnl7bpaGw",
                     "version": "2023-12-06 22:37:24",
-                    "created_on": "2023-12-06T22:37:24.120114Z",
+                    "created_at": "2023-12-06T22:37:24.120114Z",
                     "deployment_status": "deployed",
                     "enforcement_mode": "blocking"
                   }
@@ -8839,7 +10087,7 @@
                 "$ref": "#/components/schemas/NapDeploymentStatus"
               },
               "deployed_on": {
-                "description": "Date and time.",
+                "description": "Date and time of the deployment.",
                 "type": "string",
                 "format": "date-time"
               }
@@ -8944,13 +10192,13 @@
             "type": "object",
             "properties": {
               "threat_campaign_version": {
-                "$ref": "#/components/schemas/Version"
+                "$ref": "#/components/schemas/NapSignatureVersion"
               },
               "attack_signature_version": {
-                "$ref": "#/components/schemas/Version"
+                "$ref": "#/components/schemas/NapSignatureVersion"
               },
               "bot_signature_version": {
-                "$ref": "#/components/schemas/Version"
+                "$ref": "#/components/schemas/NapSignatureVersion"
               }
             }
           }
@@ -9018,19 +10266,19 @@
           "object_id",
           "version",
           "enforcement_mode",
-          "created_on"
+          "created_at"
         ],
         "properties": {
           "object_id": {
             "$ref": "#/components/schemas/NapPolicyVersionObjectID"
           },
           "version": {
-            "$ref": "#/components/schemas/Version"
+            "$ref": "#/components/schemas/NapSignatureVersion"
           },
           "enforcement_mode": {
             "$ref": "#/components/schemas/NapPolicyEnforcementMode"
           },
-          "created_on": {
+          "created_at": {
             "description": "The date and time when the NGINX App Protect policy version was created.",
             "type": "string",
             "format": "date-time"
@@ -9045,7 +10293,7 @@
           "object_id",
           "version",
           "enforcement_mode",
-          "created_on"
+          "created_at"
         ],
         "allOf": [
           {
@@ -9108,7 +10356,7 @@
                 {
                   "version": "2023-12-06 22:37:24",
                   "object_id": "pv_-uvR3F2TQGm18jnl7bpaGw",
-                  "created_on": "2023-12-06T22:37:24.120114Z",
+                  "created_at": "2023-12-06T22:37:24.120114Z",
                   "enforcement_mode": "blocking",
                   "latest": false
                 }
@@ -9243,28 +10491,101 @@
           }
         }
       },
-      "NapPolicyObjectID": {
-        "description": "A globally unique identifier for the App Protect policy.",
-        "type": "string",
-        "format": "object_id",
-        "pattern": "^pol_.*",
-        "x-go-type": "objects.ID",
-        "x-go-type-import": {
-          "name": "objects",
-          "path": "gitlab.com/f5/nginx/one/saas/control-plane/pkg/collections/objects"
+      "NapPolicyBulkRequest": {
+        "type": "array",
+        "items": {
+          "$ref": "#/components/schemas/NapPolicyBulkRequestData"
+        },
+        "minItems": 1,
+        "maxItems": 50,
+        "example": [
+          {
+            "object_id": "pol_-uvR3F2TQGm18jnl7bpaGw",
+            "action": "delete"
+          },
+          {
+            "object_id": "pol_PL0c1XodRemmzVEjiXSsTg",
+            "action": "delete"
+          }
+        ]
+      },
+      "NapPolicyBulkRequestData": {
+        "type": "object",
+        "description": "Part of bulk operation on a Nap policy, only `delete` is supported.",
+        "required": [
+          "action",
+          "object_id"
+        ],
+        "properties": {
+          "object_id": {
+            "$ref": "#/components/schemas/NapPolicyObjectID"
+          },
+          "action": {
+            "$ref": "#/components/schemas/BulkRequestAction"
+          }
+        },
+        "example": {
+          "object_id": "pol_-uvR3F2TQGm18jnl7bpaGw",
+          "action": "delete"
         }
       },
-      "NapPolicyVersionObjectID": {
-        "description": "A globally unique identifier for the App Protect policy version.",
-        "type": "string",
-        "format": "object_id",
-        "pattern": "^pv_.*",
-        "x-go-type": "objects.ID",
-        "x-go-type-import": {
-          "name": "objects",
-          "path": "gitlab.com/f5/nginx/one/saas/control-plane/pkg/collections/objects"
+      "NapBulkResponse": {
+        "description": "The Nap policy bulk outcome.",
+        "type": "array",
+        "items": {
+          "$ref": "#/components/schemas/BulkRequestObjectStatus"
         }
       },
+      "FilterNameNapPolicy": {
+        "type": "string",
+        "description": "Keywords for NGINX App Protect policy filters.\nWhen filtering on `enforcement_mode`, only the following `filter_values` are supported:\n  * blocking\n  * transparent\nWhen filtering on `object_id`, both NAP Policy and NAP Policy version object id prefixes are supported.\n",
+        "enum": [
+          "name",
+          "enforcement_mode",
+          "object_id",
+          "deployment_enforcement_mode",
+          "deployment_status"
+        ],
+        "x-enum-varnames": [
+          "filter_name_nap_policy_name",
+          "filter_name_nap_policy_enforcement_mode",
+          "filter_name_nap_policy_object_id",
+          "filter_name_nap_policy_deployment_enforcement_mode",
+          "filter_name_nap_policy_deployment_status"
+        ]
+      },
+      "FilterNameNapPolicyDeployment": {
+        "type": "string",
+        "description": "Keywords for NGINX App Protect deployment filters.\nWhen filtering on `type`, only the following `filter_values` are supported:\n  * instance\n  * config_sync_group\nWhen filtering on `status`, only the following `filter_values` are supported:\n  * deployed\n  * deploying\n  * failed\n",
+        "enum": [
+          "name",
+          "type",
+          "policy_version",
+          "status",
+          "object_id"
+        ],
+        "x-enum-varnames": [
+          "filter_name_nap_deployment_name",
+          "filter_name_nap_deployment_type",
+          "filter_name_nap_deployment_policy_version",
+          "filter_name_nap_deployment_status",
+          "filter_name_nap_deployment_object_id"
+        ]
+      },
+      "FilterNameNapPolicyVersion": {
+        "type": "string",
+        "description": "Keywords for NGINX App Protect policy version filters.\nWhen filtering on `deployment_status`, only the following `filter_values` are supported:\n  * deployed\n  * not_deployed\n  * deploying\n  * failed\nWhen filtering on `enforcement_mode`, only the following `filter_values` are supported:\n  * blocking\n  * transparent\n",
+        "enum": [
+          "deployment_status",
+          "enforcement_mode",
+          "object_id"
+        ],
+        "x-enum-varnames": [
+          "filter_name_nap_policy_version_deployment_status",
+          "filter_name_nap_policy_version_enforcement_mode",
+          "filter_name_nap_policy_version_object_id"
+        ]
+      },
       "NapLogProfileObjectID": {
         "description": "A globally unique identifier for the App Protect log profile.",
         "type": "string",
@@ -9303,7 +10624,8 @@
               "revoked": false,
               "name": "my-data-plane-key",
               "object_id": "key_wN3IhLCmR3qmwybG_6ptEg",
-              "instances_count": 3
+              "instances_count": 3,
+              "control_planes_count": 1
             },
             {
               "expires_at": "2023-12-01T00:00:00Z",
@@ -9312,7 +10634,8 @@
               "revoked": false,
               "name": "my-data-plane-key",
               "object_id": "key_Tet21AeYTHCj7taOwVfzyw",
-              "instances_count": 3
+              "instances_count": 3,
+              "control_planes_count": 1
             }
           ]
         }
@@ -9339,13 +10662,57 @@
           "revoked": false,
           "name": "my-data-plane-key",
           "object_id": "key_wN3IhLCmR3qmwybG_6ptEg",
-          "instances_count": 3
+          "instances_count": 3,
+          "control_planes_count": 1
+        }
+      },
+      "ConfigSyncGroupDetails": {
+        "value": {
+          "object_id": "csg_-uvR3F2TQGm18jnl7bpaGw",
+          "name": "test-config-sync-group",
+          "last_reported": "2023-12-06T22:37:24.120114Z",
+          "config_status": "in_sync",
+          "config_version": "uvR3F2TQGm18jnl7bpaGw",
+          "instances": [
+            {
+              "object_id": "inst_-uvR3F2TQGm18jnl7bpaGw",
+              "hostname": "816e3c194d59",
+              "system_id": "6066aad2-211e-3718-be5d-fcc01ffc5cc8",
+              "agent_version": "v2.33.0",
+              "registered_at": "2024-05-16T18:26:40.556048Z",
+              "last_reported": "2023-12-06T22:37:24.120114Z",
+              "status": "unavailable",
+              "nginx_build": {
+                "conf_path": "/etc/nginx/nginx.conf",
+                "version": "1.25.3"
+              },
+              "os_version": "Ubuntu 22.04",
+              "nginx_id": "b636d4376dea15405589692d3c5d3869ff3a9b26b0e7bb4bb1aa7e658ace1437",
+              "config_status": "in_sync",
+              "config_version": "abc123def456"
+            }
+          ],
+          "certs": [
+            {
+              "subject_name": "test.com",
+              "name": "client",
+              "cert_type": "cert_key",
+              "not_after": "2024-01-06T00:01:30Z",
+              "not_before": "2023-12-07T00:01:30Z",
+              "cert_paths": [
+                "/etc/nginx/client.pem"
+              ],
+              "cert_status": "expiring",
+              "deployment_status": "latest",
+              "object_id": "cert_Tet21AeYTHCj7taOwVfzyw"
+            }
+          ]
         }
       }
     },
     "responses": {
-      "InvalidRequest": {
-        "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+      "Unauthorized": {
+        "description": "Client is not authorized to perform the requested operation.",
         "content": {
           "application/json": {
             "schema": {
@@ -9363,6 +10730,26 @@
             }
           }
         }
+      },
+      "NotFound": {
+        "description": "Requested resource was not found.",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Error"
+            }
+          }
+        }
+      },
+      "InvalidRequest": {
+        "description": "Request cannot be processed due to invalid input or parameters. Verify the request format and provided data.",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Error"
+            }
+          }
+        }
       }
     },
     "securitySchemes": {
@@ -9388,7 +10775,8 @@
         "Certificates",
         "CVEs",
         "Events",
-        "Staged Configs"
+        "Staged Configs",
+        "Control Planes"
       ]
     },
     {
@@ -9402,6 +10790,12 @@
       "tags": [
         "Settings"
       ]
+    },
+    {
+      "name": "NGINX One App Protect",
+      "tags": [
+        "NGINX App Protect"
+      ]
     }
   ]
 }
\ No newline at end of file

From 8545aa1b9b55103dc229e480708a75df73801139 Mon Sep 17 00:00:00 2001
From: Mike Jang <3287976+mjang@users.noreply.github.com>
Date: Tue, 15 Jul 2025 10:23:06 -0700
Subject: [PATCH 116/117] feature: incorporate NIC into NGINX 1 Console (not
 yet for NGF) (#736)

* feature: incorporate NIC and NGF into NGINX 1 Console

* Include changelog

Co-authored-by: Alan Dooley <a.dooley@f5.com>

Co-authored-by: Jodie Putrino <jputrino@users.noreply.github.com>

Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>

Co-authored-by: Sylvia Wang <139922338+sylwang@users.noreply.github.com>

---------

Co-authored-by: Sylvia Wang <139922338+sylwang@users.noreply.github.com>
---
 content/nginx-one/_index.md       |   3 +
 content/nginx-one/api/_index.md   |   2 +-
 content/nginx-one/changelog.md    |   7 ++
 content/nginx-one/glossary.md     |   5 +-
 content/nginx-one/k8s/_index.md   |   8 ++
 content/nginx-one/k8s/add-nic.md  | 159 ++++++++++++++++++++++++++++++
 content/nginx-one/k8s/overview.md |  19 ++++
 7 files changed, 199 insertions(+), 4 deletions(-)
 create mode 100644 content/nginx-one/k8s/_index.md
 create mode 100644 content/nginx-one/k8s/add-nic.md
 create mode 100644 content/nginx-one/k8s/overview.md

diff --git a/content/nginx-one/_index.md b/content/nginx-one/_index.md
index 34a88e88e..624af7c04 100644
--- a/content/nginx-one/_index.md
+++ b/content/nginx-one/_index.md
@@ -40,6 +40,9 @@ F5 NGINX One Console makes it easy to manage NGINX instances across locations an
     {{<card title="Secure with NGINX App Protect" titleUrl="/nginx-one/nap-integration/" >}}
       Manage one instance or groups of instances. Monitor certificates. Set up metrics.
     {{</card>}}
+    {{<card title="Connect Kubernetes deployments" titleUrl="/nginx-one/k8s/">}}
+      Monitor deployments for CVEs and certificates
+    {{</ card >}}
     {{<card title="Organize users with RBAC" titleUrl="/nginx-one/rbac/" >}}
       Assign responsibilities with role-based access control 
     {{</card>}}
diff --git a/content/nginx-one/api/_index.md b/content/nginx-one/api/_index.md
index 5b3284d5e..3a1598f3f 100644
--- a/content/nginx-one/api/_index.md
+++ b/content/nginx-one/api/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Automate with the NGINX One API
 description:
-weight: 700
+weight: 800
 url: /nginx-one/api
 ---
diff --git a/content/nginx-one/changelog.md b/content/nginx-one/changelog.md
index 1c38199b4..e66dd29f8 100644
--- a/content/nginx-one/changelog.md
+++ b/content/nginx-one/changelog.md
@@ -41,6 +41,13 @@ In NGINX One Console, you can:
 - Toggle between [Default policy bundles]({{< ref "/nap-waf/v5/configuration-guide/configuration/#updating-default-policy-bundles" >}})
 - Set a blocking or transparant [Policy enforcement mode]({{< ref "/nap-waf/v5/configuration-guide/configuration/#policy-enforcement-modes" >}})
 
+### Monitor F5 NGINX Ingress Controller deployments
+
+You can now monitor your NGINX Ingress Controller deployments. For details, see how
+you can [Connect to NGINX One Console]({{< ref "/nginx-one/k8s/add-nic.md" >}}).
+
+Unlike other NGINX instances, when you connect NGINX Ingress Controller to NGINX One Console, access is read-only. Refer to our [NGINX Ingress Controller]({{< ref "/nic/" >}}) for details on how to modify these instances.
+
 ## July 1, 2025
 
 ### NGINX Agent version 3 support
diff --git a/content/nginx-one/glossary.md b/content/nginx-one/glossary.md
index fe3608390..06c017cd3 100644
--- a/content/nginx-one/glossary.md
+++ b/content/nginx-one/glossary.md
@@ -3,9 +3,8 @@ description: ''
 nd-docs: DOCS-1396
 title: Glossary
 toc: true
-weight: 800
-type:
-- reference
+weight: 1000
+nd-content-type: reference
 ---
 
 This glossary defines terms used in the F5 NGINX One Console and F5 Distributed Cloud.
diff --git a/content/nginx-one/k8s/_index.md b/content/nginx-one/k8s/_index.md
new file mode 100644
index 000000000..794456588
--- /dev/null
+++ b/content/nginx-one/k8s/_index.md
@@ -0,0 +1,8 @@
+---
+title: Connect Kubernetes deployments
+description:
+weight: 700
+url: /nginx-one/k8s
+nd-product: NGINX One
+---
+
diff --git a/content/nginx-one/k8s/add-nic.md b/content/nginx-one/k8s/add-nic.md
new file mode 100644
index 000000000..23619c6d2
--- /dev/null
+++ b/content/nginx-one/k8s/add-nic.md
@@ -0,0 +1,159 @@
+---
+title: Connect to NGINX One Console
+toc: true
+weight: 200
+nd-content-type: how-to
+nd-product: NGINX One
+---
+
+This document explains how to connect F5 NGINX Ingress Controller <!-- and F5 NGINX Gateway Fabric -->to F5 NGINX One Console using NGINX Agent.
+Connecting NGINX Ingress Controller to NGINX One Console enables centralized monitoring of all controller instances.
+
+Once connected, you'll see a **read-only** configuration of NGINX Ingress Controller. For each instance, you can review:
+
+- Read-only configuration file
+- Unmanaged SSL/TLS certificates for Control Planes
+
+## Before you begin
+
+Before connecting NGINX Ingress Controller to NGINX One Console, you need to create a Kubernetes Secret with the data plane key. Use the following command:
+
+```shell
+kubectl create secret generic dataplane-key \
+  --from-literal=dataplane.key=<Your Dataplane Key> \
+  -n <namespace>
+```
+
+When you create a Kubernetes Secret, use the same namespace where NGINX Ingress Controller is running. 
+If you use [`-watch-namespace`]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#watch-namespace-string" >}}) or [`watch-secret-namespace`]({{< ref "/nic/configuration/global-configuration/command-line-arguments.md#watch-secret-namespace-string" >}}) arguments with NGINX Ingress Controller, 
+you need to add the dataplane key secret to the watched namespaces. This secret will take approximately 60 - 90 seconds to reload on the pod.
+
+{{<note>}}
+You can also create a data plane key through the NGINX One Console. Once loggged in, select **Manage > Control Planes > Add Control Plane**, and follow the steps shown.
+{{</note>}}
+
+## Deploy NGINX Ingress Controller with NGINX Agent
+
+{{<tabs name="deploy-config-resource">}}
+{{%tab name="Helm"%}}
+
+Edit your `values.yaml` file to enable NGINX Agent and configure it to connect to NGINX One Console:
+
+```yaml
+nginxAgent:
+  enable: true
+  dataplaneKeySecretName: "<data_plane_key_secret_name>"
+```
+
+The `dataplaneKeySecretName` is used to authenticate the agent with NGINX One Console. See the [NGINX One Console Docs]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
+for instructions on how to generate your dataplane key from the NGINX One Console.
+
+Follow the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) instructions to deploy NGINX Ingress Controller.
+
+{{%/tab%}}
+{{%tab name="Manifests"%}}
+
+Add the following flag to the Deployment/DaemonSet file of NGINX Ingress Controller:
+
+```yaml
+args:
+- -agent=true
+```
+
+Create a `ConfigMap` with an `nginx-agent.conf` file:
+
+```yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: nginx-agent-config
+  namespace: <namespace>
+data:
+  nginx-agent.conf: |-
+    log:
+      # set log level (error, info, debug; default "info")
+      level: info
+      # set log path. if empty, don't log to file.
+      path: ""
+  
+    allowed_directories:
+      - /etc/nginx
+      - /usr/lib/nginx/modules
+  
+    features:
+      - certificates
+      - connection
+      - metrics
+      - file-watcher
+  
+    ## command server settings
+    command:
+      server:
+        host: product.connect.nginx.com
+        port: 443
+      auth:
+        tokenpath: "/etc/nginx-agent/secrets/dataplane.key"
+      tls:
+        skip_verify: false
+```      
+
+Make sure to set the namespace in the nginx-agent.config to the same namespace as NGINX Ingress Controller.
+Mount the ConfigMap to the Deployment/DaemonSet file of NGINX Ingress Controller:
+
+```yaml
+volumeMounts:
+- name: nginx-agent-config
+  mountPath: /etc/nginx-agent/nginx-agent.conf
+  subPath: nginx-agent.conf
+- name: dataplane-key
+  mountPath: /etc/nginx-agent/secrets
+volumes:
+- name: nginx-agent-config
+  configMap:
+    name: nginx-agent-config
+- name: dataplane-key
+  secret:
+    secretName: "<data_plane_key_secret_name>"
+```
+
+Follow the [Installation with Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) instructions to deploy NGINX Ingress Controller.
+
+{{%/tab%}}
+{{</tabs>}}
+
+## Verify a connection to NGINX One Console
+
+After deploying NGINX Ingress Controller <!-- or NGINX Gateway Fabric --> with NGINX Agent, you can verify the connection to NGINX One Console.
+Log in to your F5 Distributed Cloud Console account. Select **NGINX One > Visit Service**. In the dashboard, go to **Manage > Instances**. You should see your instances listed by name. The instance name matches both the hostname and the pod name.
+
+## Troubleshooting
+
+If you encounter issues connecting your instances to NGINX One Console, try the following commands:
+
+Check the NGINX Agent version:
+
+```shell
+kubectl exec -it -n <namespace> <nginx_ingress_pod_name> -- nginx-agent -v
+```
+  
+If nginx-agent version is v3, continue with the following steps.
+Otherwise, make sure you are using an image that does not include NGINX App Protect. 
+
+Check the NGINX Agent configuration:
+
+```shell
+kubectl exec -it -n <namespace> <nginx_ingress_pod_name> -- cat /etc/nginx-agent/nginx-agent.conf
+```
+
+Check NGINX Agent logs:
+
+```shell
+kubectl exec -it -n <namespace> <nginx_ingress_pod_name> -- nginx-agent
+```
+
+Select the instance associated with your deployment of NGINX Ingress Controller. Under the **Details** tab, you'll see information associated with:
+
+- Unmanaged SSL/TLS certificates for Control Planes 
+- Configuration recommendations 
+
+Under the **Configuration** tab, you'll see a **read-only** view of the configuration files.
diff --git a/content/nginx-one/k8s/overview.md b/content/nginx-one/k8s/overview.md
new file mode 100644
index 000000000..b2da7f2d1
--- /dev/null
+++ b/content/nginx-one/k8s/overview.md
@@ -0,0 +1,19 @@
+---
+# We use sentence case and present imperative tone
+title: "Integrate Kubernetes control planes"
+# Weights are assigned in increments of 100: determines sorting order
+weight: 100
+# Creates a table of contents and sidebar, useful for large documents
+toc: false
+# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
+nd-content-type: concept
+# Intended for internal catalogue and search, case sensitive:
+# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
+nd-product: NGINX One
+---
+
+You can now include Kubernetes systems through the [control plane](https://www.f5.com/glossary/control-plane). In related documentation, you can learn how to:
+
+- Set up a connection to F5 NGINX One Console through a data plane key.
+- Review the NGINX Ingress Controller instances that are part of your fleet.
+

From acf450ecacc42bc15a52df22439a45e66780f7b8 Mon Sep 17 00:00:00 2001
From: Benjamin Jee <b.jee@f5.com>
Date: Tue, 15 Jul 2025 12:14:12 -0700
Subject: [PATCH 117/117] Update gateway-api compatibility docs

---
 content/ngf/overview/gateway-api-compatibility.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/content/ngf/overview/gateway-api-compatibility.md b/content/ngf/overview/gateway-api-compatibility.md
index 5638ed596..77caabb80 100644
--- a/content/ngf/overview/gateway-api-compatibility.md
+++ b/content/ngf/overview/gateway-api-compatibility.md
@@ -167,7 +167,7 @@ See the [controller]({{< ref "/ngf/reference/cli-help.md#controller">}}) command
       - `requestHeaderModifier`: Supported. If multiple filters are configured, NGINX Gateway Fabric will choose the first and ignore the rest.
       - `urlRewrite`: Supported. If multiple filters are configured, NGINX Gateway Fabric will choose the first and ignore the rest. Incompatible with `requestRedirect`.
       - `responseHeaderModifier`: Supported. If multiple filters are configured, NGINX Gateway Fabric will choose the first and ignore the rest.
-      - `requestMirror`: Supported. Multiple mirrors can be specified.
+      - `requestMirror`: Supported. Multiple mirrors can be specified. Percent and fraction-based mirroring are supported.
       - `extensionRef`: Supported for SnippetsFilters.
     - `backendRefs`: Partially supported. Backend ref `filters` are not supported.
 - `status`
@@ -189,6 +189,7 @@ See the [controller]({{< ref "/ngf/reference/cli-help.md#controller">}}) command
       - `ResolvedRefs/False/BackendNotFound`
       - `ResolvedRefs/False/UnsupportedValue`: Custom reason for when one of the HTTPRoute rules has a backendRef with an unsupported value.
       - `ResolvedRefs/False/InvalidIPFamily`: Custom reason for when one of the HTTPRoute rules has a backendRef that has an invalid IPFamily.
+      - `ResolvedRefs/False/UnsupportedProtocol`
       - `PartiallyInvalid/True/UnsupportedValue`
 
 ### GRPCRoute